GDPR 欧盟通用数据保护条例

判断	需要核验的事实
地域适用	机构活动、目标市场、提供服务和监测行为
控制者	谁决定处理目的和方式
处理者	谁按照控制者指示代为处理
共同控制	多方是否共同决定目的和方式，如何划分责任
境外代表或DPO	分别按第27、37条条件判断，不将两种角色混同

事项	依据	验收示例
透明告知	第13—14条	告知与真实SDK、接口、用途及接收方一致
设计和默认保护	第25条	新账号默认暴露范围、采集与保存与必要性匹配
处理者治理	第28条	书面约定、再委托、监督、删除返还及协助义务对应实际链路
处理记录	第30条	从系统反查处理活动；小于250人并非无条件免记录
安全与有效性	第32条	风险匹配的权限、加密、恢复与定期验证实际生效
个人权利	第12、15—22条	查阅、更正、删除、反对等按各自条件执行，拒绝有依据

任务	触发与时限	核验记录
处理者通知控制者	第33条：获知个人数据泄露后不得无故拖延	首次获知、通知对象和内容
控制者通知监管机构	第33条：不得无故拖延，能够做到时不晚于获知后72小时；不太可能造成权利自由风险的例外单独判断	风险评估、起算点、报送和迟延理由
通知数据主体	第34条：可能导致高风险时不得无故拖延，法定例外另行判断	影响、通知内容及例外依据

章节	条号与阅读入口
I 总则	第1—4条
II 原则	第5—11条
III 数据主体权利	第12—23条
IV 控制者和处理者	第24—43条
V 向第三国或国际组织传输	第44—50条
VI 独立监管机构	第51—59条
VII 合作与一致性	第60—76条
VIII 救济、责任与处罚	第77—84条
IX 特定处理情形	第85—91条
X 授权法案与实施法案	第92—93条
XI 最后条款	第94—99条
结束语、签署与脚注	签署信息 · 脚注19—21

查看法规原文

第2条事项适用范围 / Article 2 — Material scope

English

This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
This Regulation does not apply to the processing of personal data:

(a) in the course of an activity which falls outside the scope of Union law;

(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;

(c) by a natural person in the course of a purely personal or household activity;

(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

For the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC) No 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with Article 98.
This Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.

中文参考译文

本条例适用于完全或部分以自动化方式处理个人数据，以及以非自动化方式处理已构成或拟构成档案系统一部分的个人数据。
本条例不适用于下列个人数据处理：

(a) 在不属于欧盟法适用范围的活动中进行的处理；

(b) 成员国开展《欧洲联盟条约》第五编第二章范围内的活动时进行的处理；

(c) 自然人在纯粹个人或家庭活动中进行的处理；

(d) 主管机关为预防、调查、侦查或起诉刑事犯罪，或执行刑事处罚而进行的处理，包括防范和预防对公共安全的威胁。

欧盟机构、机关、办事处和专门机构处理个人数据，适用第45/2001号条例（EC）。第45/2001号条例（EC）及适用于此类个人数据处理的其他欧盟法律文件，应按照第98条调整，以符合本条例的原则和规则。
本条例不影响第2000/31/EC号指令的适用，特别是不影响该指令第12至15条中有关中介服务提供者责任的规则。

第4条定义 / Article 4 — Definitions

English

For the purposes of this Regulation:

(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(3) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;

(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

(10) ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

(11) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

(13) ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

(14) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;

(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

(16) ‘main establishment’ means:

(a) as regards a controller with establishments in more than one Member State, the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union and the latter establishment has the power to have such decisions implemented, in which case the establishment having taken such decisions is to be considered to be the main establishment;

(b) as regards a processor with establishments in more than one Member State, the place of its central administration in the Union, or, if the processor has no central administration in the Union, the establishment of the processor in the Union where the main processing activities in the context of the activities of an establishment of the processor take place to the extent that the processor is subject to specific obligations under this Regulation;

(17) ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27, represents the controller or processor with regard to their respective obligations under this Regulation;

(18) ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;

(19) ‘group of undertakings’ means a controlling undertaking and its controlled undertakings;

(20) ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;

(21) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51;

(22) ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because:

(a) the controller or processor is established on the territory of the Member State of that supervisory authority;

(b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or

(c) a complaint has been lodged with that supervisory authority;

(23) ‘cross-border processing’ means either:

(a) processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or

(b) processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

(24) ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;

(25) ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of the European Parliament and of the Council 19;

(26) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.

中文参考译文

本条例使用下列定义：

(1) “个人数据”是指与已识别或可识别的自然人（“数据主体”）有关的任何信息；可识别的自然人是指能够直接或间接被识别的自然人，特别是通过姓名、身份识别号码、位置数据、在线标识符等标识符，或该自然人的身体、生理、遗传、精神、经济、文化或社会身份所特有的一个或多个因素加以识别；

(2) “处理”是指对个人数据或个人数据集合进行的任何操作或一组操作，无论是否采用自动化方式，例如收集、记录、组织、结构化、存储、调整或变更、检索、查阅、使用、通过传输而披露、传播或以其他方式提供、匹配或组合、限制、删除或销毁；

(3) “限制处理”是指对已存储的个人数据加以标记，以限制将来对其进行处理；

(4) “画像”是指任何形式的个人数据自动化处理，其内容是使用个人数据评价与自然人有关的某些个人方面，特别是分析或预测该自然人的工作表现、经济状况、健康、个人偏好、兴趣、可靠性、行为、位置或移动情况；

(5) “假名化”是指以这样一种方式处理个人数据：不使用额外信息便无法再将个人数据归属于特定数据主体；同时，该额外信息须单独保存，并采取技术和组织措施，确保个人数据不会归属于已识别或可识别的自然人；

(6) “档案系统”是指能够依据特定标准访问的任何结构化个人数据集合，无论其是集中式、分散式，还是按职能或地域分布；

(7) “控制者”是指单独或与他人共同决定个人数据处理目的和方式的自然人、法人、公共机关、专门机构或其他组织；处理目的和方式由欧盟法或成员国法律确定的，可由欧盟法或成员国法律规定控制者或指定控制者的具体标准；

(8) “处理者”是指代表控制者处理个人数据的自然人、法人、公共机关、专门机构或其他组织；

(9) “接收方”是指获披露个人数据的自然人、法人、公共机关、专门机构或其他组织，无论其是否为第三方。但是，依据欧盟法或成员国法律，在特定调查框架下可能接收个人数据的公共机关，不应被视为接收方；该等公共机关处理这些数据，应根据处理目的遵守适用的数据保护规则；

(10) “第三方”是指数据主体、控制者、处理者，以及在控制者或处理者直接授权下获准处理个人数据的人员以外的自然人、法人、公共机关、专门机构或组织；

(11) 数据主体的“同意”是指数据主体自由作出、具体、知情且明确的任何意愿表示，即其通过声明或明确的肯定行为，表示同意处理与其有关的个人数据；

(12) “个人数据泄露事件”是指安全受到破坏，导致已传输、存储或以其他方式处理的个人数据被意外或非法销毁、丢失、变更、未经授权披露或访问；

(13) “遗传数据”是指与自然人遗传或获得的遗传特征有关的个人数据，该等数据提供关于该自然人生理或健康的独特信息，特别是由分析该自然人的生物样本而产生；

(14) “生物识别数据”是指通过特定技术处理自然人的身体、生理或行为特征所产生的个人数据，能够实现或确认对该自然人的唯一识别，例如面部图像或指纹数据；

(15) “健康数据”是指与自然人的身体或精神健康有关、揭示其健康状况信息的个人数据，包括提供医疗保健服务所涉及的数据；

(16) “主要营业机构”是指：

(a) 对于在一个以上成员国设有营业机构的控制者，指其在欧盟境内的中央管理机构所在地；但是，如果个人数据处理目的和方式的决定是在该控制者位于欧盟境内的另一营业机构作出，且后者有权使该等决定得到执行，则应将作出该等决定的营业机构视为主要营业机构；

(b) 对于在一个以上成员国设有营业机构的处理者，指其在欧盟境内的中央管理机构所在地；如果其在欧盟境内没有中央管理机构，则在处理者承担本条例特定义务的范围内，指该处理者在欧盟境内、其营业机构活动背景下的主要处理活动发生的营业机构；

(17) “代表”是指在欧盟境内设立，经控制者或处理者依据第27条书面指定，代表控制者或处理者处理其在本条例下各自义务的自然人或法人；

(18) “企业”是指从事经济活动的自然人或法人，无论其法律形式如何，包括经常从事经济活动的合伙组织或协会；

(19) “企业集团”是指具有控制地位的企业及其所控制的企业；

(20) “有约束力的公司规则”是指在一个成员国境内设立的控制者或处理者，在企业集团内部，或从事共同经济活动的企业群体内部，向一个或多个第三国的控制者或处理者进行一次或一系列个人数据传输时遵守的个人数据保护政策；

(21) “监管机构”是指成员国依据第51条设立的独立公共机关；

(22) “有关监管机构”是指因下列原因而与个人数据处理有关的监管机构：

(a) 控制者或处理者在该监管机构所属成员国境内设立；

(b) 居住于该监管机构所属成员国的数据主体受到或可能受到该处理的重大影响；或者

(c) 已向该监管机构提出投诉；

(23) “跨境处理”是指下列任一情形：

(a) 在欧盟境内、于一个以上成员国设立的控制者或处理者，在其位于一个以上成员国的营业机构活动背景下进行的个人数据处理；或者

(b) 在控制者或处理者位于欧盟境内的单一营业机构活动背景下进行，但重大影响或可能重大影响一个以上成员国数据主体的个人数据处理。

(24) “相关且有理由的异议”是指针对决定草案提出的异议，涉及是否违反本条例，或拟对控制者或处理者采取的行动是否符合本条例；该异议须清楚说明决定草案对数据主体基本权利和自由，以及适用时对个人数据在欧盟境内自由流动所产生风险的重要程度；

(25) “信息社会服务”是指欧洲议会和理事会第2015/1535号指令（EU）第1条第1款(b)项所定义的服务19；

(26) “国际组织”是指受国际公法管辖的组织及其附属机构，或由两个或多个国家之间的协议设立或依据该等协议设立的任何其他组织。

查看法规原文

第5条个人数据处理原则 / Article 5 — Principles relating to processing of personal data

English

Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).

中文参考译文

个人数据应当：

(a) 以相对于数据主体而言合法、公平、透明的方式处理（“合法性、公平性和透明度”）；

(b) 为特定、明确和正当目的收集，且不得以与该等目的不相容的方式进一步处理；按照第89条第1款，为公共利益档案保存、科学或历史研究或统计目的进一步处理，不应视为与最初目的不相容（“目的限制”）；

(c) 相对于处理目的而言充分、相关，并限于必要范围（“数据最小化”）；

(d) 准确，并在必要时保持更新；应采取一切合理措施，确保从处理目的考虑不准确的个人数据得到及时删除或更正（“准确性”）；

(e) 以能够识别数据主体的形式保存的时间，不得超过实现个人数据处理目的所必需的期限；如果个人数据仅按照第89条第1款，为公共利益档案保存、科学或历史研究或统计目的处理，并采取本条例要求的适当技术和组织措施以保障数据主体的权利和自由，则可以保存更长时间（“存储限制”）；

(f) 采取适当技术或组织措施，以确保个人数据适当安全的方式处理，包括防范未经授权或非法处理，以及意外丢失、销毁或损坏（“完整性和保密性”）。

控制者应负责遵守第1款，并能够证明其遵守情况（“问责”）。

第6条处理的合法性 / Article 6 — Lawfulness of processing

English

Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.
The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

(a) Union law; or

(b) Member State law to which the controller is subject.

The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.

Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

(a) any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;

(b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;

(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;

(d) the possible consequences of the intended further processing for data subjects;

(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.

中文参考译文

只有至少满足下列一项条件，并在该条件所允许的范围内，处理才具有合法性：

(a) 数据主体已同意为一个或多个特定目的处理其个人数据；

(b) 处理为履行数据主体作为一方当事人的合同所必需，或者为订立合同前应数据主体请求采取措施所必需；

(c) 处理为遵守控制者承担的法律义务所必需；

(d) 处理为保护数据主体或其他自然人的重大生命利益所必需；

(e) 处理为执行符合公共利益的任务，或行使赋予控制者的公权力所必需；

(f) 处理为实现控制者或第三方追求的正当利益所必需，但数据主体需要保护个人数据的利益或基本权利和自由优先于该等利益的除外，特别是在数据主体为儿童的情况下。

第一分段(f)项不适用于公共机关履行职责时进行的处理。

对于为满足第1款(c)和(e)项而进行的处理，成员国可以保留或制定更具体的规定，通过更精确地确定处理的具体要求及确保合法、公平处理的其他措施，调整本条例规则的适用，包括第九章所规定的其他特定处理情形。
第1款(c)和(e)项所述处理的依据应由下列法律规定：

(a) 欧盟法；或者

(b) 控制者所适用的成员国法律。

处理目的应由该法律依据确定；对于第1款(e)项所述处理，该目的应为执行公共利益任务或行使赋予控制者的公权力所必需。该法律依据可以包含调整本条例规则适用的具体规定，包括：控制者处理合法性的一般条件；被处理的数据类型；有关数据主体；可以向哪些实体、为哪些目的披露个人数据；目的限制；保存期限；以及处理操作和处理程序，包括确保合法、公平处理的措施，例如针对第九章所规定其他特定处理情形的措施。欧盟法或成员国法律应符合公共利益目标，并与所追求的正当目标相称。

为不同于个人数据收集目的的其他目的进行处理，如果并非基于数据主体同意，也并非基于在民主社会中为保障第23条第1款所列目标而构成必要且相称措施的欧盟法或成员国法律，控制者为确定该其他目的的处理是否与最初收集目的相容，应考虑包括下列因素在内的事项：

(a) 个人数据收集目的与拟进一步处理目的之间的任何联系；

(b) 个人数据收集的背景，特别是数据主体与控制者之间的关系；

(c) 个人数据的性质，特别是是否按照第9条处理特殊类别个人数据，或按照第10条处理与刑事定罪和犯罪有关的个人数据；

(d) 拟进一步处理对数据主体可能产生的后果；

(e) 是否存在适当保障措施，其中可以包括加密或假名化。

第7条同意的条件 / Article 7 — Conditions for consent

English

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

中文参考译文

处理基于同意的，控制者应能够证明数据主体已经同意处理其个人数据。
数据主体在同时涉及其他事项的书面声明中表示同意的，同意请求应以与其他事项明显区分的方式呈现，使用清楚、平实的语言，并采取易于理解和获取的形式。该声明中违反本条例的任何部分均不具有约束力。
数据主体有权随时撤回同意。撤回同意不影响撤回前基于同意进行处理的合法性。数据主体在表示同意前，应被告知上述事项。撤回同意应与给予同意同样容易。
评估同意是否自由作出时，应最大限度地考虑包括下列事项在内的因素：履行合同，包括提供服务，是否以同意处理并非履行该合同所必需的个人数据为条件。

第9条特殊类别个人数据的处理 / Article 9 — Processing of special categories of personal data

English

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
Paragraph 1 shall not apply if one of the following applies:

(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;

(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;

(e) processing relates to personal data which are manifestly made public by the data subject;

(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;

(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.
Member States may maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health.

