skip to content
 

This listing of data protection laws provides an overview of national statutory instruments which have been enacted across Europe during first generation period prior to the EU Data Protection Directive 95/46 (1973-1994), second generation period under the Data Protection Directive (1995-2015) and third generation period under the General Data Protection Regulation (2016-present).  Europe here refers to EU Member States, other members of the European Economic Area (EEA) and also Switzerland and the United Kingdom which maintain a particularly close relationship with EU/EEA data protection.  Where possible, English (or a few cases French) translations have been located.  However, especially as regards third generation laws, sometimes only local language texts are available.  These texts have generally originated from national Data Protection Authorities, other national governmental authorities or, in the case of the legislation prior to 1995, the Council of Europe Archives.  The latter are designated by the relevant reference within the file series of the Committee of Experts on Data Protection (the CJ-PD).  It is intended to periodically update this listing as more translations become available, as well as ultimately include further details on the development of national data protection frameworks especially as regards their interface with freedom of expression.​

 

Austria

First Generation Legislation

Data Protection Act 1978 (CJ-PD (88) 72)

Second Generation Legislation

Federal Act concerning the Protection of Personal Data (DSG 2000) (Web/Archive)

Third Generation Legislation

Federal Act concerning the Protection of Personal Data (Updated to 2018) (Web/Archive)

 

Belgium

First Generation Legislation

Loi du 8 décembre 1992 relative à la protection de la vie privée à l'égard des traitements de données à caractère personnel (CJ-PD (93) 2 Révisé)

Second Generation Legislation

Act of 8 December 1992 on the Protection of Privacy in relation to the Processing of Personal Data – Consolidated Version 8 July 2013 (Web Archive)          

Royal Decree implementing the Act of 8 December 1992 on the Protection of Privacy in relation to the Processing of Personal Data - 13 February 2001 (Web/Archive)

Third Generation Legislation

Act on the Protection of National Persons with regard to the Processing of Personal Data (Updated to 2018) (Web/Archive)

 

Bulgaria

First Generation Legislation

None

Second Generation Legislation

Law for the Protection of Personal Data as amended February 2013 (Web/Archive)

Third Generation Legislation

Закон за изменение и допълнение на Закона за защита на личните данни (Web/Archive)

 

Croatia

First Generation Legislation

None

Second Generation Legislation

Personal Data Protection Act (as of 17 September 2012) (Web/Archive)

Third Generation Legislation

Zakon o provedbi Opće uredbe o zaštiti podataka (Web/Archive)

 

Cyprus

First Generation Legislation

None

Second Generation Legislation

Processing of Personal Data (Protection of Individuals) Law 138 (I) 2001 (Web/Archive)

Processing of Personal Data (Protection of Individuals) (Amendment) Law 2003 (on Direct Marketing)

Third Generation Legislation

Law 2015 (I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data (Web/Archive)

 

Czechia

First Generation Legislation

Czechoslovakia Act on Protection of Personal Data in Information Systems 1992 (CJ-PD (92) 19)

Second Generation Legislation

Personal Data Protection Act 2000 (Consolidated Version as of 2011) (Web/Archive)       

Third Generation Legislation

Act 110/2019 on Personal Data Processing (Web/Archive)

 

Denmark

First Generation Legislation

Private Registers Act 1978 (Act No. 293, 8 June 1978) (CJ-PD (78) 7)

Public Authorities Registers’ Act 1978 (Act No. 294, 8 June 1978) (CJ-PD (78) 8)

Private Registers Etc. Act (Consolidated) (as amended by Act No. 383, 10 June 1987) (CJ-PD (88) 20

Public Authorities Registers’ Act (Consolidated) (as amended by Act No. 383, 10 June 1987) (CJ-PD (88) 19)

Public Authorities’ Registers (Consolidated) Act No. 654 of 20 September 1991 (CJ-PD (92) 17)

Lov om massemediers informationsdatabaser (LOV nr 430 af 01/06/1994) (Web/Archive)

Second Generation Legislation

Act on Processing of Personal Data 2000 (Compiled as of 2012) (Web/Archive)

