Resources

Musk Adds Microsoft to OpenAI Lawsuit, Expanding Antitrust Allegations

X’s Updated Terms Spark Privacy Concerns

Data Subjects Rights

New Data Broker Rules Approved by CPPA Board

Data Brokers

Meta’s New Ad Model in the EU: Consent or Contextual Ads?

Consent, Data Subjects Rights

PRACTICAL GUIDE FOR DATA PROTECTION OFFICERS BY CNIL

Data Protection Officer (DPO)

GUIDE ON RESPONSIBLE USE OF BIOMETRIC DATA IN SECURITY APPLICATIONS BY Personal Data Protection Commission (PDPC) and Security Association Singapore (SAS)

Sensitive Data, Technical and Organisational Measures (TOMs)

AI tools in recruitment by UK ICO

Discussion Paper: Large Language Models and Personal Data by The Hamburg Commissioner for Data protection and freedom of information

AI Management Essentials by Department for Science, Innovation and Technology

CYBERSECURITY HANDBOOK by NATIONAL CYBERSECURITY AUTHORITY HELLENIC REPUBLIC

Technical and Organisational Measures (TOMs)

UK to Regulate AI Frontier Models with New Legislation in 2025

EDPB Releases First Report on EU-U.S. Data Privacy Framework

U.S. Court Revives Video Privacy Lawsuit Against NBA

Lawfulness of Processing

Data Broker Sells Voter Data on Support for QAnon and January 6

Data Sharing

AI and the audiovisual sector: navigating the current legal landscape by IRIS European Audiovisual Observatory

Harmonised Standards for the European AI Act by EU Commission

AI Principles and Best Practices for Developers and Employers by U.S. DEPARTMENT OF LABOR

Cyber Security Handbook for Small Business and Not-for-Profit Directors by Australian Information Security Association

Technical and Organisational Measures (TOMs)

LinkedIn Fined €310 Million by Irish Data Regulator for Targeted Ads Without Consent

Lawfulness of Processing

Perplexity AI Faces Lawsuit Over Alleged Copyright Violations by Dow Jones and NY Post

noyb Files Complaint Against Pinterest for Unlawful Ad Tracking Practices

Lawfulness of Processing

UK’s New Data Use Bill: Easier Access and Enhanced Privacy for All

Local Laws

Age Appropriate Design Toolkit Tracker- more information about the Toolkit by UK ICO

Children as data subjects

Artificial Intelligence (AI) Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing Toolkit Tracker – more information about the Toolkit by UK ICO

Data Sharing

Information & Cyber Security Checklist Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Records Management Toolkit Tracker – more information about the Toolkit by UK ICO

Data Retention, Personal Data Collection, Records of processing Activities (ROPA)

Requests For Access Toolkit Tracker – more information about the Toolkit by UK ICO

Access Requests (DSAR)

Training and Awareness Toolkit Tracker – more information about the Toolkit by UK ICO

Technical and Organisational Measures (TOMs)

Accountability Toolkit Tracker – more information about the Toolkit by UK ICO

Accountability

RTL Belgium Ordered to Add “Refuse All” Button to Cookie Banner by Belgian DPA

Consent

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg discussion paper on “Legal Foundations in Data Protection for the Use of AI”

AI, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Japan AI Safety Institute’s “Guide to Red Teaming Methodology on AI Safety”

AI, Specific processing situations

Supreme Court of Singapore’s Circular on the Use of GenAI Tools in Court Documents

Data Processing by the Government, Specific processing situations

“The Landscape of Consent Management Tools – A Data Altruism Perspective” by EU Commission

Consent, Lawfulness of Processing

Major US Telecoms Hacked by Chinese Group, Federal Surveillance System Compromised

ICO Hits Northern Ireland Police with Fine Over Employee Data Breach

French News Agency AFP Hit by Cyber Attack, Real-Time News Feeds Affected

Study Finds ChatGPT Can Perform Biometric Tasks: A Closer Look at Privacy Risks

AI, Sensitive Data

Five New CJEU Rulings: A Turning Point for GDPR Compliance

The EU’s International Cooperation on Cyber Capacity Building| second edition

Technical and Organisational Measures (TOMs)

Cyber Threat Modelling for Risk Assessment by CSB

Risk Management, Technical and Organisational Measures (TOMs)

Guide to Good Governance in Cybersecurity by DCSD

Technical and Organisational Measures (TOMs)

ENISA Threat Landscape 2024 EU Agency for Cybersecurity

Technical and Organisational Measures (TOMs)

