March 2026 brought three developments worth knowing about: a CJEU ruling on when you can refuse a data access request, the launch of the EDPB's 2026 enforcement sweep on privacy notices, and a €530M fine against TikTok as a reminder that international data transfers go well beyond the US.

January 2026 brought three developments worth knowing: the EU-Brazil adequacy decision was finalised, new SCCs for a specific transfer scenario are still delayed, and the EDPB mapped out its guidance agenda for the year ahead.

The EU-US Data Privacy Framework is still standing, but its future is not guaranteed. Here is what has happened, why the uncertainty around transatlantic data transfers is not over, and what practical steps you can take to protect your business.