[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXZGVbLMFTAkuyFB_y9lT9WE2LHJFAUrzBb-Y5zDwEw0":3,"$fDuOfbrGklFg9DNstLQj01v77JKgm8YTNP3W1V3nd5U4":81,"faq-section-":235,"white_papers":236},{"tableOfContents":4,"markDownContent":5,"htmlContent":6,"metaTitle":7,"metaDescription":8,"wordCount":9,"readTime":10,"title":11,"nbDownloads":12,"excerpt":13,"lang":14,"url":15,"intro":16,"featured":17,"state":18,"author":19,"authorId":20,"datePublication":24,"dateCreation":25,"dateUpdate":26,"mainCategory":27,"categories":43,"metaDatas":70,"imageUrl":71,"imageThumbUrls":72,"id":80},true,"Are you tired of generic newsletters that merely skim over your real challenges? Dastra brings you **Dastra Insights**: legal and regulatory monitoring **specifically designed for DPOs, legal professionals, and Privacy and AI specialists**.\n\n🎯 **Targeted, practical monitoring, grounded in the day-to-day realities of data protection and AI.**\n\nHere is our selection for **October 2026**:\n\n---\n\n## \\[GDPR, ePrivacy and cybersecurity\\] Council adopts its position on Digital Omnibus VII\n\n**Date**: 21st of October 2026 – mandate published on 22nt October 2026\\\n**Sources**: [Council of the European Union](https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/)\n\nThe Council of the European Union has adopted its negotiating mandate on the **Digital Omnibus VII** provisions concerning data protection, privacy, data governance and incident reporting. Its position amends the proposal submitted by the Commission in November 2025 in several respects.\n\nRegarding the GDPR, the Council **retains the current definition of personal data**, but proposes a new article addressing pseudonymised data and a third party’s effective ability to identify an individual. The mandate also proposes extending the deadline for notifying personal data breaches from **72 to 96 hours**, while limiting notification to the supervisory authority to breaches likely to result in a high risk.\n\nFor AI-related processing, the **Council considers that legitimate interests may, subject to a case-by-case assessment, constitute a legal basis for the development and operation of AI systems or models.**\n\nThe Council also wishes to retain the cookie regime under the ePrivacy Directive, unlike the proposal to transfer it to the GDPR.\n\nLastly, the mandate replaces the proposed European single entry point for incident notifications with a **national entry point in each Member State**, together with harmonisation carried out in cooperation with ENISA.\n\n*Important: these changes reflect only the Council’s negotiating position. They are not yet applicable and will need to be negotiated with the European Parliament before the text can potentially be adopted.*\n\n## \\[AI Act and standardisation\\] EN 18286:2026 becomes the first harmonised standard supporting the AI Act\n\n**Date**: 14th of October 2026\\\n**Sources**: [European Commission](https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal)\n\nThe reference to **EN 18286:2026 – Artificial Intelligence – Quality Management System for EU AI Act Regulatory Purposes**, developed by CEN and CENELEC, was published in the Official Journal of the European Union following Implementing Decision **(EU) 2026/2274 of 12 October 2026**. It is the first harmonised standard referenced in support of the implementation of the AI Act.\n\nProviders of high-risk AI systems applying this standard benefit from a **presumption of conformity limited to the requirements of Article 17 of the AI Act covered by the standard**, concerning the quality management system. This presumption therefore does not amount to general compliance of the AI system with the Regulation as a whole.\n\nThe standard translates the obligations under Article 17 into governance processes applicable throughout the AI system’s lifecycle. Its use remains voluntary: a provider may choose other means to demonstrate compliance, but will not benefit from the presumption attached to the harmonised standard.\n\n## \\[Generative AI and personal data\\] The ICO clarifies its expectations for model developers\n\n**Date**: 21st October 2026\\\n**Sources**: [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/)\n\nFollowing its supervisory programme concerning major foundation model developers, the ICO clarified its expectations in five areas: transparency, legal basis, exercise of rights, the presence of personal data in models, and the processing of sensitive data.\n\nDevelopers must, in particular, accurately identify the data and sources used, document their legitimate interests assessment, and provide accessible mechanisms for both users and individuals whose data were collected indirectly. The ICO also considers that a model trained on personal data may itself contain such data, depending on the level of memorisation and the potential for extraction or re-identification.\n\nThe UK approach remains broadly aligned with that of the EDPB, but appears more prescriptive regarding the practical measures and documentation expected. For each category of sensitive data processed, even unintentionally, the developer must identify a legal basis under Article 6 and a separate condition under Article 9 of the UK GDPR. However, the ICO acknowledges that the current Article 9 conditions can sometimes be difficult to apply to the training of foundation models.\n\n## \\[Generative AI and autonomous agents\\] The ICO secures commitments from ten foundation model developers\n\n**Date**: 8th of October 2026\\\n**Source**: [Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/)\n\nFollowing its supervisory programme, the ICO states that it has obtained commitments from ten developers, including Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI. The improvements relate in particular to transparency, the exercise of rights, and the assessment of safeguards applicable to processing activities.\n\nAt the same time, the ICO launched a six-week consultation on risks associated with **AI agents**, covering security, transparency, accountability, fairness, automated decision-making and the lawfulness of processing. The results are intended to inform future UK guidance and the future statutory code on AI and automated decision-making.\n\n## \\[Smart glasses\\] The EDPB clarifies responsibilities and transparency requirements\n\n**Date**: 13th of October 2026\\\n**Source**: [European Data Protection Board](https://www.edpb.europa.eu/news/edpb-publishes-statement-on-the-data-protection-challenges-of-smart-glasses_en)\n\nThe EDPB adopted a preliminary statement on smart glasses, highlighting the risks of individuals being recorded without their knowledge, particularly in schools, healthcare settings and workplaces.\n\nThe user may become a controller when they publicly disseminate recordings or use the glasses in a professional, official or political context. Manufacturers and service providers remain responsible for their own processing activities. The EDPB recommends visible and reliable recording indicators, such as light signals, audible alerts or design features enabling third parties to understand immediately that they are being filmed.\n\n## \\[B2B marketing\\] The CNIL sets out a framework for reconstructing professional email addresses\n\n**Date**: 16th of October 2026\\\n**Source**: [CNIL](https://www.cnil.fr/fr/reconstitution-adresses-professionnelles-quel-cadre)\n\nThe CNIL clarified the conditions under which an organisation may infer a professional email address from an individual’s first name, last name, employer and the company’s usual email format.\n\nLegitimate interests may be relied upon, particularly for B2B marketing, but only after assessing the purpose, the intrusive nature of the practice, the individual’s reasonable expectations, and the context in which the information was published. The CNIL recommends limited retention periods and the immediate exclusion of individuals who object to the processing. Where these conditions cannot be met, the organisation must refrain from the practice or obtain consent.\n\n## \\[Health data security\\] Decision against Children’s Health Ireland over the management of paper records\n\n**Date**: 1st of October 2026\\\n**Source**: [Irish Data Protection Commission](https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-publishes-final-decision-following-inquiry-childrens-health-ireland-chi)\n\nThe Irish DPC found infringements of Articles 5(1)(f) and 32 of the GDPR relating to the physical security of children’s medical records held at Tallaght University Hospital. The investigation revealed, in particular, sensitive documents overflowing from a bin intended for confidential waste.\n\nChildren’s Health Ireland received a reprimand and must complete several data protection impact assessments relating to the management of medical records and confidential waste. The organisation must also implement the technical and organisational measures, as well as the operational procedures, identified in those assessments.\n\n## \\[Cookies and mobile applications\\] The CNIL fines FNAC Darty €7 million\n\n**Date**: decision of 22nd of October 2026\\\n**Source**: [CNIL](https://www.cnil.fr/en/sanction-app-cookies-fnac)\n\nThe CNIL imposed two fines totalling **€7 million** on FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT. The mobile application transmitted a user identifier and information on products viewed to a third-party domain in order to personalise recommendations and train the recommendation algorithm.