March 2026 brought three developments worth knowing about: a CJEU ruling on when you can refuse a data access request, the launch of the EDPB's 2026 enforcement sweep on privacy notices, and a €530M fine against TikTok as a reminder that international data transfers go well beyond the US.

October 2025 brought two developments worth knowing: regulators are stepping up enforcement on cookie consent, and the EDPB announced that its 2026 coordinated enforcement action will target transparency and information obligations. Both hit the same nerve: the basics still matter.

Three developments from December 2024 worth knowing about: the EDPB's opinion on AI models and GDPR, the Dutch DPA's €4.75M fine against Netflix over transparency, and a CJEU ruling confirming that an apology can count as compensation for a GDPR breach.