The ICO has issued a consultation to seek organisations’ views on the processes the ICO follows when it suspects a breach of the UK GDPR or the Data Protection Act 2018 www.privacylaws.com/news/ico-con...

UK Report Jan 2026 out now: - Paying compensation under UK data protection law - Online Safety Act and UK DP laws converge on protecting children - Cyber Security and Resilience Bill - How to run a successful data champions programme + much more www.privacylaws.com/reports-gate...

The European Commission is currently seeking views on the establishment and operation of AI regulatory sandboxes as mandated by the EU AI Act www.privacylaws.com/news/eu-cons...

The European Commission’s spokesperson has today confirmed to PL&B that the European Commission is now finalising preparations with a view to having the new adequacy decisions in place before the end of the month www.privacylaws.com/news/uk-s-eu...

A new completely different market mechanism to tackle privacy issues, which addresses the absence of personal data markets and a bargaining power imbalance between companies and consumers, has been proposed by the Global Initiative for Digital Empowerment www.privacylaws.com/news/strengt...

December International Report out now: - Pseudonymised data is not always personal data, CJEU says - LinkedIn will limit the volume & nature of user data for AI training - Australia’s privacy payouts escalate - Where does robot data go? + much more... www.privacylaws.com/reports-gate...

Looking forward to our inaugural Meet the Correspondents event next week, 3 December, at Stephenson Harwood LLP in London It will be a great afternoon of talks central to the work of privacy law professionals and networking. Only a few places remain www.privacylaws.com/events-gatew...

Academics, legal & civil society representatives have written to the Science, Innovation & Technology Committee calling for an enquiry into the ICO’s enforcement, pointing out the ICO's shift away from enforcement in the public sector www.privacylaws.com/news/call-fo...

The EU Commission is proposing targeted amendments to the GDPR, for example to narrow the definition of personal data and to allow organisations the option to refuse an access request if it not made for data protection purposes, or charge a reasonable fee www.privacylaws.com/news/eu-star...

November UK Report out now: - DUAA introduces a new complaints-handling requirement - Navigating the new ‘recognised legitimate interest’ lawful basis - Beyond cyber – beware of human error & process pitfalls - UK GDPR certification under Art. 42 + much more... www.privacylaws.com/reports-gate...

The UK's ICO has issued a consultation to seek organisations’ views on the processes the ICO follows when it suspects a breach of the UK GDPR or the Data Protection Act 2018 www.privacylaws.com/news/ico-con...

We are excited to announce that our Student Essay Competition 2026 is now live! We invite university students worldwide to submit a 1500-word essay for a chance to win great prizes, such as free access to PL&B’s 39th International Conference in Cambridge www.privacylaws.com/reports-gate...

Join us next week on 4 Nov and get to grips with the common elements of principle and many differences in practice between US and European privacy laws Gain practical strategies for managing the fast developing privacy laws and privacy elements in other laws www.privacylaws.com/events-gatew...

The EDPB has published mostly positive opinions on the UK’s draft GDPR adequacy decisions published in July 2025, saying that it welcomes the continuing alignment between the UK and EU data protection frameworks www.privacylaws.com/news/edpb-is...

The ICO issued, on 15 October, a fine of £14m to Capita (Capita plc for £8m and Capita Pension Solutions Limited £6m) for a data security breach www.privacylaws.com/news/ico-fin...

Join us on 4 November for an illuminating panel event where leading voices from academia and industry will discuss how to respond to emerging challenges for age assurance www.privacylaws.com/events-gatew...

The European Data Protection Board’s new coordinated enforcement action will look into organisations’ compliance with the transparency and information obligations under the GDPR www.privacylaws.com/news/edpb-to...

October International Report is out now: - Defending MAGA speech: Trump’s war on global data Privacy - Australia seeks real-world privacy protections for children - CNIL’s AI guidance sets practical standards - GDPR enforcement trends for companies + much more www.privacylaws.com/reports-gate...

Join us on 3 December at Stephenson Harwood LLP for an afternoon of informative data protection talks and networking www.privacylaws.com/events-gatew...

Join us on 4 November at Latham & Watkins and get to grips with the common elements of principle and many differences in practice between US and European privacy laws. www.privacylaws.com/events-gatew...

While it has long been recognised that the ePrivacy Directive is outdated and attempts to adopt a regulation in this field have failed, the Commission recognises cookie consent fatigue, and the need to strengthen users’ digital rights online www.privacylaws.com/news/eu-laun...

The European Commission launched the process towards the adoption of a data protection adequacy decision with Brazil declaring that it ensures an adequate level of data protection on a similar basis to that of the EU www.privacylaws.com/news/eu-puts...

France’s Data Protection Authority, the CNIL, has fined Google €325 million & SHEIN €150 million, in particular for failing to comply with the rules on cookies www.privacylaws.com/news/cnil-fi...

UK Report Sept 2025 is out now, includes: - DUAA data protection aspects in force by end of 2025 - ICO fines 23andMe £2.31 million - Half-baked no more: Reheated rules on cookies & consent - New Act enhances enforcement and investigatory powers + much more www.privacylaws.com/reports-gate...

Join us on 1 Oct and hear from DSIT and ICO speakers on how the UK's DUAA 2025 will make it easier for businesses in the UK to develop products and services while ensuring a high standard of rights for individuals regarding their personal data www.privacylaws.com/events-gatew...

August International Report out now, inc: - Germany: Landmark case on using publicly available data for AI - Ireland imposes half of all EU GDPR fines in 2024 - GDPR simplification starts with one step at a time - Malaysia’s complex new guidelines www.privacylaws.com/reports-gate...

