March 2026 brought three developments worth knowing about: a CJEU ruling on when you can refuse a data access request, the launch of the EDPB's 2026 enforcement sweep on privacy notices, and a €530M fine against TikTok as a reminder that international data transfers go well beyond the US.

September 2025 brought three major developments: the EU Data Act became applicable, the CJEU issued a landmark ruling on pseudonymised data, and the EU-US Data Privacy Framework survived its first court challenge. Here is what you need to know

Three developments from December 2024 worth knowing about: the EDPB's opinion on AI models and GDPR, the Dutch DPA's €4.75M fine against Netflix over transparency, and a CJEU ruling confirming that an apology can count as compensation for a GDPR breach.

Three developments from November 2024 worth knowing about: the Lindenapotheke ruling on competitor GDPR enforcement, the Cyber Resilience Act entering into force, and the Belgian DPA's decision against Freedelity.