As early as the 1970s of the last millennium, the first approaches to data protection in the then European Community were pursued. In the mid-1990s, a uniform approach was then adopted for the first time. However, implementation was the responsibility of each member state and they followed different approaches, so that no uniform regulation was achieved. Furthermore, the worldwide use of the Internet in its current dimensions was not yet foreseeable.

Each country has its own contact point for reporting violations of the basic data protection regulation. It does not matter in which EU country the GDPR has been violated. This makes it easier for companies to communicate when a violation has become known. They then only need to communicate with one authority.

Companies with more than 250 employees must keep a documentation of all data in the form of a procedure directory. This contains all processed data that is collected on a person and the reason for the collection. The transmission of this data must also be documented. Furthermore, all companies that regularly collect personal data must also keep a register of procedures. This applies to all online traders and many small companies, practices and law firms.