Policy updates
What changed in the rules behind your policies.
New versions, official guidance, rules and enforcement for the frameworks PoliWriter writes to. Each update is written from its source, quotes it, and names the policies to review.
20 updates. Latest from 16 Oct 2026. Checked every day.
Norwegian DPA fines Xandr EUR 8.6 million for unlawful processing of personal data
The Norwegian DPA fined Xandr Inc. EUR 8,600,000 for processing personal data of Grindr users without a legal basis and for processing special category data concerning sexual orientation without a valid exemption.
EDPB issues statement on smart glasses and GDPR compliance
The EDPB outlines GDPR considerations for smart glasses, including controller identification, transparency, legal basis, and data protection by design. It emphasizes the need for effective transparency measures and risk mitigation for non-users.
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of health data
The Italian DPA fined IQVIA Solutions Italy S.r.l. EUR 7,000,000 for processing health data without a legal basis, inadequate information, no DPIA, and insufficient security. IQVIA must comply within 120 days or have GPs anonymise data independently.
Italian DPA fines security company EUR 39,000 for GDPR violations
The Italian DPA fined La Patria S.p.A. EUR 39,000 for failing to respond to an employee's access requests and for inadequate information about GPS data processing. The company also had incorrect references to special categories of data in its privacy notice.
Italian DPA fines Emirates EUR 180,000 over passenger health data
The Italian DPA fined Emirates EUR 180,000 for failing to provide clear information about processing of health data via MEDIF forms and for excessive retention. Emirates must comply within 30 days.
Italian DPA fines BBVA EUR 5,508,000 for failing to respect objection to direct marketing
The Italian DPA fined BBVA EUR 5,508,000 for failing to give effect to a customer's objection to direct marketing, resulting in unsolicited promotional notifications for seven months. The DPA also ordered BBVA to adopt measures to facilitate data subject rights and report back within 30 days.
Swedish DPA fines Miljödata i Karlskrona EUR 160,000 for insufficient security
The Swedish DPA fined IT service provider Miljödata i Karlskrona SEK 1,800,000 (approx. EUR 160,000) for violating GDPR Article 32(1) after a cyberattack exposed personal data of 2.2 million individuals. The company failed to maintain adequate technical and organizational security measures.
Hellenic DPA fines Ministry and E.E.T.A.A. over data breach
The Hellenic DPA fined the Ministry of Social Cohesion and Family Affairs EUR 200,000 and E.E.T.A.A. EUR 150,000 for a data breach caused by outdated systems and inadequate security, and ordered them to enter into a data processing agreement and implement security measures.
Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making
The Dutch DPA fined Uber EUR 824,990,000 for making fully automated decisions about drivers without sufficient information, violating GDPR Articles 22 and 13.
PCI SSC publishes Key Management and Operations (KMO) Standard v1.0
PCI SSC released the Key Management and Operations (KMO) Standard v1.0, which consolidates key management requirements and introduces new requirements for cloud-based HSMs and software-based cryptography. The standard initially focuses on PIN and P2PE keys.
PCI SSC releases version 2.0 of the Secure Software Lifecycle Standard
PCI SSC published version 2.0 of the Secure Software Lifecycle Standard, aligning with the Secure Software Standard v2.0 and adding requirements for digital tools and AI. A 12-month transition period from v1.1 to v2.0 begins once training becomes available in Q4 2026.
Irish DPC fines Google EUR 403 million over location data processing
The Irish Data Protection Commission fined Google EUR 403,000,000 for GDPR violations in processing location data, including lawfulness, fairness, transparency, accountability, and retention. Google must bring processing into compliance within 6 months.
EDPB issues guidelines on the interplay between the DSA and the GDPR
The EDPB adopted Guidelines 3/2025 on the interplay between the DSA and the GDPR, clarifying how intermediary service providers should apply the GDPR when processing personal data in DSA contexts.
EDPB adopts guidelines on imposing GDPR administrative fines
The EDPB adopted guidelines on determining whether to impose an administrative fine in addition to or instead of other corrective measures under the GDPR. The guidelines outline a five-step methodology for supervisory authorities.
PCI SSC publishes AI security guidance
PCI SSC published an information supplement on security considerations for AI systems, covering AI deployment, defending against malicious AI use, and how PCI standards apply to AI.
PCI SSC publishes mapping of PCI DSS v4.0.1 to NIST CSF 2.0
The PCI Security Standards Council published a document mapping PCI DSS v4.0.1 to the NIST Cybersecurity Framework 2.0 to help organizations align security efforts across both frameworks.
PCI SSC publishes guidance on compensating controls and customized approach
PCI SSC released guidance clarifying the differences between compensating controls and the customized approach under PCI DSS v4.x. It emphasizes documentation quality and assessor independence.
PCI SSC opens comment period on PCI DSS v4.0.1
The PCI Security Standards Council is requesting comments on the current PCI DSS v4.0.1 from 3 June to 20 July 2026. Eligible stakeholders can submit feedback through the PCI SSC Portal.
HHS announces Tribal consultation on proposed HIPAA Privacy Rule changes
HHS will hold a virtual Tribal consultation on February 6, 2026, to discuss proposed modifications to the HIPAA Privacy Rule that would strengthen individuals' rights to access their health information and improve care coordination.
HHS proposes changes to the HIPAA Security Rule
HHS proposes to modify the HIPAA Security Rule to strengthen cybersecurity protections for electronic protected health information (ePHI). The proposed changes address changes in technology, increased breaches, and common compliance deficiencies.
How these are written
Every day PoliWriter reads official sources: the US Federal Register, NIST, the European Data Protection Board, the European Commission and the PCI Security Standards Council, plus The HIPAA Journal for HIPAA enforcement.
Only real changes are kept: new versions, rules, official guidance, enforcement by a regulator and deadlines. An AI model drafts each update from the full source text. Every fact carries a sentence quoted from the source, and code checks that each quote is really there; a second check compares the summary and the suggested policy changes with the source. Anything that fails is not posted.
Read the source before you change a policy. Updates are not legal advice.