The primary-source pack every GDPR practitioner must bookmark

Every claim in this course is anchored to a primary source. When a claim you rely on turns out to be wrong (a Guideline is superseded, an adequacy decision is added, a fine is set aside on appeal — as happened with Amazon in March 2026), you need to be able to re-verify from the primary source in ten minutes. Bookmark these six, and add the seventh for the DPDP side. This is your working library.

1. eur-lex.europa.eu

The official EU legal database. Every Regulation, Directive, Implementing Decision, and Delegated Act is here in every EU official language with CELEX numbers. For GDPR: CELEX 32016R0679. Bookmark the direct GDPR consolidated view: https://eur-lex.europa.eu/eli/reg/2016/679/oj.

2. edpb.europa.eu

The European Data Protection Board publishes Guidelines, Opinions, and Coordinated Enforcement Announcements. Every Guideline has a version number and adoption date. Never quote a Guideline without pulling the current version from the EDPB documents register. Bookmark: https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en.

3. curia.europa.eu

The Court of Justice of the European Union case-law database. Every judgment has a case number (C-311/18 for Schrems II, C-252/21 for Meta v Bundeskartellamt, C-604/22 for IAB Europe). The database includes Advocate General opinions, orders, and pending-case dockets. When you cite a CJEU judgment, cite the case number and paragraph. Bookmark: https://curia.europa.eu.

4. ec.europa.eu adequacy decisions page

The Commission maintains the adequacy list. Any new adequacy decision, renewal, or withdrawal appears here first. As of September 2026 the list includes Brazil (mutual, 26 January 2026, Implementing Decision 2026/179), UK (renewed 19 December 2025, sunset 27 December 2031), plus Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, Uruguay, European Patent Organisation, and the US Data Privacy Framework [L5-C1]. India is not on the list and no formal adequacy dialogue has been announced by MeitY or the Commission as of September 2026. Practitioner reading: for the medium term, India-bound transfers from the Union will continue to run on Article 46 mechanisms (Standard Contractual Clauses plus Transfer Impact Assessment) rather than adequacy. Bookmark: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. The US Data Privacy Framework specifically remains valid but subject to the Latombe appeal (Case C-703/25 P) pending before the CJEU with no hearing date announced as of mid-2026, and the operational weakening from the January 2025 loss of Privacy and Civil Liberties Oversight Board quorum.

5. DPA press releases (your Member-State DPA, plus DPC Ireland and CNIL France as the most-cited)

Enforcement lives in DPA press releases. DPC Ireland (https://www.dataprotection.ie) is the lead DPA for many US-headquartered platforms under the One-Stop-Shop mechanism and issues the largest fines (Meta EUR 1.2B, TikTok EUR 530M, LinkedIn EUR 310M, WhatsApp EUR 225M). CNIL France (https://www.cnil.fr) is the most active on adtech and cookie-consent. Netherlands AP (https://www.autoriteitpersoonsgegevens.nl) handled the Uber transfer-coverage-gap case. For a running enforcement view, cross-reference with enforcementtracker.com but always cross-check numbers against the issuing DPA\'s primary release.

6. meity.gov.in

The Ministry of Electronics and Information Technology publishes the DPDP Act, DPDP Rules, notifications, and (when they land) the Data Protection Board of India Chairperson appointment and adjudication orders. Bookmark: https://www.meity.gov.in/data-protection-framework.

Search discipline

When you need to check whether a claim is still current, go in this order:

1. Primary source (eur-lex, edpb, curia, ec.europa.eu, DPA site, meity)
2. The primary source\'s latest publication date
3. Any pending amendment or appeal that would change the reading

Never rely on a secondary summary as the sole basis for advice. If the secondary source (a law-firm blog, a training slide deck) says something that matters, follow the link and read the primary.

Reading rhythm for a working practitioner

Set aside 30 minutes every Monday morning to scan the six-plus-one sources. EDPB adopted new guidelines? CJEU handed down a judgment on a pending reference? Your Member-State DPA issued a large fine? Adequacy list changed? MeitY posted a notification? Log any change in a running "framework update" register in your DPO office; brief your privacy and legal team on Wednesday. That 30-minute discipline, sustained, is what separates a practitioner who knows the framework from one who thinks they know the framework.

7. The DPDP Rules 2025 primary text and dpdprules.org

The DPDP Rules 2025 (Gazette G.S.R. 846(E), 13 November 2025) can be pulled from the eGazette portal (https://egazette.gov.in) using the year and number, or the MeitY consolidated PDF at https://www.meity.gov.in/data-protection-framework. A working practitioner also keeps https://dpdprules.org/ as a fast lookup with the 22 rules, effective dates, and cross-references. The staggered commencement — 14 November 2025 immediate for Rules 1, 2, and 17-21; 13 November 2026 for Rule 4 Consent Manager registration; 13 May 2027 for Rules 3, 5-16, 22, 23 — is the timing skeleton every dual-regime plan must respect. The Data Protection Board of India Chairperson appointment was still pending as of September 2026; MeitY had run consultation on the shortlist earlier in the year but had not published the final name in the Gazette. Every dual-regime plan should treat "day one of enforcement" as 13 May 2027 with the Board fully staffed by that date, and prepare accordingly.

Verification workflow when a claim in a memo becomes wrong

You issued a memo six months ago citing an adequacy decision. Today an EDPB press release suggests the position has moved. Here is the checklist:

1. Retrieve the primary source (Implementing Decision on eur-lex or press release on ec.europa.eu).
2. Extract the operative language and effective date.
3. Check whether the change affects any specific pieces of advice you have issued and to which clients or business units.
4. Issue a corrections memo within your internal SLA (we recommend 5 working days for material changes) that identifies the affected memos by reference number and states the corrected position.
5. Update your standing framework-summary documents (privacy policy, ROPA, DPIA templates) if the change reaches into those documents.
6. File the corrections memo in your accountability file so an auditor or DPA can trace when you learnt, when you decided, and when you communicated.

This workflow is what separates a practitioner who "keeps up" from one who "shows work". A supervisor never asks whether you knew; they ask what you did when you knew. The workflow is the answer.

Enforcement trackers and where they help versus mislead

Enforcementtracker.com aggregates DPA fines with fields for date, DPA, fine amount, articles cited, and short reasoning summary. It is a fast index but never a primary source. In one high-profile 2025 case a tracker listed a fine as "final" that had already been suspended by the national administrative court pending appeal, and the practitioner who quoted the tracker in a client memo had to walk it back. Rule: use the tracker to find the case, click through to the DPA's own press release for the language, and check for any judicial-review filings against the decision.

What this course commits to

Every lesson in this course carries citations back to the primary source in the same style you just saw in this lesson: a bracketed reference (like [L5-C1]) that you can click through to the citation register on the course Trust page. When the course is updated, the citation register is refreshed. When a citation becomes wrong (a Guideline is superseded, a case is overturned, a fine is annulled), the citation is marked and the lesson prose is corrected within our stated update-SLA. The most recent full course verification pass was on 20 September 2026 and covered every Guideline, adequacy decision, and CJEU judgment cited across the 35 lessons.