The European Union’s new privacy law, the General Data Protection Regulation (GDPR), is now in effect. This new regulation imposes sweeping privacy protection requirements on any entities that oversee personal data operations or process personal data in the EU. This has the potential to impact companies on an international scale. The new requirements come hand-in-hand with a set of stiff penalties for non-compliance, including punishing fines that can soar to € 20 million or 4% of a company’s annual gross revenue.

Our GDPR Tracker lets you follow regulation updates with ease. We’ve done the research, and we’re keeping you up-to-date on national legislation passed by member states in compliance with the GDPR. While some member states have multiple laws that redirect existing legislation to the new privacy law and GDPR, the laws referenced below detail how each member state has chosen to address the customizable sections of the GDPR, apart from solely setting up the data protection authority. We’ll update this page as more information becomes available. If you’d like to schedule a consultation to discuss how the changes will affect your business, feel free to contact us.

 

EU MemberCurrent StatusName of Proposed/Passed LegislationLast Updated
Austria4. Law PassedEnglish: Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Data Protection Act - DSG)

German: Bundesgesetz zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten (Datenschutzgesetz - DSG)
March 5, 2018
Belgium3. Draft PendingEnglish: Bill concerning the protection of individuals with regard to the processing of personal data.

Dutch: Wetsontwerp betreffende de bescherming van natuurlijke personen met betrekking tot de verwerking van persoonsgegevens.
July 16, 2018
Bulgaria3. Draft PendingEnglish: THE LAW FOR THE PROTECTION OF PERSONAL DATA

Bulgarian: ЗАКОНА ЗА ЗАЩИТА НА ЛИЧНИТЕ ДАННИ
May 23, 2018
Croatia4. Law PassedEnglish: The Law on the Implementation of the General Data Protection Regulation

Croatian: Zakon o provedbi Opće uredbe o zaštiti podataka

May 23, 2018
Cyprus3. Law PassedEnglish: The Law on the Protection of Individuals with regard to the Processing of Personal Data and the Free Movement of such Data Law of 2018 (Law. 125 (I) / 2018)

Greek: Ο περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018 (Ν. 125(I)/2018
September 24, 2018
Czech Republic3. Draft PendingEnglish: Draft Law on the Processing of Personal Data

Czech: Návrh zákona o zpracování osobních údajů
January 24, 2018
Denmark4. Law PassedEnglish: Act on supplementary provisions for a regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Data Protection Act)

Danish: Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (databeskyttelsesloven)
May 25, 2018
Estonia3. Draft PendingEnglish: Personal Data Protection Act

Estonian: Isikuandmete kaitse seadus
January 24, 2018
Finland3. Draft PendingEnglish: Data Protection Act

Finnish: Tietosuojalaki
May 14, 2018
France4. Law PassedEnglish: Law 2018-493 of June 20, 2018 on the protection of personal data (JUSC1732261L)

French: LOI n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles (JUSC1732261L)
July 16, 2018
Germany4. Law PassedEnglish: The Federal Data Protection Act (BDSG)

German: Das Bundesdatenschutzgesetz (BDSG)
January 24, 2018
Greece3. Draft PendingEnglish: Law on the Protection of Personal Data pursuant to Regulation (EU) 2016/679

Greek: Νόμος για την Προστασία Δεδομένων Προσωπικού Χαρακτήρα σε εφαρμογή του Κανονισμού (ΕΕ) 2016/679
May 14, 2018
Hungary3. Draft PendingAct CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act")January 24, 2018
Ireland4. Law PassedData Protection Act 2018May 31, 2018
Italy3. Law PassedEnglish: Legislative Decree 10 August 2018, n. 101.
Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, as well as on the free movement of such data and repealing Directive 95/46 / EC

Italian: Decreto Legislativo 10 agosto 2018, n. 101.
Disposizioni per l'adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2016/679 del Parlamento europeo e del Consiglio, del 27 aprile 2016, relativo alla protezione delle persone fisiche con riguardo al trattamento dei dati personali, nonche' alla libera circolazione di tali dati e che abroga la direttiva 95/46/CE
September 24, 2018
Latvia3. Law PassedEnglish: Personal Data Processing Law

Latvian: Personas datu apstrādes likums
September 24, 2018
Lithuania3. Law PassedEnglish: The Republic of Lithuania Personal Data Legal Protection Law

Lithuanian: LIETUVOS RESPUBLIKOS ASMENS DUOMENŲ TEISINĖS APSAUGOS ĮSTATYMAS
September 24, 2018
Luxembourg3. Law PassedEnglish: Law of 1 August 2018 on the organization of the National Data protection Commission and the implementation of regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing directive 95/46 / EC (General Data protection Regulation)), amending the Labor Code and the amended Act of 25 March 2015 laying down the system of salaries and the conditions and modalities for the promotion of civil servants.

French: Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en oeuvre du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données), portant modification du Code du travail et de la loi modifiée du 25 mars 2015 fixant le régime des traitements et les conditions et modalités d'avancement des fonctionnaires de l'État.
September 24, 2018
Malta4. Law PassedEnglish: Data Protection Act, 2018

Maltese: l-Att tal-2018 dwar il-Protezzjoni u l-Privatezza tad-Data
May 31, 2018
Netherlands4. Law PassedEnglish: Act Implementing the General Data Protection Regulation

Dutch: Uitvoeringswet Algemene verordening gegevensbescherming
May 25, 2018
Poland4. Law PassedEnglish: The Act on the Protection of Personal Data

Polish: Ustawa o ochronie danych osobowych
May 25, 2018
Portugal3. Draft PendingEnglish: Proposed Law 120 / XIII

Portuguese: Proposta de Lei 120/XIII
May 14, 2018
Romania4. Law PassedEnglish: Law no. 190/2018 on measures implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing council Directive 95/46/EC

Romanian: Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 al Parlamentului European și al Consiliului din 27 aprilie 2016 privind protecția persoanelor fizice în ceea ce privește prelucrarea datelor cu caracter personal și privind libera circulație a acestor date și de abrogare a Directivei 95/46/CE (Regulamentul general privind protecția datelor)
August 6, 2018
Slovakia4. Law PassedEnglish: The Personal Data Protection Act and the amendment of certain laws

Slovak: Zákon o ochrane osobných údajov a o zmene a doplnení niektorých zákonov
May 25, 2018
Slovenia3. Draft PendingEnglish: DRAFT LAW ON PROTECTION OF PERSONAL DATA

Slovenian: OSNUTEK ZAKONA O VARSTVU OSEBNIH PODATKOV (ZVOP-2)
January 29, 2018
Spain3. Draft PendingEnglish: Draft Organic Law for the Protection of Personal Data

Spanish: Proyecto de Ley Orgánica de Protección de Datos de Carácter Personal
January 24, 2018
Sweden4. Law PassedEnglish: Law (2018: 218) with additional provisions to the EU Data Protection Ordinance

Swedish: Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning
May 25, 2018
United Kingdom4. Law PassedData Protection Act 2018May 25, 2018

 

Although the requirements to comply with the GDPR seem daunting, you can adopt an incremental approach to compliance that begins with taking concrete steps today. The result will be significant progress to help you advance along the path to achieving compliance and minimizing the risk of sanctions or penalties. Readying your company for compliance with the GDPR is a significant undertaking that requires substantial time and resources.