GDPR - Timeline

Overview

View our Guide to the General Data Protection Regulation - a comprehensive document detailing the changes in all areas of the GDPR.

Bird & Bird Guide to the GDPR >

Last Developments:

16 December 2016

In February 2016, as part of its action plan of activities for the implementation of the General Data Protection Regulation ("GDPR"), the Article 29 Working Party ("A29WP") promised to publish guidance on the operation of the GDPR's provisions regarding the requirement for controllers and processors to appoint a Data Protection Officer ("DPO").

16 December 2016

13 December 2016

The Article 29 Working Party adopted guidelines for identifying a controller or processor’s lead supervisory authority and related FAQs on 13 December 2016 (the "Guidelines").

Identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the "cross-border processing of personal data" (defined in Article 4(23) GDPR). This is the case where: (i) the processing of personal data takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or (ii) the processing of personal data takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

13 December 2016

4 May 2016

On May 4 2016, the GDPR was published in the Official Journal of the European Union. The GDPR comes into effect on 25 May 2018. 4 May 2016

14 April 2016

The Council of the European Union confirmed agreement on the terms of the GDPR on 12 February 2016 by adopting a political agreement on its text, and formally adopted the GDPR at a Council meeting on 08 April 2016.The European Parliament's Civil Liberties Committee (LIBE) voted on the text on 12 April 2016 and the full Parliamentary Plenary voted at early second reading on 14 April 2016. The next step is the publication of the GDPR in the Official Journal (estimated to take at least a month) with the GDPR entering into force 20 days later and taking effect two years thereafter (estimated summer 2018).

14 April 2016

15 December 2015

On 15th December 2015, the EU Commission, Parliament and Council of Ministers reached agreement on the General Data Protection Regulation ("GDPR"), after months of "trilogue" negotiations.

15 December 2015

15 June 2015

On Monday 15th June 2015, Ministers representing the Member States at the EU Justice and Home Affairs Council at long last agreed a General Approach to the proposed General Data Protection Regulation. This decision has been built up slowly and with difficulty since the European Commission published its proposal in January 2012.

15 June 2015

11 September 2014

New article: "Ten recommendations for the data reforms of the decade"

Read it here

11 September 2014

12 March 2014

On 12th March 2014, the European Parliament voted overwhelmingly in favour of new data protection laws. The formal First Reading vote confirms the text of the draft Regulation approved by Parliament's LIBE Committee in October 2013. This is, however, far from the end of the journey to new EU data protection law: the Council of Ministers has yet to finish its review of the Regulation, which must then be agreed with the Parliament.

12 March 2014

22 October 2013

New article published, "EU Data Protection Regulation: One Step Forward"

Read it here

22 October 2013

11 January 2013

an Philipp Albrecht, a Rapporteur for the European Parliament, released his new report on the proposed European Data Protection Regulation, which will replace the current Data Protection framework within the European Union.

11 January 2013

3 May 2012

EU DPAs issued a resolution on the EU data protection reform at the Spring Conference 2012.

Read more about it here

3 May 2012

29 March 2012

Comparative study of the provisions in the Directive and the draft regulation from the Belgian government.

Read it here

29 March 2012

29 March 2012

The Article 29 WP Group has published "Opinion 01/2012 on the data protection reform proposals"

Read it here

29 March 2012

27 March 2012

The German Parliament published a paper on 27 March 2012, which states that they may exercise its right to subsidiarity complaints with regard to the proposal for a General Data Protection Regulation.

More information on this paper

27 March 2012

23 March 2012

The Belgium Parliament has a similar opinion with Germany.

23 March 2012

20 March 2012

The Dutch Parliament accepted a resolution calling upon the government to vote against the Data Protection Regulation in case the level of data protection in the regulation would turn out to be lower than the national data protection act.

20 March 2012

12 March 2012

Swedish DPA (Data Inspection Board) releases opinion on the draft DP regulation.

Read it here

12 March 2012

7 March 2012

Opinion of the European Data Protection Supervisor on the data protection reform package which was issued.

More information here

7 March 2012

6 March 2012

The French Senate adopted a proposal on 6 March 2012 for a European resolution on the same topic. Afterwards, the CNIL had posted its opinion criticising the draft Data Protection Regulation.

More information here

6 March 2012

7 February 2012

New EU Data Protection Rules workshop

7 February 2012

3 February 2012

Read our article about the new General Data Protection Regulation.

Read it here

3 February 2012

25 January 2012

Official draft of the new General Data Protection Regulation was published.

Read it here