Chief Information Security Officer_ HANDBOOK

Risk Management

FTC Targets Deceptive AI Claims with Operation AI Comply

AI, Lawfulness of Processing

OpenAI, Microsoft, and Amazon Join EU’s AI Pact to Shape Future Regulations

Meta Fined $101 Million for Exposing Millions of Passwords in Plaintext

Lawfulness of Processing, Technical and Organisational Measures (TOMs)

California Governor Vetoes AI Safety Bill

National Strategy on AI by Sri Lanka

AI, Lawfulness of Processing, Specific processing situations

The Future of European Competitiveness by EU Commission

AI, New technology, Specific processing situations

Tech Giants Sign Open Letter Urging “Regulatory Certainty on AI” in Europe

Telegram’s New Policy: User Data to Be Shared with Authorities in Criminal Cases

Data Sharing, Data Subjects Rights

Genetic Testing Company 23andMe Pays $30M for Data Breach

Data Breaches, Sensitive Data

LinkedIn Used User Data for AI Training Before Updating Its Terms

AI, Data Sharing, Data Subjects Rights, Lawfulness of Processing

India Digital Personal Data Protection Act (2023)

NIST Special Publication NIST SP 800-221A_Information and Communications Technology (ICT) Risk Outcomes Integrating ICT Risk Management Programs with the Enterprise Risk Portfolio

Risk Management

Artificial Intelligence and Machine Learning in Health Care and Medical Sciences Best Practices by Pitfalls Gyorgy J. Simon Constantin Aliferis Springer

AI, Health Data, Principles, Sensitive Data, Specific processing situations

Report and Guidance on Privacy in Social Network Services – ”Rome Memorandum” by International Working Group on Data Protection in Telecommunications

Definitions, Processing of personal data

ENFORCEMENT ADVISORY NO. 2024-02 by CALIFORNIA PRIVACY PROTECTION AGENCY AVOIDING DARK PATTERNS: CLEAR AND UNDERSTANDABLE LANGUAGE, SYMMETRY IN CHOICE

Data Subjects Rights

Belgian DPA Enforces GDPR Compliance on Cookie Banners After noyb Complaints

EU Court Upholds €2.4 Billion Fine Against Google for Abusing Market Power

Swedish Bank Penalized €1.3 million for Transferring Customer Data to Meta

2025 Update: New SCCs Will Address Missing Rules for Cross-Border Data Transfers

Rethinking Privacy in the AI Era | White Paper by Stanford University

AI, Specific processing situations

THE NEW STANDARD CONTRACTUAL CLAUSES – QUESTIONS AND ANSWERS

Data Transfers, Standard Contractual Clauses (SCC)

A pro-innovation approach to AI regulation by UK ICO

AI, Specific processing situations

Comparison of U.S. State Privacy Laws. Data Protection Assessments by CIPL

Controllers and Processors, Data Protection Impact Assessment (DPIA)

GDPR: a culture of non-compliance? Numbers of evidence-based enforcement efforts by nyob

Liability and Remedies, Supervisory Authorities

Analysis of the final compromise text of the EU AI Act with a view to agreement by the Belgian Presidency

AI, Specific processing situations

Recommendations 02/2020 on the European Essential Guarantees for surveillance measures

CCTV, Lawfulness of Processing, Legitimate Interest, Specific processing situations

Artificial Intelligence Strategy of the CJEU

AI, Specific processing situations

Processing Personal Data on the Basis of Legitimate Interests under the GDPR by FPF

Lawfulness of Processing, Legitimate Interest

Interim Report – Governing AI for Humanity by UN AI Advisory Body

AI, Specific processing situations

AI fairness in practice by the Alan Turing Institute

AI, Specific processing situations

RISK FRAMEWORK FOR BODY-RELATED DATA IN IMMERSIVE TECHNOLOGIES BY FPF

Principles, Sensitive Data

A Guide to Cookies and Compliance by DMA

Consent, Cookies, Lawfulness of Processing

European Commision press release on AI Act Agreement

AI, Specific processing situations

Privacy-Enhancing and Privacy Preserving Technologies: Understanding the Role of PETs and PPTs in the Digital Age by CIPL

Controllers and Processors, Technical and Organisational Measures (TOMs)

Cybersecurity of Artificial Intelligence in the AI Act by the European Commision

Controllers and Processors, Technical and Organisational Measures (TOMs)

New rules for Artificial Intelligence – Questions and Answers by the European Commision

AI, Specific processing situations

Understanding the Role of PETs and PPTs in the Digital Age

Controllers and Processors, Technical and Organisational Measures (TOMs)

