Regulationsby GlyphGDPR
Amended European Union · In force May 24, 2016 · next deadline Apr 2, 2027 (in 5 months)
Deadlines
Coming up
GDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).
Already passed
GDPR Procedural Regulation enters into forceRegulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.
GDPR Procedural Regulation adoptedRegulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.
GDPR appliesAll GDPR obligations apply from 25 May 2018 (Art 99(2)), replacing Directive 95/46/EC.
GDPR enters into forceRegulation entered into force on the twentieth day after publication in OJ L 119 of 4 May 2016 (Art 99(1)).
Summaries for reference, not legal advice. Check the official text.
What it does
The EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.
- Who it applies to
- Controllers and processors established in the EU, and non-EU controllers/processors that offer goods or services to, or monitor the behaviour of, individuals in the EU. No revenue or volume threshold; some record-keeping relief below 250 employees.
- Penalties
- Up to EUR 20M or 4% of total worldwide annual turnover of the preceding year, whichever is higher (Art 83(5)); up to EUR 10M or 2% for other infringements (Art 83(4)).
- Enforced by
- National data protection supervisory authorities (DPAs), coordinated by the European Data Protection Board (EDPB) via the one-stop-shop mechanism
- Official name
- Regulation (EU) 2016/679 (General Data Protection Regulation)
- Citation
- OJ L 119, 4.5.2016, p. 1
- Topics
- Privacy, Breach notification, Data access and sharing, Children, Biometrics, Health data
Research notes
Digital Omnibus proposal COM(2025) 837 (19 Nov 2025, procedure 2025/0360(COD)) would amend the GDPR: clarify the definition of personal data, move cookie/terminal-equipment consent from the ePrivacy Directive into a new GDPR Art 88a, add machine-readable preference signals (Art 88b), and require breach notification to DPAs only for high-risk breaches within 96 hours via a single-entry point. As of the Parliament Legislative Train update of 1 Aug 2026 it is still 'tabled': ITRE/LIBE draft report 22 June 2026, 1,750+ amendments, no plenary vote, a planned Council mandate vote on 26 June 2026 was cancelled, and no trilogues. None of these changes are law. The procedural regulation's 12- and 15-month investigation timelines are reported by the Council; check the regulation text for exact extensions.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 months
Questions about GDPR
- What are the GDPR compliance deadlines?
- May 24, 2016: GDPR enters into force. May 25, 2018: GDPR applies. Nov 26, 2025: GDPR Procedural Regulation adopted. Jan 1, 2026: GDPR Procedural Regulation enters into force. Apr 2, 2027: GDPR Procedural Regulation applies.
- When does GDPR take effect?
- GDPR took effect on May 24, 2016. The next milestone is Apr 2, 2027: GDPR Procedural Regulation applies.
- Who does GDPR apply to?
- Controllers and processors established in the EU, and non-EU controllers/processors that offer goods or services to, or monitor the behaviour of, individuals in the EU. No revenue or volume threshold; some record-keeping relief below 250 employees.
- What are the penalties under GDPR?
- Up to EUR 20M or 4% of total worldwide annual turnover of the preceding year, whichever is higher (Art 83(5)); up to EUR 10M or 2% for other infringements (Art 83(4)).