Study & verify
Every provision in the portal, in one place. Two jobs that turn out to be the same job: learning what the law actually says, and checking that what we wrote about it is true.
Verification progress
0 of 48 checked by a humanNothing ships to real users until this reaches the whole corpus. An unverified text is a claim nobody has stood behind yet.
How to verify one provision
- Open the primary source with the link on the card. Read the article itself, not a summary of it.
- Compare it with our plain-language text line by line. Look for three failures: a claim the article does not make, a condition or exception we dropped, and a deadline or number that does not match.
- Fix the text in the corresponding lib/spine file if it is wrong. If it is right, leave it alone.
- Add the verification to that entry: the date, your name, and a short note on what you checked. Only add it if you actually opened the source.
This is also the fastest way to learn the material. You do not remember an article you skimmed; you remember one you had to check somebody else's summary against.
48 provisions
Lawful basis for processing
GDPR Art. 6 · CELEX 32016R0679 ↗Show what it says
An organisation may process your personal data only if it has one of six lawful bases: your consent; performance of a contract with you; a legal obligation; protecting someone's vital interests; a task in the public interest; or its own legitimate interests, weighed against your rights and freedoms. It must settle on the basis before processing starts and tell you which one it relies on. Public authorities cannot invoke legitimate interests for their official tasks, and a basis cannot be swapped afterwards to rescue a use you have challenged.
Not yet checked by a humanSpecial categories of data (sensitive data)
GDPR Art. 9 · CELEX 32016R0679 ↗Show what it says
Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership — together with genetic data, biometric data used to identify you, and data about health, sex life or sexual orientation — may not be processed at all by default. It becomes lawful only under a narrow exception: most often your explicit consent, employment or social-security law, a vital interest, information you have manifestly made public yourself, legal claims, or healthcare delivered by someone bound by professional secrecy. Ordinary consent buried in terms of service is not enough here — it must be explicit.
Not yet checked by a humanWhat they must tell you (information duty)
GDPR Art. 13, Art. 14 · CELEX 32016R0679 ↗Show what it says
An organisation must tell you on its own initiative — you should not have to ask — who it is, why it processes your data, on which lawful basis, who receives the data, how long it keeps it, whether it goes outside the EU, whether decisions about you are automated, and what rights you have, including withdrawing consent and complaining to a supervisory authority. If it collected your data from you directly, this must come at the moment of collection. If it obtained your data from somewhere else — a broker, a public register, another company — it must also tell you the source, within a reasonable period and at the latest one month, or at its first communication with you if that comes sooner.
Not yet checked by a humanRight of access
GDPR Art. 15 · CELEX 32016R0679 ↗Show what it says
You can ask any company or organisation whether it processes your personal data and get a copy of that data, plus the purposes, categories, recipients, storage period and source. The response is due within one month (extendable by two further months for complex requests, Art. 12(3)) and is free of charge in most cases.
Not yet checked by a humanRight to rectification
GDPR Art. 16 · CELEX 32016R0679 ↗Show what it says
You can require an organisation to correct inaccurate personal data about you, and to complete incomplete data, without undue delay.
Not yet checked by a humanRight to erasure ("right to be forgotten")
GDPR Art. 17 · CELEX 32016R0679 ↗Show what it says
You can ask for your personal data to be deleted, and the organisation must comply without undue delay — unless an exception applies, such as a legal obligation to keep the data (e.g. tax records), freedom of expression, or defending legal claims. A refusal must state its grounds; "we just don't want to" is not one.
Not yet checked by a humanRight to data portability
GDPR Art. 20 · CELEX 32016R0679 ↗Show what it says
You can receive the personal data you provided to a service in a structured, commonly used, machine-readable format and move it to another provider. It covers data processed by automated means on the basis of consent or contract; direct provider-to-provider transfer only where technically feasible.
Not yet checked by a humanRight to object
GDPR Art. 21 · CELEX 32016R0679 ↗Show what it says
You can object to processing based on "legitimate interests" and to any processing for direct marketing. For direct marketing the organisation must simply stop; otherwise it must stop unless it demonstrates compelling legitimate grounds overriding your rights.
