Featured posts
Digital Omnibus
20-21 Oct: 🔥 Timeline update from noyb and Council agreed their position on GDPR and ePrivacy changes:
Events 2026
Next up: 21-23 Oct 🇩🇰 Copenhagen: ITechLaw 2026 European Conference I 22-23 Oct 🇳🇴 Sandefjord: Det årlige personvernkurset
Right of access (DSARs)
All things right of access: Article 15 elements table, a handy flowchart, key CJEU rulings and Rie's practical guide.
Data protection impact assessments – DPIAs
Key resources for data protection impact assessment – DPIAs. Latest: EDPB shares new DPIA template (it's excessive)...
DPO role key resources
Key DPO role resources: CJEU rulings, EDPB/WP29 Guidelines, DPA guidance and more.
Lawfulness: Consent
When can you rely on consent as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
Lawfulness: Legitimate interest
When can you rely on legitimate interest as a legal basis? Plus practical tips and key resources (GDPR, DPD, CFR, OECD, CJEU rulings and EDPB guidance).
The DPO role: Article 37(1)(b)
Breaking down Article 37(1)(b) key terms: 'core activities', 'regular', 'systematic', 'monitoring' and 'large scale'. And what should you do if you're still unsure whether you need to appoint a DPO? Appoint one voluntarily?
10x CJEU in Sep + Community Learning Seasons: risks, DPIAs
paid
–
3 min read
🚨 Two key CJEU rulings: EDPS v SRB on personal data & pseudonymisation (3 Sep.) and Latombe v Commission on the EU-US DPF (4 Sep.), plus one more ruling and seven Advocate General opinions. Buckle up!
The UK Data (Use and Access) Act (DUAA) 2025
paid
–
9 min read
ICO launches consultations for amendments | Get quickly up to speed on the new UK Data (Use and Access) Act. 💬 "there is no need to panic. Many of the changes empower rather than require, and even if embraced could be done so incrementally."
EDPS audit of the Commission's MS365 use
paid
–
11 min read
28 July: EDPS closes its investigation into the European Commission’s use of Microsoft 365, now deeming it compliant after previously finding serious EUDPR violations, notably on purpose limitation and international transfers.
EDPB meeting minutes 3-4 Jun 2025
paid
–
2 min read
🚨 AI & Data Protection Training | EDPB-EDPS opinion simplifying Art. 30(5) ROPA | Scientific research GLs discussed but redacted (as was "Smart TVs") | New 🇪🇪 CJEU case & 🇧🇪 IAB Europe update – but no further details | Joint EC-EDPB DMA ↔ GDPR interplay guidelines | 🇫🇷 rec. coming for email pixels.
EU and China discuss new Cross-Border Data Flow Communication Mechanism
paid
–
1 min read
Last year, EU and China began discussing a new Cross-Border Data Flow Communication Mechanism for non-personal data. On 17 July, a second meeting took place. First sector out: automative.
🇮🇪 DPC fines TikTok €530m for China transfers
paid
–
3 min read
10 July: DPC launches new investigation into China transfers. Earlier: transparency breach by failing to disclose the third countries involved and didn't explain the nature of the transfers in its privacy policy --> get compliant in six months or stop the transfers (but order paused until Oct).
CNIL shares transfer impact assessment (TIA) practical template
paid
–
2 min read
NB: On 9 July, CNIL appears to have updated the webpage with that date, though there don’t seem to be any actual changes – and the PDFs are still from January. Either way, here’s a quick reminder! 💬 "CNIL TIA template is one of the best templates available to the public!"
EDPB Helsinki Statement 2 Jul 2025
paid
–
2 min read
In a "landmark statement", the EDPB announces ready-to-use templates, a harmonised breach notification form, practical checklists and case law-style publications, plus more agile guidance updates and cross-regulatory cooperation to simplify GDPR compliance – especially for SMEs!
EDPB Guidelines 2/2024 Article 48
paid
–
5 min read
Update 4 Jul: EDPB shared high-res diagram! Earlier: I've reviewed the final version – mostly clarifications and my annotations on the public consultation one are still valid | EDPB Guidelines on Article 48 covering official requests from third country public authorities for personal data transfers.
Chief of Updates
