> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

URL: https://eur-lex.europa.eu/eli/reg/2016/679/oj

The authoritative text of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Published in the Official Journal of the European Union L 119, 4 May 2016, pp. 1–88. Freely reusable under EUR-Lex CC-BY 4.0 policy.

URL: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en

European Data Protection Board guidelines clarifying the conditions for valid consent under GDPR, including the freely given, specific, informed, and unambiguous requirements. Replaces WP29 Opinion 15/2011.

EDPB Guidelines on DPIAs (WP248 rev.01)

URL: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-wp248rev01-data-protection-impact-assessment_en

European Data Protection Board (formerly Article 29 Working Party) guidelines on when and how to conduct a DPIA. Includes the nine risk criteria checklist used to determine DPIA necessity.

EDPB Guidelines on Data Breach Notification (WP250 rev.01)

URL: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012021-examples-regarding-personal-data-breach_en

Guidelines with worked examples of personal data breach notification, covering the 72-hour supervisory authority notification requirement and the high-risk threshold for subject notification.

EDPB Recommendations on Supplementary Transfer Measures (01/2020)

URL: https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en

Post-Schrems II guidance on Transfer Impact Assessments and technical supplementary measures for data transfers to third countries, following the CJEU judgment in C-311/18 (Data Protection Commissioner v Facebook Ireland and Maximillian Schrems).

European Commission - Standard Contractual Clauses (2021)

URL: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

The implementing decision adopting the 2021 SCCs, covering four transfer modules (Controller-to-Controller, Controller-to-Processor, Processor-to-Processor, Processor-to-Controller). Replaces older 2001 and 2010 SCC decisions.

ICO - Data Minimisation Guidance

URL: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/the-principles/data-minimisation/

UK Information Commissioner's Office guidance on the data minimisation principle. Applicable as reference material for EU GDPR compliance; note that UK GDPR has diverged post-Brexit.

URL: https://www.cnil.fr/en/cnil-publishes-gdpr-developer-guide

French supervisory authority (CNIL) practical guide for developers implementing GDPR-compliant applications. Covers secure development practices, privacy by design, logging, authentication, and more.

ENISA - Pseudonymisation Techniques and Best Practices

URL: https://www.enisa.europa.eu/publications/pseudonymisation-techniques-and-best-practices

European Union Agency for Cybersecurity (ENISA) technical guidance on pseudonymisation approaches (tokenisation, hashing, encryption) with analysis of re-identification risks.

URL: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679#d1e5898-1-1

Direct link to Article 83 of GDPR specifying the two-tier fining structure (€10M/2% and €20M/4% of global annual turnover) and the criteria for determining fine amounts.

EDPB Record of Processing Activities Template

URL: https://edpb.europa.eu/our-work-tools/our-documents/other-guidance/guidelines-article-30-3-regulation-eu-2016679_en

Practical guidance on implementing Article 30 Record of Processing Activities, with field-level requirements for both controller and processor records.

GDPR Full Text - EUR-Lex Official Journal

EDPB Guidelines on Consent (WP259 rev.01)