When did GDPR come into force?

The GDPR entered into force on 24 May 2016 and became applicable on 25 May 2018, following a two-year preparation period.

These dates have different meanings:

• 24 May 2016 marked its formal entry into force, 20 days after publication in the EU’s Official Journal.

• 25 May 2018 was when its requirements became applicable and organisations within its scope had to meet their GDPR compliance obligations.

This distinction is set out in Article 99’s entry-into-force and application rules. References to GDPR “starting in 2018” generally mean its application date.