Reforming Data Protection Law – Introducing The General Data Protection Regulation

In December 2015, 3 years after the first draft was proposed, and almost 20 years since the Data Protection Directive was adopted, EU lawmakers came to agreement on the reform of data protection law. The new General Data Protection Regulation (the "GDPR") was agreed upon and is currently in the process of formalisation and translation. It is expected to come into force in 2018. In this post – the first of our series looking at the GDPR – we introduce this new piece of legislation and look at some of the implications for businesses.

What is the GDPR?

The GDPR will replace the current Data Protection Directive. As a Regulation, and unlike the preceding Directive, it applies directly. This means that the GDPR does not need to be implemented through each Member State's national law. This should reduce the level of national variation in relation to data protection law, though it will not eliminate it entirely, as Member States retain some discretion in certain areas.