DSGVO: Datenschutz-Grundverordnung (EU)

The bill has been in effect since May 25, 2018. 

This regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA) also addresses the transfer of personal data outside the EU and EEA areas. The GDPR's primary aim is to enhance the control and rights of individuals over their personal data and to simplify the regulatory environment for international business.

Unless a data subject has provided informed consent to data processing for one or more purposes, personal data may not be processed unless there is at least one legal basis to do so. Article 6 states the lawful purposes are:

• (a) If the data subject has given consent to the processing of his or her personal data;
• (b) To fulfill contractual obligations with a data subject, or for tasks at the request of a data subject who is in the process of entering into a contract;
• (c) To comply with a data controller's legal obligations;
• (d) To protect the vital interests of a data subject or another individual;
• (e) To perform a task in the public interest or in official authority;
• (f) For the legitimate interests of a data controller or a third party, unless these interests are overridden by interests of the data subject or her or his rights according to the Charter of Fundamental Rights (especially in the case of children).

Under Article 6, you need at least one of these to process personal data:

• Consent: the person has clearly agreed
• Contract: you need the data to deliver something they signed up for
• Legal obligation: the law requires you to process it
• Vital interests: it protects someone's life
• Public task: it's part of an official or public interest function
• Legitimate interests: you have a genuine need that doesn't override the person's rights

• See the data you hold on them
• Correct it or have it deleted
• Limit or object to how you use it
• Take it to another provider
• Not be subject to purely automated decisions with significant effects

Fines reach up to €20 million or 4% of global annual turnover, whichever is higher. Regulators can also order you to stop processing data altogether.

The EU's Digital Omnibus package, proposed in November 2025, would amend parts of the GDPR and the EU's cookie rules. It's still being negotiated, so the current rules apply in full until anything is adopted.

• Offizielle Gesetzgebung hier
• Artikel in unserem Blog hier
• Eine rechtliche Perspektive hier