All answers
Direct answers · GDPR
Answers to GDPR questions
Each question has its own page with the short answer first and the sources after it. The knowledge base gives the same answers when you ask a GDPR question.
Questions about the GDPR
Each answer names the article with its exact provision and, where they exist, the ruling of the Court of Justice, the EDPB guideline and the decision of the Dutch Data Protection Authority it rests on.
DPIAs and fines4
Legal basis, decisions and AI models6
- When is there an automated decision within the meaning of Article 22, and when is it nevertheless allowed?
- May an organisation refuse to explain an automated decision by invoking trade secrets?
- When can an organisation rely on legitimate interest?
- Is an AI model trained on personal data anonymous?
- May an organisation process biometric data or a database of facial features?
- What does the EDPB say about scraping web data to train generative AI?
Roles, transfers and data subject rights10
- Are standard contractual clauses on their own sufficient for a transfer?
- On what basis may personal data be transferred to a country outside the EEA, such as the US?
- When is an organisation a joint controller?
- When is a supplier a processor, and what must be arranged in the contract?
- When must a personal data breach be notified to the supervisory authority and to data subjects?
- When must an organisation designate a data protection officer?
- From what age may a child give consent itself for an online service?
- Is someone entitled to compensation if the GDPR has been infringed?
- May an organisation make it mandatory to provide data that are not needed for the service?
- What information must an organisation provide when it collects personal data?
Question not listed? Ask it in the knowledge base, read the GDPR Explorer or check your own situation in the free case check.