Data Protection Monitor
Global Privacy & Data Protection Intelligence

Liechtenstein Data Protection & Privacy Regulation

LI schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence

Last updated · 10 categories · 64 claims · 27 sources in the cumulative register

Liechtenstein's Datenschutzstelle (DSS) is participating this cycle as one of 32 European supervisory authorities in the European Data Protection Board's 2025 Coordinated Enforcement Framework examining the practical implementation of the right to erasure under Article 17 GDPR.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Data Subject Rights, Controller/Processor Duties, Sectoral Watch, AdTech & Commercial Privacy (4 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityDatenschutzstelle (DSS) / Data Protection Authority, Principality of LiechtensteinPrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Law made at European Economic Area (Bloc) level that applies in Liechtenstein is covered once, on the European Economic Area (Bloc) page. This page covers Liechtenstein’s own layer: implementation, national authorities, national options and local enforcement.

Jurisdiction lead brief

Latest update · 25 October 2026

Lead Signal

The Liechtenstein government has confirmed that the cyberattack on the Register of Beneficial Owners (VwbP), which occurred on 29 and 30 July 2026, constitutes a personal data breach within the meaning of Article 33 GDPR, triggering notification obligations. The breach affected copies of beneficial-ownership data tied to approximately 31,000 legal entities. Since 4 August 2026, the government has been discharging its Article 34 obligation to inform affected data subjects by sending letters to the legal entities concerned, asking them in turn to inform their own beneficial owners that their personal data was compromised. This is a government-run controller response to one of the larger data-breach events to touch Liechtenstein's public registers, and it remains ongoing: as at 5 October 2026, external access to the VwbP itself had resumed only in a restricted form, via in-person identification at the Giessen Service Centre in Vaduz with reduced technical functions.

Key regulatory facts for Liechtenstein
Regulatory DimensionLiechtenstein Standing Position
JurisdictionLiechtenstein (LI)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 64 sourced findings)
Regulator & FrameworkFull GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified.
Lawful Processing & Special DataFull GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults).
Data Subject RightsRights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation.
Controller/Processor DutiesComprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel.
Primary Instruments CitedDatenschutzstelle / EDPB, EDPB, DataGuidance, Liechtenstein Official Instrument (dataprotection.gi liechtenstein), Liechtenstein Official Instrument (globallawexperts.com data-protection-crypto-liechtens)
Last Confirmed / Updated2026-10-25 (27 sources in cumulative register)

#

Full GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified.

Primary frameworkGDPR (EU) 2016/679 as incorporated into the EEA Agreement, implemented via the Liechtenstein Data Protection Act (DSG) of 4 October 2018 and Data Protection Ordinance (DSV) of 11 December 2018
Supervisory authorityDatenschutzstelle (DSS) / Data Protection Authority, Principality of Liechtenstein
Traffic-light rationale — GreenFull GDPR incorporation with a closely-aligned national implementing act and an active, EDPB-integrated supervisory authority; no material derogations identified.

Sub-modules (5)

Regulator And AuthorityGreen

The DSS (Kirchstrasse 8, Vaduz) is the sole national supervisory authority, headed by Dr Marie-Louise Gächter, and is a full member of the EDPB with regard to GDPR matters (without voting rights).

Claims (5):

  • The Datenschutzstelle (DSS), based in Vaduz, is Liechtenstein's national data protection supervisory authority responsible for GDPR enforcement.
  • The supervisory authorities of the EFTA EEA States, including Liechtenstein, Iceland and Norway, are EDPB members with regard to GDPR-related matters, without voting rights.
  • The Datenschutzstelle (DSS) is Liechtenstein's national GDPR supervisory authority.
  • Datenschutzstelle (DSS) — Liechtenstein's national data protection supervisory authority, based in Vaduz
  • Datenschutzstelle (DSS) — The DSS, resident in Vaduz, is the national Data Protection Authority for Liechtenstein and enforces GDPR

Act And InstrumentsGreen

GDPR applies directly via EEA incorporation; the DSG and DSV are the domestic implementing instruments.

