This listing of data protection laws below provides an overview of national statutory instruments which have been enacted across Europe during first generation period prior to the EU Data Protection Directive 95/46 (1973-1994), second generation period under the Data Protection Directive (1995-2015) and third generation period under the General Data Protection Regulation (2016-present). Europe here refers to EU Member States, other members of the European Economic Area (EEA) and also Switzerland and the United Kingdom which maintain a particularly close relationship with EU/EEA data protection. Where possible, English (or a few cases French) translations have been located. However, especially as regards third generation laws, sometimes only local language texts are available. These texts have generally originated from national Data Protection Authorities, other national governmental authorities or, in the case of the legislation prior to 1995, the Council of Europe Archives. The latter are designated by the relevant reference within the file series of the Committee of Experts on Data Protection (the CJ-PD).

For all of the above jurisdictions, CIPIL has also produced comprehensive reports on the interface between data protection and freedom of expression & information at the constitutional level and also within first, second and third generation statutory frameworks. These reports not only tabulate the legal provisions but also summarise relevant parliamentary and related debates.

Austria

First Generation Legislation

Data Protection Act 1978 (CJ-PD (88) 72)

Second Generation Legislation

Federal Act concerning the Protection of Personal Data (DSG 2000) (Web/Archive)

Third Generation Legislation

Federal Act concerning the Protection of Personal Data (Web/Archive)

Belgium

First Generation Legislation

Loi du 8 décembre 1992 relative à la protection de la vie privée à l'égard des traitements de données à caractère personnel (CJ-PD (93) 2 Révisé)

Second Generation Legislation

Act of 8 December 1992 on the Protection of Privacy in relation to the Processing of Personal Data – Consolidated Version 8 July 2013 (Web Archive)

Royal Decree implementing the Act of 8 December 1992 on the Protection of Privacy in relation to the Processing of Personal Data - 13 February 2001 (Web/Archive)

Third Generation Legislation

Act on the Protection of National Persons with regard to the Processing of Personal Data (Updated to 2018) (Web/Archive)

Bulgaria

First Generation Legislation

None

Second Generation Legislation

Law for the Protection of Personal Data as amended February 2013 (Web/Archive)

Third Generation Legislation

Personal Data Act as amended to 26 November 2019 (Web/Archive)

Croatia

First Generation Legislation

None

Second Generation Legislation

Personal Data Protection Act (as of 17 September 2012) (Web/Archive)

Third Generation Legislation

Act on the Implementation of the General Data Protection Regulation (Web/Archive)

Cyprus

First Generation Legislation

None

Second Generation Legislation

Processing of Personal Data (Protection of Individuals) Law 138 (I) 2001 (Web/Archive)

Processing of Personal Data (Protection of Individuals) (Amendment) Law 2003 (on Direct Marketing)

Third Generation Legislation

Law 2015 (I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data (Web/Archive)

Czechia

First Generation Legislation

Czechoslovakia Act on Protection of Personal Data in Information Systems 1992 (CJ-PD (92) 19)

Second Generation Legislation

Personal Data Protection Act 2000 (Consolidated Version as of 2011) (Web/Archive)

Third Generation Legislation

Act 110/2019 on Personal Data Processing (Web/Archive)

Denmark

First Generation Legislation

Private Registers Act 1978 (Act No. 293, 8 June 1978) (CJ-PD (78) 7)

Public Authorities Registers’ Act 1978 (Act No. 294, 8 June 1978) (CJ-PD (78) 8)

Private Registers Etc. Act (Consolidated) (as amended by Act No. 383, 10 June 1987) (CJ-PD (88) 20)

Public Authorities Registers’ Act (Consolidated) (as amended by Act No. 383, 10 June 1987) (CJ-PD (88) 19)

Public Authorities’ Registers (Consolidated) Act No. 654 of 20 September 1991 (CJ-PD (92) 17)

Lov om massemediers informationsdatabaser (LOV nr 430 af 01/06/1994) (Web/Archive)

Second Generation Legislation

Act on Processing of Personal Data 2000 (Compiled as of 2012) (Web/Archive)

Lov om massemediers informationsdatabaser (Web/Archive)

Third Generation Legislation

Data Protection Act 502/2018 (Web/Archive)