\n\nThe restricted committee found that this tracker was not strictly necessary for the service requested and therefore did not qualify for the exemption provided under Article 82 of the French Data Protection Act. Its use required users’ prior consent. The sanction is accompanied by an order subject to a penalty payment of **€10,000 per day of delay**.\n\n## \\[Targeted advertising and sensitive data\\] Xandr fined for using data originating from Grindr\n\n**Date**: final decision of 2nd of October 2026\\\n**Source**: [EDPB, summary of the Norwegian authority’s decision](https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_it)\n\nThe Norwegian authority imposed a fine of **€8.6 million** on Xandr, a Microsoft group company, for processing Grindr users’ data in the context of real-time advertising auctions.\n\nUse of Grindr, combined with advertising identifiers and IP addresses, was considered capable of revealing sexual orientation and therefore to constitute the processing of data falling under Article 9 of the GDPR. Xandr, classified as a joint controller, could not simply rely on the consent obtained by Grindr: each joint controller must verify that consent is valid and covers its own processing activities.\n\n## \\[Data Act and cloud services\\] The ACM clarifies rules applicable to switching providers\n\n**Date**: 19th of October 2026\\\n**Source**: [Netherlands Authority for Consumers and Markets – ACM](https://www.acm.nl/en/publications/acm-publishes-guidelines-regarding-switching-cloud-services)\n\nThe ACM has opened a consultation on draft guidelines concerning the obligations of cloud service providers under the Data Act. Providers must enable their customers to switch services or use multiple providers simultaneously without unjustified obstacles, while ensuring the continuity and security of the transfer.\n\nThey must also provide clear information on switching arrangements, timelines and costs; provide, free of charge, the interfaces necessary for portability and interoperability; and protect non-personal data against unlawful access by authorities in third countries. For customers, the guidance calls for a review of contractual clauses, portability mechanisms and exit strategies. The consultation is open until **6th of November 2026**.","\u003Cp>Are you tired of generic newsletters that merely skim over your real challenges? Dastra brings you \u003Cstrong>Dastra Insights\u003C/strong>: legal and regulatory monitoring \u003Cstrong>specifically designed for DPOs, legal professionals, and Privacy and AI specialists\u003C/strong>.\u003C/p>\n\u003Cp>🎯 \u003Cstrong>Targeted, practical monitoring, grounded in the day-to-day realities of data protection and AI.\u003C/strong>\u003C/p>\n\u003Cp>Here is our selection for \u003Cstrong>October 2026\u003C/strong>:\u003C/p>\n\u003Chr />\n\u003Ch2 id=\"gdpr-eprivacy-and-cybersecurity-council-adopts-its-position-on-digital-omnibus-vii\">[GDPR, ePrivacy and cybersecurity] Council adopts its position on Digital Omnibus VII\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 21st of October 2026 – mandate published on 22nt October 2026\u003Cbr />\n\u003Cstrong>Sources\u003C/strong>: \u003Ca href=\"https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/\" rel=\"nofollow\">Council of the European Union\u003C/a>\u003C/p>\n\u003Cp>The Council of the European Union has adopted its negotiating mandate on the \u003Cstrong>Digital Omnibus VII\u003C/strong> provisions concerning data protection, privacy, data governance and incident reporting. Its position amends the proposal submitted by the Commission in November 2025 in several respects.\u003C/p>\n\u003Cp>Regarding the GDPR, the Council \u003Cstrong>retains the current definition of personal data\u003C/strong>, but proposes a new article addressing pseudonymised data and a third party’s effective ability to identify an individual. The mandate also proposes extending the deadline for notifying personal data breaches from \u003Cstrong>72 to 96 hours\u003C/strong>, while limiting notification to the supervisory authority to breaches likely to result in a high risk.\u003C/p>\n\u003Cp>For AI-related processing, the \u003Cstrong>Council considers that legitimate interests may, subject to a case-by-case assessment, constitute a legal basis for the development and operation of AI systems or models.\u003C/strong>\u003C/p>\n\u003Cp>The Council also wishes to retain the cookie regime under the ePrivacy Directive, unlike the proposal to transfer it to the GDPR.\u003C/p>\n\u003Cp>Lastly, the mandate replaces the proposed European single entry point for incident notifications with a \u003Cstrong>national entry point in each Member State\u003C/strong>, together with harmonisation carried out in cooperation with ENISA.