High Court - 2026 IEHC 640

The Irish High Court's ruling clarifies that once a data subject or representative body demonstrates that a controller is processing personal data in a way that engages GDPR obligations, the burden shifts to the controller to prove compliance — not the other way around. Microsoft's Xandr real-time bidding platform is alleged to have violated GDPR by sharing personal data with thousands of advertisers without adequate legal basis or transparency. This case highlights that ad-tech ecosystems, which rely on mass automated data sharing, carry significant regulatory exposure that organisations often underestimate. The ruling matters broadly because it makes it operationally harder for controllers to rely on procedural ambiguity as a defence, effectively raising the bar for demonstrable compliance across all data processing activities.