Not yet checked by a humanRight to restriction of processing
GDPR Art. 18 · CELEX 32016R0679 ↗Show what it says
Instead of deletion you can demand that processing be frozen: the organisation may keep storing your data but must otherwise leave it alone. You can require this while it verifies data you say is inaccurate, when the processing is unlawful but you prefer restriction to erasure, when it no longer needs the data but you still need it for a legal claim, or while your objection under Article 21 is being assessed. During a restriction, anything beyond storage is allowed only with your consent, for legal claims, to protect someone else's rights, or for important public interest — and the organisation must tell you before it lifts the restriction.
Not yet checked by a humanAutomated decisions and profiling
GDPR Art. 22 · CELEX 32016R0679 ↗Show what it says
You have the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects concerning you or similarly significantly affects you — an automatic loan refusal, an algorithmic rejection of a job application, an automated account closure. Such a decision is permitted only where it is necessary for a contract, authorised by Union or national law with safeguards, or based on your explicit consent; in the contract and consent cases you can always demand human intervention, put your own point of view, and contest the outcome. A score produced by a credit-reference agency can itself count as such a decision where the company receiving it draws heavily on it (CJEU, SCHUFA, C-634/21).
Not yet checked by a humanValid consent
GDPR Art. 7, Art. 4(11) · CELEX 32016R0679 ↗Show what it says
Consent must be freely given, specific, informed and unambiguous, expressed by a clear affirmative act. Pre-ticked boxes are not valid consent (CJEU, Planet49, C-673/17). Withdrawing consent must be as easy as giving it — a hidden or multi-step "reject" next to a one-click "accept" fails this test.
Not yet checked by a humanTransparency at work (employee monitoring)
GDPR Art. 5(1)(a), Art. 88 · CELEX 32016R0679 ↗Show what it says
Personal data must be processed lawfully, fairly and transparently — covert monitoring of employees is very rarely lawful, and you must normally be informed before monitoring starts. The detailed rules for employment data are set nationally under Article 88, so they differ between member states: check your country's rules or ask the labour inspectorate.
Not yet checked by a humanResponse obligations and deadlines
GDPR Art. 12 · CELEX 32016R0679 ↗Show what it says
When you exercise a data right, the organisation must respond without undue delay and at the latest within one month (extendable by two further months for complex cases — it must tell you about the extension). If it refuses, it must state its reasons and inform you of your right to complain to a Data Protection Authority and to seek a judicial remedy. Communication must be concise, transparent and in plain language.
Not yet checked by a humanExceptions to erasure
GDPR Art. 17(3) · CELEX 32016R0679 ↗Show what it says
Erasure can be lawfully refused only where the processing is needed for: freedom of expression and information; compliance with a legal obligation or a public-interest task; public health; archiving in the public interest, scientific or historical research, or statistics; or establishing, exercising or defending legal claims. The company must say which exception it relies on — a bare refusal is not enough.
Not yet checked by a humanRight to complain to a supervisory authority
GDPR Art. 77 · CELEX 32016R0679 ↗Show what it says
If you believe your data protection rights have been violated, you can lodge a complaint with a Data Protection Authority — in the member state where you live, where you work, or where the violation happened. It is free of charge and does not require a lawyer.
Not yet checked by a humanData breaches — who must be told, and when
GDPR Art. 33, Art. 34 · CELEX 32016R0679 ↗Show what it says
When personal data is breached — leaked, stolen, altered or lost — the organisation must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people's rights at risk. Where the breach is likely to result in a high risk to you personally, it must also tell you directly and without undue delay, in plain language: what happened, the likely consequences, and what it is doing in response. It may skip telling you only if the data was unintelligible to whoever took it (properly encrypted, for instance), if it has since taken steps that remove the high risk, or — where individual notice would take disproportionate effort — by making a public announcement instead.
Not yet checked by a humanGoing to court and claiming compensation
GDPR Art. 79, Art. 82 · CELEX 32016R0679 ↗Show what it says
Besides complaining to an authority, you can take the organisation to court directly — before the courts of the member state where it is established or where you habitually live — and claim compensation for material damage (money you actually lost) or non-material damage (such as distress). The organisation escapes liability only if it proves it was in no way responsible for the harm. An infringement on its own does not automatically entitle you to money: you have to show that damage actually occurred, though there is no minimum severity it has to reach (CJEU, Österreichische Post, C-300/21). Complaining to the authority and suing are independent routes — you can do both.
