🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
Previous editions

Archived edition for the week of 2026-09-20, as published that week.

Roundup

Data Protection Monitor — 2026-09-20

100 developments, ranked within this monitor. Assembled deterministically from the most recent periodic union run for this consumer — no model wrote this page, and no other monitor's coverage affects it.

48 of 481 ranked developments are withheld because their jurisdiction emitted no evidential publication gate this cycle. They are not missing and this is not a quiet week — they are unpublished pending that gate. Gate verdicts across all 481 ranked developments: BLOCK 48, OVERRIDDEN 2, PASS 431.

333 further gate-open developments fall below this edition's cut and are held for the per-jurisdiction pages.

Developments

  1. 1

    US-HIAlgorithmic, Biometric & Surveillance Governance2026-07-14

    Act 248 (SB3001) enacted 2026-07-14, Hawaii's first AI-specific statute, requiring AI-companion disclosures and minor-safety protocols; HB2136 (surveillance-data definition) also active.

    Hawaii State Legislature (SB3001)T1Confirmed

  2. 2

    US-COAlgorithmic, Biometric & Surveillance Governance2026-05-14

    SB26-189 repeals/re-enacts Colorado AI law, narrowing scope to covered ADMT; predecessor SB24-205 enjoined and AG will not enforce pending rulemaking.

    Colorado General AssemblyT1Confirmed

  3. 3

    CA-BCLawful Processing & Special Data2026-05-05

    OIPC/OPC joint investigation found PIPA does not enable implicit consent for AI processing; Commissioner stated PIPA's consent provisions are no longer well suited to AI-era processing.

    OIPC BCT1Confirmed

  4. 4

    NZRegulator & Framework2026-05-01

    IPP3A, introduced by the Privacy Amendment Act 2025, came into force 1 May 2026, extending notice obligations to indirect collection of personal information.

    Office of the Privacy Commissioner (OPC)T1Confirmed

  5. 5

    LUAdTech & Commercial Privacy2026-03-12

    Amazon 'legitimate interests' finding upheld by the 12 March 2026 Administrative Appeal Court ruling, though the associated fine was annulled.

    CNPDT1Confirmed

  6. 6

    DEController/Processor Duties2026-03-04

    BVerwG dismissed BfDI's suit to enforce inspection rights over the BND (4 March 2026); 2025 complaint inputs rose 36% YoY to 11,824.

    BfDIT1Confirmed

  7. 7

    UKRegulator & Framework2026-02-05

    DUAA 2025 Part 5 amendments substantially commenced via SI 2026/82; all data-protection provisions now in force.

    legislation.gov.uk (SI 2026/82)T1Confirmed

  8. 8

    US-MNEnforcement & Redress2026-01-31

    MCDPA's 30-day cure/warning period sunset January 31, 2026; AG Ellison publicly confirmed the sunset on February 5, 2026, citing hundreds of education letters sent during the warning period.

    Minnesota Attorney General's OfficeT1Confirmed

  9. 9

    BRCross-Border & Adequacy2026-01-27

    Reciprocal EU-Brazil adequacy decisions (26-27 Jan 2026) eliminate routine SCC/BCR requirement for EU/EEA transfers, Brazil's first-ever adequacy decision.

    ANPD (gov.br)T1Confirmed

  10. 10

    SEEnforcement & Redress2026-01-26

    SportAdmin (SEK 6m, Jan 2026), Apoteket (SEK 37m) and Apohem (SEK 8m) Meta Pixel fines mark escalating enforcement; IMY's own-initiative capacity reported constrained.

    IMYT1Confirmed

  11. 11

    FRController/Processor Duties2026-01-22

    CNIL fined France Travail €5m (22 Jan 2026) and Free/Free Mobile €42m combined (13 Jan 2026) for Article 32 security failures and DPIA-implementation gaps.