Claims (5):

  • Liechtenstein implemented the GDPR through the Data Protection Act of 4 October 2018 (DSG) and the Data Protection Ordinance of 11 December 2018 (DSV), both effective 9 January 2019.
  • The EEA Joint Committee adopted Decision No. 154/2018 incorporating the GDPR into the EEA Agreement, making the GDPR directly applicable in Liechtenstein.
  • GDPR applies in Liechtenstein via EEA incorporation and the DSG.
  • Datenschutzgesetz (DSG) — GDPR applies in Liechtenstein via EEA incorporation, enforced domestically through the DSG
  • GDPR / DSG / DSV — GDPR became directly applicable in Liechtenstein via EEA Joint Committee Decision No. 154/2018; DSG (4 Oct 2018) and DSV (11 Dec 2018) implement it nationally, closely aligned with Germany's BDSG

Material ScopeGreen

The DSG tracks GDPR material scope with no major derogations, covering legal bases, data subject rights, and transfer rules.

Claims (1):

  • The DSG does not contain major derogations from the GDPR and details legal bases for processing, data subject rights, and requirements for data transfers, and is closely aligned with the German BDSG.

Territorial ScopeGreen

GDPR Article 3 territorial scope applies as incorporated into the EEA Agreement; no LI-specific narrowing was identified in the sources reviewed.

Regulator Registration And FilingAmber

Consistent with the GDPR model, Liechtenstein does not operate a general prior-registration/notification regime for controllers; accountability is discharged through internal records (ROPA) rather than filings with the DSS.

Claims (1):

  • Liechtenstein's GDPR-aligned regime relies on internal accountability documentation (e.g., records of processing) rather than a general prior-notification/registration duty to the DSS.
Category narrative 79 words

Liechtenstein is an EEA-EFTA state that has incorporated the GDPR directly via EEA Joint Committee Decision No. 154/2018, giving the Regulation direct legal effect. The domestic implementing framework is the Data Protection Act (Datenschutzgesetz, DSG) of 4 October 2018 and the Data Protection Ordinance (DSV) of 11 December 2018, both effective 9 January 2019, closely modelled on Germany's BDSG. The Datenschutzstelle (DSS) is the national supervisory authority, an EDPB member (non-voting, as an EFTA-EEA state alongside Iceland and Norway).

Sources and claims (12)
  1. Confirmed Datenschutzstelle / EDPB — The Datenschutzstelle (DSS), based in Vaduz, is Liechtenstein's national data protection supervisory authority responsible for GDPR enforcement. observed
  2. Confirmed EDPB — The supervisory authorities of the EFTA EEA States, including Liechtenstein, Iceland and Norway, are EDPB members with regard to GDPR-related matters, without voting rights. observed
  3. Confirmed DataGuidance — Liechtenstein implemented the GDPR through the Data Protection Act of 4 October 2018 (DSG) and the Data Protection Ordinance of 11 December 2018 (DSV), both effective 9 January 2019. observed
  4. Confirmed DataGuidance — The EEA Joint Committee adopted Decision No. 154/2018 incorporating the GDPR into the EEA Agreement, making the GDPR directly applicable in Liechtenstein. observed
  5. Confirmed DataGuidance — The DSG does not contain major derogations from the GDPR and details legal bases for processing, data subject rights, and requirements for data transfers, and is closely aligned with the German BDSG. observed
  6. Probable DataGuidance — Liechtenstein's GDPR-aligned regime relies on internal accountability documentation (e.g., records of processing) rather than a general prior-notification/registration duty to the DSS. observed
  7. Probable https://dataprotection.gi/jurisdictions/liechtenstein/ — The Datenschutzstelle (DSS) is Liechtenstein's national GDPR supervisory authority.
  8. Probable https://globallawexperts.com/data-protection-crypto-liechtenstein/ — GDPR applies in Liechtenstein via EEA incorporation and the DSG.
  9. Confirmed Datenschutzstelle Liechtenstein — Datenschutzstelle (DSS) — Liechtenstein's national data protection supervisory authority, based in Vaduz observed
  10. Probable Global Law Experts — Datenschutzgesetz (DSG) — GDPR applies in Liechtenstein via EEA incorporation, enforced domestically through the DSG observed
  11. Probable GDPRhub - Datenschutzstelle (Liechtenstein) — Datenschutzstelle (DSS) — The DSS, resident in Vaduz, is the national Data Protection Authority for Liechtenstein and enforces GDPR observed
  12. Confirmed Datenschutzgesetz (DSG) - official English translation — GDPR / DSG / DSV — GDPR became directly applicable in Liechtenstein via EEA Joint Committee Decision No. 154/2018; DSG (4 Oct 2018) and DSV (11 Dec 2018) implement it nationally, closely aligned with Germany's BDSG observed

#

Full GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults).

