🇪🇺 European Union

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : Yes

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : Yes

Definition of personal data that are "special" or "sensitive": financial data : No

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : No

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : No

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : Yes

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 20000000

Consideration of turnover rates for penalties? : Yes

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Audit or supervise Data Processors : Yes

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : Yes

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : Yes

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : Yes

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : Yes

Legal basis for international data transfer: Convention 108 : Yes

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Consulting the supervisory authority (DPA) before data processing : Yes

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : Yes

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : Yes

To inform subjects via privacy notice: the existence of subject rights : Yes

To inform subjects via privacy notice: Controller/controller's representative contact details : Yes

To inform subjects via privacy notice: the legal bases for processing : Yes

To inform subjects via privacy notice: categories of personal data : Yes

To inform subjects via privacy notice: source of data : No

To inform subjects via privacy notice: recipients or category of recipients of personal data : Yes

To inform subjects via privacy notice: information regarding data transfer to third countries and safety protocols : Yes

To inform subjects via privacy notice: the period for which data will be stored/criteria for such timeframe : Yes

Does the jurisdiction have an active regulation? :

Requirement to maintain records of data processing activities : Yes

Applicability: special requirements for "small" organisations : Yes

Cookies or other tracking technologies - consent : Yes