Are you tired of generic newsletters that merely skim over your real challenges? Dastra brings you Dastra Insights: legal and regulatory monitoring specifically designed for DPOs, legal professionals, and Privacy and AI specialists.
🎯 Targeted, practical monitoring, grounded in the day-to-day realities of data protection and AI.
Here is our selection for October 2026:
[GDPR, ePrivacy and cybersecurity] Council adopts its position on Digital Omnibus VII
Date: 21st of October 2026 – mandate published on 22nt October 2026
Sources: Council of the European Union
The Council of the European Union has adopted its negotiating mandate on the Digital Omnibus VII provisions concerning data protection, privacy, data governance and incident reporting. Its position amends the proposal submitted by the Commission in November 2025 in several respects.
Regarding the GDPR, the Council retains the current definition of personal data, but proposes a new article addressing pseudonymised data and a third party’s effective ability to identify an individual. The mandate also proposes extending the deadline for notifying personal data breaches from 72 to 96 hours, while limiting notification to the supervisory authority to breaches likely to result in a high risk.
For AI-related processing, the Council considers that legitimate interests may, subject to a case-by-case assessment, constitute a legal basis for the development and operation of AI systems or models.
The Council also wishes to retain the cookie regime under the ePrivacy Directive, unlike the proposal to transfer it to the GDPR.
Lastly, the mandate replaces the proposed European single entry point for incident notifications with a national entry point in each Member State, together with harmonisation carried out in cooperation with ENISA.
Important: these changes reflect only the Council’s negotiating position. They are not yet applicable and will need to be negotiated with the European Parliament before the text can potentially be adopted.
[AI Act and standardisation] EN 18286:2026 becomes the first harmonised standard supporting the AI Act
Date: 14th of October 2026
Sources: European Commission
The reference to EN 18286:2026 – Artificial Intelligence – Quality Management System for EU AI Act Regulatory Purposes, developed by CEN and CENELEC, was published in the Official Journal of the European Union following Implementing Decision (EU) 2026/2274 of 12 October 2026. It is the first harmonised standard referenced in support of the implementation of the AI Act.
Providers of high-risk AI systems applying this standard benefit from a presumption of conformity limited to the requirements of Article 17 of the AI Act covered by the standard, concerning the quality management system. This presumption therefore does not amount to general compliance of the AI system with the Regulation as a whole.
The standard translates the obligations under Article 17 into governance processes applicable throughout the AI system’s lifecycle. Its use remains voluntary: a provider may choose other means to demonstrate compliance, but will not benefit from the presumption attached to the harmonised standard.
[Generative AI and personal data] The ICO clarifies its expectations for model developers
Date: 21st October 2026
Sources: ICO
Following its supervisory programme concerning major foundation model developers, the ICO clarified its expectations in five areas: transparency, legal basis, exercise of rights, the presence of personal data in models, and the processing of sensitive data.
Developers must, in particular, accurately identify the data and sources used, document their legitimate interests assessment, and provide accessible mechanisms for both users and individuals whose data were collected indirectly. The ICO also considers that a model trained on personal data may itself contain such data, depending on the level of memorisation and the potential for extraction or re-identification.
The UK approach remains broadly aligned with that of the EDPB, but appears more prescriptive regarding the practical measures and documentation expected. For each category of sensitive data processed, even unintentionally, the developer must identify a legal basis under Article 6 and a separate condition under Article 9 of the UK GDPR. However, the ICO acknowledges that the current Article 9 conditions can sometimes be difficult to apply to the training of foundation models.
[Generative AI and autonomous agents] The ICO secures commitments from ten foundation model developers
Date: 8th of October 2026
Source: Information Commissioner's Office
Following its supervisory programme, the ICO states that it has obtained commitments from ten developers, including Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI. The improvements relate in particular to transparency, the exercise of rights, and the assessment of safeguards applicable to processing activities.