    CNILT1Confirmed

  12. 12

    US-TXAlgorithmic, Biometric & Surveillance Governance2026-01-01

    TRAIGA (HB149), effective January 1, 2026, establishes intent-based AI liability regime with AG-exclusive enforcement and civil penalties up to $200,000 per uncurable violation; Texas Biometric Identifier Act enforced alongside TDPSA.

    Office of the Texas Attorney GeneralT1Confirmed

  13. 14

    PERegulator & Framework2025-03-31

    New implementing Reglamento (D.S. N° 016-2024-JUS) entered into force 31 March 2025, replacing the 2013 regulation.

    ANPD (gob.pe)T1Confirmed

  14. 15

    USRegulator & Framework2024-06-24

    PADFAA recency_date corrected to 2024-06-24 across affected claims

    FTCT1Confirmed

  15. 16

    AFRRegulator & Framework2023-06-08

    Malabo Convention in force since 8 June 2023; only 16 of 55 AU states ratified; NADPA/RAPDP is a cooperation network, not an enforcement body.

    African UnionT1Confirmed

  16. 17

    TZRegulator & Framework2023-05-01

    PDPA fully enforceable from 9 April 2026; further 7-day compliance ultimatum issued 12 June 2026.

    PDPC Tanzania - Background HistoryT1Confirmed

  17. 18

    DKEnforcement & Redress2018-05-25

    Denmark's Recital-151 court-mediated fining model (confirmed via CJEU C-383/23, ILVA/IDdesign) structurally constrains Datatilsynet's own powers; enforcement referrals remain frequent; the breach-notification EU ranking was corrected via challenger fold.

    CJEU / EUR-LexT1Confirmed

  18. 19

    QARegulator & Framework2017-02-13

    Baseline established: dual mainland (PDPPL/NCGAA) and QFC (QFC DPR 2021/QFC DPO) regimes.

    National Cyber Governance and Assurance Affairs (NCGAA)T1Confirmed

  19. 20

    RURegulator & Framework2006-07-27

    Challenger fold confirms Federal Law No. 266-FZ already enacted extraterritorial expansion of 152-FZ effective 2022-09-01, correcting a stale/uncertain baseline framing.

    RoskomnadzorT1Confirmed

  20. 21

    USLawful Processing & Special Data2000-04-21

    CCPA symmetry-in-choice/anti-dark-pattern rules effective 2026-01-01

    FTCT1Confirmed

  21. 22

    ARRegulator & Frameworkdate pending

    Two integral reform bills (Carro, Doñate) introduced to Congress in 2026, reproducing AAIP's 2022 anteproyecto, seeking GDPR/LGPD alignment.

    Boletín Oficial de la República ArgentinaT1Confirmed

  22. 23

    RSRegulator & Frameworkdate pending

    New Law on Personal Data Protection reported to have progressed significantly during 2025, aimed at AI/advanced-tech alignment; draft text not yet public.

    Commissioner for Information of Public Importance and Personal Data ProtectionT1Confirmed

  23. 24

    UYCross-Border & Adequacydate pending

    URCDP Resolution No. 8/2026 (17 April 2026) recommends model clauses for international data transfers, extending transfer-mechanism guidance.

    European CommissionT1Confirmed

  24. 25

    US-KYRegulator & Framework2026-01-01

    KCDPA (KRS 367.3611-367.3629, HB15 2024, amended HB473 2025) took effect January 1, 2026; enforced exclusively by KY AG's Office of Data Privacy.

    Kentucky Attorney GeneralT1Confirmed

  25. 26

    US-WYLawful Processing & Special Data2025-06-23

    No general lawful-basis regime; Genetic Data Privacy Act (effective 2022-07-01, corrected this cycle) and COPPA (effective 2025-06-23, corrected this cycle) are the only consent-threshold instruments.

    Federal Trade CommissionT1Confirmed

  26. 27

    SIRegulator & Framework2023-01-26

    ZVOP-2 confirmed in force since 26 January 2023; IP is sole DPA; two amendments (ZInfV-1, ZP-1L) confirmed.

