Staying current
Privacy law and store policy change every few months. This page says which sources to watch, who watches them, and how a change flows into the product. Use it to run the monthly privacy review.
How it works
Sources to watch
All of these are official. Prefer them to blogs and vendor newsletters, which are useful for alerts but not for facts.
| Source | Watch for | How to subscribe |
|---|---|---|
| EDPB news | New guidelines, opinions, consultations | EDPB newsletter or the news page in a feed reader |
| EUR-Lex | Adopted regulations, Commission proposals | A "My EUR-Lex" account lets you save searches and get alerts or RSS |
| European Parliament Legislative Train: Digital package | Progress of the Digital Omnibus | Check monthly |
| Commission digital package FAQ | What the Omnibus proposes | Check when the status changes |
| Court of Justice (CURIA) | Rulings, such as the EU-US Data Privacy Framework appeal C-703/25 P | Case alerts |
| ICO news | UK guidance, Data (Use and Access) Act guidance | ICO e-newsletter |
| MeitY data protection framework | DPDP Rules, amendments, consultations | Check monthly |
| e-Gazette of India | Official notifications (Rules, commencement dates, SDF designations) | Search "Digital Personal Data Protection" monthly |
| Data Protection Board of India | Board orders, reporting channel | No confirmed website as of October 2026: verify |
| Apple Developer news | App Review Guideline changes | RSS feed and the developer account email |
| Apple App Review Guidelines | Section 5 (privacy) and 1.3 (kids) | Read the change list at the top after each update |
| Google Play Developer Policy Center | Data safety, account deletion, families, user data policy | Play Console inbox; policy update emails to the account owner |
How to run it
Owner and cadence
| What | Who | When |
|---|---|---|
| Scan every source above, log anything new | Privacy owner (one named engineer, rotating each quarter) | First working Monday of the month, 1 hour |
| Review the log, decide impact | DPO with the privacy owner | Same week, 30 minutes |
| Check dated facts in this handbook module | Privacy owner | Quarterly |
| Store policy deadlines | Mobile lead | When Apple or Google emails, plus monthly scan |
| Legal-deadline tracker review | DPO | Quarterly, and 6 months before any commencement date |
Put the monthly scan in a shared calendar as a recurring event, with this page linked. A review that depends on someone remembering does not happen.
What to log
One row per change, in the team tracker:
| Field | Example |
|---|---|
| Date seen, source, link | 2026-10-05, e-Gazette, link |
| Summary in one line | "DPDP Rules: commencement window shortened" |
| Status | Proposal, adopted, in force |
| Applies to us? Why? | Yes: Indian users |
| Deadline | Date it takes effect |
| Tickets | Links |
| Decision by | DPO name |
Proposals are not law
Log proposals, but build only against adopted law, unless the DPO decides to get ahead.
As of October 2026, the main open proposal is the EU Digital Omnibus on data (COM(2025) 837, procedure 2025/0360(COD), tabled 19 November 2025). It proposes, among other things: breach reports only for high-risk breaches, within 96 hours, via one EU entry point; moving cookie consent rules into the GDPR with a one-click "refuse all"; honouring browser-level consent signals; a narrower definition of personal data for pseudonymised data; and legitimate interests for AI training with a right to object. It was still in Parliament and Council and not law. Sources: Commission proposal on EUR-Lex, EDPB-EDPS Joint Opinion 2/2026.
The separate AI omnibus is law: Regulation (EU) 2026/1744, in force 27 July 2026, which moved several EU AI Act high-risk dates later. EUR-Lex.
In the UK, the Data (Use and Access) Act 2025 data protection provisions are in force, per the ICO. ICO page.
Legal document versioning
Users and regulators must be able to see what changed. Build the policy as versioned documents, not one editable page:
- Each version is an immutable file named by its effective date,
YYYY-MM-DD. - A lock file stores
version -> sha256; CI fails if a published version changes. Fix a typo by publishing a new version. - Every version has a hand-written change summary first, and an automatic structural diff second.
- The canonical URL (for example
/privacy) never moves; stores and consent records point at it. Versioned URLs (/privacy/v/2026-10-01) are added beside it. - Each version has a
materialflag. Only a material change bumps the consent notice version and re-asks users. A typo fix must never re-prompt everyone. - Consent records store the versioned policy URL, so an audit export is self-contained.
{
"version": "2026-10-01",
"material": true,
"changeSummary": [
"Added a section on AI processing and the provider we use",
"Stated how long deleted accounts stay in backups"
],
"compose": { "core": "privacy-core@2026-09-03" },
"sections": []
}
If one product's policy is a shared core plus a product supplement, check in CI that a supplement that composed the core in its last version still does in the next.
Rules
Every legal or regulatory statement in code comments, docs or this handbook carries an "as of" date and an official link. A fact without a date cannot be re-checked.
A published policy version is never edited in place. Publish a new version with a change summary. Otherwise the archive cannot prove what a user saw when they agreed.
Mistakes we made
- A new version silently lost half the policy. The tool that started a new version copied only a known list of keys, and the list missed the key that pulled in the shared core. The next version of one product's policy had no grievance contact, retention, rights, children, security or contact sections. The lock file did not catch it, because the file was new. Add a CI rule for dropped composition.
- A policy decision stopped at engineering. The team agreed a new minimum age, but the terms were never updated, so the store rating and the terms still said the old age. Every change in this flow ends at the published document, not at the ticket.
- The policy described a retired system. An old site's policy still named a retired analytics pipeline and an old legal entity. Every monthly review includes one policy page checked against the code.
Checklist
- A named privacy owner this quarter.
- Recurring monthly calendar event with this page linked.
- Feeds and newsletters subscribed by a shared mailbox, not one person.
- Change tracker up to date, with deadlines.
- Policy versions immutable, with change summaries and a material flag.
- This module's dated facts re-checked this quarter.