{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1","L2/L3 → GDPR links: implements, explains"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":50,"total":50,"capped":false,"cap":2000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/gdpr/map","url":"https://www.headlesslaw.com/gdpr/map","title":"Map of the law — GDPR","work_id":"gdpr","date_state":"current","as_of":"2026-11-01"},"act":{"work_id":"gdpr","name":"GDPR","path":"/gdpr","title":"Regulation (EU) 2016/679","celex":"32016R0679"},"as_of":"2026-11-01","date_state":"current","select":null,"selection":null,"filters":{"level":["L2","L3"],"type":["implements","explains"]},"parts":[{"key":"I","name":"Chapter I — General provisions"},{"key":"II","name":"Chapter II — Principles"},{"key":"III","name":"Chapter III — Rights of the data subject"},{"key":"IV","name":"Chapter IV — Controller and processor"},{"key":"V","name":"Chapter V — Transfers of personal data to third countries or international organisations"},{"key":"VI","name":"Chapter VI — Independent supervisory authorities"},{"key":"VII","name":"Chapter VII — Cooperation and consistency"},{"key":"VIII","name":"Chapter VIII — Remedies, liability and penalties"},{"key":"IX","name":"Chapter IX — Provisions relating to specific processing situations"},{"key":"X","name":"Chapter X — Delegated acts and implementing acts"},{"key":"XI","name":"Chapter XI — Final provisions"}],"articles":[{"key":"act","kind":"act","label":"Whole act","heading":null,"path":"/gdpr","part":"","status_on_date":"anchor","x_index":0},{"key":"recitals","kind":"recitals","label":"Recitals","heading":null,"path":"/gdpr/recitals","part":"","status_on_date":"in_force","x_index":1},{"key":"99","kind":"article","label":"Article 99","heading":"Entry into force and application","path":"/gdpr/articles/99","part":"XI","status_on_date":"in_force","x_index":2},{"key":"1","kind":"article","label":"Article 1","heading":"Subject-matter and objectives","path":"/gdpr/articles/1","part":"I","status_on_date":"in_force","x_index":3},{"key":"2","kind":"article","label":"Article 2","heading":"Material scope","path":"/gdpr/articles/2","part":"I","status_on_date":"in_force","x_index":4},{"key":"3","kind":"article","label":"Article 3","heading":"Territorial scope","path":"/gdpr/articles/3","part":"I","status_on_date":"in_force","x_index":5},{"key":"4","kind":"article","label":"Article 4","heading":"Definitions","path":"/gdpr/articles/4","part":"I","status_on_date":"in_force","x_index":6},{"key":"5","kind":"article","label":"Article 5","heading":"Principles relating to processing of personal data","path":"/gdpr/articles/5","part":"II","status_on_date":"in_force","x_index":7},{"key":"6","kind":"article","label":"Article 6","heading":"Lawfulness of processing","path":"/gdpr/articles/6","part":"II","status_on_date":"in_force","x_index":8},{"key":"7","kind":"article","label":"Article 7","heading":"Conditions for consent","path":"/gdpr/articles/7","part":"II","status_on_date":"in_force","x_index":9},{"key":"8","kind":"article","label":"Article 8","heading":"Conditions applicable to child's consent in relation to information society services","path":"/gdpr/articles/8","part":"II","status_on_date":"in_force","x_index":10},{"key":"9","kind":"article","label":"Article 9","heading":"Processing of special categories of personal data","path":"/gdpr/articles/9","part":"II","status_on_date":"in_force","x_index":11},{"key":"10","kind":"article","label":"Article 10","heading":"Processing of personal data relating to criminal convictions and offences","path":"/gdpr/articles/10","part":"II","status_on_date":"in_force","x_index":12},{"key":"11","kind":"article","label":"Article 11","heading":"Processing which does not require identification","path":"/gdpr/articles/11","part":"II","status_on_date":"in_force","x_index":13},{"key":"12","kind":"article","label":"Article 12","heading":"Transparent information, communication and modalities for the exercise of the rights of the data subject","path":"/gdpr/articles/12","part":"III","status_on_date":"in_force","x_index":14},{"key":"13","kind":"article","label":"Article 13","heading":"Information to be provided where personal data are collected from the data subject","path":"/gdpr/articles/13","part":"III","status_on_date":"in_force","x_index":15},{"key":"14","kind":"article","label":"Article 14","heading":"Information to be provided where personal data have not been obtained from the data subject","path":"/gdpr/articles/14","part":"III","status_on_date":"in_force","x_index":16},{"key":"15","kind":"article","label":"Article 15","heading":"Right of access by the data subject","path":"/gdpr/articles/15","part":"III","status_on_date":"in_force","x_index":17},{"key":"16","kind":"article","label":"Article 16","heading":"Right to rectification","path":"/gdpr/articles/16","part":"III","status_on_date":"in_force","x_index":18},{"key":"17","kind":"article","label":"Article 17","heading":"Right to erasure (‘right to be forgotten’)","path":"/gdpr/articles/17","part":"III","status_on_date":"in_force","x_index":19},{"key":"18","kind":"article","label":"Article 18","heading":"Right to restriction of processing","path":"/gdpr/articles/18","part":"III","status_on_date":"in_force","x_index":20},{"key":"19","kind":"article","label":"Article 19","heading":"Notification obligation regarding rectification or erasure of personal data or restriction of processing","path":"/gdpr/articles/19","part":"III","status_on_date":"in_force","x_index":21},{"key":"20","kind":"article","label":"Article 20","heading":"Right to data portability","path":"/gdpr/articles/20","part":"III","status_on_date":"in_force","x_index":22},{"key":"21","kind":"article","label":"Article 21","heading":"Right to object","path":"/gdpr/articles/21","part":"III","status_on_date":"in_force","x_index":23},{"key":"22","kind":"article","label":"Article 22","heading":"Automated individual decision-making, including profiling","path":"/gdpr/articles/22","part":"III","status_on_date":"in_force","x_index":24},{"key":"23","kind":"article","label":"Article 23","heading":"Restrictions","path":"/gdpr/articles/23","part":"III","status_on_date":"in_force","x_index":25},{"key":"24","kind":"article","label":"Article 24","heading":"Responsibility of the controller","path":"/gdpr/articles/24","part":"IV","status_on_date":"in_force","x_index":26},{"key":"25","kind":"article","label":"Article 25","heading":"Data protection by design and by default","path":"/gdpr/articles/25","part":"IV","status_on_date":"in_force","x_index":27},{"key":"26","kind":"article","label":"Article 26","heading":"Joint controllers","path":"/gdpr/articles/26","part":"IV","status_on_date":"in_force","x_index":28},{"key":"27","kind":"article","label":"Article 27","heading":"Representatives of controllers or processors not established in the Union","path":"/gdpr/articles/27","part":"IV","status_on_date":"in_force","x_index":29},{"key":"28","kind":"article","label":"Article 28","heading":"Processor","path":"/gdpr/articles/28","part":"IV","status_on_date":"in_force","x_index":30},{"key":"29","kind":"article","label":"Article 29","heading":"Processing under the authority of the controller or processor","path":"/gdpr/articles/29","part":"IV","status_on_date":"in_force","x_index":31},{"key":"30","kind":"article","label":"Article 30","heading":"Records of processing activities","path":"/gdpr/articles/30","part":"IV","status_on_date":"in_force","x_index":32},{"key":"31","kind":"article","label":"Article 31","heading":"Cooperation with the supervisory authority","path":"/gdpr/articles/31","part":"IV","status_on_date":"in_force","x_index":33},{"key":"32","kind":"article","label":"Article 32","heading":"Security of processing","path":"/gdpr/articles/32","part":"IV","status_on_date":"in_force","x_index":34},{"key":"33","kind":"article","label":"Article 33","heading":"Notification of a personal data breach to the supervisory authority","path":"/gdpr/articles/33","part":"IV","status_on_date":"in_force","x_index":35},{"key":"34","kind":"article","label":"Article 34","heading":"Communication of a personal data breach to the data subject","path":"/gdpr/articles/34","part":"IV","status_on_date":"in_force","x_index":36},{"key":"35","kind":"article","label":"Article 35","heading":"Data protection impact assessment","path":"/gdpr/articles/35","part":"IV","status_on_date":"in_force","x_index":37},{"key":"36","kind":"article","label":"Article 36","heading":"Prior consultation","path":"/gdpr/articles/36","part":"IV","status_on_date":"in_force","x_index":38},{"key":"37","kind":"article","label":"Article 37","heading":"Designation of the data protection officer","path":"/gdpr/articles/37","part":"IV","status_on_date":"in_force","x_index":39},{"key":"38","kind":"article","label":"Article 38","heading":"Position of the data protection officer","path":"/gdpr/articles/38","part":"IV","status_on_date":"in_force","x_index":40},{"key":"39","kind":"article","label":"Article 39","heading":"Tasks of the data protection officer","path":"/gdpr/articles/39","part":"IV","status_on_date":"in_force","x_index":41},{"key":"40","kind":"article","label":"Article 40","heading":"Codes of conduct","path":"/gdpr/articles/40","part":"IV","status_on_date":"in_force","x_index":42},{"key":"41","kind":"article","label":"Article 41","heading":"Monitoring of approved codes of conduct","path":"/gdpr/articles/41","part":"IV","status_on_date":"in_force","x_index":43},{"key":"42","kind":"article","label":"Article 42","heading":"Certification","path":"/gdpr/articles/42","part":"IV","status_on_date":"in_force","x_index":44},{"key":"43","kind":"article","label":"Article 43","heading":"Certification bodies","path":"/gdpr/articles/43","part":"IV","status_on_date":"in_force","x_index":45},{"key":"44","kind":"article","label":"Article 44","heading":"General principle for transfers","path":"/gdpr/articles/44","part":"V","status_on_date":"in_force","x_index":46},{"key":"45","kind":"article","label":"Article 45","heading":"Transfers on the basis of an adequacy decision","path":"/gdpr/articles/45","part":"V","status_on_date":"in_force","x_index":47},{"key":"46","kind":"article","label":"Article 46","heading":"Transfers subject to appropriate safeguards","path":"/gdpr/articles/46","part":"V","status_on_date":"in_force","x_index":48},{"key":"47","kind":"article","label":"Article 47","heading":"Binding corporate rules","path":"/gdpr/articles/47","part":"V","status_on_date":"in_force","x_index":49},{"key":"48","kind":"article","label":"Article 48","heading":"Transfers or disclosures not authorised by Union law","path":"/gdpr/articles/48","part":"V","status_on_date":"in_force","x_index":50},{"key":"49","kind":"article","label":"Article 49","heading":"Derogations for specific situations","path":"/gdpr/articles/49","part":"V","status_on_date":"in_force","x_index":51},{"key":"50","kind":"article","label":"Article 50","heading":"International cooperation for the protection of personal data","path":"/gdpr/articles/50","part":"V","status_on_date":"in_force","x_index":52},{"key":"51","kind":"article","label":"Article 51","heading":"Supervisory authority","path":"/gdpr/articles/51","part":"VI","status_on_date":"in_force","x_index":53},{"key":"52","kind":"article","label":"Article 52","heading":"Independence","path":"/gdpr/articles/52","part":"VI","status_on_date":"in_force","x_index":54},{"key":"53","kind":"article","label":"Article 53","heading":"General conditions for the members of the supervisory authority","path":"/gdpr/articles/53","part":"VI","status_on_date":"in_force","x_index":55},{"key":"54","kind":"article","label":"Article 54","heading":"Rules on the establishment of the supervisory authority","path":"/gdpr/articles/54","part":"VI","status_on_date":"in_force","x_index":56},{"key":"55","kind":"article","label":"Article 55","heading":"Competence","path":"/gdpr/articles/55","part":"VI","status_on_date":"in_force","x_index":57},{"key":"56","kind":"article","label":"Article 56","heading":"Competence of the lead supervisory authority","path":"/gdpr/articles/56","part":"VI","status_on_date":"in_force","x_index":58},{"key":"57","kind":"article","label":"Article 57","heading":"Tasks","path":"/gdpr/articles/57","part":"VI","status_on_date":"in_force","x_index":59},{"key":"58","kind":"article","label":"Article 58","heading":"Powers","path":"/gdpr/articles/58","part":"VI","status_on_date":"in_force","x_index":60},{"key":"59","kind":"article","label":"Article 59","heading":"Activity reports","path":"/gdpr/articles/59","part":"VI","status_on_date":"in_force","x_index":61},{"key":"60","kind":"article","label":"Article 60","heading":"Cooperation between the lead supervisory authority and the other supervisory authorities concerned","path":"/gdpr/articles/60","part":"VII","status_on_date":"in_force","x_index":62},{"key":"61","kind":"article","label":"Article 61","heading":"Mutual assistance","path":"/gdpr/articles/61","part":"VII","status_on_date":"in_force","x_index":63},{"key":"62","kind":"article","label":"Article 62","heading":"Joint operations of supervisory authorities","path":"/gdpr/articles/62","part":"VII","status_on_date":"in_force","x_index":64},{"key":"63","kind":"article","label":"Article 63","heading":"Consistency mechanism","path":"/gdpr/articles/63","part":"VII","status_on_date":"in_force","x_index":65},{"key":"64","kind":"article","label":"Article 64","heading":"Opinion of the Board","path":"/gdpr/articles/64","part":"VII","status_on_date":"in_force","x_index":66},{"key":"65","kind":"article","label":"Article 65","heading":"Dispute resolution by the Board","path":"/gdpr/articles/65","part":"VII","status_on_date":"in_force","x_index":67},{"key":"66","kind":"article","label":"Article 66","heading":"Urgency procedure","path":"/gdpr/articles/66","part":"VII","status_on_date":"in_force","x_index":68},{"key":"67","kind":"article","label":"Article 67","heading":"Exchange of information","path":"/gdpr/articles/67","part":"VII","status_on_date":"in_force","x_index":69},{"key":"68","kind":"article","label":"Article 68","heading":"European Data Protection Board","path":"/gdpr/articles/68","part":"VII","status_on_date":"in_force","x_index":70},{"key":"69","kind":"article","label":"Article 69","heading":"Independence","path":"/gdpr/articles/69","part":"VII","status_on_date":"in_force","x_index":71},{"key":"70","kind":"article","label":"Article 70","heading":"Tasks of the Board","path":"/gdpr/articles/70","part":"VII","status_on_date":"in_force","x_index":72},{"key":"71","kind":"article","label":"Article 71","heading":"Reports","path":"/gdpr/articles/71","part":"VII","status_on_date":"in_force","x_index":73},{"key":"72","kind":"article","label":"Article 72","heading":"Procedure","path":"/gdpr/articles/72","part":"VII","status_on_date":"in_force","x_index":74},{"key":"73","kind":"article","label":"Article 73","heading":"Chair","path":"/gdpr/articles/73","part":"VII","status_on_date":"in_force","x_index":75},{"key":"74","kind":"article","label":"Article 74","heading":"Tasks of the Chair","path":"/gdpr/articles/74","part":"VII","status_on_date":"in_force","x_index":76},{"key":"75","kind":"article","label":"Article 75","heading":"Secretariat","path":"/gdpr/articles/75","part":"VII","status_on_date":"in_force","x_index":77},{"key":"76","kind":"article","label":"Article 76","heading":"Confidentiality","path":"/gdpr/articles/76","part":"VII","status_on_date":"in_force","x_index":78},{"key":"77","kind":"article","label":"Article 77","heading":"Right to lodge a complaint with a supervisory authority","path":"/gdpr/articles/77","part":"VIII","status_on_date":"in_force","x_index":79},{"key":"78","kind":"article","label":"Article 78","heading":"Right to an effective judicial remedy against a supervisory authority","path":"/gdpr/articles/78","part":"VIII","status_on_date":"in_force","x_index":80},{"key":"79","kind":"article","label":"Article 79","heading":"Right to an effective judicial remedy against a controller or processor","path":"/gdpr/articles/79","part":"VIII","status_on_date":"in_force","x_index":81},{"key":"80","kind":"article","label":"Article 80","heading":"Representation of data