Regulation (EU) 2016/679

General Data Protection Regulation

Regulation — European Union

Effective: May 25, 2018 100 platforms tracked 1259 provisions indexed Enforced by: European Data Protection Board (EDPB), National Data Protection Authorities (DPAs) Last reviewed Apr 23, 2026

Overview

The General Data Protection Regulation is the European Union's comprehensive data protection framework, replacing the 1995 Data Protection Directive. It establishes strict requirements for how organizations collect, process, store, and share personal data of individuals in the EU and EEA.

GDPR grants data subjects specific rights including the right to access, rectification, erasure ("right to be forgotten"), data portability, and the right to object to automated decision-making. Organizations must demonstrate a lawful basis for processing (consent, contractual necessity, legitimate interest, legal obligation, vital interest, or public task) and implement appropriate technical and organizational safeguards.

Enforcement is carried out by national Data Protection Authorities coordinated through the European Data Protection Board. Penalties can reach up to €20 million or 4% of global annual turnover, whichever is higher — making GDPR one of the most consequential regulatory frameworks for platform governance globally.

Penalties

Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Lower-tier violations (e.g. record-keeping failures): up to €10 million or 2% of turnover.

Key Articles & Sections

Art. 5 Principles of Processing

Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.
Read full text →
Art. 6 Lawfulness of Processing

Six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, legitimate interests.
Read full text →
Art. 7 Conditions for Consent

Consent must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.
Read full text →
Art. 13-14 Transparency Requirements

Controllers must provide detailed information at point of collection including purposes, legal basis, recipients, retention periods, and data subject rights.
Read full text →
Art. 15 Right of Access

Data subjects have the right to obtain confirmation of processing and access to their personal data.
Read full text →
Art. 17 Right to Erasure

The "right to be forgotten" — data subjects can request deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful.
Read full text →
Art. 20 Right to Data Portability

Data subjects can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller.
Read full text →
Art. 22 Automated Decision-Making

Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects.
Read full text →
Art. 25 Data Protection by Design and Default

Controllers must implement appropriate technical and organizational measures at the time of design and by default.
Read full text →
Art. 32 Security of Processing

Controllers and processors must implement appropriate technical and organizational security measures including encryption and pseudonymization.
Read full text →
Art. 33-34 Breach Notification

Personal data breaches must be reported to supervisory authority within 72 hours. Data subjects must be notified if breach poses high risk.
Read full text →
Art. 44-49 International Transfers

Personal data transfers outside EU/EEA require adequacy decisions, standard contractual clauses, binding corporate rules, or other safeguards.
Read full text →

Platforms We Track Subject to GDPR

11 relevant provisions

0 relevant provisions

13 relevant provisions

0 relevant provisions

0 relevant provisions

34 relevant provisions

0 relevant provisions

35 relevant provisions

35 relevant provisions

0 relevant provisions

5 relevant provisions

8 relevant provisions

8 relevant provisions

0 relevant provisions

12 relevant provisions

11 relevant provisions

0 relevant provisions

11 relevant provisions

10 relevant provisions

0 relevant provisions

35 relevant provisions

11 relevant provisions

0 relevant provisions

0 relevant provisions

0 relevant provisions

0 relevant provisions

12 relevant provisions

0 relevant provisions

8 relevant provisions

0 relevant provisions

Showing 30 of 100 platforms. View all platforms →

Recent Changes Related to GDPR

Apr 20, 2026 Canva Low

Canva updated their Privacy Policy on April 20, 2026, with a minor navigation change adding 'Template library' to the product menu in the page header. The actual privacy policy text itself does not a…
View change record →
Apr 20, 2026 Canva Low

Canva updated their Terms of Use on April 20, 2026. The change adds 'Template library' as a listed item in their product navigation menu. This is a minor cosmetic update to the document's navigation …
View change record →
Apr 20, 2026 Udemy Low

Udemy replaced the welcoming introductory text on their legal terms and resource center page with a 'page not found' error message. Previously, the page greeted visitors with a friendly description o…
View change record →
Apr 20, 2026 Reddit Low

Reddit's privacy policy page was detected as changed on April 20, 2026, but the actual difference is limited to an internal JavaScript challenge token used for bot verification — not any substantive …
View change record →
Apr 19, 2026 Waze Medium

Waze updated its privacy policy on April 19, 2026, removing several sections about social network integration and a 'find friends' feature that previously explained how Waze collected phone contacts …
View change record →
Apr 19, 2026 Waze Low

On April 19, 2026, Waze updated its Terms of Use by adding foundational language that formally identifies Waze Mobile Ltd. (an Israeli company with Google affiliates) as the service provider and clar…
View change record →
Apr 19, 2026 Uniswap Low

Uniswap updated their privacy policy page on April 19, 2026, but the detected change appears to be primarily a structural and navigational overhaul rather than a substantive update to privacy commitm…
View change record →
Apr 19, 2026 Uniswap Low

Uniswap updated their Terms of Service page on April 19, 2026, transforming it from a straightforward legal terms document into what appears to be a help center or FAQ hub with navigation links cover…
View change record →
Apr 19, 2026 eBay Low

eBay made a minor update to their User Agreement on April 19, 2026, removing the word 'Breadcrumb' from the navigation label at the top of the page. This is a cosmetic change to the page's breadcrumb…
View change record →
Apr 19, 2026 Skillshare Low

Skillshare updated their privacy policy on April 19, 2026, changing the 'Last Updated' date display from a specific date ('September 16, 2024') to a relative timestamp ('1 year ago'). This means user…
View change record →

Related Regulations

Official Source

View official regulation text →

Get alerted when platforms change their policies — including GDPR-relevant provisions.

Subscribe to Watcher — $9.99/mo