Primary frameworkGDPR Articles 6, 7, 9 as incorporated via EEA Agreement; DSG
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — GreenFull GDPR-aligned lawful-basis and special-category regime; DSS has issued specific guidance filling practical gaps (e.g., incapacitated adults).
D2 · Lawful Processing — Full Module Record4 sub-modules · 34 words · 5 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Rights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation.

Primary frameworkGDPR Articles 12-23 as incorporated via EEA Agreement; DSG
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — GreenRights regime is fully GDPR-aligned with active DSS interpretive guidance; standard one-month response deadlines apply via direct GDPR incorporation.

Sub-modules (5)

Access RightGreen

DSS has issued guidance on employee email access requests and general subject-access mechanics.

Claims (1):

  • The DSS has provided guidance on employee email access requests.

Rectification And ErasureGreen

DSS guidance clarifies GDPR obligations for data deletion and erasure, including storage-limitation recommendations.

Claims (2):

  • DSS guidance clarifies GDPR obligations for data deletion and erasure, emphasizing conditions and storage recommendations.
  • Datenschutzstelle (DSS) — EDPB 2025 Coordinated Enforcement Framework action on the right to erasure (Art. 17 GDPR); implementation report adopted 18 February 2026

Restriction And ObjectionGreen

DSS has addressed the right to object in the context of Google Street View image collection, and issued a newsletter on court rulings concerning abusive exercise of data subject rights.

Claims (2):

  • DSS has discussed Google's Street View image collection and individuals' rights to object under GDPR.
  • DSS newsletter highlighted court rulings on abusive exercise of data subject rights under GDPR.

Data PortabilityAmber

No LI-specific portability guidance beyond the direct GDPR Article 20 baseline was identified.

Deadlines And Response WindowsGreen

The standard one-month (extendable to three months for complex requests) GDPR response deadline applies directly via EEA incorporation; no LI-specific shortening or lengthening was identified.

Category narrative 42 words

Data subject rights (access, rectification, erasure, restriction, objection, portability) follow GDPR Articles 15-22 directly, with the DSS issuing practical guidance on access requests, erasure/deletion, and objection rights (e.g., regarding Google Street View), plus newsletter commentary on abusive exercise of data subject rights.

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (5)
  1. Confirmed DataGuidance — The DSS has provided guidance on employee email access requests. observed
  2. Confirmed DataGuidance — DSS guidance clarifies GDPR obligations for data deletion and erasure, emphasizing conditions and storage recommendations. observed
  3. Confirmed DataGuidance — DSS has discussed Google's Street View image collection and individuals' rights to object under GDPR. observed
  4. Probable DataGuidance — DSS newsletter highlighted court rulings on abusive exercise of data subject rights under GDPR. observed
  5. Probable European Data Protection Board — Datenschutzstelle (DSS) — EDPB 2025 Coordinated Enforcement Framework action on the right to erasure (Art. 17 GDPR); implementation report adopted 18 February 2026 observed

#

Comprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel.

Primary frameworkGDPR Articles 24-39 as incorporated via EEA Agreement; DSG/DSV
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — GreenComprehensive GDPR-aligned controller/processor duties with an active, EDPB-coordinated DPIA guidance framework and functioning breach-notification channel.
D4 · Controller & Processor — Full Module Record7 sub-modules · 56 words · 8 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Full GDPR Chapter V transfer regime applies via EEA incorporation, with active DSS transfer guidance and enforcement notices, plus recognition as a qualifying state under the EU-U.S. DPF.

