When discussing the EU's forthcoming General Data Protection Regulation (GDPR), commentators often say that it will be in force from May 25, 2018 and that it automatically becomes law in the EU member states. It also will be effective in the countries that are a part of the European Economic Area (EEA) -- Iceland, Liechtenstein and Norway -- but not part of the EU.
For the GDPR to become law in these countries, it first will have to be incorporated into the EEA Agreement (see link concerning incorporation of EU Acts into EEA Agreement). For up to date information concerning the status of the GDPR's incorporation into the EEA Agreement, see the following link.
Then, it will have to be implemented into national law in each of these countries (see e.g., link concerning Norway and GDPR implementation).
Thus, while the GDPR will be the law from May 25, 2018, there is still a little uncertainty as to when it will be the law in the Iceland, Liechtenstein and Norway.