This course critically evaluates the legal framework applicable to personal data processing. It will be do this predominantly with reference to the EU framework, as this has served as a blueprint for many other global data protection frameworks. However, the legal concepts we will discuss are of universal relevance.