An overview of the EU's strategy for data

The European Union's digital agenda continues to move forward as EU institutions prepare and pass new legislation to address a myriad of policy areas. In the first part of a series outlining new legislation adopted in 2022 under the EU's Strategy for Data, the IAPP provides an overview of the EU Data Governance Act, including its objectives, material and territorial scope, main requirements, enforcement, and oversight mechanism.

• Part 1 — Data Governance Act

UPDATE: 131022 - The EU Digital Markets Act (DMA) was published in the Official Journal of the European Union today. The DMA will come into force on 1 November and apply to companies six months later on 2 May 2023, creating new obligations for big technology platforms acting as gatekeepers providing core platform services. In the second part of this series, the IAPP provides an overview of the DMA, including the law's objectives, material and territorial scope, main requirements, enforcement, and oversight structure.

• Part 2 — Digital Markets Act

UPDATE: 301022 - The EU Digital Services Act (DSA) was finally published in the Official Journal of the European Union on 27 October 2022. The DSA will come into force on 16 November. It creates a new set of conditions for the provision of intermediary services and increases transparency requirements for online intermediaries. In the third part of this series, the IAPP provides an overview of the DSA, including the law's objectives, key requirements and enforcement. In related news, Pinsent Masons provide a guide for online intermediaries on the scope of the EU Digital Services Act.

• Part 3 — Digital Services Act

UPDATE: 030223 - The NIS2 Directive includes measures for a high common level of cybersecurity across the European Union. NIS2 entered into force on 13 January 2023, expanding the number of organisations that fall within its scope and strengthening security requirements. The IAPP has created a chart exploring the directive's measures. The infographic outlines key changes, challenges and requirements, along with information on enforcement, penalties and important upcoming dates.

• Part 4 — NIS2 Directive

UPDATE: 240124 - The EU Data Act was published in the Official Journal of the European Union on 13 December 2023. The Data Act came into force on 11 January 2024 and applies to companies on 12 September 2025, creating new rules on who can access and use data generated in the EU across all economic sectors. 

• Part 5 — Data Act 

In a related post, the IAPP has updated its resource outlining the key dates for EU Initiatives. The timeline starts on 25 January 2012, when the GDPR was proposed and continues through to early 2026.