Analista de GRC: 2026-09-22

1. Data Protection Commission fines Google €403 million following inquiry into its processing of location data

   Data Protection Commission (Ireland), 2026-09-21. Leer, 4 min.

   Ireland’s Data Protection Commission announced its final decision in an own-volition inquiry, opened in February 2020, into Google Ireland’s processing of location data in Web & App Activity, Location History, and Location Accuracy between 25 May 2018 and 4 February 2020, finding GDPR infringements on lawfulness and fairness, accountability, transparency, and retention. It imposed administrative fines totaling €403 million and ordered Google to bring its processing into compliance within six months, with the full decision to follow.

   Por qué importa para este rol: You line controls and evidence up with the frameworks, and a €403 million finding on retention and transparency shows which control gaps regulators are now pricing, worth mapping against your own.

2. EDPB adopts guidelines on when to impose a GDPR fine and finalizes its DSA-GDPR interplay guidelines

   European Data Protection Board, 2026-09-21. Leer, 3 min.

   At its 21 September plenary the EDPB adopted guidelines on applying the power to impose administrative fines alongside other corrective powers under the GDPR, setting out a five-step methodology that data protection authorities should follow when deciding whether to fine, with 14 practical examples, and opened them to public consultation until 13 November 2026. It also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR, which will be published after linguistic checks.

   Por qué importa para este rol: Your control narratives assume how authorities decide to fine, so the EDPB’s published five-step methodology gives you the criteria to align evidence and corrective-action expectations to.

Analista de GRC