--- title: "European Economic Area (Bloc) Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/ source_html: /jurisdictions/european-economic-area-bloc/index.html description: "European Economic Area (Bloc) data protection and privacy regulation: 10 categories, 90 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: d2c453fd12b0f0b87e9492ddfd383f0b70be97c28fae5ef0fa4992d32e875f1e generator: "fe-fleet/md-twin@1.0" --- # European Economic Area (Bloc) Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/european-economic-area-bloc/), [World Payments](https://payments.gi/jurisdictions/european-economic-area-bloc/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 90 claims · 66 sources in the cumulative register Download report (PDF) Expand all On 21 October 2026, the Council's Permanent Representatives Committee agreed its negotiating mandate on the European Commission's Digital Omnibus proposal, COM(2025) 837, which would amend the GDPR's definition of personal data under Article 4(1), the interplay between fines methodology and Article 83(2), and related provisions. Data collected 2026-10-24 · Data published 2026-11-04 Expert reviewed as at 24 Oct 2026 · peter-pink-howitt-ramparts Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: Expert-reviewed · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=EUROPEAN-ECONOMIC-AREA-BLOC)[Build Report](/reports/?j=EUROPEAN-ECONOMIC-AREA-BLOC)[Compare](/compare/?j=EUROPEAN-ECONOMIC-AREA-BLOC) Framework posture Regulated (omnibus) 10 of 10 modules populated · Expert-reviewed Lead supervisory authority European Data Protection Board (EDPB), coordinating the national supervisory authorit Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 10 Confirmed · 0 Probable · 0 Uncertain 10 Categories 0 Red categories 58 Sub-modules 90 Claims 41 Tier-1 sources Traffic-light mix 9 amber 1 green (sums to 10 rendered categories; click to filter) No categories are currently flagged red. ## Member jurisdictions This page covers law made at European Economic Area (Bloc) level once. Each member’s page covers implementation, national authorities, national options and local enforcement (30 of 30 members covered here). - [Austria](/jurisdictions/austria/) - [Belgium](/jurisdictions/belgium/) - [Bulgaria](/jurisdictions/bulgaria/) - [Croatia](/jurisdictions/croatia/) - [Cyprus](/jurisdictions/cyprus/) - [Czech Republic](/jurisdictions/czech-republic/) - [Denmark](/jurisdictions/denmark/) - [Estonia](/jurisdictions/estonia/) - [Finland](/jurisdictions/finland/) - [France](/jurisdictions/france/) - [Germany](/jurisdictions/germany/) - [Greece](/jurisdictions/greece/) - [Hungary](/jurisdictions/hungary/) - [Iceland](/jurisdictions/iceland/) - [Ireland](/jurisdictions/ireland/) - [Italy](/jurisdictions/italy/) - [Latvia](/jurisdictions/latvia/) - [Liechtenstein](/jurisdictions/liechtenstein/) - [Lithuania](/jurisdictions/lithuania/) - [Luxembourg](/jurisdictions/luxembourg/) - [Malta](/jurisdictions/malta/) - [Netherlands](/jurisdictions/netherlands/) - [Norway](/jurisdictions/norway/) - [Poland](/jurisdictions/poland/) - [Portugal](/jurisdictions/portugal/) - [Romania](/jurisdictions/romania/) - [Slovakia](/jurisdictions/slovakia/) - [Slovenia](/jurisdictions/slovenia/) - [Spain](/jurisdictions/spain/) - [Sweden](/jurisdictions/sweden/) ## Jurisdiction brief Standing operating brief 353 words EEA operates under a regulated (omnibus) supervised by European Data Protection Board (EDPB), coordinating the national supervisory authorit , with 10 regulatory modules assessed in the current cycle. - D1 · Regulator & Framework: Harmonised 30-state EEA regime anchored in Regulation (EU) 2016/679 (GDPR), updated by the Cross-Border Procedural Regulation (EU) 2025/2518 (adopted 26 Nov 2025, entered into force 1 Jan 2026, applicable 2 April 2027) and active legislative negotiations on the Digital Omnibus Proposal COM(2025) 837 final. - D2 · Lawful Processing: Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation. - D3 · Data Subject Rights: Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope. - D4 · Controller & Processor: Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted. All 10 module posture summaries - D1 · Regulator & Framework: Harmonised 30-state EEA regime anchored in Regulation (EU) 2016/679 (GDPR), updated by the Cross-Border Procedural Regulation (EU) 2025/2518 (adopted 26 Nov 2025, entered into force 1 Jan 2026, applicable 2 April 2027) and active legislative negotiations on the Digital Omnibus Proposal COM(2025) 837 final. - D2 · Lawful Processing: Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation. - D3 · Data Subject Rights: Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope. - D4 · Controller & Processor: Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted. - D5 · Cross-Border & Adequacy: Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025). - D6 · Sectoral Watch: Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps. - D7 · AdTech & Marketing: Cookie-consent fatigue is a recognised, unresolved policy problem; the principal legislative fix (Art. 88b) is currently stalled in the Council, leaving practical mechanics unsettled. - D8 · AI, Biometrics & Automated: Article 22 is settled law with recent CJEU interpretation, but the practical GDPR/AI Act interface remains in active development pending joint EDPB-Commission guidelines and AI Act simplification. - D9 · Children's Privacy: Core Article 8 mechanism is well-established law, but dedicated children's-data guidelines remain in development and several sub-areas (age verification specifics, education settings, dependent adults) lack direct 2026 sourcing in this pass. - D10 · Enforcement & Redress: Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application). Key regulatory facts for European Economic Area (Bloc) Regulatory Dimension European Economic Area (Bloc) Standing Position Jurisdiction European Economic Area (Bloc) (EEA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 90 sourced findings) Regulator & Framework Harmonised 30-state EEA regime anchored in Regulation (EU) 2016/679 (GDPR), updated by the Cross-Border Procedural Regulation (EU) 2025/2518 (adopted 26 Nov 2025, entered into force 1 Jan 2026, applicable 2 April... Lawful Processing & Special Data Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation. Data Subject Rights Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope. Controller/Processor Duties Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted. Primary Instruments Cited EDPS, IAPP, CNIL, European Economic Area (Bloc) Statutory Instrument reg/2025/2518/oj, IAPP Last Confirmed / Updated 2026-11-04 (66 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### European Economic Area (Bloc): D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Harmonised 30-state EEA regime anchored in Regulation (EU) 2016/679 (GDPR), updated by the Cross-Border Procedural Regulation (EU) 2025/2518 (adopted 26 Nov 2025, entered into force 1 Jan 2026, applicable 2 April 2027) and active legislative negotiations on the Digital Omnibus Proposal COM(2025) 837 final. Primary framework Regulation (EU) 2016/679 (GDPR), incorporated into the EEA Agreement (Annex XI) Supervisory authority [European Data Protection Board (EDPB), coordinating the national supervisory authorities of the EU/EEA Member States](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Harmonised 30-state EEA regime anchored in Regulation (EU) 2016/679 (GDPR), updated by the Cross-Border Procedural Regulation (EU) 2025/2518 (adopted 26 Nov 2025, entered into force 1 Jan 2026, applicable 2 April 2027) and active legislative negotiations on the Digital Omnibus Proposal COM(2025) 837 final. #### Sub-modules (5) The European Economic Area (EEA) data protection regime applies across all 27 EU Member States and the 3 EEA EFTA states (Iceland, Liechtenstein, and Norway, where the GDPR was incorporated into Annex XI to the EEA Agreement by EEA Joint Committee Decision No 154/2018 effective 20 July 2018). The core architecture comprises Regulation (EU) 2016/679 (GDPR), Directive (EU) 2016/680 (Law Enforcement Directive), Directive 2002/58/EC (ePrivacy Directive, following the European Commission's formal withdrawal of the long-stalled ePrivacy Regulation proposal in February 2025), and Regulation (EU) 2018/1725 (EUDPR for EU institutions). Supervision is decentralised