It's not in force yet, but will be from May 2018. Then, like its predecessor the Data Protection Directive, it'll be enforced by over >30 regulators EEA-wide,

It's not in force yet, but will be from May 2018. Then, like its predecessor the Data Protection Directive, it'll be enforced by over >30 regulators EEA-wide, with a brand new "consistency" mechanism to help multiple national regulators from different countries agree what to do about complaints that involve each one's country (though the defendant will in theory only need to deal directly with the authority of the country where the company has its main establishment; that lead authority will funnel questions etc. from all the others. Note that the existing Data Protection Directive is very actively enforced. Here's the UK's track record (and bear in mind the UK isn't one of the meanest): https://ico.org.uk/action-weve-taken/enforcement/ https://ico.org.uk/action-weve-taken/enforcement/