The UK government has issued the commencement dates for various parts of the Data (Use and Access) Act 2025, starting from 20 August 2025: www.privacylaws.com/news/data-us...

The European Commission has indicated in a draft decision that the UK remains adequate for EU-UK data flows under the new Data (Use and Access) Act 2025 www.privacylaws.com/news/eu-show...

The European Data Protection Board will be helping organisations to understand their GDPR obligations better by issuing simplified guidance #dataprotection #privacylaws #gdpr www.privacylaws.com/news/edpb-to...

Paul Arnold MBE is the first CEO of the future Information Commission which is created under the Data (Use and Access) Act 2025 (DUAA) www.privacylaws.com/news/paul-ar...

In its review of the economic impact of the GDPR, the CNIL chose to study the benefits of the GDPR. Its analysis focused on cybersecurity reveals that the GDPR has generated benefits between €585 million in identity theft cases and €1.4 billion in cyber damages www.privacylaws.com/news/cnil-sa...

July UK Report includes: - Data (Use and Access) Act 2025 - Handling complex DSARs, how AI can help - Mind the gap: Content Moderation in UK vs. EU - Cyber Security & Resilience Bill - M&S cyber attack: Lessons for retailers - ‘Is My Boss a Bot’? AI in recruitment www.privacylaws.com/reports-gate...

The UK Data (Use and Access) Bill has today received Royal Assent. The Department of Science and Technology will issue guidance and a commencement schedule in due course #dataprotection #privacylaws www.privacylaws.com/news/data-us...

The ICO has today issued a fine of £2.31million on 23andMe for failing to implement appropriate data security measures. Highly sensitive data of 155,592 people in the UK was compromised by the incident which affected seven million people globally www.privacylaws.com/news/ico-fin...

The UK Parliament yesterday passed the Data (Use and Access) Bill which now awaits Royal Assent before becoming law. The new law does not alter the UK’s current data protection regime as dramatically as was proposed under the Conservative government www.privacylaws.com/news/data-us...

June Report out now, inc: Appeal Court supports Belgian DPA against Real-Time Bidding Malta backs GDPR record-keeping simplification EDPB advises on pseudonymisation Africa’s regional privacy culture 172 Countries with #privacylaws El Salvador #DataProtection Law www.privacylaws.com/reports-gate...

The last remaining issue to be agreed on the Data Use and Access Bill (DUAB), AI and copyright, has caused a continued ping-pong between the two Houses of Parliament #dataprotection #privacylaws www.privacylaws.com/news/parliam...

Actionable insights into how to tackle the challenges faced by Privacy Officers due to the rise in AI: Assessing AI tools for compliance with #dataprotection laws Managing AI-driven data requests Addressing privacy risks in AI deployment Full programme: privacylaws.com/prog2025 #plb2025 #privacylaws

Regulators from Bermuda, Guernsey, Jersey & Gibraltar discuss the unique challenges and requirements of compliance in global strategic zones and what companies can do to ensure that their clients’ data is safe & secure Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws

Sandra Skehan (DPC Ireland), Annabel Gillham (Morrison Foerster) & Colin Rooney (Arthur Cox LLP) dissect the complexities of DSARs, share best practices & provide a comprehensive toolkit for handling DSARs effectively Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws

With damages claims arising from #dataprotection violations representing a particularly significant financial risk for companies, the panel will discuss ECJ judgements, how courts have dealt with these claims & highlight the drivers of mass actions Full programme: privacylaws.com/prog2025 #plb2025

Drawing on real-world examples, Samantha Sayers, Bolt, & James Drury-Smith, DWF, discuss "life hacks" for structuring and resourcing a data protection operating model that balances agility, compliance, and cost-efficiency Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws

Kim Shur, Eve-Christie Vermynck & Phyllis Sumner cover a cybersecurity incident, walking through & discussing board engagement; regulatory investigations; class actions; & regulatory orders imposing remedial actions Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws

Expert insight on controller and processor stances and market trends in contract negotiations following recent developments, including EDPB Opinion 22/2024 on reliance on processors and sub-processors. Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws

Giles Pratt, Tina Maisonneuve & Sarah Macfarlane discuss the intersection between AI & the boardroom How should companies talk to investors about AI? What are the AI governance responsibilities? How do shareholders view AI & compliance? Full programme: privacylaws.com/prog2025 #plb2025 #privacylaws

The EU Commission is proposing that SMEs, SMCs and organisations with fewer than 750 employees will be required to maintain records only when the processing of personal data is “high risk” under the GDPR www.privacylaws.com/news/eu-prop...

Being a DPO is hard. Simon Hania, from Uber, will share how he has created an operational structure that allows him to effectively navigate the challenges of being the appointed DPO for more than 30 jurisdictions across the globe Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection

Legal jargon & bureaucratic language form an inseparable part of privacy regulations. Henna Tolvanen explores how principles of design thinking & user-centred design can create effective, accessible & comprehensible privacy information Full programme: privacylaws.com/prog2025 #plb2025

Masha Ooijevaar, Renato Leite & @grahamgreenleaf.bsky.social examine data protection laws in Saudi Arabia, Jordan, Oman and the Dubai International Financial Centre And provide updates on the data protection laws in the UAE, Qatar, Bahrain & Egypt Full programme: privacylaws.com/prog2025 #plb2025

Heikki Tolvanen discusses how Privacy Impact Assessment & DPIA frameworks can be utilised to address the unique risks posed by AI systems. Learn how to align AI risk assessment with established privacy governance models Full programme: privacylaws.com/prog2025 #plb2025 #dataprotection #privacylaws