Resources

Guideline and Action Points for Hospital Consultants by IHCA

Health Data, Sensitive Data

Становище от 15.05.2012 г. на КЗЛД по искане No ЗАП- 18/23.04.2012

Health Data, Sensitive Data

НАРЕДБА No 1 ОТ 27 ФЕВРУАРИ 2013 Г. ЗА ПРЕДОСТАВЯНЕ НА МЕДИКО- СТАТИСТИЧЕСКА ИНФОРМАЦИЯ И НА ИНФОРМАЦИЯ ЗА МЕДИЦИНСКАТА ДЕЙНОСТ НА ЛЕЧЕБНИТЕ ЗАВЕДЕНИЯ

2025-W03 The Austrian DSB Slaps Down Google’s Controllership Denial, CCPA applicable for AI and more

2025-W05 DeepSeek: A Quantum Leap in AI, A Dead End in GDPR Compliance

2025-W02-Privacy News German Court Awards EUR 10000 for Unlawful Disclosure of Data, EDPB Issues Opinion on AI Models and more

UK ICO Consent Or Pay Guidelines

Consent, Lawfulness of Processing

OPINION OF ADVOCATE GENERAL SPIELMANN ON Case C‑413/23 P

Pseudonymisation, Technical and Organisational Measures (TOMs)

European Commision Guidelines Prohibited AI Practices

Position paper on Interplay between data protection and competition law

Competition law

Cases T-70/23, T-84/23 T-111/23

Supervisory Authorities

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847

FDPIC guideline cookies

Consent, Cookies, Lawfulness of Processing

CNIL GUIDELINES TRANSFER IMPACT ASSESSMENT

Data Transfers, Transfer Impact Assessment

Directive 2225/2023 on credit agreements for consumers

Privacy Navigator Podcast Episodes

W04-2025: Privacy Navigator Podcast

2024 Coordinated Enforcement Action Implementation of the right of access by controllers by EDPB

Access Requests (DSAR), Data Subjects Rights

EDPB Guidelines 1/2025 on Pseudonymisation

Pseudonymisation, Technical and Organisational Measures (TOMs)

AIIA example

AI, Data Protection Impact Assessment (DPIA)

Childrens Online Privacy Protection Rule

AI and privacy – guide for DPOs by CEDPO

W03-2025: Privacy News Podcast

DSB (Austria) – D130.1013 2024-0.743.431 nyob vs Google

Data Controller, Data Subjects Rights, Definitions

CJEU Press Release 2/2025 Case C-394/23 | Mousse

Data minimisation, Principles, Purpose limitation

UK ICO Controller ROPA Template

Records of processing Activities (ROPA)

UK ICO Consultation on GenAI

Legal Advisory – Application of Existing CA Laws to Artificial Intelligence

CNIL Permissions in Mobile Apps

Consent, Lawfulness of Processing

Garante vs OpenAI

UK ICO Introduction to Anonymisation

Anonymisation

CJEU Press Release 1/2025 Case T-354/22 | Bindl v Commission

Administrative Fines, Civil Liability and Damages, Data Transfers, Liability and Remedies

Решение СРС НАХД 14811-2019

Administrative Fines, Data Breaches, Liability and Remedies

W02-2025: Privacy News Podcast

Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

W50-2024: Privacy News Podcast

Case T-262/24 Commission v EDPS

Data Processing Agreement (DPA), Data Sharing, Records of processing Activities (ROPA)

UK ICO – consultation series on generative AI

Data Protection Impact Assessment (DPIA) – Microsoft CoPilot 365

Data Protection Impact Assessment (DPIA)

Adoption of AI, Blockchain and other emerging technologies within the European public sector A Public Sector Tech Watch report by EU Commission

AI, Public Interests

Draft Methodology for Human Rights, Democracy and the Rule of Law Impact Assessment for AI Systems by Council of Europe

