London, UK: September 24, 2026 – When GDPR took effect, most registrant details disappeared from public WHOIS, and enforcement teams lost one of their quickest ways to connect an infringing domain to a person. Several years on, the picture is shifting again, but unevenly.
The EU's NIS2 directive requires member states to oblige top-level domain registries and registrars to collect accurate registration data and to give lawful access to those with a legitimate need. National laws are arriving at different speeds; Germany, for example, adopted its implementing law in December 2025. At the same time, operators are moving from the old WHOIS protocol to RDAP, and ICANN's Registration Data Request Service gives rights holders a single place to ask for non-public data.
The result is a patchwork that rewards preparation. Teams that document their legitimate interest, keep clean evidence files and know which registrar will answer which kind of request resolve cases noticeably faster than teams that start from scratch every time.
“Access to registration data is improving on paper, but it is still a process rather than a lookup. The brands that treat it as a workflow are the ones getting results,” says Marcus Whitfield, cybersecurity and digital risk intelligence expert at MarkScout.
MarkScout builds this into its investigation process, combining RDAP lookups, disclosure requests and infrastructure signals such as hosting, DNS and certificate history to link related domains even when registrant fields are redacted.