- Date
- May 25, 2018
- Kind
- Regulatory change
- Significance
- Transformative
The EU General Data Protection Regulation (GDPR) entered into force on May 24, 2016 and has applied since May 25, 2018, according to the European Commission.
What it covers
- The Commission describes the regulation as addressing the protection of natural persons with regard to the processing of personal data and the free movement of such data.
- It applies to companies and public bodies in the digital single market and has been incorporated into the European Economic Area agreement, so it applies across the EEA.
- National data protection authorities supervise it and have investigative and corrective powers.
Why a marketing site covers it
Email lists, website analytics, advertising tags and customer databases all process personal data. The GDPR sits underneath later developments on this timeline, from consent banners to the 2025 Digital Omnibus proposals.
Why it matters
It set the baseline that most martech vendors still design to: lawful grounds for processing, records of consent and the ability to delete data. Many consent-management and customer-data products exist because of it.
What happened next
The rules still apply. In November 2025 the European Commission proposed changes to cookie consent in its Digital Omnibus; by mid-2026 the Council's working text had dropped those provisions (see the Digital Omnibus entry).