Welcome to the autumn edition of Data Bytes. If September felt busy, that's because it was: new regulators, new reporting regimes and a few large fines have kept the data protection and cyber security world well occupied.
Our spotlight this issue is on the EU Cyber Resilience Act. Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware of them. This applies to products already on the market and to manufacturers based outside the EU. Mark Hendry, our UK head of cyber risk explains how the new notification regime works, shares a few points that have caught some clients by surprise, and cover what the Commission's July guidance says about scope, security updates and support periods. We also look at how product class determines your conformity pathway, with no CRA notified bodies or harmonised standards in place yet.
Closer to home, the ICO has said goodbye to its old self. Since 30 September 2026 it has been the Information Commission, although the familiar ICO branding is staying. It has also kept busy, consulting on draft guidance on anonymisation and pseudonymisation for research, archiving and statistical purposes under the DUAA. The consultation closes on 19 October, so there's still time to have your say.
Over in the EU, the Commission has proposed an EU Kids Act. It would introduce age-based limits on children's access to social media, chatbots and app stores, and make platforms prove their services are safe for children. The Irish DPC has fined Google €403 million over its processing of location data, a clear reminder that transparency and retention matter. The EDPB has adopted its final guidelines on how the DSA and GDPR interact, and is consulting until 13 November on new guidelines about when to impose fines alongside other corrective powers.
As always, we've gathered the developments you need to know, pulled out the practical takeaways, and flagged the dates worth adding to your diary. So grab a warm drink and get your data bytes here.
Spotlight on the EU Cyber Resilience Act
The Cyber Resilience Act ("CRA") sets mandatory cybersecurity requirements for hardware and software products (products with digital elements or "PWDE") across their full lifecycle. Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents affecting PWDE within 24 hours after becoming aware. If your products are made available on the EU market, including from overseas, these CRA obligations are live today and need to be considered.
In this spotlight article we will start with the reporting obligations, which apply now, before summarising the clarifications brought by the Commission's July guidance.
The CRA applies in stages
- 11-Sep-26 | Notifications for actively exploited vulnerabilities and severe incidents (Article 14)
- 11 June – 11 December 2026 | Member States to appoint notified bodies authorised to carry out third-party assessments over product conformity (Important and Critical Products)
- 11-Dec-27 | Full application, including essential requirements, declaration of conformity and CE marking
Notification regime now live
For in-scope PWDE, companies must now send an "early warning" notification within 24 hours of becoming aware of an actively exploited vulnerability or severe incident affecting their product(s). This must be followed by a full notification within 72 hours and a final report 14 days after a fix is available for an actively exploited vulnerability, or one month after the 72-hour notification for a severe incident.
Notifications must be made via ENISA's Single Reporting Platform and will be received simultaneously by ENISA and the CSIRT designated as your coordinator. The designated CSIRT may share it with CSIRTs in other affected Member States. This avoids the separate national filings required under GDPR and NIS2, however it does introduce some complexity and the need to harmonise internal procedures for vulnerability and incident triage and handling for organisations in scope of multiple regimes.
Two points that have surprised some clients:
- Products already on the market are in scope. The CRA allows for "grandfathering" of PWDE placed on the market before the CRA applies fully, however extant products still fall into the vulnerability and incident reporting regime of the CRA from 11 September 2026.
- Know your coordinator. ENISA's Single Reporting Platform requires selection of a Member State CSIRT. The correct coordinator is the CSIRT in the Member State of your main establishment where cybersecurity decisions for the PWDE are taken. For some large clients the applicable main establishment may differ across their product portfolio and this needs to be considered in their CRA protocols.
The EC's July 2026 guidance clarifies points of CRA coverage.
The Commission published its guidance on 27 July 2026, it isn't binding but market surveillance authorities will use it, so it should be used to inform preparedness activities.
- Where software "runs" affects scope. Apps and browser extensions that run on a user's device are in scope. Remote-only software, such as some SaaS, is not in scope on that basis alone, but is caught where an in-scope product depends on it to function.
- Security updates are generally not substantial modifications. The test is whether a change alters the product's cybersecurity risk in a way your risk assessment hadn't already considered. The guidance's examples centre on new or changed components and features, not fixes.
- Five years is the default (not the minimum) support period. You should match the support period to how long the PWDE is expected to be in use.
As noted previously, many organisations will be in scope of multiple regimes including GDPR, NIS2, the CRA and the Data Act, sometimes simultaneously. For example some of our clients are Regulated FinTechs that offer the same product as installed software and as SaaS to different clients (where the software places them in scope of CRA and SaaS places them in scope of NIS2).
Equally, the UK has the UK Product Security and Telecommunications Infrastructure Act 2022 which is directionally similar to the CRA but not entirely harmonious and this must be considered by manufacturers supplying products in both markets.
Product class determines the conformity pathway
The CRA sorts PWDE into classes. A PWDE's class depends on its core functionality i.e. the features the product needs to do its job.
- Default products (most products: any PWDE without the core functionality of an important or critical category): you can self-assess using the internal control procedure (Module A, Annex VIII).
- Important Class I (Annex III), such as operating systems, browsers, password managers and VPNs: you can self-assess only if you fully apply a harmonised standard, common specification or European cybersecurity certification scheme at assurance level "substantial" or higher. Otherwise, a notified body must assess the product. No CRA harmonised standard had been cited at the time of writing, preventing most Class I manufacturers from self-assessing.
- Important Class II (Annex III), such as hypervisors and firewalls: a notified body must assess the product.
- Critical (Annex IV), such as smart meter gateways and smartcards: this class attracts the strictest treatment. A notified body must assess the product unless the Commission makes European cybersecurity certification mandatory for that category.
CRA notified bodies for third-party assessments will be listed on the NANDO register. At the time of writing it listed no CRA notified bodies.
Manufacturers outside the EU are in scope
The CRA applies to PWDE made available on the EU market, wherever the manufacturer is based. Importers must check that the manufacturer has met its obligations, and distributors carry their own duties. Breaching the essential requirements or the manufacturer obligations, including notification regime under article 14, carries fines of up to €15 million or 2.5% of global annual turnover, whichever is higher.
What should you do now?
Reporting is the first real test of CRA readiness. We are actively helping clients to manage those obligations and prepare for others, including:
- Legal exposure and scope analysis: Confirming which products are in or out of scope and what actions on your product development roadmap will bring older products into scope, advising on product class and conformity pathway, and how the CRA interacts with NIS2, GDPR and the Data Act.
- Risk assessment and gap analysis: Mapping product risks against the Annex I essential requirements, testing organisational readiness, and developing prioritised remediation plans.
- Incident reporting readiness: Confirming coordinating CSIRTs, developing harmonised incident triage and handling protocols, and testing through simulations.
- Conformity assessment and documentation: Preparing technical documentation, supporting clients' self-assessments, and engaging candidate notified bodies where needed.
- Board readiness: Briefing boards on CRA accountability, directors' duties and governance reporting.
UK: Key Updates
New ICO consultation on draft anonymisation, pseudonymisation and research guidance
On 24 August 2026, the Information Commission (new name but still keeping its familiar branding as the ICO) launched a consultation seeking views on its draft guidance on the application of anonymisation and pseudonymisation techniques for research, archiving and statistical purposes - the consultation closes on 19 October 2026. The draft guidance forms part of the ICO’s broader initiative to update and publish new guidance connected to legislative changes introduced by the Data (Use and Access) Act 2025 (DUAA).
The DUAA introduced safeguards for processing of personal data for the purposes of research, archiving and statistical purposes – referred to as the “RAS purposes”. If an organisation intends to process personal data for RAS purposes, it must:
- firstly, consider whether it can use anonymous information to fulfil the RAS purposes; or
- if personal data is needed, document the reasoning and have appropriate safeguards in place including: (i) pseudonymising the data where possible using an appropriate technique and controls that limit access; or (ii) applying technical and organisational measures to adhere to the data minimisation principle such as removing any personal data that is not needed to achieve the RAS purpose, encrypting data and using synthetic data, trusted research environments or trusted third parties.
The draft guidance seeks to offer practical assistance to organisations who are undertaking RAS purposes addressing areas such as:
- providing a decision tree to guide organisations on whether to anonymise or pseudonymise data – consolidating existing ICO guidance;
- addressing the data protection designation of different organisations involved – which can often be complex depending on the processing activities, objectives and specific research being carried out;
- can pseudonymised data be shared for RAS purposes;
- how personal data embedded in speech data can be minimised e.g. consideration of using a transcript to avoid identification from accent, pitch and cadence of voice;
- how personal data embedded in images and videos can be minimised e.g. by pixelating images;
- benefits of and measures to consider when using trusted research environments, federated approaches and trusted third parties; and
- when it may be appropriate to use synthetic data and how the identifiability risk should be assessed when using it.
