ENG

GDPR Tracker - Stage of legislative progress

Country
 		Last reviewed
 Stage of legislative progress 
e.g pre-consultation, in consultation
Austria 5.06.2018 The Austrian Data Protection Act ("ADPA") implementing the GDPR was adopted on 29 June 2017 and is applicable since 25 May 2018.

In addition, there are several special provisions in certain laws and business areas currently being amended or in (pre-)consultation (eg health sector, finance industry etc). These legislation procedures are mainly still ongoing, but are finalised in some areas. This leads to the a data protection fragmentation to certain decree.
Belgium 08.10.2018

Belgian Privacy Act ("BPA") adopted 30 July 2018; published in Belgian Official Gazette on 5 September 2018. Entered into force 5 September.
Czech Republic 13.09.2018 Draft of the new Data Protection Act ("DPA") is in the legislative process, currently in the second reading in the Chamber of Deputies (lower chamber of the Czech Parliament). Several amending proposals to the draft DPA have been submitted to the Parliament.
Denmark 06.09.2018 The Danish Data Protection Act passed on 17 May 2018.
Finland 13.11.2018 The Finnish Parliament approved the Data Protection Act on 13 November 2018. The Act will come into force after approval by the President and publication in the Official Gazette.
France 11.02.2019 French Data Protection Act enacted on June 20 2018 ("FDPA").
Secondary legislation expected before end of 2018 to make minor adjustments, rewrite some articles and modify the references to the FDPA in other laws.
Germany 23.05.2018

The German Data Protection Amendment Act ("GDPAA") passed on 5 July 2017 and enters into force on 25 May 2018. There was only one section that established the right of DPAs to file an action that took immediate effect on the day after the publication of the GDPAA, i.e. on 6 July 2017. 

The Parliaments of both the Bund (federal level) and the German Federal States ('Bundesländer', regional level) are now in the process of adapting further Federal States law and sector specific law to the GDPR. These procedures are mainly still ongoing, but are finalised in some areas. 

At the federal level, the so-called Second German Data Protection Amendment and Implementation Act is in the making, which will adapt a very large number of federal laws (including i.a. the German Civil Code, eGovernment Act, BSI-Act, Social Security Codes, etc.) to the GDPR requirements. The draft of this “Omnibus law” is not published yet, and the legislative process will likely not begin before summer 2018.

The Federal States are also in the process of changing their laws to meet the GDPR requirements. Only parts of these lawmaking processes have been finished yet, and many legislative procedures are still ongoing. 

In the following Federal States the respective acts have been promulgated:

• Brandenburg: Act on adaptation of the general data protection law to the Regulation (EU) 2016/679 and on implementation of the Directive (EU) 2016/680 (Gesetz zur Anpassung des Allgemeinen Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680) dated 8 May 2018
• Bremen: Bremen Act on implementation of the General Data Protection Regulation (Bremisches Ausführungsgesetz zur EU-Datenschutz-Grundverordnung) 8 May 2018 
• Hessen: Hessian Act on adaptation of Hessian data protection law to the Regulation (EU) 2016/679 and implementation of the Directive (EU) 2016/680 as well as freedom of information (Hessisches Gesetz zur Anpassung des Hessischen Datenschutzrechts an die Verordnung (EU) Nr. 2016/679 und zur Umsetzung der Richtlinie (EU) Nr. 2016/680 und zur Informationsfreiheit) dated 3 May 2018
• Saarland: Act no. 1941 on adaption of the data protection act of the Federal State Saarland to the Regulation (EU) 2016/679 (Gesetz Nr. 1941 zur Anpassung des Saarländischen Datenschutzgesetzes an die Verordnung (EU) 2016/679) dated 16 May 2018 
Hungary  01/04/2019 The bill amending the Info Act was passed on July 17 2018 by the Hungarian Parliament. It was published on July 25 2018 as Act 38 of 2018.
Ireland  07.06.2018  The Data Protection Act was signed into law by the President of Ireland on 23 May 2018 and generally brought into force on 25 May.
Italy 25.10.2018 The Legislative Decree no. 101 of 10 August 2018 (hereinafter, the "Decree") implementing the GDPR has been published in the Official Journal on September 4 2018.
Netherlands 17.09.2018 GGDPR Execution Act ("UAVG", "Uitvoeringswet Algemene verordening gegevensbescherming") has passed. The GDPR Execution Act ("UAVG", "Uitvoeringswet Algemene verordening gegevensbescherming") became effective  22 May 2018.

Discussions in Parliament considered that further area-specific data protection rules could be introduced at a later stage. 
Poland 07.09.2018 The Personal Data Protection Act (PDPA) is in force. The draft of the Act on Changes to the Sectoral Acts (ASA) is still being consulted at the government level. 
Slovakia 13.09.2018 Act no. 18/2018 Coll. on Personal Data Protection ("New DPA") enacted; effective as of 25 May 2018.
Spain 05.03.2019 The Spanish Data Protection Act ("SDPA") in force as of December 7 2018.
Sweden 06.09.2018 Swedish Data Protection Act (2018:218) and Swedish Data Protection Regulation (2018:219), containing supplementary provisions to the GDPR, entered into force on 25 May 2018.
UK 23.05.2018 Royal Assent given (23.05.18) to 25 May 2018.