Egypt’s Personal Data Protection Law – Before You Process, You Need a Licence
The Arab Republic of Egypt enacted a comprehensive data protection law in 2020. For five years, its practical impact remained [...]
International Data Protection
Microsoft Copilot: Flex Routing – Your Data Is Leaving the EU. By Default.
In April 2026, Microsoft introduced a new feature for Microsoft 365 Copilot: "Flex Routing". The name sounds harmless. The data protection implications are not. What Is Flex Routing? Flex Routing allows Microsoft to reroute Copilot AI requests to data centres [...]
China's New Draft Rules for Small Personal Information Controllers
On 3 April 2026 China's Cyberspace Administration (CAC) published a draft regulation titled the Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Controllers (Draft for Comment) (the "Draft"). The Draft is o [...]
The Italian DPA's Fine Against Intesa Sanpaolo: Lessons for Access Management and Data Breach Handling
On 26 March 2026, the Italian data protection authority (Garante per la protezione dei dati personali, "Garante") fined Intesa Sanpaolo S.p.A. €31,800,000. This is one of the largest fines the Garante has ever imposed, and it carries clear lessons for a [...]
China's Face Recognition Regulation: What the New Rules Mean for Businesses
On 1 June 2025, China's Cyberspace Administration (CAC) brought into force the Measures for the Security Management of Face Recognition Technology Applications (the "Measures"). This landmark regulation is the first piece of dedicated legislation in Chin [...]
When Access Requests Become Abusive: Key Takeaways from C-526/24 Brillen Rottler
The Court of Justice of the European Union (CJEU) has clarified in Brillen Rottler (C-526/24) that, in exceptional circumstances, even a first data subject access request (DSAR) may be refused as “manifestly unfounded or excessive” under Article 12 para. [...]
ICO Guidelines on the New Complaint Handling Requirements in the UK
The Data (Use and Access) Act 2025 introduced several important regulatory changes to the existing UK data protection framework. One of the most notable changes is the introduction of a formal right for individuals to complain directly to organisations [...]
Unlawful Profiling and Poor Transparency: Key Takeaways from the Garante’s Fine Against Intesa Sanpaolo
The Italian Data Protection Authority (Garante) has imposed a €17.6 million fine on Intesa Sanpaolo, one of the largest banking groups in Italy, for unlawful processing of personal data affecting approximately 2.4 million customers in the context of their [...]