Changing the nature of the regulatory enactment by replacing the Directive with the Regulation means that the domain of personal data processing is placed under the legislative competence of EU authorities. Therefore, whereas the EU legislators’ interference with this activity of the state was limited due to the type of the Directive as a non-legislative enactment, the replacement thereof by the Regulation has caused that the provisions of the latter can be neither implemented in national law nor even interpreted by national legislators, and only in the situations described in the Regulation (recital 8 of the GDPR)4 it may be possible for national legislators to clarify more specifically or narrow down some individual provisions of the GDPR.