Blog

The CNIL is overhauling its reference methodologies MR-001 and MR-003, which govern health data research. This is a paradigm shift: moving from administrative compliance to verifiable operational security on the ground. For healthcare, biotech, and insurance stakeholders, this means mandatory automated data purges, multi-factor authentication to be deployed before January 1, 2027, then 2028, restructured frameworks with two binding appendices, and European alignment. The changes apply immediately to new research, with a one-year transition period for ongoing processing.

In mid-May 2026, automated attacks against GitHub, PyPI, RubyGems, and software vendor Instructure revealed a systemic flaw: an organization's security no longer depends on its perimeter, but on the integrity of its entire software supply chain. For CISOs, CIOs, and DPOs, contractual validation of suppliers has become obsolete. NIS 2 and DORA now mandate absolute technical traceability (continuous component inventories, dependency control, Zero Trust applied to development), which also serves to document Article 32 of the GDPR.

GDPR, DORA, NIS 2, AI Act: Faced with the accumulation of European regulations, many organizations prioritize one project at the expense of others. This is a strategic mistake. These texts actually share a common denominator: risk management. By meeting the requirements of one, you lay the groundwork for the others. Here's how to build unified governance, reduce redundancies, and turn multi-regulatory compliance into a performance driver rather than a source of exhaustion.

Since spring 2026, CNIL has officially classified a user's inbox as a "terminal": any tracking pixel embedded in an email now requires prior and informed consent. This decision, based on Article 82 of the French Data Protection Act and the GDPR, compels companies to thoroughly review their collection of behavioral data. Pixel regulation, predictive AI, digital sovereignty, transactional emails: here's what this regulatory shift concretely changes for your organization — and the actions to take before the end of the grace period in summer 2026.

May 2026 compliance news confirms a shift towards an active defense posture. On the agenda: the CNIL's annual report and the update of its health reference methodologies (deadline May 23, 2026), a wave of attacks targeting the software supply chain (GitHub, PyPI, RubyGems, Instructure/Canvas), the operational alignment between NIS 2, DORA, and Article 32 of the GDPR, and an international CNIL initiative for the protection of minors' data. A look at the concrete impacts for DPOs, CIOs, and CISOs.

Adequacy 6.3 introduces three major advancements: a Project module to manage Privacy by Design, an AI governance module to track and secure decisions related to AI use cases, and a media library restructured by folders and collections. This version also enhances the public register, the Incidents and Breach module, and overall ergonomics.

The AI Act doesn't replace GDPR: it amplifies it. For the DPO, the challenge isn't to change roles, but to adapt their network of referents to a more complex reality. Shadow AI detection, skill hybridization, shared management tools, strengthened legitimacy with business units: here's how to transform this human network into a true strategic asset for compliance.

As of 2026, CNIL is officially the supervisory authority for the AI Act in France. This decision repositions the DPO at the heart of AI governance: a strategic point of contact on executive committees, guarantor of the dual GDPR and AI Act framework, but often without additional resources. Caught between increased visibility and an overloaded scope, here's how DPOs can organize themselves, protect themselves legally, and gain influence without burning out.

The GDPR protects natural persons. But what happens to the data of those who are not yet — or are no longer — considered such? From prenatal genomic sequencing linked to the mother's medical record to medical data that continues to circulate after death, digital law reveals its blind spots. Recent leaks from UNSS and Cegedim Santé have highlighted the urgency of these issues. This is an overview of a grey area where ethics and GDPR compliance clash.

Connected health promises unprecedented prevention — but at what cost? By translating our bodies into data, connected devices and health algorithms raise fundamental ethical questions: truly free consent, the reduction of the individual to their biological constants, the risk of social division, and algorithmic bias. This article explores the tension between technological promise and respect for human dignity, at a time when the GDPR and the AI Act are redefining the rules of the game.

The €40 million fine imposed on Criteo by the CNIL — confirmed by the Conseil d'État — sent a clear signal to the entire AdTech ecosystem: the grey areas are over. Pseudonymous data, consent responsibility, the right to be forgotten, Retail Media… this article breaks down what concretely changes for startups and scaleups operating in digital advertising, and the priority projects to undertake immediately.

Since the CJEU ruling of September 4, 2025, data can change its legal nature depending on the means actually available to re-identify it. This so-called "relative" approach redefines the boundary between anonymization and pseudonymization — with direct implications for GDPR compliance strategies, the health, research, and AI Act sectors. An overview of the technical, legal, and ethical challenges, and the precautions to take within a still-evolving legislative framework.

April 2026 marks a busy month for compliance: the EDPB launches a coordinated action on processing transparency and adopts a harmonized DPIA model, the CNIL publishes its 2026 audit priorities and a final recommendation on tracking pixels in emails, Google deploys end-to-end encryption on Gmail under certain conditions, and the CJEU clarifies the limits of abusive access requests. Here are the key takeaways.

