Urgente — agir em diasCríticoEDPBsem prazo datado
Failure to respect the rights of individuals: The CNIL fined EXTIA EUR 300 000
Afeta: Recrutamento e Seleção, AdTech, Cloud, E-commerce
Áreas: Public Policy, Government Affairs, Regulatory Affairs, Jurídico, Strategy
ALERTA REGULATÓRIO
Evento:
Failure to respect the rights of individuals: The CNIL fined EXTIA EUR 300 000
Impacto:
CRÍTICO
Afeta:
Recrutamento e Seleção, AdTech, Cloud, E-commerce
Áreas internas:
Public Policy, Government Affairs, Regulatory Affairs, Jurídico, Strategy
O que mudou:
Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure ‘right to be forgotten’) Decision: Administrative fine Key words: Data subject rights Summary of the Decision Origin of the case EXTIA, which specialises in…
Ação recomendada:
Assinar as atualizações do AI Office e do registo oficial antes de cada release relevante.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-eur-300-000_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
Afeta: Recrutamento e Seleção, AdTech, Cloud, E-commerce
Áreas: Public Policy, Government Affairs, Regulatory Affairs, Jurídico, Strategy
ALERTA REGULATÓRIO
Evento:
Failure to respect the rights of individuals: The CNIL fined EXTIA 300 000 EUR
Impacto:
CRÍTICO
Afeta:
Recrutamento e Seleção, AdTech, Cloud, E-commerce
Áreas internas:
Public Policy, Government Affairs, Regulatory Affairs, Jurídico, Strategy
O que mudou:
Background information Date of final decision: 21 July 2026 National case Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 17 (Right to erasure ‘right to be forgotten’) Decision: Administrative fine Key words: Data subject rights Summary of the Decision Origin of the case EXTIA, which specialises in…
Ação recomendada:
Assinar as atualizações do AI Office e do registo oficial antes de cada release relevante.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/failure-to-respect-the-rights-of-individuals-the-cnil-fined-extia-300-000-eur_en
Urgente — agir em diasCríticoParlamento Europeu2026-12-02
Regulamento (UE) 2026/1744 — Digital Omnibus on AI
Afeta: Cloud, Modelos de Fundação (GPAI), Provedores de IA, SaaS
Áreas: AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
ALERTA REGULATÓRIO
Evento:
Regulamento (UE) 2026/1744 — Digital Omnibus on AI
Impacto:
CRÍTICO
Afeta:
Cloud, Modelos de Fundação (GPAI), Provedores de IA, SaaS
Áreas internas:
AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
O que mudou:
Digital Omnibus on AI — altera diretamente o AI Act: reprograma a aplicação das obrigações de alto risco (Anexo III 02/12/2027; Anexo I 02/08/2028), cria novas proibições aplicáveis a 02/12/2026 e reforça a execução pela European AI Office (Art. 102–110 aplicáveis desde 27/07/2026).
Ação recomendada:
Inventariar sistemas de IA por caso de uso, risco e papel regulatório.