AI, Data Protection Impact Assessment (DPIA)

A BLUEPRINT FOR GREECE’S AI TRANSFORMATION

AI, Public Interests

FTC decision against IntelliVision Technologies

Facial Recognition

Guidelines 02/2024 on Article 48 GDPR by EDPB

Data Transfers

Norwegian DPA decision Against Familiekanalen for Violating Children’s Privacy

Children as data subjects

Major US Telecom Providers Targeted in Chinese Cyber-Attack

Data Breaches

Sensitive Medical Data Exposed: French Hospital Breach Affects Hundreds of Thousands

Data Breaches

Lawsuit Canadian news vs OpenAI

AI, Copyright

Case C‑169/23 Másdi

Data Subject Rights Restrictions, Data Subjects Rights

Standard contractual clauses for EU-EEA by EU

Standard Contractual Clauses (SCC)

Standard contractual clauses for international transfers by EU

Data Transfers, Standard Contractual Clauses (SCC)

Decision of 19 October 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Andorra

Adequacy Decisions

Decision of 30 June 2003 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Argentina

Adequacy Decisions

Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act

Adequacy Decisions

Decision of 5 March 2010 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection provided by the Faeroese Act on processing of personal data

Adequacy Decisions

Decision of 21 November 2003 on the adequate protection of personal data in Guernsey

Adequacy Decisions

Decision of 31 January 2011 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data

Adequacy Decisions

Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man

Adequacy Decisions

Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information

Adequacy Decisions

Decision of 8 May 2008 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data in Jersey

Adequacy Decisions

Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand

Adequacy Decisions

Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act

Adequacy Decisions

Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided in Switzerland

Adequacy Decisions

Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom (notified under document C(2021)4800)

Adequacy Decisions

Decision (EU) 2021/1773 of 28 June 2021 pursuant to Directive (EU) 2016/680 of the European Parliament and of the Council on the adequate protection of personal data by the United Kingdom

Adequacy Decisions

Decision EU 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data under the EU-US Data Privacy Framework

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Decision pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by the Eastern Republic of Uruguay with regard to automated processing of personal data

Adequacy Decisions

Italy’s Data Protection Authority Fines Foodinho €5 Million for Data Violations

Administrative Fines, Employment, Lawfulness of Processing

Assessing Potential Future AI Risks, Benefits, and Policy Imperatives OECD

AI, Risk Management, Technical and Organisational Measures (TOMs)

Reducing Risks Posed by Synthetic Content by NIST

AI, Risk Management, Technical and Organisational Measures (TOMs)

CAIDP Responds to Outcome of U.S. Convening of AI Safety Institutes

AI, Risk Management, Technical and Organisational Measures (TOMs)

Proof of concept Blockchain and the right to erasure by AEPD

Right to Erasure

REGULATION (EU) 2024/2847 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (CYBER RESILIENCE ACT)

Technical and Organisational Measures (TOMs)

Decision by German Federal Court of Justice (BGH) on case against Facebook for data scraping incident (german)

Civil Liability and Damages, Data scraping, Liability and Remedies

New Australian Law will Mandate Age Checks, Data Deletion for Social Media Platforms

Children as data subjects

WhatsApp Data-Sharing Ban in India: Meta Faces $25.4M Fine

Data Sharing

OH Digitale Dienste version 1.2 by German data protection authority

Decision 114/2024 by Belgian Data Protection Authority (in Dutch)

Consent, Employment

First Draft General-Purpose AI Code of Practice by EU Commission

Mobile Applications recommendations for better privacy protection by CNIL (french)

Product Privacy Design

The Consumer Financial Protection Bureau (CFPB) by Consumer Financial Protection Bureau WASHINGTON, D.C

Finance and Fintech

DIRECTIVE (EU) 2024/2853 on liability for defective products and repealing

New technology

Musk Adds Microsoft to OpenAI Lawsuit, Expanding Antitrust Allegations

X’s Updated Terms Spark Privacy Concerns

Data Subjects Rights

New Data Broker Rules Approved by CPPA Board

Data Brokers

Senate Bill No. 362 (Delete Act)

Data Brokers

LAW DIVISION 6. CALIFORNIA PRIVACY PROTECTION AGENCY CHAPTER 3. Data Broker Registration

Data Brokers

Meta’s New Ad Model in the EU: Consent or Contextual Ads?

Consent, Data Subjects Rights

PRACTICAL GUIDE FOR DATA PROTECTION OFFICERS BY CNIL

Data Protection Officer (DPO)

GUIDE ON RESPONSIBLE USE OF BIOMETRIC DATA IN SECURITY APPLICATIONS BY Personal Data Protection Commission (PDPC) and Security Association Singapore (SAS)

Sensitive Data, Technical and Organisational Measures (TOMs)

AI tools in recruitment by UK ICO

Statement 5/2024 on the Recommendations of the High-Level Group on Access to Data for Effective Law Enforcement by EDPB

Access Requests (DSAR), Data Subjects Rights

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI Management Essentials by Department for Science, Innovation and Technology

CYBERSECURITY HANDBOOK by NATIONAL CYBERSECURITY AUTHORITY HELLENIC REPUBLIC

Technical and Organisational Measures (TOMs)

UK to Regulate AI Frontier Models with New Legislation in 2025

AEPD (Spain) – EXP202315853 against Ibercaja Banco

Lawfulness of Processing, Performance of Contract

Slovenian SA Decision 0603-42/2023/12 against Dodo Pizza

CCTV, Lawfulness of Processing, Legitimate Interest

EDPB Releases First Report on EU-U.S. Data Privacy Framework

U.S. Court Revives Video Privacy Lawsuit Against NBA

Lawfulness of Processing

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

EDPB Report on the first review of the European Commission Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Cyber Security Handbook for Small Business and Not-for-Profit Directors by Australian Information Security Association

Technical and Organisational Measures (TOMs)

GDPR in Practice – Experience of Data Protection Authorities by FRA

Supervisory Authorities

Data (Use and Access) Bill [HL] Draft

LinkedIn Fined €310 Million by Irish Data Regulator for Targeted Ads Without Consent

Lawfulness of Processing

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

noyb Files Complaint Against Pinterest for Unlawful Ad Tracking Practices

Lawfulness of Processing

UK’s New Data Use Bill: Easier Access and Enhanced Privacy for All

Local Laws

Age-Appropriate Design Toolkit Tracker

Children as data subjects

AI Toolkit Tracker

Personal Data Breach Management and Reporting Toolkit Tracker

Data Breaches

Requests for Access Toolkit Tracker

Access Requests (DSAR)

Data Sharing Toolkit Tracker

Data Sharing

Training and Awareness Toolkit Tracker

Technical and Organisational Measures (TOMs)

Information & Cyber Security Checklist Tracker

Technical and Organisational Measures (TOMs)

Records Management Toolkit Tracker

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Accountability Toolkit Tracker

Accountability

Age Appropriate Design Toolkit Tracker- more information about the Toolkit by UK ICO

Children as data subjects

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Personal Data Breach Management and Reporting Toolkit Tracker – more information about the Toolkit by UK ICO

Data Breaches

Information & Cyber Security Checklist Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Requests For Access Toolkit Tracker – more information about the Toolkit by UK ICO

Access Requests (DSAR)

Training and Awareness Toolkit Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Accountability Toolkit Tracker – more information about the Toolkit by UK ICO

Accountability

NIS 2 Directive Goes Live: Stricter Cybersecurity Measures Now in Effect

RTL Belgium Ordered to Add “Refuse All” Button to Cookie Banner by Belgian DPA

Consent

Meta Tests Facial Recognition for Scam Prevention and Easier Account Unlocking

X’s New Policy Allows AI Training on users Data

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Apohem AB (8/29/2024)

