GDPR: When is a law a law?

By Elodie Ellingsen, Data Privacy Officer

The UK government website glossary defines a Regulation as “a legislative act of the EU which is directly applicable in Member States without the need for national implementing legislation. [Article 288 TFEU].”

Did you know that under EU law, Regulations become automatically binding and directly applicable on the date they enter into force?

EU Regulations are legal acts, which apply to all EU countries as soon as they enter into force; they do not need to be made into national law to apply. Furthermore, if there is a conflict between a Regulation and an existing national law, the Regulation takes priority over that law.

The date of entry into force is usually the 20th day following publication of the Regulation in the Official Journal of the European Union. While publication means that EU rules have been adopted and published, they are not necessarily mandatory on the date of entry into force. The date when they become mandatory is the date of applicability. In the case of the GDPR, publication in the Official Journal took place on 4 May 2016, and although it came into force on 24th of May 2016, it is not mandatory and applicable until 25th of May 2018 – six months from tomorrow.

The GDPR timeline below shows just how long this process has taken – five years alone to get the Regulation into writing, and so complex that the Article 29 Working Party is still finalising advisory details. In that context, six months is not a long time; don’t wait to ensure you’ve completed your journey to compliance.

GDPR Timeline