Newsroom

Regulatory change, translated for privacy teams

Follow updates on GDPR, AI governance, cybersecurity, PECR and enforcement activity, with practical notes on what privacy teams should review next.

67 articles5 topicsUpdated 24 September 2026

For the maintained reference page, see EU AI Act Ireland: 2026 timeline and Article 50 guide.

GDPR EnforcementEUIE2 min read

DPC Fines Google €403 Million Over Location Data Processing

The Data Protection Commission has fined Google €403 million after an inquiry into how it processed users' location data, finding infringements of lawfulness and fairness, transparency, accountability and data retention, and ordering Google to bring the processing into compliance within six months.

Read article →
GDPR EnforcementGlobal2 min read

Dutch Regulator Fines Uber €825 Million Over Fully Automated Driver Deactivations

The Dutch data protection authority has fined Uber €824,990,000 for deactivating drivers' accounts through fully automated decisions without meaningful human review, and for failing to tell drivers enough about that automated decision-making - the second-largest GDPR fine to date.

Read article →
Policy & GuidanceEUUS2 min read

AI Omnibus Enters Into Force: High-Risk Deadlines Move to December 2027 and August 2028

The Digital Omnibus on AI - Regulation (EU) 2026/1744 - entered into force on 27 July 2026, moving the EU AI Act's Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028, while Article 50 transparency duties kept their 2 August 2026 start.

Read article →
Policy & GuidanceEUIE2 min read

Ireland Enacts AI Regulation Law and Establishes the AI Office of Ireland

The Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July and has established the AI Office of Ireland as an independent statutory body coordinating the EU AI Act's enforcement, with Paul Byrne appointed as its first chief executive.

Read article →
Policy & Guidance
Digital Omnibus GDPR and Cookie Reforms Stall Without a Council MandateWhile the AI half of the Digital Omnibus is now law, the proposal to amend the GDPR and move cookie rules into it remains in first reading: Parliament's committees face more than 1,750 amendments and the Council has yet to agree a negotiating mandate.EUUSAdvisory2 min read
International Transfers
Irish High Court Upholds TikTok's €530 Million Fine Over Transfers to ChinaThe Irish High Court has upheld the Data Protection Commission's €530 million fine against TikTok over the transfer of EEA user data to China and related transparency failures, confirming one of the largest GDPR penalties on record while allowing a narrow appeal on the size of the fine to proceed.EUIEAction required2 min read
Cybersecurity
Novo Nordisk Breach Exposes Clinical Trial and Healthcare Professional DataNovo Nordisk has disclosed a security incident in which attackers copied personal data from internal systems, including pseudonymised clinical trial data covering biomarkers and lifestyle factors, and directly identifying information about healthcare professionals - a breach that illustrates the layered sensitivity of health-sector data.GlobalBackground2 min read
Cybersecurity
Klue Supply-Chain Attack Exposes Salesforce Data Through Stolen OAuth TokensA compromise of market intelligence platform Klue allowed attackers to steal OAuth tokens connecting customer Salesforce environments, exposing business data across numerous organisations including Tanium, Gong, Huntress, and LastPass - a textbook SaaS supply-chain attack built on a forgotten legacy credential.GlobalBackground2 min read
Policy & Guidance
European Parliament Advances Digital Omnibus on AI, Confirming Deadline ExtensionsThe European Parliament has adopted its position on the Digital Omnibus on AI, moving the package that extends the AI Act's high-risk deadlines and streamlines its rules closer to final adoption - following the political agreement reached with the Council in May.EUUSAction required2 min read
AI & Privacy
Commission Extends Consultation on High-Risk AI Classification GuidelinesThe European Commission has extended the consultation on its draft guidelines for classifying high-risk AI systems to 23 July 2026, giving organisations more time to engage with guidance that clarifies how to determine whether an AI system falls within the AI Act's high-risk category under Article 6.EUAdvisory2 min read
AI & Privacy
AI Transparency Code of Practice Published Ahead of August DeadlineThe European AI Office has published the final Code of Practice on Transparency of AI-Generated Content, giving providers and deployers a practical compliance pathway ahead of the Article 50 transparency obligations that apply from 2 August 2026. Initial signatories must submit their forms by 22 July.EUAction required2 min read
Cybersecurity
Council of Europe Breach Exposes Scale of PeopleSoft Zero-Day CampaignShinyHunters claims to have stolen more than 297GB of data — over 429,000 files including 409,000 payslips — from the Council of Europe, exploiting an Oracle PeopleSoft zero-day that has been used to compromise more than 100 organisations across Europe and the United States.GlobalBackground3 min read
GDPR Enforcement
ICO Fines South Staffordshire Water £963,900 Over Critical Infrastructure BreachThe ICO has fined South Staffordshire Plc and South Staffordshire Water Plc £963,900 after a phishing-led cyberattack left an attacker undetected on the network for 20 months and exposed the personal data of 633,887 people — a decision that signals tougher scrutiny of cybersecurity failures at critical infrastructure operators.EUUKAction required2 min read
Cybersecurity
NIS2 Cooperation Group Adopts Common Incident Reporting TemplatesThe NIS Cooperation Group has adopted common templates for cybersecurity incident reporting under the NIS2 Directive, establishing a uniform format across member states. The Commission intends to make the templates mandatory through an implementing act, reducing the administrative burden of cross-border reporting.EUAction required2 min read
GDPR Enforcement
AEPD Closes Amadeus Case After €14.4 Million Traveller Profiling SettlementSpain's AEPD has closed its case against Amadeus IT Group after the travel technology company paid €14.4 million to settle a fine over a pilot that profiled travellers using booking data without a lawful basis or adequate transparency — a decision the travel sector is reading as a warning on the reuse of passenger data.USAction required3 min read
Policy & Guidance
European Commission Proposes Cloud and AI Development Act to Strengthen Digital SovereigntyThe European Commission has formally proposed the Cloud and AI Development Act (CADA), introducing a four-tier cloud sovereignty framework, plans to triple EU data centre capacity, and new requirements for how public institutions procure cloud and AI services.EUAdvisory2 min read
Cybersecurity
Netherlands Seizes 800 Servers and Arrests Two for Enabling Russian-Linked CyberattacksDutch authorities have seized 800 servers and arrested two men for operating bulletproof hosting infrastructure used by Russia-linked actors to conduct cyberattacks, influence operations, and disinformation campaigns across the European Union.GlobalAction required2 min read
Policy & Guidance
UK Complaints Procedure Deadline Arrives: What Organisations Must Have in Place by 19 JuneFrom 19 June 2026, all UK data controllers must have a formal data protection complaints procedure in place under the Data (Use and Access) Act 2025, requiring 30-day acknowledgment, investigation without undue delay, and a mandatory pre-escalation step before individuals can complain to the ICO.EUUKAction required2 min read
Policy & Guidance
E-Evidence Regulation Takes Effect in August, Enabling Direct Cross-Border Data RequestsFrom 18 August 2026, the EU's E-Evidence Regulation will allow law enforcement authorities to request electronic data - including content data - directly from service providers in other member states, with a standard ten-day production deadline and an eight-hour window in urgent cases.EUAction required2 min read
Policy & Guidance
Digital Omnibus Proposes Sweeping GDPR Changes: Longer Breach Deadlines, Simplified ROPA, and Single-Click ConsentThe European Commission's Digital Omnibus proposal would raise the breach notification threshold to high risk only, extend the reporting deadline from 72 to 96 hours, simplify records of processing for SMEs, and introduce single-click consent mechanisms - the most significant set of proposed changes to the GDPR since its adoption.EUUSAction required2 min read

Regulatory calendar

What’s on the horizon

Primary sources →
  1. 16 daysto go
    EU18 Oct 2026

    NIS2 — DORA interplay review

    European Commission NIS2/DORA review window opens for financial-entity carve-outs.

  2. 4 monthsto go
    EU1 Feb 2027

    AI Act — Art. 6 list review

    Commission review of the Annex III high-risk AI use-case list, with potential additions for workplace monitoring.

  3. 10 monthsto go
    EU2 Aug 2027

    AI Act — General-purpose AI

    Transparency, copyright, and systemic-risk obligations for GPAI providers take full effect.

  4. 14 monthsto go
    UK29 Nov 2027

    UK DPDI Act — Phase 2 commencement

    Second commencement order expected to activate ICO guidance regime and automated decision-making rules.

  5. 22 monthsto go
    EU2 Aug 2028

    EU AI Act — All remaining provisions

    Final tranche: existing high-risk AI systems placed on the market before 2026 must come into conformity.

Turn regulatory updates into workflow action

Use Acompli to review affected assessments, records, risks and suppliers when the regulatory landscape changes.

Book a walkthrough →Browse regulatory sources