GDPR recitals

The recitals set out the reasoning behind the GDPR. Each links to its full text and to the articles it explains.

• Recital 1 Data Protection as a Fundamental Right
• Recital 2 Respect of the Fundamental Rights and Freedoms
• Recital 3 Directive 95/46/EC Harmonisation
• Recital 4 Data Protection in Balance with Other Fundamental Rights
• Recital 5 Cooperation Between Member States to Exchange Personal Data
• Recital 6 Ensuring a High Level of Data Protection Despite the Increased Exchange of Data
• Recital 7 The Framework is Based on Control and Certainty
• Recital 8 Adoption into National Law
• Recital 9 Different Standards of Protection by the Directive 95/46/EC
• Recital 10 Harmonised Level of Data Protection Despite National Scope
• Recital 11 Harmonisation of the Powers and Sanctions
• Recital 12 Authorization of the European Parliament and the Council
• Recital 13 Taking Account of Micro, Small and Medium-Sized Enterprises
• Recital 14 Not Applicable to Legal Persons
• Recital 15 Technology Neutrality
• Recital 16 Not Applicable to Activities Regarding National and Common Security
• Recital 17 Adaptation of Regulation (EC) No 45/2001
• Recital 18 Not Applicable to Personal or Household Activities
• Recital 19 Not Applicable to Criminal Prosecution
• Recital 20 Respecting the Independence of the Judiciary
• Recital 21 Liability Rules of Intermediary Service Providers Shall Remain Unaffected
• Recital 22 Processing by an Establishment
• Recital 23 Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Targeted
• Recital 24 Applicable to Controllers/Processors Not Established in the Union if Data Subjects Within the Union are Profiled
• Recital 25 Applicable to Controllers Due to International Law
• Recital 26 Not Applicable to Anonymous Data
• Recital 27 Not Applicable to Data of Deceased Persons
• Recital 28 Introduction of Pseudonymisation
• Recital 29 Pseudonymisation at the Same Controller
• Recital 30 Online Identifiers for Profiling and Identification
• Recital 31 Not Applicable to Public Authorities in Connection with Their Official Tasks
• Recital 32 Conditions for Consent
• Recital 33 Consent to Certain Areas of Scientific Research
• Recital 34 Genetic Data
• Recital 35 Health Data
• Recital 36 Determination of the Main Establishment
• Recital 37 Group of undertakings
• Recital 38 Special Protection of Children's Personal Data
• Recital 39 Principles of Data Processing
• Recital 40 Lawfulness of Data Processing
• Recital 41 Legal Basis or Legislative Measures
• Recital 42 Burden of Proof and Requirements for Consent
• Recital 43 Freely Given Consent
• Recital 44 Performance of a Contract
• Recital 45 Fulfillment of Legal Obligations
• Recital 46 Vital Interests of the Data Subject
• Recital 47 Overriding Legitimate Interest
• Recital 48 Overriding Legitimate Interest Within Group of Undertakings
• Recital 49 Network and Information Security as Overriding Legitimate Interest
• Recital 50 Further Processing of Personal Data
• Recital 51 Protecting Sensitive Personal Data
• Recital 52 Exceptions to the Prohibition on Processing Special Categories of Personal Data
• Recital 53 Processing of Sensitive Data in Health and Social Sector
• Recital 54 Processing of Sensitive Data in Public Health Sector
• Recital 55 Public Interest in Processing by Official Authorities for Objectives of Recognized Religious Communities
• Recital 56 Processing Personal Data on People's Political Opinions by Parties
• Recital 57 Additional Data for Identification Purposes
• Recital 58 The Principle of Transparency
• Recital 59 Procedures for the Exercise of the Rights of the Data Subjects
• Recital 60 Information Obligation
• Recital 61 Time of Information
• Recital 62 Exceptions to the Obligation to Provide Information
• Recital 63 Right of Access
• Recital 64 Identity Verification
• Recital 65 Right of Rectification and Erasure
• Recital 66 Right to be Forgotten
• Recital 67 Restriction of Processing
• Recital 68 Right of Data Portability
• Recital 69 Right to Object
• Recital 70 Right to Object to Direct Marketing
• Recital 71 Profiling
• Recital 72 Guidance of the European Data Protection Board Regarding Profiling
• Recital 73 Restrictions of Rights and Principles
• Recital 74 Responsibility and Liability of the Controller
• Recital 75 Risks to the Rights and Freedoms of Natural Persons
• Recital 76 Risk Assessment
• Recital 77 Risk Assessment Guidelines
• Recital 78 Appropriate Technical and Organisational Measures
• Recital 79 Allocation of the Responsibilities
• Recital 80 Designation of a Representative
• Recital 81 The Use of Processors
• Recital 82 Record of Processing Activities
• Recital 83 Security of Processing
• Recital 84 Risk Evaluation and Impact Assessment
• Recital 85 Notification Obligation of Breaches to the Supervisory Authority
• Recital 86 Notification of Data Subjects in Case of Data Breaches
• Recital 87 Promptness of Reporting / Notification
• Recital 88 Format and Procedures of the Notification
• Recital 89 Elimination of the General Reporting Requirement