Prazo:
Aplicação das proibições — 2026-12-02 (38 dias)
Fonte oficial:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744
Urgente — agir em diasCríticoEDPBsem prazo datado
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
Afeta: AdTech, Cloud, E-commerce, MarTech
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
EDPB harmonises fining methodology and adopts final DSA-GDPR guidelines
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, MarTech
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Brussels, 21 September – During its latest plenary, the EDPB has adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR and the final version of its guidelines on interplay between the Digital Service Act (DSA) and the GDPR . The new EDPB guidelines are a major step in further aligning how Data Protection Authorities…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/edpb-harmonises-fining-methodology-and-adopts-final-dsa-gdpr-guidelines_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Health data breach: the CNIL fined Hôpital Privé de la Loire EUR 500 000
Afeta: Saúde, Cibersegurança, AdTech, Bancos
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Health data breach: the CNIL fined Hôpital Privé de la Loire EUR 500 000
Impacto:
CRÍTICO
Afeta:
Saúde, Cibersegurança, AdTech, Bancos
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 3 September 2026 National case Controller: Hôpital Privé de la Loire Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Decision: Administrative fine Keywords: Cybersecurity, Personal data breaches, Health and research Summary of the Decision Origin of the case In summer…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/health-data-breach-the-cnil-fined-hopital-prive-de-la-loire-eur-500-000_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Health data breach: the CNIL fined Hôpital Privé de la Loire 500 000 EUR
Afeta: Saúde, Cibersegurança, AdTech, Bancos
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Health data breach: the CNIL fined Hôpital Privé de la Loire 500 000 EUR
Impacto:
CRÍTICO
Afeta:
Saúde, Cibersegurança, AdTech, Bancos
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 3 September 2026 National case Controller: Hôpital Privé de la Loire Legal Reference: Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject), Decision: Administrative fine Keywords: Cybersecurity, Personal data breaches, Health and research Summary of the Decision Origin of the case In summer…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/health-data-breach-the-cnil-fined-hopital-prive-de-la-loire-500-000-eur_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Afeta: AdTech, Cloud, E-commerce, MarTech
Áreas: Product, Marketing, Jurídico, Compliance, Data Governance
ALERTA REGULATÓRIO
Evento:
Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, MarTech
Áreas internas:
Product, Marketing, Jurídico, Compliance, Data Governance
O que mudou:
Background information Date of final decision: 2 October 2026 National case Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Fines, Basic principles, Marketing, Online platforms Summary of the Decision Origin of the case The case started in 2020 when the Norwegian…
Ação recomendada:
Revisar transparência, rotulagem e padrões de interface dos produtos com IA.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/norwegian-dpa-fines-xandr-eur-8-600-000-for-unlawful-processing-of-personal-data_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data
Afeta: Saúde, AdTech, Cloud, E-commerce
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data
Impacto:
CRÍTICO
Afeta:
Saúde, AdTech, Cloud, E-commerce
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data
Afeta: Saúde, AdTech, Cloud, E-commerce
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data
Impacto:
CRÍTICO
Afeta:
Saúde, AdTech, Cloud, E-commerce
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 14 May 2026 National case Controller: Emirates Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/italian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-health-data_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing
Afeta: Bancos, AdTech, Cloud, E-commerce
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing
Impacto:
CRÍTICO
Afeta:
Bancos, AdTech, Cloud, E-commerce
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 3 July 2026 National case Controller: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA) Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensu…
Afeta: Cibersegurança, AdTech, Bancos, Cloud
Áreas: Cybersecurity, Risk, Engenharia / ML, Compliance, Data Protection Officer
ALERTA REGULATÓRIO
Evento:
Swedish DPA fines Miljödata i Karlskrona approximately EUR 160 000 for insufficient technical and organisational measures to ensure information security
Impacto:
CRÍTICO
Afeta:
Cibersegurança, AdTech, Bancos, Cloud
Áreas internas:
Cybersecurity, Risk, Engenharia / ML, Compliance, Data Protection Officer
O que mudou:
Background information Date of final decision: 22/09/2026 National case Legal Reference(s): Article 32 (Security of processing) Decision: Administrative fine Key words: Cybersecurity, personal data breaches Summary of the Decision Origin of the case In August 2025, the IT service provider Miljödata was targeted in a cyberattack, during which a malicious actor gained access to a large volume of…