subjects","path":"/gdpr/articles/80","part":"VIII","status_on_date":"in_force","x_index":82},{"key":"81","kind":"article","label":"Article 81","heading":"Suspension of proceedings","path":"/gdpr/articles/81","part":"VIII","status_on_date":"in_force","x_index":83},{"key":"82","kind":"article","label":"Article 82","heading":"Right to compensation and liability","path":"/gdpr/articles/82","part":"VIII","status_on_date":"in_force","x_index":84},{"key":"83","kind":"article","label":"Article 83","heading":"General conditions for imposing administrative fines","path":"/gdpr/articles/83","part":"VIII","status_on_date":"in_force","x_index":85},{"key":"84","kind":"article","label":"Article 84","heading":"Penalties","path":"/gdpr/articles/84","part":"VIII","status_on_date":"in_force","x_index":86},{"key":"85","kind":"article","label":"Article 85","heading":"Processing and freedom of expression and information","path":"/gdpr/articles/85","part":"IX","status_on_date":"in_force","x_index":87},{"key":"86","kind":"article","label":"Article 86","heading":"Processing and public access to official documents","path":"/gdpr/articles/86","part":"IX","status_on_date":"in_force","x_index":88},{"key":"87","kind":"article","label":"Article 87","heading":"Processing of the national identification number","path":"/gdpr/articles/87","part":"IX","status_on_date":"in_force","x_index":89},{"key":"88","kind":"article","label":"Article 88","heading":"Processing in the context of employment","path":"/gdpr/articles/88","part":"IX","status_on_date":"in_force","x_index":90},{"key":"89","kind":"article","label":"Article 89","heading":"Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes","path":"/gdpr/articles/89","part":"IX","status_on_date":"in_force","x_index":91},{"key":"90","kind":"article","label":"Article 90","heading":"Obligations of secrecy","path":"/gdpr/articles/90","part":"IX","status_on_date":"in_force","x_index":92},{"key":"91","kind":"article","label":"Article 91","heading":"Existing data protection rules of churches and religious associations","path":"/gdpr/articles/91","part":"IX","status_on_date":"in_force","x_index":93},{"key":"92","kind":"article","label":"Article 92","heading":"Exercise of the delegation","path":"/gdpr/articles/92","part":"X","status_on_date":"in_force","x_index":94},{"key":"93","kind":"article","label":"Article 93","heading":"Committee procedure","path":"/gdpr/articles/93","part":"X","status_on_date":"in_force","x_index":95},{"key":"94","kind":"article","label":"Article 94","heading":"Repeal of Directive 95/46/EC","path":"/gdpr/articles/94","part":"XI","status_on_date":"in_force","x_index":96},{"key":"95","kind":"article","label":"Article 95","heading":"Relationship with Directive 2002/58/EC","path":"/gdpr/articles/95","part":"XI","status_on_date":"in_force","x_index":97},{"key":"96","kind":"article","label":"Article 96","heading":"Relationship with previously concluded Agreements","path":"/gdpr/articles/96","part":"XI","status_on_date":"in_force","x_index":98},{"key":"97","kind":"article","label":"Article 97","heading":"Commission reports","path":"/gdpr/articles/97","part":"XI","status_on_date":"in_force","x_index":99},{"key":"98","kind":"article","label":"Article 98","heading":"Review of other Union legal acts on data protection","path":"/gdpr/articles/98","part":"XI","status_on_date":"in_force","x_index":100}],"nodes":[{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","path":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","href":"/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","level":"L2","label":"2021/915","short_title":"Decision — Contractual clauses between controllers and processors [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2021/915 · binding on its addressees · dated 4 Jun 2021 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","path":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","href":"/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","level":"L2","label":"2021/914","short_title":"Decision — Standard contractual clauses for transfer to third countries [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2021/914 · binding on its addressees · dated 4 Jun 2021 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan","path":"/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan","href":"/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan","level":"L2","label":"2019/419","short_title":"Decision — Adequate protection of personal data by Japan [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2019/419 · binding on its addressees · dated 23 Jan 2019 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom","path":"/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom","href":"/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom","level":"L2","label":"2021/1772","short_title":"Decision — Adequate protection of personal data by the United Kingdom [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2021/1772 · binding on its addressees · dated 28 Jun 2021 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea","path":"/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea","href":"/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea","level":"L2","label":"2022/254","short_title":"Decision — Adequate protection of personal data by the Republic of Korea [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2022/254 · binding on its addressees · dated 17 Dec 2021 