News European Data Protection Board

DOJ repeatedly emphasized that cybersecurity obligations are mission-critical contract terms, and that it thus intends to use the FCA to enforce misrepresentations. Law enforcement also continued its efforts to hold accountable the threat actors responsible for a series of international ransomware attacks that plagued businesses across the globe in 2021. DOJ continued to focus enforcement on apprehending threat actors and recovering funds obtained through cybercrime. Red Hat reported unauthorized access to a consulting GitLab instance, with copied engagement materials but no identified impact to its product software supply chain. China’s Network Data Security Management Resolutions and India’s Digital Personal Data Protection Act (“DPDPA”) are reflective of an increasingly global commitment to safeguarding individual rights to data privacy, including the right to consent to personal data processing.

We outline key developments, including draft Codes of Practice, new governance structures, voluntary compliance initiatives and practical tools to support organisations preparing for compliance across the EU. The EU AI Act is moving into its implementation phase, so transparency obligations and enforcement milestones are approaching. We explain what has changed, what it means for organisations, and the practical steps to consider now. The ICO is planning to update and amend its guidance over the coming months; it will be important to follow this to gauge the real practical impact of some of the provisions.

• With adversaries increasingly targeting supply chain partners and regulatory expectations for the supply chain continuing to expand, supply chain risk management and vendor compliance is expected to become a defining challenge—and differentiator—in the coming years.
• This means organisations must continue to carefully assess and document their reasoning, particularly where data use may not be obvious to individuals.
• There will be a small number of obligations though, too — in particular, privacy notices will have to be amended to refer to a new data subject right to complain.
• This update summarises the European Commission’s Digital Omnibus package from a privacy perspective, focusing on how it may affect organisations that process personal data across the EU.
• And regulators increasingly expect organizations to prove continuous compliance through real-time security data and reporting, not once-a-year audits.

As AI becomes more embedded in commercial operations, this is an area where legal, technical and contractual considerations increasingly overlap. For businesses, this means reviewing not just cookie banners, but also how third-party tools, analytics platforms and marketing technologies are deployed and documented. However, these are not a free pass, transparency and user opt-out mechanisms remain essential.

• For startups, that means you can’t just ship an agent and hope for the best – you need to install the right mechanisms when it comes to data access, rectification and so on.
• I work with a wide variety of organisations, particularly in the media, sports and life sciences sectors.
• The EU’s AI Act addresses risk categories, while the ICO is addressing data rights in real-time autonomous decision-making.
• We will agree with government on how my office can receive assurance on the delivery and impact of this work.”

EDPB Adopts Final Guidelines on Blockchain and Personal Data: A Practical Guide for Organisations

Across the world, regulators have imposed novel requirements to both protect privacy rights and enhance private sector cybersecurity measures. The guidance emphasizes the importance of active engagement by an organization’s leadership to oversee third‑party cyber risk, including annual review and approval of the organization’s cybersecurity policies. Reg S-P applies to broker‑dealers, investment companies, SEC‑registered investment advisers, funding portals and all transfer agents (including those registered with other banking agencies). Although HHS sought comments on the proposed rule by March 2025, no final rule has yet been published, and industry groups have criticized the proposed rule as impractical and unduly burdensome, while acknowledging the need for updated cybersecurity requirements.

“You can define boundaries, permissions and intended use cases, but you cannot always predict every action an agent may take in a live environment. In http://www.greengauge21.net/privacy-policy/ practice, the hardest areas will be data minimisation, explainability, audit trails and making sure an agent does not go beyond the scope the user expects. Agentic systems operate across multiple tools, datasets and decision points, which makes it difficult to clearly define data ownership, lawful processing, and responsibility for outcomes. “In practical terms, founders should make sure their systems are easy to understand and can be checked or reviewed from the very beginning. If your agent is making decisions that produce legal or similarly significant effects, there needs to be a human review mechanism. The biggest compliance challenge is attribution of responsibility across multi-agent systems.

• There are complicated incident classification and reporting requirements (in some cases outstripping the notification timelines in privacy laws), as well as specific requirements around internal policies and supplier contracting.
• Noyb also said it was “unclear” whether the tracking of visitors to users’ profile pages was legal, as the company does not ask for active consent.
• “One of the biggest compliance challenges the ICO’s guidance creates for startups is accountability.
• 2025 is the first year in which a majority of organizations (66%) of organizations said they use purpose-built technology to manage compliance risk in Navex Global’s annual State of Risk & Compliance Report.
• “The personal data of every individual has become a currency that is constantly collected, shared and sometimes used in ways that remain hidden from most users,” Bizga warns.
• Finally, the United Kingdom has taken steps of its own to enhance cybersecurity practices for essential digital services by introducing to Parliament the long-awaited Cyber Security and Resilience Bill in November 2025, taking inspiration from DORA and NIS2.

The letter complains that “civil society organisations have filed highly important and strategic complaints in Ireland, many without any material result.” “Patterns of delayed or limited enforcement continue to undermine trust in the DPC as an eIective enforcer of the law,” wrote the NGOs. The letter also points out that Sweeney may have had to sign non-disclosure agreements during her time at Meta, raising questions about her ability to properly participate in investigations. This appointment “raises serious questions about the DPC’s independence at a time when its impartiality is of critical importance for the entire Union, and when public trust is already fragile,” the https://www.downloadwasp.com/13253/buy-folder-lock.html letter states.