This guidance is a must read for any organisations that take an interest in, drive or rely on research – (likely applying to a wide range of sectors such as tech, education, healthcare). It provides an insight into how the DUAA can be practically applied and the ICO’s expectations of how data minimisation can be adhered.
Any organisations using personal data for RAS purposes should use the draft guidance to assess whether their current practices meet ICO expectations, in particular considering whether anonymised data would still fulfil RAS purposes or if not, whether the appropriate safeguards have been implemented. Early engagement with the guidance offers an opportunity to shape your organisation's approach to RAS in compliance with the ICO’s expectations.
UK: In case you Missed it
- ICO to become Information Commission, but still known as ICO: On 10 September 2026, the UK Government confirmed that, as of 30 September 2026, the Information Commissioner’s Office will formally be replaced by and the functions transferred to the new Information Commission; although the Information Commission’s Office will still be known as the ICO. The Information Commission will be a body corporate with non-executive and executive members. The recruitment process for a permanent Chair remains ongoing. See more details here.
- ICO updates consent guidance following RTM v Bonne Terre: The ICO has updated its consent guidance to reflect the Court of Appeal’s decision from April 2026 in RTM v Bonne Terre and Anor [2026] EWCA Civ 488. The guidance now includes a new section “can we rely on consent from people in vulnerable situations” which: (i) clarifies data protection law does not oblige controllers to ascertain an individual’s state of mind – i.e. it is not determinative of consent; (ii) cautions that even where an objective indication of consent exists, reliance on that consent may not satisfy the fairness requirement if the controller has knowledge of, or ought reasonably to know of, a vulnerability. See more details here.
- Lessons arising from the Revolut data breach: In September 2026, the bank Revolut disclosed that an unauthorised third party had gained access to its customer records by sending fabricated requests from an unauthorised email account using a legitimate government agency’s domain. In fulfilling the request, data sent by Revolut included names, copies of identity documents, facial verification images and financial records. The incident highlights: (i) that authenticated emails should not, of itself, satisfy verification/due diligence criteria; and (ii) the risk of breaches/security incidents occurring where threat actors can successfully impersonate organisations that are legally entitled to make such requests. Organisations who routinely receive such requests such as financial service companies should implement robust procedures for verification.
- ICO investigation into Police Scotland’s handling of subject access requests: On 11 September 2026, the ICO confirmed that it was investigating Police Scotland’s handling of subject access requests (SARs). Whilst, at this stage, there is very little information about what specifically prompted the investigation, the ICO has disclosed that it will be establishing whether Police Scotland failed to respond within the statutory timescales. This announcement is a reminder that continuous delays to respond to SARs remain an area of regulatory scrutiny. See more details here.
- TikTok appeal withdrawn and £12.7 million fine to be paid – Following our update in our last Data Bytes (Data Bytes 68 - see UK in case you missed article 2), TikTok has now withdrawn its appeal and will pay the ICO fine of £12.7 million for mishandling children's personal data.
- Reform plans to scrap the UK GDPR: Reform UK has signalled its intention to repeal the existing UK data protection framework and replace it with what it describes as a “light-touch” approach – mimicking New Zealand's regulatory model. This is reminiscent of the calls for the Data Protection and Digital Information Bill to set a less burdensome approach post Brexit and raise familiar questions about whether they would remove important safeguards and whether such a departure from EU data protection standards could jeopardise the UK’s EU adequacy decision.
EU: Key Updates
1. New proposed EU Kids Act regulating minors’ access to social media
On 16 September 2026, European Commission President Ursula von der Leyen announced a proposed EU Kids Act in her State of the Union address. The Commission formally published the legislative proposal the following day, marking a significant step towards the regulation of minors’ access to social media.
The proposed legislation adopts a graduated, age-differentiated approach to restricting the use of social media, video sharing platforms, access to general conversational chatbots and app stores by children and young people:
- children under the age of 13 would be prohibited from accessing social media and the other relevant services and systems entirely – thereby harmonising the European digital age limit for social media. However, there is an exception for providers of video sharing platform services that can demonstrate that they are an age-appropriate service so that parents can enable access to children under 13 years old by means of accounts that are created and supervised by parents themselves;
- between the ages of 13 and 15, individuals would not be permitted to have their own personal account but could use a “mini account” set up by parents. Mini accounts would be set up with limited functionalities and supervised by a parent or guardian, would have restricted features (e.g. parents are enabled to pre-approve potential new contacts) and a daily hour restriction. Ultimately limiting the use of autonomous accounts to under 15-year-olds across the European Union would seek to harmonise local rules and create the same level of protection for children;
- individuals aged 15 to 18 could create their own accounts without parental consent/oversight but social media platforms would be required to incorporate mandatory safe-design features for such accounts (such as time-limited access and interruption of usage) which would be designed in a way to protect school time and core sleep hours; and
- imposes specific obligations on age assurance.
