Focus 1
Who is in scope
One EU user can be enough if personal data is processed in the context of targeting or monitoring.
Framework hub
GDPR
GDPR applies to any organisation that processes personal data of EU residents, regardless of where the organisation is established.
EU baseline
If you are established in the EU, operate in the EU, or place this product or service on the EU market, treat this as a first-order compliance check. Non-EU reach language means outsiders can also be covered, not that EU companies are outside scope.
Review scopeFocus 2
DPA enforcement tracker
Latest decisions and enforcement updates are collected from CNPD, EDPB, EDPS, ICO, CNIL, BfDI, and DPC Ireland.
Focus 3
Core rights
Article 13, 14, 17, and 20 obligations are summarized with source-backed updates.
Focus 4
Data transfers
SCCs, adequacy decisions, and related guidance are tracked from official sources.
Source updates
HIGHFederal Register2026-10-01
Notice of Proposed Information Collection Requests
The National Mediation Board (NMB) invites comments on the proposed information collection requests as required by the Paperwork Reduction Act of 1995.
US federal regulationGDPR
URGENTEDPB2026-09-23
The Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of...
GDPRePrivacyEU AI ActDORA
URGENTEDPB2026-09-23
The Irish Data Protection Commission fines Google 403 000 000 EUR following Inquiry into Google’s processing of location data
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of...
GDPRePrivacyEU AI ActDORA
URGENTEDPB2026-09-22
The Spanish DPA fined Securitas Direct EUR 100 000 for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
Background information Date of final decision: 1 February 2023 National case Controller: SECURITAS DIRECT, S.A.
GDPRePrivacy
URGENTEDPB2026-09-22
The Spanish DPA fined Securitas Direct 100 000 EUR for making the exercise of data subject rights more difficult by directing individuals to a chargeable telephone number
Background information Date of final decision: 1 February 2023 National case Controller: SECURITAS DIRECT, S.A.
GDPRePrivacy
URGENTEDPB2026-09-21
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers...
GDPRePrivacyDigital Services ActDORA
URGENTEDPB2026-09-21
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers...
GDPRePrivacyDigital Services ActDORA
URGENTEDPB2026-09-11
Failure to respect the rights of individuals: The CNIL fined EXTIA EUR 300 000
Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the...
GDPRePrivacyDORA