EU Data Protection Directive

A directive adopted by the European Commission in 1995 that sets out the framework for data protection regulation in the European Union (EU) (Directive 95/46/EC). The directive regulates the processing (including the collection, use, storage, disclosure, and destruction) of personal data about individuals. Each of the 27 EU member states, Norway and Liechtenstein (which are European Economic Area countries but not EU member states), has separately implemented the directive into its own national law. Because the directive's requirements were separately implemented by each country, data protection laws and regulations may vary slightly among countries.

In April 2016, the European Parliament and the Council adopted the General Data Protection Regulation (2016/679), which replaces the current directive and has direct effect in all EU member states effective May 25, 2018 without the need for further implementing legislation.

For more information on the data protection requirements of EU member states, see Data Protection Multi-jurisdictional Guide.