Current developments around the GDPR
New rulings, guidelines and what they mean for your business.
Artificial intelligence, new European guidelines, and targeted audits by supervisory authorities: Data protection continues to evolve. For companies, this raises one practical question above all: Which developments affect their own operations, and where is action needed? We provide an overview of selected current priorities and their significance for business practice.
Transparency Takes Center Stage in 2026
In March 2026, the European Data Protection Board (EDPB) launched a Europe-wide coordinated audit on transparency and information obligations. A total of 25 data protection supervisory authorities are participating. The focus is on the requirements of Articles 12, 13, and 14 of the GDPR—that is, how companies inform individuals about the processing of their personal data.
For companies, this is a concrete reason to review their privacy notices. Our recommendation: Compare the information on your website—as well as that provided to employees, applicants, and customers—with your actual processes. Are new software solutions now being used? Have service providers or processing purposes changed? Do data subjects understand what happens to their data?
A formal review process is particularly helpful: Anyone introducing a new service should simultaneously clarify which privacy notices need to be updated.
Artificial Intelligence Requires a Transparent Data Protection Review
AI applications assist companies in drafting, analyzing, and processing customer inquiries. As soon as personal data is processed in this context, questions arise regarding the legal basis and the protection of data subjects.
In its opinion on AI models from December 2024, the EDSA already clarified: An AI model is not automatically anonymous. Furthermore, a legitimate interest may serve as a legal basis under certain conditions. However, this requires an assessment of the specific interest and necessity, as well as a balancing of these against the rights of the data subjects. This does not result in a blanket authorization for the processing of personal data for AI purposes.
We therefore recommend that companies establish binding guidelines for approved AI applications and permissible areas of use. Employees should know what information they are permitted to enter. Before implementation, it is particularly important to check whether the provider uses the data for its own training purposes and what options exist for storage and deletion.
New Guidelines on Anonymization and Web Scraping
The EDSA continues to develop its guidance in 2026 as well. The draft guidelines on anonymization and web scraping in connection with generative AI are currently undergoing public consultation. Comments may be submitted until October 30, 2026. The documents should therefore not yet be treated as final versions.
These topics are particularly relevant for companies that analyze large datasets, develop AI, or use data from publicly available sources. Our recommendation: Document the origin and intended use of such data. Also, have experts verify whether the claimed anonymization is actually viable for the specific use case.
Enforcement of the GDPR is also being further clarified
Since September 2026, additional draft guidelines on the relationship between fines and other remedial powers of supervisory authorities have been under discussion. The consultation runs through November 13, 2026. The focus is on the application of existing supervisory powers; the draft itself does not create any new legal grounds for fines.
For practical business operations, we recommend regularly reviewing data protection measures to assess their actual effectiveness. Can requests from data subjects be reliably assigned? Are responsibilities in the event of data protection incidents clearly defined? Are identified vulnerabilities addressed, and are the measures documented?
What Companies Can Specifically Address Now
These developments point to sensible next steps:
- Review privacy notices: Does the information align with the services and processes actually in use?
- Regulate AI use: Identify applications, review areas of use, and train employees.
- Review data sets: Examine the origin, intended uses, and assumptions regarding anonymization.
- Test processes: Simulate how to handle data subject requests and data breaches using concrete examples.
- Define responsibilities: Clearly assign responsibility for regular reviews and the implementation of necessary adjustments.
Would you like to know which of these developments are relevant to your company? We can help you review your data protection practices, identify areas requiring action, and integrate appropriate measures into your daily operations. Contact us.