across national Data Protection Authorities (DPAs) in each of the 30 EEA states (including decentralized Land-level DPAs in Germany) coordinated through the One-Stop-Shop (Art. 56) and Consistency Mechanism (Arts. 60–65) by the European Data Protection Board (EDPB), in which the three EEA EFTA DPAs (Datatilsynet Norway, Persónuvernd Iceland, DSS Liechtenstein) and the EFTA Surveillance Authority participate as full operational members without voting rights or eligibility to hold the Chair (Decision No 154/2018). Two major legislative developments reshape the framework in 2025–2026: first, Regulation (EU) 2025/2518 on additional procedural rules for cross-border GDPR enforcement was enacted on 26 November 2025 (OJ L, 12.12.2025), entered into force on 1 January 2026, and applies from 2 April 2027; second, on 19 November 2025 the European Commission tabled the Digital Omnibus Regulation proposal (COM(2025) 837 final; EDPB–EDPS Joint Opinion 2/2026 issued 10 February 2026), proposing targeted amendments to the GDPR, ePrivacy Directive, Data Act, and AI Act. Sources and claims (17) - [EDPS](https://www.edps.europa.eu/data-protection/our-work/cooperation-eu-dpas/cooperation-european-economic-area-eea-and-european-free-trade-association-efta_en) — National data protection authorities of the EU Member States and the EEA EFTA states (Iceland, Liechtenstein, Norway) are the primary enforcement bodies for the GDPR, cooperating through the EDPB's consistency and cooperation framework. - [IAPP](https://iapp.org/news/a/irelands-meta-decisions-raise-complex-fundamental-questions) — The EDPB may issue binding decisions under Article 65 GDPR that direct a lead supervisory authority to alter proposed measures, including materially increasing proposed fines, as occurred in the Meta Ireland Facebook/Instagram inquiries where the EDPB directed the fine be raised from a proposed maximum of €59 million to €390 million. - [CNIL](https://www.cnil.fr/sites/cnil/files/2025-01/guide_tia.pdf) — Regulation (EU) 2016/679 (GDPR) repealed and replaced Directive 95/46/EC as the EU's general data protection framework. - [https://eur-lex.europa.eu/eli/reg/2025/2518/oj](https://eur-lex.europa.eu/eli/reg/2025/2518/oj) — Regulation (EU) 2025/2518, laying down additional procedural rules for GDPR cross-border enforcement (harmonising complaint admissibility, lead/concerned-authority cooperation and party rights), was adopted on 26 November 2025, published in the Official Journal on 12 December 2025, and applies from 2 April 2027. - [CNIL](https://www.cnil.fr/sites/cnil/files/2025-01/guide_tia.pdf) — GDPR Article 2 material scope covers processing of personal data by automated means and manual processing forming part of a filing system, as reflected in EDPB and CNIL guidance defining personal data broadly (any information relating to an identified or identifiable natural person). - [IAPP](https://iapp.org/news/a/european-commission-adopts-eu-u-s-adequacy-decision) — Since 25 May 2018, GDPR applies to processing in the context of an EU/EEA establishment's activities and to processing by non-established controllers/processors targeting EEA data subjects through the offering of goods or services or the monitoring of their behaviour within the Union. - [EDPB](https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_20240417_report_extraterritorial_enforcement_gdpr_en.pdf) — An EDPB report on extraterritorial enforcement notes that any exercise of a DPA's investigative powers outside EU/EEA territory requires the consent of the foreign state, limiting practical extraterritorial reach notwithstanding Article 3's broad scope. - [CNIL](https://www.cnil.fr/sites/cnil/files/2025-01/guide_tia.pdf) — The GDPR is generally understood to have abolished the ex-ante notification/registration regime that existed under Directive 95/46/EC, substituting an accountability-based compliance model (Article 5(2), Article 24). - [Legiscope](https://www.legiscope.com/blog/european-data-protection-board-edpb.html) — European Data Protection Board comprises: The EDPB's membership consists of the head of each national supervisory authority, one per EU Member State plus Iceland, Liechtenstein