EU Member State GDPR Implementation Laws and Drafts


While one of the main goals of the EU General Data Protection Regulation is harmonizing data protection rules throughout Europe, it does provide for certain areas where EU member states "shall" and "may" carve out exceptions within the articles of the regulation. Because of this, it's necessary for member states to pass GDPR implementation laws.

Read more about the GDPR derogations in this white paper by Müge Fazlioglu, CIPP/E, CIPP/US.

A couple of member states have been prepared for some time, others have been working quickly in these final weeks to pass GDPR implementation legislation, but the majority are still working through drafts in their respective legislatures. The GDPR goes into effect May 25, 2018, so it's pretty much guaranteed not all 28 member states will be ready in time. (David Meyer has more about what happens in member states that don't have an updated law in this Privacy Advisor article.) So to help you keep track of the progress states are making in implementing the GDPR, we've compiled this list of member state GDPR implementation laws and drafts.

Know of a more up-to-date version or an English translation? Email us

Country Publish/adoption date Legislation
(Passed laws in bold)
Summary

Austria July 31, 2017 Federal Act amending the Data Protection Act 2000 (Data Protection Adaptation Act) 2018 (in German) Summary

Belgium September 5, 2018

Law of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data (In French and Dutch) Summary
   December 3, 2018 Law establishing the Data Protection Authority (in Dutch)  

Bulgaria April 30, 2018 Draft Data Protection Act (in Bulgarian) Not yet available

Croatia May 3, 2018 The Law on Implementation of the General Data Protection Agreement (in Croatian) Summary

Cyprus July 21, 2018 Law Providing protection of natural persons against the processing of personal data and the free movement of this data (in Greek) Not yet available

Czech Republic last edited March 28, 2018 Draft law on the processing of personal data  (in Czech) Not yet available

Denmark May 23, 2018 Law No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Exchange of Such Information (Data Protection Act) (in Danish)
English translation
Summary

Estonia April 16, 2018 (Commission session, May 28) Personal Data Protection Act 616 SE (in Estonian) Not yet available

Finland March 1, 2018 Government proposal to Parliament for supplementing the EU General Data Protection Regulation (in Finnish) Summary (in Finnish)

France June 20, 2018
Law concerning the protection of personal data (in French) Summary

Germany July 5, 2017 The German Act to Adapt Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680 (in English) Summary

Greece February 20, 2018 Draft law on the protection of data (in Greek) Not yet available

Hungary June 20, 2018 Act on the right to information self-determination and freedom of information 2011 CXII. law for legal harmonization (in Hungarian)
Draft bill on the right to information self-determination and freedom of information (in Hungarian)
*Note: While a basic law has been passed (in bold), a new and more substantial bill (not bold) has been proposed and will likely see a vote within the month of July.

Ireland May 24,2018 Data Protection Act 2018 (in English) Summary

Italy August 10, 2018 Provisions for the adaptation of national legislation to the provisions of the GDPR (in Italian) Not yet available

Latvia June 21, 2018 Personal Data Processing Law (in Latvian) Not yet available

Lithuania July 16, 2018 Law on the Protection of Personal Data (in Lithuanian) Summary

Luxembourg August 16, 2018 Law of 1 August 2018 on the organization of the National Commission for Data Protection and the General Scheme on Data Protection (in French) Not yet available.

Malta May 28, 2018 Data Protection Act
(in English)
* Subsidiary legislation relating to specific sectors were retained and are accessible here
Not yet available

The Netherlands May 16, 2018 Law Implementing the General Data Protection Regulation (in Dutch) Summary
(in English)

Poland May 24, 2018 Law on the protection of personal data (in Polish) Not yet available

Portugal March 26, 2018 Proposed Law No. 120 / Xiii (3) ensures the implementation, in the national legal order, of regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal and free data circulation of these data Summary

Romania   Law 190/2018 on measures to implement regulations of the European Parliament and Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing the EU Directive 95/46 (In Romanian) 
Unofficial English translation here
Not yet available

Slovakia January 30, 2018 Act No. 122/2013 Coll. on Protection of Personal Data and on Changing and Amending of other acts, resulting from amendments and additions executed by the Act. No. 84/2014 Coll.  (in English) Not yet available

Slovenia April 4, 2018 Proposal of the Law on Personal Data Protection (in Slovenian) Not yet available

Spain July 31, 2018 5/2018 on urgent measures for the adaptation of Spanish Law to European Union regulations on data protection (in Spanish) Not yet available

Sweden April 19, 2018 Regulation (2018: 219) with additional provisions to the EU Data Protection Ordinance (in Swedish) Summary

United Kingdom May 23, 2018 Data Protection Act (In English) Summary