GDPR Tracker - Stage of legislative progress


Last reviewed
Stage of legislative progress 
e.g pre-consultation, in consultation
Belgium 28.07.2017 Belgian Privacy Minister drafting new framework law.
Czech Republic 29.06.2017 Ministry of the Interior is "constructing" a new Data Protection Act. 
Denmark 29.06.2017 Justice Ministry report on 24 May 2017 summarised GDPR and A29WP guidance. Implementing legislation to be based on report and consultations.
Finland 02.08.2017 A Working Group set by the Ministry of Justice has given a proposal on a new Data Protection Act. The role of the Working Group was to assess whether there is a need for a general data protection law and to prepare a proposal for such law, if necessary. The proposal is not a formal government proposal.
France 29.06.2017 GDPR implementation report approved by French National Assembly. 
Germany 07.08.2017 German Data Protection Amendment Act ("GDPAA") passed on 5 July 2017 and enters into force on 25 May 2018. There was only one section that established the right of DPAs to file an action took immediate effect on the day after the publication of the GDPAA, i.e. on 6 July 2017. 

The data protection laws of the German Federal States ('Bundesländer') and sector-specific data protection laws will need to be adapted.

Hungary  04.12.2017 On 29 August 2017 the Ministry of Justice published a draft bill intended for 'implementation' of the GDPR in Hungary but this relates only to the current Hungarian general data protection act, the InfoAct. This public consultation ended on 08 September 2017 and the comments and results have not been published yet. These will be published when the government submits the draft bill to the Parliament. The Ministry of Justice is only in charge for the InfoAct as the task of 'implementation' of other sectorial data protection acts (e.g. in the telecom, finance, e-commerce, health sectors) belongs to other ministries. There is no official information on the status of legislative progress at these ministries.
Update (04 December 2017): after the public consultation the Ministry of Justice has withdrawn the first draft of amendments to the current the InfoAct. While the reasons were not published it is likely that the Ministry has also realised that in order to ensure that Hungarian law is complainant with the provisions of the GDPR the review of sectorial laws containing data protection provisions is also necessary. The Ministry has requested certain associations to provide their input and drafts on the InfoAct and sectorial laws by 15 January 2018.
Ireland  12.09.2017  General Scheme of the Data Protection Bill published on 12 May 2017. Draft legislation to be published in Autumn 2017.General Scheme of the Data Protection Bill published on 12 May 2017. Draft legislation to be published in Autumn 2017.
Italy 28.06.2017 No draft published yet. 
Netherlands 28.06.2017 Draft GDPR Execution Act consultation closed in January 2017. Revised Act expected late 2017. 
Poland 01.08.2017 DPA published draft on 27 January 2017. Awaiting publication of draft legislation. 
Spain 27.07.2017 Public consultation ended on 28 February 2017. Draft Data Protection Bill published on 23 June 2017. 
Sweden 17.07.2017 GDPR Committee published report on GDPR implementation. Legislative proposal expected late 2017.
UK 07.08.2017 Statement of Intent published: draft legislation to be published in Autumn.