A directive adopted by the European Commission in 1995 that set out the framework for data protection regulation in the European Union (EU) (Directive 95/46/EC). The directive regulated the processing (including the collection, use, storage, disclosure, and destruction) of personal data about individuals. Each of the 27 EU member states and European Economic Area countries (which includes Norway, Iceland, and Liechtenstein) separately implemented the directive into its own national law. Because the directive's requirements were separately implemented by each country, data protection laws and regulations varied slightly among countries.

Effective May 25, 2018, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR) (2016/679), which replaced the directive and has direct effect in all EU member states without the need for further implementing legislation.

For more information on the GDPR, see Practice Note, Overview of EU General Data Protection Regulation.