A new data protection framework (the GDPR) has been adopted, significantly changing current EU laws. It will take the form of a Regulation and so will be directly applicable in all EU Member States from 25 May 2018. Once in effect, the current Data Protection Directive 95/46/EC will be repealed.

Organisations operating in the EU will be caught. Importantly, organisations outside the EU who nonetheless target consumers in the EU will now also be caught.