International Comparative Legal Guide to: Cybersecurity 2019 - 2nd Edition

The Irish High Court has delivered a landmark judgment in TikTok's appeal against the Data Protection Commission's €530 million fine, establishing that organizations must not only identify appropriate transfer...

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

The European Commission has issued interpretive guidelines on Article 50 of the AI Act, clarifying transparency obligations for emotion recognition systems, biometric categorization, and deepfake content.

This privacy statement outlines how cookies are used on this website and provides users with options to manage their cookie preferences. By accepting all cookies, users consent to analytics and targeting cookies being deployed on their device.

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.

The European Data Protection Board's 2025 Annual Report reveals significant developments in EU data protection enforcement and regulatory cooperation. With approximately €1.15 billion...

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.

On 19 November 2025, the European Commission published its draft Digital Omnibus Regulations (EU Regulations 2025/0360 and 2025/0359).

On 17 December 2024, the European Data Protection Board ("EDPB"), following a first of its kind request from the Data Protection Commission ("DPC") under Article 64(2) of the GDPR...

On 24 July 2026, China's Ministry of Finance and State Taxation Administration jointly issued the Announcement on Individual Income Tax Matters Relating to Offshore Trusts (《财政部 税务总局关于离岸信托个人所 得税有关事项的公告》) (Announcement No. 21 of 2026) (the "Notice"), together with a companion Announcement of the State Taxation Administration on Collection and Administration Matters Relating to Individual Income Tax on Offshore Trusts...

CIMA’s new AML / CFT / CPF Compliance Rule and Sanctions Rule, effective 18 September 2026, introduce binding compliance, governance, risk management and sanctions screening requirements for all regulated financial service providers in the Cayman Islands.

An overview of the Cayman Islands fund finance market, highlighting H1 2026 trends, data and outlook, including transaction activity, subscription line and NAV facility developments, financing terms, pricing trends and market expectations for the second half of 2026.

Most often, businesses gravitate towards the LTD model due to its familiarity and simplicity. However, DACs and Irish Collective Asset Management Vehicles...

The Cyber Resilience Act (Regulation (EU) 2024/2847)1 (“CRA”) establishes horizontal cybersecurity requirements for products with digital elements (“PDEs”) placed on the European Union (“EU”) market. Reporting obligations took effect on 11 September 2026, with full application of the CRA from 11 December 2027.

Two years on from the entry into force of Directive (EU) 2024/927, commonly referred to as AIFMD II, the 16 April 2026 transposition deadline has passed, and the state of play across the EU is best described as uneven, with compliance posture increasingly dependent on where an AIFM is authorised. However, Luxembourg, which hosts the largest shares of EU AIFs within the Union, transposed the Directive without material gold-plating.

An overview of the European fund finance market, highlighting H1 2026 trends, data and outlook, including transaction volumes, jurisdictional preferences and emerging financing trends. This forms part of the August 2026 Edition of FUNDed

On 17 June 2026, the Department for International Tax Cooperation (“DITC”), on behalf of the Tax Information Authority (the “TIA”)...

The BVI’s April 2026 update to its CRS Guidance Notes advances the implementation of CRS 2.0, expanding the scope of reportable accounts and introducing new compliance and reporting obligations ahead of the first reporting deadline on 31 May 2027.