After over three years of discussions at many levels, it is now clear that the proposed EU data protection framework will be revised, and that it will be in the form of a Regulation – the General Data Protection Regulation. The GDPR will replace the current Directive and will be directly applicable in all Member States without the need for implementing national legislation. It is currently under discussion in “trilogue” by the European Commission, the Parliament and the Council as they try to agree on a final text. Each institution has previously published its own form of the text, so we have a fair idea of which points might be harder to agree.

Ever since the European Commission first proposed their text back in 2012, this legislation has attracted a huge amount of attention. It even appears to be influencing decisions by the Court of Justice of the EU as they try to interpret EU law in an environment where many corporations are already starting to operate under the expected requirements of the new regime.