News & insights

The European Commission has renewed its adequacy decisions for the UK, so personal data can continue to flow freely from the EU.

Germany’s NIS2 Implementation Act takes effect, significantly expanding the number of organisations subject to cyber security duties.

Larger US broker-dealers, investment advisers and funds must now have incident response programmes and notify affected customers within 30 days.

India notifies its Digital Personal Data Protection Rules, starting a phased implementation with most obligations applying from May 2027.

The UK Government has introduced legislation to modernise and expand the NIS Regulations.

Taiwan’s amended Personal Data Protection Act establishes an independent commission and strengthens breach reporting.

The DFARS rule implementing CMMC takes effect, allowing US Department of Defense contracts to require CMMC status as a condition of award.

Egypt issues the Executive Regulations to its Personal Data Protection Law, starting a one-year transition.

Singapore’s amended Cybersecurity Act extends oversight to virtual and third-party-owned Critical Information Infrastructure.