The first major EU Cyber Resilience Act (the “CRA“) compliance deadline is fast approaching. From 11 September 2026, manufacturers within scope of the CRA must comply with new reporting obligations for actively exploited vulnerabilities and severe incidents. These requirements take effect more than a year before the CRA’s substantive provisions, making them an
Continue Reading EU: Preparing for the Cyber Resilience Act’s September 2026 Reporting Obligations
The NIS2 Directive continues to evolve – and organisations must keep pace. On 20 January 2026, the Commission unveiled a set of targeted amendments to the NIS2 Directive (“the Proposal“), signalling the next phase of its push to modernise and streamline the EU’s cybersecurity legal framework.
Positioned within a broader legislative package, also
Continue Reading EU: NIS2 Update – EU Moves to Harmonise Cyber Controls, Refine Scope, and Add New In-Scope Entities
The Irish Supreme Court, on 24 July 2025, issued a landmark decision offering greater clarity on non-material damages in the context of privacy claims under the General Data Protection Regulation (GDPR). The judgment in Dillon v Irish Life Assurance plc[1] (Dillon) marks a significant development for both individuals seeking compensation
Continue Reading Ireland: GDPR, PIAB, and the Personal Injury Puzzle – The Irish Supreme Court Decides
The NIS2 Directive has significantly reshaped the cybersecurity landscape across the EU. Since the implementation deadline in October 2024, EU Member States have been working to incorporate new standards into their national laws, fostering a dynamic and rapidly evolving regulatory environment. Recently, Ireland’s National Cyber Security Centre (NCSC) published the draft NIS2 Risk Management Measures
Continue Reading Ireland: NIS2 revamps Ireland’s cybersecurity landscape: Old regulators, new powers
October has already been a busy month for the Court of Justice of the European Union (“CJEU”), which has published a number of judgments on the interpretation and application of the GDPR, including five important decisions, all issued by the CJEU on one day – 4 October 2024.
This article provides an overview
Continue Reading EU: CJEU InsightThe Irish Data Protection Commission (DPC) has welcomed X’s agreement to suspend its processing of certain personal data for the purpose of training its AI chatbot tool, Grok. This comes after the DPC issued suspension proceedings against X in the Irish High Court. The DPC described this as the first time that any
Continue Reading Ireland: Increased regulatory convergence of AI and data protection: X suspends training of AI chatbot with EU user data after Irish regulator issues High Court proceedings
The Data Protection Commission (DPC) has published its 2023 Annual Report, highlighting a record year with DPC fines accounting for 87% of all GDPR fines issued across the EU. A busy year for the DPC also saw a 20% increase in reported personal data breaches as Helen Dixon steps down after 10 years in
Continue Reading Ireland: DPC Issues Record 87% of EU GDPR Fines in 2023; Breach Reports Increase by 20%Introduction
Identifiability; what can amount to personal data; and joint controllership are some of the issues addressed by the Court of Justice of the European Union (CJEU) in its recent judgment in the IAB Europe case (C-604/22). This case concerned the use of personal data for online advertising purposes and the use
Continue Reading CJEU ruling clarifies data protection and e-privacy issues in the ad-tech space
2023 was a busy year for the Court of Justice of the European Union (CJEU), with the issuance of a number of far-reaching judgments on the interpretation and application of the GDPR.
In December 2023, the CJEU delivered two important decisions which supplement a growing body of jurisprudence on the issuance of administrative fines and
Continue Reading CJEU Insight