\u003C/p>\n\u003Cp>\u003Cem>Important: these changes reflect only the Council’s negotiating position. They are not yet applicable and will need to be negotiated with the European Parliament before the text can potentially be adopted.\u003C/em>\u003C/p>\n\u003Ch2 id=\"ai-act-and-standardisation-en-182862026-becomes-the-first-harmonised-standard-supporting-the-ai-act\">[AI Act and standardisation] EN 18286:2026 becomes the first harmonised standard supporting the AI Act\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 14th of October 2026\u003Cbr />\n\u003Cstrong>Sources\u003C/strong>: \u003Ca href=\"https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal\" rel=\"nofollow\">European Commission\u003C/a>\u003C/p>\n\u003Cp>The reference to \u003Cstrong>EN 18286:2026 – Artificial Intelligence – Quality Management System for EU AI Act Regulatory Purposes\u003C/strong>, developed by CEN and CENELEC, was published in the Official Journal of the European Union following Implementing Decision \u003Cstrong>(EU) 2026/2274 of 12 October 2026\u003C/strong>. It is the first harmonised standard referenced in support of the implementation of the AI Act.\u003C/p>\n\u003Cp>Providers of high-risk AI systems applying this standard benefit from a \u003Cstrong>presumption of conformity limited to the requirements of Article 17 of the AI Act covered by the standard\u003C/strong>, concerning the quality management system. This presumption therefore does not amount to general compliance of the AI system with the Regulation as a whole.\u003C/p>\n\u003Cp>The standard translates the obligations under Article 17 into governance processes applicable throughout the AI system’s lifecycle. Its use remains voluntary: a provider may choose other means to demonstrate compliance, but will not benefit from the presumption attached to the harmonised standard.\u003C/p>\n\u003Ch2 id=\"generative-ai-and-personal-data-the-ico-clarifies-its-expectations-for-model-developers\">[Generative AI and personal data] The ICO clarifies its expectations for model developers\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 21st October 2026\u003Cbr />\n\u003Cstrong>Sources\u003C/strong>: \u003Ca href=\"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/building-trust-and-transparency-into-generative-ai-development-our-work-to-create-regulatory-certainty/\" rel=\"nofollow\">ICO\u003C/a>\u003C/p>\n\u003Cp>Following its supervisory programme concerning major foundation model developers, the ICO clarified its expectations in five areas: transparency, legal basis, exercise of rights, the presence of personal data in models, and the processing of sensitive data.\u003C/p>\n\u003Cp>Developers must, in particular, accurately identify the data and sources used, document their legitimate interests assessment, and provide accessible mechanisms for both users and individuals whose data were collected indirectly. The ICO also considers that a model trained on personal data may itself contain such data, depending on the level of memorisation and the potential for extraction or re-identification.\u003C/p>\n\u003Cp>The UK approach remains broadly aligned with that of the EDPB, but appears more prescriptive regarding the practical measures and documentation expected. For each category of sensitive data processed, even unintentionally, the developer must identify a legal basis under Article 6 and a separate condition under Article 9 of the UK GDPR. However, the ICO acknowledges that the current Article 9 conditions can sometimes be difficult to apply to the training of foundation models.\u003C/p>\n\u003Ch2 id=\"generative-ai-and-autonomous-agents-the-ico-secures-commitments-from-ten-foundation-model-developers\">[Generative AI and autonomous agents] The ICO secures commitments from ten foundation model developers\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 8th of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/\" rel=\"nofollow\">Information Commissioner's Office\u003C/a>\u003C/p>\n\u003Cp>Following its supervisory programme, the ICO states that it has obtained commitments from ten developers, including Amazon, Anthropic, Apple, Google, Meta, Microsoft and OpenAI. The improvements relate in particular to transparency, the exercise of rights, and the assessment of safeguards applicable to processing activities.\u003C/p>\n\u003Cp>At the same time, the ICO launched a six-week consultation on risks associated with \u003Cstrong>AI agents\u003C/strong>, covering security, transparency, accountability, fairness, automated decision-making and the lawfulness of processing. The results are intended to inform future UK guidance and the future statutory code on AI and automated decision-making.