709 Publications

What is changing in each member's jurisdiction — enforcement, case law, new obligations.

709 articles

Polish Supreme Administrative Court Requires DPAs to Prove Identifiability Before Treating IP Addresses and Cookie IDs as Personal Data

In a significant judgment issued on 16 October 2025 (III OSK 2595/22), the Polish Supreme Administrative Court (NSA) held that the data protection authority (UODO) cannot assume that IP addresses and cookie identifiers always constitute personal data. Instead, the authority must demonstrate - based on objective, case-specific factors - that an individual is identifiable within the meaning of Article 4(1) GDPR. The ruling strengthens procedural rigor in GDPR enforcement and reinforces the contextual approach to identifiability reflected in CJEU case law, including Breyer and Planet49.

9 December 2025

AI & automationLegislation

Romania and the EU AI Act: Ready or Just Warming Up?

Artificial Intelligence is reshaping industries and societies worldwide. As the European Union rolls out the AI Act, Romania is at the boiling point: Is it prepared to navigate this complex regulatory landscape? While the country boasts a vibrant tech ecosystem, aligning its legislative and institutional structures with EU standards still remains a challenge. This article explores the country’s current stance, challenges, and opportunities in aligning with Europe’s landmark AI regulation.

4 December 2025

INPLP internal

A new member has joined the INPLP: Rachel O’Brien

O’Brien Legal is a boutique Auckland firm specialising in privacy, data protection and AI governance, supported by strong commercial and technology law capability. The firm helps organisations underst…

3 December 2025

INPLP internal

INPLP Reaches 50 Countries

Reaching 50 countries.What once felt like a distant dream has become reality: INPLP now connects privacy professionals in 50 countries around the world. Our newest member from Bolivia marks a mileston…

2 December 2025

INPLP internal

The 10th INPLP Conference

The 10th Conference of the INPLP took place in Barcelona and was a tremendous success, bringing together participants from 35 countries. A heartfelt thank-you to our local partner Belen Arribas Sanchez for the excellent on-site organization. A highly engaging Scientific Session and a visit to the European Commission Representation in Barcelona were among the program’s highlights—alongside the incredible culinary diversity that fostered many inspiring conversations. This year, we were also proud to celebrate reaching 50 member countries within the INPLP | International Network of Privacy Law Professionals network — a remarkable milestone on our journey. We are already looking forward to the 11th INPLP Conference, which will take place in November 2026, either in New Delhi or Amsterdam.

2 December 2025

Using Face Recognition Systems in Commercial Premises

Bulgarian Data Protection Authority recently published a statement on the admissibility of using videosurveillance systems with face recognission functionalities in big commercial premises as shoping malls and hypermarkets.

2 December 2025

INPLP internal

A new member has joined the INPLP: Rodrigo Moreno

Moreno Baldivieso is a leading full-service corporate and commercial law firm in Bolivia, recognized for its excellence across all major practice areas, including a rapidly expanding Privacy and Data…

18 November 2025

Closing the Gap: Paraguay Advances Toward Comprehensive Data Protection

Paraguay is on the verge of adopting its first General Law on the Protection of Personal Data, closing a long-standing gap in its legal framework. Its success will depend on overcoming institutional, business, and cultural challenges, but it represents a milestone for competitiveness in the digital era.

4 November 2025

INPLP internal

New members have joined the INPLP: Lucia Cantera, Isabel Mendez, Virginia Cervieri and Keesha Fleming Lake

Cervieri Monsuarez is an international law firm, with offices in Uruguay, Paraguay, Bolivia and Anguilla. With wide expertise in diverse matters such as Intellectual Property, technology and data prot…

3 October 2025

The New Era of Privacy and Data Protection in Mexico: What’s Changing?

The Mexican legal system has undergone an unprecedented transformation in the past few months. This has impacted several areas, including but not limited to the dissolution of INAI, former regulator for transparency, access to public information, privacy and personal data protection.

30 September 2025

Enforcement & fines

Due Diligence Obligations in the Spain: Lessons learnt from AEPD Sanctions and future trends

Amid the EU's rapidly evolving due diligence landscape, this article unpacks Spain’s tough stance on data protection compliance and reveals how landmark AEPD fines have sounded a wake-up call: businesses must rigorously vet their third-party providers or face costly consequences.

2 September 2025

Legislation

Harmonising Data Protection Legislation across the Commonwealth Caribbean

Can the Commonwealth Model Provisions on Data Protection (“CMP”) drive harmonisation of the collection and retention of Data throughout the Commonwealth Caribbean?

14 August 2025

Join the network

Applications from qualified privacy practices are reviewed individually by the INPLP board.

Apply for membership