The European General Data Protection Regulation is a fantastically complex piece of legislation but it is not an "Act" or, as Acts are called in the EU, a Directive.
It has been brought into law across the EU (and beyond) and will come into force on 25th May 2018.
Most importantly, it proves how domestic law in member states can be written by Europe outside the democratic process.