Blog - Ailance

The EU Commission has presented the "General-Purpose AI Code of Practice", a voluntary code of conduct for GPAI.

General-Purpose AI Code of Practice: EU Unveils New AI Code of Practice

05.08.2025

As of February 2, 2025, the first bans on unacceptable AI practices and AI competency requirements have become mandatory. Since August 2, 2025, specific GPAI („General-Purpose AI“) rules have been in effect under the AI Regulation. The European Commission has presented the „General-Purpose AI Code of Practice“ in this regard. We provide an overview of this code of practice and explain the benefits it offers.

Read the full article »

Data leak at McDonald's: Security researchers managed to gain access to McDonald's HR platform McHire using the password "123456".

McDonald’s Data Breach: How a „123456“ Password Put Millions of Applicants’ Data at Risk

04.08.2025

Security researchers were able to gain access to the fast-food chain McDonald’s„ HR platform, McHire, using the password “123456.” This allowed access to up to 64 million records. What companies should look out for—and how Ailance helps prevent such risks.

Read the full article »

The European supervisory authorities EBA, ESMA and EIOPA have published a DORA guideline on the supervision of critical third-party providers.

DORA Guidelines on the Supervision of Critical Third-Party Providers (CTPP)

16.07.2025

The Digital Operational Resilience Act (DORA) has been in effect since January. In July, the European supervisory authorities EBA, ESMA, and EIOPA issued guidance on the supervision of critical third-party ICT service providers. A particular focus: critical third-party providers of information and communication technologies (CTPPs).

Read the full article »

The data protection supervisory authorities want to harmonize the reporting obligations under NIS-2 and the GDPR.

NIS 2 Directive: Data Protection Authorities Seek to Standardize Reporting Channels for IT Security Incidents and Data Breaches

15.07.2025

The current draft bill for the NIS-2 Implementation Act has been met with significant criticism from data protection supervisory authorities. The focus is on the inadequate duty to inform IT security authorities and the lack of interaction between the reporting obligations under the NIS 2 Directive and those of the GDPR. What the data protection authorities are now demanding.

Read the full article »

The addressees of the Data Act are broadly defined.

Addressees of the EU Data Act: Who is affected and what obligations apply?

11.07.2025

The EU Data Act (EU Regulation 2023/2854) will be directly applicable in all EU member states as of September 12, 2025. We explain which entities are specifically covered by the Data Act and what new obligations apply, particularly to manufacturers and service providers.

Read the full article »

Perform threshold value analysis in 5 steps

What is a GDPR threshold analysis and when is it mandatory?

09.07.2025

When should a threshold analysis be conducted, how does it work, and how can one reliably determine whether a „presumed high risk“ exists? This article provides practical answers to these and other questions and demonstrates how threshold analyses can be integrated into data protection management in an effective and legally compliant manner.

Read the full article »

Designing efficient risk management with AI and automation.

How to Identify Risks Early: Integrated Risk Management with AI and Automation

08.07.2025

If you don't recognize risks until the damage has already been done, you lose time, money, and trust. Early-warning systems are crucial; technologies such as Artificial Intelligence Automation is revolutionizing the approach to integrated risk management. Discover the benefits your company can expect and how Ailance – Integrated Risk Management can support you in this process.

Read the full article »

The processing directory must be created if personal data is processed.

GDPR Data Processing Inventory: Requirements, Structure, and Implementation of a Data Processing Inventory Explained Simply

07.07.2025

A Processing directory (VVT) serves to demonstrate compliance with data protection—Compliance and the Transparency. In the following article, we answer the most important questions about the Processing directory.

Read the full article »

The popular video editing app CapCut from ByteDance, which also owns TikTok, updated its terms of use on June 12, 2025.

CapCut Controversy Over New „Terms of Service“: Legal Risks Lurk Here

04.07.2025

CapCut, the popular video editing app from ByteDance—the company that also owns TikTok—updated its terms of service on June 12, 2025. These terms now include a comprehensive transfer of rights, which has led to ongoing criticism from legal experts and the public. We examine the associated legal risks for Responsible persons.

Read the full article »

Ailance™ Blog. Expertise & news on data protection, compliance and risk management

Current insights on GDPR, risk management, compliance & new products from Ailance™

General-Purpose AI Code of Practice: EU Unveils New AI Code of Practice

McDonald’s Data Breach: How a „123456“ Password Put Millions of Applicants’ Data at Risk

DORA Guidelines on the Supervision of Critical Third-Party Providers (CTPP)

NIS 2 Directive: Data Protection Authorities Seek to Standardize Reporting Channels for IT Security Incidents and Data Breaches

Addressees of the EU Data Act: Who is affected and what obligations apply?

What is a GDPR threshold analysis and when is it mandatory?

How to Identify Risks Early: Integrated Risk Management with AI and Automation

GDPR Data Processing Inventory: Requirements, Structure, and Implementation of a Data Processing Inventory Explained Simply

CapCut Controversy Over New „Terms of Service“: Legal Risks Lurk Here