and Norway. - [https://eur-lex.europa.eu/eli/reg/2025/2518/oj](https://eur-lex.europa.eu/eli/reg/2025/2518/oj) — Regulation (EU) 2025/2518 extends deadline: Reforms GDPR cross-border enforcement procedure (complaint admissibility, lead/concerned-authority cooperation, party rights); adopted 26 Nov 2025, published in the OJ 12 Dec 2025, applying from 2 Apr 2027. - [ppc.land (explainer, corroborating official EFTA dates)](https://ppc.land/eea/) — GDPR (Regulation (EU) 2016/679) — Incorporated into the EEA Agreement by EEA Joint Committee Decision No 154/2018 of 6 July 2018, entering into force in Iceland, Liechtenstein and Norway on 20 July 2018. - [EFTA EEA-Lex factsheet (AI Act)](https://www.efta.int/eea-lex/32024r1689) — AI Act, DSA, Data Act — None has been incorporated into the EEA Agreement for Iceland, Liechtenstein and Norway as of this cycle; each is listed by EFTA as under scrutiny with a draft Joint Committee Decision pending. - [Quasa](https://quasa.io/stories/eu-digital-omnibus-stalls-again-current-gdpr-rules-still-apply) — Digital Omnibus Regulation (2025/0360 COD) — Coreper failed to adopt a Council negotiating mandate on 7 October 2026 and again on 11 October 2026, principally over Data Act trade-secret provisions - [ppc.land (explainer, corroborating official EFTA dates)](https://ppc.land/eea/) — The EDPB's membership consists of the head of each national supervisory authority, one per EU Member State plus Iceland, Liechtenstein and Norway. - [ppc.land (explainer, corroborating official EFTA dates)](https://ppc.land/eea/) — European Data Protection Board — The EDPB's membership consists of the head of each national supervisory authority, one per EU Member State plus Iceland, Liechtenstein and Norway. - [EFTA EEA-Lex factsheet (AI Act)](https://www.efta.int/eea-lex/32024r1689) — Regulation (EU) 2025/2518 — Reforms GDPR cross-border enforcement procedure (complaint admissibility, lead/concerned-authority cooperation, party rights); adopted 26 Nov 2025, published in the OJ 12 Dec 2025, applying from 2 Apr 2027. - [Legal247](https://legal247.no/en/insights/digital-omnibus-gdpr/) — Digital Omnibus proposal COM(2025) 837 — On 21 October 2026 Coreper agreed the Council's negotiating mandate on the Commission's Digital Omnibus proposal, which would amend GDPR Art 4(1) (personal data definition), Art 83(2) (fines methodology interplay) and related provisions; the mandate keeps the current personal-data definition, permits AI training on the legitimate-interest basis, and supports a 4-month (reduced from 6-month) breach-notification re-request deadline. ### European Economic Area (Bloc): D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation. Primary framework GDPR Articles 4-11 (Regulation (EU) 2016/679); proposed amendments under the Digital Omnibus (COM(2025) 836 final) Supervisory authority [EDPB / national DPAs (e.g. Irish DPC for Meta ad-targeting cases)](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Core provisions are stable and enforced, but the Digital Omnibus proposal (still in trilogue as of mid-2026) creates near-term uncertainty over consent-signal mechanics and the sensitive-data/AI derogation. D2 · Lawful Processing — Full Module Record 4 sub-modules · 314 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope. Primary framework GDPR Articles 12-23 (Regulation (EU) 2016/679) Supervisory authority [EDPB (coordinating 25 national DPAs in the 2026 CEF transparency action)](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Rights are robustly enforced and subject to active coordinated supervisory scrutiny, but a pending legislative change (abuse-of-access-rights clarification) could alter practical scope. #### Sub-modules (5) Chapter III (Arts. 12–23) GDPR guarantees transparent information (Arts. 13–14), right of access and a free first copy of personal data undergoing processing (Art. 15; CJEU Case C-487/21 Österreichische Datenschutzbehörde and Case C-307/22 FT v DW confirming the right to a free initial copy of medical records even when requested for non-data-protection litigation), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction (Art. 18), data portability (Art. 