Countdown
Thursday, May 25, 2028 · 762 days away
Countdown
GDPR 10-Year Evaluation Report
Event overview
Commission's Article 97 third evaluation of the General Data Protection Regulation — decadal milestone.
25 May 2028 marks the tenth anniversary of the General Data Protection Regulation's date of application and the statutory deadline for the Commission's third evaluation report under Article 97. The countdown tracks the formal ten-year review, which is the first review to cover a full decade of enforcement data and may propose amendments to the Regulation.
Regulation (EU) 2016/679 applied from 25 May 2018 and set up a four-year evaluation cycle under Article 97. The Commission published its first evaluation in June 2020 and its second in July 2024. The third review is due by 25 May 2028 — ten years after GDPR began to apply and the first review with a full decade of supervisory-authority decisions, one-stop-shop procedural experience, and Court of Justice case law.
Between 2018 and 2024, data protection authorities imposed more than €4.5 billion in cumulative fines, with headline decisions including €1.2 billion against Meta Platforms Ireland (May 2023) over EU-US data transfers, €746 million against Amazon Europe Core (July 2021), and €390 million against Meta over its legal basis for personalised advertising (January 2023). The one-stop-shop mechanism — central to Article 56 — has been repeatedly criticised by the European Data Protection Board and national DPAs for slow cross-border case handling, prompting the 2023 Commission proposal for a GDPR Procedural Regulation still under negotiation. The 2028 review will also take place against the backdrop of the AI Act, the Data Act, and the EU-US Data Privacy Framework adopted in July 2023. The Court of Justice's Schrems II judgment (July 2020) and the subsequent Schrems III litigation questioning the Data Privacy Framework remain the defining external pressure on Chapter V. The EDPB's 2024 coordinated enforcement action on the right of access and its binding decisions under Article 65 against the Irish Data Protection Commission have further tested the consistency mechanism's design. Academic research, such as the Max Planck Institute's 2024 mapping study, has documented persistent divergence in how DPAs interpret legitimate interest, consent, and children's data provisions.
Article 97 sets 25 May 2028 as a legal deadline, not a discretionary milestone. It triggers the formal Commission assessment — with Parliament and Council oversight — of whether GDPR's substantive provisions need amendment, whether Chapter V international-transfer rules remain fit for purpose, and whether cooperation mechanisms between DPAs are working. Any proposed amendments would be the most significant change to GDPR since its adoption.
Connections run through the EU AI Act enforcement countdown and EU AI Act Phase 2 countdown, which raise AI training-data issues. The EU Data Act design obligations countdown overlaps on data-access rights.
When exactly is the GDPR 10-year review? 25 May 2028, ten years after the date of application and the Article 97 four-year-cycle deadline.
Is the GDPR 10-year review confirmed or expected? Confirmed as a legal obligation under Article 97 of Regulation (EU) 2016/679.
Who is responsible for the GDPR 10-year review? The European Commission (DG JUST), with input from the European Data Protection Board, national DPAs, Council, and Parliament.
Where can I read the official announcement? Previous evaluations and the schedule sit at https://commission.europa.eu/publications/reports-application-gdpr_en.
Related countdowns
UK Building Safety Regulator 2-Year Review
India Union Budget 2028-29
Tuam Mother-and-Baby Home Excavation Final Report
UK National Archives Cabinet Papers Release (1997/98)
Karnataka Assembly Election 2028
Simhastha Ujjain — Third Shahi Snan (Vaishakh Purnima)
