707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles

The emerging contours of ‘Verifiable Parental Consent’ under India’s new Data Privacy Law.

India’s new data privacy law will change the way in which data processors collect and process children’s data, by requiring ‘verifiable parental consent’ be obtained; this article provides guidance on how this may work in practice.

24 July 2025

Enforcement & fines

Firm But Fair: Irish DPC Publishes 2024 Annual Report

On 19 June 2025, the Data Protection Commission published its Annual Report for 2024, and the popular Case Studies Booklet 2024. The report indicates a fair, consistent regulatory approach by the DPC, which also encompasses a willingness to decisively pursue enforcement measures.

22 July 2025

AI & automationLegislation

Regulating AI a la Suisse: Between innovation and uncertainty - No comprehensive AI Act

The Federal Council's approach on regulation AI has finally been published on 12 February 2025.

15 July 2025

Enforcement & finesData subject rights

When the GDPR Clock Never Stops: Lessons from a EUR 175,000 Fine for Delayed Data Subject Responses

In a recent decision (n° 1FR/2025 of 6 January 2025), the Luxembourg National Data Protection Authority (the “CNPD”) sanctioned a major credit institution for non complying with access request’s deadlines as set by the GDPR- despite arguments of force majeure and operational challenges. The initial sanction suggested by the CNPD during the investigation phase to fine the credit institution amounted EUR 493,560 for the breach of Art. 12 (3) and (4) of the GDPR comprinsing 47 access right requests made by data subjects.

10 July 2025

THE SPANISH DATA PROTECTION AUTHORITY NEW LEADERSHIP PUBLISHES STRATEGIC PLAN 2025-2030 AND SUBMITTS IT TO PUBLIC CONSULTATION

The Spanish DPA (AEPD) has new leadership and has just published an Strategic Plan which has been submitted to public consultation and has gotten feedback from the leading professional associations.

8 July 2025

International transfers

From Brazil to the World: Mastering Compliance in Cross-Border Data Transfers

As international data flows intensify, ensuring compliance with Brazil’s General Data Protection Law (LGPD) has become a strategic priority for businesses operating globally. This article unpacks the critical distinctions in what constitutes an international data transfer under Brazilian law and examines the new obligations introduced by Resolution CD/ANPD No. 19/2024.

3 July 2025

INPLP internal

New members have joined the INPLP: Marshall Situmorang and Andhitta Audria Putri

Nusantara Legal Partnership ("NLP") is a premier boutique law firm based in Jakarta, Indonesia, established in 2018. Since its establishment, they are committed to advocating for their clients‘ cause…

27 June 2025

Litigation

Can Public Schools Use Google Under the GDPR? Finland’s Top Court Says “Yes, But…”

The Finnish Supreme Administrative Court recently addressed whether Finnish municipalities can rely on GDPR Article 6(1)(c), a statory obligation to process personal data, when using cloud tools like Google Workspace for Education. It confirmed that that statutory obligations may serve as a legal basis, however provided each service is shown to be necessary and proportionate.

26 June 2025

INPLP internal

A new member has joined the INPLP: Cecilia Abente Stewart

Abente Stewart - Abogados is a boutique law firm specializing in intellectual property, with a longstanding tradition of protecting and enforcing companies’ IP portfolios. The firm provides legal assi…

25 June 2025

Employment dataLitigation

Consent as the lawful basis for monitoring the activities of employees: really?

A recent case decided by the French Court de cassation demonstrates technical disregard of the GDPR, particularly in employment litigation matters.

24 June 2025

Legislation

Chilean data privacy new regulation: based and far from the GDPR

For 7 years Chilean Congress debated the amendment of Law 19.628 concerning data privacy. Finally, on December 13, 2024, the new regulation was published and is set to come into force on December 1st, 2026.

27 May 2025

Litigation

ECJ rules on gender identity rectification under GDPR

Can a person demand rectification of their gender entry in a registar? a Member State cannot rely on the absence in its national law, of a procedure for the legal recognition of transgender identity in order to limit the right to rectification.

13 May 2025

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership