🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi

Roundup

Data Protection Monitor — 2026-10-18

Assembled deterministically from our recent research runs and ranked by date and importance.

Previous editions

New or updated since 2026-10-11

New to this edition or changed since the last one.

  1. 1

    US-GAChildren & Vulnerable Groups2026-10-15

    Eleventh Circuit vacated the SB 351 preliminary injunction on 2026-10-15, clearing enforcement to proceed on remand.

    Georgia AG's OfficeT1Confirmed

  2. 2

    IEEnforcement & Redress2026-09-21

    Google EUR 403m fine, HSE/CHI decisions, and Supreme Court LinkedIn appeal permission all within last 60 days.

    Data Protection CommissionT1Confirmed

  3. 3

    DECross-Border & Adequacy2026-07-31

    EU-US DPF under growing legal pressure following Trump v. Slaughter; EDPB letter to Commissioner McGrath; noyb threatens fresh annulment challenge. SCC gap confirmed for Art. 3(2) importers.

    EDPBT1Confirmed

  4. 4

    US-MDLawful Processing & Special Data2026-07-01

    HB711/Ch.874 (effective July 1, 2026) adds immigration-enforcement data-sale ban and expands 'sensitive data' to cover inferred data.

    Maryland General AssemblyT1Confirmed

  5. 5

    US-NJRegulator & Framework2026-06-30

    NJDPA cure period sunset July 1, 2026 and new data-broker law (P.L.2026, c.25) enacted June 30, 2026, with registry filing deferred to spring 2027.

    New Jersey LegislatureT1Confirmed

  6. 6

    COAlgorithmic, Biometric & Surveillance Governance2026-06-18

    SIC finally confirmed (18 June 2026) definitive closure of World Foundation/Tools for Humanity's iris-biometric 'Orb' operation for unauthorised processing of sensitive biometric data.

    Superintendencia de Industria y Comercio (SIC)T1Confirmed

  7. 7

    US-VTRegulator & Framework2026-06-16

    VDPOSA (Act 145/S.71) enacted 16 June 2026, effective 1 January 2028, making Vermont the 23rd/24th US state with a comprehensive privacy law.

    Vermont General AssemblyT1Confirmed

  8. 8

    CORegulator & Framework2026-05-20

    Ley Estatutaria 2573 de 2026 creates identity-validation/anti-identity-theft duties; SIC ran a public consultation (closed 9 Oct 2026) on implementing protocols.

    Funcion Publica (official gazette/normative manager)T1Confirmed

  9. 9

    US-CAEnforcement & Redress2026-05-08

    Record 2026 CCPA enforcement year: GM $12.75M settlement, CPPA data-broker strike force actions, aggregate fines ~$17.1M across five settlements.

    California Attorney General (privacy.ca.gov)T1Confirmed

  10. 10

    CAAlgorithmic, Biometric & Surveillance Governance2026-05-06

    OPC/CAI/BC/AB joint findings against OpenAI (May 6, 2026) and OPC findings against X/Grok (June 11, 2026) both concern AI-related personal-information handling; Canada has no enacted federal AI-specific statute (AIDA died at prorogation Jan 6, 2025).

    Office of the Privacy Commissioner of CanadaT1Confirmed

  11. 11

    COSectoral Watch2026-04-07

    Decreto 0368/2026 makes Open Finance mandatory for SFC-supervised entities with a double-consent mechanism; Ley 2573/2026 imposes credit-bureau identity-theft-victim flagging duties.

    Unidad de Regulacion Financiera (URF), Ministerio de HaciendaT1Confirmed

  12. 12

    US-CAController/Processor Duties2026-01-01

    CPPA risk-assessment regime in force since Jan 1 2026; ADMT-specific obligations commence Jan 1 2027.

    CPPAT1Confirmed

  13. 13

    SCRegulator & Frameworkdate pending

    Disputed commencement status of the Data Protection Act 2023.

    Information Commission of SeychellesT1Confirmed

  14. 14

    SEAlgorithmic, Biometric & Surveillance Governancedate pending

    EDPB issued a statement on smart glasses recording transparency, reported via IMY.

    IntegritetsskyddsmyndighetenT1Confirmed

  15. 15

    GIRegulator & Framework2026-07-15

    Data Protection Regulations 2026 (LN.96/2026) came into force 15 July 2026, re-instating closer EU GDPR alignment.

    Government of GibraltarT1Confirmed

  16. 16

    US-MOEnforcement & Redress2026-10-14

    AG issued CID No. 26-212 to TikTok on 14 October 2026, due 13 November 2026.

    Missouri Attorney GeneralT1Confirmed

  17. 17

    TRController/Processor Duties2026-10-08

    Principle Decision 2026/2035 narrows adequate notice/lawful-basis expectations for employer email monitoring.

    KVKK (official)T1Confirmed

  18. 18

    US-PAEnforcement & Redress2026-07-14

    PA AG announced two multistate data-breach settlements this year (23andMe July 2026, Labcorp Sept 2026); no private right of action yet exists but HB 997 passed the House in Oct 2025.

    Pennsylvania Office of Attorney GeneralT1Confirmed

  19. 19

    US-IDChildren & Vulnerable Groups2026-07-01

    Stop Harms from Addictive Social Media Act (HB542) entered into force 2026-07-01.

    Idaho LegislatureT1Confirmed

  20. 20

    HKAlgorithmic, Biometric & Surveillance Governancedate pending

    PCPD published Agentic-AI guidance supplement (25 Aug 2026); Worldcoin biometric-project investigation found a PDPO contravention.

    Legislative Council of Hong KongT1Confirmed

  21. 21

    US-CTRegulator & Framework2027-01-01

    SB 4/PA 26-64 and SB 1295/PA 25-113 substantially expand the CTDPA's scope and add a data-broker registration regime.

    Connecticut General AssemblyT1Confirmed

  22. 22

    AUAlgorithmic, Biometric & Surveillance Governance2026-10-07

    OAIC opened an investigation into the maker of 'HeyCyan' smart-glasses software on 7 October 2026, part of broader scrutiny of connected/surveillance devices; new APP 1.7-1.9 ADM disclosure duties commence 10 December 2026.

    OAICT1Confirmed

  23. 23

    GRController/Processor Duties2026-07-28

    HDPA fined Ministry/EETAA EUR350,000 combined for Art 25/28/32 violations (decision 28 Jul 2026, published 8 Oct 2026).

    EDPBT1Confirmed

  24. 24

    ROController/Processor Duties2026-03-25

    Art 32 security-of-processing failures continue to dominate ANSPDCP enforcement, including a 2 October 2026 EUR 5,000 fine following a self-notified cyber-attack; the largest 2026 fine (Renault, EUR 125,000, March 2026) also invoked Art 28(1).

    ANSPDCPT1Confirmed

  25. 25

    US-RIRegulator & Framework2026-01-01

    RIDTPPA (R.I. Gen. Laws § 6-48.1 et seq.) in force since 2026-01-01; RI AG sole enforcer.

    Rhode Island General AssemblyT1Confirmed

  26. 26

    CARegulator & Framework2026-06-15

    Bill C-36 (PPCDA) introduced June 15, 2026, first reading; would replace PIPEDA privacy provisions and create a new Digital Safety and Data Protection Commission of Canada.

    Parliament of CanadaT1Probable

  27. 27

    HRAlgorithmic, Biometric & Surveillance Governance2026-10-02

    AZOP's decision establishes applied precedent on biometric data-minimisation necessity testing in a commercial access-control setting, with a EUR 2.59m fine against an unnamed gambling operator affecting 34,933 players.

    Net.hrT2Probable

  28. 28

    CA-QCAlgorithmic, Biometric & Surveillance Governance2026-09-23

    Cour du Quebec confirmed CAI's Clearview AI order on appeal (23 Sept 2026); judicial generative-AI guidelines adopted (4 Sept 2026).

    Blogue SOQUIJT2Probable

  29. 29

    PWController/Processor Duties2026-07-21

    Cybersecurity Act introduces a mandatory breach-notification duty and centralised incident-reporting system, new since mid-2026.

    PINAT2Probable

  30. 30

    PWRegulator & Framework2026-07-21

    Cybersecurity Act (RPPL 12-8) signed 2026-07-21, creating a Bureau of Cybersecurity with a data-protection and breach-notification mandate, materially extending the pre-existing Privacy Act (6 PNCA §§205-206).

    Island TimesT2Probable

  31. 31

    US-OHController/Processor Duties2026-10-15

    Central Ohio Primary Care Physicians disclosed a breach (discovered 2026-08-25, disclosed 2026-10-15) affecting ~1.4M patients/employees, triggering ORC 1349.19 notification duties.