    Informacijski pooblaščenec (IP)T1Confirmed

  27. 28

    ISRegulator & Framework2018-07-15

    GDPR incorporated via EEA Agreement into Act No. 90/2018; Persónuvernd is sole DPA.

    Althingi (Icelandic Parliament)T1Confirmed

  28. 29

    UARegulator & Framework2011-01-01

    Ombudsman-embedded model persists; Draft Law 8153 GDPR-alignment reform remains pre-second-reading.

    Verkhovna Rada Legal Database (zakon.rada.gov.ua)T1Confirmed

  29. 30

    EERegulator & Frameworkdate pending

    AKI remains the sole supervisory authority; a 2025-effective amendment grants AKI collective-redress standing.

    Andmekaitse Inspektsioon (AKI)T1Confirmed

  30. 33

    IECross-Border & Adequacy2026-06-30

    High Court upheld the DPC's EUR 530 million fine against TikTok (30 June 2026); Supreme Court dismissed a related DPC appeal (30 April 2026).

    Digital Policy AlertT2Confirmed

  31. 34

    US-MTChildren & Vulnerable Groups2025-10-01

    SB 297 adds heightened privacy protections for consumers under 18, applying without the numeric applicability thresholds that gate the rest of the Act.

    Future of Privacy ForumT2Confirmed

  32. 35

    LVEnforcement & Redressdate pending

    Riga Regional Court finalised the DVI's EUR 1.2M fine against Tet (final, non-appealable); DVI opened 266 in-depth review proceedings, identified 143 violations, applied corrective measures in 62 cases, issued 7 administrative-offence decisions in its latest reporting period.

    LSM (Latvian Public Broadcasting)T2Confirmed

  33. 36

    US-ILChildren & Vulnerable Groups2026-07-31

    Children's Online Social Media Safety Act (HB5511/P.A. 104-0664) signed 31 July 2026, requiring OS-level age-signal interface by 1 Jan 2028.

    Office of Governor JB PritzkerT2Confirmed

  34. 37

    PEEnforcement & Redress2026-05-14

    760 inspections in 2025 (up 67% YoY), 136 sanctioning procedures, fines exceeding S/11 million; 301 inspections/52 procedures YTD to 14 May 2026.

    LexLatinT2Confirmed

  35. 39

    HRController/Processor Duties2025-07-02

    2026 EDPB CEF activity newly probes AI-systems/transparency accountability; Croatian Insurance Bureau fine date corrected this cycle via challenger fold (2024-05-27 -> 2025-07-02).

    DataGuidanceT2Confirmed

  36. 40

    ZALawful Processing & Special Data2021-06-30

    Section 57(1) prior-authorisation scope corrected from a general ss.27-33 rule to four enumerated scenarios

    DataGuidanceT2Confirmed

  37. 41

    US-CARegulator & Framework2026-01-01

    CPPA's comprehensive Sept 2025-adopted regulations package (cybersecurity audits, risk assessments, ADMT) became effective January 1, 2026.

    California Privacy Protection AgencyT1Confirmed

  38. 42

    JPAlgorithmic, Biometric & Surveillance Governancedate pending

    New 'Specific Biometric Personal Information' category created with heightened transparency, deletion rights, and opt-out prohibition.

    Mori Hamada & MatsumotoT2Confirmed

  39. 43

    GIRegulator & Framework2021-01-01

    Data Protection Regulations 2026 (LN 96/2026) amended the Gibraltar GDPR and DPA04 under the Treaty on Gibraltar and the EU Act 2026, effective 15 July 2026.

    Gibraltar Regulatory AuthorityT1Confirmed

  40. 44

    MYRegulator & Framework2010-06-02

    Personal Data Protection (Amendment) Act 2024 fully commenced across three phases, in force as of 1 June 2025.

    Department of Personal Data Protection (JPDP)T1Confirmed

  41. 45

    CLRegulator & Frameworkdate pending

    Ley 21.719 creates the APDP, entering into force 1 December 2026; Ley 21.806 set a 1 June 2026 deadline for designating its Governing Council.

