27 Jun 2026
8/10
Data Protection
Effective: 27/06/2026
The Spanish Data Protection Authority sanctions Vodafone with 1.05 million and Amadeus with 14.4 million euros for violating the RGPD in the processing of personal data.
Companies processing personal data, especially large technology and telecommunications corporations
19 Jun 2026
6/10
Data Protection
New UN convention that facilitates cooperation between countries to prosecute computer crimes and share digital evidence in criminal investigations.
Technology companies, digital service providers, telecommunications and judicial authorities
08 Apr 2026
6/10
Data Protection
Effective: 07/04/2026
The EU establishes the body that will coordinate the shared use of health data among member states. It will regulate access to medical records and health data at European scale.
Hospitals, insurers, pharmaceuticals, researchers and health sector technology companies
03 Jul 2026
5/10
Data Protection
Effective: 30/06/2026
The Commission establishes internal rules on how it manages personal data in its investigations into large digital platforms. It allows restricting certain rights of affected individuals during those investigations.
Technology companies investigated under the DMA and individuals whose data is processed by the Commission in those proceedings
09 Jun 2026
5/10
Data Protection
Effective: 20/04/2026
A delegated EU regulation is corrected that regulates how companies can invoke cybersecurity reasons to delay the publication of incident notifications. It affects entities obligated to report digital security incidents.
Companies and entities obligated to report cybersecurity incidents under EU regulations
20 Apr 2026
5/10
Data Protection
Effective: 10/04/2026
The Spanish AI Supervision Agency and the Institute for Women will collaborate to ensure that AI systems respect fundamental rights and gender equality.
AI development and user companies, especially in HR, finance and services
03 Jul 2026
4/10
Data Protection
Effective: 30/06/2026
The Commission establishes how it manages personal data in its investigations into foreign subsidies that distort the EU market. It defines when it can limit the access of those affected to their own information.
Companies investigated for foreign subsidies and natural persons linked to those files
10 Mar 2026
4/10
Data Protection
A corrigendum is issued for the European Data Regulation (Data Act) of 2023. It affects the rules on data sharing between businesses and public administrations.
Technology companies, connected device manufacturers, cloud service providers and public administrations in the EU
29 May 2026
3/10
Data Protection
Effective: 27/04/2026
Red.es signs an addendum with 20 entities to create a Digital Rights Observation Space that promotes the Digital Rights Charter. Spanish and international universities, foundations and civil organizations participate.
Citizens, digital entities, universities and organizations signatory to the agreement
16 May 2026
3/10
Data Protection
The agreement is extended that allows the Social Institute of the Navy to access Andalusian electronic clinical records to conduct mandatory medical examinations for maritime embarkation.
Seafarers in Andalusia, Social Institute of the Navy and Andalusian Health Service