Primary frameworkGDPR Articles 44-49 as incorporated via EEA Agreement
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — GreenFull GDPR Chapter V transfer regime applies via EEA incorporation, with active DSS transfer guidance and enforcement notices, plus recognition as a qualifying state under the EU-U.S. DPF.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 92 words · 9 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Financial, health, telecoms/cookie and employment overlays are evidenced via DSS guidance/reports; credit-scoring, education, and insurance sub-modules lack dedicated LI sources.

Primary frameworkGDPR as incorporated via EEA Agreement, overlaid with sector-specific Liechtenstein financial-market and other sectoral rules
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — AmberFinancial, health, telecoms/cookie and employment overlays are evidenced via DSS guidance/reports; credit-scoring, education, and insurance sub-modules lack dedicated LI sources.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 50 words · 5 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Cookie/tracker consent is actively covered by DSS guidance; several other sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising, direct marketing specifics) lack dedicated LI sources and rely on the GDPR/ePrivacy baseline.

Primary frameworkGDPR + EU ePrivacy Directive as applied in Liechtenstein via EEA incorporation
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — AmberCookie/tracker consent is actively covered by DSS guidance; several other sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising, direct marketing specifics) lack dedicated LI sources and rely on the GDPR/ePrivacy baseline.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 47 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Profiling/ADM and AI-risk sub-modules are well evidenced via active DSS guidance; biometric, genetic-data, and state-surveillance sub-modules rely more heavily on the general GDPR baseline.

Primary frameworkGDPR Article 22 and Articles 9-10 as incorporated via EEA Agreement
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — AmberProfiling/ADM and AI-risk sub-modules are well evidenced via active DSS guidance; biometric, genetic-data, and state-surveillance sub-modules rely more heavily on the general GDPR baseline.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 57 words · 6 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Age-verification, minor-profiling and dependent-adult sub-modules are evidenced via active DSS guidance; parental-consent-age specifics and education-settings rules rely on the unlocalised GDPR Article 8 baseline.

Primary frameworkGDPR Article 8 as incorporated via EEA Agreement; DSG
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — AmberAge-verification, minor-profiling and dependent-adult sub-modules are evidenced via active DSS guidance; parental-consent-age specifics and education-settings rules rely on the unlocalised GDPR Article 8 baseline.
D9 · Children's Privacy — Full Module Record5 sub-modules · 51 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Enforcement powers and recent developments are well evidenced; specific collective-redress/private-right-of-action mechanics and regulator funding/headcount data for Liechtenstein were not separately sourced.

Primary frameworkGDPR Articles 58, 77-84 as incorporated via EEA Agreement; DSG
Supervisory authorityDatenschutzstelle (DSS)
Traffic-light rationale — AmberEnforcement powers and recent developments are well evidenced; specific collective-redress/private-right-of-action mechanics and regulator funding/headcount data for Liechtenstein were not separately sourced.
Periodic update · new data 2026-10-25

Enforcement & Redress

The dominant enforcement-and-redress development for Liechtenstein is not a Datenschutzstelle fine or formal decision against a private controller, but the government's own compliance response, as controller, to the VwbP cyberattack. No DSS fine or formal enforcement decision against a private party was identified. Instead, the activity of note is the government discharging its own Article 33 and Article 34 obligations following its classification of the VwbP cyberattack as a personal data breach, with notification to affected legal entities ongoing since 4 August 2026 regarding beneficial owners of approximately 31,000 legal entities whose data was compromised.

This is a notable framing point: in a cycle where the single largest and most consequential data-protection event concerns a government-run register, the relevant redress and accountability mechanism in play is the government's own self-reporting and notification conduct as controller, rather than supervisory enforcement directed at it or at a third party. The Datenschutzstelle's breach notification procedure requires reporting without delay and, where possible, within 72 hours of the controller becoming aware of the breach, administered through the DSS's own online notification form; whether the government's own notification to the DSS met this standard was not confirmed.

Outlook

Whether the Datenschutzstelle takes any further formal supervisory step in response to the VwbP breach, beyond the government's own notification and remediation activity, is not yet known. The absence of any announced DSS decision or fine as should be read as the current state of the record rather than as an indication that no further action is possible.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 102 words · 11 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 64 claim(s) (66 category placement(s)), 27 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: upheld (8 confirmed against the cited source; 4 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer impact assessment
Art. 49Cross-Border & Adequacytransfer impact assessment
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties