Issue 311

APAC

  • Insurance Regulatory and Development Authority of India released updatedInformation and Cyber Security Guidelines for Regulated Entities.
  • China’s CAC launched campaigns to strengthen personal information protection compliance across key sectors.
  • South Korea’s PIPC fined an auction house KRW 287.2 million for personal data breach and security lapses.
  • Singapore’s Ministry of Digital Development and Information clarified data protection and safety obligations for AI-enabled smart glasses.
  • Vietnam ratified the UN Convention on Cybercrime, becoming first in southeast Asia to do so.

EMEA

  • The European Data Protection Board published its 2025 Annual Report highlighting guidance, enforcement and regulatory cooperation efforts.
  • Germany’s Office of Information Security released updated Cloud Computing Compliance Criteria Catalogue, to strengthen cloud security standards.
  • Personal Data Protection Office of Poland announced adoption of Data Management Act by the Parliament.
  • France’s CNIL outlined priority enforcement areas for 2026, including recruitment, single electoral register and sports federations.
  • Moldova ratified Convention 108+ and engaged in international data protection cooperation discussions.
  • Italy’s Data watchdog imposed EUR 31 million fine on a banking company for unlawful access to customer data.
  • The Central Bank of Netherlands updated reporting process for serious ICT-related incidents under the Digital Operational Resilience Act.
  • Ukraine’s Ministry of Digital Transformation published guidance on safe use of AI assistants and agents.
  • Latvia amended the Law on the Processing of Aircraft Passenger Data, updating data retention and access provisions.

Americas

  • The U.S. Federal Trade Commission published its 2026-2030 Strategic Plan outlining priorities.
  • Kentucky’s data privacy bill to regulate Automatic Content Recognition (ACR) data passed by both houses.
  • Iowa Senate launched inquiry into technology companies over failures in reporting online child exploitation cases.
  • Montana’s AG launched investigation into automobile companies over alleged collection and sale of personal driving data without consent.
  • Electronic Privacy Information Centre filed amicus brief supporting South Carolina’s Age-Appropriate Design Code.
  • The Massachusetts Supreme Judicial Court delivered a ruling concerning a technology company’s social media design and its potential harm to minors.