News & Analysis as of July 30, 2025

General Data Protection Regulation (GDPR) › Penalties

+ Follow

Follow this channel for updates and analysis on all aspects of the European Union's General Data Protection Regulation, a reform of EU's data protection rules that impacts... more +

Follow this channel for updates and analysis on all aspects of the European Union's General Data Protection Regulation, a reform of EU's data protection rules that impacts individuals throughout the Union and all businesses operating therein. less -

Italy: The Garante Issues First GDPR Fine Over Employees Email Metadata Privacy Breach

DLA Piper on 6/4/2025

The Italian Data Protection Authority (the Garante) has issued its first GDPR fine for, among other breaches, unlawful retention of metadata from employees’ emails and web browsing activities. The decision applies, for the...more

Navigating the EU’s “NIS 2” Directive: Key Cybersecurity Compliance Points for Businesses Operating in the EU to Consider

Pillsbury Winthrop Shaw Pittman LLP on 11/5/2024

The NIS 2 Directive requires a wide range of in-scope organizations to adopt robust cybersecurity measures and incident response plans....more

Series 1 - The World’s First AI Regulation Is Here

Goodwin on 3/15/2024

Yesterday, March 13, 2024, the European Parliament approved the EU Artificial Intelligence Act (“AI Act”), a sweeping AI governance framework which presents the first comprehensive law in the world aimed at ensuring AI...more

EU AI Act Will Be World’s First Comprehensive AI Law

Woods Rogers on 3/14/2024

On March 13, 2024, the European Union’s parliament formally approved the EU AI Act (pdf), making it the world’s first major set of regulatory ground rules to govern generative artificial intelligence (AI) technology. The EU...more

Six Months Until Enforcement: Key Compliance Steps for Saudi Arabia’s Data Protection Law

Latham & Watkins LLP on 3/13/2024

The PDPL has broad extraterritorial scope and substantial penalties for non-compliance, with full enforcement expected to start in September. The Personal Data Protection Law (PDPL) is the first comprehensive data...more

Driving data privacy compliance with workflow automation

Mitratech Holdings, Inc on 12/1/2023

Easily track, manage, archive, and audit consumer data requests, subject access requests (SARS), and other processes needed to keep your company compliant. In an era of increasing scrutiny and activity surrounding data...more

European Advocate General rejects the need for “strict liability” in GDPR violations – The last word, however, is not yet spoken

White & Case LLP on 5/9/2023

It is, by now, well known that not taking data protection seriously can prove costly for organizations. Since the introduction of the European General Data Protection Regulation (the "GDPR") in 2018, non-GDPR-compliant...more

January 2023 AFS Privacy Report: Colorado Department of Law Issues Updated Draft CPA Rules

ArentFox Schiff on 1/13/2023

Colorado Department of Law Issues Draft CPA Revisions - On December 22, the Colorado Department of Law issued updates to the draft Colorado Privacy Act (CPA) rules. These revisions build on written comments and feedback from...more

China's New Data Privacy Law is Sweeping and Serious: Avoid the High Cost of Noncompliance

Bracewell LLP on 8/25/2021

Last Friday, China passed the world’s harshest data privacy law, threatening violators with fines of up to 50 million Yuan (or about $7.7 million at the time of publication) or 5% of annual revenue. The Personal Information...more

Colorado joins California and Virginia in Passing a Comprehensive Privacy Law

Foley & Lardner LLP on 7/23/2021

On July 7, 2021, Colorado Governor Jared Polis signed the Colorado Privacy Act (“CPA”) into law, making Colorado the third state to enact comprehensive privacy legislation, following in the footsteps of California and...more

Update on the State of Privacy Law in China

Sheppard Mullin Richter & Hampton LLP on 5/14/2021

China is continuing to move forward with its first comprehensive privacy law. China recently issued a second version of the draft Personal Information Protection Law (Draft PIPL) which will be open for public comments until...more

German Data Protection Authorities continue to impose record penalties: notebooksbilliger.de fined 10,4 Mio EUR

Spirit Legal on 1/28/2021

Barbara Thiel, the Data Protection Commissioner for the Federal State of Lower Saxony, has issued a record fine of 10.4 million euros against the company notebooksbilliger.de AG for unlawful video surveillance of staff and...more

New DIFC Data Protection Law in Force - What You Need to Know

Akin Gump Strauss Hauer & Feld LLP on 10/2/2020

On October 1, 2020, the three-month grace period for businesses to comply with the Dubai International Financial Centre (DIFC) Data Protection Law (DIFC Law No. 5 of 2020) (“DPL 2020”) came to an end. Regulating the...more

Brazilian Government Makes the LGPD Effective Imminently

Foley & Lardner LLP on 9/11/2020

On August 14, 2018, the Brazilian government approved the Brazilian General Data Protection Law, known as the Lei Geral de Proteção de Dados Pessoais (“LGPD”). Enforcement was set to begin on August 15, 2020 but then, due to...more