中文参考译文

禁止处理揭示种族或族裔出身、政治观点、宗教或哲学信仰、工会成员身份的个人数据，并禁止处理遗传数据、以唯一识别自然人为目的的生物识别数据、健康数据，或与自然人的性生活或性取向有关的数据。
有下列任一情形的，不适用第1款：

(a) 数据主体已明确同意为一个或多个特定目的处理该等个人数据，但欧盟法或成员国法律规定数据主体不得解除第1款所述禁止的除外；

(b) 处理为控制者或数据主体履行就业、社会保障和社会保护法律领域的义务及行使特定权利所必需，并限于欧盟法、成员国法律或依据成员国法律订立的集体协议所授权的范围，且该等法律或协议为数据主体的基本权利和利益提供适当保障；

(c) 数据主体在身体上或法律上无法表示同意，且处理为保护数据主体或其他自然人的重大生命利益所必需；

(d) 具有政治、哲学、宗教或工会宗旨的基金会、协会或其他非营利组织，在采取适当保障措施的正当活动中进行处理，且该处理仅涉及本组织成员、前成员或因组织宗旨与其保持经常联系的人员，并且未经数据主体同意，不向该组织之外披露个人数据；

(e) 处理涉及数据主体已明显自行公开的个人数据；

(f) 处理为确立、行使或抗辩法律请求所必需，或者法院正在履行司法职能；

(g) 处理基于欧盟法或成员国法律，为重大公共利益所必需；该法律应与所追求的目标相称，尊重数据保护权的本质，并规定适宜、具体的措施，以保障数据主体的基本权利和利益；

(h) 处理依据欧盟法、成员国法律或与医疗卫生专业人员订立的合同，为预防医学或职业医学、评估雇员工作能力、医疗诊断、提供医疗或社会照护或治疗，或管理医疗或社会照护系统及服务所必需，并遵守第3款所述条件和保障措施；

(i) 处理基于欧盟法或成员国法律，为公共卫生领域的公共利益所必需，例如防范严重的跨境健康威胁，或确保医疗保健以及药品、医疗器械具有高标准的质量和安全；该法律应规定适宜、具体的措施，以保障数据主体的权利和自由，特别是职业保密；

(j) 处理按照第89条第1款，基于欧盟法或成员国法律，为公共利益档案保存、科学或历史研究或统计目的所必需；该法律应与所追求的目标相称，尊重数据保护权的本质，并规定适宜、具体的措施，以保障数据主体的基本权利和利益。

第1款所述个人数据，由依据欧盟法、成员国法律或国家主管机构制定的规则承担职业保密义务的专业人员处理，或在该专业人员负责下处理，或者由依据上述法律或规则同样承担保密义务的其他人员处理的，可以为第2款(h)项所述目的进行处理。
对于遗传数据、生物识别数据或健康数据的处理，成员国可以保留或制定进一步条件，包括限制。

查看法规原文

第1节透明度与行使方式 / Section 1 — Transparency and modalities

第12条数据主体行使权利时的透明信息、沟通与方式 / Article 12 — Transparent information, communication and modalities for the exercise of the rights of the data subject

English

The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.
The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.
The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically they shall be machine-readable.
The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of determining the information to be presented by the icons and the procedures for providing standardised icons.

中文参考译文

控制者应采取适当措施，以简洁、透明、易懂且易于获取的形式，使用清楚、平实的语言，向数据主体提供第13、14条所述的任何信息，以及第15至22条和第34条规定的与处理有关的任何沟通内容，特别是专门面向儿童的信息。信息应以书面或其他方式提供，包括在适当情况下以电子方式提供。应数据主体请求，可以口头提供信息，但须通过其他方式证明数据主体的身份。
控制者应便利数据主体行使第15至22条规定的权利。在第11条第2款所述情况下，控制者不得拒绝就数据主体行使第15至22条权利的请求采取行动，除非控制者能够证明其无法识别数据主体的身份。
控制者应无不当迟延地向数据主体提供其就第15至22条请求采取行动的信息，并且无论如何应在收到请求后一个月内提供。考虑请求的复杂性和数量，必要时该期限可以再延长两个月。控制者应在收到请求后一个月内，将任何此类延期及迟延原因告知数据主体。数据主体以电子方式提出请求的，应尽可能以电子方式提供信息，但数据主体另有请求的除外。
控制者不就数据主体的请求采取行动的，应及时且最迟在收到请求后一个月内，告知数据主体不采取行动的原因，以及向监管机构投诉和寻求司法救济的可能途径。
依据第13、14条提供的信息，以及依据第15至22条和第34条进行的任何沟通和采取的任何行动，均应免费。数据主体的请求明显缺乏依据或过度，特别是具有重复性的，控制者可以：

(a) 考虑提供信息、进行沟通或采取所请求行动的行政成本，收取合理费用；或者

(b) 拒绝就请求采取行动。

控制者应承担证明请求明显缺乏依据或过度的责任。

在不影响第11条的前提下，控制者对提出第15至21条所述请求的自然人身份存在合理怀疑的，可以要求提供确认数据主体身份所必需的额外信息。
依据第13、14条向数据主体提供的信息，可以结合标准化图标呈现，以易见、易懂且清晰可读的方式，对拟进行的处理给出具有实际意义的概览。以电子形式呈现的图标，应可供机器读取。
欧盟委员会有权依据第92条制定授权法案，以确定图标应呈现的信息及提供标准化图标的程序。

第2节信息和访问个人数据 / Section 2 — Information and access to personal data

第13条向数据主体收集个人数据时应提供的信息 / Article 13 — Information to be provided where personal data are collected from the data subject

English

Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(d) the right to lodge a complaint with a supervisory authority;

(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.

中文参考译文

直接向数据主体收集与其有关的个人数据时，控制者应在获取个人数据之时，向数据主体提供下列全部信息：

(a) 控制者的身份和联系方式，以及适用时控制者代表的身份和联系方式；

(b) 适用时，数据保护官的联系方式；

(c) 个人数据拟用于何种处理目的，以及处理的法律依据；

(d) 处理基于第6条第1款(f)项的，控制者或第三方所追求的正当利益；

(e) 如有，个人数据的接收方或接收方类别；

(f) 适用时，控制者拟将个人数据传输至第三国或国际组织的事实，以及欧盟委员会是否作出充分性决定；对于第46、47条或第49条第1款第二分段所述传输，应指明适当或适宜的保障措施，以及获得其副本的方式或公开获取位置。

除第1款所述信息外，控制者还应在获取个人数据之时，向数据主体提供确保公平、透明处理所必需的下列补充信息：

(a) 个人数据将保存的期限；无法确定的，提供用于确定该期限的标准；

(b) 有权请求控制者提供对与数据主体有关的个人数据的访问、更正或删除、限制处理，或反对处理，以及享有数据可携带权；

(c) 处理基于第6条第1款(a)项或第9条第2款(a)项的，有权随时撤回同意，且不影响撤回前基于同意进行处理的合法性；

(d) 向监管机构投诉的权利；

(e) 提供个人数据是否属于法定或合同要求，或订立合同所必需的要求；数据主体是否有义务提供个人数据，以及未提供数据可能产生的后果；

(f) 是否存在第22条第1、4款所述的自动化决策，包括画像；并至少在该等情况下，提供关于所涉及逻辑的有意义信息，以及该处理对数据主体的意义和预期后果。

控制者拟为不同于收集目的的其他目的进一步处理个人数据的，应在进一步处理之前，将该其他目的及第2款所述任何相关补充信息提供给数据主体。
在数据主体已经掌握该等信息的情况下，并在其已掌握的范围内，第1、2、3款不适用。

第14条未从数据主体取得个人数据时应提供的信息 / Article 14 — Information to be provided where personal data have not been obtained from the data subject

English

Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information:

(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;

(b) the contact details of the data protection officer, where applicable;

(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

(d) the categories of personal data concerned;

(e) the recipients or categories of recipients of the personal data, if any;

(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject:

(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

(e) the right to lodge a complaint with a supervisory authority;

(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The controller shall provide the information referred to in paragraphs 1 and 2:

(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.
Paragraphs 1 to 4 shall not apply where and insofar as:

(a) the data subject already has the information;

(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;

(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or

(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

中文参考译文

个人数据并非从数据主体取得的，控制者应向数据主体提供下列信息：

(a) 控制者的身份和联系方式，以及适用时控制者代表的身份和联系方式；

(b) 适用时，数据保护官的联系方式；

(c) 个人数据拟用于何种处理目的，以及处理的法律依据；

(d) 所涉及的个人数据类别；

(e) 如有，个人数据的接收方或接收方类别；

(f) 适用时，控制者拟将个人数据传输至第三国或国际组织内接收方的事实，以及欧盟委员会是否作出充分性决定；对于第46、47条或第49条第1款第二分段所述传输，应指明适当或适宜的保障措施，以及获得其副本的方式或公开获取位置。

除第1款所述信息外，控制者还应向数据主体提供确保对其进行公平、透明处理所必需的下列信息：

(a) 个人数据将保存的期限；无法确定的，提供用于确定该期限的标准；

(b) 处理基于第6条第1款(f)项的，控制者或第三方追求的正当利益；

(c) 有权请求控制者提供对与数据主体有关的个人数据的访问、更正或删除、限制处理，以及反对处理，并享有数据可携带权；

(d) 处理基于第6条第1款(a)项或第9条第2款(a)项的，有权随时撤回同意，且不影响撤回前基于同意进行处理的合法性；

(e) 向监管机构投诉的权利；

(f) 个人数据的来源，以及适用时是否来自公众可访问的来源；

(g) 是否存在第22条第1、4款所述自动化决策，包括画像；并至少在该等情况下，提供关于所涉及逻辑的有意义信息，以及该处理对数据主体的意义和预期后果。

控制者应在下列期限提供第1、2款所述信息：

(a) 考虑个人数据处理的具体情况，在取得个人数据后的合理期间内，但最迟不超过一个月；

(b) 个人数据拟用于与数据主体沟通的，最迟在首次与该数据主体沟通之时；或者

(c) 拟向其他接收方披露个人数据的，最迟在首次披露个人数据之时。

控制者拟为不同于取得目的的其他目的进一步处理个人数据的，应在进一步处理之前，将该其他目的及第2款所述任何相关补充信息提供给数据主体。
在下列情况下，并限于该情况所及范围，第1至4款不适用：

(a) 数据主体已掌握该等信息；

(b) 提供该等信息经证明不可能，或需要付出不相称的努力，特别是在遵守第89条第1款所述条件和保障措施的前提下，为公共利益档案保存、科学或历史研究或统计目的进行处理；或者本条第1款所述义务可能导致处理目的无法实现或严重妨碍其实现。在该等情况下，控制者应采取适当措施保护数据主体的权利、自由和正当利益，包括将该等信息向公众提供；

(c) 控制者适用的欧盟法或成员国法律明确规定了数据的获取或披露，且规定了保护数据主体正当利益的适当措施；或者

(d) 个人数据须根据欧盟法或成员国法律规定的职业保密义务保持秘密，包括法定保密义务。

第15条数据主体的访问权 / Article 15 — Right of access by the data subject

English

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

中文参考译文

数据主体有权从控制者获得确认，知悉其个人数据是否正在被处理；正在被处理的，有权访问该等个人数据及下列信息：

(a) 处理目的；

(b) 所涉及的个人数据类别；

(c) 个人数据已经或将要披露给的接收方或接收方类别，特别是第三国或国际组织中的接收方；

(d) 可能时，个人数据预计保存的期限；无法确定的，提供确定该期限的标准；

(e) 有权请求控制者更正或删除与数据主体有关的个人数据、限制处理该等个人数据，或反对该处理；

(f) 向监管机构投诉的权利；

(g) 个人数据并非从数据主体收集的，关于其来源的任何可用信息；

(h) 是否存在第22条第1、4款所述自动化决策，包括画像；并至少在该等情况下，提供关于所涉及逻辑的有意义信息，以及该处理对数据主体的意义和预期后果。

个人数据被传输至第三国或国际组织的，数据主体有权获知依据第46条与该传输有关的适当保障措施。
控制者应提供正在处理的个人数据的副本。对于数据主体请求的额外副本，控制者可以根据行政成本收取合理费用。数据主体以电子方式提出请求且未另有请求的，应以通用电子形式提供信息。
第3款所述获得副本的权利，不得对他人的权利和自由产生不利影响。

第3节更正与删除 / Section 3 — Rectification and erasure

第17条删除权（“被遗忘权”） / Article 17 — Right to erasure (‘right to be forgotten’)

English

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

(d) the personal data have been unlawfully processed;

(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

(a) for exercising the right of freedom of expression and information;

(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(e) for the establishment, exercise or defence of legal claims.

中文参考译文

有下列任一理由的，数据主体有权要求控制者无不当迟延地删除与其有关的个人数据，控制者也有义务无不当迟延地删除个人数据：

(a) 个人数据对于其收集或其他处理目的已不再必要；

(b) 数据主体撤回了作为处理依据的第6条第1款(a)项或第9条第2款(a)项同意，且该处理没有其他法律依据；

(c) 数据主体依据第21条第1款反对处理，且不存在优先于该反对的正当处理理由；或者数据主体依据第21条第2款反对处理；

(d) 个人数据已被非法处理；

(e) 为遵守控制者适用的欧盟法或成员国法律规定的义务，必须删除个人数据；

(f) 个人数据是在提供第8条第1款所述信息社会服务的情形下收集的。

控制者已公开个人数据，且依据第1款有义务删除该等数据的，应考虑可用技术和实施成本，采取合理措施，包括技术措施，通知正在处理该等个人数据的控制者：数据主体已要求其删除指向该等个人数据的任何链接，或该等数据的副本或复制件。
在处理为下列目的所必需的范围内，第1、2款不适用：

(a) 行使表达和信息自由权；

(b) 遵守控制者适用的欧盟法或成员国法律规定、要求进行处理的法律义务，或者执行公共利益任务，或行使赋予控制者的公权力；

(c) 依据第9条第2款(h)、(i)项及第9条第3款，为公共卫生领域的公共利益；

(d) 依据第89条第1款，为公共利益档案保存、科学或历史研究或统计目的，且第1款所述权利可能导致该处理目的无法实现或严重妨碍其实现；或者

(e) 确立、行使或抗辩法律请求。

第18条限制处理权 / Article 18 — Right to restriction of processing

English

The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:

(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.

中文参考译文

有下列任一情形的，数据主体有权要求控制者限制处理：

(a) 数据主体对个人数据准确性提出异议，在控制者核实个人数据准确性所需期间内；

(b) 处理违法，但数据主体反对删除个人数据，转而要求限制其使用；

(c) 控制者为处理目的已不再需要该等个人数据，但数据主体为确立、行使或抗辩法律请求仍需要该等数据；

(d) 数据主体已依据第21条第1款反对处理，尚待核实控制者的正当理由是否优先于数据主体的理由。

依据第1款限制处理的，该等个人数据除存储外，仅可在数据主体同意，或为确立、行使或抗辩法律请求，或保护其他自然人或法人的权利，或基于欧盟或成员国重大公共利益的情况下进行处理。
对依据第1款获准限制处理的数据主体，控制者应在解除处理限制之前予以告知。

第20条数据可携带权 / Article 20 — Right to data portability

English

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

(b) the processing is carried out by automated means.

In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

中文参考译文

在下列条件均满足时，数据主体有权以结构化、通用且可供机器读取的格式，接收其向控制者提供的与其有关的个人数据，并有权将该等数据传输给另一控制者，不受原接收个人数据的控制者阻碍：

(a) 处理基于第6条第1款(a)项或第9条第2款(a)项的同意，或基于第6条第1款(b)项的合同；并且

(b) 处理以自动化方式进行。

数据主体依据第1款行使数据可携带权时，在技术可行的情况下，有权要求个人数据直接从一个控制者传输至另一控制者。
行使本条第1款所述权利，不影响第17条。该权利不适用于为执行公共利益任务或行使赋予控制者的公权力所必需的处理。
第1款所述权利不得对他人的权利和自由产生不利影响。

第4节反对权与自动化个体决策 / Section 4 — Right to object and automated individual decision-making

第21条反对权 / Article 21 — Right to object

English

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

中文参考译文

对于基于第6条第1款(e)或(f)项进行的与其有关的个人数据处理，包括基于该等规定进行的画像，数据主体有权基于其特定情况随时提出反对。控制者不得再处理该等个人数据，除非其能够证明存在优先于数据主体利益、权利和自由的具有压倒性的正当处理理由，或者处理是为确立、行使或抗辩法律请求。
为直接营销目的处理个人数据的，数据主体有权随时反对为该营销目的处理与其有关的个人数据；这包括与该直接营销有关范围内的画像。
数据主体反对为直接营销目的进行处理的，不得再为该等目的处理个人数据。
最迟在首次与数据主体沟通之时，应明确提请数据主体注意第1、2款所述权利，并将其与其他任何信息分开、清楚地呈现。
在使用信息社会服务的情况下，不受第2002/58/EC号指令影响，数据主体可以采用技术规范，通过自动化方式行使反对权。
依据第89条第1款，为科学或历史研究或统计目的处理个人数据的，数据主体有权基于其特定情况，反对处理与其有关的个人数据，但处理为执行基于公共利益的任务所必需的除外。

第22条自动化个体决策，包括画像 / Article 22 — Automated individual decision-making, including profiling

English

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Paragraph 1 shall not apply if the decision:

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c) is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

中文参考译文

数据主体有权不受仅基于自动化处理（包括画像）作出、并对其产生法律效果或类似重大影响的决定约束。
决定具有下列任一情形的，第1款不适用：

(a) 为订立或履行数据主体与数据控制者之间的合同所必需；

(b) 获控制者适用的欧盟法或成员国法律授权，且该法律同时规定了保障数据主体权利、自由和正当利益的适宜措施；或者

(c) 基于数据主体的明确同意。

在第2款(a)、(c)项所述情况下，数据控制者应采取适宜措施，保障数据主体的权利、自由和正当利益，至少包括要求控制者进行人工干预、表达自身观点及对决定提出异议的权利。
第2款所述决定不得基于第9条第1款所述特殊类别个人数据，除非适用第9条第2款(a)或(g)项，且已采取适宜措施保障数据主体的权利、自由和正当利益。

第5节限制 / Section 5 — Restrictions

第23条限制 / Article 23 — Restrictions

English

Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

(a) national security;

(b) defence;

(c) public security;

(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

(f) the protection of judicial independence and judicial proceedings;

(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

(i) the protection of the data subject or the rights and freedoms of others;

(j) the enforcement of civil law claims.

