Europe: Compliance

The compliance period prescribed for data controllers in relation to loyalty card practices has been extended until 28 February 2027 pursuant to the Decision of the Personal Data Protection Board (the “Board”) dated 22 July 2026 and numbered 2026/1491 (the “Decision”), published in the Official Gazette dated 13 August 2026 and numbered 33339.

The FCA has published a blog, by its Head of Cross-cutting Policy & Strategy, Alex Smith, which announces that access to FCA Handbook data is now available directly...

The European Central Bank has issued an urgent directive to major financial institutions requiring comprehensive action plans to counter rapidly evolving cybersecurity threats powered by frontier artificial intelligence models. With an October 2026 deadline looming, banks must demonstrate concrete measures across vulnerability management, monitoring capabilities, and third-party risk controls as AI-enabled attacks compress the timeline between threat discovery and exploitation. This supervisory escalation s