US TAKE IT DOWN Act signed into law
19 May 2025
The US has criminalised publishing non-consensual intimate imagery, including AI deepfakes, and given platforms one year to set up removal processes.
Changes to laws and regulations affecting information security, privacy, AI and resilience.
The US has criminalised publishing non-consensual intimate imagery, including AI deepfakes, and given platforms one year to set up removal processes.
Japan enacts its Active Cyber Defense Act, requiring critical infrastructure operators to report incidents and share information.
A new UK code sets baseline security expectations for software vendors.
New US rules restricting access to bulk sensitive personal data by countries of concern take effect, with further obligations from October 2025.
The UK Government has published a Cyber Governance Code of Practice setting out what boards and directors should do to govern cyber risk.
Swiss critical infrastructure operators must now report cyber attacks to the National Cyber Security Centre within 24 hours.
UK financial firms must now be able to remain within impact tolerances for their important business services.
Peru’s new data protection regulation takes effect, adding DPO duties and 48-hour breach notification.
Mexico’s new LFPDPPP comes into force, replacing the 2010 law and transferring regulatory functions.
The new UK public procurement regime is live, and Cyber Essentials requirements continue under PPN 014.
Prohibited AI practices are now banned in the EU, and AI literacy obligations apply.
A new voluntary code sets baseline security principles across the AI lifecycle.