Everything Recruiters Need to Know About GDPR by ZOHO

Employment, Specific processing situations

SME Guide on Information Security Controls by European Digital SME Alliance

Controllers and Processors, Technical and Organisational Measures (TOMs)

AI Act Provisional Agreement Press Release

AI, Specific processing situations

PRACTICAL GUIDANCE FOR THE USE OF GENERATIVE ARTIFICIAL INTELLIGENCE IN THE PRACTICE OF LAW by State Bar of California

AI, Specific processing situations

GDPR guidance: Legitimate Inerersts Assessments (LIA) for Digital Advertising

Lawfulness of Processing, Legitimate Interest, Marketing and Advertising, Specific processing situations

The impact of the General Data Protection Regulation (GDPR) on artificial intelligence by the EU Parliamnet

AI, Specific processing situations

Benefits and Risks of Generative Artificial Intelligence Report by the State of California

AI, Specific processing situations

Artificial intelligence for healthcare and well-being during exceptional times | European Commision

Generative AI: The Data Protection Implications by CEDPO

AI, Specific processing situations

Exceeding customer expectations by Google

Principles, Privacy by Design

Global Toolkit on AI and the Rule of Law for the Judiciary by UNESCO

AI, Specific processing situations

TOWARDS A SUSTAINABLE, MULTILATERAL, AND UNIVERSAL SOLUTION FOR INTERNATIONAL DATA TRANSFER by the UK Government

Data Transfers

Automated Decision-Making Under the GDPR by the FPF

AI, Automated Decision-making, Controllers and Processors, Specific processing situations

Protection of workers’ personal data: General principles by ILO

Employment, Specific processing situations

Study on the essence of the fundamental rights to privacy and to protection of personal data by EDPS

Data Subjects Rights

Human rights Impact Assessments for AI

Controllers and Processors, Data Protection Impact Assessment (DPIA)

Government access to datain third countries

Data Processing by the Government, Specific processing situations

Decision of the Data Protection Commission made pursuant to Section 111 of the DPA, 2018 and Articles 60 and 65 of the GDPR

Fairness, Liability and Remedies, Principles, Supervisory Authorities

Practice Guide to Anonymising Personal Data

Anonymisation, Controllers and Processors

One-Stop-Shop thematic case digest: RIGHT TO OBJECTAND RIGHT TO ERASURE

Data Subjects Rights, Right to Erasure, Right to Object

Study on the appropriate safeguards under Article 89(1) GDPR for the processing of personal data for scientific research

Material scope, Scientific Research, Specific processing situations

Study on the national administrative rules impacting the cooperation duties for the national supervisory authorities

Supervisory Authorities

Demonstration of a privacy-preserving age verification process by CNIL

Children as data subjects, Data Subjects Rights

Voluntary AI Safety Standard by the Australian Government

AI, Specific processing situations

Safe and responsible AI in Australia Proposals paper for introducing mandatory guardrails for AI in high-risk settings by Australian Government

AI, Specific processing situations

Frequently Asked Questions (FAQs) on the Data Act by the EU Commission

Controllers and Processors, Data Sharing

Multidisciplinary Perspectives on Artificial Intelligence and the Law by Springer

AI, Specific processing situations

Meta CAN Use Brazilian User Data for AI Training with Restrictions

Irish Watchdog Ends Case Against X Following AI Data Restrictions

Council of Europe Unveils First Global AI Treaty

FBI Audit Reveals Major Data Handling Flaws

UNESCO: Consultation paper on AI Regulation

AI, Lawfulness of Processing, Public Interests, Specific processing situations

Saudi Data & Artificial Intelligence Authority: Rules governing the appointment of Personal DPOs under the Kingdom of Saudi Arabia’s (KSA) Personal Data Protection Law (PDPL)

AI, Specific processing situations

Briefing EU Legislation in Progress by EPRS on AI Act

AI, Specific processing situations

GDPR in practice – Experiences of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Effective Cyber Risk Management: A best practice governance guide for digitally secure and resilient organisations by Governance Institute of Australia

Risk Management, Technical and Organisational Measures (TOMs)

Online age verification: balancing privacy and the protection of minors by CNIL

Children as data subjects, Data Subjects Rights

Online age verification: balancing privacy and the protection of minors by CNIL | French

