Resource center
Insights
European data regulation does not stand still. This is where Privello tracks the emerging instruments — new obligations for connected products, cross-border data flows, and internal reporting — while they take shape. Topics live here as working analysis before any earns a dedicated service page, so companies planning market entry can see what is coming and where it will land.
What we are watching
Current insights
The EU Cyber Resilience Act
Regulation (EU) 2024/2847 puts binding cybersecurity duties on products with digital elements sold into the EU, from consumer devices to enterprise software.
ReadCross-Border HR Data Transfers
Moving EU and Swiss employee records to a U.S. parent is a transfer under the GDPR and revFADP, and it needs its own lawful mechanism.
ReadThe EU Whistleblowing Directive
Directive (EU) 2019/1937 requires internal reporting channels at many organisations, and those channels carry real data-protection obligations.
ReadNorway–U.S. Data Transfers
The Data Privacy Framework covers Norway through the EEA — with an incorporation step most compliance files skip, and a regulator that has told companies to keep a fallback ready.
ReadNorway's New Cookie Rules
Since 1 January 2025 the new ekomloven requires GDPR-standard consent in Norway. Banners geo-scoped to "EU only" quietly miss it.
ReadDoes Your GDPR Representative Cover Norway?
Article 27 reaches Norway through the EEA — but many representative arrangements are contracted to the EU only. The gap is visible from the outside.
ReadBegin
Turn a topic into a plan
If one of these developments touches your operation, tell us what you are planning. We will outline the realistic options in a first conversation.