From entry into force the Regulation existed as binding Union law, which is why provisions such as Article 92(2) and Article 96 use 24 May 2016 as their reference date. Its obligations only became enforceable against controllers, processors and Member States from the date of application two years later.

It gave controllers and processors time to bring existing processing into conformity, Member States time to adapt national law and set up their supervisory frameworks, and it aligned deadlines such as the notification of secrecy rules under Article 90(2) with the start of application. Recital 171 states that processing already under way should be brought into conformity within that period.

No, not necessarily. Recital 171 makes clear that where processing is based on consent given under the Directive, it is not necessary for the data subject to give consent again if the manner in which the consent was given is in line with the conditions of the Regulation, in particular Articles 4(11) and 7.

No. As a regulation it applies directly in the Member States without transposition, unlike the repealed Directive 95/46/EC. National legislation remains relevant only where the Regulation itself leaves room for specification, as in the opening clauses of Chapter IX, Articles 85 to 91.