Mexico’s new private sector data protection law comes into force
21 Mar 2025
Mexico’s new LFPDPPP comes into force, replacing the 2010 law and transferring regulatory functions.
Insights for North, Central, and South America, and the Caribbean.
Mexico’s new LFPDPPP comes into force, replacing the 2010 law and transferring regulatory functions.
The US launches the Cyber Trust Mark, a voluntary FCC security label for consumer IoT products.
Bermuda’s Personal Information Protection Act 2016 is now fully in force.
The CMMC Program rule is now in effect, establishing the certification framework for US Department of Defense contractors handling controlled information.
Chile publishes Law 21.719, a GDPR-style data protection law that takes effect in December 2026.
The Wall Street Journal reports that the Salt Typhoon group had penetrated major US telecoms firms, including systems used for court-authorised wiretaps.
The FDA has finalised guidance explaining how its electronic records and signatures rules apply to clinical investigations, including cloud services.
Organisations accessing US criminal justice information must now use multi-factor authentication, as the CJIS Security Policy requirement becomes auditable.
Switzerland adds certified US organisations to its list of adequate countries, allowing transfers under the Swiss–US Data Privacy Framework.
Illinois has amended its biometric privacy law so that repeated collection of the same biometric data counts as a single violation.
The US has prohibited Kaspersky from selling antivirus and cybersecurity products in the US, with software updates banned from 29 September 2024.
Attackers use stolen passwords to access Snowflake cloud accounts at Ticketmaster, AT&T, Santander, and others, stealing data on many millions of people.