April's privacy update covers three things worth knowing: a Belgian DPA fine over an ex-employee's mailbox, the Booking.com data breach as a reminder about vendor risk, and the EDPB's first standardised DPIA template.

March 2026 brought three developments worth knowing about: a CJEU ruling on when you can refuse a data access request, the launch of the EDPB's 2026 enforcement sweep on privacy notices, and a €530M fine against TikTok as a reminder that international data transfers go well beyond the US.

Our February 2026 roundup: a CJEU ruling on EDPB decisions, the Digital Omnibus Joint Opinion, and a reality check on the right to erasure.

January 2026 brought three developments worth knowing: the EU-Brazil adequacy decision was finalised, new SCCs for a specific transfer scenario are still delayed, and the EDPB mapped out its guidance agenda for the year ahead.

The European Commission's Digital Omnibus proposal landed in November 2025 with one clear aim: make EU digital compliance less of a maze. Here is what it proposes, what it means in practice, and where things stand now.

October 2025 brought two developments worth knowing: regulators are stepping up enforcement on cookie consent, and the EDPB announced that its 2026 coordinated enforcement action will target transparency and information obligations. Both hit the same nerve: the basics still matter.

September 2025 brought three major developments: the EU Data Act became applicable, the CJEU issued a landmark ruling on pseudonymised data, and the EU-US Data Privacy Framework survived its first court challenge. Here is what you need to know

Three developments from December 2024 worth knowing about: the EDPB's opinion on AI models and GDPR, the Dutch DPA's €4.75M fine against Netflix over transparency, and a CJEU ruling confirming that an apology can count as compensation for a GDPR breach.

Three developments from November 2024 worth knowing about: the Lindenapotheke ruling on competitor GDPR enforcement, the Cyber Resilience Act entering into force, and the Belgian DPA's decision against Freedelity.