GDPR Deadline - EU States not ready

Only half a dozen of the 28 member states have passed their GDPR implementation acts. The GDPR is a regulation and member states don’t need to pass equivalent national laws. However, each member state needs to update its national data protection law in order to align it with the GDPR and to implement elements of the regulation for its domestic context.

If a member state hasn't produced its implementation act by May 25, what does that mean for businesses trying to operate there? The answer is clear: You have to follow the GDPR, However, it is uncertain whether the authorities in that country will be able to enforce it without new legislation. This is a country-by-country issue.

I do not see that an authority can impose fines if the respective country has not issued and implemented proper legislation (nulla poena sine lege). Without getting the details, it is almost impossible to be compliant.

Be aware: Germany is ready!

Martin Eckert (www.mme.ch)