20, reinforced from 12 September 2025 by real-time IoT/connected-product data switching rights under the EU Data Act Regulation (EU) 2023/2854), objection (Art. 21, unconditional for direct marketing), and rights against solely automated decision-making (Art. 22). In Case C-203/22 Dun & Bradstreet Austria (27 February 2025), the CJEU held that under Art. 15(1)(h) GDPR a controller conducting automated credit scoring must explain the actual procedure and principles applied to the data subject's profile so the individual can verify accuracy and consistency, and cannot rely on a blanket 'trade secrets' refusal (instead disclosing contested algorithms to the DPA or court for case-by-case balancing). Response deadlines under Art. 12(3) are one calendar month from receipt, extendable by two further months for complex or numerous requests upon notice within the first month. Under the Digital Omnibus Proposal COM(2025) 837 final (legislative proposal, not yet in force), the Commission has proposed clarifying Art. 12(5) so that abusive DSARs pursued solely for non-data-protection purposes (such as pre-trial discovery abuse) may be treated as manifestly unfounded or excessive, though the EDPB–EDPS Joint Opinion 2/2026 (10 February 2026) opposed restricting access rights on motive grounds. Sources and claims (5) - [EDPB](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf) — The CJEU has confirmed (Case C-307/22) that data subjects may legitimately exercise the Article 15 right of access for objectives other than becoming aware of processing or verifying its lawfulness, without needing to provide particular motivation. - [https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal-regulation_en](https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-22026-proposal-regulation_en) — The Digital Omnibus proposes to give controllers legal clarity for cases of abuse of rights by data subjects, but the EDPB and EDPS consider that exercising the access right for purposes other than data protection should not itself be treated as an element defining abuse. - [EDPB](https://www.edpb.europa.eu/news/cef-2026-edpb-launches-coordinated-enforcement-action-on-transparency-and-information_en) — The EDPB ran a year-long 2025 Coordinated Enforcement Framework action on the Article 17 right to erasure/right to be forgotten, adopting a report on the action's findings in 2026. - [EDPB](https://www.edpb.europa.eu/system/files/2025-01/edpb_guidelines_202501_pseudonymisation_en.pdf) — The right to data portability under Article 20 GDPR continues to be interpreted per the WP29 Guidelines on the right to data portability, as endorsed by the EDPB. - [EDPB](https://www.edpb.europa.eu/news/cef-2026-edpb-launches-coordinated-enforcement-action-on-transparency-and-information_en) — During 2026, 25 DPAs across Europe are participating in the EDPB's Coordinated Enforcement Framework action assessing controller compliance with Article 12-14 transparency and information obligations that condition the effective exercise of data subject rights. ### European Economic Area (Bloc): D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted. Primary framework GDPR Articles 24-39 (Regulation (EU) 2016/679); Digital Omnibus (COM(2025) 836 final) Supervisory authority [National DPAs (e.g. CNIL for the IQVIA health-data fine); EDPB coordination](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Baseline obligations are stable and well-enforced, but simplification proposals (still in trilogue) will materially change SME/SMC recordkeeping and breach-notification thresholds once adopted. D4 · Controller & Processor — Full Module Record 7 sub-modules · 262 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025). Primary framework GDPR Chapter V, Articles 44-50 (Regulation (EU) 2016/679) Supervisory authority [European Commission (adequacy decisions) with EDPB opinion role; national DPAs for SCC/BCR approval](https://www.edpb.europa.eu/our-work-tools/our-documents/topic/adequacy-decision_en) Traffic-light rationale — Amber Comprehensive Chapter V transfer architecture with 17 active European Commission adequacy decisions (including UK adequacy renewed on 19 December 2025 until 