Related legislation: LED & ePrivacy
Alongside the GDPR, the EU adopted the Law Enforcement Directive for processing by criminal-law authorities. The ePrivacy Directive governs confidentiality, traffic data, marketing and terminal-equipment access across electronic communications. The Commission withdrew its 2017 proposal for an ePrivacy Regulation on 6 October 2025, so the Directive and national implementing laws remain in force.
The Law Enforcement Directive protects data processed by competent authorities for prevention, investigation, detection or prosecution of criminal offences or execution of criminal penalties. It entered into force 5 May 2016, with member states required to transpose it by 6 May 2018. It harmonises rules but does not prevent member states providing higher safeguards. Note it is a directive, so it must be transposed - unlike the GDPR.
The ePrivacy Directive sets rules for electronic communications, including confidentiality, traffic data, marketing and cookies. It particularises the GDPR for matters within its scope. The Commission withdrew the 2017 ePrivacy Regulation proposal on 6 October 2025. The Directive and national implementing laws therefore remain the operative regime.
| Feature | Law Enforcement Directive | ePrivacy Directive |
|---|---|---|
| Subject matter | Processing by criminal-law authorities | Processing across public communications networks |
| Instrument type | Directive (must be transposed) | Directive |
| In force | 5 May 2016 (transpose by 6 May 2018) | 2002/58/EC |
| Relationship to GDPR | Separate companion to the GDPR | GDPR adds no obligations on top of it |
Key terms - quick answers
What is “Law Enforcement Directive”?
What is “ePrivacy Directive”?
What is “ePrivacy Regulation”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.