We attended CPDP2026
Here are our key takeaways.
10 years after GDPR, the debates are more complex than ever. AI is reshaping everything.
1. Personal data? Definition. Codification. SRB case law.
The definition of personal data is still debated after 10 years of GDPR. We need regulators to go beyond principles and give concrete answers: in this specific context, with this specific use case: is this data personal? Yes or no. Clarity saves everyone time and money.
2. EU law fragmentation. Enough is enough
One law. 27 interpretations. That's not harmonization, that's fragmentation. And fragmentation kills legal certainty, slows down businesses, and undermines trust in the entire framework.
3. Simplification ≠ deregulation
The Digital Omnibus wants to streamline rules and that's welcome. But simplification must clarify, not compromise.
4. EU tech sovereignty: still more rhetoric than reality
The debate on EU tech sovereignty is too often framed around big players. But the real beneficiaries would be the thousands of European SMEs currently dependent on foreign infrastructure with all the legal, security and competitive risks that come with it.
However, the EU currently seems to lack hardware infrastructure to guarantee real technological sovereignty on privacy and AI anonymization. Back on the agenda in June.
5. AI regulatory sandboxes: promising if done right
Spain has launched its own.
Here's how they built it:
They didn't just read the AI Act. They went deep into it and translated it into concrete, operational guidelines purpose-built for the sandbox.
A team of 40 multidisciplinary experts was assembled : legal, technical & ethical backgrounds. When doubts arose on AI Act implementation, that diversity was invaluable.
All relevant national authorities: privacy, AI, market surveillance were involved from day one. Silos were broken early. That was a deliberate and necessary choice.
The lesson: regulatory sandboxes only work when theory meets practice and when all the right people are in the room.
7. A New Digital Fairness Act is coming
A new EU law to update consumer protection rules for the digital era is expected within months. Systemic risk from mass profiling is entering the conversation even if GDPR doesn't name it yet.
Ready to dive deeper? Our team of lawyers would love to help you find the right balance between staying innovative and staying compliant. Don't hesitate to get in touch.