Latest from the Privacy Desk
All dispatches →
GDPR TCF Policies Amendments: Multi-Device Consent, TCF UI Improvements & Special Feature 2 Clarification
If you work with consent management, programmatic advertising, or data privacy compliance in Europe, the Transparency & Consent Framework (TCF) is something…
GDPR The UK ICO Signals a Major Shift on Online Advertising, Consent Fatigue, and the Future of Cookie Rules
The UK Information Commissioner’s Office has opened the door to one of the most important changes in online advertising regulation since the…
GDPR BSI Releases C3A Criteria: A New Framework for Cloud Sovereignty in Europe
As a privacy and security officer advising multinational clients on cloud deployments, I’ve long worried about the gap between technical security controls…
GDPR CNIL Urges DPOs to Produce Activity Reports: A Practical Tool for Driving Compliance
After several years as a DPO, I’ve learned that one of the most useful things you can do is put together a…
GDPR GDPR at 10: The Law That Rewrote the Internet’s Rulebook — and What Comes Next
Ten years ago this week, on 27 April 2016, the European Parliament and Council put their signatures on Regulation (EU) 2016/679 —…
RTM v Bonne Terre: The Court of Appeal Restores the Objective Consent Test — and Saves UK Direct Marketing From a Mind-Reading Standard
For roughly fifteen months, every UK marketer, gambling operator, and cookie-banner reviewer who paid attention to the RTM v Bonne Terre litigation…
GDPR Email Tracking Pixels Are Now a Frontline Privacy Risk
Inside Italy’s Crackdown on Invisible Email Surveillance For years, tracking pixels embedded in emails operated in a legal gray area—quietly collecting behavioral…
GDPR Tracking Pixels in Emails: France’s CNIL Publishes Final Recommendations to Better Protect Privacy
On April 14, 2026, the French data protection authority (CNIL) released the final version of its recommendations on the use of tracking…
GDPR GDPR Article 27: EU Representative, UK Representative and DPO Compliance Guide
If your business collects, stores, or processes personal data belonging to people in the European Union or the United Kingdom — but…
GDPR ENISA Opens Public Consultation on EUDI Wallet Cybersecurity Certification
A Critical Step Toward Trusted Digital Identity Across Europe The European Union Agency for Cybersecurity (ENISA) has launched a public consultation on…
GDPR OneTrust vs TrustWorks: Evaluating Legacy GRC Platforms Against Modern API-Driven Privacy Automation
The Shift in Modern Data Governance The architecture of corporate data governance has fundamentally changed.
GDPR Italian Data Protection Authority Slaps Intesa Sanpaolo with €31.8 Million Fine Over Massive Insider Data Breach
Italy’s Garante per la protezione dei dati personali (the Data Protection Authority) has issued one of its largest fines in recent years,…