Lov om massemediers informationsdatabaser (Web/Archive)

Estonia

First Generation Legislation

None

Second Generation Legislation

Personal Data Act 1996 (Web/Archive)

Personal Data Act 2003 (Web/Archive)

Personal Data Protection Act 2007 (Web/Archive)

Third Generation Legislation

Personal Data Protection Act 2018 (Web/Archive)

Finland

First Generation Legislation

Personal Data File Act 30 April 1987/471 (CJ-PD (88) 15)

Laki henkilörekisterilain muuttamisesta 387/1994 (Web/Archive)

Second Generation Legislation

Personal Data Act 523/1999 (Web/Archive)

Third Generation Legislation

Data Protection Act 1050/2018 (Web/Archive)

France

First Generation Legislation

Act No. 78-17 of 6 January 1978 on Data Processing, Data Files and Freedoms (CJ-PD (78) 1)

Second Generation Legislation

Act No 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (amended to 2011) (Web/Archive)

Decree No 2005-1309 of 20 October 2005 enacted for the application of Act No 78-17 of 6 January 1978 on Data Processing, Files and Individual Liberties (Consolidated to 25 March 2007) (Web/Archive)

Third Generation Legislation

Act No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (amended to 1 June 2019) (Web/Archive)

Germany

First Generation Legislation

Federal Data Protection Law (BDSG) 27 January 1977 (Original German Web/Archive)

Federal Data Protection Act 1991 (CJ-PD (91) 30)

Second Generation Legislation

Federal Data Protection Act (BDSG) 2003 (amended to 2009) (Web/Archive)

Interstate Treaty on Broadcasting and Telemedia (Web/Archive)

Third Generation Legislation

Federal Data Protection Act (BDSG) 2017 (Web/Archive)

Interstate Media Treaty (in force since 7 November 2020) (Web/Archive)

Greece

First Generation Legislation

None

Second Generation Legislation

Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended) (Web/Archive)

Third Generation Legislation

Law 4624/2019 Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions (Web/Archive)

Hungary

First Generation Legislation

Act No LXIII of 1992 on Protection of Personal Data and Disclosure of Data of Public Interest (CJ-PD (93) 3)

Second Generation Legislation

Act CXII of 2011 On Informational Self-Determination and Freedom of Information (Web/Archive)

Third Generation Legislation

Act CXII of 2011 on Informational Self-Determination and Freedom of Information (as updated 1 January 2022) (Web/Archive)

Iceland

First Generation Legislation

Act No. 63/1981 Respecting Systematic Recording of Personal Data (Information Concerning Private Affairs) (CJ-PD (81) 3)

Act Concerning the Registration and Handling of Personal Data 1989 (CJ-PD (82) 13)

Second Generation Legislation

Act No 77/2000 on the Protection of Privacy as regards the Processing of Personal Data (amended to 2010) (Web/ Archive)

Third Generation Legislation

Act 90/2018 on Data Protection and the Processing of Personal Data (Web/Archive)

Ireland

First Generation Legislation

Data Protection Act 1988 (Web/Archive) (Bill as Enacted – CJ-PD (88) 61)

Second Generation Legislation

Data Protection Act 1988 Revised (Updated to 30 March 2012) (Web/Archive)

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)

Italy

First Generation Legislation

None

Second Generation Legislation

Act 675/1996 on the Protection of Individuals and Other Subjects with Regard to the Processing of Personal Data (amendments to 1999) (replaced by Code below) (Web/Archive)

Personal Data Protection Code Legislative Decree 196/2003 (Web/Archive)

Code of Conduct on the Processing of Personal Data in the Exercise of Journalistic Activities (see Personal Data Protection Code – Annex A1)

Code of Conduct and Professional Practice Regarding the Processing of Personal Data for Historical Purposes (see Personal Data Protection Code – Annex A2)

Code of Conduct and Professional Practice Applying to Processing of Personal Data for Statistical and Scientific Purposes (Web/Archive)

Legge 214/2013 recante disposizioni urgenti per la crescita, l’equità e il consolidamento dei conti pubblici. Giuriconsult editore Copia gratuita fuori commercio (see art. 40(2) removing legal persons, bodies and associations from the scope of the Personal Data Protection Code) (Web/Archive)

