Who sets GDPR rules?

GDPR was adopted by the European Parliament and the Council of the European Union following a proposal from the European Commission. Changes to the regulation are made through the EU legislative process.

Several bodies oversee how its rules work in practice:

• National data protection authorities: Supervise compliance, investigate complaints and take enforcement action.

• European Data Protection Board: Issues guidance, supports consistent application and adopts binding decisions in certain disputes between supervisory authorities.

• Courts: Review disputes and enforcement decisions. The Court of Justice of the European Union provides authoritative interpretations of EU law.

National lawmakers can also adopt supplementary provisions where GDPR permits them, including rules for particular aspects of employment-related data processing. Organisations must consider these applicable national requirements alongside the regulation.