\u003C/p>\n\u003Ch2 id=\"smart-glasses-the-edpb-clarifies-responsibilities-and-transparency-requirements\">[Smart glasses] The EDPB clarifies responsibilities and transparency requirements\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 13th of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://www.edpb.europa.eu/news/edpb-publishes-statement-on-the-data-protection-challenges-of-smart-glasses_en\" rel=\"nofollow\">European Data Protection Board\u003C/a>\u003C/p>\n\u003Cp>The EDPB adopted a preliminary statement on smart glasses, highlighting the risks of individuals being recorded without their knowledge, particularly in schools, healthcare settings and workplaces.\u003C/p>\n\u003Cp>The user may become a controller when they publicly disseminate recordings or use the glasses in a professional, official or political context. Manufacturers and service providers remain responsible for their own processing activities. The EDPB recommends visible and reliable recording indicators, such as light signals, audible alerts or design features enabling third parties to understand immediately that they are being filmed.\u003C/p>\n\u003Ch2 id=\"b2b-marketing-the-cnil-sets-out-a-framework-for-reconstructing-professional-email-addresses\">[B2B marketing] The CNIL sets out a framework for reconstructing professional email addresses\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 16th of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://www.cnil.fr/fr/reconstitution-adresses-professionnelles-quel-cadre\" rel=\"nofollow\">CNIL\u003C/a>\u003C/p>\n\u003Cp>The CNIL clarified the conditions under which an organisation may infer a professional email address from an individual’s first name, last name, employer and the company’s usual email format.\u003C/p>\n\u003Cp>Legitimate interests may be relied upon, particularly for B2B marketing, but only after assessing the purpose, the intrusive nature of the practice, the individual’s reasonable expectations, and the context in which the information was published. The CNIL recommends limited retention periods and the immediate exclusion of individuals who object to the processing. Where these conditions cannot be met, the organisation must refrain from the practice or obtain consent.\u003C/p>\n\u003Ch2 id=\"health-data-security-decision-against-childrens-health-ireland-over-the-management-of-paper-records\">[Health data security] Decision against Children’s Health Ireland over the management of paper records\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 1st of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://dataprotection.ie/en/news-media/latest-news/data-protection-commission-publishes-final-decision-following-inquiry-childrens-health-ireland-chi\" rel=\"nofollow\">Irish Data Protection Commission\u003C/a>\u003C/p>\n\u003Cp>The Irish DPC found infringements of Articles 5(1)(f) and 32 of the GDPR relating to the physical security of children’s medical records held at Tallaght University Hospital. The investigation revealed, in particular, sensitive documents overflowing from a bin intended for confidential waste.\u003C/p>\n\u003Cp>Children’s Health Ireland received a reprimand and must complete several data protection impact assessments relating to the management of medical records and confidential waste. The organisation must also implement the technical and organisational measures, as well as the operational procedures, identified in those assessments.\u003C/p>\n\u003Ch2 id=\"cookies-and-mobile-applications-the-cnil-fines-fnac-darty-7-million\">[Cookies and mobile applications] The CNIL fines FNAC Darty €7 million\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: decision of 22nd of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://www.cnil.fr/en/sanction-app-cookies-fnac\" rel=\"nofollow\">CNIL\u003C/a>\u003C/p>\n\u003Cp>The CNIL imposed two fines totalling \u003Cstrong>€7 million\u003C/strong> on FNAC DARTY PARTICIPATIONS ET SERVICES and FNAC DIRECT. The mobile application transmitted a user identifier and information on products viewed to a third-party domain in order to personalise recommendations and train the recommendation algorithm.\u003C/p>\n\u003Cp>The restricted committee found that this tracker was not strictly necessary for the service requested and therefore did not qualify for the exemption provided under Article 82 of the French Data Protection Act. Its use required users’ prior consent. The sanction is accompanied by an order subject to a penalty payment of \u003Cstrong>€10,000 per day of delay\u003C/strong>.