Crucially, the proposal intends to reverse the burden of proof which means that social media platforms would bear the obligation of demonstrating that their services are safe for children. A separate Digital Fairness Act, expected later in the autumn, will address and dovetail with the broader issue of addictive design practices across digital platforms.
President von der Leyen characterised the initiative as follows: “It is not about our minors accessing social media. It is about when and how do we allow social media to access minors.” This is an interesting shift of perspective given the current wave across Europe to ban social media for children under certain ages.
The proposed EU Kids Act is a pivotal moment in EU digital regulation and is indicative of the Commission's focus on child safety. Organisations operating digital platforms including online social networking services but also video sharing platforms, online games, AI general chatbots and companions, app stores and operating systems should begin assessing the potential implications of the proposed Act now as privacy by design will be an integral part of complying with the age assurance, parental controls and safe-design obligations.
2. Irish DPC fines Google €403 million for processing of location data
On 21 September 2026, the Irish Data Protection Commission (DPC) announced a €403 million fine against Google Ireland Limited in respect of its processing of users’ location data and ordered Google to rectify its non-compliant behaviour within 6 months. The decision follows an inquiry by the DPC as lead supervisory authority which was prompted by complaints submitted by several European consumer rights organisations, including the European Consumer Organisation.
The DPC's inquiry was focused on Google’s processing of location data over a period of nearly 2 years in three of its features:
- “Web & App Activity” - this is an account setting available to individuals that have a Google Account and when enabled, was used by Google to process browsing history, search history and location data when on Google sites and apps;
- “Location History” - this is a service which, when users opt-in, uses data to infer location information. It makes use of a timeline feature to track where the user has travelled/visited on a private map and this map is saved by Location History, even when the user is not using a Google service; and
- “Location Accuracy” - this is a feature available on Android OS that allows the device to determine location with greater accuracy than relying on GPS inputs in the device.
Google was found to have infringed the GDPR as follows:
- the lawfulness and fairness obligations in relation to its processing of location data;
- its accountability obligations, specifically its failure to demonstrate compliance with the principles of lawfulness, fairness and transparency in relation to Location Accuracy;
- its transparency obligations across all three features which meant that Google users may not have been aware/had a reasonable expectation that their location data was being used for purposes such as provision of ads or to infer their interests; and
- its obligations regarding the retention of location data in Web & App Activity and Location History – the DPC found that Google retained location data for longer than was necessary and this was deemed an aggravating factor in respect of user’s loss of control.
If your organisation processes location data, make sure every purpose is clearly disclosed and has a valid lawful basis; in particular, transparency over any secondary uses such as advertising or inferring users' interests should be provided in privacy notices because users are unlikely to expect such uses. The DPC's fine shows that unclear transparency and keeping location data too long will be treated as serious failures because, by its nature, location data (whilst not a category of special category data) can reveal private and sensitive information about an individual.
EU: In case you Missed it
- EDPB adopts final DSA-GDPR guidelines: On 21 September 2026, the EDPB adopted the final guidelines on the interplay between the Digital Services Act (DSA) and the GDPR. This is a final form following earlier consultations. See more details here.
- EDPB adopts fining methodology: On 21 September 2026, the EDPB also adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR – these are open for consultation until 13 November 2026. The guidelines are intended to: (i) complement the guidelines on the calculation of administrative fines; and (ii) harmonise fining methodology across European data protection authorities by establishing a five-step methodology to assist in determining whether to impose a fine, either on its own or alongside other corrective measures such as reprimands, orders or warnings. Practical examples are also provided to help decide which corrective measures should be imposed, if any. See more details here.
Authors: Rhiannon Webster, Partner; Mark Hendry, Partner, Risk Advisory; Alexandre Brazeau, Partner; Alexander Duisberg, Partner; Arnav Joshi, Partner; Nicolas Quoy, Partner; Shehana Cameron-Perera, Senior Associate; Tom Brookes, Senior Associate; Stacy Young, Associate and Davide Borelli, Counsel.