Third Generation Legislation

Personal Data Protection Code containing provisions to adapt the national legislation to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Web/Archive)

Latvia

First Generation Legislation

None

Second Generation Legislation

Personal Data Protection Law (as of 2012) (Web/Archive)

Third Generation Legislation

Fizisko personu datu apstrādes likums (Web/Archive)

Liechtenstein

First Generation Legislation

None

Second Generation Legislation

Data Protection Act 2002 (Web/Archive)

Data Protection Ordinance 2002 (Web/Archive)

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)

Data Protection Ordinance 2018 (Web/Archive)

Lithuania

First Generation Legislation

None

Second Generation Legislation

Law on the Legal Protection of Personal Data 1996 (Updated to 2011) (Web/Archive)

Third Generation Legislation

Law of Republic of Lithuania on Legal Protection of Personal Data (Updated to 16 July 2018) (Web/Archive)

Law of the Republic of Lithuania on Legal Protection of Personal Data, Processed for the Purposes of Prevention, Investigation, Detection or Prosecution of Criminal Offences, or the Execution of Criminal Penalties, or National Security, or Defence (Updated to 16 July 2018) (Web/Archive)

Luxembourg

First Generation Legislation

Nominal Data (Automatic Processing) Act of 31 March 1979 (CJ-PD (79) 3)

Loi du 30 sepembre et du 1er octobre 1992 modifiant la loi du 31 mars 1979 réglementant l'utilisation des données nominatives dans les traitements informatiques (CJ-PD (92) 29)

Second Generation Legislation

Loi du 2 août 2002 relative à la protection des personnes à l’égard du traitement des données à caractère personnel (Web/Archive)

Protection of Persons with regard to the Processing of Personal Data 2002 (Updated to 2007) (Web/Archive)

Third Generation Legislation

Act of 1 August 2018 on the Organisation of the National Data Protection Commission and the General Data Protection Framework, amending the Labour Code (Web/Archive)

Loi du 1er août 2018 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel en matière pénale ainsi qu’en matière de sécurité nationale (Web/Archive)

Malta

First Generation Legislation

None

Second Generation Legislation

Data Protection Act 2001 (Updated to 2012) (Web/Archive)

Third Country (Data Protection) Regulations 2003 (Updated to 2007)

Processing of Personal Data (Protection of Minors) Regulations 2004

Notification and Fees (Data Protection Act) Regulations 2003 (Updated to 2007)

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)

Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations 2018 (Web/Archive)

Processing of Child’s Personal Data in Relation to the Offer of Information Society Services Regulations 2018 (Web/Archive)

Netherlands

First Generation Legislation

Data Protection Act 1988 (CJ-PD (89) 4)

Second Generation Legislation

Personal Data Protection Act 1999 (Web/Archive)

Third Generation Legislation

Wet van 16 mei 2018 Uitvoeringswet Algemene verordening gegevensbescherming (Web/Archive)

Norway

First Generation Legislation

Act relating to Personal Data Registers of 9 June 1978 (CJ-PD (78) 5)

Second Generation Legislation

Personal Data Act 2000 (Web/Archive)

Personal Data Regulations 2000 (Updated to 2013) (Web/Archive)

Third Generation Legislation

Personopplysningsloven 2018 (Web/Archive)

Poland

First Generation Legislation

None

Second Generation Legislation

Act on the Protection of Personal Data 1997 (Updated to 2012) (Web/Archive)

Regulation by the Minister of Internal Affairs and Administration of 11 December 2008 as regards specimen of notification of a data filing system to registration by the Inspector General for Personal Data Protection (Web/Archive)

Third Generation Legislation

Act of 10 May 2018 on the Protection of Personal Data (Web/Archive)

Portugal

First Generation Legislation

Law 10/91 for the Protection of Personal Data with Regard to Automatic Processing (CJ-PD (91) 33)

Second Generation Legislation

Act 68/98 on the Protection of Personal Data (Web/Archive)

Third Generation Legislation

Lei no 58/2019 – Lei de execução do RGPD (Web/Archive)

Lei no 59/2019 Aprova as regras relativas ao tratamento de dados pessoais para efeitos de prevenção, deteção, investigação ou repressão de infrações penais ou de execução de sanções penais (Web/Archive)