Changes to laws and regulations affecting information security, privacy, AI and resilience.
The European Data Protection Board has adopted a statement on smart glasses, saying transparency for bystanders is the central GDPR challenge and that manufacturers and service providers cannot shift their obligations onto users.
Singapore’s new law brings licensing, resilience duties, and incident reporting for large data centres and cloud providers.
Coupang asks a Seoul court to cancel South Korea’s record ₩624.7 billion privacy penalties over its 2025 data breach.
Amendments to the Connecticut Data Privacy Act, including a ban on selling precise geolocation data, take effect on 1 October 2026.
Ofcom expects online platforms serving UK users to use hash matching, or equally effective measures, to stop illegal intimate images and deepfakes being shared from 30 September 2026.
The Information Commissioner’s Office is replaced by a board-led Information Commission under the Data (Use and Access) Act 2025.
TikTok has withdrawn its appeals against the ICO’s £12.7m children’s privacy fine and an information notice, clearing the way for the ICO’s recommender systems investigation.
The EDPB has adopted Guidelines 04/2026 on administrative fines, replacing the 2017 guidelines, and finalised its DSA–GDPR guidelines.
Ireland’s Data Protection Commission has fined Google €403 million for unlawful, unfair, and opaque processing of location data, and ordered it to comply within six months.
Manufacturers must now report actively exploited vulnerabilities and severe incidents under the EU Cyber Resilience Act.
EU authorities can now issue European Production and Preservation Orders directly to service providers.
Registered California data brokers must now retrieve and act on consumer deletion requests submitted through the state’s DROP platform.