Processing is only legal if it meets one of six bases, such as consent or "legitimate interests".

In Schrems v Meta (C-446/21), the CJEU emphasized data minimisation , ruling that personal data cannot be processed indefinitely for targeted advertising without strict temporal limits. Article 6: Lawfulness of Processing

Invalidated the EU-US Privacy Shield due to US surveillance concerns. (C-21/23)

Anyone who has suffered damage due to a GDPR infringement has the right to receive compensation from the controller or processor.

The General Data Protection Regulation (GDPR) serves as the primary legal framework for data privacy in the European Union, with its 99 articles interpreted through evolving case law from the Court of Justice of the European Union (CJEU) . Key GDPR Articles and Commentary

For in-depth study, legal practitioners often refer to specialized texts like The EU General Data Protection Regulation (GDPR): A Commentary by Bygrave and Docksey.

The CJEU ruled in FT v DW (C-307/22) that controllers must provide the first copy of medical records free of charge , regardless of the reason for the request. Article 82: Right to Compensation