From 25 May 2018, the General Data Protection Regulation (GDPR) replaces the 1995 Data Protection Directive and the national laws transposing the Directive. The GDPR is the most significant piece of European legislation regulating the collection and management of personal data – a key asset and potential source of significant liabilities for many modern businesses.

It will be directly applicable in all EU member states, without the need for any national implementing legislation and is intended to provide much greater harmonisation than at present. The UK will adopt the GDPR, despite its planned withdrawal from the EU in 2019.