Lov om massemediers informationsdatabaser (Web/Archive)     

Third Generation Legislation

Data Protection Act 502/2018 (Web/Archive)

 

Estonia      

First Generation Legislation

None

Second Generation Legislation

Personal Data Protection Act 2007  (Web/Archive)          

Third Generation Legislation

Personal Data Protection Act 2018 (Web/Archive)

 

Finland      

First Generation Legislation

Personal Data File Act 30 April 1987/471 (CJ-PD (88) 15)

Second Generation Legislation

Personal Data Act 523/1999 (Web/Archive)

Third Generation Legislation

Data Protection Act 1050/2018 (Web/Archive)

 

France

First Generation Legislation

Act No. 78-17 of 6 January 1978 on Data Processing, Data Files and Freedoms (CJ-PD (78) 1)

Second Generation Legislation

Act No 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (amended to 2011) (Web/Archive)

Decree No 2005-1309 of 20 October 2005 enacted for the application of Act No 78-17 of 6 January 1978 on Data Processing, Files and Individual Liberties (Consolidated to 25 March 2007) (Web/Archive)

Third Generation Legislation

Ordonnance n° 2018-1125 (Web/Archive)

 

Germany

First Generation Legislation

Bundesdatenschutzgesetz (BDSG) vom 27. Januar 1977 ​(Web/Archive)

Federal Data Protection Act 1991 (CJ-PD (91) 30)

Second Generation Legislation

Federal Data Protection Act (BDSG) 2003 (amended to 2009) (Web/Archive)

Interstate Treaty on Broadcasting and Telemedia (Web/Archive)

Third Generation Legislation

Federal Data Protection Act (BDGS) 2017 (Web/Archive)

Staatsvertrag für Rundfunk und Telemedien (Web/Archive)

 

Greece

First Generation Legislation

None

Second Generation Legislation

Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended) (Web/Archive

Third Generation Legislation

Law 4624/2019 Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions (Web/Archive)

 

Hungary

First Generation Legislation

Act No LXIII of 1992 on Protection of Personal Data and Disclosure of Data of Public Interest (CJ-PD (93) 3)

Second Generation Legislation

Act CXII of 2011 On Informational Self-Determination and Freedom of Information (Web/Archive)

Third Generation Legislation

2018 évi törvény az információs önrendelkezési jogról és az információszabadságról szóló (Web/Archive)

 

Iceland

First Generation Legislation

Act No. 63/1981 Respecting Systematic Recording of Personal Data (Information Concerning Private Affairs) (CJ-PD (81) 3)

Act Concerning the Registration and Handling of Personal Data 1989 (CJ-PD (82) 13)

Second Generation Legislation

Act No 77/2000 on the Protection of Privacy as regards the Processing of Personal Data (amended to 2010) (Web/ Archive)

Third Generation Legislation

Act 90/2018 on Data Protection and the Processing of Personal Data (Web/Archive)

 

Ireland

First Generation Legislation

Data Protection Act 1988 (Web/Archive) (Bill as Enacted – CJ-PD (88) 61)

Second Generation Legislation

Data Protection Act 1988 Revised (Updated to 30 March 2012) (Web/Archive)   

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)

 

Italy

First Generation Legislation

None

Second Generation Legislation

Act 675/1996 on the Protection of Individuals and Other Subjects with Regard to the Processing of Personal Data (amendments to 1999) (replaced by Code below) (Web/Archive)

Personal Data Protection Code Legislative Decree 196/2003 (Web/Archive)

Code of Conduct on the Processing of Personal Data in the Exercise of Journalistic Activities (see Personal Data Protection Code – Annex A1)

Code of Conduct and Professional Practice Regarding the Processing of Personal Data for Historical Purposes (see Personal Data Protection Code – Annex A2)

Code of Conduct and Professional Practice Applying to Processing of Personal Data for Statistical and Scientific Purposes (Web/Archive)

