GDPR Tracker - Stage of legislative progress


Last reviewed
Stage of legislative progress 
e.g pre-consultation, in consultation
Austria 5.06.2018 The Austrian Data Protection Act ("ADPA") implementing the GDPR was adopted on 29 June 2017 and is applicable since 25 May 2018.

In addition, there are several special provisions in certain laws and business areas currently being amended or in (pre-)consultation (eg health sector, finance industry etc). These legislation procedures are mainly still ongoing, but are finalised in some areas. This leads to the a data protection fragmentation to certain decree.
Belgium 17.05.2018

The draft Belgian Data Protection Act aimed at implementing the GDPR was approved on 16 March 2018 by the Council of Ministers at its first reading. The draft has been submitted to the  Council of State for opinion, as well as to the Belgian Privacy Commission. The revised draft will be submitted to the Federal Parliament for adoption.

The Belgian Federal Parliament adopted the Act of 3 December 2017 establishing the Data Protection Authority as the successor of the existing Belgian Privacy Commission. 

Czech Republic 16.05.2018 Draft of the new Data Protection Act("DPA") [] is in the legislative process, currently in the House of Commons (lower chamber of the Czech Parliament).
Denmark 22.05.2018 Danish Data Protection Act passed on 17 May 2018.
Finland 17.05.2018 The Finnish government proposal for a Data Protection Act was submitted to the Parliament of Finland on 1st March 2018. The government proposal is currently under discussion in the Parliament Committees.
France 22.05.2018 The French data protection bill was voted and adopted by the French Parliament on 14 May 2018. But according to French Constitution 60 French Senators appealed to the Constitutional court on 16 may 2018 to rule on the constitutionality of the voted bill. Therefore some changes are expected, depending on the content of the Constitutional court’s decision, which can take a few weeks. Then the bill can be enacted. 
Germany 23.05.2018

The German Data Protection Amendment Act ("GDPAA") passed on 5 July 2017 and enters into force on 25 May 2018. There was only one section that established the right of DPAs to file an action that took immediate effect on the day after the publication of the GDPAA, i.e. on 6 July 2017. 

The Parliaments of both the Bund (federal level) and the German Federal States ('Bundesländer', regional level) are now in the process of adapting further Federal States law and sector specific law to the GDPR. These procedures are mainly still ongoing, but are finalised in some areas. 

At the federal level, the so-called Second German Data Protection Amendment and Implementation Act is in the making, which will adapt a very large number of federal laws (including i.a. the German Civil Code, eGovernment Act, BSI-Act, Social Security Codes, etc.) to the GDPR requirements. The draft of this “Omnibus law” is not published yet, and the legislative process will likely not begin before summer 2018.

The Federal States are also in the process of changing their laws to meet the GDPR requirements. Only parts of these lawmaking processes have been finished yet, and many legislative procedures are still ongoing. 

In the following Federal States the respective acts have been promulgated:

• Brandenburg: Act on adaptation of the general data protection law to the Regulation (EU) 2016/679 and on implementation of the Directive (EU) 2016/680 (Gesetz zur Anpassung des Allgemeinen Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680) dated 8 May 2018
• Bremen: Bremen Act on implementation of the General Data Protection Regulation (Bremisches Ausführungsgesetz zur EU-Datenschutz-Grundverordnung) 8 May 2018 
• Hessen: Hessian Act on adaptation of Hessian data protection law to the Regulation (EU) 2016/679 and implementation of the Directive (EU) 2016/680 as well as freedom of information (Hessisches Gesetz zur Anpassung des Hessischen Datenschutzrechts an die Verordnung (EU) Nr. 2016/679 und zur Umsetzung der Richtlinie (EU) Nr. 2016/680 und zur Informationsfreiheit) dated 3 May 2018
• Saarland: Act no. 1941 on adaption of the data protection act of the Federal State Saarland to the Regulation (EU) 2016/679 (Gesetz Nr. 1941 zur Anpassung des Saarländischen Datenschutzgesetzes an die Verordnung (EU) 2016/679) dated 16 May 2018 

Hungary  17.05.2018 On 29 August 2017 the Ministry of Justice published a draft bill intended for 'implementation' of the GDPR in Hungary but this relates only to the current Hungarian general data protection act, the InfoAct. This public consultation ended on 08 September 2017 and the comments and results have not been published yet. These will be published when the government submits the draft bill to the Parliament. The Ministry of Justice is only in charge for the InfoAct as the task of 'implementation' of other sectorial data protection acts (e.g. in the telecom, finance, e-commerce, health sectors) belongs to other ministries. There is no official information on the status of legislative progress at these ministries.

Update (04 December 2017): After the public consultation the Ministry of Justice has withdrawn the first draft of amendments to the current the InfoAct. While the reasons were not published it is likely that the Ministry has also realised that in order to ensure that Hungarian law is complainant with the provisions of the GDPR the review of sectorial laws containing data protection provisions is also necessary. The Ministry has requested certain associations to provide their input and drafts on the InfoAct and sectorial laws by 15 January 2018.
Update (16 May 2018): The Ministry of Justice has not published any new version for the draft bill amending the InfoAct and we received the information that the legislation procedure was put on hold because of the elections in April 2018.
Ireland  07.06.2018  The Data Protection Act was signed into law by the President of Ireland on 23 May 2018 and generally brought into force on 25 May.
Italy 17.05.2018 On May 11 a new official Legislative Decree Scheme ("Scheme") was published which will not repeal the current Italian Data Protection Act ("IDPA") but rather it will amend the provisions of the IDPA in conflict with the GDPR. 
Netherlands 17.05.2018 The GDPR Execution Act ("UAVG", "Uitvoeringswet Algemene verordening gegevensbescherming") has passed. Although this was not yet officially communicated, the Act will almost certainly become effective together with the GDPR. 
Poland 16.05.2018 The Personal Data Protection Act (PDPA) is in force.  The draft of the Act on Changes to the Sectoral Acts (ASA) is still being consulted at the government level. 
Spain 16.05.2018 GDPR Implementation Act has not been enacted yet. Spanish Data Protection Draft Bill was published on the 24th November 2017. 
Please view the Spanish version of the Spanish Data Protection Draft Bill here (no English version available) 
Sweden 22.05.2018 The Government Bill was passed on the 19th of April and the new Data Protection Act (2018:218) will enter into force the 25th of May.
UK 23.05.2018 Royal Assent given (23.05.18) to 25 May 2018.