Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the protection of natural persons with regard to the processing of personal data and the rules relating to the free movement of personal data.
This recital of the General Data Protection Regulation clarifies article 1 GDPR (Subject-matter and objectives).*