protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data; and

ensure that the exchange of personal data by competent authorities within the Union, where such exchange is required by Union or Member State law, is neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.

in the course of an activity which falls outside the scope of Union law;

by the Union institutions, bodies, offices and agencies.

processed lawfully and fairly;

collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;

adequate, relevant and not excessive in relation to the purposes for which they are processed;

accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

the controller is authorised to process such personal data for such a purpose in accordance with Union or Member State law; and

processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.

charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested; or

refuse to act on the request.

the identity and the contact details of the controller;

the contact details of the data protection officer, where applicable;

the purposes of the processing for which the personal data are intended;

the right to lodge a complaint with a supervisory authority and the contact details of the supervisory authority;

the existence of the right to request from the controller access to and rectification or erasure of personal data and restriction of processing of the personal data concerning the data subject.

the legal basis for the processing;

the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine that period;

where applicable, the categories of recipients of the personal data, including in third countries or international organisations;

where necessary, further information, in particular where the personal data are collected without the knowledge of the data subject.

avoid obstructing official or legal inquiries, investigations or procedures;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

protect national security;

protect the rights and freedoms of others.

avoid obstructing official or legal inquiries, investigations or procedures;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

protect national security;

protect the rights and freedoms of others.

the accuracy of the personal data is contested by the data subject and their accuracy or inaccuracy cannot be ascertained; or

the personal data must be maintained for the purposes of evidence.

avoid obstructing official or legal inquiries, investigations or procedures;

avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

protect public security;

protect national security;

protect the rights and freedoms of others.

the transfer is necessary for the purposes set out in Article 1(1);

the personal data are transferred to a controller in a third country or international organisation that is an authority competent for the purposes referred to in Article 1(1);

where personal data are transmitted or made available from another Member State, that Member State has given its prior authorisation to the transfer in accordance with its national law;

the Commission has adopted an adequacy decision pursuant to Article 36, or, in the absence of such a decision, appropriate safeguards have been provided or exist pursuant to Article 37, or, in the absence of an adequacy decision pursuant to Article 36 and of appropriate safeguards in accordance with Article 37, derogations for specific situations apply pursuant to Article 38; and

in the case of an onward transfer to another third country or international organisation, the competent authority that carried out the original transfer or another competent authority of the same Member State authorises the onward transfer, after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the personal data was originally transferred and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred.

the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are transferred;

the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with data protection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and

the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.

appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or

the controller has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with regard to the protection of personal data.

in order to protect the vital interests of the data subject or another person;

to safeguard legitimate interests of the data subject, where the law of the Member State transferring the personal data so provides;

for the prevention of an immediate and serious threat to public security of a Member State or a third country;

in individual cases for the purposes set out in Article 1(1); or

in an individual case for the establishment, exercise or defence of legal claims relating to the purposes set out in Article 1(1).

the transfer is strictly necessary for the performance of a task of the transferring competent authority as provided for by Union or Member State law for the purposes set out in Article 1(1);

the transferring competent authority determines that no fundamental rights and freedoms of the data subject concerned override the public interest necessitating the transfer in the case at hand;

the transferring competent authority considers that the transfer to an authority that is competent for the purposes referred to in Article 1(1) in the third country is ineffective or inappropriate, in particular because the transfer cannot be achieved in good time;

the authority that is competent for the purposes referred to in Article 1(1) in the third country is informed without undue delay, unless this is ineffective or inappropriate;

the transferring competent authority informs the recipient of the specified purpose or purposes for which the personal data are only to be processed by the latter provided that such processing is necessary.

it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

compliance with the request would infringe this Directive or Union or Member State law to which the supervisory authority receiving the request is subject.

advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Directive;

examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Directive and issue guidelines, recommendations and best practices in order to encourage consistent application of this Directive;

draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 47(1) and (3);

issue guidelines, recommendations and best practices in accordance with point (b) of this subparagraph for establishing personal data breaches and determining the undue delay referred to in Article 30(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach;

issue guidelines, recommendations and best practices in accordance with point (b) of this subparagraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons as referred to in Article 31(1);

review the practical application of the guidelines, recommendations and best practices;

provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country, a territory or one or more specified sectors within a third country, or an international organisation, including for the assessment whether such a third country, territory, specified sector, or international organisation no longer ensures an adequate level of protection;

promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations;

promote the exchange of knowledge and documentation on data protection law and practice with data protection supervisory authorities worldwide.