Skip to content
EDPB Guidelines for GDPR Compliance
On Trove · from European Data Protection Board

EDPB Guidelines for GDPR Compliance

Load when you need the EU regulators' official reading of the GDPR.

Read a preview

You can read the contents and the first 2,000 characters.
Free accounts get the whole book.

  • By European Data Protection Board
  • 79 chapters
  • Updated Oct 24, 2026

What’s inside

  • EDPB Guidelines 05/2020 on consent — About this document
  • EDPB Guidelines 05/2020 on consent — 0 PREFACE
  • EDPB Guidelines 05/2020 on consent — 1 INTRODUCTION
  • EDPB Guidelines 05/2020 on consent — 2 CONSENT IN ARTICLE 4(11) OF THE GDPR
  • EDPB Guidelines 05/2020 on consent — 3.1 Free / freely given
  • EDPB Guidelines 05/2020 on consent — 3.2 Specific

What is EDPB Guidelines for GDPR Compliance?

Load when you need the EU regulators' official reading of the GDPR. Five final European Data Protection Board guidelines, word for word, one page per section with the official paragraph numbers: consent (05/2020), controller and processor (07/2020), data protection by design and by default (4/2019), right of access (01/2022) and personal data breach notification (9/2022). Companion to GDPR Compliance: Checklist and Official Texts, whose rules cite these pages.

Read more

European Data Protection Board · markdown · Listed Oct 24, 2026

  • gdpr
  • edpb
  • privacy
  • data protection
  • compliance

From the first page

1. Go to Chapter 2 — Decision Matrix (p. 2). Find your task and jump to the listed page. 2. Each page is one section of one guideline. Paragraphs keep their official numbers, shown as 17. in bold; cite them as "EDPB Guidelines 05/2020, para. 17". 3. Each guideline starts with an "About this document" page: version, adoption date, original link and reuse terms.

Preview · 2,000 of 734,253 characters

GDPR Compliance: Checklist and Official Texts
UI/UX Design Principles for AI Agents
Building Your Agent Team: A Practitioner's Guide to Multi-Agent AI Systems
Blender 3D Mastery: A Complete Reference for Claude Code with Blender MCP

