The first major EU Cyber Resilience Act (the “CRA”) compliance deadline is fast approaching. From 11 September 2026, manufacturers within scope of the CRA must comply with new reporting obligations for actively exploited vulnerabilities and severe incidents. These requirements take
On 7 July 2026, the European Data Protection Board (EDPB) adopted its draft Guidelines 02/2026 on Anonymisation for public consultation. The Guidelines provide long-awaited clarification on when data can truly be considered anonymous under the GDPR, updating the previous Article
Today, 17 July 2026, marks an important milestone under the EU’s Critical Entities Resilience Directive (CER), as Member States are required to identify and designate the entities considered “critical” for the provision of essential services.
Understanding the CER Directive
The
Deepfakes (AI-generated synthetic media capable of producing highly realistic images, audio, and video of real individuals) have graduated from a mere novelty to a genuine legal concern. Using neural networks trained on visual and audio data, deepfake systems can replicate
The United States Supreme Court’s decision in Trump v. Slaughter significantly alters the constitutional framework governing independent regulatory agencies and may have implications for transatlantic personal data transfers.
The six-to-three decision overturns Humphrey’s Executor v. United States, a 1935 case establishing
“Important data” is a concept unique to China law. It refers to data relating to specific topics, groups, or regions, or data that reaches a certain level of precision and scale, the tampering, destruction, leakage or illegal acquisition or use
For years, China’s cross-border data transfer regime was long on rules but short on consequences. Companies—both foreign and domestic—were given a relatively extended period to understand the requirements, formulate suitable strategies, and implement compliance measures. Recent enforcement actions led by
A proposed common template for personal data breach notifications recently published by the European Data Protection Board (“EDPB”) for consultation has the potential to assist organisations in streamlining personal data breach reporting across the EU while also raising additional complexity
The Data (Use and Access) Act 2025 (“DUAA”), introduces a new statutory requirement for all controllers, with no exceptions, to implement a formal process to handle data protection complaints by 19 June 2026.
Key changes
The DUAA received Royal Assent on 19