\u003C/p>\n\u003Ch2 id=\"targeted-advertising-and-sensitive-data-xandr-fined-for-using-data-originating-from-grindr\">[Targeted advertising and sensitive data] Xandr fined for using data originating from Grindr\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: final decision of 2nd of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_it\" rel=\"nofollow\">EDPB, summary of the Norwegian authority’s decision\u003C/a>\u003C/p>\n\u003Cp>The Norwegian authority imposed a fine of \u003Cstrong>€8.6 million\u003C/strong> on Xandr, a Microsoft group company, for processing Grindr users’ data in the context of real-time advertising auctions.\u003C/p>\n\u003Cp>Use of Grindr, combined with advertising identifiers and IP addresses, was considered capable of revealing sexual orientation and therefore to constitute the processing of data falling under Article 9 of the GDPR. Xandr, classified as a joint controller, could not simply rely on the consent obtained by Grindr: each joint controller must verify that consent is valid and covers its own processing activities.\u003C/p>\n\u003Ch2 id=\"data-act-and-cloud-services-the-acm-clarifies-rules-applicable-to-switching-providers\">[Data Act and cloud services] The ACM clarifies rules applicable to switching providers\u003C/h2>\n\u003Cp>\u003Cstrong>Date\u003C/strong>: 19th of October 2026\u003Cbr />\n\u003Cstrong>Source\u003C/strong>: \u003Ca href=\"https://www.acm.nl/en/publications/acm-publishes-guidelines-regarding-switching-cloud-services\" rel=\"nofollow\">Netherlands Authority for Consumers and Markets – ACM\u003C/a>\u003C/p>\n\u003Cp>The ACM has opened a consultation on draft guidelines concerning the obligations of cloud service providers under the Data Act. Providers must enable their customers to switch services or use multiple providers simultaneously without unjustified obstacles, while ensuring the continuity and security of the transfer.\u003C/p>\n\u003Cp>They must also provide clear information on switching arrangements, timelines and costs; provide, free of charge, the interfaces necessary for portability and interoperability; and protect non-personal data against unlawful access by authorities in third countries. For customers, the guidance calls for a review of contractual clauses, portability mechanisms and exit strategies. The consultation is open until \u003Cstrong>6th of November 2026\u003C/strong>.\u003C/p>\n","Dastra Insights Privacy & AI: What Happened in October?","Legal and regulatory monitoring specifically designed for DPOs, legal counsel, and Privacy and AI professionals.",1575,9,"Dastra Insights: What happened in October in Privacy and AI?",0,null,"en","dastra-insights-what-happened-in-october-in-privacy-and-ai","Legal and regulatory monitoring specifically designed for DPOs, legal professionals, and Privacy and AI professionals.",false,"Published",{"id":20,"displayName":21,"avatarUrl":22,"bio":13,"blogUrl":13,"color":13,"userId":20,"creationDate":23},20352,"Leïla Sayssa","https://static.dastra.eu/tenant-3/avatar/20352/TDYeY3C8Rz1lLE/dpo-avatar-h01-150.png","2025-03-03T11:08:22","2026-11-02T09:45:00","2026-11-02T09:45:39.5710778","2026-11-02T10:27:55.2558387",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":33},2,"Blog","A list of curated articles provided by the community","blog","#28449a",[34,37,40],{"lang":35,"name":29,"description":36},"fr","Une liste d'articles rédigés par la communauté",{"lang":38,"name":29,"description":39},"es","Una lista de artículos escritos por la comunidad",{"lang":41,"name":29,"description":42},"de","Eine Liste von Artikeln, die von der Community verfasst wurden",[44,49],{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":45},[46,47,48],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},{"id":10,"name":50,"description":51,"url":52,"color":53,"parentId":28,"count":13,"imageUrl":13,"parent":54,"order":59,"translations":60},"News","Stay up to date with the latest news from data protection authorities: decisions, fines, guidelines, and regulatory trends in GDPR and privacy.","news","#1676ca",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":55},[56,57,58],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},4,[61,64,67],{"lang":35,"name":62,"description":63},"Actualités","Suivez les dernières actualités des autorités de protection des données (CNIL, EDPS, etc.) : décisions, sanctions, lignes directrices et tendances réglementaires en matière de RGPD et de privacy.",{"lang":38,"name":65,"description":66},"Actualidad","Todos los artículos relativos a las autoridades de protección de datos",{"lang":41,"name":68,"description":69},"Nachrichten","Alle Artikel mit Bezug zu Datenschutzbehörden",[],"https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-original.jpg",[73,74,75,76,77,78,79],"https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-1000.