Data protection updates — a practical guide for organisations

The guidance published by the data protection authority during 2025 lands in day-to-day operations under three headings: keeping the data inventory current, the legal basis used for international transfers, and the records to keep for breach notification.

Data inventory. The era of producing an inventory once and shelving it is over. When a new application goes live, which personal data is processed for which purpose is expected to reach the inventory within the same week. The most practical way to make this a process is to add a data protection clause to the change management form.

International transfers. This is the most frequently asked question as cloud services spread. If the notification deadline for standard contractual clauses is missed, the legal basis for the transfer falls away; the contract renewal calendar and the notification calendar need to be kept in the same place.

Breach notification. The 72-hour clock starts when the breach becomes known. The incident response playbook should therefore contain «is this a personal data breach» as a discrete step, with the decision owner written down in advance.

This article is general information and does not replace legal advice. Contact our data protection office for an assessment specific to your organisation.