GDPR Articles Index: All 99 Articles and How to Use Them

The GDPR contains 99 articles in 11 chapters, supported by 173 recitals. This index covers every article number and explains how the chapters fit together. The tables provide a quick route to a provision; the commentary shows which questions to ask before applying it. Links lead to selected practical guides, rather than implying that every provision has a separate article on this site.

Use the official GDPR text on EUR-Lex as the legal reference. Recitals help interpret the operative provisions but do not independently replace their conditions. Court judgments, applicable national legislation and regulatory guidance may then clarify a particular issue. An article number is a starting point for analysis, not proof that an organisation has satisfied the obligation it names.

For programme planning, use the data privacy compliance guide; for evidence and review, use the GDPR audit methodology. An effective review follows actual processing from collection to deletion, identifying the provisions that apply at each stage. There is no reliable shortcut under which compliance with a handful of articles removes a fixed percentage of enforcement exposure.

Chapter I: scope and definitions, Articles 1–4

Begin with whether the activity falls within the Regulation. Article 2 addresses material scope and exclusions, including the distinction between automated processing and certain structured non-automated records. Article 3 then addresses territorial scope. A business does not escape the GDPR merely because its headquarters are outside the EU; equally, a website being accessible from Europe does not by itself resolve all the territorial criteria. The guide to GDPR outside the EU develops that assessment.

Article 4 supplies definitions used throughout the instrument. Establish whether information relates to an identifiable person, what operations are being performed and who determines their purposes and essential means. The Article 4 definitions guide is useful when a project uses labels such as anonymous data, processor or consent loosely. Incorrect classification at this stage can distort the later choice of contract, security controls or transfer mechanism.

Document the facts that support your classification. A supplier may process some information on a customer’s behalf while acting independently for a different purpose. A dataset without names can still contain personal data if people remain identifiable. Resolve those questions for the operation being examined, instead of assigning one label permanently to every relationship or system within the organisation.

Chapter II: principles and lawful processing, Articles 5–11

Article 5 combines the substantive principles with accountability. The data privacy principles operate together: a lawful basis does not excuse excessive collection or indefinite retention. Read purpose limitation, data minimisation, accuracy and storage limitation against the actual activity. Accountability then requires the controller to demonstrate compliance, rather than merely describe an intention to comply.

Choose the applicable Article 6 lawful basis for each purpose before processing begins. If relying on consent, examine the Article 7 conditions, including proof and withdrawal. If relying on legitimate interests, assess necessity and the balancing of interests and rights; the legitimate-interest guide explains that route. Neither basis is a universal substitute for checking the rules governing a specific channel or sector.

Article 8 addresses consent for information society services offered directly to children, rather than every use of children’s data. Its parental-authorisation requirement does not apply to preventive or counselling services offered directly to a child, as explained in the EDPB’s final consent guidance using Recital 38. Article 9 adds a separate condition for special categories: an Article 6 basis alone is insufficient. Use the special-categories guide to identify the relevant exception and safeguards. Article 10 treats criminal-conviction and offence data separately. Article 11 addresses processing that does not require identification; it does not authorise collecting extra identifiers solely to make every possible future rights request easier.

Chapter III: information and individual rights, Articles 12–23

Start with Article 12 transparency and response rules. Information must be understandable and accessible, and requests must be facilitated. The general response period is without undue delay and within one month, with a qualified extension of up to two further months for complexity and number, with notice and reasons within the first month. If the controller does not act, reasons and complaint and judicial-remedy information are due without delay and within one month; that initial refusal notice is not postponed by the general extension.

Article 13 concerns collection from the individual; Article 14 concerns information obtained elsewhere. The latter has its own timing rules and exceptions. A privacy notice is not itself a lawful basis, and publishing one does not prove that people received the required information. Match the notice to the actual purposes, recipients, retention and transfer arrangements.

The rights also have different conditions. Access is not identical to portability, while erasure has grounds and exceptions that must be assessed individually. Restriction can matter while an accuracy dispute or objection is being examined. Article 19 connects rectification, erasure and restriction to notifications to recipients, subject to its qualifications; completing an internal change may therefore leave a further step outstanding.

Under Article 21, distinguish objections relating to a person’s particular situation from the absolute right to stop processing for direct marketing. Article 22 concerns solely automated decisions producing legal or similarly significant effects, with its exceptions and safeguards. It does not make every automated tool or profiling operation unlawful. Article 23 permits specified legislative restrictions subject to conditions; an organisation cannot create an equivalent exception simply by writing one into its terms.

Chapter IV: responsibility and operational controls, Articles 24–43

Article 24 establishes controller responsibility, and Article 25 requires data protection by design and by default. Articles 26 and 28 then address different relationships: joint controllers determine purposes and means jointly; processors act on behalf of controllers. Review the processor obligations and data processing agreement guide after determining the roles. The Article 28 arrangement may be a written contract or another binding Union or Member-State legal act, including electronic form.

Article 30 records help describe the processing, but maintaining a record of processing activities does not make the processing lawful. The under-250 exception is qualified: non-occasional processing, processing likely to risk individuals, Article 9 special categories and Article 10 conviction or offence data are relevant exclusions from that exception. Assess the activities concerned instead of declaring an entire small business exempt.

Article 32 security requires measures appropriate to risk. Following a personal-data breach, Article 33 requires authority notification without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to risk individuals. Explain delay and document every personal-data breach. Article 34 communication is a separate high-risk assessment, with statutory exceptions. A technical incident and a personal-data breach are not automatically the same thing.

