From the Desk
Compliance & GRC
Regulatory updates, compliance frameworks, governance, risk management.
20
Stories filed
3
Desks covered
≥ 6/10
Editorial floor
Coverage:RegulatoryComplianceSecurity
§
On the Compliance & GRC Desk
The latest stories filtered for your beat, organised by sub-section.
Compliance4 stories
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted AdsGoogle's updated privacy policy blending AI feature data with ad targeting may conflict with GDPR purpose-limitation and data-minimisation principles, especially where enterprise accounts are used.2d
- 23andMe successor settles with California for $6 million over cybersecurity failingsThe settlement demonstrates that state regulators will pursue successor entities for prior-era security deficiencies, reinforcing that data-protection obligations survive corporate restructuring.6d
- WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy RegulatorsEmbedding hidden instructions that prevent an AI chatbot from directing users to data-protection authorities may violate GDPR's requirement to inform data subjects of their right to lodge complaints — a regulatory red flag for any partner using similar patterns.6d
- Provable Compliance: A Protocol for Runtime Compliance Evidence and Transaction-Specific DecisioningA protocol for transaction-specific runtime compliance evidence could reduce the gap between point-in-time KYC/AML reviews and the continuous compliance posture regulators increasingly expect under DORA and NIS2.19 Oct
Security13 stories
- Microsoft Teams to get AI-powered, context-aware phishing detection3d
- Microsoft: Windows Server 2016 reaches end of support in JanuaryRunning unsupported operating systems directly conflicts with NIS2 and DORA patch-management requirements and will appear as a finding in audits.3d
- Capcom confirms data breach affecting 11.7 million accountsCross-border breach notification obligations under GDPR apply if EU customer data was among the 11.7 million records; this case illustrates enforcement exposure for non-EU headquartered firms.4d
- Dutch National Cyber Security Center is Offline because it uses PHP5d
- Zeabur shutting down after second security breach in two months6d
- When Your Ransomware Negotiator Works for the Other SideThird-party vendor integrity is a core requirement under NIS2 and DORA; a compromised negotiator could taint evidence chains and regulatory reporting.16 Oct
- Fake Arch Linux packages push malware with root privileges15 Oct
- Vulnerability Management Isn't About the Score — It's About How It Applies to You15 Oct
- UK Legal Aid Agency: Hackers stole records dating back to 1978The breach of records dating back to 1978 illustrates the regulatory and liability risks of retaining personal data far beyond any defensible retention period, relevant under GDPR's data-minimisation principle.15 Oct
- Ledger asks sellers across Asia to halt sales after supply-chain attackSupply-chain integrity is a core requirement under NIS2 and DORA; a major hardware vendor halting sales due to tampering validates the regulatory emphasis on vendor due-diligence and chain-of-custody controls.14 Oct
- Spyware manufacturer had access to data harvested by former Polish government, current PM saysPoland's spyware scandal highlights how EU data-protection and fundamental-rights frameworks intersect with surveillance tools — relevant for GDPR and forthcoming spyware regulation.14 Oct
- How to Run a Deepfake Readiness Drill Before a Cloned Voice Calls Your Team14 Oct
- Zero Trust in Practice: Moving Beyond the Buzzword14 Oct
Regulatory3 stories
- UK proposes 14-year prison terms for undersea cable sabotageThe UK's move to modernise sabotage sentencing for critical undersea infrastructure reflects the hybrid-threat environment that NIS2 and DORA also address, and may influence EU legislative thinking.3d
- EU cyber law won’t force fixes for fridge controllers hit in French attackThe CRA's reliance on manufacturer-defined support periods creates a regulatory gap for connected products; compliance teams must understand where the CRA's protections end and organisational risk management must begin.6d
- U.K. Sanctions Cryptomus for RU Money LaunderingSanctions against crypto platforms used for ransomware laundering directly affect compliance obligations: any payment routed through a sanctioned entity exposes the organisation to severe penalties.14 Oct