Changes to laws and regulations affecting information security, privacy, AI and resilience.
The Council of Europe opens the Second Additional Protocol to the Budapest Convention for signature, enabling faster cross-border access to electronic evidence.
New York employers that monitor employee phone, email or internet use must now give prior written notice and obtain acknowledgement.
Royal Decree 311/2022 updates Spain’s National Security Framework (ENS) for public sector systems and suppliers.
US banks must now notify their regulator within 36 hours of a significant computer-security incident, and service providers must notify their bank customers.
India’s CERT-In issues directions requiring cyber incidents to be reported within six hours and logs to be kept for 180 days.
Japan’s amended APPI introduces mandatory breach reporting and tighter rules on cross-border transfers.
New UK tools for international transfers of personal data, the IDTA and the UK Addendum to the EU SCCs, come into force.
CIRCIA will require US critical infrastructure entities to report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours.
New mandatory notification requirements apply to acquisitions in 17 sensitive sectors, including data infrastructure, AI and cryptographic authentication.
Singapore’s Healthcare Services Act 2020 begins its phased commencement, modernising licensing and oversight of healthcare providers, including data safeguards.
The UAE’s first federal personal data protection law, Federal Decree-Law 45 of 2021, takes effect.
Cloud services used by Texas state agencies must now hold TX-RAMP certification under Texas law.