DPO Advisor

Find everything you need to stay up-to-date on evolving privacy & security regulations around the world.

Region

regulation

Austria’s DSB finds that Microsoft violated EU privacy law in educational deployment

October 23, 2025

Austria’s DSB found Microsoft violated the GDPR by tracking students via its 365 Education tools without proper consent. The case highlights strict privacy rules for tech platforms handling minors’ data in EU schools.

Ontario IPC updates De-identification Guidelines for Structured Data

October 15, 2025

Ontario’s IPC released updated De-identification Guidelines for Structured Data, offering practical steps to reduce re-identification risks and strengthen privacy. The guidance promotes responsible, transparent data use across sectors.

Australian Clinical Labs hit with first civil penalty under Privacy Act for 2022 data breach

October 9, 2025

Australia’s Federal Court fined Clinical Labs A$5.8M for a 2022 breach exposing 223K records. The first civil penalty under the Privacy Act signals stricter enforcement of data security and breach reporting duties.

Amnesty International Kenya’s data rights study and guidelines

October 6, 2025

Amnesty International Kenya published a study and data guidelines to boost awareness of Kenya’s Data Protection Act. The report urges stronger oversight and provides practical tools for civil groups to enhance privacy accountability.

Thailand’s PDPC issues eight severe fines under PDPA

October 3, 2025

Thailand’s PDPC issued major fines in eight cases under the PDPA, citing poor security, misuse of sensitive data, and lack of compliance roles. The regulator signals a shift from education to strict enforcement for data protection.

Imgur withdraws from the UK after ICO warning over data practices

October 2, 2025

Imgur blocked UK access after the ICO raised concerns about its data handling, especially children’s data. The move highlights how UK GDPR compliance costs can drive global platforms to withdraw from stricter privacy markets.

UK Upper Tribunal upholds ICO case against Clearview AI

October 1, 2025

The UK’s Upper Tribunal upheld the ICO’s case against Clearview AI, confirming UK GDPR applies to firms processing biometric data of UK citizens. The ruling reinforces data protection authority over global facial-recognition companies.

Spain’s AEPD fines Iberinform €720,000 for improper data processing

September 30, 2025

Spain’s AEPD fined Iberinform €720,000 for processing personal data without informing individuals. The regulator cited GDPR breaches of fairness and transparency, rejecting cost excuses and stressing users’ right to be informed.

California CPPA issues record US$1.35 million fine against Tractor Supply Company

September 29, 2025

California’s CPPA fined Tractor Supply $1.35M for privacy lapses under the CCPA, citing poor opt-out tools and ignored Global Privacy Control signals. The case shows strict state-level enforcement of data rights and compliance duties.