<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2016-05-04","gaps":[],"covered":["GDPR L1","L2/L3 → GDPR links: implements, explains"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":null,"checked_against":null},"truncation":{"shown":50,"total":50,"capped":false,"cap":2000,"next_cursor":null},"failures":[],"incomplete":[]},"page":{"path":"/gdpr/map","url":"https://www.headlesslaw.com/gdpr/map","title":"Map of the law — GDPR","work_id":"gdpr","date_state":"current","as_of":"2026-11-01"},"act":{"work_id":"gdpr","name":"GDPR","path":"/gdpr","title":"Regulation (EU) 2016/679","celex":"32016R0679"},"select":null,"counts":{"articles_with_links":32,"l2_nodes":8,"l3_nodes":24,"edges":50,"act_level_edges":0,"undated_edges":0,"not_in_force_sources":0}} -->
# Map of the law — GDPR

All links as a table (50)

| Article | Level | Document | Link type | From | Until |
|---|---|---|---|---|---|
| [Article 3](https://www.headlesslaw.com/gdpr/articles/3) | Level 3 | [EDPB 3/2018 — Guideline — Territorial scope of the GDPR [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-03-2018-territorial-scope) · not legislation | Explains | 12 Nov 2019 | — |
| [Article 3](https://www.headlesslaw.com/gdpr/articles/3) | Level 3 | [EDPB 05/2021 — Guideline — Interplay of Article 3 and Chapter V [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2021-article-3-chapter-v-interplay) · not legislation | Explains | 14 Feb 2023 | — |
| [Article 4](https://www.headlesslaw.com/gdpr/articles/4) | Level 3 | [EDPB 01/2025 — Guideline — Pseudonymisation [consultation]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation) · not legislation | Explains | 16 Jan 2025 | — |
| [Article 4](https://www.headlesslaw.com/gdpr/articles/4) | Level 3 | [EDPB 05/2020 — Guideline — Consent [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2020-consent) · not legislation | Explains | 4 May 2020 | — |
| [Article 4](https://www.headlesslaw.com/gdpr/articles/4) | Level 3 | [EDPB 07/2020 — Guideline — Controller/processor [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-07-2020-controller-processor) · not legislation | Explains | 7 Jul 2021 | — |
| [Article 5](https://www.headlesslaw.com/gdpr/articles/5) | Level 3 | [WP260 rev.01 — Guideline — Transparency [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp260-transparency) · not legislation | Explains | 29 Nov 2017 | — |
| [Article 6](https://www.headlesslaw.com/gdpr/articles/6) | Level 3 | [EDPB 1/2024 — Guideline — Legitimate interest [consultation]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2024-legitimate-interest) · not legislation | Explains | 8 Oct 2024 | — |
| [Article 6](https://www.headlesslaw.com/gdpr/articles/6) | Level 3 | [EDPB 2/2019 — Guideline — Processing under Article 6(1)(b) for online services [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2019-article-6-1-b-online-services) · not legislation | Explains | 8 Oct 2019 | — |
| [Article 6](https://www.headlesslaw.com/gdpr/articles/6) | Level 3 | [EDPB 05/2020 — Guideline — Consent [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2020-consent) · not legislation | Explains | 4 May 2020 | — |
| [Article 7](https://www.headlesslaw.com/gdpr/articles/7) | Level 3 | [EDPB 05/2020 — Guideline — Consent [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2020-consent) · not legislation | Explains | 4 May 2020 | — |
| [Article 8](https://www.headlesslaw.com/gdpr/articles/8) | Level 3 | [EDPB 05/2020 — Guideline — Consent [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2020-consent) · not legislation | Explains | 4 May 2020 | — |
| [Article 9](https://www.headlesslaw.com/gdpr/articles/9) | Level 3 | [EDPB 05/2020 — Guideline — Consent [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-05-2020-consent) · not legislation | Explains | 4 May 2020 | — |
| [Article 12](https://www.headlesslaw.com/gdpr/articles/12) | Level 3 | [EDPB 01/2022 — Guideline — Right of access [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2022-right-of-access) · not legislation | Explains | 28 Mar 2023 | — |
| [Article 12](https://www.headlesslaw.com/gdpr/articles/12) | Level 3 | [WP260 rev.01 — Guideline — Transparency [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp260-transparency) · not legislation | Explains | 29 Nov 2017 | — |
| [Article 13](https://www.headlesslaw.com/gdpr/articles/13) | Level 3 | [WP260 rev.01 — Guideline — Transparency [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp260-transparency) · not legislation | Explains | 29 Nov 2017 | — |
