EU Member State GDPR Implementation Laws and Drafts

While one of the main goals of the EU General Data Protection Regulation is harmonizing data protection rules throughout Europe, it does provide for certain areas where EU member states "shall" and "may" carve out exceptions within the articles of the regulation. Because of this, it's necessary for member states to pass GDPR implementation laws.

Read more about the GDPR derogations in this white paper by Müge Fazlioglu, CIPP/E, CIPP/US.

A couple of member states have been prepared for some time, others have been working quickly in these final weeks to pass GDPR implementation legislation, but the majority are still working through drafts in their respective legislatures. The GDPR goes into effect May 25, 2018, so it's pretty much guaranteed not all 28 member states will be ready in time. (David Meyer has more about what happens in member states that don't have an updated law in this Privacy Advisor article.) So to help you keep track of the progress states are making in implementing the GDPR, we've compiled this list of member state GDPR implementation laws and drafts.

Know of a more up-to-date version or an English translation? Email us

Country Publish/adoption date Legislation
(Passed laws in bold)

Austria July 31, 2017 Federal Act amending the Data Protection Act 2000 (Data Protection Adaptation Act) 2018 (in German) Summary
   May 15, 2018 Two additional amendments to the new law were also passed:
Federal law 23
Federal law 24

Belgium September 5, 2018

Law of 30 July 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data (In French and Dutch) Summary
   December 3, 2018 Law establishing the Data Protection Authority (in Dutch)  

Bulgaria April 30, 2018 Draft Data Protection Act (in Bulgarian) The Rapporteur Committee on the bill adopted it on first reading, Sept. 12.

Croatia May 3, 2018 The Law on Implementation of the General Data Protection Agreement (in Croatian) Summary

Cyprus July 21, 2018 Law Providing protection of natural persons against the processing of personal data and the free movement of this data (in Greek) Not yet available

Czech Republic Proposed March 28, 2018, approved by lower house of Parliament Dec. 5, 2018. There is no consolidated draft of the approved bill, see the initial proposal and Parliament's changes here. The lower chamber of the Parliament has approved GDPR implementation legislation. It must now be approved by the upper chamber and signed by the president.

Denmark May 23, 2018 Law No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Individuals with regard to the Processing of Personal Data and on the Free Exchange of Such Information (Data Protection Act) (in Danish)
English translation

Estonia April 16, 2018 (Commission session, May 28) Personal Data Protection Act 616 SE (in Estonian) Not yet available

Finland March 1, 2018 Government proposal to Parliament for supplementing the EU General Data Protection Regulation (in Finnish) Summary (in Finnish)

France June 20, 2018
Law concerning the protection of personal data (in French) Summary

Germany July 5, 2017 The German Act to Adapt Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680 (in English) Summary

Greece February 20, 2018 Draft law on the protection of data (in Greek) Public consultation completed March 5.

Hungary June 20, 2018 Act on the right to information self-determination and freedom of information 2011 CXII. law for legal harmonization (in Hungarian)
Draft bill on the right to information self-determination and freedom of information (in Hungarian)
*Note: While a basic law has been passed (in bold), a more substantial bill (not bold) has been proposed.

Ireland May 24,2018 Data Protection Act 2018 (in English) Summary

Italy August 10, 2018 Provisions for the adaptation of national legislation to the provisions of the GDPR (in Italian) Summary

Latvia June 21, 2018 Personal Data Processing Law (in Latvian) Not yet available

Lithuania July 16, 2018 Law on the Protection of Personal Data (in Lithuanian) Summary

Luxembourg August 16, 2018 Law of 1 August 2018 on the organization of the National Commission for Data Protection and the General Scheme on Data Protection (in French) Not yet available.

Malta May 28, 2018 Data Protection Act
(in English)
* Subsidiary legislation relating to specific sectors were retained and are accessible here
Not yet available

The Netherlands May 16, 2018 Law Implementing the General Data Protection Regulation (in Dutch) Summary

Poland May 24, 2018 Law on the protection of personal data (in Polish) Not yet available

Portugal March 26, 2018 Proposed Law No. 120 / Xiii (3) ensures the implementation, in the national legal order, of regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal and free data circulation of these data Summary

Romania   Law 190/2018 on measures to implement regulations of the European Parliament and Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing the EU Directive 95/46 (In Romanian) 
Unofficial English translation here
Not yet available

Slovakia January 30, 2018 Act No. 122/2013 Coll. on Protection of Personal Data and on Changing and Amending of other acts, resulting from amendments and additions executed by the Act. No. 84/2014 Coll.  (in English) Not yet available

Slovenia April 4, 2018 Proposal of the Law on Personal Data Protection (in Slovenian) Not yet available

Spain December 5, 2018 Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (in Spanish) Summary

Sweden April 19, 2018 Regulation (2018: 219) with additional provisions to the EU Data Protection Ordinance (in Swedish) Summary

United Kingdom May 23, 2018 Data Protection Act (In English) Summary