Legislation

Designed to grapple with the realities of global, ubiquitous data in the internet era, the EU’s new data protection legislation should provide increased legal certainty for both individuals and organisations processing data and greater protection for the individual in general.

In this section you will find links to key pieces of current and new data protection legislation.

In particular, the reform of the EU’s data protection rules which began in January 2012, has resulted in three key pieces of legislation:

• a general Regulation on data protection (679/2016 - GDPR) which was adopted on 24 May 2016, applicable as of 25 May 2018;
• a specific Directive (680/2016) on data protection in the area of police and justice, adopted on 5 May 2016, applicable as of 6 May 2018;
• the Regulation (EU) 2018/1725 with regard to the processing of personal data by the Union institutions, bodies, offices and agencies.

Take a look at the history of the General Data Protection Regulation on our GDPR timeline page for more information about its evolution.

Below you will also find a link to the ePrivacy Directive 2002/58/EC which provides additional data protection rules for telecommunications networks and internet services. This Directive is due to be repealed. The European Commission adopted a proposal for a Regulation on 10 January 2017; it is currently under discussion in the European Parliament and the Council of the European Union.

The European Commission adopted the Regulation (EU) 2018/1725 which repealed Regulation (EC) 45/2001 and brings it into line with the GDPR. This Regulation lays down the rules for data protection in the EU institutions - as well as the duties of the European Data Protection Supervisor.

With this comprehensive reform, the EU has a modern framework for protecting privacy and data protection.

Link to the history of the General Data Protection Regulation