27 Jun 2026
8/10
Data Protection
Effective: 27/06/2026
The Spanish Data Protection Authority sanctions Vodafone with 1.05 million and Amadeus with 14.4 million euros for violating the RGPD in the processing of personal data.
Companies processing personal data, especially large technology and telecommunications corporations
28 Jul 2026
7/10
Data Protection
Effective: 24/07/2026
Messaging apps without phone numbers will be able to analyze content to detect child sexual abuse. This is a temporary exception to European privacy rules.
Providers of encrypted messaging apps and interpersonal communications operating in the EU
19 Jun 2026
6/10
Data Protection
New UN convention that facilitates cooperation between countries to prosecute computer crimes and share digital evidence in criminal investigations.
Technology companies, digital service providers, telecommunications and judicial authorities
08 Apr 2026
6/10
Data Protection
Effective: 07/04/2026
The EU establishes the body that will coordinate the shared use of health data among member states. It will regulate access to medical records and health data at European scale.
Hospitals, insurers, pharmaceuticals, researchers and health sector technology companies
06 Aug 2026
5/10
Data Protection
The EU and Iceland agree to share flight booking data (PNR) to combat terrorism and serious crimes. It affects travelers flying between both territories.
Airlines with EU-Iceland routes, air passengers and security authorities
05 Aug 2026
5/10
Data Protection
Effective: 22/07/2026
The European Commission denies registration of a citizen initiative requesting a halt to mandatory digital identity and age verification on the internet. Without registration, the initiative cannot officially collect sig...
European citizens, initiative promoters, digital platforms and internet users
03 Jul 2026
5/10
Data Protection
Effective: 30/06/2026
The Commission establishes internal rules on how it manages personal data in its investigations into large digital platforms. It allows restricting certain rights of affected individuals during those investigations.
Technology companies investigated under the DMA and individuals whose data is processed by the Commission in those proceedings
09 Jun 2026
5/10
Data Protection
Effective: 20/04/2026
A delegated EU regulation is corrected that regulates how companies can invoke cybersecurity reasons to delay the publication of incident notifications. It affects entities obligated to report digital security incidents.
Companies and entities obligated to report cybersecurity incidents under EU regulations
20 Apr 2026
5/10
Data Protection
Effective: 10/04/2026
The Spanish AI Supervision Agency and the Institute for Women will collaborate to ensure that AI systems respect fundamental rights and gender equality.
AI development and user companies, especially in HR, finance and services
14 Aug 2026
4/10
Data Protection
Effective: 14/08/2026
The European Central Bank establishes the rules for processing personal data during prudential supervision of credit institutions. It defines responsibilities between the ECB and national competent authorities.
Credit institutions under supervision, ECB, national banking supervisory authorities