27 December 2031, European Patent Organisation adequacy in July 2025, and Brazil adequacy adopted 27 January 2026) and the EU–US Data Privacy Framework upheld by the General Court in Case T-553/23 Latombe v Commission (3 September 2025), balanced against active DPC/EDPB transfer enforcement (TikTok €530m fine, May 2025; Case T-354/22 Bindl v Commission, Jan 2025). D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 309 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps. Primary framework GDPR (Regulation (EU) 2016/679) with sector-specific overlays (ePrivacy Directive 2002/58/EC) Supervisory authority [National DPAs (e.g. CNIL for health-data enforcement)](https://www.cnil.fr/en/investigation-powers-cnil/sanctions-issued-cnil) Traffic-light rationale — Amber Health and telecoms/eprivacy overlays are actively evidenced; other sectoral overlays (financial, employment, education, insurance) lack direct 2026 sourcing in this pass and are flagged as gaps. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 241 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Cookie-consent fatigue is a recognised, unresolved policy problem; the principal legislative fix (Art. 88b) is currently stalled in the Council, leaving practical mechanics unsettled. Primary framework ePrivacy Directive 2002/58/EC read with GDPR consent standards (Regulation (EU) 2016/679) Supervisory authority [National DPAs (oversight of Art. 88b-type mechanisms proposed to be entrusted to DPAs)](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Cookie-consent fatigue is a recognised, unresolved policy problem; the principal legislative fix (Art. 88b) is currently stalled in the Council, leaving practical mechanics unsettled. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 247 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Article 22 is settled law with recent CJEU interpretation, but the practical GDPR/AI Act interface remains in active development pending joint EDPB-Commission guidelines and AI Act simplification. Primary framework GDPR Article 22 (Regulation (EU) 2016/679); interplay with Regulation (EU) 2024/1689 (AI Act) Supervisory authority [EDPB (joint guideline development with European Commission)](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Article 22 is settled law with recent CJEU interpretation, but the practical GDPR/AI Act interface remains in active development pending joint EDPB-Commission guidelines and AI Act simplification. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 288 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Core Article 8 mechanism is well-established law, but dedicated children's-data guidelines remain in development and several sub-areas (age verification specifics, education settings, dependent adults) lack direct 2026 sourcing in this pass. Primary framework GDPR Article 8 (Regulation (EU) 2016/679) Supervisory authority [EDPB (developing dedicated Guidelines on children's data)](https://www.edpb.europa.eu/) Traffic-light rationale — Amber Core Article 8 mechanism is well-established law, but dedicated children's-data guidelines remain in development and several sub-areas (age verification specifics, education settings, dependent adults) lack direct 2026 sourcing in this pass. D9 · Children's Privacy — Full Module Record 5 sub-modules · 198 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### European Economic Area (Bloc): D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Confirmed▾ Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application). Primary framework GDPR Articles 77-84, 58, 83 (Regulation (EU) 2016/679); Regulation (EU) 2025/2518; Directive (EU) 2020/1828 Supervisory authority [National DPAs with EDPB Article 65 binding-decision oversight (e.g. Irish DPC, CNIL, Czech SA)](https://www.edpb.europa.eu/) Traffic-light rationale — Green Enforcement powers are broad, actively used at scale (billion-euro-class fines), collective redress mechanisms are in force, and a further procedural-harmonisation regulation is already adopted (pending 2027 application). D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 334 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties