--- title: "CA-TFN Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ca-tfn-data-protection-privacy-regulation/ source_html: /jurisdictions/canada-tobique-first-nation/index.html description: "CA-TFN data protection and privacy regulation: 10 categories, 5 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 31883391b17e8fd88e4e03e4173d123cf528ac4d7f602899537eb886fbbfcf30 generator: "fe-fleet/md-twin@1.0" --- # CA-TFN Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: artificial-intelligence Last updated 2026-10-25 · 10 categories · 5 claims · 42 sources in the cumulative register Download report (PDF) Expand all Summary answer not yet published for this jurisdiction Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CANADA-TOBIQUE-FIRST-NATION)[Build Report](/reports/?j=CANADA-TOBIQUE-FIRST-NATION)[Compare](/compare/?j=CANADA-TOBIQUE-FIRST-NATION) Framework posture Hybrid regime 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Privacy Commissioner of Canada (OPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 0 Red categories 58 Sub-modules 5 Claims 12 Tier-1 sources Traffic-light mix 7 amber 2 green 1 n/a (sums to 10 rendered categories; click to filter) No red categories; 25 sub-modules are flagged red. Canada federal law that applies in CA-TFN is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers CA-TFN’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Standing operating brief 258 words CA-TFN operates under a hybrid regime supervised by Office of the Privacy Commissioner of Canada (OPC) , with 9 regulatory modules assessed in the current cycle. - D1 · Regulator & Framework: A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists. - D2 · Lawful Processing: Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list. - D3 · Data Subject Rights: Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent. - D4 · Controller & Processor: Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM). All 9 module posture summaries - D1 · Regulator & Framework: A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists. - D2 · Lawful Processing: Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list. - D3 · Data Subject Rights: Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent. - D4 · Controller & Processor: Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM). - D5 · Cross-Border & Adequacy: Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only. - D6 · Sectoral Watch: The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps. - D8 · AI, Biometrics & Automated: Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force. - D9 · Children's Privacy: Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage. - D10 · Enforcement & Redress: Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform. Key regulatory facts for CA-TFN Regulatory Dimension CA-TFN Standing Position Jurisdiction CA-TFN (CA-TFN) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 5 sourced findings) Regulator & Framework A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no... Lawful Processing & Special Data Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list. Data Subject Rights Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent. Controller/Processor Duties Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM). Primary Instruments Cited Tobique Gaming Commission, CA-TFN Official Instrument (fnigc.ca FNIGC_FN_Guide_Privacy_Act_EN-1-), Tobique Gaming Commission Last Confirmed / Updated 2026-10-25 (42 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### CA-TFN: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists. Primary framework Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c.5 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber A functioning federal regulator and statute exist and have been applied directly to a First Nation band council, but PIPEDA's material scope is activity-limited (commercial/FWUB) rather than universal, and no registration/filing regime or Indigenous-specific instrument exists. #### Sub-modules (5) #### Regulator And AuthorityGreen OPC is an independent Agent of Parliament mandated to oversee both PIPEDA (private sector) and the Privacy Act (federal public sector). Claims (2): - Tobique Gaming Commission — TGC has appointed a data protection officer responsible for its own website privacy policy and acts as controller for data collected through thetgc.ca. #### Act And InstrumentsAmber PIPEDA received Royal Assent in 2000; Part 1 is the operative private-sector instrument; no successor statute has yet replaced it. Claims indexed in baseline register · source extraction in progress #### Material ScopeAmber PIPEDA covers commercial-activity personal information nationally and FWUB employee data, including, per OPC case practice, band-council employees acting in core governmental functions. Claims (3): - Office of the Privacy Commissioner of Canada / Tobique First Nation — PIPEDA plausibly applies to private-sector commercial activity but its application to Tobique First Nation government bodies and the