Individual Topics

Individual topics of the GDPR, organized by regulatory area.

Available sections

• 1.3.1 Scope of the GDPR: the material and territorial scope of the GDPR under Articles 2 and 3 GDPR: the forms of processing covered, exclusions from the material scope, the establishment criterion and the targeting criterion.
• 1.3.2 Legal Bases for Processing: the structure and system of Article 6 GDPR: the general prohibition subject to permission, the exhaustive catalog of grounds for lawful processing, the necessity requirement, and the relationship with the opening clauses and with the purpose limitation principle.
• 1.3.3 Principles Relating to Processing: the principles relating to the processing of personal data under Article 5 GDPR. Classification, legal nature, relationship with Article 6 GDPR, addressees, exceptions under Articles 23 and 85 GDPR, and liability to administrative fines.
• 1.3.5 Transparency Obligations (Privacy Notice): the information and transparency obligations under Articles 12 to 14 GDPR: when a privacy notice is required, the mandatory information where data are collected from the data subject and from third parties, exceptions, as well as drafting and practice.
• 1.3.6 Controllers and Processors: the data protection roles under the GDPR and how they are distinguished: controller (Article 4(7), Article 24), persons acting under the authority of the controller (Article 29), joint controllers (Article 26), and processor (Article 28 GDPR), including the data processing agreement.
• 1.3.7 Records of Processing Activities: the obligation to maintain records of processing activities under Article 30 GDPR: mandatory content for controllers and processors, form, the obligation to make the records available, the SME exemption under paragraph 5, and reform proposal COM(2025) 501.
• 1.3.8 Data Protection Officer: designation, position, tasks, and liability of the data protection officer under Articles 37 to 39 GDPR and § 38 of the German Federal Data Protection Act (BDSG); qualification, the internal and the external data protection officer, and drafting guidance for the contract with an external data protection officer.
• 1.3.10 Data Protection Impact Assessment: when it is required (threshold analysis), the six-step procedure with risk assessment and report, and the internal organization of those involved under Articles 35 and 36 GDPR.
• 1.3.12 Special Categories of Personal Data (Article 9 GDPR): the processing of special categories of personal data under Article 9 GDPR: the general prohibition of processing, the grounds for lawful processing, the relationship with Article 6 GDPR, and opening clauses for Member State law.
• 1.3.13 Transfers to Third Countries (Data Export): the transfer of personal data to unsafe third countries under Chapter V of the GDPR (Articles 44 to 49 GDPR): assessment framework, derogations under Article 49, standard contractual clauses with a Transfer Impact Assessment, the Data Privacy Framework, and Binding Corporate Rules.
• 1.3.14 Automated Individual Decision-Making (Article 22 GDPR): the general prohibition of decisions based solely on automated processing under Article 22 GDPR: the statutory criteria, profiling and scoring, the exceptions under paragraph 2, the safeguards under paragraph 3, sensitive data under paragraph 4, information and access rights, and the relationship with the AI Act.
• 1.3.15 Personal Data Breach (Data Breach): handling a personal data breach under Articles 4(12), 33, and 34 GDPR: the concept, the internal process from detection through to documentation, the three-stage risk assessment, notification to the supervisory authority and communication to the data subjects, as well as further notification obligations outside the GDPR.

Further individual topics will be added over time.