European Union
Full entry AI-checked Checked 5 November 2026
| Law | Citation | Status | In force from |
|---|---|---|---|
| General Data Protection Regulation (GDPR) | Regulation (EU) 2016/679 | In force | 24 May 2016 |
| GDPR Procedural Regulation | Regulation (EU) 2025/2518 | In force | 1 January 2026 |
| ePrivacy Directive | Directive 2002/58/EC, as amended by Directive 2009/136/EC | In force | 31 July 2002 |
| Artificial Intelligence Act (AI Act) | Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 | In force | 1 August 2024 |
| Digital Omnibus on AI | Regulation (EU) 2026/1744 | In force | 27 July 2026 |
| Digital Omnibus (proposal) | COM(2025) 837 final, procedure 2025/0360(COD) | Draft, not law | — |
| Medical devices simplification (proposal) | COM(2025) 1023 final, procedure 2025/0404(COD) | Draft, not law | — |
- General Data Protection Regulation (GDPR): Has applied since 25 May 2018. It also applies in Iceland, Liechtenstein and Norway through the EEA Agreement. Member states add their own rules where the GDPR lets them.
- GDPR Procedural Regulation: Applies from 2 April 2027. Sets common procedures for regulators handling cross-border complaints and investigations, such as time limits and the right to be heard.
- ePrivacy Directive: Cookies and similar technologies (Art. 5(3)) and electronic marketing (Art. 13). As a directive, it applies through each member state’s own law. The 2009 amendments, which made cookies need consent, had to be in national law by 25 May 2011.
- Artificial Intelligence Act (AI Act): Applies in stages. Bans and AI literacy from 2 February 2025, general-purpose AI model rules from 2 August 2025, most other rules (including transparency) from 2 August 2026, two more bans and output marking for older generative systems from 2 December 2026, and high-risk rules from 2 December 2027 or 2 August 2028.
- Digital Omnibus on AI: Amends the AI Act. Delays high-risk rules to 2 December 2027 (Annex III uses such as hiring, credit and education) and 2 August 2028 (AI in Annex I products), bans AI that makes non-consensual intimate content or child sexual abuse material from 2 December 2026, and softens the AI literacy duty.
- Digital Omnibus (proposal): Commission proposal of 19 November 2025 to amend the GDPR, the ePrivacy Directive and other data laws. The Council agreed its negotiating position on 21 October 2026, and Parliament’s committees hadn’t voted by 5 November 2026. It isn’t law yet.
- Medical devices simplification (proposal): Commission proposal of 16 December 2025 to simplify the medical devices and in vitro diagnostics regulations. It would also move both to Section B of AI Act Annex I, so the AI Act’s high-risk requirements would no longer apply directly to AI in those devices, and the Commission could set AI rules under the medical devices regulations instead. On 5 November 2026 it was still awaiting a vote in Parliament’s committee. It isn’t law yet.
Regulators
Section titled “Regulators”- European Data Protection Board (EDPB), which issues EU-wide guidance and settles disputes between national authorities
- National data protection authorities, which enforce the GDPR (listed by the EDPB)
- European AI Office (European Commission), which supervises general-purpose AI models under the AI Act
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR covers personal data processed in the context of an EU establishment, wherever the processing happens, and by organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Art. 3). Purely personal or household use is outside it. The GDPR also applies in Iceland, Liechtenstein and Norway through the EEA Agreement. The AI Act covers providers placing AI systems or general-purpose AI models on the EU market, deployers in the EU, and non-EU providers and deployers whose AI output is used in the EU.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-320… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · ai-act-service-desk.ec.europa.eu/en/ai-act/article-2
Lawful bases
Section titled “Lawful bases”Every use of personal data needs one of six lawful bases (Art. 6), namely consent, contract, legal obligation, vital interests, public task or legitimate interests. Processing special category data, such as health, biometric or ethnic origin data, is banned unless an Art. 9(2) condition also applies, such as explicit consent. Consent must be a clear, free, specific and informed choice, so silence and pre-ticked boxes don’t count. The pending Digital Omnibus would confirm that AI development and operation can rely on legitimate interests, with safeguards.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · oeil.europarl.europa.eu/oeil/en/procedure-file
Consent age for online services
Section titled “Consent age for online services”When an online service offered directly to a child relies on consent, the GDPR default is that children can consent for themselves from 16. Member states may set a lower age, but not below 13, so it ranges from 13 to 16 (see each member state’s entry). Below that age a parent must give or authorise consent, and you must make reasonable efforts to check it.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and…
Children
Section titled “Children”Children need extra protection, notably in marketing and profiling (Recital 38). Use clear, plain language with them (Art. 12), weigh their interests heavily in legitimate interests tests (Art. 6(1)(f)), and erase on request data from online services offered to them (Art. 17(1)(f)). Platforms open to minors must protect their privacy, safety and security, with no profiling-based ads to users they’re reasonably sure are minors (DSA Art. 28; guidelines presented 14 July 2025). A pending EU KIDS Act proposal (17 September 2026) would stop under-15s opening their own social media accounts.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · digital-strategy.ec.europa.eu/en/news/commission-presents-guidelines-… · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a user’s device, including cookies, tracking pixels and device identifiers, needs prior consent to the GDPR standard after clear and full information, unless it’s strictly necessary to carry a communication or provide a service the user explicitly asked for (ePrivacy Art. 5(3)). Each member state applies this through its own law and regulator. The pending Digital Omnibus would move these rules into the GDPR for personal data, exempt some audience measurement and security uses, and make sites honour automated browser consent signals.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_… · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Electronic marketing
