The legal framework
Regulation (EU) 2016/679 of 27 April 2016, applicable since 25 May 2018, sets the principles of lawfulness, minimisation, purpose limitation and security, and gives individuals directly enforceable rights: access, rectification, erasure, portability and objection. It is complemented by the ePrivacy Directive 2002/58/EC, which governs cookies and electronic communications. Fines reach 4 % of worldwide turnover. Being a regulation, it is not transposed: national laws only fill the margins it leaves open.
The difference between a regulation and a directive is visible here: no national statute was needed for the GDPR to apply. National laws intervene only where the Regulation leaves discretion — the age of consent for children, health data, research.
The right to erasure, often called the right to be forgotten, came from a 2014 judgment of the Court of Justice before being codified in Article 17. It is the basis for asking a dating site to delete a profile or a photograph.
The Regulation binds companies established outside the Union whenever they offer services to people located in it. That is what allows a European resident to exercise rights against an American application.
Key points
| Instrument | Regulation (EU) 2016/679, applicable since 25 May 2018 |
|---|---|
| Nature | A regulation: directly applicable, no transposition |
| Rights | Access, rectification, erasure, portability, objection, restriction |
| Cookies | Directive 2002/58/EC, prior consent required |
| Penalties | Up to €20 million or 4 % of worldwide turnover |
| Reach | Applies to non-EU companies targeting people in the Union |
In practice
- Check first what kind of instrument it is: a regulation applies directly, a directive must be transposed and leaves differences between states.
- Consult the consolidated version on EUR-Lex, which incorporates every amendment.
- Identify the national transposing statute: that is what a court will actually apply.
- Where the meaning is disputed, look for Court of Justice judgments on the point.
- For a cross-border dispute, check whether a national contact point or a European network can help.
Cost and coverage
Consulting Union law costs nothing: EUR-Lex publishes every text free of charge, in twenty-four official languages and in consolidated form. Any cost lies in legal advice, where the interaction between the European text and the national transposing statute becomes decisive — common with directives, rare with regulations.
Where to go
- EUR-Lex, the official portal of Union law, publishing every text in twenty-four languages
- The European e-Justice Portal, for cross-border procedures
- Your Europe, the Commission's information service for citizens
- SOLVIT, the network that resolves misapplication of Union law by an administration
- The European Consumer Centre in your country, for cross-border consumer disputes
Worth knowing
Do not confuse the European Union with the Council of Europe: the European Convention on Human Rights and the Strasbourg Court are not EU bodies and cover forty-six states, including Switzerland and the United Kingdom.
Frequently asked questions
Does the GDPR have to be transposed?
No. It is a regulation and applies directly in every member state; national laws only adapt it where it leaves discretion.
Which rights can I exercise?
Access, rectification, erasure, portability, objection and restriction of processing.
Who do I complain to?
The supervisory authority of your country of residence, which cooperates with the others under the one-stop-shop mechanism.
Does it cover an American app?
Yes, as soon as it offers its services to people located in the Union.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database