Two high-risk compliance deadlines just moved. The transparency deadline did not. It hits on 2 August. On 29 June, the EU Council gave final approval to the AI Act Digital Omnibus — the first substantive amendment since the Act’s 2024…
The legal foundation of EU-US data transfers is under formal challenge for the third time in a decade. On 30 June, privacy organisation noyb sent a formal letter to the European Commission requesting withdrawal of the EU-US Data Privacy Framework…
The EDPB just published guidelines that redefine when data qualifies as anonymous — and the answer now depends on who holds it. On 8 July, the European Data Protection Board adopted new guidelines on anonymisation, incorporating the Court of Justice…
A single GDPR violation used to mean one regulator. One fine. One corrective order. That model is over. The EDPB’s Coordinated Enforcement Framework has been operational since 2023. What it means in practice: a violation that might once have drawn…
€5 million. Tens of millions of patient records. And a compliance argument that failed at first contact with a regulator. France’s CNIL fined IQVIA Operations France for breaches in two health data warehouses — one fed by 14,000 pharmacies, one…
€18 million. Spain’s largest-ever privacy fine. For using data passengers already gave you — just not for this. Spain’s AEPD fined Amadeus IT Group for building a traveller-profiling system from historical booking data. The data was real. The consent wasn’t…
The UK ICO has fined South Staffordshire Water following a ransomware attack that exposed major failures in cybersecurity governance, monitoring, and data protection controls. What makes this case particularly serious is not just the breach itself — it’s how long…
Two Chinese State Council decrees entered into force on April 7, 2026 — with no transition period, no grace period, and no implementing guidelines. For any organization subject to EU law that maintains commercial relationships with Chinese entities, these regulations…
A Danish court has fined a public authority DKK 500,000 for failing to remediate a known security vulnerability — marking a clear enforcement signal on operational security. The ruling by Vestre Landsret clarifies when data controllers are held liable under…
If you think compliance risk sits only in cybersecurity… you’re already exposed. In March, Intesa Sanpaolo was hit twice by the Garante per la protezione dei dati personali—for very different failures, but with a single underlying message: 1. Strategic failure:…