Not yet checked by a humanReporting illegal content (notice and action)
DSA Art. 16 · CELEX 32022R2065 ↗Show what it says
Any hosting service must give you an easy, electronic way to report content you consider illegal. It must confirm receipt of your report, tell you its decision, and say whether automated tools were used. Reporting is free.
Not yet checked by a humanStatement of reasons for moderation decisions
DSA Art. 17 · CELEX 32022R2065 ↗Show what it says
If a platform removes or demotes your content, suspends or terminates your account, or demonetises you, it must give you a statement of reasons: which restriction it applied, the facts behind it, whether the decision was automated, which law or which term of service you allegedly breached, and how to appeal (Art. 17(3)). A silent ban is itself a violation.
Not yet checked by a humanFree internal appeal
DSA Art. 20 · CELEX 32022R2065 ↗Show what it says
Online platforms must run a free internal complaint system: you can appeal a moderation decision for at least six months, the review cannot be wholly automated, and an unjustified decision must be reversed. The smallest platforms (micro and small enterprises) are exempt.
Not yet checked by a humanOut-of-court dispute settlement
DSA Art. 21 · CELEX 32022R2065 ↗Show what it says
If the internal appeal fails, you can take the dispute to a certified out-of-court settlement body — free or at a nominal fee for you, and the platform must engage in good faith. Honest limit: the body's decision is not binding on the platform; going to court always remains open.
Not yet checked by a humanRecommender systems: transparency and opt-out
DSA Art. 27, Art. 38 · CELEX 32022R2065 ↗Show what it says
Platforms must explain in plain language the main parameters of their recommender feeds and any options you have to change them (Art. 27). The largest platforms (VLOPs) must additionally offer at least one feed option that is not based on profiling you (Art. 38).
Not yet checked by a humanComplaint to the Digital Services Coordinator
DSA Art. 53 · CELEX 32022R2065 ↗Show what it says
You can lodge a complaint against a platform with the Digital Services Coordinator of the member state where you are located, alleging an infringement of the DSA — free of charge. The Coordinator is the DSA's analog of a Data Protection Authority.
Not yet checked by a humanGatekeeper platforms: defaults, uninstalling, interoperability
DMA Art. 6, Art. 7 · CELEX 32022R1925 ↗Show what it says
Companies formally designated as "gatekeepers" must let you uninstall preinstalled apps, change defaults via choice screens for browsers and search engines, install third-party apps and app stores, and — for the biggest messaging services — respond to interoperability requests. Honest limit: these duties bind only the designated gatekeepers, not every platform.
Not yet checked by a humanProhibited AI practices
AI Act Art. 5 · CELEX 32024R1689 ↗Show what it says
Since 2 February 2025 the AI Act bans certain uses outright: social scoring by or for public authorities, exploiting people's vulnerabilities, untargeted scraping of facial images, and emotion recognition at work and in education (with narrow safety and medical exceptions).
Not yet checked by a humanYou must be told it's AI
AI Act Art. 50 · CELEX 32024R1689 ↗Show what it says
AI systems that interact with people must disclose it where it isn't obvious, and AI-generated or AI-manipulated content ("deepfakes") must be labeled, including in a machine-readable way. Honest timing note: these transparency duties apply from 2 August 2026.
Not yet checked by a humanAI complaints and the right to an explanation
AI Act Art. 85, Art. 86 · CELEX 32024R1689 ↗Show what it says
From 2 August 2026 you can complain about an AI system to your national market surveillance authority (Art. 85), and where a decision with legal or similarly significant effects on you was based on the output of a high-risk AI system, you have the right to a clear and meaningful explanation (Art. 86).
Not yet checked by a humanYou are presumed to be an employee
Platform Work Art. 5 · CELEX 32024L2831 ↗Show what it says
Where the facts show direction and control by the platform, the relationship is legally presumed to be employment — and it is the platform, not you, that has to prove otherwise. This reverses the usual burden of proof: you no longer have to build the case that you were really an employee. It applies in relevant administrative and judicial proceedings from 2 December 2026; before that date the national law of your country still decides, and member states may set the rules out differently when they transpose.
