What changes to privacy rules for your business this year?
Short answer: the General Data Protection Regulation itself is not rewritten every year. It is a European regulation that applies directly, and its core is fixed. What can change are the guidelines from supervisory authorities, the interpretation given to certain concepts, and the laws that stand directly alongside it and relate to it. For your business, there is also a second factor that is at least as important: whether your own way of processing data has changed.
Whether something specifically changes for your business cannot be answered in general terms. That depends on which personal data you process, with whom you share it, and in which countries you operate. The question "what changes this year" therefore splits into two parts: what changes in the regulation itself, and what changes in your own situation so that you suddenly fall under something that was not previously applicable.
What is fixed, and what shifts
The legal bases for processing data, the rights of data subjects, and the obligation to keep track of what you process are set out in the regulation itself and do not change from year to year. What does move is the way supervisory authorities view it: guidelines are supplemented, and legislation that stands directly alongside it — think of rules on data transfers, cookies, or new technology — can affect what is expected of you in practice. This is not a change to the GDPR itself, but it does count when considering whether your processing register is still up to date.
In addition, the context in which you work sometimes changes without the law itself changing. A new processor handling your data, a tool that collects user data, or expansion to another EU country: these are all moments when it is worth checking whether your file is still accurate, even if nothing has changed on paper in the regulations.
For whom this makes a difference this year
The impact of changes in guidelines or related legislation is not the same for everyone. It matters especially for businesses that deploy new technology where personal data plays a role, for businesses expanding to other countries within or outside the EU, and for businesses that share data with multiple parties or platforms at the same time. An installation company that only keeps customer data in its own accounting software is in a different situation than a webshop that shares customer data with marketing partners in different countries.
To determine what applies to your own business, the text of the regulation itself and the guidance from the Authority for Data Protection are the starting point. Reglia does not itself provide substantive guidance on this: that is the responsibility of the platform that handles personal data, and the supervisory authority. see which platforms there are and what they cover gives you a first picture of where a question about data processing belongs.
Keeping track without having to search yourself every month
The practical question is not so much what changes, but how you notice it in time without making it a side job. Many businesses check the supervisory authority's website a few times a year, or let information come in by chance through a newsletter. That works until the moment you happen not to be checking.
A summary attached to your company dossier — with your KvK number, the countries where you operate and what you have already documented — makes it easier to see whether an adjustment affects you, rather than having to figure out for yourself whether a general change applies to your situation. Reglia does not build that summary itself in terms of content; it brings together what the personal data platform maintains, so that it does not become scattered across separate logins. How exactly that works and what does and does not happen to your data in the process, you can read on the page on how reglia handles your data.
What this means for your dossier
The most useful thing you can do yourself is not to wait until something "changes", but to periodically check whether your processing register still matches what you actually do. Has a new processor been added? Is there a new country where you deliver? Has data sharing arisen that did not exist a year ago? These are the moments when a change in regulation actually matters for your business, regardless of whether the law itself was amended that month.
Questions that often come up in this context — such as how often you need to check something, or what happens if you overlook something — are answered on the frequently asked questions page. For your company's specific situation, the supervisory authority or a lawyer is the appropriate point of contact; reglia describes where a question belongs, but does not provide its own substantive opinion on it.
Curious about which platforms are available and which platform suits your situation? View the overview of connected platforms and see at a glance where you can turn for personal data, product safety, packaging or accessibility.