The GDPR is based on the fundamental right to data protection (Art. 8 CFR; Art. 16 TFEU). According to pure doctrine, any processing of personal data is an interference with this fundamental right.

However, the fundamental right to data protection alone does not provide any indication as to when such an interference is justified. This can only be determined when another protected interest is added. The Data Protection Directive 95/46 still saw this protected interest "in particular" in the privacy of natural persons.

The GDPR cannot decide on a concrete object of protection. It no longer even mentions the fundamental right to private life. Instead, the GDPR postulates that it protects "the fundamental rights and freedoms" of natural persons (Article 1(2)). The term "(fundamental) rights and freedoms" is mentioned 77 times in the GDPR, whereby the rights and freedoms of data subjects, the rights and freedoms of natural persons and the rights and freedoms of other persons (i.e. also those of the controller) are protected.

However, if the GDPR is to protect all rights and freedoms, this leads to an excessive demand on controllers, at least in private law transactions, because they would theoretically have to take all fundamental rights and freedoms into account in all 68 obligations and in all 82 balancing tests of the GDPR. Moreover, the uncertainty about the object of protection leads to disappointment among data subjects if their expectation that the GDPR will protect all their rights cannot be met.

What role the right to informational self-determination, which is central to the German data protection tradition, will still play in the future is unclear. The German courts continue to uphold the right to informational self-determination, although the Charter of Fundamental Rights, the European Convention on Human Rights, the European Court of Justice and the GDPR do not recognise this fundamental right.

Whether and to what extent the fundamental right to data protection is an independent fundamental right or a fundamental right that must be supplemented by another fundamental right (Marsch: "combined fundamental right") is not apparent from the GDPR. The fundamental right to private life (Article 7 CFR) is regularly cited by the ECJ together with the fundamental right to data protection. However, the relationship between the two fundamental rights is unclear. Many data protectionists see the fundamental right to data protection as an independent fundamental right.

The question of what is protected cannot be left unanswered, because almost every question of interpretation of the GDPR depends on the protective purpose of the specific norm.