Not yet checked by a humanWhat the platform is forbidden to collect
Platform Work Art. 7 · CELEX 32024L2831 ↗Show what it says
Automated monitoring and decision-making systems may not process data on your emotional or psychological state, may not intrude on your private conversations, and may not collect data while you are not working or offering work. They also may not try to predict whether you will exercise fundamental rights — such as joining a union — or infer protected characteristics like race, migration status, health or political views. Identifying you biometrically out of a crowd is prohibited; verifying that you are you, one-to-one, is not.
Not yet checked by a humanWhat they must tell you about the algorithm
Platform Work Art. 9 · CELEX 32024L2831 ↗Show what it says
The platform must tell you, in writing and before your first working day, which of your data and actions are monitored, why, who receives that data, what categories of decision the systems take, which parameters influence those decisions — and on what grounds an account can be restricted, suspended or terminated. It must tell you again before any change that affects your working conditions, and on request. You get the details of the systems that affect you directly; the fuller picture goes to worker representatives and the authorities on request.
Not yet checked by a humanA human must decide to block you
Platform Work Art. 10 · CELEX 32024L2831 ↗Show what it says
Any decision to restrict, suspend or terminate your account or your contract must be taken by a human being — not by the system alone. The platform must also monitor its automated systems and assess their impact on working conditions at least every two years, together with worker representatives, and the staff doing that oversight must be competent, trained and actually empowered to override an automated decision, with protection from being dismissed for doing so. Where the review finds a high risk of discrimination or of infringing rights, the system must be changed or dropped.
Not yet checked by a humanGetting an explanation and a review
Platform Work Art. 11 · CELEX 32024L2831 ↗Show what it says
You can require an explanation of any automated decision, without undue delay, and discuss it with a named contact person at the platform. For the decisions that hurt — restricting, suspending or terminating your account, refusing payment, changing your contractual status, or anything with equivalent detriment — the platform must give you written reasons by the day the decision takes effect. You can then ask for a review: the platform has two weeks to reply with substantiated reasons. If the decision turns out to infringe your rights, it must put it right within two weeks or compensate you, and prevent it happening again.
Not yet checked by a humanSafety, pressure and harassment
Platform Work Art. 12 · CELEX 32024L2831 ↗Show what it says
The platform must assess the risks its automated systems create — accidents, psychosocial pressure, ergonomic strain — and check whether its safeguards are adequate, then actually introduce preventive measures. It may not use those systems to put undue pressure on you or otherwise endanger your physical and mental health, and it must have working channels through which violence and harassment can be reported and acted on. If the app pushes you to ride faster to keep your rating, that is the situation this article is about.
Not yet checked by a humanBefore the rules change, they must consult
Platform Work Art. 13, Art. 14 · CELEX 32024L2831 ↗Show what it says
A platform may not introduce or substantially change its automated systems without first informing and consulting worker representatives; on larger platforms — over 250 workers in that member state — it must also pay for the expert help those representatives need to understand what is being proposed. Where there are no representatives, it must inform the workers directly, in writing and in plain, transparent language. In practice this is what turns a silent overnight change to the algorithm into something that has to be announced and argued about first.
Not yet checked by a humanWhen the Charter applies at all
Charter Art. 51 · CELEX 12012P/TXT ↗Show what it says
The Charter binds the EU institutions in everything they do, and binds the member states only when they are implementing EU law — applying an EU regulation, transposing a directive, or otherwise acting within the scope of Union law. A purely national matter with no EU law involved is outside the Charter, however serious it is; there your route is the national constitution and the ECHR. The Charter also does not extend the EU's powers or create new competences (Art. 51(2)).
Not yet checked by a humanHow far a right can be limited
Charter Art. 52 · CELEX 12012P/TXT ↗Show what it says
Charter rights are not all absolute. A limitation is lawful only if it is provided for by law, respects the essence of the right, is genuinely necessary, and is proportionate to an objective of general interest or the protection of others' rights. Where a Charter right corresponds to an ECHR right, its meaning and scope are at least those of the Convention — EU law may go further in protection, never less far (Art. 52(3)).
Not yet checked by a humanRespect for private and family life
Charter Art. 7 · CELEX 12012P/TXT ↗Show what it says
Everyone has the right to respect for their private and family life, home and communications. In EU law this sits next to, but is not the same as, the separate right to data protection in Article 8 — surveillance, searches and interception engage this article even where no personal data file is involved.
