Browse
Institutions
What each regulator, court and standards body has decided, published or enforced — in one place. An article is listed under the institutions that acted in the story.
EU institutions and courts
European Commission
Proposes EU law and enforces the AI Act for general-purpose AI models through its AI Office; drives the Data Act, Data Union Strategy and Digital Omnibus.
Council of the EU
Co-legislator representing the member states; adopts positions and final EU laws.
CJEU
Gives the binding interpretation of the GDPR and other EU law; its judgments set the rules every regulator applies.
EDPB
Brings together EU data protection authorities; issues GDPR guidelines and binding decisions in cross-border cases.
Data protection authorities
CNIL
French data protection authority; prolific on AI guidance, cookies and large fines.
Garante
Italian data protection authority; among the most active on generative AI.
AEPD
Spanish data protection authority; issues the largest number of GDPR fines in the EU.
Dutch AP
Dutch data protection authority and national coordinator for the supervision of algorithms and AI.
German DPAs
The federal and state authorities, coordinated through the Datenschutzkonferenz (DSK).
Datatilsynet
Norwegian data protection authority; landmark ad-tech decisions and an AI regulatory sandbox.
IMY
Swedish Authority for Privacy Protection.
CalPrivacy
Enforces the California Consumer Privacy Act; rules on automated decision-making and data brokers.