AI governance remains a central theme, particularly within the EU. Perhaps most significantly, the EU’s Digital Omnibus on AI entered into force on 27 July 2026, postponing high-risk obligations under Annex III among other changes that aim to ease the regulatory burden. At a Member State level, Ireland’s Regulation of Artificial Intelligence Act 2026 commenced, giving effect to the EU AI Act in Ireland. Greece has also introduced a national framework implementing the EU AI Act. We also see some interesting developments in litigation, with Irish courts introducing practice directions on responsible generative AI use in court documents.

Workplace monitoring continues to draw regulatory attention. Slovakia’s DPA fined an employer for the unlawful tracking of a home worker’s location, while Sweden’s IMY reprimanded an employer for in-vehicle camera surveillance of drivers. Italy’s Garante fined a manufacturer for accessing employees’ work email accounts outside the scope of so-called ‘defensive controls’, and Türkiye’s regulator has told employers to stop using biometric data for attendance tracking. In the UK, the Government has consulted on options for regulating workplace monitoring technologies, including a possible statutory duty to consult and negotiate with worker representatives. Elsewhere, New Zealand’s Privacy Commissioner issued guidance on the use of smart glasses in the workplace, an area of growing focus due to the significant privacy considerations the technology presents.

Enforcement activity has also featured prominently. Romania’s DPA issued fines for inadequate security and excessive processing, Poland’s DPA issued a written warning over a company’s failure to cooperate with an investigation, and Finland’s Data Protection Ombudsman reprimanded an authority for unlawful employee credit checks. Ireland’s Data Protection Commission’s annual report makes for particularly interesting reading, noting a sharp, 45% rise in new cases.

Finally, we have seen several interesting decisions clarifying the scope of individuals’ personal data rights and the corresponding obligations on employers. In Belgium, for example, the DPA ordered an employer to provide five years of timesheets in response to a subject access request, rejecting its argument that the request was excessive. In Singapore, recent enforcement decisions have highlighted the risks of retaining former employees’ data and leaving dormant accounts inadequately protected. Sticking with the same theme, Kazakhstan has introduced a new Digital Code which creates certain personal data rights such as a right to be forgotten.

You can find further details on these updates, and more, by downloading the PDF on the right hand-side.