The EU’s Cyber Resilience Act (“CRA”) imposes end-to-end, product-level cybersecurity standards, risk management, and oversight obligations on those involved in the manufacture and supply of products with digital elements. It…
From 19 June 2026, businesses in the UK are subject to new statutory data protection complaints handling requirements, intended to give individuals a clearer route for raising data protection complaints…
Debevoise & Plimpton LLP announced the launch of STAAR 2.0, an enhanced version of its award-winning[1] client-facing AI platform designed to help in-house legal and compliance teams evaluate, govern, and…
This summer, the UK enacted the long-anticipated Data (Use and Access) Act 2025 (“DUAA”), the first major amendments to the UK’s data protection legislation since Brexit. The changes include substantial…
Given that AI models require large swathes of data to operate, the GDPR’s expansive definition of personal data means that many applications of AI involve complex data protection issues –…
Our top-five European data protection developments from February are: European Commission publishes guidelines on prohibited AI practices: The EU Commission has published non-binding guidance on the EU AI Act’s prohibited…
Our top-eleven European data protection developments for the end of 2024 are: EU Cyber Resilience Act: The Council of the European Union approved the Cyber Resilience Act, introducing cybersecurity requirements…
As we approach the end of the year, here are the Top 10 Cybersecurity posts on the Debevoise Data Blog in 2024 by page views. If you are not already…
Our top five European data protection developments from May are: UK guidance on ransom payments: The UK NCSC and various insurance industry bodies co-published guidance on key considerations for ransomware…
Key takeaways from April include: UK FCA’s AI regulation: UK FCA-regulated firms should take note of the FCA’s newly confirmed approach to AI regulation that seeks to be outcome-focused, principle-led,…