In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a) the purposes of the processing or categories of processing;

(b) the categories of personal data;

(c) the scope of the restrictions introduced;

(d) the safeguards to prevent abuse or unlawful access or transfer;

(e) the specification of the controller or categories of controllers;

(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g) the risks to the rights and freedoms of data subjects; and

(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

中文参考译文

数据控制者或处理者适用的欧盟法或成员国法律，可以通过立法措施，限制第12至22条和第34条所规定义务与权利的范围，以及第5条中与第12至22条权利义务相对应的规定；但该限制必须尊重基本权利和自由的本质，并且是在民主社会中为保障下列事项所必需且相称的措施：

(a) 国家安全；

(b) 国防；

(c) 公共安全；

(d) 预防、调查、侦查或起诉刑事犯罪，或执行刑事处罚，包括防范和预防对公共安全的威胁；

(e) 欧盟或成员国其他重要的一般公共利益目标，特别是欧盟或成员国重要的经济或金融利益，包括货币、预算和税务事项，以及公共卫生和社会保障；

(f) 保护司法独立和司法程序；

(g) 预防、调查、侦查及追究受监管职业违反职业道德的行为；

(h) 与(a)至(e)项及(g)项所述情况下行使公权力有关的监测、检查或监管职能，即使该联系只是偶然存在；

(i) 保护数据主体或他人的权利和自由；

(j) 执行民事法律请求。

特别是，第1款所述任何立法措施，至少应在相关情况下对下列事项作出具体规定：

(a) 处理目的或处理类别；

(b) 个人数据类别；

(c) 所引入限制的范围；

(d) 防止滥用、非法访问或非法传输的保障措施；

(e) 控制者或控制者类别的具体确定；

(f) 考虑处理或处理类别的性质、范围和目的而确定的保存期限及适用保障措施；

(g) 对数据主体权利和自由的风险；以及

(h) 数据主体被告知该限制的权利，但告知可能损害该限制目的的除外。

查看法规原文

第1节一般义务 / Section 1 — General obligations

第25条设计阶段及默认状态下的数据保护 / Article 25 — Data protection by design and by default

English

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate compliance with the requirements set out in paragraphs 1 and 2 of this Article.

中文参考译文

控制者应考虑现有技术水平、实施成本、处理的性质、范围、背景和目的，以及该处理对自然人权利和自由构成的、发生可能性和严重程度各不相同的风险，在确定处理方式时以及实际进行处理时，均采取适当的技术和组织措施，例如假名化。这些措施应旨在有效落实数据最小化等数据保护原则，并将必要保障纳入处理，以满足本条例要求并保护数据主体的权利。
控制者应采取适当的技术和组织措施，确保在默认状态下，仅处理为实现每一特定处理目的所必需的个人数据。该义务适用于所收集个人数据的数量、处理程度、存储期限及可访问性。特别是，这些措施应确保在默认状态下，未经个人主动干预，不向不特定数量的自然人开放个人数据的访问。
第42条规定的经批准的认证机制，可以作为证明符合本条第1款和第2款要求的一个要素。

第27条未在欧盟设立机构的控制者或处理者的代表 / Article 27 — Representatives of controllers or processors not established in the Union

English

Where Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.
The obligation laid down in paragraph 1 of this Article shall not apply to:

(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

(b) a public authority or body.

The representative shall be established in one of the Member States where the data subjects, whose personal data are processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.
The representative shall be mandated by the controller or processor to be addressed in addition to or instead of the controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to processing, for the purposes of ensuring compliance with this Regulation.
The designation of a representative by the controller or processor shall be without prejudice to legal actions which could be initiated against the controller or the processor themselves.

中文参考译文

适用第3条第2款时，控制者或处理者应以书面形式指定一名位于欧盟境内的代表。
本条第1款规定的义务不适用于下列情形：

(a) 处理属于偶发性处理，不包含大规模处理第9条第1款所述特殊类别数据或者第10条所述与刑事定罪及犯罪有关的个人数据，并且考虑处理的性质、背景、范围和目的后，不太可能对自然人的权利和自由造成风险；或者

(b) 公共机关或公共机构。

代表应设立于下列数据主体所在的某一成员国：其个人数据因向其提供商品或服务而被处理的数据主体，或者其行为受到监测的数据主体。
控制者或处理者应授权该代表，使监管机构和数据主体等能够就与处理有关的所有事项，在联系控制者或处理者的同时或者代替联系控制者或处理者而联系该代表，以确保遵守本条例。
控制者或处理者指定代表，不影响针对控制者或处理者本身可能提起的法律诉讼。

第28条处理者 / Article 28 — Processor

English

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.
The processor shall not engage another processor without prior specific or general written authorisation of the controller. In the case of general written authorisation, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes.
Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:

(a) processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

(c) takes all measures required pursuant to Article 32;

(d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.

Where a processor engages another processor for carrying out specific processing activities on behalf of the controller, the same data protection obligations as set out in the contract or other legal act between the controller and the processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where that other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the controller for the performance of that other processor's obligations.
Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.
Without prejudice to an individual contract between the controller and the processor, the contract or the other legal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual clauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the controller or processor pursuant to Articles 42 and 43.
The Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the examination procedure referred to in Article 93(2).
A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.
The contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic form.
Without prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes and means of processing, the processor shall be considered to be a controller in respect of that processing.

中文参考译文

处理拟由他人代表控制者进行的，控制者仅可委托能够提供充分保证的处理者，以确保其采取适当的技术和组织措施，使处理满足本条例要求并确保数据主体的权利得到保护。
未经控制者事先作出的特定或一般书面授权，处理者不得另行委托其他处理者。获得一般书面授权时，处理者应将拟增加或替换其他处理者的任何变化告知控制者，从而使控制者有机会对这些变化提出异议。
处理者的处理应受欧盟或成员国法律下的合同或其他法律文件约束，该合同或法律文件就控制者而言对处理者具有约束力，并应规定处理的事项与期限、处理的性质与目的、个人数据的类型与数据主体的类别，以及控制者的义务与权利。该合同或其他法律文件尤其应规定，处理者须：

(a) 仅依据控制者有记录的指示处理个人数据，包括向第三国或国际组织传输个人数据的指示；但处理者所受约束的欧盟或成员国法律要求其处理的除外。在此情况下，处理者应在处理前将该法律要求告知控制者，除非该法律基于重大公共利益理由禁止作出该告知；

(b) 确保获授权处理个人数据的人员已经作出保密承诺，或者负有适当的法定保密义务；

(c) 采取第32条要求的所有措施；

(d) 遵守第2款和第4款所述另行委托其他处理者的条件；

(e) 考虑处理的性质，在可能的范围内，通过适当的技术和组织措施协助控制者履行其回应数据主体行使第三章规定权利之请求的义务；

(f) 考虑处理的性质及处理者能够获得的信息，协助控制者确保履行第32条至第36条规定的义务；

(g) 在与处理有关的服务提供结束后，按照控制者的选择删除全部个人数据或将其返还控制者，并删除现有副本，除非欧盟或成员国法律要求保存这些个人数据；

(h) 向控制者提供证明履行本条义务所必需的全部信息，并允许和协助控制者或其授权的其他审计人员开展审计，包括检查。

就第一段(h)项而言，处理者认为某项指示违反本条例或者欧盟或成员国其他数据保护规定的，应立即告知控制者。

处理者另行委托其他处理者代表控制者开展特定处理活动的，应通过欧盟或成员国法律下的合同或其他法律文件，使该其他处理者承担第3款所述控制者与处理者之间的合同或其他法律文件中规定的相同数据保护义务；尤其应提供充分保证，采取适当的技术和组织措施，使处理满足本条例要求。该其他处理者未履行其数据保护义务的，最初的处理者仍应就该其他处理者履行其义务向控制者承担全部责任。
处理者遵守第40条所述经批准的行为准则，或者采用第42条所述经批准的认证机制，可以作为证明本条第1款和第4款所述充分保证的一个要素。
在不影响控制者与处理者之间个别合同的情况下，本条第3款和第4款所述合同或其他法律文件可以全部或部分以本条第7款和第8款所述标准合同条款为基础，包括这些条款属于依据第42条和第43条授予控制者或处理者之认证的一部分的情况。
欧盟委员会可以就本条第3款和第4款所述事项，按照第93条第2款所述审查程序制定标准合同条款。
监管机构可以就本条第3款和第4款所述事项，按照第63条所述一致性机制通过标准合同条款。
第3款和第4款所述合同或其他法律文件应采用书面形式，包括电子形式。
在不影响第82条、第83条和第84条的情况下，处理者通过自行决定处理目的和方式而违反本条例的，就该处理而言，该处理者应被视为控制者。

第30条处理活动记录 / Article 30 — Records of processing activities

English

Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information:

(a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;

(b) the purposes of the processing;

(c) a description of the categories of data subjects and of the categories of personal data;

(d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;

(e) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

(f) where possible, the envisaged time limits for erasure of the different categories of data;

(g) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

Each processor and, where applicable, the processor's representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing:

(a) the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer;

(b) the categories of processing carried out on behalf of each controller;

(c) where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

(d) where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.
The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request.
The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

中文参考译文

每一控制者以及在适用情况下其代表，应保存由其负责的处理活动记录。记录应包含下列全部信息：

(a) 控制者的名称和联系方式，以及在适用情况下共同控制者、控制者代表和数据保护官的名称或姓名及联系方式；

(b) 处理目的；

(c) 数据主体类别和个人数据类别的说明；

(d) 个人数据已经或将要向其披露的接收方类别，包括第三国或国际组织中的接收方；

(e) 在适用情况下，向第三国或国际组织传输个人数据的情况，包括该第三国或国际组织的身份信息；对于第49条第1款第二段所述传输，还应包括适当保障措施的记录文件；

(f) 在可能的情况下，预计删除不同类别数据的期限；

(g) 在可能的情况下，对第32条第1款所述技术和组织安全措施的一般说明。

每一处理者以及在适用情况下其代表，应保存代表控制者开展的各类别处理活动记录，记录应包含：

(a) 处理者或各处理者，以及该处理者所代表的每一控制者的名称和联系方式；并在适用情况下，包含控制者代表或处理者代表，以及数据保护官的名称或姓名及联系方式；

(b) 代表每一控制者开展的处理的类别；

(c) 在适用情况下，向第三国或国际组织传输个人数据的情况，包括该第三国或国际组织的身份信息；对于第49条第1款第二段所述传输，还应包括适当保障措施的记录文件；

(d) 在可能的情况下，对第32条第1款所述技术和组织安全措施的一般说明。

第1款和第2款所述记录应采用书面形式，包括电子形式。
控制者或处理者，以及在适用情况下控制者或处理者的代表，应根据监管机构的要求向其提供记录。
第1款和第2款所述义务不适用于雇员少于250人的企业或组织；但是，其开展的处理可能对数据主体的权利和自由造成风险、处理并非偶发性处理，或者处理包含第9条第1款所述特殊类别数据或第10条所述与刑事定罪及犯罪有关的个人数据的除外。

第2节个人数据安全 / Section 2 — Security of personal data

第32条处理安全 / Article 32 — Security of processing

English

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

(a) the pseudonymisation and encryption of personal data;

(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.
Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article.
The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.

中文参考译文

控制者和处理者应考虑现有技术水平、实施成本、处理的性质、范围、背景和目的，以及对自然人权利和自由构成的、发生可能性和严重程度各不相同的风险，采取适当的技术和组织措施，确保与风险相适应的安全水平；其中应酌情包括但不限于：

(a) 对个人数据进行假名化和加密；

(b) 确保处理系统和服务持续具备保密性、完整性、可用性和韧性的能力；

(c) 在发生物理或技术事件时，及时恢复个人数据可用性及其访问的能力；

(d) 定期测试、评估和评价用于确保处理安全的技术和组织措施之有效性的程序。

评估适当的安全水平时，应特别考虑处理所带来的风险，尤其是对传输、存储或以其他方式处理的个人数据的意外或非法毁损、丢失、更改、未经授权的披露或访问所产生的风险。
遵守第40条所述经批准的行为准则，或者采用第42条所述经批准的认证机制，可以作为证明符合本条第1款要求的一个要素。
控制者和处理者应采取措施，确保在控制者或处理者授权下行事且能够访问个人数据的任何自然人，仅依控制者的指示处理这些数据；但欧盟或成员国法律要求该自然人处理的除外。

第33条向监管机构通报个人数据泄露事件 / Article 33 — Notification of a personal data breach to the supervisory authority

English

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
The processor shall notify the controller without undue delay after becoming aware of a personal data breach.
The notification referred to in paragraph 1 shall at least:

(a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

(b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

(c) describe the likely consequences of the personal data breach;

(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay.
The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article.

中文参考译文

发生个人数据泄露事件时，控制者应无不当迟延地向依第55条具有管辖权的监管机构通报该事件，并在可行的情况下，不迟于知悉事件后72小时；但该个人数据泄露事件不太可能对自然人的权利和自由造成风险的除外。未在72小时内向监管机构作出通报的，应附上迟延理由。
处理者应在知悉个人数据泄露事件后，无不当迟延地通知控制者。
第1款所述通报至少应：

(a) 说明个人数据泄露事件的性质，包括在可能的情况下，受影响数据主体的类别和大致人数，以及受影响个人数据记录的类别和大致数量；

(b) 提供数据保护官或其他能够提供更多信息的联络点的名称或姓名及联系方式；

(c) 说明个人数据泄露事件可能造成的后果；

(d) 说明控制者为处理该事件已经采取或拟采取的措施，包括在适当情况下减轻其可能不利影响的措施。

无法同时提供信息的，可以在无法同时提供的范围内分阶段提供，但不得因此产生进一步的不当迟延。
控制者应记录任何个人数据泄露事件，包括与事件有关的事实、事件的影响及已经采取的补救行动。这些记录应使监管机构能够核实是否遵守本条。

第34条向数据主体告知个人数据泄露事件 / Article 34 — Communication of a personal data breach to the data subject

English

When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3).
The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:

(a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;

(c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met.

中文参考译文

个人数据泄露事件可能对自然人的权利和自由造成高风险时，控制者应无不当迟延地向数据主体告知该事件。
本条第1款所述向数据主体作出的告知，应以清晰、浅显的语言说明个人数据泄露事件的性质，并至少包含第33条第3款(b)、(c)和(d)项所述信息及措施。
符合下列任何条件的，无须作出第1款所述向数据主体的告知：

(a) 控制者已经采取适当的技术和组织保护措施，并且这些措施已应用于受个人数据泄露事件影响的个人数据，特别是加密等能够使未经授权访问者无法理解个人数据的措施；

(b) 控制者已经采取后续措施，确保第1款所述对数据主体权利和自由的高风险不再可能成为现实；

(c) 作出告知将需要付出不成比例的努力。在此情况下，应以公开告知或类似措施替代，以同等有效的方式使数据主体知悉。

控制者尚未向数据主体告知个人数据泄露事件的，监管机构在考虑该事件导致高风险的可能性后，可以要求其作出告知，也可以认定第3款所述任何条件已经满足。

查看法规原文

第3节数据保护影响评估与事前咨询 / Section 3 — Data protection impact assessment and prior consultation

第35条数据保护影响评估 / Article 35 — Data protection impact assessment

English

Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.
The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment.
A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:

(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or

(c) a systematic monitoring of a publicly accessible area on a large scale.

The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68.
The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board.
Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union.
The assessment shall contain at least:

(a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

(c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

Compliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors shall be taken into due account in assessing the impact of the processing operations performed by such controllers or processors, in particular for the purposes of a data protection impact assessment.
Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.
Where processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the Member State to which the controller is subject, that law regulates the specific processing operation or set of operations in question, and a data protection impact assessment has already been carried out as part of a general impact assessment in the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be necessary to carry out such an assessment prior to processing activities.
Where necessary, the controller shall carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations.

