Data protection explained (2025)

Home
About us
Learn more about the role of the European Commission, its leadership and corporate policies
Discover more
- The President
  College of Commissioners
  Departments and executive agencies
  Staff
  See all
- In strategy and policy
  In law
  In budget and funding
  In international relations
  See all
- Transparency
  Ethics and Good Administration
  People first – Modernising the European Commission
  The Commission’s use of languages
  See all
- Contact
- Our priorities
  Learn how the EU is building a sustainable, digital, and inclusive future through its seven key priorities.
  Discover more
  Competitiveness
  Security and defence
  European social fairness
  Quality of life
  Democracy and our values
  A global Europe
  EU budget and reform
- News and media
  Stay up to date with the European Commission's news. Discover the latest updates, stories, multimedia and other valuable material
  Discover more
  News
  Press corner
  Visual stories
  Audiovisual portal
  Publications
  Statistics
  Learning corner
  Eurobarometer
  EU law
  See all
  Topics from A to Z
  Discover EU policies designed to bring benefits to citizens, businesses and other stakeholders in the EU
  Discover more
  Human rights in non-EU countries
  Your fundamental rights in the EU
  Recipients and results of EU aid
  How we provide aid
  Ensuring aid effectiveness
  See all
  Doing business in the EU
  Financial services
  Economic recovery
  Economic forecasts and surveillance
  The European Semester
  Economic and Monetary Union
  The euro area
  The benefits of the euro
  See all
  Skills and qualifications
  Study or teach abroad
  Teaching methods and materials
  Policy on educational issues
  Set up projects for education and training
  See all
  Overall targets and reporting
  Implementation in EU countries
  International cooperation
  Standards, tools and labels
  See all
  Financial support for projects
  Projects and results
  Countries, regions, cities
  Cooperation between border regions
  See all
  Food safety and quality
  Farming
  Oceans and fisheries
  Forestry
  Sustainable agriculture
  Agricultural trade
  Plants and plant products
  Animals and animal products
  See all
  Law-making process
  Track law-making
  Search law
  Law by topic
  Application of EU law
  Cross-border cases
  Judicial training and professional networks
  Find a legal professional
  See all
  Living in another EU country
  Consumer rights and complaints
  Culture, Heritage, Sport in the EU
  Working in another EU country
  Employment opportunities
  Travelling in the EU
  Travelling for non-EU nationals
  Emigrating to the EU
  See all
  Strategy on research and innovation
  Law and regulations
  Knowledge: publications, tools and data
  Funding
  Projects
  Partners, networking
  Research by area
  See all
  Get involved
  Share your views on EU laws and policies, debate Europe's future and find funding for your EU projects.
  Discover more
  Have your say
  European Citizens’ Panels
  European Citizens' Initiative
  Petition the EU
  See all
  Job opportunities at the Commission
  Working for the EU civil service
  Traineeships
  Volunteering
  See all
  Funding and tenders
  Events
  Visitors' Centre
  Experience Europe exhibition centre
  See all
  European Commission on social media
  
  Home
  Law
  Law by topic
  Data protection
  Data protection explained
  Information about personal data, data processing, how personal data is protected, and more.
  
  Page contents
  
  What is personal data?
  Personal data is any information that relates to an identified or identifiable living individual (data subject). Different pieces of information, which together can lead to the identification of a particular person, may also be considered personal data.
  Personal data that has been de-identified, encrypted orpseudonymisedbut can be used to re-identify a person remains personal data and falls within the scope of the General Data Protection Regulation (GDPR), the EU's main data protection law.
  
  Examples of personal data
  a name and surname
  a home address
  an email address such as'name [dot] surnamecompany [dot] com (name[dot]surname[at]company[dot]com)'
  an Internet Protocol (IP) address
  an identification card number
  a cookie ID
  the advertising identifier of your phone
  data held by a hospital or doctor, which could be a symbol that uniquely identifies a person
  
  Personal data that has been renderedanonymousin such a way that the individual is no longer identifiable is not considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.
  
