.png)
EU
GDPR
The EDPB adopted Guidelines 04/2026 on when supervisory authorities should impose a fine rather than use other corrective powers. They set out a five-step methodology with 14 worked examples and replace the old WP29 fining guidelines. Consultation runs until 13 November 2026.
At the same plenary, the Board adopted its final guidelines on the interplay between the DSA and the GDPR.
GDPR
The Irish DPC fined Google €403 million and ordered it to bring its processing into compliance within six months. The inquiry found breaches of Articles 5, 6, 12 and 13 GDPR in Web & App Activity.Location History and Location Accuracy between May 2018 and February 2020.
The own-volition inquiry was opened in 2020 after complaints from consumer groups, including BEUC.
DSA
The Commission adopted its proposal for an EU KIDS Act. It would bar platforms from giving accounts to children under 13 and set an EU-wide minimum age of 15 for having an account of their own.
It also reverses the burden of proof: services would have to show they are safe by design. The proposal builds on the DSA's minorsprotection framework and extends to AI systems.
DORA
The EBA published final Guidelines on third-party risk management, aligned with DORA. They focus on arrangements supporting critical or important functions and cover both ICT and non-ICT services across the full lifecycle.
Separately, the ESAs' autumn risk update flagged reliance on non-EEA ICT providers and AI-enabled cyber risk as key vulnerabilities
DORA
The EBA published final Guidelines on third-party risk management, aligned with DORA. They focus on arrangements supporting critical or important functions and cover both ICT and non-ICT services across the full lifecycle.
Separately, the ESAs' autumn risk update flagged reliance on non-EEA ICT providers and AI-enabled cyber risk as key vulnerabilities
Sweden
GDPR
IMY IMY fined Miljödata i Karlskrona AB SEK 1.8 million for insufficient security under Article 32(1) GDPR, following the data breach in August 2025.
According to the company, around 2.2 million people were affectedby the incident.
Read More
GDPR
IMY opened reviews of mass election text messages sent by Sverigedemokraterna and Örebropartiet. Around 1,500 complaints and tips came in about the SD messages alone.
The reviews look at the legal basis and how recipients were selected, under both the GDPR and the EU political advertising regulation.
Read More
GDPR
IMY asked the EDPB to clarify which personal data counts as data relating to criminal convictions and offences under Article 10 GDPR, as member states currently apply the provision differently.
IMY also served as rapporteur for the EDPB's new finingmethodology guidelines adopted on 21 September.
Read More
