GDPR

Recent developments

• 23 Oct 2026 Amendment announced Moderate 53 EU EDPB

  EU Council approves amendment to GDPR allowing unrestricted AI data processing

  The amendment could override fundamental privacy rights by permitting AI firms to use all personal data with minimal safeguards. EU Member States, through the Council, approved a change to the GDPR that would make processing personal data "in the context of AI" automatically lawful. The amendment (Article 88bis) would let AI companies use any personal data without consent, relying on a broad legitimate interest. The proposal still requires negotiation with the European Parliament before becoming law.

  Effective: not stated.

  Source: noyb. GDPR in the regulations library.

• 21 Oct 2026 Regulatory Guidance published Moderate 44 EU European Data Protection Board

  EDPB adopts Guidelines 3/2025 on DSA‑GDPR interplay

  The new EDPB guidance helps platforms align DSA duties with GDPR privacy requirements. On 17 September 2026 the European Data Protection Board adopted Guidelines 3/2025 addressing how the Digital Services Act interacts with the EU General Data Protection Regulation. The guidance clarifies the application of GDPR obligations for services covered by the DSA.

  Effective: 17 September 2026.

  Source: Hunton Privacy & Cybersecurity Law Blog. GDPR in the regulations library.

• 21 Oct 2026 Enforcement Action in effect Low 37 EU-DE Berlin Data Protection Authority

  Berlin DPA finds microtargeting by major German parties illegal

  The rulings signal that political parties in Germany may not use personal political data for targeted ads without consent, impacting future campaign practices. The Berlin Data Protection Authority issued decisions that the SPD, Greens, Die LINKE and CDU unlawfully used political microtargeting in the 2021 election. The authority ruled there was no legal basis, such as consent, for processing personal political interests for advertising. The AfD case remains pending.

  Source: noyb. GDPR in the regulations library.

• 16 Oct 2026 Fine decided High 63 EU-NO Norwegian Data Protection Authority

  Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data

  The fine highlights the strict liability of joint controllers for obtaining valid consent when handling sensitive personal data. The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent. Xandr was found to be a joint controller in real‑time bidding, relying on invalid consent from Grindr for sexual orientation data.

  Penalty: administrative fine of EUR 8 600 000.

  Source: European Data Protection Board news. GDPR in the regulations library.

• 13 Oct 2026 Regulatory Guidance published Moderate 56 EU European Data Protection Board

  EDPB issues guidance on privacy challenges of smart glasses

  The guidance alerts stakeholders to emerging privacy risks of smart glasses and clarifies GDPR applicability and transparency obligations. The European Data Protection Board adopted statement 1/2026 on smart glasses, highlighting serious privacy concerns and the need for transparency. It clarifies when users act as data controllers and stresses that manufacturers and service providers must comply with GDPR obligations. The statement also recommends obvious recording indicators to protect bystanders, especially children.

  Source: European Data Protection Board news. GDPR in the regulations library.

• 13 Oct 2026 Fine in effect Moderate 52 EU-FR French Data Protection Authority

  French DPA fines Google €325 million for spam emails in Gmail

  Significant GDPR enforcement action against a major tech company highlights privacy compliance risks for email services. The French data protection authority imposed a €325 million administrative fine on Google for sending spam emails through Gmail, citing violations of the GDPR.

  Penalty: €325 million.

  Source: noyb. GDPR in the regulations library.

• 12 Oct 2026 Regulatory Guidance announced Moderate 44 EU EDPB

  Future of Privacy Forum Announces 2026 Award Recipients Honoring Data Protection Leadership in Europe

  The awards spotlight leading figures shaping European data protection, underscoring the importance of privacy and AI governance in the region. The Future of Privacy Forum announced the winners of its 2026 Awards, recognizing the European Data Protection Supervisor, scholar Christopher Kuner, and SAP executive Corinna Cellarius for their contributions to data protection and privacy in Europe. The ceremony took place during the 10th anniversary of the Brussels Privacy Symposium, highlighting a decade of dialogue in the EU data protection community.

  Source: Future of Privacy Forum. GDPR in the regulations library.

• 12 Oct 2026 Fine in effect High 72 EU-IT Italian Data Protection Authority (Garante)

  Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing

  The fine underscores the GDPR’s strict enforcement of consent and data‑subject rights in telecom marketing. The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban on processing personal data obtained without consent and ordered the company to strengthen its technical and organisational measures. The decision was based on infringements of consent, the right to object, accountability and security obligations.

  Effective: 5 June 2026. Penalty: EUR 16 700 000.

  Source: European Data Protection Board news. GDPR in the regulations library.