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-1500.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-800.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-600.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-300.webp","https://static.dastra.eu/content/4d516353-5e52-42e5-baa9-dd46792558c4/dastractu-100.webp",60851,{"total":82,"items":83,"parent":230},8,[84,105,126,147,169,179,197,213],{"id":85,"name":86,"description":87,"url":88,"color":89,"parentId":28,"count":13,"imageUrl":13,"parent":90,"order":82,"translations":95},20,"Inside Dastra","Go behind the scenes at Dastra: company news, culture, events, team highlights, and the people driving our GDPR solution.","dastra-life","#e3cf68",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":91},[92,93,94],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},[96,99,102],{"lang":35,"name":97,"description":98},"Vie de Dastra","Plongez dans les coulisses de Dastra : actualités internes, culture d’entreprise, événements, équipes et engagements. Découvrez qui se cache derrière notre solution RGPD.",{"lang":41,"name":100,"description":101},"Innerhalb von Dastra","Eintauchen in das Unternehmen",{"lang":38,"name":103,"description":104},"Dentro de Dastra","Sumérjase en la empresa",{"id":106,"name":107,"description":108,"url":109,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":111,"order":116,"translations":117},69,"Expertise","Gain insights from our experts on GDPR compliance, data protection, and privacy challenges. In-depth articles, professional analysis, and real-world best practices.","indepth","#000000",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":112},[113,114,115],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},7,[118,120,123],{"lang":35,"name":107,"description":119},"Bénéficiez des conseils de nos experts sur la conformité RGPD, la protection des données et les enjeux privacy. Articles de fond, analyses et retours d’expérience métier.",{"lang":41,"name":121,"description":122},"Fachwissen","Entdecken Sie die Artikel unserer DSGVO-Experten",{"lang":38,"name":124,"description":125},"Experiencia","Descubre los artículos de nuestros expertos en Privacy",{"id":59,"name":127,"description":128,"url":129,"color":130,"parentId":28,"count":13,"imageUrl":13,"parent":131,"order":136,"translations":137},"Use cases","Discover how companies use Dastra to manage their GDPR compliance. Testimonials, use cases, and real-world integrations of our privacy management solution.","case-studies","#b61b9c",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":132},[133,134,135],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},6,[138,141,144],{"lang":35,"name":139,"description":140},"Retours d'expérience","Découvrez comment les entreprises utilisent Dastra pour piloter leur conformité RGPD. Témoignages, cas d’usage et intégrations concrètes de notre solution de privacy management.",{"lang":41,"name":142,"description":143},"Case Studies","Entdecken Sie die Erfahrungsberichte unserer Kunden",{"lang":38,"name":145,"description":146},"Casos prácticos","Descubra los testimonios de nuestros clientes",{"id":148,"name":149,"description":150,"url":151,"color":152,"parentId":28,"count":13,"imageUrl":13,"parent":153,"order":158,"translations":159},10,"Release notes","Keep up with the latest features of Dastra: product updates, new functionalities, and improvements to our GDPR compliance and data management platform.","release","#8c316a",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":154},[155,156,157],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},5,[160,163,166],{"lang":35,"name":161,"description":162},"Notes de version","Restez informé(e) des dernières fonctionnalités de Dastra : mises à jour, évolutions produit et améliorations de notre solution de conformité RGPD et de gestion des données personnelles.",{"lang":41,"name":164,"description":165},"Veröffentlichungen","Alle Versionshinweise und Funktionen von Dastra",{"lang":38,"name":167,"description":168},"Lanzamientos","Todas las notas de la versión e información sobre las funciones de Dastra",{"id":10,"name":50,"description":51,"url":52,"color":53,"parentId":28,"count":13,"imageUrl":13,"parent":170,"order":59,"translations":175},{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":171},[172,173,174],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},[176,177,178],{"lang":35,"name":62,"description":63},{"lang":38,"name":65,"description":66},{"lang":41,"name":68,"description":69},{"id":180,"name":181,"description":182,"url":183,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":184,"order":189,"translations":190},221,"AI Governance","Best practices, regulatory frameworks and real-world insights to manage AI responsibly and in compliance