Esheria Regulatory Atlas

Data protection in European Union

Personal data, privacy, cybersecurity duties, processing, and cross-border transfers. Every result links to its stored legal text and available official source evidence.

10,526 matching statutes

• European Union

  REGULATION (EU) 2024/868 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

  32024R0868

  1 provisions

  This regulation amends the Customs Information System rules to align personal data processing with EU data protection rules and adds a 9 October 2025 review requirement for older data.

  In force Open & Chat

• European Union

  COMMISSION IMPLEMENTING DECISION (EU) 2021/1773

  32021D1773

  5 provisions

  The Decision says certain personal data transfers to the UK can proceed without further authorisation when the UK provides an adequate level of protection, subject to a few conditions and exceptions.

  In force Open & Chat

• European Union

  REGULATION (EU) No 603/2013 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

  32013R0603

  3 provisions

  This provision sets up Eurodac and requires Member States to take and send fingerprints and related data for certain applicants within set time limits, while limiting access and transfers.

  Regulation Open & Chat

• European Union

  COMMISSION IMPLEMENTING REGULATION (EU) 2021/1772

  32021D1772

  8 provisions

  The Commission says personal data may be transferred to a third country without further authorisation if it has made an adequacy decision, but this decision does not cover UK immigration-control transfers.

  In force Open & Chat

• European Union

  2. EU-sourced PNR data may also be processed on a case-by-case basis where necessary for the protection of the vital interests of the data subject or other persons, in particular as regards the risk of death or serious injury to the data subjects or others, or a significant public health risk, in particular as required by internationally recognised standards, such as the World Health Organisation’s International Health Regulations (2005).

  32008D0651

  1 provisions

  The agreement lets Australia process EU-sourced PNR data for specified law-enforcement and related purposes, with limits on disclosure, retention, security, and deletion.

  In force Open & Chat

• European Union

  COMMISSION IMPLEMENTING REGULATION (EU) 2025/2215

  32025R2215

  5 provisions

  This Regulation amends the existing Union authorisation for SOPUROXID and replaces the Annex text.

  In force Open & Chat

• European Union

  COMMISSION DECISION (EU) 2020/1502

  32020D1502

  1 provisions

  The Commission must give data subjects information about personal data processing, and it may restrict some data-subject rights in defined cases while recording and reviewing those restrictions.

  In force Open & Chat

• European Union

  DIRECTIVE (EU) 2016/681 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

  32016L0681

  2 provisions

  Air carriers must transfer PNR data to the relevant PIU, and Member States must set up PIUs and impose data-protection safeguards.

  In force Open & Chat

• European Union

  pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

  32023D1795

  10 provisions

  The decision says personal data may be transferred from EU controllers and processors to certified U.S. organisations without further authorisation, but certified organisations must follow the Framework’s rules.

  In force Open & Chat

• European Union

  HAVING REGARD to US statutes and regulations requiring each air carrier operating passenger flights in foreign air transportation to or from the United States to provide DHS with electronic access to PNR data to the extent that they are collected and contained in the air carrier's automated reservation/departure control systems (hereinafter ‘reservation systems’),

  32006D0729

  1 provisions

  This Decision approves signing an EU–US agreement on passenger name record (PNR) data and authorises provisional application. It also allows Member State authorities, in some cases, to suspend data flows to DHS, and requires reporting to the Council and Commission.

  In force Open & Chat

• European Union

  REGULATION (EU) 2024/1358 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

  32024R1358

  6 provisions

  This part explains that Eurodac is established for comparing biometric data, and that Member States must take and transmit biometric data for covered persons, including children from age six, with some data stored in Eurodac within 72 hours after status is granted.

  In force Open & Chat

• European Union

  COMMISSION DECISION (EU) 2020/969

  32020D0969

  1 provisions

  The Decision sets internal Commission rules for the DPO, DPCs, controllers, data-subject information, and when data-subject rights may be restricted.

  In force Open & Chat