    NBC4 / WCMHT2Probable

  32. 32

    NOEnforcement & Redress2026-10-12

    Datatilsynet imposed its largest-ever fine (NOK 92m) on Xandr on 12 Oct 2026 for unlawful processing/sharing of Grindr users' sensitive data via RTB ad auctions.

    BleepingComputerT2Probable

  33. 33

    US-NMEnforcement & Redress2026-10-06

    October 6, 2026 remedial order requiring Meta to pay $567 million, following the March 2026 jury verdict of $375 million in civil penalties.

    Albuquerque JournalT2Probable

  34. 34

    DKController/Processor Duties2026-10-04

    Two major breach-notification events: CPR register breach and DTU DTUBasen breach, both notified early October 2026.

    Help Net SecurityT2Probable

  35. 35

    CREnforcement & Redress2026-09-16

    Active, unresolved Prodhab investigation into alleged 400M-record dark-web data exposure, opened 16 September 2026.

    La NacionT2Probable

  36. 36

    BREnforcement & Redress2026-08-25

    ANPD's R$153.7M TikTok fine (25 Aug 2026) remains the operative benchmark; a new public hearing on the dosimetry methodology opened 15 Oct 2026, and a separate inspection-process consultation runs 9 Sept-26 Oct 2026.

    ANPD (TikTok decision, via secondary reporting)T2Probable

  37. 37

    LKRegulator & Framework2026-07-22

    22 July 2026 Gazette Order appoints 1 January 2027 as commencement date for Sections 2-3, Part I and Part III of the PDPA.

    Ada DeranaT2Probable

  38. 38

    US-CTSectoral Watch2026-10-01

    New DOB data-security-incident notification duty (PA 26-51), effective Oct 1, 2026, sits alongside the CTDPA.

    Connecticut General AssemblyT1Confirmed

    Also tracked by world-payments:W3

  39. 39

    US-CAAlgorithmic, Biometric & Surveillance Governance2026-04-01

    FEHA employment ADS regulation modification took effect April 1, 2026.

    California Civil Rights DepartmentT1Confirmed

  40. 40

    US-WYData Subject Rights2026-03-06

    New government-sector access right under W.S. 9-21-202(b) for residents to request copies of government-held personal data.

    Wyoming Enterprise Technology ServicesT1Probable

  41. 41

    AUEnforcement & Redress2026-06-15

    OAIC adopts an explicitly 'enforcement-first' 2026 posture: ongoing Optus/Medibank civil-penalty proceedings, new investigations (HeyCyan), and a June 2026 AMEX determination, alongside a degrading complaint-handling timeliness (6-12 month backlog).

    OAICT1Confirmed

  42. 42

    MZEnforcement & Redressdate pending

    Cybersecurity Law and Cybercrime Law entered into force 29 September 2026; data-protection bill remains pending as of that date.

    INTICT1Probable

  43. 43

    ESAlgorithmic, Biometric & Surveillance Governance2026-10-05

    Royal Decree 723/2026 entered into force 5 October 2026, creating a new individual worker-information duty on algorithmic/ADM workplace systems; AEPD issued guidance (7 Oct) and preventive warnings on AI video-surveillance (6 Oct) and AI-enabled cybercrime (28 Sept).

    Kepler NewsletterT3Probable

  44. 44

    ZAEnforcement & Redress2026-08-07

    Security-compromise notifications rose over 40% year-on-year (2024-2025); Regulator seeks a 180-day PAIA self-help disclosure power via the Judicial Matters Amendment Bill.

    ClearComplyT3Probable

  45. 45

    US-CTChildren & Vulnerable Groups2026-07-01

    Protected minors' age range raised from 13-16 to 13-17 with blanket ad-targeting/sale prohibition.

    Epstein Becker Green / Workforce BulletinT3Probable

  46. 46

    US-KSController/Processor Duties2026-07-01

    HB 2591 extends the Financial Institutions Information Security Act covered-entity list to earned-wage-access registrants, effective 1 July 2026.

    Kansas Office of the State Bank CommissionerT1Confirmed

  47. 47

    NZController/Processor Duties2026-05-27

    OPC's MMH/Health NZ Phase 1 inquiry found both breached Rule 5 security safeguards in a 99,416-patient breach; OPC recommended direct processor liability reform and issued compliance notices (reported October 2026).

    Healthcare IT NewsT3Probable

  48. 48

    UKEnforcement & Redress2026-02-05

    DUAA raised the maximum PECR fine from £500,000 to £17.5m/4% global turnover; ICO fined Reddit £14.47m on 24 Feb 2026 for under-13 data processing without lawful basis or DPIA.