Tobique Gaming Commission as a First Nation regulatory body is unresolved; First Nations data-sovereignty principles (OCAP) assert First Nations data is governed by First Nations laws #### Territorial ScopeGreen PIPEDA applies wherever there is a real and substantial connection to Canada and applies fully within New Brunswick because NB has no 'substantially similar' provincial law (unlike AB/BC/QC). Claims indexed in baseline register · source extraction in progress #### Regulator Registration And FilingRed No general registration, notification or fee duty on controllers was identified under PIPEDA. Tobique First Nation (a reserve community in New Brunswick) is not subject to a dedicated Indigenous or provincial private-sector data-protection statute. The operative regime is the federal Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner of Canada (OPC), which applies to commercial activity across Canada and to employee data of 'federal works, undertakings or businesses' (FWUBs). New Brunswick has not enacted a provincial private-sector law deemed 'substantially similar' to PIPEDA (unlike Alberta, BC and Quebec), so PIPEDA applies in full within NB. OPC practice treats a First Nation band council acting in its core governmental functions as a FWUB, bringing band-council employee personal information within PIPEDA's and the OPC's jurisdiction — a finding of direct relevance to Tobique First Nation's own governance body. Sources and claims (2) - [Tobique Gaming Commission](https://thetgc.ca/privacy-policy/) — Tobique Gaming Commission — TGC has appointed a data protection officer responsible for its own website privacy policy and acts as controller for data collected through thetgc.ca. - [https://fnigc.ca/wp-content/uploads/2024/08/FNIGC_FN_Guide_Privacy_Act_EN-1.pdf](https://fnigc.ca/wp-content/uploads/2024/08/FNIGC_FN_Guide_Privacy_Act_EN-1.pdf) — Office of the Privacy Commissioner of Canada / Tobique First Nation — PIPEDA plausibly applies to private-sector commercial activity but its application to Tobique First Nation government bodies and the Tobique Gaming Commission as a First Nation regulatory body is unresolved; First Nations data-sovereignty principles (OCAP) assert First Nations data is governed by First Nations laws ### CA-TFN: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list. Primary framework PIPEDA Schedule 1 (CSA Model Code) Principles 4.1-4.10; ss.5(3), 6.1, 7 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber Core consent and sensitivity doctrines are well-developed and actively enforced, but there is no statutory anonymisation/pseudonymisation safe harbour and no enumerated special-category list. D2 · Lawful Processing — Full Module Record 4 sub-modules · 88 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent. Primary framework PIPEDA s.8; Schedule 1 Principle 4.9 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber Access and timeliness rights are robust and enforced, but erasure and portability rights that are now baseline in comparator regimes remain absent. #### Sub-modules (5) #### Access RightGreen Individuals have the right to be informed of, and to access, their personal information held by an organization. Claims indexed in baseline register · source extraction in progress #### Deadlines And Response WindowsGreen 30-day response deadline, one 30-day extension (with written notice and complaint-rights advisory), deemed refusal on silence; actively enforced (e.g., Bell 2026 contravention). Claims indexed in baseline register · source extraction in progress #### Rectification And ErasureRed Right to challenge accuracy exists; no standalone erasure right exists under PIPEDA, and the CPPA's proposed right to be forgotten died with Bill C-27. Claims indexed in baseline register · source extraction in progress #### Data PortabilityRed PIPEDA has no direct equivalent of GDPR Art 20 data portability. Claims indexed in baseline register · source extraction in progress #### Restriction And ObjectionRed No explicit standalone restriction/objection right distinct from consent withdrawal was confirmed in sources reviewed this cycle. Individuals have a right of access and to challenge accuracy (Principle 4.9), with a strict 30-day statutory response deadline (s.8(3)), a single 30-day extension option with mandatory notice (s.8(4)), and a deemed-refusal consequence for silence (s.8(5)) — actively enforced (e.g., 2026 Bell Canada finding). PIPEDA has no standalone erasure/'right to be forgotten' or data-portability right; the defunct Bill C-27/CPPA would have added both. ### CA-TFN: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM). Primary framework PIPEDA ss.10.1-10.3; Schedule 1 Principles 4.1, 4.7 Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Green Breach-notification and accountability duties are clearly specified, in force, and actively enforced through multiple OPC findings (Brinks, MGM). D4 · Controller & Processor — Full Module Record 7 sub-modules · 95 words · 7 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only. Primary framework PIPEDA (transborder transfer accountability); EU Commission Canada adequacy decision (2001, reconfirmed 2024); UK Canada adequacy regulations Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Green Adequacy from both the EU and UK is current and was substantively reconfirmed in 2024, though materially scoped to PIPEDA-covered commercial data only. