Countdown

GDPR 10-Year Evaluation Report

Thursday, May 25, 2028 · 567 days away

Europe Regulatoryscheduled

Countdown

566

Days

Hours

Min

Sec

Reminders

Discord

Event overview

Commission's Article 97 third evaluation of the General Data Protection Regulation — decadal milestone.

Date: 2028-05-25
Country / jurisdiction: EU
Region: Europe
Category: Regulatory
Status: scheduled

Confirmation checklist

Before you act on this countdown

Use the timer for orientation, then run through these checks before booking, publishing, buying tickets, scheduling alerts, or moving operations around this date.

Date signal

The date is suitable for countdown use, with the source still owning late changes.

Local time

No reliable start time is attached yet, so this page stays date-first instead of implying midnight.

Calendar action

Add it to a calendar after checking the source for time, venue, or access changes.

Next useful path

Use Regulatory, 2028, or Europe paths below to compare related countdowns before deciding what to watch next.

Source trail

Source trail for GDPR 10-Year Evaluation Report

Verify source

Primary source

commission.europa.eu

Last reviewed

2026-04-30

Tracker status

scheduled

Date precision

Single-date event without a reliable public start time; date-first countdown only.

Schema posture

Event structured data is emitted because the record is single-date and scheduled or confirmed.

This is an expected date. Use reminders and monitoring, but verify the source before making travel, purchase, publication, or staffing decisions.

Primary citation

The current date signal points to commission.europa.eu. The source URL is shown visibly on the page so readers can verify late changes instead of relying only on the timer.

Freshness and review

Source policy was reviewed on 2026-04-30. Live countdown values are render-time snapshots; editorial source fields update when the tracked event dataset changes.

Operational detail

The record does not carry a reliable public start time yet, so the page avoids implying a midnight or all-day start.

Weak-date handling

The page can support calendar actions and Event schema, while still telling readers to check the source for operational changes.

What this countdown tracks

25 May 2028 marks the tenth anniversary of the General Data Protection Regulation's date of application and the statutory deadline for the Commission's third evaluation report under Article 97. The countdown tracks the formal ten-year review, which is the first review to cover a full decade of enforcement data and may propose amendments to the Regulation.

Background

Regulation (EU) 2016/679 applied from 25 May 2018 and set up a four-year evaluation cycle under Article 97. The Commission published its first evaluation in June 2020 and its second in July 2024. The third review is due by 25 May 2028 — ten years after GDPR began to apply and the first review with a full decade of supervisory-authority decisions, one-stop-shop procedural experience, and Court of Justice case law.

Between 2018 and 2024, data protection authorities imposed more than €4.5 billion in cumulative fines, with headline decisions including €1.2 billion against Meta Platforms Ireland (May 2023) over EU-US data transfers, €746 million against Amazon Europe Core (July 2021), and €390 million against Meta over its legal basis for personalised advertising (January 2023). The one-stop-shop mechanism — central to Article 56 — has been repeatedly criticised by the European Data Protection Board and national DPAs for slow cross-border case handling, prompting the 2023 Commission proposal for a GDPR Procedural Regulation still under negotiation. The 2028 review will also take place against the backdrop of the AI Act, the Data Act, and the EU-US Data Privacy Framework adopted in July 2023. The Court of Justice's Schrems II judgment (July 2020) and the subsequent Schrems III litigation questioning the Data Privacy Framework remain the defining external pressure on Chapter V. The EDPB's 2024 coordinated enforcement action on the right of access and its binding decisions under Article 65 against the Irish Data Protection Commission have further tested the consistency mechanism's design. Academic research, such as the Max Planck Institute's 2024 mapping study, has documented persistent divergence in how DPAs interpret legitimate interest, consent, and children's data provisions.

Why the date matters

Article 97 sets 25 May 2028 as a legal deadline, not a discretionary milestone. It triggers the formal Commission assessment — with Parliament and Council oversight — of whether GDPR's substantive provisions need amendment, whether Chapter V international-transfer rules remain fit for purpose, and whether cooperation mechanisms between DPAs are working. Any proposed amendments would be the most significant change to GDPR since its adoption.

What to watch for

Commission assessment of the one-stop-shop and cross-border enforcement.
Treatment of AI-model training data and legitimate-interests analysis.
Review of Chapter V adequacy decisions, including the US Data Privacy Framework.
Evaluation of the consistency mechanism and EDPB binding decisions.
Position on legitimate interest versus consent for behavioural advertising.
Statistics on complaints, cross-border cases, and fine recovery rates.
Interactions with the Data Act, AI Act, and Digital Services Act.

Connections run through the EU AI Act enforcement countdown and EU AI Act Phase 2 countdown, which raise AI training-data issues. The EU Data Act design obligations countdown overlaps on data-access rights.

