China’s Ministry of Commerce is holding talks with Alibaba, ByteDance, and Z.ai about restricting overseas access to the country’s most advanced AI models — including Qwen, Doubao, GLM-5.2, and DeepSeek R1. Open-source was China’s global distribution strategy. DeepSeek and Qwen…
Nearly half of regulated financial entities entered DORA’s active enforcement phase with known compliance gaps. The first compulsion payments have been issued. The informal tolerance period that characterised 2025 DORA supervision is over. National competent authorities — BaFin, AFM, DNB,…
Two high-risk compliance deadlines just moved. The transparency deadline did not. It hits on 2 August. On 29 June, the EU Council gave final approval to the AI Act Digital Omnibus — the first substantive amendment since the Act’s 2024…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
The EDPB just published guidelines that redefine when data qualifies as anonymous — and the answer now depends on who holds it. On 8 July, the European Data Protection Board adopted new guidelines on anonymisation, incorporating the Court of Justice…
A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
A privacy fine just triggered a Congressional trade investigation. Then the President’s stock trades surfaced. South Korea’s PIPC imposed two separate fines on Coupang Inc. totalling ~$410 million: $278M for a November 2025 breach affecting 33.7 million users, and $132M…
Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17…
The G7 DPA roundtable — hosted by CNIL in Paris during France’s G7 presidency — adopted two formal documents this week. The first: a declaration on privacy-preserving age assurance, establishing principles for robust, rights-respecting, and interoperable age verification across jurisdictions…
31% of production AI agent deployments are being rolled back for a single reason: PII exposure. Not hallucination. Not performance. Personal data surfacing where it shouldn’t — in customer interactions, in logs, in outputs that were never meant to contain…