| [Article 14](https://www.headlesslaw.com/gdpr/articles/14) | Level 3 | [WP260 rev.01 — Guideline — Transparency [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp260-transparency) · not legislation | Explains | 29 Nov 2017 | — |
| [Article 15](https://www.headlesslaw.com/gdpr/articles/15) | Level 3 | [EDPB 01/2022 — Guideline — Right of access [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2022-right-of-access) · not legislation | Explains | 28 Mar 2023 | — |
| [Article 23](https://www.headlesslaw.com/gdpr/articles/23) | Level 3 | [EDPB 10/2020 — Guideline — Restrictions under Article 23 [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-10-2020-article-23-restrictions) · not legislation | Explains | 13 Oct 2021 | — |
| [Article 25](https://www.headlesslaw.com/gdpr/articles/25) | Level 3 | [EDPB 01/2025 — Guideline — Pseudonymisation [consultation]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation) · not legislation | Explains | 16 Jan 2025 | — |
| [Article 25](https://www.headlesslaw.com/gdpr/articles/25) | Level 3 | [EDPB 4/2019 — Guideline — DPbDD [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-04-2019-data-protection-by-design) · not legislation | Explains | 20 Oct 2020 | — |
| [Article 26](https://www.headlesslaw.com/gdpr/articles/26) | Level 3 | [EDPB 07/2020 — Guideline — Controller/processor [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-07-2020-controller-processor) · not legislation | Explains | 7 Jul 2021 | — |
| [Article 28](https://www.headlesslaw.com/gdpr/articles/28) | Level 2 | [2021/914 — Decision — Standard contractual clauses for transfer to third countries [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries) · binding | Implements | 27 Jun 2021 | — |
| [Article 28](https://www.headlesslaw.com/gdpr/articles/28) | Level 2 | [2021/915 — Decision — Contractual clauses between controllers and processors [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-915-contractual-clauses-between-controllers-and-processors) · binding | Implements | 27 Jun 2021 | — |
| [Article 28](https://www.headlesslaw.com/gdpr/articles/28) | Level 3 | [EDPB 07/2020 — Guideline — Controller/processor [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-07-2020-controller-processor) · not legislation | Explains | 7 Jul 2021 | — |
| [Article 29](https://www.headlesslaw.com/gdpr/articles/29) | Level 3 | [EDPB 07/2020 — Guideline — Controller/processor [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-07-2020-controller-processor) · not legislation | Explains | 7 Jul 2021 | — |
| [Article 32](https://www.headlesslaw.com/gdpr/articles/32) | Level 3 | [EDPB 01/2025 — Guideline — Pseudonymisation [consultation]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2025-pseudonymisation) · not legislation | Explains | 16 Jan 2025 | — |
| [Article 33](https://www.headlesslaw.com/gdpr/articles/33) | Level 3 | [EDPB 9/2022 — Guideline — Breach notification [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-09-2022-breach-notification) · not legislation | Explains | 28 Mar 2023 | — |
| [Article 34](https://www.headlesslaw.com/gdpr/articles/34) | Level 3 | [EDPB 9/2022 — Guideline — Breach notification [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-09-2022-breach-notification) · not legislation | Explains | 28 Mar 2023 | — |
| [Article 35](https://www.headlesslaw.com/gdpr/articles/35) | Level 3 | [WP248 rev.01 — Guideline — DPIA [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp248-dpia) · not legislation | Explains | 4 Apr 2017 | — |
| [Article 36](https://www.headlesslaw.com/gdpr/articles/36) | Level 3 | [WP248 rev.01 — Guideline — DPIA [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-wp248-dpia) · not legislation | Explains | 4 Apr 2017 | — |
| [Article 42](https://www.headlesslaw.com/gdpr/articles/42) | Level 3 | [EDPB 1/2018 — Guideline — Certification and certification criteria [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria) · not legislation | Explains | 4 Jun 2019 | — |
| [Article 43](https://www.headlesslaw.com/gdpr/articles/43) | Level 3 | [EDPB 1/2018 — Guideline — Certification and certification criteria [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-01-2018-certification-criteria) · not legislation | Explains | 4 Jun 2019 | — |