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","path":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","href":"/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","level":"L2","label":"2023/1795","short_title":"Decision — Adequate protection under the EU-US Data Privacy Framework [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2023/1795 · binding on its addressees · dated 10 Jul 2023 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation","path":"/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation","href":"/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation","level":"L2","label":"2025/1382","short_title":"Decision — Adequate protection by the European Patent Organisation [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2025/1382 · binding on its addressees · dated 15 Jul 2025 [in force]"},{"work_id":"spaces/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil","path":"/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil","href":"/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil","level":"L2","label":"2026/179","short_title":"Decision — Adequate level of protection of personal data by Brazil [in force]","legal_nature":"binding_adopted","source_line":"Commission Implementing Decision (EU) 2026/179 · binding on its addressees · dated 26 Jan 2026 [in force]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope","path":"/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope","href":"/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope","level":"L3","label":"EDPB 3/2018","short_title":"Guideline — Territorial scope of the GDPR [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 12 Nov 2019 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay","path":"/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay","href":"/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay","level":"L3","label":"EDPB 05/2021","short_title":"Guideline — Interplay of Article 3 and Chapter V [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 14 Feb 2023 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest","path":"/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest","href":"/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest","level":"L3","label":"EDPB 1/2024","short_title":"Guideline — Legitimate interest [consultation]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70(1)(e) of Regulation (EU) 2016/679 · not legislation · dated 8 Oct 2024 [consultation]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services","path":"/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services","href":"/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services","level":"L3","label":"EDPB 2/2019","short_title":"Guideline — Processing under Article 6(1)(b) for online services [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70(1)e of Regulation (EU) 2016/679 · not legislation · dated 8 Oct 2019 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","path":"/gdpr/level-3/guidelines/edpb-05-2020-consent","href":"/gdpr/level-3/guidelines/edpb-05-2020-consent","level":"L3","label":"EDPB 05/2020","short_title":"Guideline — Consent [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 4 May 2020 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency","path":"/gdpr/level-3/guidelines/edpb-wp260-transparency","href":"/gdpr/level-3/guidelines/edpb-wp260-transparency","level":"L3","label":"WP260 rev.01","short_title":"Guideline — Transparency [final]","legal_nature":"not_legislation","source_line":"Guidelines by the Article 29 Working Party · not legislation · dated 29 Nov 2017 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-01-2022-right-of-access","path":"/gdpr/level-3/guidelines/edpb-01-2022-right-of-access","href":"/gdpr/level-3/guidelines/edpb-01-2022-right-of-access","level":"L3","label":"EDPB 01/2022","short_title":"Guideline — Right of access [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 28 Mar 2023 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","path":"/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","href":"/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","level":"L3","label":"EDPB 01/2025","short_title":"Guideline — Pseudonymisation [consultation]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70(1)(e) of Regulation (EU) 2016/679 · not legislation · dated 16 Jan 2025 [consultation]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","path":"/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","href":"/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","level":"L3","label":"EDPB 07/2020","short_title":"Guideline — Controller/processor [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1e) of Regulation (EU) 2016/679 · not legislation · dated 7 Jul 2021 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions","path":"/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions","href":"/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions","level":"L3","label":"EDPB 10/2020","short_title":"Guideline — Restrictions under Article 23 [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 13 Oct 2021 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design","path":"/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design","href":"/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design","level":"L3","label":"EDPB 4/2019","short_title":"Guideline — DPbDD [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1e) of