European Union: Data Protection

On 17 March 2026, SCHUFA Holding AG (SCHUFA) – Germany's largest and most influential credit reference agency (CRA) – implemented a comprehensive reform of its scoring methodology...

On 19 March 2026, the Court of Justice of the European Union (CJEU or Court) issued its judgment in Case C-526/24, Brillen Rottler GmbH & Co. KG v TC.

The Cyber Resilience Act (CRA) is a European regulation which aims to improve cybersecurity and cyber resilience and provides for common cybersecurity standards for products with digital elements.

In our previous article, Digital Omnibus Regulation Proposal, we examined the Commission’s proposal published on 19 November 2025 (the “GDPR Omnibus”). On the same day, the Commission introduced a complementary initiative, the Digital Omnibus on AI Regulation Proposal (the “AI Omnibus”).

This briefing provides an overview and summary of the key developments in international data transfers that took place over the course of 2025.

On 12 September 2025, the EU Data Act (Regulation (EU) 2023/2854) became applicable across the EU. Finland’s complementary enforcement legislation, the Act on the Supervision of Data Management and Data Sharing (laki datan hallinnan ja jakamisen valvonnasta 1148/2025), entered into force on 1 January 2026.

In its decision of 10 February 2026, WhatsApp Ireland Ltd v European Data Protection Board (Case C-97/23 P) [1], the Court of Justice of the European Union ("CJEU") held that a decision...

The question of whether financial penalties imposed for personal data breaches—particularly administrative fines—can be insured remains one of the most contested issues...

Many AI tools deployed for HR purposes are likely to be classified as "high risk" under the AI Act, triggering strict obligations for employers, including mandatory human oversight...