| [Article 43](https://www.headlesslaw.com/gdpr/articles/43) | Level 3 | [EDPB 4/2018 — Guideline — Accreditation of certification bodies [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-04-2018-accreditation-certification-bodies) · not legislation | Explains | 4 Jun 2019 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2019/419 — Decision — Adequate protection of personal data by Japan [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2019-419-adequate-protection-of-personal-data-by-japan) · binding | Implements | 23 Jan 2019 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2021/1772 — Decision — Adequate protection of personal data by the United Kingdom [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-1772-adequate-protection-of-personal-data-by-the-united-kingdom) · binding | Implements | 28 Jun 2021 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2022/254 — Decision — Adequate protection of personal data by the Republic of Korea [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2022-254-adequate-protection-of-personal-data-by-the-republic-of-korea) · binding | Implements | 17 Dec 2021 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2023/1795 — Decision — Adequate protection under the EU-US Data Privacy Framework [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2023-1795-adequate-protection-under-the-eu-us-data-privacy-framework) · binding | Implements | 10 Jul 2023 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2025/1382 — Decision — Adequate protection by the European Patent Organisation [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2025-1382-adequate-protection-by-the-european-patent-organisation) · binding | Implements | 15 Jul 2025 | — |
| [Article 45](https://www.headlesslaw.com/gdpr/articles/45) | Level 2 | [2026/179 — Decision — Adequate level of protection of personal data by Brazil [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2026-179-adequate-level-of-protection-of-personal-data-by-brazil) · binding | Implements | 26 Jan 2026 | — |
| [Article 46](https://www.headlesslaw.com/gdpr/articles/46) | Level 2 | [2021/914 — Decision — Standard contractual clauses for transfer to third countries [in force]](https://www.headlesslaw.com/gdpr/level-2/implementing-acts/2021-914-standard-contractual-clauses-for-transfer-to-third-countries) · binding | Implements | 27 Jun 2021 | — |
| [Article 46](https://www.headlesslaw.com/gdpr/articles/46) | Level 3 | [EDPB 01/2020 — Recommendation — Transfer measures [final]](https://www.headlesslaw.com/gdpr/level-3/recommendations-and-codes/edpb-01-2020-supplementary-transfer-measures) · not legislation | Explains | 18 Jun 2021 | — |
| [Article 46](https://www.headlesslaw.com/gdpr/articles/46) | Level 3 | [EDPB 2/2020 — Guideline — Transfers between EEA and non-EEA public authorities [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2020-article-46-public-authorities) · not legislation | Explains | 15 Dec 2020 | — |
| [Article 47](https://www.headlesslaw.com/gdpr/articles/47) | Level 3 | [EDPB 1/2022 — Recommendation — Controller Binding Corporate Rules [final]](https://www.headlesslaw.com/gdpr/level-3/recommendations-and-codes/edpb-01-2022-controller-bcr) · not legislation | Explains | 20 Jun 2023 | — |
| [Article 48](https://www.headlesslaw.com/gdpr/articles/48) | Level 3 | [EDPB 02/2024 — Guideline — Article 48 GDPR [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2024-article-48) · not legislation | Explains | 4 Jun 2025 | — |
| [Article 49](https://www.headlesslaw.com/gdpr/articles/49) | Level 3 | [EDPB 2/2018 — Guideline — Derogations of Article 49 [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2018-article-49-derogations) · not legislation | Explains | 25 May 2018 | — |
| [Article 60](https://www.headlesslaw.com/gdpr/articles/60) | Level 3 | [EDPB 02/2022 — Guideline — Application of Article 60 [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2022-article-60) · not legislation | Explains | 14 Mar 2022 | — |
| [Article 65](https://www.headlesslaw.com/gdpr/articles/65) | Level 3 | [EDPB 03/2021 — Guideline — Application of Article 65(1)(a) [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-03-2021-article-65-1-a) · not legislation | Explains | 24 May 2023 | — |
| [Article 70](https://www.headlesslaw.com/gdpr/articles/70) | Level 3 | [EDPB 02/2025 — Guideline — Blockchain [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-02-2025-blockchain) · not legislation | Explains | 7 Jul 2026 | — |
| [Article 70](https://www.headlesslaw.com/gdpr/articles/70) | Level 3 | [EDPB 04/2022 — Guideline — Calculation of administrative fines [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines) · not legislation | Explains | 24 May 2023 | — |
| [Article 83](https://www.headlesslaw.com/gdpr/articles/83) | Level 3 | [EDPB 04/2022 — Guideline — Calculation of administrative fines [final]](https://www.headlesslaw.com/gdpr/level-3/guidelines/edpb-04-2022-administrative-fines) · not legislation | Explains | 24 May 2023 | — |