    Bratby LawT3Probable

  49. 49

    US-MNEnforcement & Redress2026-01-31

    The mandatory 30-day AG warning-letter cure period under §325M.20(a) expired 2026-01-31; the AG has since received 200+ complaints and sent dozens of warning letters; no private right of action exists.

    Madgett LawT3Probable

  50. 50

    US-NMAlgorithmic, Biometric & Surveillance Governance2026-03-24

    A Santa Fe jury found Meta liable under the Unfair Practices Act for algorithmic recommendation systems directing harmful content to minors (March 24, 2026 verdict).

    KRQE News 13T2Probable

  51. 51

    HUAlgorithmic, Biometric & Surveillance Governance2025-12-01

    AI Act institutional framework now complete and in force; NAIH holds advisory role and AI Council delegate seat.

    LexLintT2Probable

  52. 52

    HUEnforcement & Redress2026-10-18

    NAIH issued multiple 2026 fines (Obuda University, Hungarian University of Agriculture, Mediaworks) and the AI Act enforcement track is a new parallel administrative-fine mechanism.

    CMS LawT3Probable

  53. 53

    IDRegulator & Framework2026-10-17

    GR 33/2026 enacted 16 Jul 2026, in force 16 Jan 2027; PDPA still not established and now subject to constitutional litigation.

    Matthews WongT3Probable

  54. 54

    EGEnforcement & Redress2026-10-07

    PDPC portal launch reported 7 October 2026, moving the regime toward enforcement readiness.

    Baker McKenzieT3Probable

  55. 55

    US-DEController/Processor Duties2026-10-06

    HB 380 adds mandatory third-party due diligence/contracting duties and lowers the DPIA threshold; HB 381 tightens breach notification (already in force).

    Morgan LewisT3Probable

  56. 56

    US-DERegulator & Framework2026-09-02

    HB 380 signed Sept 2, 2026, lowers DPDPA applicability thresholds and adds a third-party-acquirer trigger, effective Jan 1, 2027.

    WilmerHaleT3Probable

  57. 57

    IDEnforcement & Redress2026-09-01

    GR 33/2026 confirms 2% annual-revenue fine ceiling; PDPA still unestablished creating a live enforcement gap; constitutional challenge 236/PUU-XXIV/2026 ongoing.

    Rajah & TannT3Probable

  58. 58

    JPEnforcement & Redress2026-07-17

    Act 56/2026 grants PPC first-ever administrative-surcharge power and relaxes the order-issuance threshold; PPC's 7 Oct 2026 breach alert is an active enforcement-adjacent intervention.

    A&O ShearmanT3Probable

  59. 59

    MXEnforcement & Redress2026-07-12

    SABG imposed a record MXN 42,849,095 fine against the Mexican Football Federation on 2026-07-12 over FAN ID biometric data failures, the first published sanction under the 2025 LFPDPPP.

    Baker McKenzieT3Probable

  60. 60

    US-COAlgorithmic, Biometric & Surveillance Governance2026-05-29

    Revised interim draft ADMT & Chatbot AI Service Rules (4 CCR 904-6) released 6 Oct 2026, changing the 'materially influence'/de minimis threshold approach, ahead of the 26 Oct 2026 hearing; ADMT Act (SB 26-189) and Chatbot Safety Act (HB 26-1263) both take effect 1 Jan 2027.

    Secure PrivacyT3Probable

  61. 61

    ESEnforcement & Redress2026-05-01

    Sustained high-volume enforcement including Amadeus IT Group (EUR 18 million), Vodafone (EUR 750,000), 23andMe (EUR 2.4 million) and smaller fines across Aug-Oct 2026.

    Data Protection ReportT3Probable

  62. 62

    US-IDAlgorithmic, Biometric & Surveillance Governance2026-03-31

    Conversational AI Safety Act (SB1297) enacted 2026-03-31, commencing 2027-07-01.

    Idaho LegislatureT1Confirmed

  63. 63

    BDCross-Border & Adequacy2026-02-05

    Amendment Ordinance 2026 narrowed data-localisation to restricted/CII data only; no adequacy decision found either direction.

    Digital Policy AlertT3Probable

  64. 64

    TWRegulator & Framework2025-11-11

    PDPA 2025 Amendments designate PDPC as competent authority; PDPC itself not yet established, Preparatory Office continues to act; commencement date disputed across sources.

