The history of the General Data Protection Regulation (GDPR) spans several decades, evolving from early privacy concepts to a globally adopted gold standard for data protection. 

The Early Era: Foundations of Privacy (1890–1990) 

• 1890: The “Right to Privacy” concept is first articulated in the USA by Warren and Brandeis.
• 1950: The European Convention on Human Rights is established, protecting the right to respect for private and family life.
• 1970: The German state of Hesse passes the world’s first data protection law.
• 1973: Sweden enacts the first national Data Protection Act.
• 1980: The OECD issues privacy principles to harmonise international data flows.
• 1981: Convention 108 is signed, becoming the first legally binding international treaty for data protection. 

The Directive Era: Pre-Internet Regulation (1995–2011) 

• 1995: The EU adopts the Data Protection Directive (95/46/EC), setting minimum standards for member states.
• 1998: The UK implements the directive through the Data Protection Act 1998.
• 2000: Safe Harbour Principles are developed to facilitate EU-US data transfers.
• 2009: The European Commission launches a public consultation on data protection reform. 

The Development Era: Crafting the GDPR (2012–2015) 

• 2012: The European Commission releases the first proposal for the GDPR.
• 2014: The European Parliament votes overwhelmingly in favour of the draft regulation (621 to 10).
• 2015: Formal “Trilogue” negotiations between the Parliament, Council, and Commission reach a final agreement.
• 2015 (Oct): The European Court of Justice invalidates the Safe Harbour agreement in the Schrems I case. 

The Enforcement Era: Implementation and Fines (2016–2020)

• 2016 (Apr): The GDPR is officially adopted by the European Parliament and Council.
• 2016 (May): The regulation enters into force, beginning a two-year grace period for compliance.
• 2018 (May 25): The GDPR becomes fully enforceable across the EU.
• 2019: Regulators begin issuing major fines, including a €50 million penalty against Google by France’s CNIL.
• 2020: The Schrems II ruling invalidates the EU-US Privacy Shield, causing uncertainty for international transfers. 

The Modern Era: Brexit and AI Evolution (2021–Present) 

• 2021 (Jan): Post-Brexit, the UK GDPR and Data Protection Act 2018 take full effect as domestic law in the UK.
• 2022: The EU Data Governance Act enters into force.
• 2023: Italy’s regulator temporarily bans ChatGPT over GDPR concerns, highlighting the regulation’s role in governing AI.
• 2024–2026: Expansion of GDPR-style laws globally and the introduction of the EU AI Act to complement data protection rules. 

GDPR General Data Protection Regulation timeline history by year