Lead story · Regulatory
The EDPB's statement of 13 October 2026 says who is responsible when smart glasses record other people, what bystanders must be told, and why consent after the fact does not work.
3 min read
Web Compliance
4 min read
Web Compliance
3 min read
Security · News analysis
Sweden's IMY has fined an IT service provider SEK 1.8 million (about EUR 160,000) under Article 32 after a 2025 cyberattack exposed the data of 2.2 million people. What the two failures it found mean for you.
3 min read
Operations · Guide
CCTV means processing personal data: signage, minimisation, retention and a lawful basis. What GDPR asks of every business running cameras.
3 min read
Regulatory · News analysis
3 min read
Regulatory · News analysis
3 min read
Regulatory · News analysis
Updated 3 min read
Every article, newest first.
Web Compliance · News analysis
The EDPB adopted the final version of its Guidelines 3/2025 on the DSA and the GDPR on 17 September 2026. Both laws apply in full; what that means for notices, recommender systems, advertising, minors and risk assessments.
Regulatory · News analysis
On 21 October 2026 the Council agreed its position on the Digital Omnibus: pseudonymisation, breach deadlines, cookies, incident reporting. It is a negotiating position, not law — the GDPR as it stands still applies.
Web Compliance · News analysis
Norway's regulator fined an adtech company NOK 92 million for processing dating-app users' data on the strength of consent another company had collected — and found invalid. What valid consent looks like when data arrives through a partner.
Regulatory · News analysis
The EDPB's statement of 13 October 2026 says who is responsible when smart glasses record other people, what bystanders must be told, and why consent after the fact does not work.
Security · News analysis
Sweden's IMY has fined an IT service provider SEK 1.8 million (about EUR 160,000) under Article 32 after a 2025 cyberattack exposed the data of 2.2 million people. What the two failures it found mean for you.
Updated Operations · News analysis
Securitas Direct was fined €100,000 for pointing people to a chargeable phone line to exercise their data rights. What the case teaches about rights handling.
Updated Regulatory · Guide
Removing names, email addresses and customer numbers does not necessarily make a dataset anonymous. The EDPB's new draft guidance provides a structured way to test whether individuals can still be isolated, linked or inferred from the remaining information.
Updated Regulatory · News analysis
The EDPB has published draft guidelines on a harmonised methodology for GDPR fines. What they would mean for businesses — and how to assess your risk exposure.
Updated AI Act · Guide
The EU has finalised the AI Act simplification package, moving the high-risk deadlines to December 2027 and adding new obligations. What data controllers and deployers should do now.
Updated AI Act · Guide
Marketing AI is not “high-risk” under the EU AI Act, and the Act imposes no consent rule — those come from the GDPR. What the Act requires, and from when.
Updated Regulatory · News analysis
The ICO became the Information Commission on 30 September 2026. What changed, what did not, and what it means for your UK representative arrangements.
Operations · Guide
CCTV means processing personal data: signage, minimisation, retention and a lawful basis. What GDPR asks of every business running cameras.
Regulatory · News analysis
The ICO's 2026 marketing penalties were issued under PECR, not the GDPR — but the two laws work together. What anyone running campaigns on personal data needs to get right.
Regulatory · News analysis
The ICO's latest penalties are for unlawful marketing calls and messages under PECR, not the GDPR. What its 2026 actions mean for your compliance programme.
DPO · News analysis
Nigeria's data protection chief has called for stronger compliance and better-equipped DPOs. The questions every organisation should be asking of its own framework.
AI Act · Guide
AI systems process personal data at scale. How GDPR principles and the EU AI Act's phased obligations fit together — and what to build into your compliance framework.
Operations · Guide
AI notetakers transcribe meetings automatically — and process personal data as they do. Consent, security, retention and the case for expert DPO support.
Regulatory · Guide
Entering the UK market brings UK GDPR duties — from lawful bases and security to appointing a UK representative under Article 27 if you have no UK presence.
Regulatory · News analysis
Brazil's data protection authority fined TikTok's owner nearly US$30 million for processing children's data without a valid legal basis. The lesson travels well beyond Brazil.
Regulatory · News analysis
The CNIL's fines of €1 million and €1.7 million against Mobius Solutions and Nexpublica France show how data protection failures turn into penalties — and what businesses should do about it.
Regulatory · News analysis
Reform UK has pledged to replace UK GDPR with 'light-touch' data protection laws. An analysis of the practical implications for businesses on both sides of the Channel.
Operations · Guide
The UK's subject access rules have been clarified following the Data (Use and Access) Act 2025. Organisations must respond to valid requests, but they are now expressly required to carry out searches that are reasonable and proportionate — not searches without any practical limit.
Regulatory · Guide
Publicly available does not mean freely usable. The EDPB's new draft guidance explains what organisations must consider before scraping personal data from websites to train or fine-tune generative AI models.
Regulatory · Guide
Use a clear Article 27 decision process to assess EU establishment, targeting, monitoring and the occasional-processing exemption.
Regulatory · Guide
Assess whether your organisation needs a UK GDPR Representative based on UK establishment, goods or services, monitoring and the available exemptions.
DPO · Guide
Compare a Data Protection Officer with an EU or UK GDPR Representative, including legal triggers, duties, location and when your organisation may need both.
Web Compliance · Guide
Where cookie and tracking compliance breaks in practice: CMP logs, consent scope, dark patterns, and what “proof” looks like for EU/UK auditors.
Vendor Risk · Guide
How to operationalise vendor reviews for SaaS and cloud services: SCCs, TIAs, data mapping and a tiered control approach that doesn’t slow teams down.
Operations · Guide
Turn DPIAs into a lightweight guardrail — where they sit in tickets, PRs, and launch checklists, with risk triggers teams will actually use.
Security · Guide
From hardening and identity to logging and encryption — practical security baselines that make privacy-by-design real.
DPO · Guide
Scope, independence, reporting lines and cadence — what to expect from an effective outsourced DPO engagement.
If something here touches how your organisation handles personal data, drop us a line. We’ll talk it through with you — no obligation.
Talk to us
