EU Digital, Data & Cybersecurity Legislation (Consolidated)

European Union · updates: weekly · eu-digital-law

Consolidated EU digital, data and cybersecurity legislation — every consolidated version of every regulation, directive and decision in force that EUR-Lex itself files under three of its directory codes, in English, taken from the Publications Office’s keyless CELLAR repository in the publisher’s own Formex XML. The codes, each with its sub-codes, are 13.20.60 Information technology, telecommunications and data-processing — where the publisher files the Digital Markets Act, the NIS 2 Directive, the Cyber Resilience Act, eIDAS, the ePrivacy Directive, the Cybersecurity Act and the European Electronic Communications Code — 13.10.30 Research and technological development, where it files the AI Act next to the research-programme acts that share the code, and 19.40 Programmes, where it files the GDPR and its adequacy decisions next to the Visa Information System, eu-LISA, the Whistleblower Directive and the migration-fund acts that share it. Measured on 24 August 2026: 182 consolidated versions of 106 acts. An act for which CELLAR publishes no consolidated version is not here — on that date that included the Digital Services Act, the Data Act and the Data Governance Act — because the corpus is the consolidated family, not the Official Journal text. One record is one article or one annex, so a provision can be cited and retrieved on its own. Identity carries the date: a record’s key is the consolidated CELEX number, which names the act and the date its text was in force from, so the same article across successive consolidations is a series of records a buyer can diff. Each record states the act and its title, the consolidation date and layer, the ELI, whether a later consolidated version of the same act exists in the release, the Part/Title/Chapter it sits under, every amending act folded into the consolidation, and — read off the publisher’s own consolidation marks — which amending act changed that particular provision. Formulae published as images are omitted and counted. The directory codes that define the dataset ride on every record, so an act the publisher files under two of these datasets says so in both. Reuse rests on Commission Decision 2011/833/EU, and the source acknowledgement, the statement of what was changed and the notice that consolidated texts have no legal effect ride on every record. Every record carries its source URL, fetch timestamp, HTTP status and the SHA-256 of both the raw response and the extracted record. Every release ships a manifest with every file’s SHA-256 and a Merkle root over every chunk hash, which the buyer can recompute from the downloaded files. record_id and chunk_id are stable across releases. Personal data is screened out inside the pipeline before any hash is computed.