Not yet checked by a humanProtection of personal data
Charter Art. 8 · CELEX 12012P/TXT ↗Show what it says
Personal data must be processed fairly, for specified purposes, and on a legitimate basis laid down by law; everyone has the right to access data collected about them and to have it rectified, under the control of an independent authority. This is the constitutional root of the GDPR — the concrete rights you can actually exercise are in that Regulation, not here.
Not yet checked by a humanFreedom of expression and information
Charter Art. 11 · CELEX 12012P/TXT ↗Show what it says
Everyone has the right to hold opinions and to receive and impart information without interference by public authority and regardless of frontiers; the freedom and pluralism of the media are respected. Against a platform rather than a state, this right mostly bites through EU secondary law — the DSA's rules on content moderation and statements of reasons.
Not yet checked by a humanNon-discrimination
Charter Art. 21 · CELEX 12012P/TXT ↗Show what it says
Discrimination on any ground — including sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political opinion, membership of a national minority, property, birth, disability, age or sexual orientation — is prohibited, as is discrimination on grounds of nationality within the scope of the Treaties. Unlike most Charter provisions, the CJEU has held this one can be relied on directly in a dispute between private parties.
Not yet checked by a humanEffective remedy and fair trial
Charter Art. 47 · CELEX 12012P/TXT ↗Show what it says
Anyone whose EU-law rights are violated has the right to an effective remedy before a tribunal: a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law, with the possibility of advice, defence and representation, and legal aid where needed to ensure effective access to justice. It is broader than its Convention counterparts — it is not limited to civil rights and criminal charges.
Not yet checked by a humanRight to a fair trial
ECHR Art. 6 ↗Show what it says
In the determination of civil rights and obligations or of a criminal charge, everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law, with the presumption of innocence and minimum defence rights in criminal cases. Note the limit: proceedings that are neither civil nor criminal in the Convention sense — many tax and immigration matters — fall outside it.
Not yet checked by a humanRight to respect for private and family life
ECHR Art. 8 ↗Show what it says
Everyone has the right to respect for their private and family life, home and correspondence. A public authority may interfere only where it is in accordance with the law and necessary in a democratic society for one of the listed aims — national security, public safety, the economic well-being of the country, prevention of disorder or crime, protection of health or morals, or the rights of others. In Convention practice this article carries data protection, surveillance and workplace-monitoring cases.
Not yet checked by a humanFreedom of expression
ECHR Art. 10 ↗Show what it says
Everyone has the right to freedom of expression, including to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. The Convention is explicit that exercising it carries duties and responsibilities, so it may be restricted where prescribed by law and necessary in a democratic society — for national security, public safety, preventing disorder or crime, health, morals, the reputation or rights of others, confidential information, or the authority and impartiality of the judiciary.
Not yet checked by a humanRight to an effective remedy
ECHR Art. 13 ↗Show what it says
Anyone whose Convention rights are violated must have an effective remedy before a national authority, even where the violation was committed by people acting officially. This is the article behind the requirement to exhaust domestic remedies before Strasbourg: the national system is supposed to be able to fix it first.
Not yet checked by a humanProhibition of discrimination
ECHR Art. 14 ↗Show what it says
Enjoyment of the Convention rights must be secured without discrimination on any ground such as sex, race, colour, language, religion, political or other opinion, national or social origin, association with a national minority, property, birth or other status. Unlike Charter Article 21, this one is not free-standing: it attaches to another Convention right, so it cannot be invoked on its own (Protocol 12 provides a general ban, but only for the states that ratified it).
Not yet checked by a humanWho may apply to the Court
ECHR Art. 34 ↗Show what it says
Any person, non-governmental organisation or group of individuals claiming to be the victim of a violation by one of the states bound by the Convention may apply to the European Court of Human Rights. "Victim" means personally and directly affected — you cannot complain about a law in the abstract, or on behalf of the public. States undertake not to hinder the exercise of this right.
Not yet checked by a humanAdmissibility conditions
ECHR Art. 35 ↗Show what it says
The Court may deal with a case only after all domestic remedies have been exhausted, and within four months of the final domestic decision. The four-month limit came in with Protocol No. 15 and applies where the final domestic decision was taken on or after 1 February 2022; before that the limit was six months. An application is also inadmissible if it is anonymous, substantially the same as a matter already examined, manifestly ill-founded, or an abuse of the right of application.
Not yet checked by a human