FAQ

When exactly is the GDPR 10-year review? 25 May 2028, ten years after the date of application and the Article 97 four-year-cycle deadline.

Is the GDPR 10-year review confirmed or expected? Confirmed as a legal obligation under Article 97 of Regulation (EU) 2016/679.

Who is responsible for the GDPR 10-year review? The European Commission (DG JUST), with input from the European Data Protection Board, national DPAs, Council, and Parliament.

Where can I read the official announcement? Previous evaluations and the schedule sit at https://commission.europa.eu/publications/reports-application-gdpr_en.

Date confidence

Scheduled date

GDPR 10-Year Evaluation Report is tracked as a scheduled event. The date is suitable for countdown and calendar use, while final logistics should still be checked against the linked source.

Source

https://commission.europa.eu/publications/reports-application-gdpr_en

Source host: commission.europa.eu
Date precision: Single scheduled date from the linked source
Schema posture: Event startDate emitted because the record is single-date and scheduled/confirmed
Planning boundary: Use as a monitoring aid until the source trail is stronger

Structured data posture

This page emits Event structured data because the tracked record has a single scheduled or confirmed date. The linked source remains the final reference for time, venue, and operational changes.

Countdown evidence

Retention class

Date-first scheduled countdown

Evidence score

5/10 record signals

City-page readiness

Held to date-first

Evidence score5/10 signals present: primary source URL; tracked date; schema-safe date; place context; related event cluster
Date and schemaSchema-safe single date: Single-date event without a reliable public start time; date-first countdown only. Event structured data is emitted because the record is single-date and scheduled or confirmed.
Local-time readinessDate-first only: The record is not used as a city-local event page until it has a reliable time, timezone, and non-windowed date.
Record completeness1 concrete fields: country EU
Weak-field watchlist4 fields to improve: verified public start time; venue; manual official-source note; historical sequence
Source freshnesscommission.europa.eu; reviewed 2026-04-30: Related crawl path: Tuam Mother-and-Baby Home Excavation Final Report, UEFA Euro 2028 Final (Wembley), UK Building Safety Regulator 2-Year Review, Mobile World Congress 2028.

Planning notes

How to use this GDPR 10-Year Evaluation Report countdown

Countdown pages are useful when they are honest about what is known, what is merely expected, and what still needs checking. This page keeps the live timer separate from the source confidence and structured-data posture.

Date confidence

GDPR 10-Year Evaluation Report is tracked as scheduled for Thursday, May 25, 2028; the countdown can support reminders while final logistics still belong to commission.europa.eu. The page can emit precise Event structured data because the tracked record has a single scheduled or confirmed date.

What could change

Watch for date shifts, venue or access updates, broadcast windows, registration rules, and source corrections. The current precision is: Single-date event without a reliable public start time; date-first countdown only..

Local-time usefulness

No reliable source start time is attached yet, so the page stays date-first and avoids implying a midnight start. 567 days remain at render time.

Category context

GDPR 10-Year Evaluation Report sits in Regulatory with country EU. Related countdown links should help users compare similar events, not create unverified event-city pages.

Catalog-specific details

No creator, platform, league, brand, fixture, family, or alternate-name detail is attached to this event record.

Series and expectation notes

No series history, end date, or what-to-expect field is attached.

Priority note

This page is kept specific through source confidence, category, region, date precision, and update notes rather than generic countdown filler.

Verification trail

source URL https://commission.europa.eu/publications/reports-application-gdpr_en. trust checks: Source host: commission.europa.eu, Date precision: Single scheduled date from the linked source, Schema posture: Event startDate emitted because the record is single-date and scheduled/confirmed, and Planning boundary: Use as a monitoring aid until the source trail is stronger. no manual editorial context is attached yet.

Record completeness

present fields: country EU. missing or weak fields: verified public start time, venue, manual official-source note, and historical sequence

Related crawl path

Nearby retained events: Tuam Mother-and-Baby Home Excavation Final Report, UEFA Euro 2028 Final (Wembley), UK Building Safety Regulator 2-Year Review, Mobile World Congress 2028, and India Union Budget 2028-29. These links should support topical discovery without creating unverified event-city pages.

Review boundary: this page tracks the public date signal, source link, category, region, and calendar posture. It does not replace official ticketing, exchange, broadcaster, organizer, court, regulator, or government notices.

Source reviewed Apr 30, 2026. The countdown record is intentionally labeled as scheduled or expected; use the source link and any range notes before treating the date as final.

Live values rendered at Nov 5, 7:06 PM UTC.

Related planning pages

Countdown hubAll currently tracked countdowns.Regulatory countdownsRelated events in this category.2028 countdownsEvents tracked for the same calendar year.Europe countdownsRegion-specific countdown pages.SourcesHow we cite and review date sources.Speculative datesHow expected and windowed dates are labeled.

Related countdowns