Controllers and Processors, Technical and Organisational Measures (TOMs)

Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)-Apoteket AB. (8/29/2024)

Controllers and Processors, Technical and Organisational Measures (TOMs)

Dutch Supervisory Authority for Data Protection (AP)-Clearview AI Inc. (5/16/2024)

Controllers and Processors, Data Subjects Rights, Lawfulness of Processing, Principles, Representative, Sensitive Data

Dutch Supervisory Authority for Data Protection (AP)-Uber Technologies Inc., Uber B.V. (7/22/2024)

Data Transfers

Polish National Personal Data Protection Office (UODO)-National Prosecutor’s Office (9/2/2024)

Consent, Controllers and Processors, Data Breaches, Lawfulness of Processing, Principles, Sensitive Data

Norwegian Supervisory Authority (Datatilsynet)-Eidskog municipality (9/6/2024)

Lawfulness of Processing

Data Protection Authority of Hamburg-Company (7/16/1905)

Data Protection Authority of Hamburg-Police employees (7/16/1905)

Data Protection Authority of Hamburg-Private individual (7/16/1905)

Data Protection Authority of Hamburg-Online retailer (7/16/1905)

Spanish Data Protection Authority (aepd)-ALTERNATIVA CORELLANA INDEPENDIENTE (6/26/2024)

Administratives Measures, Liability and Remedies

Data Protection Authority of Hamburg-Hotel (7/16/1905)

Spanish Data Protection Authority (aepd)-Private individual (7/4/2024)

Data minimisation, Principles

Data Protection Authority of Niedersachsen-Company (7/15/1905)

Lawfulness of Processing

Danish Data Protection Authority (Datatilsynet)-Municipality of Vejen (8/14/2024)

Spanish Data Protection Authority (aepd)-UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA (8/12/2024)

Data Subjects Rights, Integrity and confidentiality, Principles

French Data Protection Authority (CNIL)-Website editor (1/31/2024)

French Data Protection Authority (CNIL)-Unknown (1/31/2024)

Polish National Personal Data Protection Office (UODO)-Company (5/20/2024)

Controllers and Processors, Integrity and confidentiality, Principles, Representative, Technical and Organisational Measures (TOMs)

Italian Data Protection Authority (Garante)-TS Food Processing s.r.l. (6/20/2024)

Data Subjects Rights

Spanish Data Protection Authority (aepd)-AFIANZA ASESORES S.L. (3/16/2023)

Data Subjects Rights, Integrity and confidentiality, Principles

French Data Protection Authority (CNIL)-Association (5/25/2024)

French Data Protection Authority (CNIL)-Dentist (1/31/2024)

French Data Protection Authority (CNIL)-Association (4/25/2024)

Lawfulness of Processing

French Data Protection Authority (CNIL)-Pubilc educational institution (5/23/2024)

French Data Protection Authority (CNIL)-Bakery (6/10/2024)

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)-BEST ELAN ONLINE SRL (8/6/2024)

Administratives Measures, Liability and Remedies

Spanish Data Protection Authority (aepd)-Private individual (5/28/2024)

Data minimisation, Principles

Spanish Data Protection Authority (aepd)-EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. (6/7/2024)

Data minimisation, Data Subjects Rights, Principles

Spanish Data Protection Authority (aepd)-Private individual (5/14/2024)

Data minimisation, Principles

French Data Protection Authority (CNIL)-Pharmaceutical wholesaler (1/24/2024)

French Data Protection Authority (CNIL)-Attorney (1/22/2024)

French Data Protection Authority (CNIL)-Attorney (1/15/2024)

French Data Protection Authority (CNIL)-Website operator (1/9/2024)

Italian Data Protection Authority (Garante)-Municipality of Nepi (6/20/2024)

Controllers and Processors, Data Processing Agreement (DPA), Lawfulness of Processing, Representative