Legge 214/2013 recante disposizioni urgenti per la crescita, l’equità e il consolidamento dei conti pubblici. Giuriconsult editore Copia gratuita fuori commercio (see art. 40(2) removing legal persons, bodies and associations from the scope of the Personal Data Protection Code) (Web/Archive)

Third Generation Legislation

Decreto legislative 10 agosto 2018, n101 (amending Personal Data Protection Code Legislative Decree 196/2003 – see above) (Web/Archive)

 

Latvia

First Generation Legislation

None

Second Generation Legislation

Personal Data Protection Law (as of 2012) (Web/Archive)

Third Generation Legislation

Fizisko personu datu apstrādes likums (Web/Archive)

 

Liechtenstein

First Generation Legislation

None

Second Generation Legislation

Data Protection Act 2002 (Web/Archive)

Data Protection Ordinance 2002 (Web/Archive)

Third Generation Legislation

Datenshutzgesetz (DSG) 2018 (Web/Archive)

Datenschutzverordnung (DSV) (Web/Archive)

 

Lithuania

First Generation Legislation

None

Second Generation Legislation

Law on the Legal Protection of Personal Data 1996 (Updated to 2011) (Web/Archive)

Third Generation Legislation

Asmens Duomenų Teisinės Apsaugos Įstatymo NR. I-1374 Pakeitimo Įstatymas 2018 (Web/Archive)

 

Luxembourg

First Generation Legislation

Nominal Data (Automatic Processing) Act of 31 March 1979 (CJ-PD (79) 3)

Loi du 30 sepembre et du 1er octobre 1992 modifiant la loi du 31 mars 1979 réglementant l'utilisation des données nominatives dans les traitements informatiques (CJ-PD (92) 29)

Second Generation Legislation

Loi du 2 août 2002 relative à la protection des personnes à l’égard du traitement des données à caractère personnel (Web/Archive)

Protection of Persons with regard to the Processing of Personal Data 2002 (Updated to 2007) (Web/Archive)

Third Generation Legislation

Act of 1 August 2018 on the Organisation of the National Data Protection Commission and the General Data Protection Framework, amending the Labour Code (Web/Archive)

Loi du 1er août 2018 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel en matière pénale ainsi qu’en matière de sécurité nationale (Web/Archive)

 

Malta

First Generation Legislation

None

Second Generation Legislation

Data Protection Act 2001 (Updated to 2012) (Web/Archive)

Third Country (Data Protection) Regulations 2003 (Updated to 2007) 

Processing of Personal Data (Protection of Minors) Regulations 2004       

Notification and Fees (Data Protection Act) Regulations 2003 (Updated to 2007)  

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)

Data Protection (Processing of Personal Data by Competent Authorities for the Purposes of the Prevention, Investigation, Detection or Prosecution of Criminal Offences or the Execution of Criminal Penalties) Regulations 2018 (Web/Archive)

Processing of Child’s Personal Data in Relation to the Offer of Information Society Services Regulations 2018 (Web/Archive)

 

Netherlands

First Generation Legislation

Data Protection Act 1988 (CJ-PD (89) 4)

Second Generation Legislation

Personal Data Protection Act 1999  (Web/Archive)

Third Generation Legislation

Wet van 16 mei 2018 Uitvoeringswet Algemene verordening gegevensbescherming (Web/Archive)

 

Norway

First Generation Legislation

Act relating to Personal Data Registers of 9 June 1978 (CJ-PD (78) 5)

Second Generation Legislation

Personal Data Act 2000 (Web/Archive

Personal Data Regulations 2000 (Updated to 2013)  (Web/Archive)

Third Generation Legislation

Personopplysningsloven 2018 (Web/Archive)

 

Poland

First Generation Legislation

None

Second Generation Legislation

Act on the Protection of Personal Data 1997 (Updated to 2012) (Web/Archive)  

Regulation by the Minister of Internal Affairs and Administration of 11 December 2008 as regards specimen of notification of a data filing system to registration by the Inspector General for Personal Data Protection (Web/Archive)

Third Generation Legislation

Act of 10 May 2018 on the Protection of Personal Data (Web/Archive)