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 80 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps. Primary framework PIPEDA (FWUB doctrine); OCAP® Principles (non-statutory); First Nations Data Governance Strategy (2020, non-statutory) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber The core JID-defining jurisdictional finding (band council as FWUB) is well evidenced, but health-sector and financial-sector sectoral overlays for this specific community remain unconfirmed gaps. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 112 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ This is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework. Primary framework PIPEDA (general consent principles only); Canada's Anti-Spam Legislation (CASL) for electronic marketing Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Not assessed This is the weakest-covered module: no dedicated cookie, dark-pattern, opt-out-signal, or clean-room regime exists under the operative PIPEDA framework. #### Sub-modules (6) #### Cookies And TrackersRed No dedicated statutory cookie-consent provision; OPC applies general meaningful-consent doctrine and recommends avoiding tracking of children. Claims indexed in baseline register · source extraction in progress #### Dark PatternsRed No binding dark-pattern prohibition under PIPEDA was found; OPC has funded academic research into dark patterns but this is not a regulatory instrument. Claims indexed in baseline register · source extraction in progress #### Opt Out SignalsRed No PIPEDA-specific recognition of browser-level opt-out signals (e.g., Global Privacy Control) was located. #### Clean Rooms And DcrRed No data clean-room-specific regime was located under PIPEDA. #### Cross Context AdvertisingRed No CPRA-style 'sale'/'share' cross-context advertising regime was located under PIPEDA. #### Direct MarketingAmber Electronic direct marketing consent (opt-in, soft opt-in for existing business relationships) is governed by CASL, administered by the CRTC/Competition Bureau separately from OPC/PIPEDA enforcement. Claims indexed in baseline register · source extraction in progress PIPEDA has no dedicated cookie-consent or ePrivacy-style tracker regime; the OPC instead applies its general meaningful-consent framework to online behavioural advertising, acknowledging that valid consent from children is difficult to obtain and recommending organizations avoid tracking on child-directed sites. Electronic direct marketing is governed by a separate statute, Canada's Anti-Spam Legislation (CASL), enforced by the CRTC/Competition Bureau rather than the OPC. No dedicated dark-pattern prohibition, opt-out-signal (e.g., GPC) regime, clean-room framework, or cross-context-advertising rule analogous to CPRA was identified under PIPEDA. ### CA-TFN: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force. Primary framework PIPEDA (general consent/purpose principles only — no AI-specific statute in force); defunct Artificial Intelligence and Data Act (AIDA, Bill C-27) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber Vigorous ad hoc enforcement exists against biometric surveillance misuse via general consent/purpose principles, but no codified ADM-transparency right or AI-specific statute is currently in force. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 111 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage. Primary framework PIPEDA s.6.1; Schedule 1 Principle 4.3; OPC Guidelines for Obtaining Meaningful Consent (non-statutory) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber Strong, actively-enforced interpretive protections for minors exist, but they rest on non-binding OPC guidance rather than statute, and a prospective enforceable children's code remains at the consultation stage. D9 · Children's Privacy — Full Module Record 5 sub-modules · 112 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### CA-TFN: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform. Primary framework PIPEDA ss.11-17 (complaints, compliance agreements, Federal Court); defunct Consumer Privacy Protection Act (Bill C-27) Supervisory authority [Office of the Privacy Commissioner of Canada (OPC)](https://www.priv.gc.ca/) Traffic-light rationale — Amber Active, well-documented enforcement continues via the ombudsman/Federal-Court model, but the absence of order-making power and AMPs under current law is a structural weakness flagged repeatedly by the regulator itself, pending stalled legislative reform. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 155 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties