Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

707 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

707 articles
International transfers

Guideline on the Transfers of Personal Data Abroad

Published in January 2025, this guideline aims to explain the processes for transferring personal data abroad under Article 9 of the Personal Data Protection Law No. 6698 (“the Law”). The guideline serves as an instructive document regarding the implementation of the Law and the safeguards established by the Personal Data Protection Board (“the Board”). While the guideline primarily explains the provisions of the Law, it also aims to provide practical guidance through case studies and scenarios. Notably, this guideline reflects the Personal Data Protection Authority's approach of aligning with the European Data Protection Board's guidelines in terms of methodology. As an overview, it is essential to summarize the legislative changes addressed in the guide.

18 February 2025

AI & automation

Initial Legislative Developments for Artificial Intelligence in Turkiye

With the rapid expansion of the use of artificial intelligence (AI) and its integration into all areas of life, it has become essential to establish a legal framework that regulates the safe and ethical development, distribution and use of AI systems, considering the complexity and unique characteristics of this technology. In addition to promoting the safe, transparent, and human rights-respecting development of AI technologies, and aiming to protect the safety, rights, and freedoms of users and society, the European Union Artificial Intelligence Act ("AI Act"), which is the first legal regulation in this field, was approved by the European Parliament on March 13, 2024 to ensure the ethical development of AI and the protection of personal data. Finally, the AI Act was also approved by the Council of the European Union on May 21, 2024.

14 January 2025

Knowing Your Data Related Rights: Romania's Schengen Full Access

After more than a decade of anticipation, Romania has officially become a full member of the Schengen Area. As of 1 January 2025, land border checks with Romania and Bulgaria are a thing of the past, building on the earlier removal of air and sea border controls on 31 March 2024. This article explores the impact of Romania's full Schengen accession, with a special focus on the rights of data subjects in this new context.

9 January 2025

International transfers

UK Data Reform: Striking the Balance Between Adequacy and Innovation

The UK Government has brought forward a new Bill that proposes several changes to UK data protection law, alongside other provisions intended to broaden use and commercialisation of data for economic and societal benefit. The Bill, introduced into the House of Lords on 23 October 2024, bears similarities to the previous Government's proposed reforms, but includes safeguards that are in part aimed at ensuring the UK will retain its adequacy arrangements with the EU.

19 December 2024

Employment dataLitigation

Polish Supreme Administrative Court Upholds Employers' Right to Retain Rejected Applicants' Data for Defense Against Potential Discrimination Claims

The Polish Supreme Administrative Court issued a landmark ruling on February 20, 2024 case no III OSK 2700/22, affirming that employers can lawfully retain personal data of rejected job applicants based on their legitimate interest in defending against potential discrimination claims. This decision provides significant guidance on the interpretation of Article 6(1)(f) of the General Data Protection Regulation (GDPR) concerning the lawful grounds for processing personal data after the conclusion of a recruitment process.

18 December 2024

Data Protection and Conflict of Interest

The role of the Data Protection Officer (DPO), or Encarregado de Dados, is critical to fostering a culture of privacy and data protection in organisations. Given their unique position, DPOs must have independence, autonomy, and direct access to senior management to fulfil their duties effectively. However, as organisations seek to optimise resources, the possibility of role accumulation often arises, whereby a DPO might take on additional responsibilities within the company. This raises significant questions around conflict of interest, particularly as data protection regulations continue to evolve in Brazil and globally.

12 November 2024

Unauthorized Processing of Personal Data in Connection with a Traffic Accident

The Slovak Office for Personal Data Protection (hereinafter referred to as the “Office”) recently imposed a fine of EUR 7,500 on Company CC for repeated and serious violations of data protection rules under the GDPR. Company CC, which focuses on compensating traffic accident participants, unlawfully collected and processed personal data without a proper legal basis and subsequently contacted these individuals with service offers. This case underscores the importance of lawful and transparent processing of personal data.

5 November 2024

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership