In April 2022, the European Parliament established the “Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware”, known in short as “PEGA”. Its tasks include investigating the development, the (mis)use and regulation of surveillance programmes in relation to the European Union. The committee will present a report in 2023 with their findings and recommendations. Herein, it is expected to include an outline for a legal framework regarding the development, sale and use of surveillance spyware as well as possible consequences for any illegal usage. Since 2021, the updated EU export regulation on dual use items – i.e., goods that may be used for civilian or military applications, explicitly includes cyber-surveillance technology. This regulation has strengthened export transparency and introduced human rights risks as assessment criteria for export licenses. However, the regulations have also been criticised as a missed opportunity to stop exports of surveillance tools to repressive regimes. The EU Regulation 2018/1725 lays down the duties of the European Data Protection Supervisor (EDPS). The EDPS’s tasks are relevant for the protection of personal data from spyware misuse although they are not confined to spyware generated data. For example, in January 2022, the EDPS notified Europol of an order to delete data concerning individuals with no established link to a criminal activity. The EDPS has also argued that the current use of surveillance spyware is not in accordance with EU laws.