According to the reasoning of the proposal, the original function of the regulation is to control multinational companies taking advantage of regulatory discrepancies between member states.

Other companies, specifically small and medium-sized enterprises, should be warned and not sanctioned when first breaching the law.

Compliance puts a substantial burden on SMEs, the proposal says, which the authorities should take into consideration.

The tasks related to the introduction of GDPR will be performed by the data protection authority NAIH.

GDPR, which entered into force on Friday, harmonises data protection regulation throughout the EU. It applies to all authorities, companies or organisations handling or using personal data of people staying in the EU.