Xandr fined NOK 92 million over Grindr advertising data
Norway’s DPA fined Xandr NOK 92 million over Grindr user data in advertising auctions. The decision explains consent checks and…
Scott Dooley
ICO reprimands Ogi and Data Cymru after ‘Password1’ ransomware breach
The ICO reprimanded Ogi Networks and Data Cymru after a test account helped expose 3,300 people’s data. The ICO announced…
CNIL closes Google injunction after account and Gmail changes
CNIL announced the closure on 14 October 2026, following its 23 September decision. The outcome concerns a limited injunction, not…
Paper-record security and retention: an audit guide for managers
Start a paper-record audit with one storage location and follow a sample file through its life: arrival, access, retrieval, retention…
Irish DPC fines Google €403m: what location-data governance teams should learn
The Irish Data Protection Commission (DPC) has fined Google Ireland Limited €403 million after finding failures in the way Google…
ICO investigates Police Scotland SAR compliance: what organisations should learn
The ICO’s investigation into Police Scotland’s handling of subject access requests (SARs) is a useful reminder for every organisation that…
Who’s who on the new ICO board
Seven non-executives and an interim chief executive now run the UK's data protection regulator. Who they are, what each brings,…
ICO confirms TikTok £12.7m children’s privacy fine is final: what online-service teams should learn
The ICO says TikTok’s £12.7m children’s privacy fine is final. Here are the practical controls online-service teams should test.
EU withdrawal pages: what you need to know
A practical guide to EU online contract-withdrawal functions from 19 June 2026, with a clear distinction from GDPR cookie-consent withdrawal.
Securitas Direct fined €100,000: why data-subject rights must be genuinely free
The Spanish DPA fined Securitas Direct €100,000 after a chargeable phone number made data-subject rights harder to exercise. Here is…
Irish DPC fines HSE €645,000 over insecure paper medical-record storage
In late 2023, people got into two disused psychiatric hospitals in Ireland and filmed what they found: boxes of patient…
CNIL fines EXTIA €300,000: what HR teams should learn about erasure requests
On 9 September 2026, the CNIL published a decision fining EXTIA €300,000 after the IT and engineering company failed to…
CNIL fines Hôpital Privé de la Loire €500,000 after health-data breach
A €500,000 CNIL fine against Hôpital Privé de la Loire is a reminder that healthcare security has to be designed…
P&O Ferries data breach: lessons for customer communications
P&O Ferries reportedly exposed passenger details through a text message. What can organisations learn about safe sharing, staff training and…
AliExpress and silent audio fingerprinting: what the finding means for online tracking
A recent investigation into AliExpress is a useful reminder that online tracking is not limited to cookies or visible consent…
Data Protection Training Matrix: How UK Employers Can Map Training by Role
A completion spreadsheet can show who finished a course. It cannot, by itself, show that people received training suited to…
Dutch AP fines Uber €825m: what meaningful human review looks like
The Dutch Data Protection Authority (AP) has fined Uber €825 million over automated driver-account deactivations. The decision, reported on 21…
Data protection training for staff: a practical UK employer checklist
Data protection training for staff works best when it is part of an everyday operating routine, rather than a generic…
ICO action against the Metropolitan Police: why training and assurance must be demonstrable
An ICO enforcement notice and reprimand issued to the Metropolitan Police Service (MPS) offer a practical reminder for any organisation…
Agentic AI & GDPR: a practical guide to GDPR compliant adoption of AI
AI agents such as a support bot that can read customer records, update customer orders and provide customers with the…