What is the legal status of the GDPR?

The General Data Protection Regulation (GDPR) is an EU Regulation, which, according to EU law, is a binding legislative act. It must be applied in its entirety across all EU and EEA member states, making it directly functional law without requiring national legislation to implement it. This was a deliberate choice to ensure a harmonized data protection framework, unlike the previous Directive which led to fragmentation. However, the GDPR includes numerous "opening clauses" (e.g., regarding the age of consent for children, processing in the context of employment) that explicitly allow or require member states to introduce more specific rules in their national laws to supplement the Regulation.

B. This describes the function of an EU Directive. The GDPR is a Regulation, which is directly applicable, not a Directive that sets minimum standards requiring national transposition.
C. The GDPR is a legally binding and enforceable law with significant penalties for non-compliance, not a non-binding recommendation.

1. Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 10. This recital explains the choice of a Regulation: "In order to ensure a consistent and high level of protection...the level of protection...should be equivalent in all Member States...Consistent and homogenous application of the rules...should be ensured throughout the Union." This confirms its status as harmonized, functional law.

2. Consolidated version of the Treaty on the Functioning of the European Union (TFEU), Article 288. This article defines EU legal instruments: "A regulation shall have general application. It shall be binding in its entirety and directly applicable in all Member States." This is the legal basis for the GDPR's status.

3. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 88 ("Processing in the context of employment"). This is an example of an "opening clause," stating: "Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data..."

4. European Union Agency for Fundamental Rights (FRA) and Council of Europe, Handbook on European data protection law (2018 edition), Chapter 1, Section 1.2, p. 23. The handbook states, "As a regulation, the GDPR is directly applicable in all EU Member States... This means that it became binding national law... without any implementing act being required."