Session replay tools: the CNIL's recommendation requires consent and masking
On 5 November 2026 the CNIL published its recommendation on session replay tools: prior consent, purposes set in advance, masking and short retention.
Floris Lindenaar
Floris Lindenaar founded Dazr, an independent, self-funded software company registered in Italy that builds software for organisations and people in Europe, hosted in the EU. Every article lists the official sources it is based on.
Articles
Portugal NIS2: Decree-Law 125/2025 and the CNCS regulation, the key deadlines
Portugal's NIS2 law has applied since early April 2026 and the CNCS regulation since June. What is due now, and why the security measures follow in 2028.
Sweden NIS2: the Cybersecurity Act applies from 15 January 2026
Sweden's Cybersecurity Act (SFS 2025:1506) has applied since 15 January 2026. Who registers where, the incident deadlines, the supervisors and the fines.
AI Act: EN 18286 is the first harmonised standard, for quality management
Since 14 October 2026, providers of high-risk AI that follow EN 18286:2026 are presumed to meet the AI Act's quality management rules (Article 17).
Cyber Resilience Act: ENISA's new guidance on SBOMs and secure updates
ENISA published technical advisories on software bills of materials (22 October) and secure update mechanisms (4 November) for CRA manufacturers.
Czechia NIS2: security measures due one year after NÚKIB registration
Under Czech Act 264/2025, security measures and incident reporting apply one year after NÚKIB's registration decision: early 2027 for many.
Data Act: the Commission's model contract terms and cloud contract clauses
Recommendation (EU) 2026/2394 gives non-binding model terms for data sharing and clauses for cloud contracts, ahead of free switching on 12 January 2027.
EDPB Guidelines 04/2026: when a GDPR infringement leads to a fine
The EDPB sets out five steps authorities follow to decide whether a GDPR infringement is fined or reprimanded. Comments are open until 13 November 2026.
Anonymous data under the GDPR: the EDPB's three tests and a EUR 7 million fine
EDPB Guidelines 02/2026 set three tests for anonymous data. Italy's Garante fined IQVIA EUR 7 million over health data it called anonymous.
GDPR fines published in September and October 2026: security, processors and people's rights
Seven GDPR decisions from Norway, Ireland, France, Sweden, Greece and Italy: weak security, missing processor contracts and ignored requests.
Poland NIS2: after the KSC register deadline, obligations apply from 3 April 2027
Poland's amended KSC Act has applied since 3 April 2026. The register deadline passed on 3 October 2026; the obligations apply from 3 April 2027.
Digital Omnibus: the Council's position on GDPR and cookies
On 21 October 2026 EU ambassadors agreed the Council's mandate on the Digital Omnibus: breach reporting, personal data, cookies, incident reporting.
Italy NIS2: basic security measures due in October 2026
Entities on Italy's 2025 NIS list have 18 months to adopt ACN's basic security measures, ending in October 2026. Those listed in 2026 have until July 2027.
NIS2 in October 2026: where transposition stands
Two years after the deadline, four Member States are before the EU Court of Justice, while Germany, the Netherlands and Austria now apply NIS2 laws.
GDPR enforcement in 2026: large fines and new procedures
Google fined EUR 403 million over location data, faster cross-border procedures from April 2027, and GDPR changes that are still only proposals.
AI Act after the Digital Omnibus: the new dates
Regulation (EU) 2026/1744 moved the AI Act's high-risk rules to December 2027 and August 2028. Transparency duties have applied since 2 August 2026.
Austria: the NISG 2026 applies from 1 October 2026
Austria's NIS2 law has applied since 1 October 2026 to about 4,000 organisations. Registration, self-declaration and reporting deadlines at a glance.
Cyber Resilience Act: reporting is live, the rest follows in 2027
Since 11 September 2026 manufacturers report exploited vulnerabilities and severe incidents to ENISA's platform. Full CRA rules apply on 11 December 2027.
Data Act: new duties for connected products, free cloud switching next
The Data Act has applied since 12 September 2025. Design duties for connected products followed in 2026; cloud switching charges end on 12 January 2027.
DORA: the first critical ICT providers are designated
The ESAs designated 19 critical ICT third-party providers under DORA, now under direct EU oversight. What it means for financial entities and suppliers.
Get Dazr Compliance news by email
One short email on Monday with the week’s new articles, only in weeks with news.