Contents

  1. 01EDPB Guidelines for GDPR Compliancep.1
    1. How to use this bookp.1
    2. Contentsp.1
    3. Source, licence and currencyp.1
  2. 02Decision Matrixp.2
  3. 03EDPB Guidelines 05/2020 on consent — About this documentp.3
  4. 04EDPB Guidelines 05/2020 on consent — 0 PREFACEp.4
  5. 05EDPB Guidelines 05/2020 on consent — 1 INTRODUCTIONp.5
  6. 06EDPB Guidelines 05/2020 on consent — 2 CONSENT IN ARTICLE 4(11) OF THE GDPRp.6
  7. 07EDPB Guidelines 05/2020 on consent — 3.1 Free / freely givenp.7
    1. 3.1.1 Imbalance of powerp.7
    2. 3.1.2 Conditionalityp.7
    3. 3.1.3 Granularityp.7
    4. 3.1.4 Detrimentp.7
  8. 08EDPB Guidelines 05/2020 on consent — 3.2 Specificp.8
See all 79 parts
  1. 09EDPB Guidelines 05/2020 on consent — 3.3 Informedp.9
    1. 3.3.1 Minimum content requirements for consent to be ‘informed’p.9
    2. 3.3.2 How to provide informationp.9
  2. 10EDPB Guidelines 05/2020 on consent — 3.4 Unambiguous indication of wishesp.10
  3. 11EDPB Guidelines 05/2020 on consent — 4 OBTAINING EXPLICIT CONSENTp.11
  4. 12EDPB Guidelines 05/2020 on consent — 5 ADDITIONAL CONDITIONS FOR OBTAINING VALID CONSENTp.12
    1. 5.1 Demonstrate consentp.12
    2. 5.2 Withdrawal of consentp.12
  5. 13EDPB Guidelines 05/2020 on consent — 6 INTERACTION BETWEEN CONSENT AND OTHER LAWFUL GROUNDS IN ARTICLE 6 GDPRp.13
  6. 14EDPB Guidelines 05/2020 on consent — 7 SPECIFIC AREAS OF CONCERN IN THE GDPRp.14
    1. 7.1 Children (Article 8)p.14
    2. 7.2 Scientific researchp.14
    3. 7.3 Data subject’s rightsp.14
  7. 15EDPB Guidelines 05/2020 on consent — 8 CONSENT OBTAINED UNDER DIRECTIVE 95/46/ECp.15
  8. 16EDPB Guidelines 07/2020 on controller and processor — About this documentp.16
  9. 17EDPB Guidelines 07/2020 on controller and processor — EXECUTIVE SUMMARYp.17
    1. Controllerp.17
    2. Joint controllersp.17
    3. Processorp.17
    4. Relationship between controller and processorp.17
    5. Relationship among joint controllersp.17
  10. 18EDPB Guidelines 07/2020 on controller and processor — INTRODUCTIONp.18
  11. 19EDPB Guidelines 07/2020 on controller and processor — Part I – 1 GENERAL OBSERVATIONSp.19
  12. 20EDPB Guidelines 07/2020 on controller and processor — Part I – 2 DEFINITION OF CONTROLLERp.20
    1. 2.1 Definition of controllerp.20
  13. 21EDPB Guidelines 07/2020 on controller and processor — Part I – 3 DEFINITION OF JOINT CONTROLLERSp.21
    1. 3.1 Definition of joint controllersp.21
    2. 3.2 Existence of joint controllershipp.21
  14. 22EDPB Guidelines 07/2020 on controller and processor — Part I – 4 DEFINITION OF PROCESSORp.22
  15. 23EDPB Guidelines 07/2020 on controller and processor — Part I – 5 DEFINITION OF THIRD PARTY/RECIPIENTp.23
    1. Third partyp.23
    2. Recipientp.23
  16. 24EDPB Guidelines 07/2020 on controller and processor — Part II – 1.1 Choice of the processorp.24
    1. 1 RELATIONSHIP BETWEEN CONTROLLER AND PROCESSORp.24
    2. 1.1 Choice of the processorp.24
  17. 25EDPB Guidelines 07/2020 on controller and processor — Part II – 1.2 Form of the contract or other legal actp.25
  18. 26EDPB Guidelines 07/2020 on controller and processor — Part II – 1.3 Content of the contract or other legal actp.26
    1. 1.3.1 The processor must only process data on documented instructions from the controller (Art. 28(3)(a) GDPR)p.26
    2. 1.3.2 The processor must ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28(3)(b) GDPR)p.26
    3. 1.3.3 The processor must take all the measures required pursuant to Article 32 (Art. 28(3)(c) GDPR)p.26
    4. 1.3.4 The processor must respect the conditions referred to in Article 28(2) and 28(4) for engaging another processor (Art. 28(3)(d) GDPR).p.26
    5. 1.3.5 The processor must assist the controller for the fulfilment of its obligation to respond to requests for exercising the data subject's rights (Article 28(3) (e) GDPR).p.26
    6. 1.3.6 The processor must assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 (Art. 28(3)(f) GDPR).p.26
    7. 1.3.7 On termination of the processing activities, the processor must, at the choice of the controller, delete or return all the personal data to the controller and delete existing copies (Art. 28(3)(g) GDPR).p.26
    8. 1.3.8 The processor must make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller (Art. 28(3)(h) GDPR).p.26
  19. 27EDPB Guidelines 07/2020 on controller and processor — Part II – 1.4 Instructions infringing data protection lawp.27
