On April 15, 2026, the European Data Protection Board (EDPB) adopted guidelines on the processing of personal data for scientific research purposes.[1] The guidelines aim to clarify GDPR compliance requirements for scientific research involving personal data.
Latest from Cleary Cybersecurity and Privacy Watch
New York’s RAISE Act vs. California’s TFAIA: What Companies Need to Know
As states continue to grapple with establishing regulatory frameworks for the most powerful artificial intelligence (“AI”) systems, New York has joined California in targeting frontier AI models with the Responsible AI Safety and Education Act (the “RAISE Act” or the
President Trump Signs Executive Order Seeking to Preempt State AI Regulation
For more insights and analysis from Cleary lawyers on policy and regulatory developments from a legal perspective, visit What to Expect From a Second Trump Administration.
On December 11, 2025, President Donald Trump signed an executive order titled Establishing
GDPR vs. the hosting defence: How wary should online platforms be of the EU Court of Justice Russmedia judgment?
CJEU ruling heralded as “landmark” GDPR judgment turns on a specific set of facts and requires careful interpretation in the post-DSA regulatory reality.
AI-Enabled Cyber Intrusions: What Two Recent Incidents Reveal for Corporate Counsel
This article was authored by Daniel Ilan, Rahul Mukhi, Prudence Buckland, and Melissa Faragasso from Cleary Gottlieb, and Brian Lichter and Elijah Seymour from Stroz Friedberg, a LevelBlue company.
Recent disclosures by Anthropic and OpenAI highlight a pivotal shift in the cyber threat
California Enacts Landmark AI Safety Law But With Very Narrow Applicability
On September 29, 2025, Governor Gavin Newsom signed the Transparency in Frontier Artificial Intelligence Act (TFAIA, SB 53 or the Act)[1], establishing a comprehensive framework for transparency, safety and accountability in the development and deployment of the most
Enforcement Countdown: Is DOJ Ready for the Bulk Data Rule “Grace Period” to End?
As of July 8, the U.S. Department of Justice (“DOJ”) is scheduled to begin full enforcement of its Data Security Program (“DSP”) and the recently issued Bulk Data Rule after its 90-day limited enforcement policy expires, ushering in “full compliance”
CPPA Enforcement Action Against Honda Underscores Need for CCPA Compliant Privacy Practices
On March 12, the California Privacy Protection Agency (“CPPA”) announced an enforcement action against American Honda Motor Co. (“Honda”), with a $632,500 fine for violating the California Consumer Privacy Act and its implementing regulations (“CCPA”).[1] This action, which is
Data Act FAQs – Key Takeaways for Manufacturers and Data Holders
On 3 February 2025, the European Commission (“EC”) published an updated version of its frequently asked questions (“FAQs”) on the EU Data Act.[1] The Data Act, which is intended to make data more accessible to users of IoT devices
New York Legislature Passes Health Data Privacy Bill
Last week, the New York legislature passed the New York Health Information Privacy Act (S929) (“NYHIPA” or the “Act”)[1]. The Act, which is currently awaiting the Governor’s signature, seeks to regulate the collection, sale and processing of healthcare