How does ConductAtlas monitor GDPR compliance?

ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect GDPR obligations. Every change is archived with cryptographic verification.

Regulation

Regulation (EU) 2016/679

General Data Protection Regulation

Regulation, European Union

Effective: May 25, 2018 Enforced by: European Data Protection Board (EDPB), National Data Protection Authorities (DPAs) Last reviewed May 9, 2026

Overview

The General Data Protection Regulation is the European Union's comprehensive data protection framework, replacing the 1995 Data Protection Directive. It establishes strict requirements for how organizations collect, process, store, and share personal data of individuals in the EU and EEA.

GDPR grants data subjects specific rights including the right to access, rectification, erasure ("right to be forgotten"), data portability, and the right to object to automated decision-making. Organizations must demonstrate a lawful basis for processing (consent, contractual necessity, legitimate interest, legal obligation, vital interest, or public task) and implement appropriate technical and organizational safeguards.

Enforcement is carried out by national Data Protection Authorities coordinated through the European Data Protection Board. Penalties can reach up to €20 million or 4% of global annual turnover, whichever is higher — making GDPR one of the most consequential regulatory frameworks for platform governance globally.

Penalties

Up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Lower-tier violations (e.g. record-keeping failures): up to €10 million or 2% of turnover.

Key Articles & Sections

Art. 5 Principles of Processing

Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability.
Read full text →
Art. 6 Lawfulness of Processing

Six lawful bases for processing: consent, contract, legal obligation, vital interests, public task, legitimate interests.
Read full text →
Art. 7 Conditions for Consent

Consent must be freely given, specific, informed, and unambiguous. Must be as easy to withdraw as to give.
Read full text →
Art. 13-14 Transparency Requirements

Controllers must provide detailed information at point of collection including purposes, legal basis, recipients, retention periods, and data subject rights.
Read full text →
Art. 15 Right of Access

Data subjects have the right to obtain confirmation of processing and access to their personal data.
Read full text →
Art. 17 Right to Erasure

The "right to be forgotten" — data subjects can request deletion when data is no longer necessary, consent is withdrawn, or processing is unlawful.
Read full text →
Art. 20 Right to Data Portability

Data subjects can receive their data in a structured, commonly used, machine-readable format and transmit it to another controller.
Read full text →
Art. 22 Automated Decision-Making

Data subjects have the right not to be subject to decisions based solely on automated processing that produce legal or significant effects.
Read full text →
Art. 25 Data Protection by Design and Default

Controllers must implement appropriate technical and organizational measures at the time of design and by default.
Read full text →
Art. 32 Security of Processing

Controllers and processors must implement appropriate technical and organizational security measures including encryption and pseudonymization.
Read full text →
Art. 33-34 Breach Notification

Personal data breaches must be reported to supervisory authority within 72 hours. Data subjects must be notified if breach poses high risk.
Read full text →
Art. 44-49 International Transfers

Personal data transfers outside EU/EEA require adequacy decisions, standard contractual clauses, binding corporate rules, or other safeguards.
Read full text →

ⓘ

ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology

Related Regulations

Official Source

View official regulation text →

Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.

Monitor up to 20 platforms — $4.99/mo → Get the weekly letter, free