Changes to laws and regulations affecting information security, privacy, AI and resilience.
The Bill returns to the Commons after third reading in the Lords on 2 November, carrying report-stage amendments and new powers to address agentic AI risks.
Peers defeated the government twice, adding a 12-month review of the NIS scheme and a register of hostile state cyber actors to the Bill ahead of third reading.
A UK government White Paper proposes replacing the Submarine Telegraph Act 1885 with new offences of up to 14 years for damaging subsea cables, plus security duties for operators.
The Privacy Commissioner of Canada has launched a Children’s Privacy Code setting expectations on consent, profiling, deceptive design, and privacy-protective defaults for under-18s.
The European Data Protection Board has adopted a statement on smart glasses, saying transparency for bystanders is the central GDPR challenge and that manufacturers and service providers cannot shift their obligations onto users.
Singapore’s new law brings licensing, resilience duties, and incident reporting for large data centres and cloud providers.
Coupang asks a Seoul court to cancel South Korea’s record ₩624.7 billion privacy penalties over its 2025 data breach.
Amendments to the Connecticut Data Privacy Act, including a ban on selling precise geolocation data, take effect on 1 October 2026.
Ofcom expects online platforms serving UK users to use hash matching, or equally effective measures, to stop illegal intimate images and deepfakes being shared from 30 September 2026.
The Information Commissioner’s Office is replaced by a board-led Information Commission under the Data (Use and Access) Act 2025.
TikTok has withdrawn its appeals against the ICO’s £12.7m children’s privacy fine and an information notice, clearing the way for the ICO’s recommender systems investigation.
The EDPB has adopted Guidelines 04/2026 on administrative fines, replacing the 2017 guidelines, and finalised its DSA–GDPR guidelines.