  20. 28EDPB Guidelines 07/2020 on controller and processor — Part II – 1.5 Processor determining purposes and means of processingp.28
  21. 29EDPB Guidelines 07/2020 on controller and processor — Part II – 1.6 Sub-processorsp.29
  22. 30EDPB Guidelines 07/2020 on controller and processor — Part II – 2 CONSEQUENCES OF JOINT CONTROLLERSHIPp.30
    1. 2.1 Determining in a transparent manner the respective responsibilities of joint controllers for compliance with the obligations under the GDPRp.30
    2. 2.2 Allocation of responsibilities needs to be done by way of an arrangementp.30
    3. 2.3 Obligations towards data protection authoritiesp.30
  23. 31EDPB Guidelines 07/2020 on controller and processor — Annex I – Flowchart for applying the concepts of controller, processor and joint controllers in practicep.31
  24. 32EDPB Guidelines 4/2019 on data protection by design and by default — About this documentp.32
  25. 33EDPB Guidelines 4/2019 on data protection by design and by default — Executive summaryp.33
  26. 34EDPB Guidelines 4/2019 on data protection by design and by default — 1 SCOPEp.34
  27. 35EDPB Guidelines 4/2019 on data protection by design and by default — 2 ANALYSIS OF ARTICLE 25(1) AND (2) DATA PROTECTION BY DESIGN AND BY DEFAULTp.35
    1. 2.1 Article 25(1): Data protection by designp.35
    2. 2.2 Article 25(2): Data protection by defaultp.35
  28. 36EDPB Guidelines 4/2019 on data protection by design and by default — 3.1 Transparencyp.36
  29. 37EDPB Guidelines 4/2019 on data protection by design and by default — 3.2 Lawfulnessp.37
  30. 38EDPB Guidelines 4/2019 on data protection by design and by default — 3.3 Fairnessp.38
  31. 39EDPB Guidelines 4/2019 on data protection by design and by default — 3.4 Purpose Limitationp.39
  32. 40EDPB Guidelines 4/2019 on data protection by design and by default — 3.5 Data Minimisationp.40
  33. 41EDPB Guidelines 4/2019 on data protection by design and by default — 3.6 Accuracyp.41
  34. 42EDPB Guidelines 4/2019 on data protection by design and by default — 3.7 Storage limitationp.42
  35. 43EDPB Guidelines 4/2019 on data protection by design and by default — 3.8 Integrity and confidentialityp.43
  36. 44EDPB Guidelines 4/2019 on data protection by design and by default — 3.9 Accountabilityp.44
  37. 45EDPB Guidelines 4/2019 on data protection by design and by default — 4 ARTICLE 25(3) CERTIFICATIONp.45
  38. 46EDPB Guidelines 4/2019 on data protection by design and by default — 5 ENFORCEMENT OF ARTICLE 25 AND CONSEQUENCESp.46
  39. 47EDPB Guidelines 4/2019 on data protection by design and by default — 6 RECOMMENDATIONSp.47
  40. 48EDPB Guidelines 01/2022 on the right of access — About this documentp.48
    1. Version historyp.48
    2. Licencep.48
    3. About this conversionp.48
    4. Pages that followp.48
  41. 49EDPB Guidelines 01/2022 on the right of access — EXECUTIVE SUMMARYp.49
    1. Aim and overall structure of the right of accessp.49
    2. General considerations on the assessment of the data subject’s requestp.49
    3. Scope of the right of accessp.49
    4. How to provide accessp.49
    5. Limits and restrictionsp.49
  42. 50EDPB Guidelines 01/2022 on the right of access — Preamblep.50
  43. 51EDPB Guidelines 01/2022 on the right of access — 1 INTRODUCTION - GENERAL OBSERVATIONSp.51
  44. 52EDPB Guidelines 01/2022 on the right of access — 2.1 Aim of the right of accessp.52
  45. 53EDPB Guidelines 01/2022 on the right of access — 2.2 Structure of Article 15 GDPRp.53
    1. 2.2.1 Defining the content of the right of accessp.53
    2. 2.2.2 Provisions on Modalitiesp.53
    3. 2.2.3 Possible limitation of the right of accessp.53
  46. 54EDPB Guidelines 01/2022 on the right of access — 2.3 General principles of the right of accessp.54
    1. 2.3.1 Completeness of the informationp.54
    2. 2.3.2 Correctness of the informationp.54
    3. 2.3.3 Time reference point of the assessmentp.54
    4. 2.3.4 Compliance with data security requirementsp.54
  47. 55EDPB Guidelines 01/2022 on the right of access — 3.1 Introductionp.55
    1. 3.1.1 Analysis of the content of the requestp.55
    2. 3.1.2 Form of the requestp.55
  48. 56EDPB Guidelines 01/2022 on the right of access — 3.2 Identification and authenticationp.56
  49. 57EDPB Guidelines 01/2022 on the right of access — 3.3 Proportionality assessment regarding authentication of the requesting personp.57
  50. 58EDPB Guidelines 01/2022 on the right of access — 3.4 Requests made via third parties / proxiesp.58