Children as data subjects, Data Subjects Rights

EU Parliament Faces noyb Complaints After Major Data Breach

California’s New AB 3048: Opt-Out Signals in Every Browser

Dutch DPA Fines Clearview €30.5M: Directors Could be Held Liable

OpenAI and Anthropic Partner with U.S. Government for AI Safety Research

Massive Data Breach: Exposed 31.5 Million Sensitive Records from ServiceBridge

NIST Special Publication_1800: Implementing a Zero Trust Architecture

Technical and Organisational Measures (TOMs)

ON THE ANTITRUST IMPLICATIONS OF EMBEDDING GENERATIVE AI IN CORE PLATFORM SERVICES BY SSRN

AI, Specific processing situations

Policy for the responsible use of AI in government by Australian Government

AI, Data Processing by the Government, Specific processing situations

Consumer Protection in respect of Use of Generative Artificial Intelligence by Hong Kong Monetary Authority

AI, Specific processing situations

The State of Artificial Intelligence in the Pacific Islands

AI, Specific processing situations

Google’s Gemini AI on Android with Enhanced Privacy Features

NPD Confirms Major Breach: Sensitive Data of Millions Exposed

ICO Provisional £6 Million Penalty for Software Provider Following NHS Data Breach

X Closes Brazil Operations Citing “Censorship Orders” from Judge

Data protection code of practice for digital identity schemes in Afrtica

Code of Conduct, Controllers and Processors

Relying on the legal basis of legitimate interests to develop an AI system by CNIL

Lawfulness of Processing, Legitimate Interest

Website privacy controls a guide for business by New York State Attorney General

Data Subjects Rights

Data protection compliant AI by Bavarian State Office for Data protection Supervision

AI, Specific processing situations

NIST Special Publication_1800-29 Data Confidentiality- Detect, Respond to, and Recover from Data Breaches

Controllers and Processors, Data Breaches

Meta Faces $1.4 Billion Penalty for Unauthorized Biometric Data Collection in Texas

Noyb Sues Hamburg DPA Over ‘Pay or OK’ Consent System

Google Officially Declared a Monopoly by U.S. Federal Judge

Noyb Files Nine Complaints Against Twitter/X for Unlawful AI Data Usage

Meta Challenges EDPB Opinion on “Consent or Pay” Model at EU Court

Lithuanian SA Fines Vinted UAB €2.38 Million for GDPR Violations

EU AI Act Now in Force: Prepare for Compliance

Meta and OpenAI Unveil New AI Models: Llama 3.1 and SearchGPT

Confidential Computing and Privacy: Policy Implications of Trusted Execution Environments by Future of Privacy Forum

AI, Specific processing situations

Frequently Asked Questions (FAQ) NIS2 in Belgium by Centre for cybersecurity Belgium

Technical and Organisational Measures (TOMs)

Formal Opinion 512 on Generative Artificial Intelligence Tools by AMERICAN BAR ASSOCIATION

AI, Specific processing situations

Today’s and tomorrow’s means of payment facing the challenge of data protection by CNIL

Definitions, Processing of personal data

Artificial Intelligence and Algorithms in Risk Assessment by the European Labour Authority

Risk Management

PRIVACY ENHANCING TECHNOLOGY (PET): PROPOSED GUIDE ON SYNTHETIC DATA GENERATION BY PDPC

Principles, Sensitive Data

ENFORCEMENT ADVISORY NO. 2024-01 APPLYING DATA MINIMIZATION TO CONSUMER REQUESTS BY CALIFORNIA PRIVACY PROTECTION AGENCY

Data minimisation, Principles

Global Third Party Cybersecurity Breaches by SecurityScorecard

Controllers and Processors, Data Breaches

GDPR & Generative AI A Guide for Customers by Microsoft

AI, Specific processing situations

Principles on Children & Online Gaming Adopted at the Nordic Data Protection Meeting in Oslo 30 May 2024

Children as data subjects, Data Subjects Rights

DECISION OF THE INFORMATION COMMISSIONER Snap Inc. and Snap Group Limited

AI, Specific processing situations

Artificial intelligence (AI) and human rights: Using AI as a weapon of repression and its impact on human rights by EU Parliament

AI, Specific processing situations

GDPR in practice: Experience of data protection authorities by FRA

Data Processing by the Government, Specific processing situations

Information note by EDPB on data transfers under the GDPR to the United States after the adoption of the adequacy decision on 10 July 2023

Adequacy Decisions, Data Transfers

Regulating targeted and behavioural advertising in digital services by EU Parliament

Marketing and Advertising, Specific processing situations

Data protection impact assessment on the processing of personal data on government Facebook Pages

Controllers and Processors, Data Protection Impact Assessment (DPIA)