  Examples of data that is not considered personal data
  a company registration number
  an email address such as 'infocompany [dot] com'
  anonymised data, if anonymisation is irreversible
  
  References
  Article 4(1)and (5)^andRecitals (14), (26) to (30)^{of the GDPR}
  Article 29 Working Party Opinion 4/2007 on the concept of personal data
  Article 29 Working Party Opinion 05/2014 on Anonymisation Techniques
  
  What is data processing?
  What constitutes personal data processing?
  Data processing is any operation performed on personal data. It includes thecollection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, disseminationor otherwise making available,alignment or combination, restriction, erasure or destructionof personal data.
  The GDPR protects personal dataregardless of the technology used for processing that data. It is technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example in an alphabetical order). It also does not matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.
  
  Examples of data processing
  staff management and payroll administration
  accessing or consultinga contacts database containing personal data
  shredding documents containing personal data
  posting a photo of a person on a website
  storing IP addresses or MAC addresses
  video recording (CCTV)
  
  References
  Articles 2^,4(2)^and(6)^andRecital (15)^{of the GDPR}
  
  Who processes personal data?
  Personal data processing can be carried out by individuals, or by private or public organisations, such as companies or public authorities. Their responsibilities and liability for specific data processing depend on the role that they play in the processing in question.
  Data controller
  The data controller determines thepurposesfor which and themeansby which personal data is processed.
  Data processor
  The data processor processes personal dataon behalfof the controller,on that controller’s documented instructions.
  
  Example: Data controller and processor
  A brewery has many employees. It signs a contract with a payroll company to pay the wages. The brewery tells the payroll company when the wages should be paid, when an employee leaves or has a pay rise, and provides all other details for the salary slip and payment. The payroll company provides the IT system and stores the employees’ data.
  In this case, the brewery is the data controller and the payroll company is the data processor.
  Read more about the role of the data controller and processor
  
  References
  Articles 4(7)^and(8)^and24, 26 and 28^{of the GDPR}
  EDPB Guidelines 7/2020 on the concepts of controller and processor in the GDPR
  
  When and to whom does EU data protection law apply?
  The GDPR applies to:
  A controller or a processor, such as an individual or a private or public organisation, established in the EU which processes personal dataas part of its activities, regardless of whether the data is processedin the EU; and
  A controller or a processor, such as an individual or a private or public organisation, established outside the EU when it is offering goods/services (paid or for free) to individuals in the EU or monitoring the behaviour of individuals in the EU.
  
  Example of when the GDPR applies
  A small, tertiary education company, operating online with an establishment based outside the EU targets mainly students in Spanish and Portuguese language universities in the EU.
  A company with an establishment in the EU provides travel services to customers based in the Baltic countries and in that context processes personal data of natural persons.
  Example of when the GDPRdoes notapply
  A company, which is a service provider based outside the EU, provides services to customers outside the EU.Its clients can use its services when they travel to other countries, including within the EU. Provided that the company does not specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
  
  If a company is a small and medium-sized enterprise (SME) processing personal data, it must comply with the GDPR. However, some obligations of the GDPR do not apply if the processing is not a core part of the SME’s business, or if its activity is not likely to create risks for individuals.
  Read more about specific rules for SMEs.
  The GDPR does not apply to data processed by an individual for purely personal reasons or for activities carried out in one's home, if there is no connection to a professional or commercial activity. When an individual uses personal data outside the personal sphere, for socio-cultural or financial activities, for example, then the data protection law has to be respected.
  The GDPR does not apply to the processing of personal data of deceased persons.
  
  References
  Articles 2 and 3^andRecitals (13), (18), (22) to (25) and (27)^{of the GDPR}
  
  How is personal data protected?
  Principles of personal data processing
  To ensure the protection of your personal data when it is collected or used, the GDPR sets out 7 key principles that individuals and private or public organisations must comply with when they process personal data.
  
  The principles of personal data processing under the GDPR
  Lawfulness, fairness and transparency
  Purpose limitation
  Data minimisation
  Storage limitation
  Accuracy
  Integrity and confidentiality
  Accountability
  Read more about the principles of the GDPR
  
  Data protection rights
  Under the GDPR, individuals have several rights over their personal data.
  
  The rights of individuals
  Right to be informed
  Right of access
  Right to rectification
  Right to erasure
  Right to restriction of processing
  Right to data portability
  Right to object
  Rights in relation to automated decision-making and profiling
  Read more about the rights of individuals under the GDPR

Data protection explained (2025)

What is personal data?

What is data processing?

What constitutes personal data processing?

Who processes personal data?

Data controller

Data processor

When and to whom does EU data protection law apply?

How is personal data protected?

Principles of personal data processing

Data protection rights