Regulation (EU) 2016/679 · not legislation · dated 20 Oct 2020 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-09-2022-breach-notification","path":"/gdpr/level-3/guidelines/edpb-09-2022-breach-notification","href":"/gdpr/level-3/guidelines/edpb-09-2022-breach-notification","level":"L3","label":"EDPB 9/2022","short_title":"Guideline — Breach notification [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70(1)(e) and (l) of Regulation (EU) 2016/679 · not legislation · dated 28 Mar 2023 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-wp248-dpia","path":"/gdpr/level-3/guidelines/edpb-wp248-dpia","href":"/gdpr/level-3/guidelines/edpb-wp248-dpia","level":"L3","label":"WP248 rev.01","short_title":"Guideline — DPIA [final]","legal_nature":"not_legislation","source_line":"Guidelines by the Article 29 Working Party · not legislation · dated 4 Apr 2017 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria","path":"/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria","href":"/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria","level":"L3","label":"EDPB 1/2018","short_title":"Guideline — Certification and certification criteria [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1e) of Regulation (EU) 2016/679 · not legislation · dated 4 Jun 2019 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies","path":"/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies","href":"/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies","level":"L3","label":"EDPB 4/2018","short_title":"Guideline — Accreditation of certification bodies [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 4 Jun 2019 [final]"},{"work_id":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures","path":"/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures","href":"/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures","level":"L3","label":"EDPB 01/2020","short_title":"Recommendation — Transfer measures [final]","legal_nature":"not_legislation","source_line":"Recommendation by the EDPB · not legislation · dated 18 Jun 2021 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities","path":"/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities","href":"/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities","level":"L3","label":"EDPB 2/2020","short_title":"Guideline — Transfers between EEA and non-EEA public authorities [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1e) of Regulation (EU) 2016/679 · not legislation · dated 15 Dec 2020 [final]"},{"work_id":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr","path":"/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr","href":"/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr","level":"L3","label":"EDPB 1/2022","short_title":"Recommendation — Controller Binding Corporate Rules [final]","legal_nature":"not_legislation","source_line":"Recommendation by the EDPB · not legislation · dated 20 Jun 2023 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2024-article-48","path":"/gdpr/level-3/guidelines/edpb-02-2024-article-48","href":"/gdpr/level-3/guidelines/edpb-02-2024-article-48","level":"L3","label":"EDPB 02/2024","short_title":"Guideline — Article 48 GDPR [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 4 Jun 2025 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations","path":"/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations","href":"/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations","level":"L3","label":"EDPB 2/2018","short_title":"Guideline — Derogations of Article 49 [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1j) and (1e) of Regulation (EU) 2016/679 · not legislation · dated 25 May 2018 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2022-article-60","path":"/gdpr/level-3/guidelines/edpb-02-2022-article-60","href":"/gdpr/level-3/guidelines/edpb-02-2022-article-60","level":"L3","label":"EDPB 02/2022","short_title":"Guideline — Application of Article 60 [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70(1)(e) of Regulation (EU) 2016/679 · not legislation · dated 14 Mar 2022 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a","path":"/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a","href":"/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a","level":"L3","label":"EDPB 03/2021","short_title":"Guideline — Application of Article 65(1)(a) [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB · not legislation · dated 24 May 2023 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-02-2025-blockchain","path":"/gdpr/level-3/guidelines/edpb-02-2025-blockchain","href":"/gdpr/level-3/guidelines/edpb-02-2025-blockchain","level":"L3","label":"EDPB 02/2025","short_title":"Guideline — Blockchain [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB under Article 70 (1)(e) of Regulation (EU) 2016/679 · not legislation · dated 7 Jul 2026 [final]"},{"work_id":"spaces/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines","path":"/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines","href":"/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines","level":"L3","label":"EDPB 04/2022","short_title":"Guideline — Calculation of administrative fines [final]","legal_nature":"not_legislation","source_line":"Guidelines by the EDPB · not legislation · dated 24 May 2023 [final]"}],"edges":[{"edge_id":"00afdc46095eca1c0853","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope","src_unit":"spaces/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope/page","dst_unit":"3","src_from":"2019-11-12","src_until":null},{"edge_id":"80dd15fd9e8e2309b423","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay/page","dst_unit":"3","src_from":"2023-02-14","src_until":null},{"edge_id":"08d325b8ca0cdb07f837","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation/page","dst_unit":"4","src_from":"2025-01-16","src_until":null},{"edge_id":"d15e02c9775e8fb03745","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent/page","dst_unit":"4","src_from":"2020-05-04","src_until":null},{"edge_id":"429f64264a11af05d7cb","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","src_unit":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor/page","dst_unit":"4","src_from":"2021-07-07","src_until":null},{"edge_id":"ae3f4d0ac75d6e913632","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency/page","dst_unit":"5","src_from":"2017-11-29","src_until":null},{"edge_id":"85255b967d768834cf1c","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest/page","dst_unit":"6","src_from":"2024-10-08","src_until":null},{"edge_id":"868bbb1e4ec2c81f4695","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services/page","dst_unit":"6","src_from":"2019-10-08","src_until":null},{"edge_id":"22f031288d77ef140ad7","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent/page","dst_unit":"6","src_from":"2020-05-04","src_until":null},{"edge_id":"c957b25c0a8e8ffde1fa","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent/page","dst_unit":"7","src_from":"2020-05-04","src_until":null},{"edge_id":"d7455ecc88ee682bb100","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent/page","dst_unit":"8","src_from":"2020-05-04","src_until":null},{"edge_id":"73bbb87ca3dcb89fe21c","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent","src_unit":"spaces/gdpr/level-3/guidelines/edpb-05-2020-consent/page","dst_unit":"9","src_from":"2020-05-04","src_until":null},{"edge_id":"8bdbdbce7257fcbfc263","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2022-right-of-access","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2022-right-of-access/page","dst_unit":"12","src_from":"2023-03-28","src_until":null},{"edge_id":"6d2fad94b14b0280ee92","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency/page","dst_unit":"12","src_from":"2017-11-29","src_until":null},{"edge_id":"7a92197f4b17a8e1deb4","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency/page","dst_unit":"13","src_from":"2017-11-29","src_until":null},{"edge_id":"8ccfdffb17021b869834","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp260-transparency/page","dst_unit":"14","src_from":"2017-11-29","src_until":null},{"edge_id":"9e298f76dd5a5684508c","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2022-right-of-access","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2022-right-of-access/page","dst_unit":"15","src_from":"2023-03-28","src_until":null},{"edge_id":"c62ba3b6cc77e027e991","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions","src_unit":"spaces/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions/page","dst_unit":"23","src_from":"2021-10-13","src_until":null},{"edge_id":"b521aaeb74e01c2e36bc","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation/page","dst_unit":"25","src_from":"2025-01-16","src_until":null},{"edge_id":"123463e5b4e198ed296f","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design","src_unit":"spaces/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design/page","dst_unit":"25","src_from":"2020-10-20","src_until":null},{"edge_id":"be4154e52e43d9e27a77","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","src_unit":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor/page","dst_unit":"26","src_from":"2021-07-07","src_until":null},{"edge_id":"b02ca04a75ca02c6e655","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","src_unit":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/head","dst_unit":"28","src_from":"2021-06-27","src_until":null},{"edge_id":"ed22629fa040c6807ca9","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors","src_unit":"spaces/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors/head","dst_unit":"28","src_from":"2021-06-27","src_until":null},{"edge_id":"bbff23bbf85b3d8869ac","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","src_unit":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor/page","dst_unit":"28","src_from":"2021-07-07","src_until":null},{"edge_id":"3d64baf2a3fee05b7b38","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor","src_unit":"spaces/gdpr/level-3/guidelines/edpb-07-2020-controller-processor/page","dst_unit":"29","src_from":"2021-07-07","src_until":null},{"edge_id":"c602b0065fba48c17ea3","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation/page","dst_unit":"32","src_from":"2025-01-16","src_until":null},{"edge_id":"ff0f902c9f54917183e2","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-09-2022-breach-notification","src_unit":"spaces/gdpr/level-3/guidelines/edpb-09-2022-breach-notification/page","dst_unit":"33","src_from":"2023-03-28","src_until":null},{"edge_id":"41ecf60210577619af0a","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-09-2022-breach-notification","src_unit":"spaces/gdpr/level-3/guidelines/edpb-09-2022-breach-notification/page","dst_unit":"34","src_from":