Spain’s data protection authority, AEPD, has fined Yoti €950,000 over its facial age-verification technology — a clear signal that biometric compliance is now under intense regulatory scrutiny. Key GDPR Breaches Identified • Unlawful processing of biometric data (special category data) • Invalid consent (not sufficiently informed,…
The U.S. privacy legislative landscape continues to evolve rapidly in 2026, with new state laws entering into force and additional bills moving through state legislatures. Rather than a single nationwide framework, the United States is increasingly characterized by a multi-layered…
The EU’s Digital Omnibus initiative — aimed at simplifying digital regulations — has taken a notable turn. A leaked Council draft (Feb 2026) shows that EU member states have removed the European Commission’s proposal to redefine “personal data” under the…
Nigeria’s data protection regime has entered a firm enforcement phase. Under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Commission (NDPC) is actively escalating oversight — making clear that compliance is now mandatory and enforceable. GAID as…
Saudi Arabia’s data protection regime has entered a new phase. The Saudi Data and Artificial Intelligence Authority (SDAIA) confirmed that 48 enforcement decisions were issued over the past year under the PDPL — marking the first substantive wave of adjudications…
DLA Piper’s latest GDPR survey reveals a 22% surge in breach notifications — the first time daily figures have crossed 400 since GDPR came into force in 2018. After years of plateau, the trend has sharply reversed. The drivers? A…
Cross-border data transfers are under increasing regulatory scrutiny in 2026. United Kingdom The United Kingdom’s Information Commissioner’s Office (ICO) issued updated guidance clarifying when a “restricted transfer” occurs under UK GDPR, introducing a practical 3-step test and reinforcing the need…
After years of complaints about slow, fragmented GDPR enforcement, Brussels is finally moving. The Council of the EU and the European Parliament had agreed on new procedural rules to streamline how national Data Protection Authorities (DPAs) handle cross-border GDPR cases…
What Actually Changed Under the new framework: • Admissibility criteria are standardized across member states • Procedural timelines are clarified, reducing year-long investigations • Simplified settlements become possible without full cooperation mechanisms • DPAs are nudged toward consistency instead of…
€1.2B in GDPR fines issued across Europe in 2025, keeping pace with 2024 and bringing total fines since 2018 to ~€7.1B. Ireland and France led enforcement, together accounting for over €1B last year. But enforcement today is about more than…