    K&L GatesT3Probable

  65. 65

    CA-NBRegulator & Frameworkdate pending

    Bill C-36 (PPCDA) introduced 2026-06-15, now at second-reading stage; would repeal PIPEDA Part 1.

    Privacy HorizonT3Probable

  66. 66

    US-NYEnforcement & Redressdate pending

    Multistate Labcorp/AMCA breach settlement, led in part by NY AG, secured $89,178 for New York, within approximately 180-day lookback window.

    NY Attorney GeneralT1Confirmed

  67. 67

    CZEnforcement & Redressdate pending

    ÚOOÚ's largest-ever fine (CZK 351m, Avast) remains the standing enforcement high-water mark; a Czech court corrected ÚOOÚ's approach to assessing security measures in a hashing-algorithm case.

    Úřad pro ochranu osobních údajůT1Confirmed

  68. 68

    DELawful Processing & Special Datadate pending

    UWG §7(2) Nr. 2 B2B email consent requirement and CJEU Inteligo Media ruling on free-account sign-up confirmed.

    Bundesministerium der JustizT1Confirmed

  69. 69

    US-LARegulator & Framework2026-06-01

    Louisiana Data Privacy Act (Act 502/SB386), signed 29 May 2026, effective 1 Jan 2027, shifts jurisdiction_status from unregulated_gap to hybrid.

    Davis Wright TremaineT3Probable

  70. 70

    US-OKRegulator & Framework2026-03-20

    OCDPA (SB 546) enacted 2026-03-20, effective 2027-01-01; corrects prior position that Oklahoma has no comprehensive consumer-privacy statute.

    Legal 500T3Probable

  71. 71

    INRegulator & Frameworkdate pending

    DPDP (Removal of Difficulties) Order 2026 corrects ss.9(1)/10(2)(c)(ii); DPBI Chairperson/Member posts remain unfilled as of 14 Oct 2026.

    Scrut.ioT3Probable

  72. 72

    US-CORegulator & Framework2026-10-06

    Revised interim draft ADMT & Chatbot AI Service Rules released 6 Oct 2026, ahead of the 26 Oct 2026 rulemaking hearing.

    Colorado Department of LawT1Probable

  73. 73

    IDCross-Border & Adequacy2026-10-18

    Constitutional Court (Case 137/PUU-XXIII/2025) upheld Art.56 tiered transfer framework and noted PDPA 'has yet to be established'.

    Conflict of Laws .netT3Probable

  74. 74

    US-TXCross-Border & Adequacy2026-10-16

    Oct 16, 2026 Temu settlement over CCP data exposure.

    Texas Attorney GeneralT1Probable

  75. 75

    US-MAController/Processor Duties2026-08-26

    WISP (201 CMR 17.00) and breach-notification (c.93H) duties remain in force; Winn-Dixie filing illustrates the AG-only breach-detail disclosure practice.

    PivIT StrategyT3Probable

  76. 76

    ECCross-Border & Adequacy2026-01-28

    SPDP Resolución SPDP-SPD-2026-0004 (28 Jan 2026) establishes adequacy-based and alternative-safeguard transfer mechanisms, adopting RIPD model clauses.

    Allende & BreaT3Probable

  77. 77

    SACross-Border & Adequacy2026-10-06

    SDAIA's 6 October 2026 consultation draft lists data localisation as its first Key Change; substantive text not yet retrieved.

    Reed SmithT3Probable

  78. 78

    SARegulator & Framework2026-10-06

    SDAIA published draft PDPL Implementing Regulation amendments for consultation on 6 October 2026, closing 5 November 2026.

    Clyde & CoT3Probable

  79. 79

    US-PARegulator & Framework2026-10-06

    HB 78 removed from Senate table Oct 6, 2026, remaining procedurally live; AG Bureau of Consumer Protection remains the sole enforcement authority.

    FastDemocracyT3Probable

  80. 80

    BEAlgorithmic, Biometric & Surveillance Governance2026-09-02

    Belgium confirmed in breach of the EU AI Act Art 70 designation deadline; enforcement gap in effect from 2 August 2026.

    DataPandaT3Probable

  81. 81

    US-UTChildren & Vulnerable Groups2026-09-24

    SB73 VPN/age-verification litigation stayed pending possible 2027 legislative amendment; underlying injunction and age-verification duty unchanged.

    Electronic Frontier FoundationT2Probable

  82. 82

    LTController/Processor Dutiesdate pending

    InMedica fined EUR 450,000 for breach-reporting and data-security failures; H1 2026 report attributes 48% of breaches to human error.

