Your EU digital compliance briefing | Edition #002 | Thursday, January 29, 2026

Every workday, we keep you current on EU digital regulation in 3 minutes.

Top Stories

Data Protection Day 2026: Reset or Refine? — 2 min read

The European Data Protection Supervisor and Council of Europe marked Data Protection Day yesterday with a conference examining GDPR's future. Nearly a decade after GDPR took effect, policymakers are debating whether the regulation needs simplification or strengthening. The event comes as the Commission's Digital Omnibus Package—proposed in November 2025—seeks to streamline digital rules, including codifying CJEU case law on pseudonymization and recognizing AI development as a "legitimate interest" under GDPR. Critics warn that simplification efforts risk diluting core privacy safeguards.

Commission Opens Proceedings to Assist Google on DMA Compliance — 2 min read

The European Commission launched two specification proceedings against Google on Monday under the Digital Markets Act. The first addresses Google's obligation to provide third-party developers with interoperability access to Android features used by its AI services, including Gemini. The second concerns Google's requirement to share anonymized search ranking and click data with competitors—including whether AI chatbot providers can access this data. The Commission will issue preliminary findings within three months and conclude proceedings within six months.

EU Expands DSA Investigation into X Over Grok Deepfakes — 2 min read

The Commission opened a formal DSA investigation into X on Sunday over risks linked to its Grok AI chatbot, specifically the generation of non-consensual sexually explicit images. The probe examines whether X properly assessed and mitigated risks from deploying Grok in the EU, including content that may constitute child sexual abuse material. Executive Vice-President Henna Virkkunen called such deepfakes "a violent, unacceptable form of degradation." The Commission also extended its ongoing investigation into X's recommender systems to include Grok-based recommendations. X faces potential fines of up to 6% of global turnover.

Stat of the Day

29,500

German entities now fall under NIS2 supervision following the BSI portal launch on January 6—up from 4,500 previously. Companies have three months from registration to implement risk management measures and incident reporting procedures. (Source)

Quick Hits

DSA Human Rights Alliance Publishes Enforcement Principles — The Alliance released principles on Monday calling for DSA enforcement to incorporate global perspectives and ensure human rights-based platform governance.

Virkkunen Warns X of "Clear Obligations" — Commissioner Virkkunen stated X has clear DSA obligations following the Grok investigation launch; Malaysia and Indonesia have blocked Grok access entirely.

UK-EU Sign DORA Oversight MoU — UK and EU financial regulators signed an agreement on January 14 to coordinate oversight of critical third-party technology providers under DORA and the UK's operational resilience framework.

Sweden NIS2 Law Now in Force — Sweden's Cybersäkerhetslag (2025:1506) went live on January 15, completing the country's NIS2 transposition.

Compliance Calendar

Dates sourced from official EU publications and regulatory trackers. Verify with legal counsel before relying on deadlines.

Enforcement Tracker

Next edition: Friday, January 30, 2026

Was this useful? Forward to a colleague who needs to stay compliant.

Subscribe | Unsubscribe