• Recital 90 Data Protection Impact Assessement
• Recital 91 Necessity of a Data Protection Impact Assessment
• Recital 92 Broader Data Protection Impact Assessment
• Recital 93 Data Protection Impact Assessment at Authorities
• Recital 94 Consultation of the Supervisory Authority
• Recital 95 Support by the Processor
• Recital 96 Consultation of the Supervisory Authority in the Course of a Legislative Process
• Recital 97 Data Protection Officer
• Recital 98 Preparation of Codes of Conduct by Organisations and Associations
• Recital 99 Consultation of Stakeholders and Data Subjects in the Development of Codes of Conduct
• Recital 100 Certification
• Recital 101 General Principles for International Data Transfers
• Recital 102 International Agreements for an Appropriate Level of Data Protection
• Recital 103 Appropriate Level of Data Protection Based on an Adequacy Decision
• Recital 104 Criteria for an Adequacy Decision
• Recital 105 Consideration of International Agreements for an Adequacy Decision
• Recital 106 Monitoring and Periodic Review of the Level of Data Protection
• Recital 107 Amendment, Revocation and Suspension of Adequacy Decisions
• Recital 108 Appropriate Safeguards
• Recital 109 Standard Data Protection Clauses
• Recital 110 Binding Corporate Rules
• Recital 111 Exceptions for Certain Cases of International Transfers
• Recital 112 Data Transfers due to Important Reasons of Public Interest
• Recital 113 Transfers Qualified as Not Repetitive and that Only Concern a Limited Number of Data Subjects
• Recital 114 Safeguarding of Enforceability of Rights and Obligations in the Absence of an Adequacy Decision
• Recital 115 Rules in Third Countries Contrary to the Regulation
• Recital 116 Cooperation Among Supervisory Authorities
• Recital 117 Establishment of Supervisory Authorities
• Recital 118 Monitoring of the Supervisory Authorities
• Recital 119 Organisation of Several Supervisory Authorities of a Member State
• Recital 120 Features of Supervisory Authorities
• Recital 121 Independence of the Supervisory Authorities
• Recital 122 Responsibility of the Supervisory Authorities
• Recital 123 Cooperation of the Supervisory Authorities with Each Other and with the Commission
• Recital 124 Lead Authority Regarding Processing in Several Member States
• Recital 125 Competences of the Lead Authority
• Recital 126 Joint Decisions
• Recital 127 Information of the Supervisory Authority Regarding Local Processing
• Recital 128 Responsibility Regarding Processing in the Public Interest
• Recital 129 Tasks and Powers of the Supervisory Authorities
• Recital 130 Consideration of the Authority with which the Complaint has been Lodged
• Recital 131 Attempt of an Amicable Settlement
• Recital 132 Awareness-Raising Activities and Specific Measures
• Recital 133 Mutual Assistance and Provisional Measures
• Recital 134 Participation in Joint Operations
• Recital 135 Consistency Mechanism
• Recital 136 Binding Decisions and Opinions of the Board
• Recital 137 Provisional Measures
• Recital 138 Urgency Procedure
• Recital 139 European Data Protection Board
• Recital 140 Secretariat and Staff of the Board
• Recital 141 Right to Lodge a Complaint
• Recital 142 The Right of Data Subjects to Mandate a Not-For-Profit Body, Organisation or Association
• Recital 143 Judicial Remedies
• Recital 144 Related Proceedings
• Recital 145 Choice of Venue
• Recital 146 Indemnity
• Recital 147 Jurisdiction
• Recital 148 Penalties
• Recital 149 Penalties for Infringements of National Rules
• Recital 150 Administrative Fines
• Recital 151 Administrative Fines in Denmark and Estonia
• Recital 152 Power of Sanction of the Member States
• Recital 153 Processing of Personal Data Solely for Journalistic Purposes or for the Purposes of Academic, Artistic or Literary Expression
• Recital 154 Principle of Public Access to Official Documents
• Recital 155 Processing in the Employment Context
• Recital 156 Processing for Archiving, Scientific or Historical Research or Statistical Purposes
• Recital 157 Information from Registries and Scientific Research
• Recital 158 Processing for Archiving Purposes
• Recital 159 Processing for Scientific Research Purposes
• Recital 160 Processing for Historical Research Purposes
• Recital 161 Consenting to the Participation in Clinical Trials
• Recital 162 Processing for Statistical Purposes
• Recital 163 Production of European and National Statistics
• Recital 164 Professional or Other Equivalent Secrecy Obligations
• Recital 165 No Prejudice of the Status of Churches and Religious Associations
• Recital 166 Delegated Acts of the Commission
• Recital 167 Implementing Powers of the Commission
• Recital 168 Implementing Acts on Standard Contractual Clauses
• Recital 169 Immediately Applicable Implementing Acts
• Recital 170 Principle of Subsidiarity and Principle of Proportionality
• Recital 171 Repeal of Directive 95/46/EC and Transitional Provisions
• Recital 172 Consultation of the European Data Protection Supervisor
• Recital 173 Relationship to Directive 2002/58/EC