Claire Saunders

On 15 April 2026, the EDPB adopted updates to the Europrivacy certification (the European Data Protection Seal). The European Data Protection Seal is a certification

As part of its AI and Biometrics strategy, the ICO has recently released a report relating to the use of automated decision making for significant

On 18 February 2026, the EDPB published its report on the Coordinated Enforcement Framework (CEF) on the right to erasure. The right to erasure was

On 5 February 2026, the ICO fined MediaLab.AI Inc. (MediaLab), who own the social media platform Imgur £247,590, for failing to implement appropriate safeguards to

On 20 January 2026, the EU Commission proposed a new package of cyber security measures. The package includes a proposal to revise the Cyber Security

On 20 January 2026, the EDPB and EDPS issued a joint opinion on the AI provisions in the Digital Omnibus, which details recommendations in relation

On 15 January 2026, the ICO released updated guidance on international transfers which aims to reduce complexity and support responsible data transfers. The guidance includes:

The CNIL has fined NEXPUBLICA FRANCE EUR 1.7 million for failing to implement adequate security measures for its Public CRM (PCRM) software, a user relationship

The ICO has formally welcomed the Cyber Security and Resilience Bill (the Bill) as a “meaningful and necessary update” to the UK’s existing Network and

On 19 December 2025, the EU confirmed the renewal of the UK adequacy decision, meaning that personal data can continue to be sent from the

On 18 December 2025, the CJEU handed down judgment in case C-422/24 which relates to the use of body worn cameras by a Swedish public

On 12 December 2025, the EU Commission published the GDPR Enforcement Rules Regulation. The regulation “aims to deliver faster and more effective enforcement of the GDPR

On 4 December 2025, the EDPB issued recommendations on the legal basis for requiring the creation of user accounts on e-commerce sites. It has asked

On 20 November 2025, the ICO fined Last Pass UK Ltd.  (Last Pass) £1.23 million in relation to a data breach which occurred when a

On 5 November 2025 the EDPB issued its opinion on the draft adequacy decision in favour of Brazil. The opinion was generally positive with the

On 31 October 2025 the ICO published draft guidance on enforcement. The guidance covers: Investigation process: how the ICO decides whether to investigate, what organisations

The ICO has issued 2 sets of draft guidance for consultation. The first set of guidance relates to recognised legitimate interests and covers: What the

On 21 July 2025 the UK Government issued its first commencement regulations in relation to the Data (Use and Access) Act 2025 (the Act). Following

On 8 July 2025 the EDPB and the European Data Protection Supervisor (EDPS) issued a joint statement on the proposal for a regulation on simplification

In a press release earlier this month, the German data protection regulator confirmed that it had issued two fines totalling €45million against Vodafone GmbH. The

On 17 June 2025, the ICO finalised their fine against 23andMe in relation to a cyber attack which led to unauthorised access to the personal