中文参考译文

某类处理，尤其是使用新技术的处理，在考虑处理的性质、范围、背景和目的后，可能对自然人的权利和自由造成高风险的，控制者应在处理前评估拟开展的处理操作对个人数据保护的影响。一次评估可以涵盖一组具有类似高风险的类似处理操作。
控制者开展数据保护影响评估时，已经指定数据保护官的，应征求数据保护官的意见。
尤其在下列情况下，应开展第1款所述数据保护影响评估：

(a) 基于自动化处理（包括画像分析），对与自然人有关的个人方面进行系统且广泛的评价，并据此作出对该自然人产生法律效果或类似重大影响的决定；

(b) 大规模处理第9条第1款所述特殊类别数据，或者第10条所述与刑事定罪及犯罪有关的个人数据；或者

(c) 对公众可进入的区域进行大规模系统性监测。

监管机构应制定并公布依第1款须开展数据保护影响评估的处理操作类型清单。监管机构应将这些清单通报第68条所述欧洲数据保护委员会。
监管机构也可以制定并公布无须开展数据保护影响评估的处理操作类型清单。监管机构应将这些清单通报欧洲数据保护委员会。
在通过第4款和第5款所述清单之前，如果清单涉及的处理活动与在多个成员国向数据主体提供商品或服务、或者监测其行为有关，或者可能实质影响个人数据在欧盟内自由流动，主管监管机构应适用第63条所述一致性机制。
评估至少应包含：

(a) 对拟开展的处理操作及处理目的的系统说明，包括在适用情况下控制者所追求的正当利益；

(b) 对处理操作相对于处理目的之必要性及相称性的评估；

(c) 对第1款所述数据主体权利和自由所面临风险的评估；以及

(d) 拟用于应对风险的措施，包括为确保个人数据保护并证明遵守本条例而设置的保障措施、安全措施和机制，同时考虑数据主体及其他有关人员的权利与正当利益。

评估有关控制者或处理者所开展处理操作的影响时，尤其是为开展数据保护影响评估，应适当考虑这些控制者或处理者遵守第40条所述经批准的行为准则的情况。
在适当情况下，控制者应就拟进行的处理征求数据主体或其代表的意见，但不得影响对商业利益或公共利益的保护，或者处理操作的安全。
根据第6条第1款(c)或(e)项进行的处理，在欧盟法律或控制者所受约束的成员国法律中具有法律依据，该法律规制相关的特定处理操作或一组处理操作，并且在制定该法律依据时，已经作为一般影响评估的一部分开展数据保护影响评估的，不适用第1款至第7款；但成员国认为有必要在处理活动前开展此类评估的除外。
必要时，控制者应开展复核，以评估处理是否按照数据保护影响评估进行；至少在处理操作所带来的风险发生变化时，应进行该复核。

第36条事前咨询 / Article 36 — Prior consultation

English

The controller shall consult the supervisory authority prior to processing where a data protection impact assessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk.
Where the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the supervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written advice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58. That period may be extended by six weeks, taking into account the complexity of the intended processing. The supervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one month of receipt of the request for consultation together with the reasons for the delay. Those periods may be suspended until the supervisory authority has obtained information it has requested for the purposes of the consultation.
When consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory authority with:

(a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;

(b) the purposes and means of the intended processing;

(c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

(d) where applicable, the contact details of the data protection officer;

(e) the data protection impact assessment provided for in Article 35; and

(f) any other information requested by the supervisory authority.

Member States shall consult the supervisory authority during the preparation of a proposal for a legislative measure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which relates to processing.
Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.

中文参考译文

第35条规定的数据保护影响评估表明，在控制者不采取降低风险的措施时，处理将导致高风险的，控制者应在处理前咨询监管机构。
监管机构认为第1款所述拟进行的处理将违反本条例，尤其是控制者未充分识别或降低风险的，监管机构应在收到咨询请求后至多八周内，向控制者以及在适用情况下向处理者提供书面意见，并可行使第58条所述的任何权力。考虑拟进行处理的复杂性，该期限可以延长六周。监管机构应在收到咨询请求后一个月内，向控制者以及在适用情况下向处理者告知该延期及迟延理由。在监管机构取得其为咨询目的所要求提供的信息之前，可以中止计算上述期限。
根据第1款向监管机构咨询时，控制者应向监管机构提供：

(a) 在适用情况下，参与处理的控制者、共同控制者和处理者的各自责任，尤其是企业集团内部处理的责任；

(b) 拟进行处理的目的和方式；

(c) 按照本条例为保护数据主体权利和自由而提供的措施与保障；

(d) 在适用情况下，数据保护官的联系方式；

(e) 第35条规定的数据保护影响评估；以及

(f) 监管机构要求的任何其他信息。

成员国在拟订由其国家议会通过的、与处理有关的立法措施提案，或者以该立法措施为依据的监管措施时，应咨询监管机构。
尽管有第1款规定，成员国法律仍可要求控制者，就其为履行公共利益任务而进行的处理，包括与社会保障和公共卫生有关的处理，咨询监管机构并获得其事前授权。

第4节数据保护官 / Section 4 — Data protection officer

第37条数据保护官的指定 / Article 37 — Designation of the data protection officer

English

The controller and the processor shall designate a data protection officer in any case where:

(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment.
Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size.
In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors.
The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.
The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract.
The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.

中文参考译文

在下列任何情况下，控制者和处理者应指定数据保护官：

(a) 处理由公共机关或公共机构进行，但法院履行司法职能时进行的处理除外；

(b) 控制者或处理者的核心活动包含因其性质、范围和／或目的而需要对数据主体进行大规模、经常性和系统性监测的处理操作；或者

(c) 控制者或处理者的核心活动包含大规模处理第9条规定的特殊类别数据，以及第10条所述与刑事定罪及犯罪有关的个人数据。

企业集团可以任命一名共同的数据保护官，条件是每一机构都能够方便地与该数据保护官取得联系。
控制者或处理者为公共机关或公共机构的，可以考虑其组织结构和规模，为多个此类机关或机构指定同一名数据保护官。
在第1款所述情形以外，控制者、处理者，或者代表各类控制者或处理者的协会及其他组织，可以指定数据保护官；欧盟或成员国法律要求指定的，则应指定。数据保护官可以代表这些协会及其他代表控制者或处理者的组织履职。
数据保护官的指定应以专业素质为依据，尤其应考虑其数据保护法律和实践方面的专业知识，以及履行第39条所述职责的能力。
数据保护官可以是控制者或处理者的工作人员，也可以依据服务合同履行职责。
控制者或处理者应公布数据保护官的联系方式，并将其通报监管机构。

第38条数据保护官的地位 / Article 38 — Position of the data protection officer

English

The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.
The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge.
The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor.
Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation.
The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law.
The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests.

中文参考译文

控制者和处理者应确保数据保护官适当且及时地参与所有与个人数据保护有关的事项。
控制者和处理者应支持数据保护官履行第39条所述职责，提供履行这些职责、访问个人数据和处理操作以及维持其专业知识所必需的资源。
控制者和处理者应确保数据保护官在履行这些职责方面不接受任何指示。控制者或处理者不得因数据保护官履行职责而将其解职或对其处罚。数据保护官应直接向控制者或处理者的最高管理层报告。
数据主体可以就与处理其个人数据以及行使本条例所规定权利有关的所有事项，联系数据保护官。
数据保护官应按照欧盟或成员国法律，就其履行职责的有关事项承担守密或保密义务。
数据保护官可以履行其他任务和职责。控制者或处理者应确保这些任务和职责不会导致利益冲突。

第39条数据保护官的职责 / Article 39 — Tasks of the data protection officer

English

The data protection officer shall have at least the following tasks:

(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;

(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

(d) to cooperate with the supervisory authority;

(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

The data protection officer shall in the performance of his or her tasks have due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

中文参考译文

数据保护官至少应履行下列职责：

(a) 向控制者或处理者，以及开展处理的员工，告知并提供咨询，说明其依据本条例及欧盟或成员国其他数据保护规定承担的义务；

(b) 监督对本条例、欧盟或成员国其他数据保护规定，以及控制者或处理者有关个人数据保护政策的遵守情况，包括责任分配、参与处理操作的员工的意识提升和培训，以及相关审计；

(c) 在被要求时，就数据保护影响评估提供意见，并依第35条监督其开展；

(d) 与监管机构合作；

(e) 作为监管机构就处理相关事项的联络点，包括第36条所述事前咨询，并在适当情况下就任何其他事项进行咨询。

数据保护官履行职责时，应考虑处理的性质、范围、背景和目的，适当关注与处理操作有关的风险。

第5节行为准则与认证 / Section 5 — Codes of conduct and certification

第40条行为准则 / Article 40 — Codes of conduct

English

The Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of codes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific features of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.
Associations and other bodies representing categories of controllers or processors may prepare codes of conduct, or amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to:

(a) fair and transparent processing;

(b) the legitimate interests pursued by controllers in specific contexts;

(c) the collection of personal data;

(d) the pseudonymisation of personal data;

(e) the information provided to the public and to data subjects;

(f) the exercise of the rights of data subjects;

(g) the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained;

(h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;

(i) the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects;

(j) the transfer of personal data to third countries or international organisations; or

(k) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79.

In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide appropriate safeguards within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards including with regard to the rights of data subjects.
A code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body referred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers or processors which undertake to apply it, without prejudice to the tasks and powers of supervisory authorities competent pursuant to Article 55 or 56.
Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory authority which is competent pursuant to Article 55. The supervisory authority shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if it finds that it provides sufficient appropriate safeguards.
Where the draft code, or amendment or extension is approved in accordance with paragraph 5, and where the code of conduct concerned does not relate to processing activities in several Member States, the supervisory authority shall register and publish the code.
Where a draft code of conduct relates to processing activities in several Member States, the supervisory authority which is competent pursuant to Article 55 shall, before approving the draft code, amendment or extension, submit it in the procedure referred to in Article 63 to the Board which shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation or, in the situation referred to in paragraph 3 of this Article, provides appropriate safeguards.
Where the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies with this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall submit its opinion to the Commission.
The Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or extension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2).
The Commission shall ensure appropriate publicity for the approved codes which have been decided as having general validity in accordance with paragraph 9.
The Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make them publicly available by way of appropriate means.

中文参考译文

成员国、监管机构、欧洲数据保护委员会和欧盟委员会应鼓励拟订有助于正确适用本条例的行为准则，并考虑各处理行业的具体特点，以及微型、小型和中型企业的具体需求。
代表各类控制者或处理者的协会及其他组织，可以拟订行为准则，或者修订或扩展这些准则，以具体明确本条例的适用，例如涉及下列事项：

(a) 公平且透明的处理；

(b) 控制者在特定背景下追求的正当利益；

(c) 个人数据的收集；

(d) 个人数据的假名化；

(e) 向公众和数据主体提供的信息；

(f) 数据主体权利的行使；

(g) 向儿童提供的信息及对儿童的保护，以及取得对儿童负有父母责任者同意的方式；

(h) 第24条和第25条所述措施与程序，以及第32条所述确保处理安全的措施；

(i) 向监管机构通报个人数据泄露事件，以及向数据主体告知这些事件；

(j) 向第三国或国际组织传输个人数据；或者

(k) 用于解决控制者与数据主体之间有关处理争议的庭外程序及其他争议解决程序，但不影响数据主体依据第77条和第79条享有的权利。

除受本条例约束的控制者或处理者可以遵守外，依本条第5款获批准并依本条第9款具有普遍效力的行为准则，也可由根据第3条不受本条例约束的控制者或处理者遵守，以在按照第46条第2款(e)项所述条件向第三国或国际组织传输个人数据的框架内提供适当保障。这些控制者或处理者应通过合同或其他具有法律约束力的文件，作出具有约束力和可执行性的承诺，以落实上述适当保障，包括有关数据主体权利的保障。
本条第2款所述行为准则应包含相应机制，使第41条第1款所述组织能够对承诺适用该准则的控制者或处理者遵守准则规定的情况实施强制监督，但不影响根据第55条或第56条具有管辖权的监管机构的职责和权力。
本条第2款所述协会和其他组织拟制定行为准则，或者修订或扩展现有准则的，应将准则草案、修订或扩展文本提交依第55条具有管辖权的监管机构。监管机构应就该草案、修订或扩展是否符合本条例提出意见；认定其提供了充分且适当保障的，应批准该草案、修订或扩展。
准则草案、修订或扩展依第5款获批准，且相关行为准则不涉及多个成员国的处理活动的，监管机构应登记并公布该准则。
行为准则草案涉及多个成员国的处理活动的，依第55条具有管辖权的监管机构在批准准则草案、修订或扩展之前，应按照第63条所述程序将其提交欧洲数据保护委员会。欧洲数据保护委员会应就该草案、修订或扩展是否符合本条例，或者在本条第3款所述情况下是否提供适当保障，提出意见。
第7款所述意见确认准则草案、修订或扩展符合本条例，或者在第3款所述情况下提供了适当保障的，欧洲数据保护委员会应将其意见提交欧盟委员会。
欧盟委员会可以通过实施法案，决定依本条第8款提交的、已经批准的行为准则、修订或扩展在欧盟内具有普遍效力。这些实施法案应按照第93条第2款规定的审查程序通过。
欧盟委员会应确保依第9款决定具有普遍效力的经批准准则得到适当公开。
欧洲数据保护委员会应将所有经批准的行为准则、修订和扩展汇编于登记册，并通过适当方式向公众提供。

第41条对经批准行为准则的监督 / Article 41 — Monitoring of approved codes of conduct

English

Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.
A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:

(a) demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;

(b) established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;

(c) established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

(d) demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.

The competent supervisory authority shall submit the draft criteria for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.
Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.
The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the conditions for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.
This Article shall not apply to processing carried out by public authorities and bodies.

中文参考译文

在不影响主管监管机构依据第57条和第58条所享有职责与权力的情况下，对第40条规定的行为准则遵守情况的监督，可以由对该准则所涉事项具有适当专业知识水平、并为此获得主管监管机构认可的组织实施。
第1款所述组织符合下列条件的，可以获得监督行为准则遵守情况的认可：

(a) 已就其在准则所涉事项方面的独立性和专业知识作出证明，并令主管监管机构满意；

(b) 已建立程序，使其能够评估有关控制者和处理者适用该准则的资格，监督其遵守准则规定的情况，并定期审查准则的运行；

(c) 已建立程序和组织机制，处理有关违反准则或者控制者、处理者过去或当前实施准则方式的投诉，并使这些程序和机制对数据主体和公众保持透明；以及

(d) 已向主管监管机构作出令其满意的证明，表明其任务和职责不会导致利益冲突。

主管监管机构应依第63条所述一致性机制，将本条第1款所述组织的认可标准草案提交欧洲数据保护委员会。
在不影响主管监管机构的职责和权力以及第八章规定的情况下，本条第1款所述组织应在具备适当保障的前提下，针对控制者或处理者违反准则的情况采取适当行动，包括暂停有关控制者或处理者参与准则，或者将其排除在准则之外。该组织应将这些行动及采取行动的理由告知主管监管机构。
第1款所述组织未满足或不再满足认可条件，或者该组织采取的行动违反本条例的，主管监管机构应撤销对该组织的认可。
本条不适用于公共机关和公共机构开展的处理。

第42条认证 / Article 42 — Certification

English

The Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at Union level, the establishment of data protection certification mechanisms and of data protection seals and marks, for the purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors. The specific needs of micro, small and medium-sized enterprises shall be taken into account.
In addition to adherence by controllers or processors subject to this Regulation, data protection certification mechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of demonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this Regulation pursuant to Article 3 within the framework of personal data transfers to third countries or international organisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding and enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards, including with regard to the rights of data subjects.
The certification shall be voluntary and available via a process that is transparent.
A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which are competent pursuant to Article 55 or 56.
A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal.
The controller or processor which submits its processing to the certification mechanism shall provide the certification body referred to in Article 43, or where applicable, the competent supervisory authority, with all information and access to its processing activities which are necessary to conduct the certification procedure.
Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the requirements for the certification are not or are no longer met.
The Board shall collate all certification mechanisms and data protection seals and marks in a register and shall make them publicly available by any appropriate means.

