Issue 301

APAC

  • Indian government amended the IT Rules to require social platforms to take down AI-generated deepfake content within 3 hours.
  • The FICCI-EY Risk Survey 2026 identified cybersecurity breaches as the top risk facing Indian businesses.
  • South Korean data watchdog imposed a fine of KRW 707.8 million on the National Research Foundation for inadequate safety measures.
  • Japan’s Personal Information Protection Commission updated its Business Guide to support compliance under the data protection framework.
  • China’s Technical Committee 260 released first batch of National Cybersecurity Standard Requirements for this year.
  • Office of Australian Information Commissioner published a statement on Administrative Review Tribunal’s decision on a retail company’s use of facial recognition.

EMEA

  • EU Commission invited feedback on draft guidelines on the calculation of reasonable compensation under the Data Act.
  • UK’s Information Commissioner Office announced investigation into an AI system for generating non-consensual inappropriate images.
  • France’s CNIL fined a public employment platform EUR 5 million for failing to secure job seekers’ data.
  • Germany’s Financial Supervisory Authority issued guidance on ICT risks in AI use at financial entities.
  • Italian data protection authority imposed a fine of EUR 40,000 on an optical manufacturing company for accessing and retaining former employees’ emails after their departure.
  • European Commission created a Signatory Taskforce for General-Purpose AI Code of Practice.
  • Denmark’s Data Protection Authority responded to an inquiry on data processing agreement terms on personal data transfer to third countries.
  • Sweden’s Privacy Authority imposed a fine of SEK 6 million on a software company following personal data leak from a cyberattack. 
  • The Dutch Data Protection Authority outlined its vision on generative AI governance.
  • Latvia’s Data Inspectorate released a guidance on transparency and content requirements for cookie policy.
  • Turkish Data Protection Authority announced data breach involving a food manufacturing company.

Americas

  • A New York bill on additional protections for sensitive health information passed by Senate.
  • Information and Privacy Commissioner of Ontario issued guidance on AI scribes to safeguard patient data.
  • A coalition of U.S. Attorneys General criticised the Department of Justice’s attempt to obtain sensitive data from Minnesota authorities.
  • An Oregon bill establishing Commission on Artificial Intelligence was prefiled in House.
  • A bill to create a Telephone Solicitation Act was introduced in the Michigan’s House of Representatives.
  • A California bill on consumer privacy requests dealing with deletion request records and request submission methods was introduced in the Senate.
  • Quebec’s Access to Information Commission released explanatory guide and checklist on preventing privacy breaches.
  • Hawaii’s Drop and Delete Act to regulate data brokers, enable personal data deletion and establish enforcement mechanisms introduced to House of Representatives.