A data protection impact assessment under Article 35 examines likely high-risk processing before it starts. If high residual risk remains without sufficient measures, Article 36 requires prior consultation. Articles 37–39 separately address DPO designation, position and tasks. The DPO job-description guide helps translate that role into responsibilities without transferring the controller’s accountability to the DPO. DPO designation is mandatory for public authorities or bodies, except courts acting judicially, and for the specified core activities involving regular and systematic monitoring on a large scale or large-scale Article 9 or 10 processing. National law may add requirements. Assess these conditions separately from whether appointing a DPO would be useful. Codes and certification under Articles 40–43 do not remove the controller’s or processor’s own legal responsibility.

Chapter V: international transfers, Articles 44–50

Article 44 requires the Chapter V conditions to be met alongside the rest of the GDPR. Identify the recipient, location and actual disclosure or access before selecting a mechanism. A European billing address or storage region is not a complete transfer assessment. The cross-border transfers guide provides the broader workflow, while the French-language Swiss data-protection guide offers a country-specific comparison; Switzerland should not be treated as an EU Member State.

Article 45 concerns adequacy decisions, and Article 46 concerns appropriate safeguards. Standard contractual clauses are one route; Article 47 provides the detailed rules for binding corporate rules. Compare BCRs, SCCs and the DPF only after verifying which mechanism actually covers the recipient and transfer. A transfer impact assessment helps examine relevant third-country circumstances where that assessment is required; it is not a replacement for an applicable mechanism.

Article 48 addresses third-country court or administrative demands, while Article 49 provides derogations for specific situations. Do not use an exceptional route as an unexplained permanent solution for routine transfers. Article 50 concerns international cooperation. These provisions show why a supplier review must consider both the initial disclosure and later demands or onward transfers, rather than stopping once a contract has been signed.

Chapter VI: supervisory authorities, Articles 51–59

These articles establish independent supervisory authorities and their functions, powers and competence. The supervisory-authority guide explains their role. Article 58 includes investigative and corrective powers, not just fines: orders to change processing, meet rights requests or suspend transfers can affect daily operations. Preparing reliable evidence therefore matters even when a financial penalty is not the immediate issue.

The competent authority is determined by the applicable rules, including the qualified arrangements for cross-border processing; it is not selected solely by the company’s preference. The French-language guide to preparing for a CNIL inspection provides a national example, not a universal description of every authority’s procedure. Distinguish a regulator’s information request, preliminary view and final decision when recording the status of an investigation.

Chapter VII: cooperation and consistency, Articles 60–76

Cross-border cases can involve a lead authority and other concerned authorities under Article 60, with mutual assistance and joint operations addressed in Articles 61 and 62. Articles 63–67 provide the consistency mechanism and related procedures. The European Data Protection Board guide explains how this institutional structure relates to national supervision. These provisions matter when understanding who makes a decision and why several authorities appear in the same matter.

Distinguish the EDPB’s published guidance from its binding dispute-resolution decisions under Article 65. Guidance supports interpretation; it is not interchangeable with a binding decision addressed to authorities in a particular procedure. An Article 64 opinion also has its own procedural role. When citing regulatory material, identify the document type, final or consultation status, adoption date and the issue it actually resolves.

Chapter VIII: remedies, liability and penalties, Articles 77–84

Individuals can complain to an authority under Article 77, while Articles 78 and 79 address judicial remedies against authorities and controllers or processors. Representation and related proceedings are addressed in Articles 80 and 81. Article 82 concerns compensation for material or non-material damage resulting from an infringement. Compensation and an administrative fine are different remedies with different purposes; an infringement does not mean that every person automatically receives the amount of a regulatory penalty.

Article 83 sets conditions and maximum tiers for GDPR administrative fines. The lower tier includes obligations under Articles 8, 11, 25–39, 42 and 43: up to €10 million or, for an undertaking, 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. The higher tier includes the basic principles and consent conditions under Articles 5, 6, 7 and 9, rights under Articles 12–22 and transfers under Articles 44–49: up to €20 million or 4%, on the same turnover basis and higher-of rule.

Those are maxima, not an automatic invoice for every breach. The authority must apply the relevant statutory factors and ensure effectiveness, proportionality and dissuasiveness. Article 83 also covers further categories and non-compliance with supervisory orders; Article 84 concerns other Member-State penalties. Do not turn the tier structure into a claim that only a few articles matter, or that satisfying those articles guarantees a particular reduction in risk.

Chapter IX: specific processing situations, Articles 85–91

These provisions explain why national law remains important within an EU regulation. Freedom of expression, official documents, national identifiers and employment can require a more specific assessment. Article 89 establishes safeguards and conditions for archiving, research and statistics; merely calling a project “research” does not suspend individual rights or justify any retention period. Article 90 addresses secrecy obligations, and Article 91 concerns qualifying existing church and religious-association rules.

For a cross-border organisation, identify which national provisions apply to each activity rather than copying one country’s employment notice or medical-record procedure everywhere. Keep the EU obligation, national rule and organisational choice distinguishable in the evidence. This makes updates easier when one local requirement changes without altering the common processing model across every establishment.

Chapters X and XI: delegated acts and final provisions, Articles 92–99

Articles 92 and 93 govern delegated powers and committee procedure. The final provisions address repeal, the relationship with other instruments and agreements, reporting, review and application. In particular, Article 95 concerns the relationship with the ePrivacy Directive. Choosing a GDPR basis therefore does not by itself resolve all rules for electronic marketing or access to information on a user’s device.

Use the index to locate the operative rule, then read its paragraph-level conditions and relevant interpretation. Record the version and date of legal material used for a decision. Proposals, consultation documents and future application dates should remain clearly separate from currently applicable obligations. A reliable article map helps a team ask the right questions; the documented answers still depend on the particular processing, people and jurisdictions involved.