Private data security

European Union: Data Protection Laws Are Overhauled By The Adoption Of The General Data Protection Regulation

On 14 April 2016, the European Parliament adopted the General Data Protection Regulation (GDPR). This marks the final stage of the legislative process paving the way for the patchwork of national data protection laws, created by the Data Protection Directive passed in 1995, to be replaced with a uniform law across the EU. The GDPR will enter into force 20 days after its publication in the EU Official Journal and will be directly applicable in all member states two years after this date without the need for implementing national legislation.

The GDPR has been four years in negotiation between the European Commission, the Parliament and the Council. The new rules represent the biggest change to data protection in 20 years and aim to strengthen the rights individuals have over their data whilst also updating the rules for a digital age. In the UK the rules will replace the Data Protection Act 1998.