    GRIP (Global Relay)T2Probable

  83. 83

    DEAlgorithmic, Biometric & Surveillance Governance2026-07-29

    KI-MIG entered force 29 July 2026, establishing Bundesnetzagentur AI supervision and a non-public high-risk AI system register.

    BundesnetzagenturT1Probable

  84. 84

    JPController/Processor Duties2026-10-07

    PPC alert of 7 October 2026 on large-scale breaches; Act 56/2026 introduces risk-based breach-notification exemption.

    PPCT1Confirmed

  85. 85

    KREnforcement & Redress2026-09-11

    PIPA fine ceiling raised from 3% to 10% of total turnover (effective 11 Sept 2026) facing its first major live test in the Oct 2026 banking-breach wave; record 2026 fines already issued against SK Telecom and Coupang.

    GattyworksT3Probable

  86. 86

    IEAlgorithmic, Biometric & Surveillance Governance2026-08-02

    Irish AI Act 2026 and AI Office now in statutory force.

    MathesonT3Probable

  87. 87

    GICross-Border & Adequacy2026-07-15

    Adequacy references pivoted from UK adequacy regulations to EU Commission adequacy decisions; s.83A law-enforcement basis similarly realigned.

    Gibraltarlaw.com (law firm)T3Probable

  88. 88

    US-CTLawful Processing & Special Data2026-07-01

    No-threshold sensitive-data trigger in effect from July 1, 2026.

    Benesch LawT3Probable

  89. 89

    TZRegulator & Framework2026-04-09

    PDPC closed voluntary registration on 8 April 2026, moving to full enforcement including fines from 9 April 2026.

    dataprotection.giT3Probable

  90. 90

    VNLawful Processing & Special Data2026-01-01

    Decree 356 tightens consent standards and reclassifies cyberspace activity history as sensitive personal data.

    LexologyT3Probable

  91. 91

    US-RIController/Processor Dutiesdate pending

    Standing breach-notification rule (45/30-day, 500-threshold) confirmed; pending S 2638 amendment (24-hour agency channel, raised penalties) enactment status unconfirmed.

    OneTrust DataGuidanceT3Probable

  92. 92

    US-SCRegulator & Frameworkdate pending

    No dedicated DPA; AG enforces sectoral minors'-online-safety statutes.

    South Carolina Attorney GeneralT1Confirmed

  93. 93

    SGRegulator & Framework2026-10-16

    Public Sector (Governance) (Amendment) Act 2026 (Act 2 of 2026) amended the PDPA with effect 16 October 2026.

    Attorney-General's Chambers of Singapore (Singapore Statutes Online)T1Probable

  94. 94

    CA-BCEnforcement & Redress2026-10-09

    New investigation (City of Kamloops/Mayor Hamer-Jackson, unauthorized disclosure) and new order (City of Port Moody, access to workplace investigation records), both first listed within the window.

    Office of the Information and Privacy Commissioner for British ColumbiaT1Probable

  95. 95

    FIAdTech & Commercial Privacy2026-10-08

    Sanctions Board imposed a EUR 33,000 fine on Mindemo Oy (8 Oct 2026, just pre-window) for cookie/tracker deficiencies in a health-booking service transmitting health data to tracking providers without adequate risk assessment.

    Tietosuojavaltuutetun toimistoT1Probable

  96. 96

    NLSectoral Watch2025-11-21

    ACM designated Data Act enforcement authority; switching-charge reduction duty commenced.

    Autoriteit Consument en MarktT1Probable

  97. 97

    US-DELawful Processing & Special Data2026-10-07

    HB 380 broadens the sensitive-data definition and restricts sensitive-data sales.

    ZwillGenT3Probable

  98. 98

    PLEnforcement & Redress2026-10-05

    UODO fined an administrator 29,112 PLN (5 Oct 2026) for non-execution of a prior order; first-ever private-CCTV penalty (26,711 PLN) became final 22 Aug 2026.

    UODOT1Confirmed

  99. 99

    EGRegulator & Framework2026-10-01

    PDPC electronic portal officially launched October 2026 ahead of the 31 October 2026 grace-period expiry.

    SH&PT3Probable

  100. 100

    KRController/Processor Duties2026-10-01

    PIPC Chair acknowledged security-system shortcomings during live banking-breach wave; Network Act 24-hour incident-reporting deadline now in force.

    Legal 500 / D&A LLCT3Probable

Regulatory horizon