"2023-03-28","src_until":null},{"edge_id":"ed54649bdb4bb87f3138","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp248-dpia","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp248-dpia/page","dst_unit":"35","src_from":"2017-04-04","src_until":null},{"edge_id":"c5d5ed13931f02ca47ca","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-wp248-dpia","src_unit":"spaces/gdpr/level-3/guidelines/edpb-wp248-dpia/page","dst_unit":"36","src_from":"2017-04-04","src_until":null},{"edge_id":"63148ad376fa584d3279","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria/page","dst_unit":"42","src_from":"2019-06-04","src_until":null},{"edge_id":"e7890f44faee21b4133c","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria","src_unit":"spaces/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria/page","dst_unit":"43","src_from":"2019-06-04","src_until":null},{"edge_id":"116782349421a5360846","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies","src_unit":"spaces/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies/page","dst_unit":"43","src_from":"2019-06-04","src_until":null},{"edge_id":"ad3b2f27e914858196c8","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan","src_unit":"spaces/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan/head","dst_unit":"45","src_from":"2019-01-23","src_until":null},{"edge_id":"8a3d7d49f7f6145b4005","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom","src_unit":"spaces/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom/head","dst_unit":"45","src_from":"2021-06-28","src_until":null},{"edge_id":"a0ec57df0c15edf1630b","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea","src_unit":"spaces/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea/head","dst_unit":"45","src_from":"2021-12-17","src_until":null},{"edge_id":"e91a9367c14b8979f23c","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework","src_unit":"spaces/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework/head","dst_unit":"45","src_from":"2023-07-10","src_until":null},{"edge_id":"c214a188970ca47d2834","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation","src_unit":"spaces/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation/head","dst_unit":"45","src_from":"2025-07-15","src_until":null},{"edge_id":"18b9e66ea600a4a7eba2","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil","src_unit":"spaces/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil/head","dst_unit":"45","src_from":"2026-01-26","src_until":null},{"edge_id":"6b24c9893e89af82279a","type":"implements","layer":"implements","scope":"unit","src":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries","src_unit":"spaces/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries/head","dst_unit":"46","src_from":"2021-06-27","src_until":null},{"edge_id":"3e52becc8cdf07748f41","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures","src_unit":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures/page","dst_unit":"46","src_from":"2021-06-18","src_until":null},{"edge_id":"7a8db96040a73f351fbc","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities/page","dst_unit":"46","src_from":"2020-12-15","src_until":null},{"edge_id":"d86d72a952eed47f4bee","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr","src_unit":"spaces/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr/page","dst_unit":"47","src_from":"2023-06-20","src_until":null},{"edge_id":"2e2cd51a0403cef1bd48","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2024-article-48","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2024-article-48/page","dst_unit":"48","src_from":"2025-06-04","src_until":null},{"edge_id":"bb4aa863028905340886","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations/page","dst_unit":"49","src_from":"2018-05-25","src_until":null},{"edge_id":"66d751d4a27e0c54cef7","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2022-article-60","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2022-article-60/page","dst_unit":"60","src_from":"2022-03-14","src_until":null},{"edge_id":"f3f85086e9ef6eb3742b","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a","src_unit":"spaces/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a/page","dst_unit":"65","src_from":"2023-05-24","src_until":null},{"edge_id":"1e7a68f1b6210c27624f","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-02-2025-blockchain","src_unit":"spaces/gdpr/level-3/guidelines/edpb-02-2025-blockchain/page","dst_unit":"70","src_from":"2026-07-07","src_until":null},{"edge_id":"a59dad2d914dedc9af08","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines","src_unit":"spaces/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines/page","dst_unit":"70","src_from":"2023-05-24","src_until":null},{"edge_id":"5c5bbfa5fc62eadb3c17","type":"guides","layer":"explains","scope":"unit","src":"spaces/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines","src_unit":"spaces/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines/page","dst_unit":"83","src_from":"2023-05-24","src_until":null}],"counts":{"articles_with_links":32,"l2_nodes":8,"l3_nodes":24,"edges":50,"act_level_edges":0,"undated_edges":0,"not_in_force_sources":0},"map_url":"https://www.headlesslaw.com/gdpr/map","note":"edges = the relations of the act's units on as_of (same rule as <page>/relations?at=); src_from 0001-01-01 = no date recorded for the source (shown on every date)"}