Latest from the Privacy Desk
All dispatches →
GDPR BSI Releases C3A Criteria: A New Framework for Cloud Sovereignty in Europe
As a privacy and security officer advising multinational clients on cloud deployments, I’ve long worried about the gap between technical security controls…
GDPR CNIL Urges DPOs to Produce Activity Reports: A Practical Tool for Driving Compliance
After several years as a DPO, I’ve learned that one of the most useful things you can do is put together a…
GDPR GDPR at 10: The Law That Rewrote the Internet’s Rulebook — and What Comes Next
Ten years ago this week, on 27 April 2016, the European Parliament and Council put their signatures on Regulation (EU) 2016/679 —…
RTM v Bonne Terre: The Court of Appeal Restores the Objective Consent Test — and Saves UK Direct Marketing From a Mind-Reading Standard
For roughly fifteen months, every UK marketer, gambling operator, and cookie-banner reviewer who paid attention to the RTM v Bonne Terre litigation…
GDPR Email Tracking Pixels Are Now a Frontline Privacy Risk
Inside Italy’s Crackdown on Invisible Email Surveillance For years, tracking pixels embedded in emails operated in a legal gray area—quietly collecting behavioral…
GDPR Tracking Pixels in Emails: France’s CNIL Publishes Final Recommendations to Better Protect Privacy
On April 14, 2026, the French data protection authority (CNIL) released the final version of its recommendations on the use of tracking…
GDPR GDPR Article 27: EU Representative, UK Representative and DPO Compliance Guide
If your business collects, stores, or processes personal data belonging to people in the European Union or the United Kingdom — but…
GDPR ENISA Opens Public Consultation on EUDI Wallet Cybersecurity Certification
A Critical Step Toward Trusted Digital Identity Across Europe The European Union Agency for Cybersecurity (ENISA) has launched a public consultation on…
GDPR OneTrust vs TrustWorks: Evaluating Legacy GRC Platforms Against Modern API-Driven Privacy Automation
The Shift in Modern Data Governance The architecture of corporate data governance has fundamentally changed.
GDPR Italian Data Protection Authority Slaps Intesa Sanpaolo with €31.8 Million Fine Over Massive Insider Data Breach
Italy’s Garante per la protezione dei dati personali (the Data Protection Authority) has issued one of its largest fines in recent years,…
AI The EU AI Act’s Ban on Facial Image Scraping
If your organization builds, deploys, or integrates AI systems that process facial images — whether for identity verification, security, content moderation, or…
Key Focus Areas for Implementing Data Protection by Design and by Default in 2026
Nearly a decade after the EU GDPR took effect, the principle of data protection by design and by default remains one of…