 

Portugal

First Generation Legislation

Law 10/91 for the Protection of Personal Data with Regard to Automatic Processing (CJ-PD (91) 33)

Second Generation Legislation

Act 68/98 on the Protection of Personal Data (Web/Archive)

Third Generation Legislation

Lei no 58/2019 – Lei de execução do RGPD (Web/Archive)

Lei no 59/2019 Aprova as regras relativas ao tratamento de dados pessoais para efeitos de prevenção, deteção, investigação ou repressão de infrações penais ou de execução de sanções penais (Web/Archive)

 

Romania

First Generation Legislation

None

Second Generation Legislation

Law No 677/2001 on the Protection of Individuals with Regard to the Processing of Personal Data and the Free Movement of Such Data (Web/Archive)

Law No 102/2005 on the Setting Up, Organisation and Functioning of the National Supervisory Authority for Personal Data Processing (Web/Archive)

Third Generation Legislation

Law 190/2018 on Implementing Measures to General Data Protection Regulation (Web/Archive)

 

Slovakia

First Generation Legislation

Czechoslovakia Act on Protection of Personal Data in Information Systems 1992 (CJ-PD (92) 19)

Second Generation Legislation

Act 428/2002 on Protection of Personal Data (Updated to 2008 and replaced by Act 122/2013) (Web/Archive)

Act 122/2013 on Protection of Personal Data and on Changing and Amending of Other Acts (Updated to 2014) (Web/Archive

Third Generation Legislation

Act 18/2017 on Personal Data Protection and Amendment and Supplementing Certain Acts (Web/Archive)

 

Slovenia

First Generation Legislation

Law on Personal Data Security 1990 (CJ-PD (92) 28))

Second Generation Legislation

Personal Data Protection Act 2004 (Web/Archive)

Third Generation Legislation

None at Present

 

Spain

First Generation Legislation

Loi Organique 5/1992 de Réglementation du Traitement Automatisé des Données à Caractère Personnel (CJ-PD (93) 7)

Second Generation Legislation

Organic Law 15/1999 on the Protection of Personal Data (Web/Archive)

Third Generation Legislation

Ley Orgánica 3/2018, de 5 de Diciembre, de Protección de Datos Personales y Garantía de los Derechos Digitales (Web/Archive)

 

Sweden

First Generation Legislation

Data Act of 1 May 1973

Data Act as amended with effect from 1 April 1988 (CJ-PD (88) 67)

Second Generation Legislation

Personal Data Act 1998 (Web/Archive)

Personal Data Act Amendment 2007

Personal Data Ordinance 1998 (Web/Archive)   

Fundamental Law on Freedom of Expression (Web/Archive)       

Third Generation Legislation

Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (Web/Archive)

Förordning (2018:219) med kompletterande bestämmelser till EU:s dataskyddsförordning (Web/Archive)

Fundamental Law on Freedom of Expression (Web/Archive)

Switzerland

First Generation Legislation

Loi federale sur la protection des donnees 1992 (CJ-PD (92) 12)

Second Generation Legislation

Federal Act on Data Protection (FADP) of 19 June 1992 (Status as of 1 January 2014) (Web/Archive)

Ordinance to the Federal Act on Data Protection of 14 June 1993 (Status as of 16 October 2012) (Web/Archive)

Third Generation Legislation

Federal Act on Data Protection (FADP) of 19 June 1992 (Status as of 1 March 2019) (Web/Archive)

Ordonnance relative à la loi fédérale sur la protection des données (OLPD) du 14 juin 1993 (Etat le 16 octobre 2012) (Web/Archive)

 

United Kingdom

First Generation Legislation

Data Protection Act 1984 (Web/Archive)

Second Generation Legislation

Data Protection Act 1998 (Updated to 2013) (Web/Archive)

Data Protection (Designated Codes of Practice) (No 2) Order 2000 (Web/Archive)             

Data Protection (Processing of Sensitive Personal Data) Order 2000 (Web/Archive)  

Third Generation Legislation

Data Protection Act 2018 (Web/Archive)