中文参考译文

成员国、监管机构、欧洲数据保护委员会和欧盟委员会应鼓励建立数据保护认证机制、数据保护印章和标志，尤其是在欧盟层面建立，以证明控制者和处理者的处理操作符合本条例。应考虑微型、小型和中型企业的具体需求。
除供受本条例约束的控制者或处理者采用外，依本条第5款获批准的数据保护认证机制、印章或标志，还可以为下列目的而建立：在按照第46条第2款(f)项所述条件向第三国或国际组织传输个人数据的框架内，证明根据第3条不受本条例约束的控制者或处理者提供了适当保障。这些控制者或处理者应通过合同或其他具有法律约束力的文件，作出具有约束力和可执行性的承诺，以落实这些适当保障，包括有关数据主体权利的保障。
认证应属自愿，并可通过透明的程序取得。
依据本条取得认证，不减轻控制者或处理者遵守本条例的责任，也不影响依第55条或第56条具有管辖权的监管机构的职责和权力。
本条规定的认证，应由第43条所述认证机构或主管监管机构，根据该主管监管机构依第58条第3款批准的标准，或者欧洲数据保护委员会依第63条批准的标准，予以签发。标准由欧洲数据保护委员会批准的，可以形成共同认证，即“欧洲数据保护印章”。
将其处理提交认证机制的控制者或处理者，应向第43条所述认证机构，或者在适用情况下向主管监管机构，提供开展认证程序所必需的全部信息以及对其处理活动的访问。
向控制者或处理者签发的认证，有效期最长为三年；持续满足相关要求的，可以在相同条件下续期。不满足或不再满足认证要求的，应视情况由第43条所述认证机构或主管监管机构撤销认证。
欧洲数据保护委员会应将所有认证机制、数据保护印章和标志汇编于登记册，并通过任何适当方式向公众提供。

第43条认证机构 / Article 43 — Certification bodies

English

Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, certification bodies which have an appropriate level of expertise in relation to data protection shall, after informing the supervisory authority in order to allow it to exercise its powers pursuant to point (h) of Article 58(2) where necessary, issue and renew certification. Member States shall ensure that those certification bodies are accredited by one or both of the following:

(a) the supervisory authority which is competent pursuant to Article 55 or 56;

(b) the national accreditation body named in accordance with Regulation (EC) No 765/2008 of the European Parliament and of the Council 20 in accordance with EN-ISO/IEC 17065/2012 and with the additional requirements established by the supervisory authority which is competent pursuant to Article 55 or 56.

Certification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where they have:

(a) demonstrated their independence and expertise in relation to the subject-matter of the certification to the satisfaction of the competent supervisory authority;

(b) undertaken to respect the criteria referred to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63;

(c) established procedures for the issuing, periodic review and withdrawal of data protection certification, seals and marks;

(d) established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification has been, or is being, implemented by the controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

(e) demonstrated, to the satisfaction of the competent supervisory authority, that their tasks and duties do not result in a conflict of interests.

The accreditation of certification bodies as referred to in paragraphs 1 and 2 of this Article shall take place on the basis of criteria approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63. In the case of accreditation pursuant to point (b) of paragraph 1 of this Article, those requirements shall complement those envisaged in Regulation (EC) No 765/2008 and the technical rules that describe the methods and procedures of the certification bodies.
The certification bodies referred to in paragraph 1 shall be responsible for the proper assessment leading to the certification or the withdrawal of such certification without prejudice to the responsibility of the controller or processor for compliance with this Regulation. The accreditation shall be issued for a maximum period of five years and may be renewed on the same conditions provided that the certification body meets the requirements set out in this Article.
The certification bodies referred to in paragraph 1 shall provide the competent supervisory authorities with the reasons for granting or withdrawing the requested certification.
The requirements referred to in paragraph 3 of this Article and the criteria referred to in Article 42(5) shall be made public by the supervisory authority in an easily accessible form. The supervisory authorities shall also transmit those requirements and criteria to the Board. The Board shall collate all certification mechanisms and data protection seals in a register and shall make them publicly available by any appropriate means.
Without prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall revoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the accreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation.
The Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of specifying the requirements to be taken into account for the data protection certification mechanisms referred to in Article 42(1).
The Commission may adopt implementing acts laying down technical standards for certification mechanisms and data protection seals and marks, and mechanisms to promote and recognise those certification mechanisms, seals and marks. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

中文参考译文

在不影响主管监管机构依据第57条和第58条所享有职责与权力的情况下，具有适当数据保护专业知识水平的认证机构，应在告知监管机构、使其能够在必要时行使第58条第2款(h)项规定的权力后，签发和续期认证。成员国应确保这些认证机构获得下列一方或双方的认可：

(a) 依第55条或第56条具有管辖权的监管机构；

(b) 按照欧洲议会和理事会第765/2008号条例（EC）20指定的国家认可机构；认可应依据EN-ISO/IEC 17065/2012，以及依第55条或第56条具有管辖权的监管机构制定的附加要求进行。

第1款所述认证机构仅在符合下列条件时，方可按照该款获得认可：

(a) 已就其在认证所涉事项方面的独立性和专业知识作出证明，并令主管监管机构满意；

(b) 已承诺遵守第42条第5款所述、由依第55条或第56条具有管辖权的监管机构批准，或者由欧洲数据保护委员会依第63条批准的标准；

(c) 已建立签发、定期审查及撤销数据保护认证、印章和标志的程序；

(d) 已建立程序和组织机制，处理有关违反认证要求，或者控制者、处理者过去或当前实施认证方式的投诉，并使这些程序和机制对数据主体和公众保持透明；以及

(e) 已向主管监管机构作出令其满意的证明，表明其任务和职责不会导致利益冲突。

对本条第1款和第2款所述认证机构的认可，应依据依第55条或第56条具有管辖权的监管机构批准的标准，或者欧洲数据保护委员会依第63条批准的标准进行。依本条第1款(b)项进行认可的，这些要求应作为对第765/2008号条例（EC）所规定要求，以及描述认证机构方法和程序之技术规则的补充。
第1款所述认证机构应对导致签发认证或撤销该认证的适当评估负责，但不影响控制者或处理者遵守本条例的责任。认可的有效期最长为五年；认证机构满足本条规定要求的，可以在相同条件下续期。
第1款所述认证机构应向主管监管机构说明授予或撤销所申请认证的理由。
本条第3款所述要求以及第42条第5款所述标准，应由监管机构以易于获取的形式公开。监管机构还应将这些要求和标准传送欧洲数据保护委员会。欧洲数据保护委员会应将所有认证机制和数据保护印章汇编于登记册，并通过任何适当方式向公众提供。
在不影响第八章的情况下，认可条件未满足或不再满足，或者认证机构采取的行动违反本条例的，主管监管机构或国家认可机构应撤销对本条第1款所述认证机构的认可。
欧盟委员会应获授权依第92条通过授权法案，以具体规定第42条第1款所述数据保护认证机制应考虑的要求。
欧盟委员会可以通过实施法案，制定认证机制、数据保护印章和标志的技术标准，以及推广和承认这些认证机制、印章和标志的机制。这些实施法案应按照第93条第2款所述审查程序通过。

查看法规原文

第45条基于充分性决定的传输 / Article 45 — Transfers on the basis of an adequacy decision

English

A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:

(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred;

(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and

(c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.
The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect.

Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).

The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5.
A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49.
The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.
Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.

中文参考译文

欧盟委员会已经决定某第三国、该第三国境内的某一领土或一个或多个特定行业，或者有关国际组织确保了充分保护水平的，可以向该第三国或国际组织传输个人数据。此类传输无须取得任何特定授权。
评估保护水平的充分性时，欧盟委员会尤其应考虑下列要素：

(a) 法治、对人权和基本自由的尊重、相关的一般性和行业性立法，包括有关公共安全、国防、国家安全、刑法以及公共机关访问个人数据的立法；上述立法的实施情况、数据保护规则、职业规则和安全措施，包括该国家或国际组织所遵守的向另一第三国或国际组织继续传输个人数据的规则；判例法；以及针对个人数据正在被传输的数据主体，是否存在有效且可执行的数据主体权利，以及有效的行政和司法救济；

(b) 第三国内或者对国际组织具有监管权限的一个或多个独立监管机构的存在及有效运作情况；这些机构应负责确保并执行数据保护规则，包括具备充分执法权力，协助数据主体行使权利并向其提供意见，以及与成员国监管机构合作；以及

(c) 有关第三国或国际组织已经作出的国际承诺，或者由具有法律约束力的公约或文件，以及由其参与多边或区域性体系而产生的其他义务，尤其是有关个人数据保护的义务。

欧盟委员会在评估保护水平的充分性后，可以通过实施法案，决定某第三国、第三国境内的某一领土或一个或多个特定行业，或者某国际组织确保了本条第2款意义上的充分保护水平。该实施法案应规定至少每四年进行一次定期审查的机制，审查应考虑该第三国或国际组织的所有相关发展。实施法案应明确其领土及行业适用范围，并在适用情况下列明本条第2款(b)项所述监管机构。该实施法案应按照第93条第2款所述审查程序通过。
欧盟委员会应持续监测第三国和国际组织的发展，这些发展可能影响依本条第3款以及依第95/46/EC号指令第25条第6款通过的决定的运行。
现有信息表明，尤其是在本条第3款所述审查之后表明，某第三国、第三国境内的某一领土或一个或多个特定行业，或者某国际组织不再确保本条第2款意义上的充分保护水平的，欧盟委员会应在必要范围内，通过不具有溯及力的实施法案，废止、修订或暂停本条第3款所述决定。

这些实施法案应按照第93条第2款所述审查程序通过。

存在经充分说明的紧迫且必要理由时，欧盟委员会应按照第93条第3款所述程序，通过立即适用的实施法案。

欧盟委员会应与第三国或国际组织开展磋商，以补救导致依据第5款作出决定的有关情况。
依据本条第5款作出的决定，不影响根据第46条至第49条，向有关第三国、该第三国境内的某一领土或一个或多个特定行业，或者有关国际组织传输个人数据。
欧盟委员会应在《欧盟官方公报》及其网站上，公布其已经决定确保或不再确保充分保护水平的第三国、第三国境内领土和特定行业，以及国际组织的名单。
欧盟委员会依据第95/46/EC号指令第25条第6款通过的决定，应继续有效，直至由欧盟委员会依本条第3款或第5款通过的决定予以修订、替代或废止。

第46条提供适当保障的传输 / Article 46 — Transfers subject to appropriate safeguards

English

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

(a) a legally binding and enforceable instrument between public authorities or bodies;

(b) binding corporate rules in accordance with Article 47;

(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);

(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights; or

(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects' rights.

Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:

(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or

(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.

The supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to in paragraph 3 of this Article.
Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.

中文参考译文

不存在第45条第3款所述决定的，控制者或处理者只有在提供适当保障，且数据主体享有可执行的权利并可获得有效法律救济的条件下，才可向第三国或国际组织传输个人数据。
第1款所述适当保障可以通过下列方式提供，无须取得监管机构的任何特定授权：

(a) 公共机关或公共机构之间具有法律约束力和可执行性的文件；

(b) 符合第47条的有约束力的公司规则；

(c) 欧盟委员会按照第93条第2款所述审查程序通过的标准数据保护条款；

(d) 由监管机构通过，并由欧盟委员会按照第93条第2款所述审查程序批准的标准数据保护条款；

(e) 依第40条获批准的行为准则，加上第三国的控制者或处理者作出的、落实包括数据主体权利在内的适当保障的具有约束力和可执行性的承诺；或者

(f) 依第42条获批准的认证机制，加上第三国的控制者或处理者作出的、落实包括数据主体权利在内的适当保障的具有约束力和可执行性的承诺。

经主管监管机构授权，第1款所述适当保障还可以特别通过下列方式提供：

(a) 控制者或处理者与第三国或国际组织中的控制者、处理者或个人数据接收方之间的合同条款；或者

(b) 纳入公共机关或公共机构之间行政安排的条款，其中包含可执行且有效的数据主体权利。

在本条第3款所述情况下，监管机构应适用第63条所述一致性机制。
成员国或监管机构依据第95/46/EC号指令第26条第2款作出的授权，应继续有效，直至该监管机构在必要时予以修订、替代或废止。欧盟委员会依据第95/46/EC号指令第26条第4款通过的决定，应继续有效，直至在必要时由欧盟委员会按照本条第2款通过的决定予以修订、替代或废止。

第47条有约束力的公司规则 / Article 47 — Binding corporate rules

English

The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they:

(a) are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees;

(b) expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and

(c) fulfil the requirements laid down in paragraph 2.

The binding corporate rules referred to in paragraph 1 shall specify at least:

(a) the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic activity and of each of its members;

(b) the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected and the identification of the third country or countries in question;

(c) their legally binding nature, both internally and externally;

(d) the application of the general data protection principles, in particular purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for processing, processing of special categories of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules;

(e) the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules;

(f) the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage;

(g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14;

(h) the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group of enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling;

(i) the complaint procedures;

(j) the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for ensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data protection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of such verification should be communicated to the person or entity referred to in point (h) and to the board of the controlling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic activity, and should be available upon request to the competent supervisory authority;

(k) the mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory authority;

(l) the cooperation mechanism with the supervisory authority to ensure compliance by any member of the group of undertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to the supervisory authority the results of verifications of the measures referred to in point (j);

(m) the mechanisms for reporting to the competent supervisory authority any legal requirements to which a member of the group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country which are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and

(n) the appropriate data protection training to personnel having permanent or regular access to personal data.

The Commission may specify the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2).

中文参考译文

有约束力的公司规则符合下列条件的，主管监管机构应按照第63条规定的一致性机制予以批准：

(a) 具有法律约束力，适用于企业集团或从事共同经济活动的企业群体中每一有关成员，包括其员工，并由这些成员执行；

(b) 明确赋予数据主体就其个人数据处理享有的可执行权利；以及

(c) 满足第2款规定的要求。

第1款所述有约束力的公司规则至少应明确：

(a) 企业集团或从事共同经济活动的企业群体，以及其每一成员的结构与联系方式；

(b) 数据传输或一组传输，包括个人数据类别、处理类型及其目的、受影响数据主体的类型，以及所涉第三国的身份信息；

(c) 这些规则在内部和外部的法律约束力；

(d) 一般数据保护原则的适用，尤其是目的限制、数据最小化、有限存储期限、数据质量、设计阶段及默认状态下的数据保护、处理的法律基础、特殊类别个人数据的处理、确保数据安全的措施，以及向不受有约束力的公司规则约束的组织继续传输数据的要求；

(e) 数据主体就处理享有的权利及行使这些权利的方式，包括依第22条不受完全基于自动化处理（包括画像分析）的决定约束的权利、向主管监管机构提出投诉以及依第79条向成员国有管辖权法院寻求救济的权利，以及就违反有约束力的公司规则获得救济并在适当情况下获得赔偿的权利；

(f) 设立于某成员国领土内的控制者或处理者，对任何未在欧盟设立机构的有关成员违反有约束力的公司规则所产生责任的承担；只有在控制者或处理者证明该成员不应对引起损害的事件负责时，方可全部或部分免除其责任；

(g) 除第13条和第14条规定的信息外，如何向数据主体提供有关有约束力的公司规则的信息，尤其是本款(d)、(e)和(f)项所述规定的信息；

(h) 依第37条指定的数据保护官，或者负责监督企业集团或从事共同经济活动的企业群体内部遵守有约束力的公司规则情况的其他人员或实体的职责，以及监督培训和投诉处理的职责；

(i) 投诉程序；

(j) 企业集团或从事共同经济活动的企业群体内部，用于确保核实有约束力的公司规则遵守情况的机制。这些机制应包括数据保护审计，以及确保采取纠正行动以保护数据主体权利的方法。核实结果应通报(h)项所述人员或实体，以及企业集团中控制性企业的董事会，或者从事共同经济活动的企业群体的董事会，并应根据主管监管机构的要求向其提供；

(k) 报告和记录规则变更，并向监管机构报告这些变更的机制；

(l) 与监管机构的合作机制，以确保企业集团或从事共同经济活动的企业群体的任何成员遵守规则，尤其是向监管机构提供对(j)项所述措施的核实结果；

(m) 向主管监管机构报告下列事项的机制：企业集团或从事共同经济活动的企业群体的成员在第三国所受约束的任何法律要求，而这些要求可能对有约束力的公司规则所提供的保障产生重大不利影响；以及

(n) 对持续或经常能够访问个人数据的人员提供的适当数据保护培训。

欧盟委员会可以具体规定控制者、处理者和监管机构之间，就本条意义上的有约束力的公司规则交换信息的格式与程序。这些实施法案应按照第93条第2款规定的审查程序通过。

第49条特定情形的例外 / Article 49 — Derogations for specific situations

English

In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

(d) the transfer is necessary for important reasons of public interest;

(e) the transfer is necessary for the establishment, exercise or defence of legal claims;

(f) the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

(g) the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.

Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.

A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.
Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers.
The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject.
In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission.
The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.

