On April 8, 2025, the UK government published the Cyber Code of Practice (the “Code”) to support board directors in governing cybersecurity risks. The Code is available online. The UK's data protection regulator is actively investigating and, in some … [Read more] about UK Government Publishes Cyber Governance Code of Practice for Boards and Directors
On March 23, 2025, 23andMe Holding Co. (“23andMe”) filed for bankruptcy in the Eastern District of Missouri, potentially setting in motion the sale of genetic data collected from more than 15 million people. This has led to news outlets and state … [Read more] about To Delete or Not to Delete: Can 23andMe Really Sell Genetic Data Via Bankruptcy?
On March 26, 2025, the UK data protection regulator (the Information Commissioner’s Office (“ICO”)) fined Advanced Computer Software Group Ltd (“Advanced”) £3.07 million (approximately $4 million). In 2022, Advanced suffered a ransomware incident … [Read more] about UK’s Data Protection Regulator fines a UK SaaS provider ~$4 million following a ransomware incident
On March 18, 2025, the European Commission proposed to extend its adequacy decision in favor of the United Kingdom (‘UK’) for an additional six-month period. This would allow free flows of personal data from the EU to the UK to continue until … [Read more] about European Commission Moves to Extend Free Flows of Personal Data to the UK
On March 10, 2025, the Belgian Data Protection Authority (BDPA) updated its 2020 guidance on the processing of personal data for direct marketing purposes (see the updated guidance here in French and in Dutch). The BDPA reviewed its original guidance … [Read more] about Belgian Data Protection Authority Issues Updated Guidance on Direct Marketing Rules