The PDPL came into force on 14 September 2023.
As stated in section 3 of the Royal Decree No. 19/m dated 1443/2/9, you will have a one-year grace from the effective date of the PDPL to ensure your compliance with the PDPL.
What should you do during the grace period?
During the grace period, the Competent Authority will not apply any penalties against you. However, during this period you are expected to take measures aimed at achieving compliance with the PDPL by 14 September 2024.
As stated in section 3 of the Royal Decree No. 19/m dated 1443/2/9, the Competent Authority may extend the grace period for you if your reasons for the extension are appropriate. What reasons shall be considered as appropriate will be decided by the Competent Authority in each specific case at its sole discretion.
The grace period does not relieve you from the obligation to comply with other applicable laws and regulations in the area of personal data (for example, in the financial and healthcare sector).