ہوم › قوانین کی لائبریری › EU GDPR
EU GDPR
Regulation (EU) 2016/679 (General Data Protection Regulation)
دو ذرائع سے تصدیق شدہ. آخری تصدیق 10 اکتوبر، 2026
اگلی مکمل جانچ: . ریگولیٹرز کی خبریں ہر ماہ دیکھی جاتی ہیں؛ تبدیلیاں درج ہوتی ہیں: تبدیلیوں کا ریکارڈ.
اس صفحے کا حوالہ دیں: GlanceDesk Jurisdiction, “EU GDPR (European Union (EEA))”, glancedeskjurisdiction.com/laws/eu-gdpr, last verified 10 October 2026.
European Union (EEA) پرائیویسی
- حیثیت
- In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
- یہ کن پر لاگو ہوتا ہے
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
- سائز کی حدیں
- None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
- ریگولیٹر
- National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
- خلاف ورزی یا واقعے کی رپورٹنگ
- Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
- ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ
- 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
- ڈیٹا پروٹیکشن آفیسر
- DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
- مقامی نمائندہ
- Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
- ڈیٹا بیرونِ ملک بھیجنا
- Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
- کوکیز اور رضامندی
- Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
- زیادہ سے زیادہ سزا
- Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓
جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔
آپ کو کیا کرنا ہوگا✓
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
- Put SCCs or another valid mechanism in place before sending data outside the EEA.
حالیہ تبدیلیاں
Commission's Digital Omnibus (COM(2025) 837, 19 Nov 2025) would raise the breach threshold to high risk, extend the deadline to 96 hours via a single reporting point and refine the personal-data definition. Not adopted: EU governments have not yet agreed the Council's negotiating position (a vote planned for 26 Jun 2026 was cancelled; further votes planned for 7 and 11 Oct 2026 were also called off, with no new date set); Parliament is still at committee stage; trilogues not started as of Oct 2026. Current GDPR rules (72 hours, risk threshold) remain fully applicable.✓
Termly
Create and maintain a privacy policy, cookie banner and request forms.
Create your privacy policy with Termlyپارٹنر لنک: آپ خریدیں تو آپ پر کسی اضافی لاگت کے بغیر ہمیں کمیشن مل سکتا ہے۔ اس کا ہمارے قانونی مواد پر کبھی اثر نہیں ہوتا۔ ملحقہ (affiliate) انکشاف
ذرائع
- بنیادی ذریعہ: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- دوسرا ذریعہ: https://eaccny.com/news/nautadutilh-the-digital-omnibus-what-changed-what-survived-and-what-remains-open/
- ریگولیٹر: National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)
آزادانہ جانچ کے لیے استعمال ہونے والے ذرائع (22)
- https://www.legislation.gov.uk/eur/2016/679/article/99/adopted
- https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360(COD)
- https://www.heuking.de/en/news-events/newsletter-articles/detail/gdpr-ai-and-cookies-what-the-eus-data-omnibus-could-change-for-companies.html
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504
- https://www.dlapiperdataprotection.com/index.html?t=law&c=IE
- https://www.scl.org/10114-article-30-gdpr-what-does-the-paragraph-5-exemption-really-mean-for-smaller-organisations/
- https://edpb.europa.eu/about-edpb/our-members_en
- https://www.legislation.gov.uk/eur/2016/679/article/27/adopted
- https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
- https://www.legislation.gov.uk/eur/2016/679/article/7/adopted
- https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02002L0058-20091219
- https://www.legislation.gov.uk/eur/2016/679/article/83/adopted
- https://www.legislation.gov.uk/eur/2016/679/article/28/adopted
- https://www.lw.com/en/insights/Digital-Omnibus-EU-Commission-Proposes-to-Streamline-GDPR-and-EU-AI-Act
- https://www.praxikon.com/en/avg/digital-omnibus/raad-iers-voorzitterschap
- https://data.consilium.europa.eu/doc/document/ST-10729-2026-INIT/en/pdf
- https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en
- https://connectontech.bakermckenzie.com/european-data-protection-board-edpb-publishes-updated-guidelines-9-2022-on-personal-data-breach-notification-under-gdpr/
- https://data.consilium.europa.eu/doc/document/ST-9834-2026-REV-1/en/pdf
- https://www.praxikon.com/en/avg/digital-omnibus/raad-mandaat-niet-bereikt
- https://agenceurope.eu/en/bulletin/article/13954/5/vote-on-digital-omnibus-postponed-until-11-october-under-pressure-from-paris-and-berlin
- https://agenceurope.eu/en/bulletin/article/13958/17/future-of-digital-omnibus-still-in-limbo-as-member-states-fail-to-agree
= دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں
صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں contact@