中文参考译文

不存在第45条第3款规定的充分性决定，或者第46条规定的适当保障（包括有约束力的公司规则）的，仅在符合下列条件之一时，才可向第三国或国际组织进行一次或一组个人数据传输：

(a) 数据主体在被告知因缺少充分性决定和适当保障而可能由此类传输给其带来的风险后，已经明确同意拟进行的传输；

(b) 传输为履行数据主体与控制者之间的合同，或者按照数据主体的请求采取合同订立前措施所必需；

(c) 传输为控制者与另一自然人或法人为了数据主体利益而订立或履行合同所必需；

(d) 传输为重大公共利益理由所必需；

(e) 传输为确立、行使或抗辩法律请求权所必需；

(f) 数据主体在身体上或法律上无法表示同意时，传输为保护数据主体或其他人的重大生命利益所必需；

(g) 传输来自依欧盟或成员国法律旨在向公众提供信息，并向一般公众或任何能够证明其正当利益的人开放查询的登记册，但仅限于具体情况下满足欧盟或成员国法律规定的查询条件的范围。

某项传输不能以第45条或第46条的规定（包括有关有约束力的公司规则的规定）为依据，且本款第一段所述特定情形的例外均不适用的，只有同时满足下列条件，才可向第三国或国际组织传输：传输并非重复性传输，仅涉及有限数量的数据主体，为实现控制者所追求的迫切正当利益所必需，且数据主体的利益或权利和自由并不优先于该利益；控制者还须已经评估围绕数据传输的所有情况，并根据评估就个人数据保护提供适当保障。控制者应将该传输告知监管机构。除提供第13条和第14条所述信息外，控制者还应向数据主体告知该传输以及所追求的迫切正当利益。

依第1款第一段(g)项进行的传输，不得涉及登记册所包含的全部个人数据或者完整类别的个人数据。登记册供具有正当利益者查询的，仅可应这些人的请求，或者在这些人为接收方时进行传输。
第1款第一段(a)、(b)和(c)项，以及该款第二段，不适用于公共机关行使其公共权力时开展的活动。
第1款第一段(d)项所述公共利益，应得到欧盟法律或者控制者所受约束的成员国法律的承认。
不存在充分性决定时，欧盟或成员国法律可以基于重大公共利益理由，对向第三国或国际组织传输特定类别个人数据明确设定限制。成员国应将这些规定通报欧盟委员会。
控制者或处理者应在第30条所述记录中，记录本条第1款第二段所述评估及适当保障。

查看法规原文

第1节独立地位 / Section 1 — Independent status

第51条监管机构 / Article 51 — Supervisory authority

English

Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).
Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.
Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.
Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

中文参考译文

每一成员国应规定由一个或多个独立公共机关负责监督本条例的适用，以保护自然人在处理方面的基本权利和自由，并促进个人数据在欧盟内自由流动（“监管机构”）。
每一监管机构应促进本条例在整个欧盟内的一致适用。为此，监管机构应按照第七章相互合作，并与欧盟委员会合作。
一个成员国设立多个监管机构的，该成员国应指定在欧洲数据保护委员会中代表这些机构的监管机构，并规定相应机制，确保其他机构遵守与第63条所述一致性机制有关的规则。
每一成员国应于2018年5月25日前，将其根据本章制定的法律规定通报欧盟委员会，并及时通报此后影响这些规定的任何修订。

第52条独立性 / Article 52 — Independence

English

Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.
The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody.
Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not.
Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board.
Each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned.
Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget.

中文参考译文

每一监管机构依本条例履行职责和行使权力时，应完全独立地行事。
每一监管机构的成员依本条例履行职责和行使权力时，应不受任何直接或间接的外部影响，不得寻求或接受任何人的指示。
每一监管机构的成员应避免任何与其职责不相容的行为，并不得在任期内从事任何与其职责不相容的职业，无论是否有偿。
每一成员国应确保每一监管机构获得有效履行职责和行使权力所必需的人力、技术和财政资源、场所以及基础设施，包括为相互协助、合作及参与欧洲数据保护委员会所需的资源。
每一成员国应确保每一监管机构自行选任并拥有自己的工作人员，且这些工作人员仅受该监管机构成员的指挥。
每一成员国应确保每一监管机构接受不影响其独立性的财务监督，并拥有独立、公开的年度预算；该预算可以构成国家总体预算的一部分。

第54条监管机构设立规则 / Article 54 — Rules on the establishment of the supervisory authority

English

Each Member State shall provide by law for all of the following:

(a) the establishment of each supervisory authority;

(b) the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;

(c) the rules and procedures for the appointment of the member or members of each supervisory authority;

(d) the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

(e) whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment;

(f) the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment.

The member or members and the staff of each supervisory authority shall, in accordance with Union or Member State law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers. During their term of office, that duty of professional secrecy shall in particular apply to reporting by natural persons of infringements of this Regulation.

中文参考译文

每一成员国应通过法律规定下列全部事项：

(a) 每一监管机构的设立；

(b) 被任命为每一监管机构成员所需的资格及任职条件；

(c) 每一监管机构成员的任命规则和程序；

(d) 每一监管机构成员的任期不得少于四年；但对于2016年5月24日后的首次任命，为通过错开任命的程序保护监管机构独立性而确有必要的，部分成员的任期可以较短；

(e) 每一监管机构成员能否连任，以及在可以连任时允许连任的届数；

(f) 规范每一监管机构成员及工作人员义务的条件，在任期内及任期后禁止从事的不相容行为、职业及获取的不相容利益，以及终止任职的规则。

每一监管机构的成员及工作人员，应依欧盟或成员国法律，对其履行职责或行使权力过程中知悉的任何保密信息，在任期内及任期后均承担职业保密义务。在任期内，该职业保密义务尤其适用于自然人对违反本条例行为的举报。

第2节管辖权、职责和权力 / Section 2 — Competence, tasks and powers

第56条牵头监管机构的管辖权 / Article 56 — Competence of the lead supervisory authority

English

Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.
By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.
Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).
Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.
The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.

中文参考译文

在不影响第55条的前提下，控制者或处理者的主要营业机构或单一营业机构所在地的监管机构，有权按照第60条规定的程序，就该控制者或处理者进行的跨境处理担任牵头监管机构。
作为第1款的例外，投诉或可能违反本条例的事项仅涉及某监管机构所属成员国境内的营业机构，或者仅对该成员国的数据主体产生重大影响的，该监管机构有权处理向其提出的投诉或该可能违法事项。
在本条第2款所述情况下，该监管机构应及时将有关事项告知牵头监管机构。牵头监管机构应在获告知后三周内，考虑控制者或处理者在作出告知的监管机构所属成员国是否设有营业机构，决定是否按照第60条规定的程序处理该案件。
牵头监管机构决定处理该案件的，适用第60条规定的程序。向牵头监管机构告知该事项的监管机构，可以向其提交决定草案。牵头监管机构拟订第60条第3款所述决定草案时，应最大限度地考虑该草案。
牵头监管机构决定不处理该案件的，由向其告知该事项的监管机构按照第61条和第62条处理。
对于控制者或处理者开展的跨境处理，牵头监管机构应是该控制者或处理者的唯一对话方。

第57条职责 / Article 57 — Tasks

English

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

(a) monitor and enforce the application of this Regulation;

(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;

(c) advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;

(d) promote the awareness of controllers and processors of their obligations under this Regulation;

(e) upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;

(f) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

(g) cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;

(h) conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;

(i) monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;

(j) adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(k) establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);

(l) give advice on the processing operations referred to in Article 36(2);

(m) encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);

(n) encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);

(o) where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);

(p) draft and publish the criteria for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

(q) conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

(r) authorise contractual clauses and provisions referred to in Article 46(3);

(s) approve binding corporate rules pursuant to Article 47;

(t) contribute to the activities of the Board;

(u) keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and

(v) fulfil any other tasks related to the protection of personal data.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

中文参考译文

在不影响本条例规定的其他职责的前提下，每一监管机构应在其管辖领土内：

(a) 监督并执行本条例；

(b) 促进公众认识和理解与处理有关的风险、规则、保障措施和权利。应特别关注专门面向儿童的活动；

(c) 按照成员国法律，就有关在处理方面保护自然人权利和自由的立法及行政措施，向本国议会、政府及其他机构和组织提供意见；

(d) 提高控制者和处理者对其在本条例下所承担义务的认识；

(e) 应请求，向任何数据主体提供有关行使本条例规定权利的信息，并在适当情况下为此与其他成员国的监管机构合作；

(f) 处理数据主体或者机构、组织、协会依第80条提出的投诉，在适当范围内调查投诉事项，并在合理期间内告知投诉人调查进展和结果，尤其是在需要进一步调查或与其他监管机构协调时；

(g) 与其他监管机构合作，包括共享信息及提供相互协助，以确保本条例适用和执行的一致性；

(h) 就本条例的适用开展调查，包括依据从其他监管机构或其他公共机关收到的信息开展调查；

(i) 在相关发展影响个人数据保护的范围内对其进行监测，尤其是信息与通信技术以及商业实践的发展；

(j) 通过第28条第8款及第46条第2款(d)项所述标准合同条款；

(k) 依第35条第4款建立并维护与数据保护影响评估要求有关的清单；

(l) 就第36条第2款所述处理操作提供意见；

(m) 依第40条第1款鼓励拟订行为准则，并依第40条第5款对提供充分保障的行为准则提出意见和予以批准；

(n) 依第42条第1款鼓励建立数据保护认证机制、数据保护印章及标志，并依第42条第5款批准认证标准；

(o) 在适用情况下，依第42条第7款对已签发的认证进行定期审查；

(p) 拟订并公布第41条所述行为准则监督组织及第43条所述认证机构的认可标准；

(q) 对第41条所述行为准则监督组织及第43条所述认证机构进行认可；

(r) 授权采用第46条第3款所述合同条款和规定；

(s) 依第47条批准有约束力的公司规则；

(t) 为欧洲数据保护委员会的活动作出贡献；

(u) 在内部保存违反本条例行为及依第58条第2款采取措施的记录；以及

(v) 履行与个人数据保护有关的任何其他职责。

每一监管机构应通过提供也可电子填写的投诉表格等措施，便利提出第1款(f)项所述投诉，同时不得排除其他沟通方式。
每一监管机构履行职责，不应向数据主体以及在适用情况下向数据保护官收费。
请求明显缺乏依据或过度，特别是具有重复性的，监管机构可以根据行政成本收取合理费用，或拒绝就该请求采取行动。监管机构应承担证明请求明显缺乏依据或过度的责任。

第58条权力 / Article 58 — Powers

English

Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.
Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.
Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

中文参考译文

每一监管机构应拥有下列全部调查权：

(a) 命令控制者和处理者，以及在适用情况下控制者或处理者的代表，提供其履行职责所需的任何信息；

(b) 以数据保护审计的形式开展调查；

(c) 对依第42条第7款签发的认证进行审查；

(d) 将涉嫌违反本条例的行为通知控制者或处理者；

(e) 从控制者和处理者处获得对全部个人数据以及履行职责所必需的全部信息的访问；

(f) 依欧盟或成员国程序法，进入控制者和处理者的任何场所，包括接触任何数据处理设备和手段。

每一监管机构应拥有下列全部纠正权：

(a) 向控制者或处理者发出警告，指出拟进行的处理操作可能违反本条例规定；

(b) 处理操作已经违反本条例规定的，对控制者或处理者予以训诫；

(c) 命令控制者或处理者遵从数据主体依本条例行使权利的请求；

(d) 命令控制者或处理者使处理操作符合本条例规定，并在适当情况下要求其以指定方式、在指定期限内完成；

(e) 命令控制者向数据主体告知个人数据泄露事件；

(f) 施加临时或最终的限制，包括禁止处理；

(g) 依第16、17和18条命令更正或删除个人数据、或者限制处理，并依第17条第2款和第19条命令将这些行动通知已获披露个人数据的接收方；

(h) 撤销认证，或命令认证机构撤销依第42条和第43条签发的认证；不满足或不再满足认证要求的，命令认证机构不得签发认证；

(i) 根据个案情况，依第83条处以行政罚款，作为本款所述措施的补充或替代；

(j) 命令暂停向第三国接收方或国际组织传输数据。

每一监管机构应拥有下列全部授权和咨询权：

(a) 按照第36条所述事前咨询程序，向控制者提供意见；

(b) 主动或应请求，就与个人数据保护有关的任何事项，向本国议会、成员国政府，或依成员国法律向其他机构和组织以及公众提出意见；

(c) 成员国法律要求事前授权的，授权开展第36条第5款所述处理；

(d) 依第40条第5款提出意见并批准行为准则草案；

(e) 依第43条认可认证机构；

(f) 依第42条第5款签发认证并批准认证标准；

(g) 通过第28条第8款及第46条第2款(d)项所述标准数据保护条款；

(h) 授权采用第46条第3款(a)项所述合同条款；

(i) 授权采用第46条第3款(b)项所述行政安排；

(j) 依第47条批准有约束力的公司规则。

行使本条授予监管机构的权力，应遵守欧盟和成员国法律依《宪章》规定的适当保障，包括有效的司法救济和正当程序。
每一成员国应通过法律规定，其监管机构有权提请司法机关注意违反本条例的行为，并在适当情况下提起诉讼或以其他方式参与诉讼，以执行本条例规定。
每一成员国可以通过法律，赋予其监管机构第1、2、3款所述权力以外的其他权力。行使这些权力不得损害第七章的有效运行。

查看法规原文

第1节合作 / Section 1 — Cooperation

第60条牵头监管机构与其他有关监管机构之间的合作 / Article 60 — Cooperation between the lead supervisory authority and the other supervisory authorities concerned

English

The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.
The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.
The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.
Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.
Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.
Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.
The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.
By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.
Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter.

The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof.

After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.
Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.
The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.

中文参考译文

牵头监管机构应依本条与其他有关监管机构合作，努力达成共识。牵头监管机构与有关监管机构应相互交换所有相关信息。
牵头监管机构可随时要求其他有关监管机构依第61条提供相互协助，并可依第62条开展联合行动，尤其是为开展调查，或监督涉及在另一成员国设立的控制者或处理者的措施的实施情况。
牵头监管机构应及时向其他有关监管机构通报有关事项的相关信息，并及时向其提交决定草案以征求意见，适当考虑其意见。
其他任何有关监管机构在依本条第3款接受征询后四周内，对决定草案提出相关且有理由的异议的，牵头监管机构如不采纳该异议，或者认为异议不相关或缺乏理由，应将该事项提交第63条所述一致性机制处理。
牵头监管机构拟采纳所提出的相关且有理由的异议的，应向其他有关监管机构提交修订后的决定草案以征求意见。该修订草案应在两周内适用第4款所述程序。
其他有关监管机构均未在第4款和第5款所述期限内，对牵头监管机构提交的决定草案提出异议的，视为牵头监管机构与有关监管机构同意该草案，并受其约束。
牵头监管机构应通过决定，并视情况将决定通知控制者或处理者的主要营业机构或单一营业机构，同时将该决定，包括相关事实和理由的摘要，告知其他有关监管机构及欧洲数据保护委员会。受理投诉的监管机构应将该决定告知投诉人。
作为第7款的例外，投诉被驳回或拒绝的，由受理投诉的监管机构通过决定并将其通知投诉人，同时告知控制者。
牵头监管机构与有关监管机构同意驳回或拒绝投诉的部分内容，并对其他部分采取行动的，应就该事项的各部分分别作出决定。

牵头监管机构应就针对控制者采取行动的部分作出决定，将其通知位于本成员国领土内的控制者或处理者的主要营业机构或单一营业机构，并告知投诉人；投诉人所属的监管机构则应就驳回或拒绝投诉的部分作出决定，将其通知投诉人，并告知控制者或处理者。

依第7款和第9款收到牵头监管机构的决定后，控制者或处理者应采取必要措施，确保其位于欧盟境内所有营业机构活动背景下的处理活动遵守该决定。控制者或处理者应将为遵守决定所采取的措施通知牵头监管机构，由该机构告知其他有关监管机构。
在特殊情况下，有关监管机构有理由认为，为保护数据主体利益而迫切需要采取行动的，适用第66条所述紧急程序。
牵头监管机构与其他有关监管机构应采用标准化格式，通过电子方式相互提供本条要求的信息。

第61条相互协助 / Article 61 — Mutual assistance

English

Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.
Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.
Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.
The requested supervisory authority shall not refuse to comply with the request unless:

(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

(b) compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4.
Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.
Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.
Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).
The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

中文参考译文

监管机构应相互提供相关信息和协助，以一致的方式执行和适用本条例，并建立有效相互合作的措施。相互协助尤其应包括信息请求及监管措施，例如请求开展事前授权和咨询、检查及调查。
每一监管机构应采取所需的一切适当措施，无不当迟延地、且最迟在收到请求后一个月内，回复另一监管机构的请求。这些措施尤其可以包括传送有关调查开展情况的相关信息。
协助请求应包含所有必要信息，包括请求目的及理由。交换的信息仅可用于提出请求时所指明的目的。
被请求监管机构不得拒绝遵从请求，除非：

(a) 其对请求事项或被要求执行的措施不具有管辖权；或者

(b) 遵从请求将违反本条例，或违反接受请求的监管机构所受约束的欧盟或成员国法律。

被请求监管机构应将为回应请求所采取措施的结果，或者视情况将措施进展，告知请求监管机构。依第4款拒绝遵从请求的，被请求监管机构应说明理由。
被请求监管机构原则上应使用标准化格式，通过电子方式提供其他监管机构所请求的信息。
被请求监管机构不得就其依据相互协助请求采取的任何行动收费。监管机构可以约定规则，对特殊情况下提供相互协助所产生的特定支出进行相互补偿。
某监管机构在收到另一监管机构的请求后一个月内未提供本条第5款所述信息的，请求监管机构可依第55条第1款在其所属成员国领土内采取临时措施。在此情况下，应推定第66条第1款所述迫切需要采取行动的条件已经满足，并要求欧洲数据保护委员会依第66条第2款作出紧急且有约束力的决定。
欧盟委员会可通过实施法案，规定本条所述相互协助的格式和程序，以及监管机构之间、监管机构与欧洲数据保护委员会之间通过电子方式交换信息的安排，尤其是本条第6款所述标准化格式。这些实施法案应按照第93条第2款所述审查程序通过。

第62条监管机构的联合行动 / Article 62 — Joint operations of supervisory authorities

English

The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.
Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate.
A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority's authorisation, confer powers, including investigative powers on the seconding supervisory authority's members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority's members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. The seconding supervisory authority's members or staff shall be subject to the Member State law of the host supervisory authority.
Where, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating.
The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. The Member State of the seconding supervisory authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf.
Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4.
Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2).

