GDPR in practice : experiences of data protection authorities

In 2024, the general data protection regulation (GDPR) is in its sixth year of implementation. This regulation, adopted in 2016 as a key part of the EU's data protection reform, amended the legal framework that had been in place since the 1995 data protection directive entered into force. It has enhanced data subjects' rights, redefined the scope and application of the fundamental right of data protection and harmonised further national legal frameworks across the European Union. It has strengthened the mandate, tasks and powers of supervisory authorities. Supervisory authorities are referred to in this report as 'data protection authorities' (DPAs), as key enforcers of the fundamental right of protection of personal data.