General Data Protection Regulation (GDPR)
This Regulation aims to protect the fundamental rights and freedoms of natural persons with regard to the processing of personal data and to ensure the free movement of personal data within the Union. It applies to the processing of personal data by automated or non-automated means, covering processing operations such as collection, recording, organisation, storage, transmission, disclosure and destruction, and requires controllers and processors to comply with core principles including transparency, lawfulness, data minimisation, accuracy and security.
Timeline
- 24 May 2016Entry into force
- 25 May 2018This Regulation starts to apply; processing already under way before its entry into force must be brought into conformity with this Regulation by this date (Article 99(2), Recital 171)
- 25 May 2020AuthoritiesThe Commission submits its first report on the evaluation and review of this Regulation, and every four years thereafter (Article 97(1))
Key facts
- Reference
- Regulation (EU) 2016/679
- Adopted
- 27 Apr 2016
- Published
- 4 May 2016
- Status
- In force
- Topic
- Cybersecurity & Data
- Industries
- Cross-sector, Financial Services
Main compliance requirements
Paid members only
The main compliance requirements, applicability questions and penalties are available in the ZC Smart Compliance Hub. Paid members and clients can sign in to the Hub to view them.
Related legislation
- Repeals and replaces: Directive 95/46/EC (Data Protection Directive)
- builds on: Directive 2002/58/EC (ePrivacy Directive)
- related legislation: Regulation (EU) 2018/1725 (data protection by Union institutions, which replaced Regulation (EC) 45/2001), Directive 2016/680 (data protection in criminal justice), Directive 2000/31/EC (E-Commerce Directive)
Official sources
Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data