    Biblioteca del Congreso Nacional (BCN)T1Confirmed

  42. 46

    US-LALawful Processing & Special Data2027-01-01

    Sensitive-data sale requires prior consumer consent; biometric-data sale notice required.

    Louisiana State Legislature (SB 386 original)T1Confirmed

  43. 47

    US-VTRegulator & Framework2026-06-16

    S.71/Act 145 (VDPOSA) enacted June 16, 2026, effective January 1, 2028; AG sole enforcer.

    Vermont General Assembly — Bill Status S.71 (Act 145)T1Confirmed

  44. 49

    ITAlgorithmic, Biometric & Surveillance Governance2026-07-09

    Character.AI fine, deepfake ruling, facial-recognition decree dispute, and OpenAI fine annulment all active this cycle.

    Garante per la protezione dei dati personaliT1Confirmed

  45. 50

    US-KSController/Processor Duties2026-07-01

    2026 HB 2591 extends 'covered entity' status under the Kansas Financial Institutions Information Security Act to virtual-currency-kiosk registrants, requiring an information security program.

    Kansas Legislature Conference Committee Report Brief on HB 2591T1Confirmed

    Also tracked by financial-integrity:D7

  46. 51

    NOEnforcement & Redress2026-06-05

    Elkjøp fined NOK 20 million (2026); Borgarting Court of Appeal dismissed Grindr's final appeal in August 2025, leaving the NOK 65 million fine (Norway's largest GDPR fine) in place.

    DatatilsynetT1Confirmed

  47. 52

    NZAlgorithmic, Biometric & Surveillance Governance2025-11-03

    Biometric Processing Privacy Code 2025 fully in force from 3 November 2025 with existing-user compliance deadline of 3 August 2026; Amendment No.1 (March 2026) reflects IPP3A for biometric processing.

    Office of the Privacy Commissioner (OPC)T1Confirmed

  48. 53

    US-COChildren & Vulnerable Groups2025-10-01

    SB24-041 adds age-appropriate design code and minor-data protections, effective Oct 1, 2025; notice-and-cure mechanism sunsets Dec 31, 2026.

    Colorado General AssemblyT1Confirmed

  49. 54

    US-NJRegulator & Framework2025-01-15

    A5328 (P.L.2026, c.25) signed 2026-06-30 amending the NJDPA to add a data-broker/data-collector registration regime and sensitive-data sale ban, effective immediately.

    NJCCICT1Confirmed

  50. 55

    US-ORRegulator & Framework2024-07-01

    HB 2008 and HB 3875 (2025) amend the OCPA, with substantive changes effective January 1, 2026.

    Oregon Department of JusticeT1Confirmed

  51. 57

    US-CTRegulator & Framework2023-07-01

    Two 2026 amendment packages (PA 25-113, PA 26-64) substantially widen scope and obligations.

    Connecticut Attorney GeneralT1Confirmed

  52. 58

    NLAlgorithmic, Biometric & Surveillance Governancedate pending

    Record €824,990,000 Uber fine (21 Aug 2026) for automated driver-deactivation decisions, following the earlier Clearview AI biometric-data fine.

    Autoriteit PersoonsgegevensT1Confirmed

  53. 59

    SECross-Border & Adequacydate pending

    IMY fined Apoteket (SEK 37m) and Apohem (SEK 8m) for Meta Pixel sensitive-data transfers without adequate safeguards; continued Google Analytics transfer-safeguard enforcement.

    IMYT1Confirmed

  54. 60

    DERegulator & Framework2026-05-30

    BfDI leadership transition (Hennemann elected) and DADG Data Act personal-data competence entered into force 30 May 2026.

    BfDIT1Confirmed

  55. 61

    US-MSController/Processor Duties2026-04-08

    HB1596 imposes written information-security-program, qualified-individual, and breach-notification obligations on MTL licensees, effective July 1, 2026.