中文参考译文

监管机构应在适当情况下开展联合行动，包括由其他成员国监管机构成员或工作人员参与的联合调查及联合执法措施。
控制者或处理者在多个成员国设有营业机构，或者一个以上成员国的大量数据主体可能受到处理操作的重大影响的，每一有关成员国的监管机构均有权参与联合行动。依第56条第1款或第4款具有管辖权的监管机构，应邀请每一有关成员国的监管机构参与联合行动，并及时回应监管机构提出的参与请求。
监管机构可依成员国法律，在派出监管机构授权的情况下，向参与联合行动的派出监管机构成员或工作人员授予包括调查权在内的权力；或者在接待监管机构所属成员国法律允许的范围内，允许派出监管机构成员或工作人员依派出监管机构所属成员国法律行使其调查权。此类调查权仅可在接待监管机构成员或工作人员的指导下、且在其在场时行使。派出监管机构成员或工作人员应受接待监管机构所属成员国法律约束。
派出监管机构的工作人员依第1款在另一成员国开展行动的，接待监管机构所属成员国应依行动所在地成员国的法律，对这些人员的行为承担责任，包括对其在行动中造成的任何损害承担赔偿责任。
损害发生地成员国应依适用于本国工作人员造成损害的条件赔偿该损害。派出监管机构的工作人员在另一成员国领土内对任何人造成损害的，派出监管机构所属成员国应向该另一成员国全额偿还其代为支付给有权获赔者的任何款项。
在不影响对第三方行使权利的情况下，除第5款外，每一成员国在第1款所述情形下，不得就第4款所述损害向另一成员国要求偿还。
拟开展联合行动，而某监管机构在一个月内未履行本条第2款第二句规定的义务的，其他监管机构可依第55条在其所属成员国领土内采取临时措施。在此情况下，应推定第66条第1款所述迫切需要采取行动的条件已经满足，并要求欧洲数据保护委员会依第66条第2款提供意见或作出紧急且有约束力的决定。

第2节一致性 / Section 2 — Consistency

第64条欧洲数据保护委员会的意见 / Article 64 — Opinion of the Board

English

The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

(a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

(b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

(c) aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to Article 43(3);

(d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

(e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

(f) aims to approve binding corporate rules within the meaning of Article 47.

Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.
In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter.

Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.

Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.
The Chair of the Board shall, without undue, delay inform by electronic means:

(a) the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and

(b) the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

The competent supervisory authority shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3.
The supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.
Where the supervisory authority concerned informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply.

中文参考译文

主管监管机构拟采取下列任何措施的，欧洲数据保护委员会应提出意见。为此，主管监管机构在其决定草案涉及下列事项时，应将草案提交欧洲数据保护委员会：

(a) 拟通过依第35条第4款须开展数据保护影响评估的处理操作清单；

(b) 涉及第40条第7款所述行为准则草案、或者行为准则的修订或扩展是否符合本条例的问题；

(c) 拟批准第41条第3款所述组织或第43条第3款所述认证机构的认可标准；

(d) 拟确定第46条第2款(d)项及第28条第8款所述标准数据保护条款；

(e) 拟授权采用第46条第3款(a)项所述合同条款；或者

(f) 拟批准第47条意义上的有约束力的公司规则。

任何监管机构、欧洲数据保护委员会主席或欧盟委员会，均可请求欧洲数据保护委员会审议具有普遍适用性或者在一个以上成员国产生影响的任何事项，以获得其意见；尤其是在主管监管机构未依第61条履行相互协助义务，或未依第62条履行联合行动义务的情况下。
在第1款和第2款所述情况下，欧洲数据保护委员会应就提交的事项提出意见，但已经就同一事项提出意见的除外。意见应在八周内以成员简单多数通过。考虑事项的复杂性，该期限可再延长六周。

就依第5款传送给欧洲数据保护委员会成员的第1款所述决定草案而言，成员未在主席指明的合理期间内提出异议的，视为同意该决定草案。

监管机构和欧盟委员会应使用标准化格式，通过电子方式，无不当迟延地向欧洲数据保护委员会传送任何相关信息，包括视情况提供事实摘要、决定草案、采取该措施的必要理由，以及其他有关监管机构的意见。
欧洲数据保护委员会主席应无不当迟延地通过电子方式：

(a) 将以标准化格式提交的任何相关信息告知欧洲数据保护委员会成员及欧盟委员会。必要时，欧洲数据保护委员会秘书处应提供相关信息的译文；以及

(b) 将意见告知视情况适用的第1款和第2款所述监管机构，以及欧盟委员会，并将该意见公开。

主管监管机构在第3款所述期限内，不得通过第1款所述决定草案。
第1款所述监管机构应最大限度地考虑欧洲数据保护委员会的意见，并在收到意见后两周内，采用标准化格式，通过电子方式向欧洲数据保护委员会主席告知其将维持还是修订决定草案；如有修订，还应提交修订后的草案。
有关监管机构在本条第7款所述期限内，告知欧洲数据保护委员会主席其不拟全部或部分采纳欧洲数据保护委员会的意见，并提供相关理由的，适用第65条第1款。

第65条欧洲数据保护委员会解决争议 / Article 65 — Dispute resolution by the Board

English

In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:

(a) where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;

(b) where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;

(c) where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.

The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them.
Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair.
The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3.
The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6.
The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision.

The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9).

The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article.

中文参考译文

为确保本条例在个案中得到正确且一致的适用，欧洲数据保护委员会应在下列情况下作出有约束力的决定：

(a) 在第60条第4款所述案件中，有关监管机构对牵头监管机构的决定草案提出相关且有理由的异议，或者牵头监管机构以该异议不相关或缺乏理由为由拒绝采纳。有约束力的决定应涉及该相关且有理由的异议所针对的全部事项，尤其是是否存在违反本条例的行为；

(b) 对于哪个有关监管机构对主要营业机构具有管辖权存在意见冲突；

(c) 主管监管机构在第64条第1款所述情况下未请求欧洲数据保护委员会提出意见，或者未采纳欧洲数据保护委员会依第64条提出的意见。在此情况下，任何有关监管机构或欧盟委员会均可将事项提交欧洲数据保护委员会。

第1款所述决定应自事项提交之日起一个月内，以欧洲数据保护委员会成员三分之二多数通过。因事项复杂，该期限可再延长一个月。第1款所述决定应说明理由，以牵头监管机构及所有有关监管机构为对象，并对其具有约束力。
欧洲数据保护委员会未能在第2款所述期限内通过决定的，应在第2款所述第二个月届满后的两周内，以成员简单多数通过决定。成员票数相等的，由主席投票决定。
在第2款和第3款所述期限内，有关监管机构不得就依第1款提交欧洲数据保护委员会的事项作出决定。
欧洲数据保护委员会主席应无不当迟延地将第1款所述决定通知有关监管机构，并告知欧盟委员会。监管机构通知第6款所述最终决定后，应及时在欧洲数据保护委员会网站公布该决定。
牵头监管机构，或者视情况由受理投诉的监管机构，应根据本条第1款所述决定，无不当迟延地、且最迟在欧洲数据保护委员会通知其决定后一个月内，作出最终决定。

牵头监管机构，或者视情况由受理投诉的监管机构，应将其最终决定分别通知控制者或处理者以及数据主体的日期告知欧洲数据保护委员会。有关监管机构的最终决定应依第60条第7、8、9款的条件作出。

最终决定应援引本条第1款所述决定，并说明该决定将依本条第5款公布于欧洲数据保护委员会网站。最终决定应附上本条第1款所述决定。

第66条紧急程序 / Article 66 — Urgency procedure

English

In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.
Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision.
Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.
By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board.

中文参考译文

在特殊情况下，有关监管机构认为为保护数据主体的权利和自由而迫切需要采取行动的，可不受第63、64、65条所述一致性机制或第60条所述程序的限制，立即采取旨在其本国领土内产生法律效果的临时措施，并明确不超过三个月的有效期。该监管机构应及时将措施及采取措施的理由告知其他有关监管机构、欧洲数据保护委员会及欧盟委员会。
监管机构已依第1款采取措施，并认为迫切需要采取最终措施的，可请求欧洲数据保护委员会提出紧急意见或作出紧急且有约束力的决定，并说明请求该意见或决定的理由。
在为保护数据主体的权利和自由而迫切需要采取行动的情况下，主管监管机构未采取适当措施的，任何监管机构均可视情况请求欧洲数据保护委员会提出紧急意见或作出紧急且有约束力的决定，并说明请求理由，包括迫切需要采取行动的理由。
作为第64条第3款和第65条第2款的例外，本条第2款和第3款所述紧急意见或紧急且有约束力的决定，应在两周内以欧洲数据保护委员会成员简单多数通过。

查看法规原文

第3节欧洲数据保护委员会 / Section 3 — European data protection board

第68条欧洲数据保护委员会 / Article 68 — European Data Protection Board

English

The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality.
The Board shall be represented by its Chair.
The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives.
Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State's law.
The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission the activities of the Board.
In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation.

中文参考译文

兹设立欧洲数据保护委员会（以下简称“委员会”），作为欧盟的一个机构，并具有法律人格。
欧洲数据保护委员会由其主席代表。
欧洲数据保护委员会由每一成员国的一个监管机构的负责人，以及欧洲数据保护监督专员，或者其各自的代表组成。
某成员国有多个监管机构负责监督本条例规定的适用的，应依该成员国法律任命一名共同代表。
欧盟委员会有权参与欧洲数据保护委员会的活动和会议，但无表决权。欧盟委员会应指定一名代表。欧洲数据保护委员会主席应向欧盟委员会通报欧洲数据保护委员会的活动。
在第65条所述情况下，欧洲数据保护监督专员仅就涉及适用于欧盟机构、机关、办事处和专门机构，并且在实质上与本条例相应的原则和规则的决定，享有表决权。

第70条欧洲数据保护委员会的职责 / Article 70 — Tasks of the Board

English

The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular:

(a) monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities;

(b) advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;

(c) advise the Commission on the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules;

(d) issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services as referred to in Article 17(2);

(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;

(f) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2);

(g) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach;

(h) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1).

(i) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47;

(j) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);

(k) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83;

(l) review the practical application of the guidelines, recommendations and best practices referred to in points (e) and (f);

(m) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);

(n) encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42;

(o) carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a public register of accredited bodies pursuant to Article 43(6) and of the accredited controllers or processors established in third countries pursuant to Article 42(7);

(p) specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42;

(q) provide the Commission with an opinion on the certification requirements referred to in Article 43(8);

(r) provide the Commission with an opinion on the icons referred to in Article 12(7);

(s) provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or international organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an international organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the international organisation.

(t) issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66;

(u) promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

(v) promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations;

(w) promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide.

(x) issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and

(y) maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.

Where the Commission requests advice from the Board, it may indicate a time limit, taking into account the urgency of the matter.
The Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public.
The Board shall, where appropriate, consult interested parties and give them the opportunity to comment within a reasonable period. The Board shall, without prejudice to Article 76, make the results of the consultation procedure publicly available.

中文参考译文

欧洲数据保护委员会应确保本条例的一致适用。为此，欧洲数据保护委员会应主动或者在相关情况下应欧盟委员会请求，尤其履行下列职责：

(a) 在不影响各国监管机构职责的前提下，在第64条和第65条规定的情况下，监督并确保本条例得到正确适用；

(b) 就与欧盟内个人数据保护有关的任何问题，包括本条例的任何修订提案，向欧盟委员会提供意见；

(c) 就控制者、处理者和监管机构之间为有约束力的公司规则而交换信息的格式和程序，向欧盟委员会提供意见；

(d) 就第17条第2款所述从公众可用通信服务中删除个人数据链接、副本或复制件的程序，发布指南、建议及最佳实践；

(e) 主动、应其某一成员的请求或应欧盟委员会请求，审议涉及本条例适用的任何问题，并发布指南、建议及最佳实践，以促进本条例的一致适用；

(f) 依本款(e)项发布指南、建议及最佳实践，进一步明确依第22条第2款基于画像作出决定的标准和条件；

(g) 依本款(e)项发布指南、建议及最佳实践，以认定个人数据泄露事件、确定第33条第1款和第2款所述不当迟延，以及明确控制者或处理者须通报个人数据泄露事件的具体情形；

(h) 依本款(e)项，就个人数据泄露事件可能对第34条第1款所述自然人的权利和自由造成高风险的情形，发布指南、建议及最佳实践。

(i) 依本款(e)项发布指南、建议及最佳实践，以进一步明确基于控制者遵守的有约束力的公司规则、以及处理者遵守的有约束力的公司规则进行个人数据传输的标准和要求，并明确为确保第47条所述有关数据主体个人数据得到保护所需的进一步要求；

(j) 依本款(e)项发布指南、建议及最佳实践，进一步明确基于第49条第1款进行个人数据传输的标准和要求；

(k) 为监管机构拟订有关适用第58条第1、2、3款所述措施，以及依第83条确定行政罚款的指南；

(l) 审查(e)项和(f)项所述指南、建议及最佳实践的实际应用；

(m) 依本款(e)项发布指南、建议及最佳实践，以建立自然人依第54条第2款举报违反本条例行为的共同程序；

(n) 鼓励依第40条和第42条拟订行为准则，建立数据保护认证机制、数据保护印章和标志；

(o) 依第43条开展认证机构的认可及定期审查，并维护第43条第6款所述获认可机构，以及第42条第7款所述在第三国设立的获认可控制者或处理者的公开登记册；

(p) 明确第43条第3款所述要求，以便认可第42条下的认证机构；

(q) 就第43条第8款所述认证要求向欧盟委员会提出意见；

(r) 就第12条第7款所述图标向欧盟委员会提出意见；

(s) 就第三国或国际组织保护水平充分性的评估，向欧盟委员会提出意见，包括评估第三国、该第三国境内的某一领土或一个或多个特定行业，或者国际组织是否不再确保充分保护水平。为此，欧盟委员会应向欧洲数据保护委员会提供所有必要文件，包括就该第三国、领土或特定行业与该第三国政府的往来函件，或者与该国际组织的往来函件。

(t) 依第64条第1款所述一致性机制，对监管机构决定草案提出意见，对依第64条第2款提交的事项提出意见，并依第65条作出有约束力的决定，包括第66条所述案件；

(u) 促进监管机构之间的合作，以及有效的双边和多边信息与最佳实践交流；

(v) 推动共同培训计划，便利监管机构之间的人员交流，并在适当情况下与第三国监管机构或国际组织开展人员交流；

(w) 促进与世界各地数据保护监管机构就数据保护立法及实践开展知识和文件交流。

(x) 就依第40条第9款在欧盟层面拟订的行为准则提出意见；以及

(y) 维护可供公众访问的电子登记册，登记监管机构和法院对一致性机制所处理问题作出的决定。

欧盟委员会请求欧洲数据保护委员会提供意见时，可以考虑事项紧迫性，指明期限。
欧洲数据保护委员会应将其意见、指南、建议和最佳实践送交欧盟委员会及第93条所述委员会，并予以公开。
欧洲数据保护委员会应在适当情况下征询利益相关方意见，并给予其在合理期间内发表评论的机会。在不影响第76条的前提下，应向公众提供该征询程序的结果。

第75条秘书处 / Article 75 — Secretariat

English

The Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor.
The secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board.
The staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation shall be subject to separate reporting lines from the staff involved in carrying out tasks conferred on the European Data Protection Supervisor.
Where appropriate, the Board and the European Data Protection Supervisor shall establish and publish a Memorandum of Understanding implementing this Article, determining the terms of their cooperation, and applicable to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation.
The secretariat shall provide analytical, administrative and logistical support to the Board.
The secretariat shall be responsible in particular for:

(a) the day-to-day business of the Board;

(b) communication between the members of the Board, its Chair and the Commission;

(c) communication with other institutions and the public;

(d) the use of electronic means for the internal and external communication;

(e) the translation of relevant information;

(f) the preparation and follow-up of the meetings of the Board;

(g) the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory authorities and other texts adopted by the Board.

