Nearly half of regulated financial entities entered DORA’s active enforcement phase with known compliance gaps. The first compulsion payments have been issued. The informal tolerance period that characterised 2025 DORA supervision is over. National competent authorities — BaFin, AFM, DNB,…
Two high-risk compliance deadlines just moved. The transparency deadline did not. It hits on 2 August. On 29 June, the EU Council gave final approval to the AI Act Digital Omnibus — the first substantive amendment since the Act’s 2024…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
The EDPB just published guidelines that redefine when data qualifies as anonymous — and the answer now depends on who holds it. On 8 July, the European Data Protection Board adopted new guidelines on anonymisation, incorporating the Court of Justice…
A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
A privacy fine just triggered a Congressional trade investigation. Then the President’s stock trades surfaced. South Korea’s PIPC imposed two separate fines on Coupang Inc. totalling ~$410 million: $278M for a November 2025 breach affecting 33.7 million users, and $132M…
Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17…
The G7 DPA roundtable — hosted by CNIL in Paris during France’s G7 presidency — adopted two formal documents this week. The first: a declaration on privacy-preserving age assurance, establishing principles for robust, rights-respecting, and interoperable age verification across jurisdictions…
31% of production AI agent deployments are being rolled back for a single reason: PII exposure. Not hallucination. Not performance. Personal data surfacing where it shouldn’t — in customer interactions, in logs, in outputs that were never meant to contain…
₩248 million. A separate fine, against a separate entity — and a fundamentally different set of violations. While South Korea’s record $409M penalty against Coupang focused on a breach affecting 37.5 million consumers, the PIPC’s action against Coupang Fulfillment Services…