At the same time, the ICO launched a six-week consultation on risks associated with AI agents, covering security, transparency, accountability, fairness, automated decision-making and the lawfulness of processing. The results are intended to inform future UK guidance and the future statutory code on AI and automated decision-making.
[Smart glasses] The EDPB clarifies responsibilities and transparency requirements
Date: 13th of October 2026
Source: European Data Protection Board
The EDPB adopted a preliminary statement on smart glasses, highlighting the risks of individuals being recorded without their knowledge, particularly in schools, healthcare settings and workplaces.
The user may become a controller when they publicly disseminate recordings or use the glasses in a professional, official or political context. Manufacturers and service providers remain responsible for their own processing activities. The EDPB recommends visible and reliable recording indicators, such as light signals, audible alerts or design features enabling third parties to understand immediately that they are being filmed.
[B2B marketing] The CNIL sets out a framework for reconstructing professional email addresses
Date: 16th of October 2026
Source: CNIL
The CNIL clarified the conditions under which an organisation may infer a professional email address from an individual’s first name, last name, employer and the company’s usual email format.
Legitimate interests may be relied upon, particularly for B2B marketing, but only after assessing the purpose, the intrusive nature of the practice, the individual’s reasonable expectations, and the context in which the information was published. The CNIL recommends limited retention periods and the immediate exclusion of individuals who object to the processing. Where these conditions cannot be met, the organisation must refrain from the practice or obtain consent.
[Health data security] Decision against Children’s Health Ireland over the management of paper records
Date: 1st of October 2026
Source: Irish Data Protection Commission
The Irish DPC found infringements of Articles 5(1)(f) and 32 of the GDPR relating to the physical security of children’s medical records held at Tallaght University Hospital. The investigation revealed, in particular, sensitive documents overflowing from a bin intended for confidential waste.
Children’s Health Ireland received a reprimand and must complete several data protection impact assessments relating to the management of medical records and confidential waste. The organisation must also implement the technical and organisational measures, as well as the operational procedures, identified in those assessments.
[Cookies and mobile applications] The CNIL fines FNAC Darty €7 million
Date: decision of 22nd of October 2026
Source: CNIL
The CNIL imposed two fines totalling €7 million on FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT. The mobile application transmitted a user identifier and information on products viewed to a third-party domain in order to personalise recommendations and train the recommendation algorithm.
The restricted committee found that this tracker was not strictly necessary for the service requested and therefore did not qualify for the exemption provided under Article 82 of the French Data Protection Act. Its use required users’ prior consent. The sanction is accompanied by an order subject to a penalty payment of €10,000 per day of delay.
[Targeted advertising and sensitive data] Xandr fined for using data originating from Grindr
Date: final decision of 2nd of October 2026
Source: EDPB, summary of the Norwegian authority’s decision
The Norwegian authority imposed a fine of €8.6 million on Xandr, a Microsoft group company, for processing Grindr users’ data in the context of real-time advertising auctions.
Use of Grindr, combined with advertising identifiers and IP addresses, was considered capable of revealing sexual orientation and therefore to constitute the processing of data falling under Article 9 of the GDPR. Xandr, classified as a joint controller, could not simply rely on the consent obtained by Grindr: each joint controller must verify that consent is valid and covers its own processing activities.
[Data Act and cloud services] The ACM clarifies rules applicable to switching providers
Date: 19th of October 2026
Source: Netherlands Authority for Consumers and Markets – ACM
The ACM has opened a consultation on draft guidelines concerning the obligations of cloud service providers under the Data Act. Providers must enable their customers to switch services or use multiple providers simultaneously without unjustified obstacles, while ensuring the continuity and security of the transfer.
They must also provide clear information on switching arrangements, timelines and costs; provide, free of charge, the interfaces necessary for portability and interoperability; and protect non-personal data against unlawful access by authorities in third countries. For customers, the guidance calls for a review of contractual clauses, portability mechanisms and exit strategies. The consultation is open until 6th of November 2026.