GDPR requirements explained: Articles 5 to 49 in plain language

How the GDPR sets out its requirements

Regulation (EU) 2016/679 has 99 articles in 11 chapters and has applied since 25 May 2018. Chapter I holds Article 3 on territorial reach and the Article 4 definitions; the obligations an organisation plans for sit mainly in Articles 5 to 49.

Two definitions decide which duties are yours: a controller determines the purposes and means of processing (Article 4(7)); a processor handles data on the controller's behalf (Article 4(8)). Many companies are both, activity by activity.

Principles, lawful bases and special categories (Articles 5 to 9)

Article 5(1) lists six principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality. Article 5(2) adds accountability, the duty to demonstrate the other six, which is why an inventory of processing activities comes first.

Article 6(1) offers six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests, the last not open to public authorities performing their tasks. Each activity needs one, chosen before processing starts. Where consent is the basis, Article 7 requires that you can prove it was given, that the request is distinguishable from other matters and written in plain language, and that withdrawing is as easy as giving.

Article 9(1) prohibits processing special-category data, such as health, genetic or identifying biometric data, unless an Article 9(2) condition applies. HR and occupational health files are where most businesses meet it.

Transparency and the rights of individuals (Articles 12 to 22)

Articles 13 and 14 set out the information people must be given about the processing. Article 12 governs how rights requests are handled: a response without undue delay and within one month, which may be extended by two further months with the reasons given, and in principle free of charge.

Most failures here are operational rather than legal: a request arrives in a shared inbox, nobody owns it, and the month runs out.

Accountability, processors and records (Articles 24 to 30)

Article 24 asks the controller for measures that ensure and demonstrate compliance, reviewed and updated, with policies where proportionate. Article 25 requires protection designed in when the means of processing are chosen and, by default, only the data each purpose needs. Organisations outside the Union caught by Article 3(2) must designate a representative in the Union in writing under Article 27, unless exempt.

Under Article 28, controllers use only processors giving sufficient guarantees, under a contract with the Article 28(3) terms: instructions, confidentiality, security, sub-processors, help with rights and with Articles 32 to 36, deletion or return, and audit information. Sub-processors need the controller's prior written authorisation. A processor that decides purposes and means becomes a controller for that processing.

Article 30 requires a written record of processing, available to the supervisory authority on request: for controllers, purposes, categories of people and data, recipients, transfers and safeguards, retention and a general description of security; for processors, the categories of processing per controller. The under-250 exemption falls away where processing is not occasional, is likely to result in a risk or includes special-category or criminal-offence data.

How these records, notices and contracts are drafted and kept is the subject of GDPR documentation: records, notices, contracts and DPIAs.

Security, breaches and impact assessments (Articles 32 to 36)

Article 32 prescribes no control list. It asks for measures appropriate to the risk, which may include pseudonymisation and encryption, resilience, timely restoration and regular testing. An ISO/IEC 27001 system supplies much of the evidence if its risk assessment covers harm to people, not only to the business.

Article 33 sets the breach clock: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people. Processors tell their controller without undue delay, and every breach is documented. Article 34 adds telling the people affected when the risk to them is high.

Article 35 requires an impact assessment before processing likely to result in a high risk, and always for extensive profiling with significant effects, large-scale special-category or criminal-offence data, and large-scale monitoring of public areas. It describes the processing, tests necessity and proportionality, weighs risks and records safeguards, with the DPO's advice. If high risk would remain, Article 36 requires consulting the authority first.

The data protection officer and transfers (Articles 37 to 49)

Article 37 makes a DPO compulsory for public authorities and bodies, except courts acting judicially, and where core activities involve regular and systematic large-scale monitoring or large-scale special-category or criminal-offence data. Article 38 secures timely involvement, protection from penalty and a reporting line to top management; Article 39 lists the tasks, from advice and monitoring to acting as the authority's contact point.

Chapter V allows transfers outside the EU and EEA mainly on three footings: an Article 45 adequacy decision, Article 46 safeguards such as the Commission's standard contractual clauses or binding corporate rules, or the Article 49 derogations. Cloud hosting, offshore support and group companies are where unrecorded transfers hide. The UK's own rules are covered in GDPR vs UK GDPR: what differs and what does not.

Who checks compliance, and why no certificate settles it

Supervisory authorities enforce the Regulation, with Article 58(2) powers from reprimands to bans on processing. Article 83 sets a lower fine tier for controller and processor duties such as Articles 25 to 39, and a higher one for the principles, lawful bases, rights and transfers.

Voluntary Article 42 certification exists, but Article 42(4) says it does not reduce anyone's responsibility, and ISO/IEC 27701 is not an Article 42 certification (see GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2). Your requirements are tested when a client auditor, a data subject or a regulator asks; the sequence for building the evidence is in GDPR compliance step by step.

GDPR requirements: questions buyers ask