Ação recomendada:
Testar resposta a incidentes e reporte nos prazos aplicáveis.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/swedish-dpa-fines-miljodata-i-karlskrona-approximately-eur-160-000-for-insufficient-technical_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling
Afeta: Fintech, AdTech, Cloud, E-commerce
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling
Impacto:
CRÍTICO
Afeta:
Fintech, AdTech, Cloud, E-commerce
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Cross-border case Controller: Uber B.V Legal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine Key words: Automated decision making, profiling and online tracking, fines Summary of the Decision The Autoriteit…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/dutch-dpa-fines-uber-eur-824-990-000-for-unlawful-automated-decision-making-and-insufficient_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE)
Afeta: Saúde, AdTech, Cloud, E-commerce
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE)
Impacto:
CRÍTICO
Afeta:
Saúde, AdTech, Cloud, E-commerce
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 28 August 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority), Article 34 (Communication of a personal data breach to the data subject) Decision: Administrative fine, Compliance…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/data-protection-commission-announces-final-decision-following-inquiry-into-the-health-service_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements
Afeta: AdTech, Cloud, E-commerce, Marketplaces
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, Marketplaces
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 05/06/2026 National case Controller: Wind Tre S.p.A. Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Italian DPA fines security company EUR 39 000 for violations concerning employees’ data
Afeta: AdTech, Cloud, E-commerce, Marketplaces
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Italian DPA fines security company EUR 39 000 for violations concerning employees’ data
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, Marketplaces
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 6 August 2026 National case Controller: La Patria S.p.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject) and Article 15 (Right to access by the data subject)…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/italian-dpa-fines-security-company-eur-39-000-for-violations-concerning-employees-data_en
Urgente — agir em diasCríticoEDPBsem prazo datado
Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affa…
Afeta: AdTech, Cloud, E-commerce, Marketplaces
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, Marketplaces
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en
Urgente — agir em diasCríticoEDPBsem prazo datado
The Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data
Afeta: AdTech, Cloud, E-commerce, Marketplaces
Áreas: Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
ALERTA REGULATÓRIO
Evento:
The Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data
Impacto:
CRÍTICO
Afeta:
AdTech, Cloud, E-commerce, Marketplaces
Áreas internas:
Data Protection Officer, Privacy, Compliance, Jurídico, Data Governance
O que mudou:
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected…
Ação recomendada:
Atualizar a matriz de risco com o padrão sancionado nesta decisão.
Prazo:
Sem prazo futuro datado na fonte oficial.
Fonte oficial:
https://www.edpb.europa.eu/news/the-irish-data-protection-commission-fines-google-403-000-000-eur-following-inquiry_en
Alta — agir em semanasAltoParlamento Europeu2027-12-02
Regulamento (UE) 2024/1689 — AI Act
Afeta: Modelos de Fundação (GPAI), Cloud, Provedores de IA, SaaS
Áreas: AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
ALERTA REGULATÓRIO
Evento:
Regulamento (UE) 2024/1689 — AI Act
Impacto:
ALTO
Afeta:
Modelos de Fundação (GPAI), Cloud, Provedores de IA, SaaS
Áreas internas:
AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
O que mudou:
AI Act — o ato âncora deste monitor: abordagem baseada em risco, práticas proibidas, sistemas de alto risco, modelos de uso geral (GPAI) e European AI Office.
Ação recomendada:
Inventariar sistemas de IA por caso de uso, risco e papel regulatório.
Prazo:
Obrigações de alto risco — Anexo III — 2027-12-02 (403 dias)
Fonte oficial:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689
Alta — agir em semanasAltoParlamento Europeu2027-12-02
2021/0106(COD)
Afeta: Modelos de Fundação (GPAI), Cloud, Provedores de IA, SaaS
Áreas: AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
ALERTA REGULATÓRIO
Evento:
2021/0106(COD)
Impacto:
ALTO
Afeta:
Modelos de Fundação (GPAI), Cloud, Provedores de IA, SaaS
Áreas internas:
AI Governance, Regulatory Affairs, Jurídico, Compliance, Product
O que mudou:
Primeiro quadro jurídico vinculante do mundo para a inteligência artificial: abordagem baseada em risco, práticas proibidas, obrigações para sistemas de alto risco e para modelos de uso geral (GPAI), European AI Office.
Ação recomendada:
Inventariar sistemas de IA por caso de uso, risco e papel regulatório.
Prazo:
Obrigações de alto risco — Anexo III — 2027-12-02 (403 dias)
Fonte oficial:
https://data.europarl.europa.eu/api/v2/procedures/2021-0106?format=application/ld%2Bjson