Faced with the omnipresence of screens and AI, current regulations often simply treat symptoms rather than causes. For data professionals, the challenge goes beyond simple compliance with the GDPR: it is a question of restoring real attentional and decision-making sovereignty. This summary analyzes why systemic governance is essential to protect human balances and collective performance.

Understanding what cookies mean is essential to protect your online privacy in 2026. A cookie is a digital memory placed by a site on your browser to remember your preferences or track your behavior. While they offer convenience (basket, language), they also ask the question of whether to accept cookies in the face of the risks of profiling. This guide gives you a clear cookie def and the method to clear Chrome cookies in one click.

The entry into force of the AI Act defines the new framework for European innovation, reconciling technology and the protection of fundamental rights. For DPOs and CISOs, this regulation imposes increased vigilance on the “red lines” of Article 5, such as cognitive manipulation or social scoring. The success of your compliance now depends on integrated governance, linking the requirements of the AI Act to the rigor of the GDPR to ensure a sovereign and secure growth trajectory.

The e-health sector is going through a major crisis with the massive intrusion suffered by Cegedim Santé, jeopardizing the personal data of nearly 15 million French patients. While medical records have become the priority target of cybercriminals on the dark web, this flaw highlights the fragility of digital medical infrastructures. This analysis deciphers the mechanisms of the attack, the risks of the supply chain (supply chain risk) and the concrete protection measures to be deployed to restore trust between practitioners and patients.

The month of March 2026 marks a turning point in digital governance with the forced convergence between cybersecurity, data protection and the regulation of artificial intelligence. Between the historic condemnation of Meta, the adoption of the Resilience Law transposing NIS 2 and DORA, and the official designation of the CNIL as the supervisory authority for the IA Act, compliance officers must now unify their processes. This summary analyzes systemic threats and regulatory changes to transform your obligations into performance drivers.

Compliance with the GDPR and the AI Act is a major challenge for healthcare and clinical research stakeholders. In this discussion, Eve Lepicard and Sophie Malabous from the Artic association explain how using Adequacy compliance software enables them to structure their record of processing activities agilely. Thanks to an intuitive interface and the support of Calixte Descamps, they transform regulatory constraints into tangible operational deliverables.

The integration of AI in health imposes new compliance challenges related to the GDPR and the AI Act. While the ergonomics of the tools facilitate care, it should not lead to medical disempowerment. For DPOs and CISOs, the challenge is to guarantee effective human surveillance and data sovereignty in the face of legal and technical risks. Learn how to secure your AI deployments while respecting medical confidentiality.

The use of artificial intelligence systems (AIS) in health imposes on professionals a triple obligation to provide information: the Public Health Code (CSP) for care, the GDPR for personal data, and the IA Act for the transparency of systems. To ensure their compliance, institutions must adopt graded (general, specific and comprehensive) and pedagogical communication. The objective is to guarantee transparency, to respect the right to explanation and to maintain patient-practitioner trust throughout the care journey.

L'entrée en vigueur de l'IA Act ne doit pas être vue comme une contrainte supplémentaire mais comme une extension naturelle du RGPD, particulièrement dans le secteur de la santé où les systèmes sont souvent classés à haut risque. La réussite de cette double mise en conformité repose sur l’AIPD, pivot central permettant d'intégrer la transparence et la supervision humaine. Grâce à Adequacy, cette interopérabilité réglementaire devient un levier d'innovation éthique et de gain de temps opérationnel.

The news at the beginning of 2026 is marked by two major data breaches: the theft of 1.5 million photos of UNSS students and the intrusion at Cegedim Santé affecting 15 million patients. Faced with this “long-lasting” hemorrhage of data (health, identity of minors), RGPD compliance must evolve from simple administrative management to an active resilience system. For professionals, this means strict control of third party risks, the adoption of strong authentication (MFA) and a rigorous data purge policy.

Discover the questions asked during our webinar “How to frame the reuse of health data?”. Led by Calixte Descamps (Adequacy) and Valentine Chauveau (Aumans Avocats), it provides concrete answers on legality, health data warehouses (EDS) and the AI Act to ensure your GDPR compliance. The replay and the PPT support are available to deepen these issues.

The massive leak of 1.5 million photos of students from UNSS (National Union of School Sport) on BreachForums marks a turning point in educational cybersecurity. This digital vulnerability, exposing minors from middle school to high school, highlights the critical risk of dormant data. For data protection professionals, this incident requires an urgent review of retention policies, the minimization of collections, and the automation of purges in order to ensure real and protective GDPR compliance.