Section 1: General obligations

  • Article 24 — Responsibility of the controller
  • Article 25 — Data protection by design and by default
  • Article 26 — Joint controllers
  • Article 27 — Representatives of controllers or processors not established in the Union
  • Article 28 — Processor
  • Article 29 — Processing under the authority of the controller or processor
  • Article 30 — Records of processing activities
  • Article 31 — Cooperation with the supervisory authority

Section 2: Security of personal data

  • Article 32 — Security of processing
  • Article 33 — Notification of a personal data breach to the supervisory authority
  • Article 34 — Communication of a personal data breach to the data subject

Section 3: Data protection impact assessment and prior consultation

  • Article 35 — Data protection impact assessment
  • Article 36 — Prior consultation

Section 4: Data protection officer

  • Article 37 — Designation of the data protection officer
  • Article 38 — Position of the data protection officer
  • Article 39 — Tasks of the data protection officer

Section 5: Codes of conduct and certification

  • Article 40 — Codes of conduct
  • Article 41 — Monitoring of approved codes of conduct
  • Article 42 — Certification
  • Article 43 — Certification bodies

← Chapter 3

Chapter 5 →