The main aim of this course is to provide a general overview of the legal issues relating to cybersecurity and data security. Given the global dimension of data flows and their economic and strategic value, the legal framework will be considered at different levels, namely international, EU and national. The first part of the course focuses on data regulation as the legal protection provided to personal and non-personal data is at the root of cybersecurity laws that aim to safeguard these intangible assets. Moreover, some key data protection regulations, such as the GDPR, already include specific data security and cybersecurity requirements. In line with the transnational dimension of cybersecurity, attention will also be paid to international conventions and frameworks (Convention 108 and 108+ of the Council of Europe, OECD Guidelines). Specific environments, such as IoT and cloud computing, will be considered when dealing with data and cybersecurity issues. Finally, the recent development of AI regulation in Europe and the risk-based approach adopted by legislators will be discussed concerning the requirements that increase data and system security. Particular emphasis will be placed on the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), the first comprehensive legal framework on AI worldwide. The course will examine its risk-based structure (prohibited practices, high-risk AI systems and transparency obligations), the rules for general-purpose AI models and the requirements most relevant from a security perspective, namely risk management, data governance and the accuracy, robustness and cybersecurity of high-risk AI systems, including resilience against AI-specific attacks such as data poisoning, model poisoning and adversarial examples. The interplay between the AI Act, the GDPR and EU cybersecurity legislation will also be addressed. The second part of the course aims to provide case studies and practical examples in information security. Special attention will be given to the Cybercrime Convention, GDPR-Data Breach, NIS2, Cybersecurity Act, AI Act, ISO/IEC 27001, and EU bodies (ENISA, CERT, etc.). The Cybercrime Convention, also known as the Council of Europe Convention on Cybercrime, was signed on November 23, 2001. It is the first international convention to address Internet and computer crime by harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. The General Data Protection Regulation (GDPR), the Network and Information Systems Directive (NIS2), and the Cybersecurity Act are essential pieces of legislation aimed at protecting personal data and ensuring the security of information systems. Together, these pieces of legislation play a crucial role in promoting and protecting the security of personal data information in the digital age. The course will also examine the relationship between this legislation and ISO/IEC 27001, the international standard for information security management systems (ISMS). Its importance will be discussed as a tool for translating legal obligations, such as the security measures required by the GDPR and the cybersecurity risk-management measures required by NIS2, into a structured, auditable and certifiable management system, while also considering the value and limits of certification as evidence of compliance. A key focus will be the concept of risk assessment (risk identification, analysis and evaluation, and selection of treatment measures), the cornerstone of both ISO/IEC 27001 and the risk-based approach of the GDPR, NIS2 and the AI Act. Each of the individual pieces of EU legislation mentioned above will be addressed by highlighting the most relevant aspects and focusing on the practical effects in the cybersecurity world. Through case studies, the student will gain detailed knowledge of the fundamental issues that need to be addressed to manage cybersecurity risks.