EdLaw
General Data Protection Regulation (Regulation (EU) 2016/679)
The EU's data protection regulation, applicable since 25 May 2018 (Article 99 of the consolidated text). It applies to controllers/processors established in the EU and, extraterritorially, to those offering goods or services to (or monitoring) data subjects in the EU (Article 3). Enforced by national supervisory authorities, coordinated by the European Data Protection Board (EDPB).
This folder reproduces the EdTech-critical articles verbatim; the UK GDPR sibling carries the fuller retained-and-amended UK text. The two instruments share ancestry but have diverged materially since the UK's amendments:
| Topic | EU GDPR (this folder) | UK GDPR |
|---|---|---|
| Child's consent age (ISS) | 16 by default; Member States may lower to not below 13 (Art. 8) | Fixed at 13 (Art. 8) |
| Automated decision-making | Art. 22 in force | Art. 22 repealed; regime is Arts. 22A–22D (DATA-SUBJECT-RIGHTS.md) |
| Fine ceilings | EUR 10m/2% and EUR 20m/4% (Art. 83) | £8.7m/2% and £17.5m/4% (ENFORCEMENT.md) |
| International transfers | Arts. 44–49, adequacy decisions by the Commission (INTERNATIONAL-TRANSFERS.md) | Restructured as Arts. 44A–49A, transfers approved by Secretary of State regulations (INTERNATIONAL-TRANSFERS.md) |
| Regulator | National supervisory authorities + EDPB | The Information Commissioner |
Applicability to EdTech
Relevant wherever an EdTech service is offered to schools or users in the EU: the higher default consent age for children, the still-in-force Article 22 automated-decision regime, and the EU transfer rules (including the EU–UK relationship, which rests on an EU adequacy decision for the UK) all surface in EU customer RFIs.
Contents
| Document | Covers |
|---|---|
| PRINCIPLES.md | Art. 5 — processing principles |
| LAWFUL-BASES.md | Arts. 6, 7, 9 — lawfulness, consent, special categories |
| CHILDREN.md | Art. 8 — child's consent (16 default / 13 floor) |
| AUTOMATED-DECISIONS.md | Art. 22 — automated individual decision-making |
| DATA-SUBJECT-RIGHTS.md | Arts. 12–21, 23 — transparency, information, access, rectification, erasure, restriction, portability, objection; restrictions |
| CONTROLLER-PROCESSOR.md | Arts. 24–31, 37–39 — controller responsibility, data protection by design and by default, joint controllers, representatives, processor contracts, processing under authority, records, cooperation, data protection officers |
| SECURITY-AND-BREACH.md | Arts. 32–34 — security, breach notification |
| DPIA.md | Arts. 35–36 — data protection impact assessment, prior consultation |
| CODES-AND-CERTIFICATION.md | Arts. 40–43 — codes of conduct, monitoring, certification, certification bodies |
| INTERNATIONAL-TRANSFERS.md | Arts. 44–46, 49 — transfers |
| ENFORCEMENT.md | Art. 83 — administrative fines |
Scope note: remaining articles (Chapter VI supervisory authorities, Chapter VII cooperation and consistency, remedies 77–82, and others) can be added with the same tooling when needed. A Cellar query on 2026-10-06 found no act amending Regulation (EU) 2016/679 and no consolidation later than 02016R0679-20160504.
Licence
The corpus reproduces the EUR-Lex consolidated text of Regulation (EU) 2016/679 (CELEX 02016R0679-20160504).
The EUR-Lex legal notice (eur-lex.europa.eu/content/legal-notice/legal-notice.html, read 2026-10-01 in the Internet Archive copy captured that day, because EUR-Lex refuses non-browser clients) says: "© European Union, 1998-2026 The Commission’s document reuse policy is based on Decision 2011/833/EU. Unless otherwise specified, you can re-use the legal documents published in EUR-Lex for commercial or non-commercial purposes." For consolidated texts it adds: "The copyright for the editorial content of this website, the summaries of EU legislation and the consolidated texts, which is owned by the EU, is licensed under the Creative Commons Attribution 4.0 International licence. This means that you can re-use the content provided you acknowledge the source and indicate any changes you have made."
Commission Decision 2011/833/EU on the reuse of Commission documents (OJ L 330, 14.12.2011, p. 39, read in the Publications Office Cellar copy on 2026-10-01) provides in Article 4 that "All documents shall be available for reuse: (a) for commercial or non-commercial purposes under the conditions laid down in Article 6", and Article 6(2) lists the conditions that may be attached: "(a) the obligation for the reuser to acknowledge the source of the documents; (b) the obligation not to distort the original meaning or message of the documents; (c) the non-liability of the Commission for any consequence stemming from the reuse."
Conditions, and how this corpus meets them:
- Acknowledge the source: each extracted provision carries a
{.meta}provenance line naming EUR-Lex and the CELEX number, and Sources links the EUR-Lex text. - Indicate changes (CC BY 4.0, for the consolidated text): the provision text is unchanged; the changes are the selection of provisions, the Markdown layout and the added anchors, all described in Meta.
- Do not distort the meaning: the text is reproduced verbatim and checked mechanically against the source (see Meta).
- No endorsement or liability: the corpus does not claim that the EU or the Publications Office endorses it, and only the Official Journal text is authentic.
The EDPB guidelines linked from each document are cited, not reproduced.
Related
- UK GDPR — the UK's retained and amended descendant of this Regulation
- DPA 2018 — the UK companion statute
- EU AI Act — applies without prejudice to this Regulation (AI Act Art. 2(7)); AI systems processing personal data engage both