with the AI Act.","ai-governance",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":185},[186,187,188],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},3,[191,194],{"lang":35,"name":192,"description":193},"Gouvernance de l'IA","Bonnes pratiques, cadres réglementaires et retours d'expérience pour piloter l'IA de façon responsable et conforme à l'AI Act.",{"lang":41,"name":195,"description":196},"KI-Governance","Best Practices, regulatorische Rahmenbedingungen und Praxiserfahrungen für einen verantwortungsvollen KI-Einsatz im Einklang mit dem AI Act.",{"id":198,"name":199,"description":200,"url":201,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":202,"order":28,"translations":207},220,"Compliance","Regulatory news, practical guides and analysis to keep your organization compliant with the GDPR and beyond.","compliance",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":203},[204,205,206],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},[208,211],{"lang":35,"name":209,"description":210},"Conformité","Actualités réglementaires, guides pratiques et analyses pour maintenir votre organisation en conformité RGPD et au-delà.",{"lang":41,"name":199,"description":212},"Regulatorische Neuigkeiten, Praxisleitfäden und Analysen, um Ihre Organisation DSGVO-konform und darüber hinaus aufzustellen.",{"id":214,"name":215,"description":216,"url":217,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":218,"order":223,"translations":224},219,"Privacy","Principles, techniques and trends in personal data protection — from privacy by design to data subject rights.","privacy",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":219},[220,221,222],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},1,[225,227],{"lang":35,"name":215,"description":226},"Principes, techniques et tendances autour de la protection des données personnelles — de la privacy by design aux droits des personnes.",{"lang":41,"name":228,"description":229},"Datenschutz","Grundsätze, Methoden und Trends zum Schutz personenbezogener Daten — von Privacy by Design bis zu Betroffenenrechten.",{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":231},[232,233,234],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},[],{"items":237,"total":282,"size":223,"page":223},[238],{"title":239,"nbDownloads":12,"excerpt":13,"lang":14,"url":240,"intro":241,"featured":17,"state":18,"author":242,"authorId":20,"datePublication":243,"dateCreation":244,"dateUpdate":245,"mainCategory":246,"categories":252,"metaDatas":268,"imageUrl":272,"imageThumbUrls":273,"id":281},"Web Scraping and Generative AI: The GDPR Guide","web-scraping-and-generative-ai-the-gdpr-guide","Scraping the web to train AI? What the EDPB’s draft Guidelines 03/2026 change—and how to prepare. Download the guide.",{"id":20,"displayName":21,"avatarUrl":22,"bio":13,"blogUrl":13,"color":13,"userId":20,"creationDate":23},"2026-11-02T13:21:00","2026-11-02T13:21:12.8135789","2026-11-02T13:24:10.7201434",{"id":247,"name":248,"description":13,"url":249,"color":250,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":189,"translations":251},70,"Livre blanc","white-papers","#1795d3",[],[253,258,260,264],{"id":28,"name":29,"description":30,"url":31,"color":32,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":12,"translations":254},[255,256,257],{"lang":35,"name":29,"description":36},{"lang":38,"name":29,"description":39},{"lang":41,"name":29,"description":42},{"id":247,"name":248,"description":13,"url":249,"color":250,"parentId":13,"count":13,"imageUrl":13,"parent":13,"order":189,"translations":259},[],{"id":214,"name":215,"description":216,"url":217,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":13,"order":223,"translations":261},[262,263],{"lang":35,"name":215,"description":226},{"lang":41,"name":228,"description":229},{"id":180,"name":181,"description":182,"url":183,"color":110,"parentId":28,"count":13,"imageUrl":13,"parent":13,"order":189,"translations":265},[266,267],{"lang":35,"name":192,"description":193},{"lang":41,"name":195,"description":196},[269],{"typeMetaDataId":59,"value":270,"id":271},"https://static.dastra.eu/backofficefilescontainer/d45bfef7-75c3-4c19-8404-71c29c2be37f/EN - Guide Web Scraping IA.pdf",118645,"https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-original.png",[274,275,276,277,278,279,280],"https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-1000.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-1500.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-800.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-600.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-300.webp","https://static.dastra.eu/content/54ce59a8-5f71-4aac-941e-02017a9bd47d/visuel-article-1-100.webp",60852,14]