GDPR Timeline

October 1995:
Introduction of Data Protection Regulation (95/46/EC), the first EU-wide privacy law

January 2012:
Initial proposal to update DPR

March 2014:
EU Parliament approves first version of the new GDPR regulation

June 2015:
Council of the EU approves first reading

December 2015:
Final text agreed; signed in January

April 2016:
GDPR (2016/679) adopted by Council of the EU and Parliament

May 2016:
GDPR adopted and published, with a two-year implementation window

May 25, 2018:
GDPR goes into force

July 2018:
A Portuguese hospital is fined 400,000 euros

September 2018:
ICO issues formal notice to AggregateIQ, a firm understood to be connected to Cambridge Analytica, over data relating to its campaigning on behalf of the Vote Leave campaign in 2016