Privacy · Data Law · Enforcement Intelligence
What the FTC's new health-data rule means for your analytics stack
Most DPOs complete their Article 30 register before a certification audit and never open it again. Here is why that approach now carries material enforcement risk under the EDPB's revised inspection methodology.
"The Article 30 register is not an administrative artefact. It is the map the supervisory authority will use to trace every data flow you have ever operated."
EDPB Inspection Methodology, January 2026
Three enforcement actions every DPO should have read last quarter
If your product touches health-adjacent data — fitness metrics, symptom logs, prescription lookups — the amended HBNR applies to you even if you are not a HIPAA covered entity.
A step-by-step breakdown for founders and counsel who have never processed a California consumer rights request — covering verification, scope decisions, and the one response error that draws automatic CPPA scrutiny.
Curated enforcement actions across GDPR, UK GDPR, CCPA, and APAC frameworks. Updated within 48 hours of publication.
Full enforcement database →Meta Platforms Ireland Ltd.
Unlawful basis for behavioural advertising; consent not freely given
Clearview AI Inc.
Unlawful processing of biometric data; failure to respond to SARs
Unnamed B2B Analytics Provider
Inadequate data processing agreement; Article 28 non-compliance
Mobilewalla Inc.
Sale of precise location data without adequate consent
DoorDash Inc.
Sharing personal information with a data cooperative without disclosure
Keppel Offshore & Marine
Inadequate protection of employee personal data; phishing-enabled breach
€2.1B
GDPR fines issued in 2025
847
Enforcement actions tracked
31
Supervisory authorities covered
48h
Average time to publication
Whether you are managing a DSAR for the first time or rebuilding consent flows before a CNIL audit, the right checklist starts here.
Consent flows, vendor DPAs, and breach response playbooks for SaaS legal teams.
Article 30 templates, DPIA frameworks, and supervisory authority correspondence guides.
First DSAR, first audit, first breach — plain-English protocols for each.
Maintain an Article 30 record of processing activities (RoPA)
Appoint a Data Protection Officer if processing at scale or special categories
Publish a CCPA-compliant "Do Not Sell or Share My Personal Information" link
Respond to verified DSARs within 45 days (extendable once)
Execute a Data Processing Agreement with every sub-processor
Complete a Transfer Impact Assessment for SCCs post-Schrems II
Document your lawful basis for each processing purpose in the RoPA
Notify the supervisory authority of qualifying breaches within 72 hours
+ 34 additional items in the full PDF — covering GDPR, CCPA, UK GDPR, and APAC frameworks
42 items across GDPR, CCPA/CPRA, UK GDPR, and APAC. Formatted for legal review and board reporting.
Redact began as a private reading list — enforcement decisions, supervisory authority opinions, and regulatory guidance that practitioners needed to find, parse, and apply before their counterparts did. The list grew. The annotations grew longer. It became a journal.
Every article is written by someone who has filed the paperwork, argued the interpretation, or sat across the table from a data subject exercising their rights. We do not paraphrase press releases. We read the decisions, trace the reasoning, and tell you what it means for the consent flow you pushed to production last Tuesday.
The editorial standard is simple: if a senior in-house counsel would not cite it in a board memo, it does not appear here.
— The Redact Editorial Board
Miriam Okonkwo
Former ICO Case Officer · LLM (Privacy Law, UCL)
GDPR enforcement, supervisory authority procedure
Thomas Adeyemi
Privacy Counsel, SaaS Practice · CIPP/E · CIPP/US
FTC enforcement, US State privacy law, ad-tech compliance
Priya Rajan
In-House Counsel, B2B SaaS · CIPM
CCPA/CPRA, consent management, vendor contracts
Cited in