China’s Ministry of Commerce is holding talks with Alibaba, ByteDance, and Z.ai about restricting overseas access to the country’s most advanced AI models — including Qwen, Doubao, GLM-5.2, and DeepSeek R1. Open-source was China’s global distribution strategy. DeepSeek and Qwen…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
A privacy fine just triggered a Congressional trade investigation. Then the President’s stock trades surfaced. South Korea’s PIPC imposed two separate fines on Coupang Inc. totalling ~$410 million: $278M for a November 2025 breach affecting 33.7 million users, and $132M…
Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17…
€200M fine. Not for selling illegal products — for failing to assess whether they were being sold. The EU just issued its largest-ever Digital Services Act penalty against Temu. The Commission’s finding: Temu’s 2024 risk assessment described risks facing “the…
The Dutch Data Protection Authority, together with regulators from Finland and Norway, imposed a €100 million GDPR fine on Yango’s operator MLU B.V. for allegedly transferring EU user data to Russia without adequate safeguards. Regulators said the company failed to…
Cross-border data transfers to China are moving back into the European regulatory spotlight. Ireland’s Data Protection Commission (DPC) has launched a formal GDPR investigation into Shein over the transfer of European user data to China. Key Focus Areas • Whether…
Two Chinese State Council decrees entered into force on April 7, 2026 — with no transition period, no grace period, and no implementing guidelines. For any organization subject to EU law that maintains commercial relationships with Chinese entities, these regulations…
Two Chinese State Council decrees. No transition period. No implementing guidelines. Immediate effect. If your organization is subject to NIS2, the CRA, or GDPR — and you have Chinese suppliers or processors — you are now operating inside a structural…
