The EU Council and European Parliament last week agreed on a proposed new General Data Protection Regulation (GDPR) to replace the current Data Protection Directive (DPD), which was adopted in 1995 and took effect in 1998.  The GDPR will take effect two years after its formal approval by the Council and Parliament (which is expected in early 2016) and will be directly binding across the EU, unlike the DPD which is implemented through national legislation in each of the 28 EU member states.