European Union. Comprehensive data protection. Directive (EU)
Data Protection DirectiveDirective 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data
Repealed/superseded
§1Summary
- Synopsis
The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
- Key themes
- Unique features
It created the adequacy concept and the Article 29 Working Party. It was the basis for the Safe Harbor decision that was annulled in Schrems I.
- SaaS relevance
Historical; its adequacy decisions stayed in force under GDPR Art 45(9) until amended or repealed.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Adequacy; SCCs; BCRs
- Maximum penalty
- Set by national law
§3Dates
- Key dates
- Adopted
- In force
- Ended
- Transposition deadline 1998-10-24; repealed by GDPR with effect from 2018-05-25
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- Article 29 Working Party (replaced by EDPB) / national DPAs
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.