by Markus Wünschelbaum//
In recent years the EU has adopted several acts on online platforms, digital gatekeepers, artificial intelligence, data access and cybersecurity that often apply to processing already governed by the GDPR. Each declares to apply “without prejudice” to the GDPR (Art 2(4)(g) DSA; Recital 37 DMA; Art 1(5) Data Act; Art 2(7) AI Act; Art 2(12) NIS2 Directive). Under the ordinary rules for resolving conflicts between norms, the later and more specific act would prevail. The clause excludes that result without explaining how both regimes can apply to the same processing – which in practice is the decisive question.
Where the legislature resolves a conflict, as in Article 95 GDPR for ePrivacy, the GDPR’s legal bases are unavailable for processing covered by the special regime (C-654/23 Inteligo Media EU:C:2025:871, paras 66 ff.). Otherwise, Article 6 remains applicable, and sectoral law can specify or restrict its terms.
This coordination standard has been indicated almost twenty years ago. Addressing without-prejudice clauses in Promusicae, Advocate General Kokott explained that data protection and other legislative objectives must be balanced proportionately (Opinion of 18 July 2007, C-275/06, EU:C:2007:454, para 49). The digital acts give this established approach renewed practical importance.
The GDPR as a framework for balancing
The Charter of Fundamental Rights ranks above all EU legislation and binds the legislature itself. Article 8 protects personal data, and any limitation must be provided for by law, respect the essence of the right and be proportionate. In applying the GDPR, the right must be balanced against competing rights such as the freedom to conduct a business, freedom of expression and the right to a fair trial (Joined Cases C-92/09 and C-93/09 Volker und Markus Schecke EU:C:2010:662, para 48). The CJEU holds that the mechanisms for this balancing are laid down in the GDPR itself (Case C-667/21 Krankenversicherung Nordrhein EU:C:2023:1022, para 54; Case C-597/19 M.I.C.M. EU:C:2021:492, para 112).
The legislature framed these mechanisms in open terms. Whether an interest is “legitimate” under Article 6(1)(f) cannot be assessed without regard to the legal standards that apply; the reasonable expectation of data subjects is shaped by what the legislation demands from data processors. Article 6(1)(c) and (e) refer expressly to Union or Member State law. The without-prejudice clauses thus keep the GDPR as the framework within which sectoral requirements must be assessed.
What counts as law
The CJEU takes a functional approach to the sources that may be taken into account. Since Opinion 1/15, a measure is “provided for by law” if it is accessible and its application foreseeable, whatever its form (Opinion 1/15 EU–Canada PNR Agreement EU:C:2017:592, paras 145 f.). The legislature adopted this understanding in Recital 41 GDPR, and the Court has accepted national case law as part of a legal basis under Article 6(3) GDPR (Joined Cases C-17/22 and C-18/22 Neunte Immobilien Portfolio EU:C:2024:738, paras 68, 71–73, 77; Case C-710/23 L.H. v Ministerstvo zdravotnictví EU:C:2025:231, paras 44 f.). In Roos, the General Court and, on appeal, the Court of Justice understood “law” in a functional sense, covering unwritten law and instruments of lower rank (cf. Case T-710/21 Roos and Others v Parliament EU:T:2022:262, paras 81, 84; Case C-458/22 P Roos and Others v Parliament EU:C:2023:871, para 61).
The Court confirmed this approach most recently in NTH Haustechnik (Case C-484/24 NTH Haustechnik EU:C:2026:496): The CJEU accepted that case law as the basis of the court’s legal obligation under Article 6(1)(c) GDPR. The case law must be clear, precise and foreseeable, must itself set out the conditions of use, and must serve an objective of public interest and be proportionate to it (NTH Haustechnik, C-484/24, paras 74–80).
