Last updated: 19.06.2018!
On May 25, 2018, the GDPR becomes applicable. Many data controllers and data processors are already in the process of preparing for the GDPR. Although there is no need to transpose the GDPR into Member States' respective legislation, since it is directly applicable in all EU Member States, Member States still have to adjust their own data protection laws to the GDPR to make the application run smoothly from next spring (and to transpose Directive 2016/680/EU for the processing of criminal data).
There is considerable uncertainty as to the fact that, in many Member States, there is little indication of exactly how the law of the Member State concerned is compatible with the GDPR. The new, GDPR-compatible data protection law has been issued in Germany first and a bit later, in Austria. Legislation has already begun in other Member States, but in many it is still not known what we can we expect from the legislator. You can find a collection of national laws implementing the GDPR here.
Below we have gathered the status of the implementation process in the 28 Member States of the EU (the table also includes the Member States of the European Economic Area and Switzerland, which are also planning legislative steps with regard to the GDPR).
|
Member State |
Status of the implementation |
Notes |
| Austria | The new national Data Protection Act implementing the GDPR had been adopted and it was published on July 31, 2017. |
The new Austrian Data Protection Act (Datenschutzgesetz – DSG) is available here in German. A summary in English is available here. |
| Belgium |
A new Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité pour la protection des données) was created to replace the Privacy Commission. (Updated on 23.01.2018) (Draft bills were published as of August 23, 2017.) |
The act is available here in French and Dutch. A short summary regarding the new Belgian Data Protection Authority is available here. (Updated on 23.01.2018) (The draft bills are available here in French and Dutch.) |
| Bulgaria |
We are not aware of any publicly available draft bills. |
According to this short summary in English, derogations from the GDPR are planned in Bulgaria. (Updated on 21.05.2018.) |
| Croatia |
The Act on Implementation of the General Data Protection Regulation (NN 42/2018) was published on May 10, 2018. (Updated on 21.05.2018.) |
The act is available here in Croatian. A short summary is available here in English. (Updated on 21.05.2018.) |
| Cyprus |
A darft bill was published. (Updated on 16.06.2018.) |
The draft bill is available here in Greek. (Updated on 16.06.2018.) |
| Czech Republic |
A draft bill was published in September. |
A short summary is available here in English. |
| Denmark |
The new Data Protection Act was passed. (Updated on 16.06.2018.) (The draft bills regarding the GDPR implementation were submitted to the Parliament on October 25, 2017.) (Updated on 22.12.2017) |
The new Data Protection Act is available here in Danish. A summary is available here in English. (Updated on 16.06.2018.) (The draft bills are available here and here in Danish.) (Updated on 22.12.2017) |
| Estonia |
We are not aware of any publicly available draft bills. |
|
| Finland |
In February 2016, the Ministry of Justice set up a working group whose main task was to prepare a legislative proposal on the “implementation”. According to the Working Party’s proposal, the Personal Data Act should be repealed and a new General Data Protection Act, which supplements the GDPR, should be approved. |
The Working Party’s report and proposal is available in Finnish here. |
| France |
The French National Assembly (Assemblée National) adopted the new draft data protection act at first reading on February 9. After a second approval, the draft will be sent to the Senate. (Updated on 14.02.2018) In France, before the entry into force of the GDPR, legislation was adopted that incorporated certain elements of the GDPR into French law. |
The new draft data protection act is available here in French. A summary is available here in English. (Updated on 14.02.2018) A summary regarding the former amendment of the respective data protection rules is available here in English. |
| Germany | Germany was the first EU Member State that approved its law implementing the GDPR. (It was published on July 5, 2017.) |
The new Data Protection Act is available in German and in English. A summary is available here in English. |
| Greece |
We are not aware of any publicly available draft bills. |
|
| Hungary |
A bill regarding the amendment to the Hungarian Data Protection Act was submitted to the Hungarian Parliament on June 19. This bill also conatins the rules necessary for the implementation of Directive 2016/680. (Updated on 19.06.2018) An amendment to the Hungarian Data Protection Act was submitted to the Hungarian Parliament on May 29. This bill conatins only a few provisions necessary for the designation of the Hungarian Data Protection Authority as the authority responsible for the enforcement of the GDPR. However, further modifications are necessary that can be expected later this year. (Updated on 03.06.2018) The first draft of the amendment of the Hungarian Data Protection Act and some other relevant laws related to the GDPR were released at the end of August. According to the plans, the bill will be submitted to the Hungarian Parliament in February and the approval by the Parliament is expected to take place during spring 2018. (Updated on 22.12.2017) |
