We watch the regulations so you don’t have to

An Italian company was fined €120,000 for unlawfully tracking employees using company cars without proper legal basis or transparency. This highlights the strict GDPR requirements for employee monitoring, especially regarding data processing principles and consent.

An Italian company was fined for collecting excessive health data via post-sick leave questionnaires without proper legal basis or transparency. This highlights GDPR risks for EU SMEs processing employee health data or sensitive personal information.

The NIS2 Directive sets a deadline of 18 April 2026 for essential entities in Belgium (and the EU) to comply with stricter cybersecurity requirements. SMEs classified as essential entities must ensure they meet these obligations or risk penalties.

The French data protection authority (CNIL) warns individuals affected by data breaches about fraudulent emails offering assistance to remove their personal data online. EU SMEs should be aware of this scam and ensure they do not engage with unsolicited offers, as it may lead to further data risks.

Ivanti Sentry products have critical security flaws that could allow attackers to take control of affected systems. EU SMEs using these products must act quickly to patch vulnerabilities and avoid potential breaches under cybersecurity regulations.

AI advancements are increasing cybersecurity risks for EU SMEs by enabling faster discovery and exploitation of vulnerabilities. This raises the need for stronger security measures to comply with EU regulations like NIS2 and GDPR.

The NIS2 Directive requires EU SMEs in critical sectors to register with national authorities to enhance cybersecurity resilience. Failure to comply may result in penalties, so affected businesses must act promptly.

The French data protection authority (CNIL) has issued 23 new fines since January 2026 for violations like excessive video surveillance, improper cookie use, and failure to respect individuals' rights. This signals stricter enforcement of data protection rules for EU SMEs.

The Belgian Data Protection Authority (APD/GBA) has reminded organizations, including EU SMEs, of their obligation to conduct a Data Protection Impact Assessment (DPIA) when processing personal data that poses high risks to individuals' rights. This is a key requirement under GDPR to ensure compliance before starting such processing activities.

The Belgian Data Protection Authority (APD/GBA) has reminded businesses about the legal requirement to appoint a Data Protection Officer (DPO) under GDPR if they process large-scale personal data or sensitive information. EU SMEs must check if they meet these criteria to avoid non-compliance risks.

The Belgian Data Protection Authority (APD/GBA) has issued new guidance on international data transfers, clarifying obligations for EU SMEs under GDPR. This affects businesses transferring personal data outside the EU/EEA, requiring compliance checks on transfer mechanisms like SCCs or adequacy decisions.

The Belgian Data Protection Authority (APD/GBA) has highlighted the importance of protecting employee privacy in the workplace. EU SMEs must ensure their monitoring and data processing practices comply with GDPR when handling employee data.

The European Union Agency for Cybersecurity (ENISA) has released new guidelines on incident response and cyber crisis management. This means EU SMEs should review their cybersecurity preparedness and ensure they have plans in place to handle potential cyber incidents effectively.

This initiative by the Belgian Data Protection Authority (APD/GBA) highlights the intersection of AI and data protection, emphasizing how EU SMEs using AI must ensure compliance with privacy laws. It serves as a reminder to review AI systems for GDPR alignment, particularly regarding data processing and transparency.

Citrix has disclosed security flaws in NetScaler ADC and Gateway that could expose sensitive data or mix up user sessions. EU SMEs using these products should update them, especially if they are exposed to the internet, to prevent potential breaches.

EU SMEs using Cisco Catalyst SD-WAN controllers or SD-WAN Manager must immediately address critical security vulnerabilities that could allow attackers to take control of their systems. Failure to act may lead to breaches of data protection or network security obligations under EU regulations.

Ivanti has disclosed critical security flaws in its EPMM products that could allow attackers to take control of vulnerable systems. EU SMEs using these products must act quickly to patch or mitigate risks, as exploitation has already occurred in some cases.