Thus the standard depends on the function of the source. A source serving as the legal basis for an interference, even an unwritten one, must itself define the scope of that interference (Case C-419/14 WebMindLicenses EU:C:2015:832, para 81; Opinion 1/15, para 139; NTH Haustechnik, C-484/24, paras 71, 79). A source serving as a safeguard, as under Article 9(2)(g) GDPR, is measured by the effectiveness of the protection it affords (Case T-451/20 Meta Platforms Ireland v Commission EU:T:2023:276, paras 212 f.). The requirements are lowest where sectoral law supplies a value judgement for the balancing of interests, since the legal basis then results from the balancing under the GDPR itself (Joined Cases C-26/22 and C-64/22 SCHUFA Holding EU:C:2023:958, paras 97 ff.).
Three forms of coordination in the digital acts
The EU legislature has used this openness in three forms. Each has a different consequence for the GDPR assessment.
(1) Sectoral law can establish legal obligations. Recital 121 NIS2 identifies cybersecurity duties as legal obligations under Article 6(1)(c) GDPR. The legislature performs the balancing, while controllers must limit processing to what the obligation requires (NTH Haustechnik, paras 99–102).
(2) Sectoral law can supply value judgements for the balancing. Under the DSA’s researcher-access rules, platforms disclose data under a legal obligation. Researchers rely on public or legitimate interest, informed by the legislature’s recognition of research (Delegated Regulation under Art 40(13) DSA, C(2025) 4340 final, recitals 15, 30).
(3) Sectoral law can narrow the available legal bases. Article 5(2) DMA requires consent for specified combinations of personal data across services, excluding contract and legitimate interest. In Meta v Bundeskartellamt, the CJEU interpreted those bases narrowly for dominant undertakings, consistently with the DMA’s assessment (C-252/21 EU:C:2023:537, paras 98 ff., 115 ff., 147 ff.).
The Court otherwise prohibits altering the catalogue of legal bases or predetermining balancing for all cases (Joined Cases C-468/10 and C-469/10 ASNEF EU:C:2011:777, paras 30–35, 48; C-582/14 Breyer EU:C:2016:779, para 62; NTH Haustechnik, para 83). Article 5(2) DMA is best understood as an accepted exception.
The Charter as the outer limit
Sectoral law may not encroach on the essence of Article 8 of the Charter. Access and rectification retain a protected core, although legislation may regulate their exercise (C-131/12 Google Spain EU:C:2014:317, paras 81, 97; C-136/17 GC EU:C:2019:773, para 66).
Controllership cannot be excluded absolutely either. Russmedia Digital confirms that a hosting liability privilege does not remove GDPR responsibilities: safeguards for publishing sensitive data must be built into the service in advance. A privilege conditional on knowledge of specific content cannot discharge that obligation (C-492/23 EU:C:2025:935, paras 90, 95 f., 106, 126).
Proportionality also remains binding. Broadly defined purposes cannot justify general and indiscriminate collection (C-268/21 Norra Stockholm Bygg EU:C:2023:145, para 54; C-175/20 SS EU:C:2022:124, para 74).
A three-step test for practice
In practice this leads to a three-step approach when reconciling digital regulation with GDPR: identify the function the sectoral rule or other law (functionally speaking) performs, check whether it meets the standard required for that function, and assess whether it respects the Charter’s limits.
If these requirements are met, without-prejudice clauses do not preclude the rule’s influence on the GDPR. Controllers subject to the digital acts must take their obligations and value judgements into account when assessing processing under the GDPR.
In practice, this calls for a coordination reflex: when a GDPR question arises, first ask what the relevant sectoral law contributes to the answer.
* Dr. Markus Wünschelbaum serves as Policy and Digital Strategy Advisor at the Hamburg Data Protection Authority. The views expressed are the author’s own and do not necessarily reflect those of the Hamburg DPA. A fuller account of this argument, with further references, appears in M. Wünschelbaum, “Die Unberührtheit des Datenschutzrechts als Koordinationsprinzip”, Neue Juristische Wochenschrift (NJW) 2026, p. 950; reasons for the broader necessity of this thinking can also be found in the policy publication “The Bridge Blueprint v.0.9.”