Skip to content
INPLP — International Network of Privacy Law Professionals
Member log in

710 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

710 articles
AI & automation

Mythos and the New Regulatory Challenges of AI-Driven Cybersecurity

The emergence of advanced AI models capable of autonomously discovering vulnerabilities is reshaping the regulatory landscape of cybersecurity, privacy and operational resilience. Mythos, Anthropic’s advanced cybersecurity-oriented model, illustrates how AI is rapidly evolving from a productivity tool into a strategic infrastructure with profound implications under the GDPR, the EU AI Act, NIS2 and DORA.

9 June 2026

Enforcement & fines

Finland Extends GDPR Fines to Public Authorities – A Long-Awaited Shift in Enforcement

Finland is set to extend GDPR administrative fines to public-sector authorities, ending a long-standing exemption that has set the country apart from most of the European Union. The proposed amendment introduces financial accountability for public bodies, but does so with capped sanctions, targeted carve-outs and a proportionality test reflecting the particular character of public institutions.

2 June 2026

AI & automation

THE SPANISH DPA ISSUES ITS LATEST REPORT: HOW DID THEY REDEFINE PRIVACY AND INNOVATION IN 2025

How is data protection evolving in an era shaped by AI and rapid technological innovation? This article explores the main achievements of the Spanish Data Protection Authority (AEPD) during 2025, highlighting its strategic initiatives to integrate AI, strengthen privacy governance, promote regulatory compliance, and foster national and international collaboration. Through technological modernization and proactive regulation, the AEPD aims at redefining the future of privacy protection in an increasingly digital world.

28 May 2026

Marketing & cookiesChildren

Austrian DPA decisions on Microsoft 365 Education: Unlawful Cookie tracking of school children – and nobody knew about it

In two parallel decisions of October 2025 and January 2026, the Austrian Data Protection Authority (DSB) ruled that Microsoft Corporation acts as a (joint) controller for parts of the data processing carried out via Microsoft 365 Education and unlawfully placed tracking cookies on a pupil’s device without consent. The decisions clarify the allocation of GDPR responsibilities between Microsoft, schools and education ministries. These decisions also have implication for any organisation using Microsoft 365 across the EEA.

5 May 2026

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership