GRC Analyst: 2026-09-22
7 minutes in total
Data Protection Commission (Ireland), 2026-09-21. Read, 4 min.
Ireland’s Data Protection Commission announced its final decision in an own-volition inquiry, opened in February 2020, into Google Ireland’s processing of location data in Web & App Activity, Location History, and Location Accuracy between 25 May 2018 and 4 February 2020, finding GDPR infringements on lawfulness and fairness, accountability, transparency, and retention. It imposed administrative fines totaling €403 million and ordered Google to bring its processing into compliance within six months, with the full decision to follow.
Why it matters for this role: You line controls and evidence up with the frameworks, and a €403 million finding on retention and transparency shows which control gaps regulators are now pricing, worth mapping against your own.
EDPB adopts guidelines on when to impose a GDPR fine and finalizes its DSA-GDPR interplay guidelines
European Data Protection Board, 2026-09-21. Read, 3 min.
At its 21 September plenary the EDPB adopted guidelines on applying the power to impose administrative fines alongside other corrective powers under the GDPR, setting out a five-step methodology that data protection authorities should follow when deciding whether to fine, with 14 practical examples, and opened them to public consultation until 13 November 2026. It also adopted the final version of its guidelines on the interplay between the Digital Services Act and the GDPR, which will be published after linguistic checks.
Why it matters for this role: Your control narratives assume how authorities decide to fine, so the EDPB’s published five-step methodology gives you the criteria to align evidence and corrective-action expectations to.
The quiz for this edition has closed.