中文参考译文

欧洲数据保护委员会应设秘书处，由欧洲数据保护监督专员提供。
秘书处仅依欧洲数据保护委员会主席的指示履行职责。
欧洲数据保护监督专员的工作人员中，参与履行本条例赋予欧洲数据保护委员会职责的人员，应与参与履行欧洲数据保护监督专员职责的人员适用分开的汇报关系。
在适当情况下，欧洲数据保护委员会与欧洲数据保护监督专员应制定并公布实施本条的谅解备忘录，确定双方合作条件，并适用于欧洲数据保护监督专员下属参与履行本条例赋予欧洲数据保护委员会职责的工作人员。
秘书处应向欧洲数据保护委员会提供分析、行政及后勤支持。
秘书处尤其应负责：

(a) 欧洲数据保护委员会的日常事务；

(b) 欧洲数据保护委员会成员、主席及欧盟委员会之间的沟通；

(c) 与其他机构及公众的沟通；

(d) 使用电子方式进行内部和外部沟通；

(e) 翻译相关信息；

(f) 欧洲数据保护委员会会议的筹备及后续工作；

(g) 筹备、起草和公布意见、解决监管机构之间争议的决定，以及欧洲数据保护委员会通过的其他文本。

查看法规原文

第82条获得赔偿的权利与责任 / Article 82 — Right to compensation and liability

English

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.
Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.
Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).

中文参考译文

任何人因违反本条例的行为遭受物质或非物质损害的，均有权就所受损害从控制者或处理者获得赔偿。
参与处理的任何控制者，应对违反本条例的处理所造成的损害承担责任。处理者仅在未履行本条例专门针对处理者规定的义务，或者超越或违背控制者合法指示行事的情况下，对处理所造成的损害承担责任。
控制者或处理者证明其对引起损害的事件不负任何责任的，应免除其第2款规定的责任。
多个控制者或处理者，或者控制者与处理者共同参与同一处理，并依第2款和第3款对处理造成的损害负有责任的，每一控制者或处理者均应对全部损害承担责任，以确保数据主体得到有效赔偿。
控制者或处理者已依第4款全额赔偿所受损害的，有权按照第2款规定的条件，向参与同一处理的其他控制者或处理者追偿与其各自对损害所负责任相对应的赔偿份额。
为行使获得赔偿的权利而提起的诉讼，应向依第79条第2款所述成员国法律具有管辖权的法院提出。

第83条处以行政罚款的一般条件 / Article 83 — General conditions for imposing administrative fines

English

Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:

(a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;

(b) the intentional or negligent character of the infringement;

(c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;

(d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;

(e) any relevant previous infringements by the controller or processor;

(f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;

(g) the categories of personal data affected by the infringement;

(h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;

(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;

(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and

(k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.

If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;

(b) the obligations of the certification body pursuant to Articles 42 and 43;

(c) the obligations of the monitoring body pursuant to Article 41(4).

Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:

(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;

(b) the data subjects' rights pursuant to Articles 12 to 22;

(c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49;

(d) any obligations pursuant to Member State law adopted under Chapter IX;

(e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1).

Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.
Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State.
The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.
Where the legal system of the Member State does not provide for administrative fines, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive.

Those Member States shall notify to the Commission the provisions of their laws which they adopt pursuant to this paragraph by 25 May 2018 and, without delay, any subsequent amendment law or amendment affecting them.

中文参考译文

每一监管机构应确保，就第4、5、6款所述违反本条例的行为依本条处以行政罚款时，罚款在每一个案中均具有有效性、相称性及威慑性。
应根据个案情况，将行政罚款作为第58条第2款(a)至(h)项及(j)项所述措施的补充或替代。在个案中决定是否处以行政罚款及其金额时，应适当考虑下列因素：

(a) 违法行为的性质、严重程度和持续时间，同时考虑有关处理的性质、范围或目的，以及受影响的数据主体人数和其所受损害程度；

(b) 违法行为属故意还是过失；

(c) 控制者或处理者为减轻数据主体所受损害采取的任何行动；

(d) 考虑控制者或处理者依第25条和第32条采取的技术和组织措施后，其所负责任的程度；

(e) 控制者或处理者此前任何相关违法行为；

(f) 为纠正违法行为并减轻其可能不利影响，与监管机构合作的程度；

(g) 违法行为所影响的个人数据类别；

(h) 监管机构获悉违法行为的方式，尤其是控制者或处理者是否通报该行为，以及通报的程度；

(i) 此前已就同一事项命令有关控制者或处理者采取第58条第2款所述措施的，对这些措施的遵守情况；

(j) 遵守第40条所述经批准的行为准则，或采用第42条所述经批准的认证机制的情况；以及

(k) 适用于个案的任何其他加重或减轻因素，例如直接或间接因违法行为获得的经济利益或避免的损失。

控制者或处理者因故意或过失，就同一或相互关联的处理操作违反本条例多项规定的，行政罚款总额不得超过针对其中最严重违法行为规定的金额。
违反下列规定的，应依第2款处以最高1 000万欧元的行政罚款；对于企业，最高金额为1 000万欧元或其上一财务年度全球年度总营业额的2%，以较高者为准：

(a) 第8、11、25至39、42和43条规定的控制者及处理者义务；

(b) 第42条和第43条规定的认证机构义务；

(c) 第41条第4款规定的监督组织义务。

违反下列规定的，应依第2款处以最高2 000万欧元的行政罚款；对于企业，最高金额为2 000万欧元或其上一财务年度全球年度总营业额的4%，以较高者为准：

(a) 第5、6、7和9条规定的处理基本原则，包括同意的条件；

(b) 第12至22条规定的数据主体权利；

(c) 第44至49条规定的向第三国或国际组织内接收方传输个人数据的要求；

(d) 根据第九章制定的成员国法律所规定的任何义务；

(e) 不遵守监管机构依第58条第2款作出的命令、临时或最终处理限制、暂停数据流动的措施，或者违反第58条第1款而未提供访问。

不遵守第58条第2款所述监管机构命令的，应依本条第2款处以最高2 000万欧元的行政罚款；对于企业，最高金额为2 000万欧元或其上一财务年度全球年度总营业额的4%，以较高者为准。
在不影响监管机构依第58条第2款享有纠正权的前提下，每一成员国可规定，是否以及在何种程度上可以对在该成员国设立的公共机关和公共机构处以行政罚款。
监管机构行使本条规定的权力，应遵守欧盟及成员国法律规定的适当程序保障，包括有效司法救济和正当程序。
成员国法律制度未规定行政罚款的，可以通过下列方式适用本条：由主管监管机构发起罚款程序，再由有管辖权的本国法院处以罚款，同时确保这些法律救济有效，并具有与监管机构处以行政罚款相当的效果。无论如何，所处罚款应具有有效性、相称性及威慑性。

这些成员国应于2018年5月25日前，将依本款制定的法律规定通报欧盟委员会，并及时通报此后影响这些规定的任何修法或修订。

查看法规原文

第85条处理与表达及信息自由 / Article 85 — Processing and freedom of expression and information

English

Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.
For processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, Member States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
Each Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to paragraph 2 and, without delay, any subsequent amendment law or amendment affecting them.

中文参考译文

成员国应通过法律协调本条例规定的个人数据保护权与表达和信息自由权，包括为新闻目的以及学术、艺术或文学表达目的进行的处理。
对于为新闻目的或学术、艺术或文学表达目的开展的处理，如为协调个人数据保护权与表达和信息自由所必需，成员国应规定对第二章（原则）、第三章（数据主体权利）、第四章（控制者和处理者）、第五章（向第三国或国际组织传输个人数据）、第六章（独立监管机构）、第七章（合作与一致性）及第九章（特定数据处理情形）的豁免或例外。
每一成员国应将依第2款制定的法律规定通报欧盟委员会，并及时通报此后影响这些规定的任何修法或修订。

第88条就业情形下的处理 / Article 88 — Processing in the context of employment

English

Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context, in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship.
Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place.
Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

中文参考译文

成员国可以通过法律或集体协议规定更具体的规则，确保就业情形下处理员工个人数据时对权利和自由的保护，尤其是为招聘、履行劳动合同（包括履行法律或集体协议规定的义务）、工作管理、规划和组织、工作场所平等与多样性、职业健康与安全、保护雇主或客户财产，以及为个人或集体行使和享有就业相关权利与利益，和终止劳动关系等目的进行的处理。
这些规则应包含适宜且具体的措施，保障数据主体的人格尊严、正当利益和基本权利，尤其应关注处理的透明度、企业集团或从事共同经济活动的企业群体内部的个人数据传输，以及工作场所的监测系统。
每一成员国应于2018年5月25日前，将依第1款制定的法律规定通报欧盟委员会，并及时通报此后影响这些规定的任何修订。

第89条公共利益档案保存、科学或历史研究及统计目的处理的保障与例外 / Article 89 — Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

English

Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation.

Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.

中文参考译文

为公共利益档案保存、科学或历史研究或统计目的进行的处理，应依本条例为数据主体的权利和自由提供适当保障。这些保障尤其应确保已落实技术和组织措施，以遵守数据最小化原则。

在可以通过假名化实现这些目的的情况下，相关措施可以包括假名化。可以通过不允许或不再允许识别数据主体身份的进一步处理实现这些目的的，应采用该方式实现。

为科学或历史研究或统计目的处理个人数据时，在遵守本条第1款所述条件和保障的前提下，如果第15、16、18和21条所述权利可能导致特定目的无法实现或严重妨碍其实现，且作出例外为实现这些目的所必需，欧盟或成员国法律可以规定对这些权利的例外。
为公共利益档案保存目的处理个人数据时，在遵守本条第1款所述条件和保障的前提下，如果第15、16、18、19、20和21条所述权利可能导致特定目的无法实现或严重妨碍其实现，且作出例外为实现这些目的所必需，欧盟或成员国法律可以规定对这些权利的例外。
第2款和第3款所述处理同时服务于另一目的的，例外仅适用于为该两款所述目的进行的处理。

查看法规原文

第92条授权的行使 / Article 92 — Exercise of the delegation

English

The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.
The delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for an indeterminate period of time from 24 May 2016.
The delegation of power referred to in Article 12(8) and Article 43(8) may be revoked at any time by the European Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in that decision. It shall take effect the day following that of its publication in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.
As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.
A delegated act adopted pursuant to Article 12(8) and Article 43(8) shall enter into force only if no objection has been expressed by either the European Parliament or the Council within a period of three months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council.

中文参考译文

欧盟委员会依本条规定的条件，获授通过授权法案的权力。
第12条第8款及第43条第8款所述权力，自2016年5月24日起无限期授予欧盟委员会。
欧洲议会或理事会可以随时撤销第12条第8款及第43条第8款所述授权。撤销决定应终止该决定指明的授权，并自其在《欧盟官方公报》公布之日的次日，或者决定指明的较晚日期生效。撤销不影响已经生效的任何授权法案的效力。
欧盟委员会通过授权法案后，应立即同时通知欧洲议会和理事会。
依第12条第8款及第43条第8款通过的授权法案，仅在通知欧洲议会和理事会后三个月内，欧洲议会及理事会均未提出异议，或者在该期限届满前，双方均已告知欧盟委员会不提出异议的情况下，方可生效。经欧洲议会或理事会提议，该期限应延长三个月。

查看法规原文

第97条欧盟委员会的报告 / Article 97 — Commission reports

English

By 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public.
In the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in particular, the application and functioning of:

(a) Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC;

(b) Chapter VII on cooperation and consistency.

For the purpose of paragraph 1, the Commission may request information from Member States and supervisory authorities.
In carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources.
The Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking into account of developments in information technology and in the light of the state of progress in the information society.

中文参考译文

欧盟委员会应于2020年5月25日前，并在此后每四年，向欧洲议会和理事会提交对本条例进行评价和审查的报告。报告应予公开。
在第1款所述评价和审查中，欧盟委员会尤其应审查下列规定的适用及运行：

(a) 有关向第三国或国际组织传输个人数据的第五章，尤其关注依本条例第45条第3款通过的决定，以及依据第95/46/EC号指令第25条第6款通过的决定；

(b) 有关合作与一致性的第七章。

为第1款之目的，欧盟委员会可以请求成员国和监管机构提供信息。
开展第1款和第2款所述评价和审查时，欧盟委员会应考虑欧洲议会、理事会以及其他相关机构或来源的立场和调查结论。
必要时，欧盟委员会应提交修订本条例的适当提案，尤其应考虑信息技术的发展，并结合信息社会的进展状况。

English

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 27 April 2016.

For the European Parliament

The President

M. SCHULZ

For the Council

The President

J.A. HENNIS-PLASSCHAERT

中文参考译文

本条例整体具有约束力，并在所有成员国直接适用。

2016年4月27日订于布鲁塞尔。

代表欧洲议会

议长

M. 舒尔茨

代表理事会

主席

J.A. 亨尼斯-普拉斯哈特

查看法规原文

以下保留公布文本中的脚注编号19—21，分别由第4、43、76条引用。编号1—18属于本页未收录的制定依据和序言部分，未在此重编或拼入正文。

GDPR 欧盟通用数据保护条例

先判断地域与角色

合法基础、保护措施与权利分别落实

DPIA与DPO是不同的条件义务

泄露事件的三条独立任务

跨境传输与完整验收

先判断地域与角色​

合法基础、保护措施与权利分别落实​

DPIA与DPO是不同的条件义务​

泄露事件的三条独立任务​

跨境传输与完整验收​

第1—99条正文英中对照​

第I章 总则 / CHAPTER I — General provisions​

第II章 原则 / CHAPTER II — Principles​

第III章 数据主体权利 / CHAPTER III — Rights of the data subject​

第IV章 控制者和处理者 / CHAPTER IV — Controller and processor​

第V章 向第三国或国际组织传输个人数据 / CHAPTER V — Transfers of personal data to third countries or international organisations​

第VI章 独立监管机构 / CHAPTER VI — Independent supervisory authorities​

第VII章 合作与一致性 / CHAPTER VII — Cooperation and consistency​

第VIII章 救济、责任与处罚 / CHAPTER VIII — Remedies, liability and penalties​

第IX章 特定处理情形的规定 / CHAPTER IX — Provisions relating to specific processing situations​

第X章 授权法案与实施法案 / CHAPTER X — Delegated acts and implementing acts​

第XI章 最后条款 / CHAPTER XI — Final provisions​

结束语与签署 / Closing formula and signatures​

正文引用的脚注 / Footnotes cited in the articles​

先判断地域与角色

合法基础、保护措施与权利分别落实

DPIA与DPO是不同的条件义务

泄露事件的三条独立任务

跨境传输与完整验收

第1—99条正文英中对照

第I章总则 / CHAPTER I — General provisions

第II章原则 / CHAPTER II — Principles

第III章数据主体权利 / CHAPTER III — Rights of the data subject

第IV章控制者和处理者 / CHAPTER IV — Controller and processor

第V章向第三国或国际组织传输个人数据 / CHAPTER V — Transfers of personal data to third countries or international organisations

第VI章独立监管机构 / CHAPTER VI — Independent supervisory authorities

第VII章合作与一致性 / CHAPTER VII — Cooperation and consistency

第VIII章救济、责任与处罚 / CHAPTER VIII — Remedies, liability and penalties

第IX章特定处理情形的规定 / CHAPTER IX — Provisions relating to specific processing situations

第X章授权法案与实施法案 / CHAPTER X — Delegated acts and implementing acts

第XI章最后条款 / CHAPTER XI — Final provisions

结束语与签署 / Closing formula and signatures

正文引用的脚注 / Footnotes cited in the articles