The Standard Data Protection Model Version 3.0a by the Conference of Independent Federal and State Data Protection Supervisory Authorities Germany

GDPR & GENERATIVE AI – A GUIDE FOR THE PUBLIC SECTOR BY MICROSOFT

AI, Specific processing situations

Comments on Guidelines 07/2020 on the concepts of controller and processor in the GDPR from the perspective of the Translation and Interpreting Sector by FIT Europe and EUATC

Controllers and Processors

Information Note by EDPB on the redress mechanism for EU/EEA individuals in relation to alleged violations of U.S. law with respect to their data collected by U.S authorities competent for national security

Adequacy Decisions, Data Transfers

Generative Artificial Intelligence Risk Assessment by State of California Department of Technology

AI, Risk Management, Specific processing situations

Perspectives on Issues in AI Governance by Google

AI, Specific processing situations

Certified Data Protection Officer by PECB

Data Protection Officer (DPO)

Artificial Intelligence and Privacy

Practice Guide to Anonymising Personal Data by Stiftung Dateschutz

Anonymisation

Human rights Impact Assessments for AI by Access Now

AI, Data Protection Impact Assessment (DPIA)

GenAI and data protection: how organisations and their employees can use it appropriately and lawfully

AI, Employment

Mapping Relationships Between Documentary Standards, Regulations, Frameworks, and Guidelines | NIST

Information note on data transfers under the GDPR to the US | EDPB

Data Transfers

UK MRC Identifiability, anonymisation and pseudonymisation

Anonymisation

How to manage DPIAs by Data Protection Network (DPN)

Data Protection Impact Assessment (DPIA)

Privacy Impact Assessment (PIA) Methodology by CNIL

Data Protection Impact Assessment (DPIA)

Data Protection Code of Conduct for Cloud Infrastructure Service Providers

Cloud Services

Members of the Code of Conduct for Cloud Infrastructure Service Providers

Code of Conduct

Cookies Instructions Kit by DMA Italy, FedoWEB et al.

Consent, Cookies

Australian Information Commissioner (OAIC): Corporate Plan for 2024-25

Data Processing by the Government, Specific processing situations

Telegram CEO’s Arrest Sparks Debate on Privacy vs. Regulation

Personal Data Collection, Technical and Organisational Measures (TOMs)

AI Meets Media: OpenAI Secures Another Multi-Year Deal with Media Giant

AI models collapse when trained on recursively generated data

AI, Specific processing situations

The government-wide vision on Generative Al of the Netherlands

AI, Data Processing by the Government, Specific processing situations

AI Possible Risks & Mitigations Optical Character Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

AI Possible Risks & Mitigations Named Entity Recognition by EDPB

AI, Controllers and Processors, Data Protection Impact Assessment (DPIA), Specific processing situations

The 10-Step Plan for Solid Privacy Compliance Based On The Most Common Fines

5310-C Privacy Threshold Assessments and Privacy Impact Assessments by Office of Information Security

Controllers and Processors, Data Protection Impact Assessment (DPIA)

THE INTERSECTION BETWEEN COMPETITION AND DATA PRIVACY by OECD – OCDE

Data Subjects Rights

Supervision of AI systems in the EU by Dutch DPA and RDI (english)

AI, Specific processing situations

Statement on the interplay between AI Act and GDPR for private sector by the The Austrian DPA

AI, Specific processing situations

Review of cybersecurity news in Ukraine, tendencies, and world events related to the First World Cyber War by U.S. Agency for International Development

National Security, Specific processing situations

Rules of Procedure by EDPB on the cooperation and respective roles of national SAs and the EDPB Secretariat regarding the submission of complaints in the redress mechanism available to EU individuals in relation to alleged violations of U.S law with respect to their data collected by U.S. authorities competent for national security

Adequacy Decisions, Data Transfers, Risk Management

Automated Decision-Making in Online Platforms: Protection Against Discrimination and Manipulation of Behavior

Automated Decision-making, Controllers and Processors

Rules of Procedure for the “Informal Panel of EU DPAs”according to the EU-US Data Privacy Framework by EDPB

Adequacy Decisions, Data Transfers

Building a Cybersecurity and Privacy Learning Program | NIST | Initial Public Draft

Data Breaches, Employment, Risk Management, Technical and Organisational Measures (TOMs)

Spanish AEPD: 10 MISUNDERSTANDINGS RELATED TO ANONYMISATION

Anonymisation

Board of Directors Handbook for Cloud Risk Governance | Google

Governance

GDPR Data Incidents – The Step-by-Step Playbook for Effective Response

Data Breaches