We watch the regulations so you don’t have to

The EDPB is pushing for a legal framework to allow regulators to share information more easily across different EU laws. For SMEs, this could mean more coordinated enforcement of GDPR and other regulations, but no immediate changes to compliance obligations yet.

This update clarifies that individuals can request the removal of their personal data from online press articles under GDPR, but this right is not absolute and must be balanced against other interests, such as freedom of the press. EU SMEs operating as publishers or handling personal data in media content must assess such requests carefully.

The French data protection authority (CNIL) has clarified that while GDPR allows Data Protection Officers (DPOs) to take on additional roles, these must not create conflicts of interest with their DPO duties. EU SMEs must ensure their DPO's independence and avoid overlapping responsibilities that could compromise compliance.

The EU AI Act enforcement begins on 2 August 2026, introducing strict transparency and compliance rules for AI systems. EU SMEs using or developing AI must ensure their systems meet these new legal requirements to avoid penalties.

The Italian data protection authority fined Poste Vita, an insurance company, for failing to properly handle a personal data breach. This serves as a reminder for EU SMEs to ensure robust data security measures and timely breach notifications under GDPR.

An Italian company was fined €40,000 for accessing an ex-employee's email account after their employment ended, violating GDPR rules on data confidentiality and individual rights. EU SMEs must ensure they do not retain or access former employees' personal data without lawful justification.

Ivanti Sentry products have critical security flaws that could allow attackers to take control of affected systems. EU SMEs using these products must act quickly to patch vulnerabilities and avoid potential breaches under cybersecurity regulations.

AI advancements are increasing cybersecurity risks for EU SMEs by enabling faster discovery and exploitation of vulnerabilities. This raises the need for stronger security measures to comply with EU regulations like NIS2 and GDPR.

The NIS2 Directive requires EU SMEs in critical sectors to register with national authorities to enhance cybersecurity resilience. Failure to comply may result in penalties, so affected businesses must act promptly.

The French data protection authority (CNIL) has issued 23 new fines since January 2026 for violations like excessive video surveillance, improper cookie use, and failure to respect individuals' rights. This signals stricter enforcement of data protection rules for EU SMEs.

The Belgian Data Protection Authority (APD/GBA) has reminded organizations, including EU SMEs, of their obligation to conduct a Data Protection Impact Assessment (DPIA) when processing personal data that poses high risks to individuals' rights. This is a key requirement under GDPR to ensure compliance before starting such processing activities.

The Belgian Data Protection Authority (APD/GBA) has reminded businesses about the legal requirement to appoint a Data Protection Officer (DPO) under GDPR if they process large-scale personal data or sensitive information. EU SMEs must check if they meet these criteria to avoid non-compliance risks.

The Belgian Data Protection Authority (APD/GBA) has issued new guidance on international data transfers, clarifying obligations for EU SMEs under GDPR. This affects businesses transferring personal data outside the EU/EEA, requiring compliance checks on transfer mechanisms like SCCs or adequacy decisions.

The Belgian Data Protection Authority (APD/GBA) has highlighted the importance of protecting employee privacy in the workplace. EU SMEs must ensure their monitoring and data processing practices comply with GDPR when handling employee data.

The European Union Agency for Cybersecurity (ENISA) has released new guidelines on incident response and cyber crisis management. This means EU SMEs should review their cybersecurity preparedness and ensure they have plans in place to handle potential cyber incidents effectively.

This initiative by the Belgian Data Protection Authority (APD/GBA) highlights the intersection of AI and data protection, emphasizing how EU SMEs using AI must ensure compliance with privacy laws. It serves as a reminder to review AI systems for GDPR alignment, particularly regarding data processing and transparency.

Citrix has disclosed security flaws in NetScaler ADC and Gateway that could expose sensitive data or mix up user sessions. EU SMEs using these products should update them, especially if they are exposed to the internet, to prevent potential breaches.

EU SMEs using Cisco Catalyst SD-WAN controllers or SD-WAN Manager must immediately address critical security vulnerabilities that could allow attackers to take control of their systems. Failure to act may lead to breaches of data protection or network security obligations under EU regulations.

Ivanti has disclosed critical security flaws in its EPMM products that could allow attackers to take control of vulnerable systems. EU SMEs using these products must act quickly to patch or mitigate risks, as exploitation has already occurred in some cases.

An Italian company was fined €120,000 for unlawfully tracking employees using company cars without proper legal basis or transparency. This highlights the strict GDPR requirements for employee monitoring, especially regarding data processing principles and consent.

An Italian company was fined for collecting excessive health data via post-sick leave questionnaires without proper legal basis or transparency. This highlights GDPR risks for EU SMEs processing employee health data or sensitive personal information.

The NIS2 Directive sets a deadline of 18 April 2026 for essential entities in Belgium (and the EU) to comply with stricter cybersecurity requirements. SMEs classified as essential entities must ensure they meet these obligations or risk penalties.

The French data protection authority (CNIL) warns individuals affected by data breaches about fraudulent emails offering assistance to remove their personal data online. EU SMEs should be aware of this scam and ensure they do not engage with unsolicited offers, as it may lead to further data risks.