🇪🇺European Union

The European Union framework is broader than the GDPR

The European Union has built one of the world's most developed frameworks for privacy, data governance, artificial intelligence and online platform accountability. The GDPR remains the centre of the EU personal data protection regime, but it is no longer the whole picture. Organisations operating in or serving the EU may also need to consider the ePrivacy Directive, the Data Governance Act, the Data Act, the Artificial Intelligence Act and the Digital Services Act.

These laws do not all do the same thing. Some protect individuals. Some regulate data access and sharing. Some govern AI risks. Some apply to online intermediaries and platforms. Together, they create a layered digital regulation system where privacy, security, transparency, fairness, accountability and user control are treated as connected obligations.

The main pillars to understand first

The GDPR is the core personal data law. It governs how controllers and processors collect, use, store, disclose, secure and transfer personal data. It requires a lawful basis, transparent notices, respect for individual rights, security measures, breach readiness, processor contracts and accountability evidence.

The ePrivacy Directive sits beside the GDPR for the electronic communications sector. It focuses on confidentiality of communications, traffic data, location data, terminal equipment access, cookies, subscriber directories and unsolicited communications. It is especially relevant for websites, telecom services, electronic marketing, tracking technologies and communications metadata.

The Data Governance Act is a trust framework for data sharing. It deals with the re-use of protected public sector data, data intermediation services and data altruism. It is important for organisations building data marketplaces, data pools, data sharing ecosystems, public-interest data projects or public sector data access workflows.

The Data Act deals with fair access to and use of data, especially data generated by connected products and related services. It gives users rights to access and share certain product and service data, regulates business-to-business data access terms, addresses unfair contractual terms, provides for business-to-government access in exceptional need, and supports switching between data processing services.

The Artificial Intelligence Act creates a risk-based framework for AI systems. It prohibits certain AI practices, regulates high-risk AI systems, imposes transparency duties for certain AI uses, regulates general-purpose AI models, and creates governance, market surveillance and penalty mechanisms.

The Digital Services Act regulates intermediary services, hosting services, online platforms, online marketplaces, very large online platforms and very large online search engines. It covers notice-and-action mechanisms, transparency reporting, internal complaints, trusted flaggers, advertising transparency, recommender systems, protection of minors, risk assessments and supervisory structures.

How these laws work together

The EU framework should not be read as a set of disconnected compliance checklists. A single digital product can trigger several EU laws at the same time. A connected device may generate product data under the Data Act, process personal data under the GDPR, use cookies or terminal access under the ePrivacy Directive, and include AI functionality that must be assessed under the AI Act.

An online platform may need DSA processes for illegal content and platform transparency, GDPR controls for user data and profiling, ePrivacy consent for tracking technologies, and AI Act review if it deploys AI systems for recommender systems, moderation, ranking, verification or other regulated uses. A data sharing platform may need to assess whether it is a data intermediation service under the Data Governance Act while also managing GDPR roles, lawful basis, contracts and security.

The practical point is simple: the EU does not regulate digital activity only through privacy notices. It expects organisations to understand data flows, system design, user rights, automated decision-making, access controls, security risks, platform processes, vendor roles, transparency duties and governance evidence.

GDPR remains the anchor

Even where a newer EU digital law applies, the GDPR often remains the legal anchor whenever personal data is involved. The Data Governance Act does not create a new lawful basis for processing personal data. The Data Act does not override the need for a GDPR lawful basis when personal data is accessed or shared. The AI Act does not replace GDPR duties when AI systems process personal data. The DSA also sits alongside EU data protection and ePrivacy rules.

This means organisations should first identify whether personal data is involved. If it is, they should document controller and processor roles, lawful basis, transparency, rights handling, retention, security, transfers and DPIA needs. The additional EU law then adds sector-specific or activity-specific obligations on top of that foundation.

The EU framework is role-based

Different obligations apply depending on the role an organisation plays. Under the GDPR, the question is whether the organisation is a controller, processor, joint controller or recipient. Under the Data Governance Act, the organisation may be a public sector body, re-user, data intermediation services provider or recognised data altruism organisation. Under the Data Act, the organisation may be a user, data holder, data recipient, manufacturer, provider of a related service or provider of a data processing service.

The same logic appears in the AI Act and DSA. The AI Act distinguishes providers, deployers, importers, distributors and other operators. The DSA distinguishes intermediary services, hosting services, online platforms, marketplaces, very large online platforms and very large online search engines. A compliance programme that does not classify roles correctly will usually miss obligations.

What organisations should prioritise

Start with a data and system map. Identify personal data, non-personal data, connected-product data, related service data, communications data, location data, cookies, AI systems, platform features, recommender systems, advertising systems, marketplaces, vendors and cross-border transfers. Then map the legal role attached to each activity.

Next, build shared controls. EU compliance is easier when privacy, product, AI, security, engineering, platform policy, procurement and legal teams work from the same evidence base. Notices, consent records, terms, data access workflows, AI documentation, platform moderation logs, vendor contracts, breach procedures, risk assessments and user-rights channels should not be maintained in isolation.

Finally, treat documentation as operational evidence. The EU model expects organisations to prove how decisions were made: why data was collected, why an AI system was classified a certain way, how a platform handled a notice, why a data access request was accepted or refused, how a cookie choice was captured, and how a high-risk processing activity was assessed.

How to use the individual EU law pages

Use the GDPR page first when the activity involves personal data. Use the ePrivacy Directive page for cookies, tracking technologies, communications confidentiality, traffic data, location data or electronic marketing. Use the Data Governance Act page for protected public sector data re-use, data intermediation and data altruism. Use the Data Act page for connected products, related services, user access to product data, data sharing with third parties, business-to-government data access and cloud switching.

Use the Artificial Intelligence Act page where AI systems or general-purpose AI models are developed, supplied, deployed or integrated into services. Use the Digital Services Act page for hosting services, online platforms, marketplaces, recommender systems, advertising transparency, content moderation and very large platform or search engine duties.