Section titled “Electronic marketing”Marketing emails and texts to individuals need prior consent, except for the soft opt-in (contact details obtained in a sale, your own similar products, and a free, easy opt-out when collected and in every message). Automated calls and faxes need consent, and for other calls each member state chooses opt-in or opt-out. Don’t hide the sender’s identity. Protection for business recipients is set nationally (ePrivacy Art. 13). People can object to direct marketing at any time, and you must then stop (GDPR Art. 21).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Breach notification
Section titled “Breach notification”Report a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it’s unlikely to risk people’s rights, and tell those affected without undue delay if the risk to them is high. Processors must tell the controller, and every breach must be documented. Public telecoms and internet providers also notify under ePrivacy Art. 4(3), within 24 hours of detection where feasible (Regulation 611/2013). The pending Digital Omnibus would limit GDPR reports to high-risk breaches, within 96 hours, via one reporting point.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf
Registration and fees
Section titled “Registration and fees”There’s no EU-level registration or fee under the GDPR (see each member state’s entry). A non-EU organisation covered because it targets or monitors people in the EU must name a representative in writing in a member state where those people are, unless its processing is occasional, low-risk and excludes large-scale special category or criminal data (Art. 27). Under the AI Act, non-EU providers of general-purpose AI models need an EU authorised representative (Art. 54), and Annex III high-risk AI systems must be registered in an EU database under the high-risk rules (Art. 49).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018… · ai-act-service-desk.ec.europa.eu/en/ai-act/article-54 · ai-act-service-desk.ec.europa.eu/en/ai-act/article-49
Data protection officer
Section titled “Data protection officer”Appoint a data protection officer if you’re a public authority or body, or if your core activities involve large-scale regular and systematic monitoring of people, such as online tracking, or large-scale processing of special category or criminal offence data (Art. 37). Member states may require one in more cases (see national entries). Publish the DPO’s contact details and give them to the supervisory authority.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and…
International transfers
Section titled “International transfers”Personal data can leave the EEA only under an adequacy decision, appropriate safeguards such as the 2021 standard contractual clauses (with a documented check of the destination’s laws) or binding corporate rules, or a listed exception (Art. 44–49). Recent adequacy decisions cover the European Patent Organisation (July 2025), the UK (renewed December 2025) and Brazil (January 2026). US organisations in the EU–US Data Privacy Framework are covered. The General Court upheld it in Latombe (T-553/23, 3 September 2025), and the appeal (C-703/25 P) was still pending on 5 November 2026.
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/international-dime… · commission.europa.eu/law/law-topic/data-protection/international-dime… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Leads, not sources: datalenk.com/blog/latombe-v-commission-data-privacy-framework
Impact assessments
Section titled “Impact assessments”Carry out a data protection impact assessment before processing likely to be high risk, such as systematic, extensive profiling with legal or similar effects, large-scale special category or criminal data, or large-scale monitoring of public areas (Art. 35). National authorities publish lists of other cases. Consult the authority first if a high risk remains after mitigation (Art. 36). From 2 December 2027, some deployers of high-risk AI, such as public bodies, credit scorers and life or health insurers, must also assess its impact on fundamental rights (AI Act Art. 27).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and… · ai-act-service-desk.ec.europa.eu/en/ai-act/article-27 · ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implemen…
Automated decisions and AI
Section titled “Automated decisions and AI”Solely automated decisions with legal or similarly significant effects must be needed for a contract, authorised by law or explicitly consented to, with safeguards such as human intervention (GDPR Art. 22). AI Act bans apply from 2 February 2025, general-purpose AI model duties from 2 August 2025 and transparency duties from 2 August 2026. From 2 December 2026 it bans AI for non-consensual sexual deepfakes or child sexual abuse material, and generative systems marketed earlier must mark their output. High-risk rules start on 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · commission.europa.eu/law/law-topic/data-protection/rules-business-and… · ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implemen… · ai-act-service-desk.ec.europa.eu/en/ai-act/article-113 · ai-act-service-desk.ec.europa.eu/en/ai-act/article-5 · ai-act-service-desk.ec.europa.eu/en/ai-act/article-50 · ai-act-service-desk.ec.europa.eu/en/ai-act/article-111
Penalties
Section titled “Penalties”GDPR fines reach €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of the principles, lawful bases, people’s rights or transfer rules, and €10 million or 2% for other duties (Art. 83). National law sets cookie and e-marketing fines. AI Act fines reach €35 million or 7% for banned practices, €15 million or 3% for most other duties and €7.5 million or 1% for misleading information. SMEs, and small mid-caps outside banned practices, get the lower figure (Art. 99). The Commission can fine general-purpose AI model providers up to €15 million or 3% (Art. 101).
Sources: eur-lex.europa.eu/legal-content/EN/TXT/HTML · eur-lex.europa.eu/legal-content/EN/TXT/HTML · ai-act-service-desk.ec.europa.eu/en/ai-act/article-99 · ai-act-service-desk.ec.europa.eu/en/ai-act/article-101
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | Added the pending proposal COM(2025) 1023, which would move the medical devices and in vitro diagnostics regulations to Section B of AI Act Annex I. Law Watch’s Cellar query listed it as proposing to amend the AI Act. Checked against the proposal’s text on publications.europa.eu and its procedure file, 2025/0404(COD). |
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/eu.yaml.