The bill of June 18, 2018 is available here in Hungarian. A short summary is available here in English. (Updated on 19.06.2018)
The draft of May 29, 2018 is available here in Hungarian. (Updated on 03.06.2018)
The proposal dated August 2017 is available here in Hungarian. (Updated on 22.12.2017) Please also see our former blogpost regarding this topic. |
| Ireland |
The new Data Protection Act 2018 was passed. (Updated on 16.06.2018) (The Irish Government published Data Protection Bill 2018. The legislation process is ongoing. (Updated on 17.02.2018) A General Scheme of the Data Protection Bill 2017 was published in May.) |
The Data Protection Act 2018 is available here. (Updated on 16.06.2018) (The Data Protection Bill 2018 is available here. A summary is available here in English. (Updated on 17.02.2018) The General Scheme of the Data Protection Bill 2017 is available here.) |
| Italy |
We are not aware of any publicly available draft bills. |
|
| Latvia |
A draft bill was published as of September 13, 2017. |
The draft bill is available here in Latvian. |
| Lithuania | A draft bill was published in June. | The draft bill is available here in Lithuanian. |
| Luxemburg |
The bill has been submitted to the Parliament as of September 12, 2017. |
The bill is available here in French. |
| Malta |
We are not aware of any publicly available draft bills. |
|
| Netherlands |
The new act was published. (Updated on 25.05.2018) (A draft bill was submitted to the Parliament in December 2017.) |
The new act is available here in Dutch. (Updated on 25.05.2018) (The draft bill is available here in Dutch. A short summary is available here in English. The former draft published in December 2016 is available here. A short summary regarding this first draft is available here in English.) |
| Poland |
Drafts regarding the implementation of the GDPR in Poland were published on September 14, 2017. |
A summary is available here in English. |
| Portugal |
We are not aware of any publicly available draft bills. |
|
| Romania |
A draft bill was published on September 5, 2017. |
The draft bill is available here in Romanian. |
| Slovakia |
The new Slovakian Data Protection Act (no. 18/2018 Coll.) was published on January 30. 2018. (Updated on 11.04.2018) |
The act is available here in Slovakian. A short summary is available here in English. (Updated on 11.04.2018) (The draft bill is available here in Slovakian.) |
| Slovenia |
The draft bill has been published. (Updated on 24.01.2018) |
The draft bill is available here in Slovenian. (Updated on 24.01.2018) |
| Spain |
The Council of Ministers approved the draft bill in November 2017. (Updated on 03.02.2018) |
The draft bill is available here in Spanish. A summary regarding the main points of the draft bill is available here in English. (Updated on 03.02.2018) (A summary of a former version of the draft bill is available here in English.) |
| Sweden |
An act has been approved on April 19, 2018. (Updated on 21.05.2018) (A report and a draft bill were published in May 2017.) |
The acts is available here in Swedish. (Updated on 21.05.2018) (The report is available here in Swedish.) |
| United Kingdom |
The Data Protection Act 2018 was adopted and it is effective from May 25, 2018. (Updated on 25.05.2018) (The bill was introduced to the Parliament on September 13, 2017.) |
The Data Protection Act 2018 is available here in English. (Updated on 25.05.2018) (The bill is available here. Explanatory notes are available here.) |
|
European Economic Area (EEA): |
||
| Iceland |
We are not aware of any publicly available draft bills. |
|
| Lichtenstein |
We are not aware of any publicly available draft bills. |
|
| Norway | A draft bill was published in July, 2017. | The bill is available here in Norwegian. A summary is available here in English. |
| +1 Switzerland: | A revised draft was issued on September 15, 2017. | The revised draft is available here in German. A summary regarding the revised draft is available here in English. |
Other very useful materials concerning the implementation processes in the Member States can be found in the links below. I also took into account the information contained therein when I made the above compilation; of course, where there was more recent information, I inserted the latest information into the above spreadsheet.
- IAPP: EU Member State GDPR Implementation Laws and Drafts (May 25, 2018)
- EUobserver: Eight countries to miss EU data protection deadline (May 18, 2018) by Nikolaj Nielsen
- Latham & Watkins' GDPR Implementation – At a Glance (as of February 2018)
- ReedSmith: Four months until the GDPR (January 26, 2018)
- Baker&McKenzie: National Legislation Survey (January, 2018)
- GDPR Implementation: State of play in the Member States – status on 6 December 2017
- Sherman & Sterling: Brexit and GDPR: What to Expect in 2018
- TaylorWessing: EU implementation and derogation table (November 2017)
- Cearta.ie blog (ongoing updates!)
- Baker McKenzie: National Legislation Survey (May 2017)
László Pók