    1. 3.4.1 Exercise of the right of access on behalf of childrenp.58
    2. 3.4.2 Exercising the right of access through portals / channels provided by a third partyp.58
  51. 59EDPB Guidelines 01/2022 on the right of access — 4.1 Definition of personal datap.59
  52. 60EDPB Guidelines 01/2022 on the right of access — 4.2 The personal data the right of access refers top.60
    1. 4.2.1 “personal data concerning him or her”p.60
    2. 4.2.2 Personal data which “are being processed”p.60
    3. 4.2.3 The scope of a new request to accessp.60
  53. 61EDPB Guidelines 01/2022 on the right of access — 4.3 Information on the processing and on data subject rightsp.61
  54. 62EDPB Guidelines 01/2022 on the right of access — 5.1 How can the controller retrieve the requested data?p.62
  55. 63EDPB Guidelines 01/2022 on the right of access — 5.2 Appropriate measures for providing accessp.63
    1. 5.2.1 Taking “appropriate measures”p.63
    2. 5.2.2 Different means to provide accessp.63
    3. 5.2.3 Providing access in a ”concise, transparent, intelligible and easily accessible form using clear and plain language”p.63
    4. 5.2.4 A large quantity of information necessitates specific requirements on how the information is providedp.63
    5. 5.2.5 Formatp.63
  56. 64EDPB Guidelines 01/2022 on the right of access — 5.3 Timing for the provision of accessp.64
  57. 65EDPB Guidelines 01/2022 on the right of access — 6 LIMITS AND RESTRICTIONS OF THE RIGHT OF ACCESSp.65
    1. 6.1 General remarksp.65
    2. 6.2 Article 15 (4) GDPRp.65
    3. 6.3 Article 12(5) GDPRp.65
    4. 6.4 Possible restrictions in Union or Member States law based on Article 23 GDPR and derogationsp.65
  58. 66EDPB Guidelines 01/2022 on the right of access — ANNEX – FLOWCHARTp.66
    1. Step 1: How to interpret and assess the request?p.66
    2. Step 2: How to answer the request (1)?p.66
    3. Step 2: How to answer the request (2)?p.66
    4. Step 2: How to answer the request (3)?p.66
    5. Step 3: Checking limits and restrictions (1)p.66
    6. Step 3: Checking limits and restrictions (2)p.66
  59. 67EDPB Guidelines 9/2022 on personal data breach notification — About this documentp.67
    1. Version historyp.67
    2. Pages in this bookp.67
  60. 68EDPB Guidelines 9/2022 on personal data breach notification — 0 PREFACEp.68
  61. 69EDPB Guidelines 9/2022 on personal data breach notification — INTRODUCTIONp.69
  62. 70EDPB Guidelines 9/2022 on personal data breach notification — I. PERSONAL DATA BREACH NOTIFICATION UNDER THE GDPRp.70
    1. A. Basic security considerationsp.70
    2. B. What is a personal data breach?p.70
  63. 71EDPB Guidelines 9/2022 on personal data breach notification — II.A When to notifyp.71
    1. 1. Article 33 requirementsp.71
    2. 2. When does a controller become “aware”?p.71
    3. 3. Joint controllersp.71
    4. 4. Processor obligationsp.71
  64. 72EDPB Guidelines 9/2022 on personal data breach notification — II.B Providing information to the supervisory authorityp.72
    1. 1. Information to be providedp.72
    2. 2. Notification in phasesp.72
    3. 3. Delayed notificationsp.72
  65. 73EDPB Guidelines 9/2022 on personal data breach notification — II.C Cross-border breaches and breaches at non-EU establishmentsp.73
    1. 1. Cross-border breachesp.73
    2. 2. Breaches at non-EU establishmentsp.73
  66. 74EDPB Guidelines 9/2022 on personal data breach notification — II.D Conditions where notification is not requiredp.74
  67. 75EDPB Guidelines 9/2022 on personal data breach notification — III. ARTICLE 34 – COMMUNICATION TO THE DATA SUBJECTp.75
    1. A. Informing individualsp.75
    2. B. Information to be providedp.75
    3. C. Contacting individualsp.75
    4. D. Conditions where communication is not requiredp.75
  68. 76EDPB Guidelines 9/2022 on personal data breach notification — IV. ASSESSING RISK AND HIGH RISKp.76
    1. A. Risk as a trigger for notificationp.76
    2. B. Factors to consider when assessing riskp.76
  69. 77EDPB Guidelines 9/2022 on personal data breach notification — V. ACCOUNTABILITY AND RECORD KEEPINGp.77
    1. A. Documenting breachesp.77
    2. B. Role of the Data Protection Officerp.77
  70. 78EDPB Guidelines 9/2022 on personal data breach notification — VI. NOTIFICATION OBLIGATIONS UNDER OTHER LEGAL INSTRUMENTSp.78
  71. 79EDPB Guidelines 9/2022 on personal data breach notification — VII. ANNEXp.79
    1. A. Flowchart showing notification requirementsp.79
    2. B. Examples of personal data breaches and who to notifyp.79