EU law: the sources

Last reviewed: 2026-10-20 · Version: 1.0

What four EU texts say, as far as the EU rules on this page rely on them. Each point is taken from the text itself, linked below it. This page is a summary of the sources, not legal advice: whether a rule applies to your business, and what it asks of you, is for you and your advisers to decide (for personal data, in your DPIA).

GDPR: Regulation (EU) 2016/679

• Applies directly. The GDPR "shall be binding in its entirety and directly applicable in all Member States" (art. 99(2)). It is part of the EEA Agreement through EEA Joint Committee Decision No 154/2018, so it applies in Norway, Iceland and Liechtenstein too.
• National rules. The GDPR leaves room for each country's own rules in set areas, for example the conditions for processing a national identification number (art. 87) and personal data in the employment context (art. 88). Each country provides one or more independent supervisory authorities (art. 51); each country's act and authority are on its country page.
• Processors. Processing by a processor is governed by a contract or other legal act that sets out what the processor may do (art. 28(3)).
• Breach notice. The controller notifies the supervisory authority of a personal data breach "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to people's rights and freedoms (art. 33(1)). The processor notifies the controller without undue delay (art. 33(2)).
• Transfers. A transfer of personal data to a country outside the EU/EEA needs a safeguard under Chapter V, such as an adequacy decision (art. 45) or standard data protection clauses (art. 46).

Source: Regulation (EU) 2016/679 — EUR-Lex; EEA Joint Committee Decision No 154/2018 — EUR-Lex.

AI Act: Regulation (EU) 2024/1689

The AI Act "shall be binding in its entirety and directly applicable in all Member States" (final provisions); it applies in stages under its art. 113. What it means for Fundarem, and its status in Norway and Iceland, is on the AI Act page.

Source: Regulation (EU) 2024/1689 — EUR-Lex.

Schrems II: Case C-311/18, judgment of 16 July 2020

The EU Court of Justice ruled on transfers of personal data to a country outside the EU under GDPR Chapter V:

• Privacy Shield invalid. It declared Commission Implementing Decision (EU) 2016/1250, the EU–US Privacy Shield, invalid.
• Standard contractual clauses valid. It found Commission Decision 2010/87/EU on standard contractual clauses valid.
• A check, case by case. Personal data sent out of the EU must keep a level of protection essentially equivalent to the one in the EU. A controller or processor that relies on standard contractual clauses must verify, case by case, whether the law of the receiving country gives that protection, add safeguards where needed, and otherwise suspend or end the transfer.

Source: Case C-311/18, judgment of 16 July 2020 — CURIA.

NIS2: Directive (EU) 2022/2555

• Who. NIS2 applies to public and private entities of the types listed in its Annex I and Annex II (sectors such as energy, transport, health, digital infrastructure, manufacturing and digital providers) that are medium-sized or larger, and to some entities whatever their size (art. 2).
• A directive. Each country brings it into its own law; the deadline for EU member states was 17 October 2024 (art. 41). Whether it covers a business depends on that national law.
• Duties. Covered entities take cybersecurity risk-management measures (art. 21) and report significant incidents to their CSIRT or competent authority in three stages: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the incident notification (art. 23).

Source: Directive (EU) 2022/2555 — EUR-Lex.