    Mississippi Legislature Bill Status System (HB1596)T1Confirmed

    Also tracked by financial-integrity:D6

  56. 62

    US-MSRegulator & Framework2026-04-01

    HB1220 creates a cybersecurity liability safe harbor and amends the Insurance Data Security Law, effective July 1, 2026.

    Mississippi Legislature Bill Status System (HB1220)T1Confirmed

  57. 63

    EEASectoral Watch2025-07-01

    DORA in force EEA-wide since 1 July 2025, layering ICT-risk duties intersecting with GDPR security/breach-notification duties.

    EFTAT1Confirmed

  58. 64

    RWEnforcement & Redress2023-10-15

    NCSA/DPO ran ISO 31000 risk-management training for DPOs (27-31 July 2026); penalty framework includes fines (RWF 2-5M or 1% of prior-year revenue) and custodial penalties for false registration.

    Ministry of ICT and Innovation (MINICT)T1Confirmed

  59. 65

    CA-QCAlgorithmic, Biometric & Surveillance Governance2023-09-22

    CAI decision prohibiting Metro Inc. from operating a biometric-characteristics database, evidencing active supervisory scrutiny of biometric processing.

    Commission d'accès à l'information du QuébecT1Confirmed

  60. 66

    KEEnforcement & Redress2021-01-01

    2026 marks a documented shift into audit-led, compensation-order and court-enforced-deletion enforcement, after roughly five years of a reactive, registration-focused posture.

    Office of the Data Protection Commissioner (ODPC)T1Confirmed

  61. 67

    USController/Processor Dutiesdate pending

    CCPA ADMT/risk-assessment/cybersecurity-audit regime phasing in 2026-2030 (confidence downgraded per challenger caveat)

    FTCT1Confirmed

  62. 69

    VEEnforcement & Redressdate pending

    TSJ Decision 1318 calls for an oversight agency that has never been created; recent Movistar/Cashea breaches underscore the redress gap.

    IAPPT2Confirmed

  63. 70

    US-LARegulator & Framework2027-01-01

    First comprehensive omnibus privacy statute (LDPA) enacted, effective January 1, 2027; AG-exclusive enforcement.

    Louisiana State Legislature (SB 386 enrolled)T1Confirmed

  64. 71

    US-KYData Subject Rights2026-01-01

    Standard VCDPA-model rights bundle (access, correction, deletion, portability, opt-out) in force since 2026-01-01.

    Kentucky Legislative Research CommissionT1Confirmed

  65. 72

    US-MTRegulator & Framework2025-10-01

    MCDPA (SB 384, 2023) as amended by SB 297 (effective Oct 1, 2025); Montana AG's Office of Consumer Protection has exclusive enforcement authority.

    Montana Department of JusticeT1Confirmed

  66. 73

    US-NMRegulator & Framework2025-01-01

    DOJ rulemaking deadline of April 1, 2026 for HB307 confirmed at T1.

    New Mexico Legislature (HB0307 text)T1Confirmed

  67. 74

    US-TXRegulator & Framework2024-07-01

    TDPSA (Ch.541, eff. 2024-07-01) confirmed with exclusive AG enforcement authority and 30-day cure period.

    Office of the Texas Attorney GeneralT1Confirmed

  68. 75

    LARegulator & Framework2017-05-12

    MTC implements and enforces the law with no independent DPA; law extends extraterritorially to foreign entities without Lao physical presence.

    World BankT1Confirmed

  69. 76

    CA-NBRegulator & Frameworkdate pending

    NB has no provincial private-sector data-protection statute; federal PIPEDA governs directly.

    Office of the Privacy Commissioner of CanadaT1Confirmed

  70. 77

    ECRegulator & Frameworkdate pending

    LOPDP (26 May 2021) established SPDP; secondary rulemaking (large-scale, biometric, AI norms) continues.

    Superintendencia de Protección de Datos Personales (SPDP)T1Confirmed

  71. 78

    BRChildren & Vulnerable Groups2026-08-25

    25 Aug 2026: ANPD sanctioned a social-media platform R$153,769,671.33 for LGPD violations in processing children's/adolescents' data -- among the largest ANPD fines on record.

