US Coast Guard maritime cybersecurity rule takes effect
16 Jul 2025
New US Coast Guard rules require US-flagged vessels and regulated facilities to appoint cybersecurity officers and report cyber incidents.
Americas
Insights for North, Central, and South America, and the Caribbean.
New York’s Child Data Protection Act takes effect
20 Jun 2025
New York’s Child Data Protection Act now limits how online services collect and process the personal data of users under 18.
US TAKE IT DOWN Act signed into law
19 May 2025
The US has criminalised publishing non-consensual intimate imagery, including AI deepfakes, and given platforms one year to set up removal processes.
US DOJ Data Security Program comes into force
8 Apr 2025
New US rules restricting access to bulk sensitive personal data by countries of concern take effect, with further obligations from October 2025.
Peru’s new data protection regulation comes into force
30 Mar 2025
Peru’s new data protection regulation takes effect, adding DPO duties and 48-hour breach notification.
Mexico’s new private sector data protection law comes into force
21 Mar 2025
Mexico’s new LFPDPPP comes into force, replacing the 2010 law and transferring regulatory functions.
US Cyber Trust Mark launched
7 Jan 2025
The US launches the Cyber Trust Mark, a voluntary FCC security label for consumer IoT products.
Bermuda’s PIPA comes fully into force
1 Jan 2025
Bermuda’s Personal Information Protection Act 2016 is now fully in force.
US Cybersecurity Maturity Model Certification program rule takes effect
16 Dec 2024
The CMMC Program rule is now in effect, establishing the certification framework for US Department of Defense contractors handling controlled information.
Chile’s new personal data protection law is published
13 Dec 2024
Chile publishes Law 21.719, a GDPR-style data protection law that takes effect in December 2026.
FDA finalises guidance on Part 11 in clinical investigations
2 Oct 2024
The FDA has finalised guidance explaining how its electronic records and signatures rules apply to clinical investigations, including cloud services.
FBI CJIS multi-factor authentication requirement becomes auditable
1 Oct 2024
Organisations accessing US criminal justice information must now use multi-factor authentication, as the CJIS Security Policy requirement becomes auditable.