Nearly half of regulated financial entities entered DORA’s active enforcement phase with known compliance gaps. The first compulsion payments have been issued. The informal tolerance period that characterised 2025 DORA supervision is over. National competent authorities — BaFin, AFM, DNB,…
Two high-risk compliance deadlines just moved. The transparency deadline did not. It hits on 2 August. On 29 June, the EU Council gave final approval to the AI Act Digital Omnibus — the first substantive amendment since the Act’s 2024…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
The EDPB just published guidelines that redefine when data qualifies as anonymous — and the answer now depends on who holds it. On 8 July, the European Data Protection Board adopted new guidelines on anonymisation, incorporating the Court of Justice…
The Dutch Data Protection Authority, together with regulators from Finland and Norway, imposed a €100 million GDPR fine on Yango’s operator MLU B.V. for allegedly transferring EU user data to Russia without adequate safeguards. Regulators said the company failed to…
Not just policy, but penalties-backed control over data value. What’s Happening Two bills advancing in parallel: • National Digital Economy & E-Governance Bill (AI governance) • Digital Sovereignty & Fair Data Compensation Bill (data localisation + economic control) Key Enforcement Signals • Fines…
A recent Reuters report reveals that the U.S. has instructed diplomats to actively oppose foreign data localization and sovereignty initiatives—elevating data governance into a coordinated diplomatic priority. Why it Matters Two competing models are hardening: • Open data flows (U.S.)…
In late 2022 the EU took a step that should raise the pulse of any executive who treats cybersecurity as “just IT.” The NIS2 Directive (Directive (EU) 2022/2555) is now the law of the land across much of Europe, and…
Excerpt The European Court of Justice’s SRB decision deepens the meaning of “personal data” under GDPR — recognizing that data is relational, contextual, and civic in nature. As the boundary between private information and public infrastructure blurs, Europe is quietly…
When the European Union adopted the Data Act in 2023, Brussels hailed it as a milestone. For the first time, legislation sought not only to protect personal data—as the General Data Protection Regulation (GDPR) did—but to regulate the broader economic…
