Claire Saunders

On 15 April 2026, the EDPB adopted updates to the Europrivacy certification (the European Data Protection Seal). The European Data Protection Seal is a certification

As part of its AI and Biometrics strategy, the ICO has recently released a report relating to the use of automated decision making for significant

On 18 February 2026, the EDPB published its report on the Coordinated Enforcement Framework (CEF) on the right to erasure. The right to erasure was

On 5 February 2026, the ICO fined MediaLab.AI Inc. (MediaLab), who own the social media platform Imgur £247,590, for failing to implement appropriate safeguards to

On 20 January 2026, the EU Commission proposed a new package of cyber security measures. The package includes a proposal to revise the Cyber Security

On 20 January 2026, the EDPB and EDPS issued a joint opinion on the AI provisions in the Digital Omnibus, which details recommendations in relation

On 15 January 2026, the ICO released updated guidance on international transfers which aims to reduce complexity and support responsible data transfers. The guidance includes:

The CNIL has fined NEXPUBLICA FRANCE EUR 1.7 million for failing to implement adequate security measures for its Public CRM (PCRM) software, a user relationship

The ICO has formally welcomed the Cyber Security and Resilience Bill (the Bill) as a “meaningful and necessary update” to the UK’s existing Network and

On 19 December 2025, the EU confirmed the renewal of the UK adequacy decision, meaning that personal data can continue to be sent from the

On 18 December 2025, the CJEU handed down judgment in case C-422/24 which relates to the use of body worn cameras by a Swedish public

On 12 December 2025, the EU Commission published the GDPR Enforcement Rules Regulation. The regulation “aims to deliver faster and more effective enforcement of the GDPR

On 4 December 2025, the EDPB issued recommendations on the legal basis for requiring the creation of user accounts on e-commerce sites. It has asked

On 20 November 2025, the ICO fined Last Pass UK Ltd.  (Last Pass) £1.23 million in relation to a data breach which occurred when a

On 5 November 2025 the EDPB issued its opinion on the draft adequacy decision in favour of Brazil. The opinion was generally positive with the

On 31 October 2025 the ICO published draft guidance on enforcement. The guidance covers: Investigation process: how the ICO decides whether to investigate, what organisations

The ICO has issued 2 sets of draft guidance for consultation. The first set of guidance relates to recognised legitimate interests and covers: What the

On 21 July 2025 the UK Government issued its first commencement regulations in relation to the Data (Use and Access) Act 2025 (the Act). Following

On 30 July 2025 the ICO issued guidance on profiling tools for online safety. The guidance looks at how you can comply with UK data

On 8 July 2025 the EDPB and the European Data Protection Supervisor (EDPS) issued a joint statement on the proposal for a regulation on simplification

In a press release earlier this month, the German data protection regulator confirmed that it had issued two fines totalling €45million against Vodafone GmbH. The

On 17 June 2025, the ICO finalised their fine against 23andMe in relation to a cyber attack which led to unauthorised access to the personal

On 2 May 2025, the Irish Data Protection Commission (DPC) issued its final decision in relation to the investigation of international transfers made by TikTok.

The private member’s AI (Regulation) Bill was recently relaunched in the House of Lords and passed its first reading on 4 March 2025. The Bill

At a recent Center for Strategic & International Studies event, EU Commissioner Michael McGrath is quoted as saying “GDPR will feature in a future omnibus

On 18 July 2024, the Irish Data Protection Commission (DPC) published a blog about AI, Large Language Models (LLMs), and data protection, giving a walkthrough

On 16 July 2024, the EDPB adopted FAQ for European businesses, giving some useful basic guidance on what the framework is, which US companies are

On 31 July 2024, the US Senate Commerce, Science and Transportation Committee passed the Future of AI Innovation Act. Senator Cantwell stated that the bill:

X has given an undertaking to the Irish High Court to pause processing of EU and EEA personal data in public posts to train its

Claimants whose claims for infringement of data protection rights were dismissed by the English High Court on the basis that they had not provided evidence

On 22 July 2024, Google announced an updated approach to its Privacy Sandbox project. In the blog post, Antony Chavez (VP, Privacy Sandbox) advised: “We

On 2 August 2024 the ICO published a progress update on the Children’s Code Strategy (the Strategy) (published in April 2024). The Strategy set out the

On 25 July 2024 the EU Commission published its second report on the GDPR. The Commission celebrated the GDPR’s successes and concluded that it now

The EU AI Act is now officially in force. Whilst many of the provisions will apply from two years’ time, one of the requirements that

On 22 July 2024, the ICO issued a reprimand to Chelmer Valley High School for failing to carry out a data protection impact assessment (DPIA)

On 17 July 2024, the EDPB adopted a statement on the data protection authorities’ (DPAs) role in the AI Act framework. The EDPB acknowledges the

EDPB provides clarification on “main establishment” The EDPB has issued some guidance on the meaning of “main establishment” for the purposes of the one-stop-shop mechanism

On 22 March 2024 the Cyberspace Administration of China finalised a new regulation which will govern cross-border data transfer. It has been reported that these