    Daniel LawT3Confirmed

  72. 79

    NLEnforcement & Redress2026-08-21

    The Uber fine, the Council of State's annulment of the Enschede fine, and the ten-municipality fine package together constitute the single most material development in this cycle's NL sweep.

    GblockT3Confirmed

  73. 80

    US-VAAdTech & Commercial Privacy2026-07-01

    SB338 (2026 c.820) prohibits sale of consumers' precise geolocation data, effective 1 July 2026; Virginia does not require GPC recognition and retains a permanent cure period.

    Regulatory Oversight (Baker Donelson)T3Confirmed

  74. 81

    FIEnforcement & Redress2026-06-01

    Supreme Administrative Court upheld €795,000 Verkkokauppa.com fine; annual case volume exceeds 13,000; 2026 EDPB Coordinated Enforcement Framework participation.

    LinklatersT3Confirmed

  75. 82

    UKEnforcement & Redress2026-02-05

    DUAA raises ICO's maximum PECR penalty to GDPR-parity level (£17.5m or 4% global turnover), up from £500,000 fixed cap, effective 5 Feb 2026.

    Osborne ClarkeT3Confirmed

  76. 83

    US-CAController/Processor Duties2026-01-01

    Mandatory cybersecurity audits and ADMT/risk-assessment obligations became operative January 1, 2026, a substantial expansion of accountability duties.

    Ervin Cohen & Jessup LLPT3Confirmed

  77. 84

    US-NHEnforcement & Redress2026-01-01

    Mandatory 60-day AG cure period expired 1/1/2026, shifting to full enforcement discretion; data-broker registration bill HB1694 failed February 2026.

    PrivacyLawMapT3Confirmed

  78. 85

    US-OKController/Processor Duties2026-01-01

    SB 626 (eff. 2026-01-01, in force) expands breach-notification duties to include biometric data and online-account credentials, with mandatory 60-day AG notification; SB 546 adds DPIA and security-practice duties, not yet in force.

    Constangy Brooks & PropheteT3Confirmed

  79. 86

    INRegulator & Framework2025-11-13

    DPDP Rules 2025 notified 13 Nov 2025; DPBI established immediately; staggered 3-phase commencement schedule through 13 May 2027.

    Baker BottsT3Confirmed

  80. 87

    THAlgorithmic, Biometric & Surveillance Governance2025-11-01

    PDPC ordered halt and deletion of biometric data (~1.2M users) from an iris-scan-for-crypto-token service (reported as World/Worldcoin), Nov 2025.

    Chambers and PartnersT3Confirmed

  81. 88

    MYController/Processor Duties2025-06-01

    Mandatory breach notification (72hrs to Commissioner, 7 days to data subjects), mandatory DPO appointment, and direct processor liability under s.9 all fully in force since 1 June 2025 / 1 April 2025.

    DLA PiperT3Confirmed

  82. 89

    US-NYController/Processor Duties2024-12-21

    Dec 2024 SHIELD Act amendment introduced a firm 30-day breach-notification deadline (replacing 'most expedient time possible') plus a new DFS-notification requirement for DFS-regulated entities.

    Ropes & Gray via JD SupraT3Confirmed

  83. 91

    GHEnforcement & Redressdate pending

    DPC declared 2026 'a year of enforcement' (26 Jan 2026); Communications Minister escalated with a policy directive mandating fines (2 March 2026); Section 56 penalties confirmed.

    NewsGhanaT3Confirmed

  84. 92

    TZEnforcement & Redress2026-08-31

    On-site compliance inspections commenced 31 August 2026 following preliminary assessments revealing gaps particularly in healthcare, finance and education.

    Lawyard - PDPC on-site compliance inspectionsT3Confirmed

  85. 93

    JPEnforcement & Redress2026-07-17

    First-ever direct administrative monetary penalty power for the PPC enacted (not yet in force, by July 2028); 5 PPC enforcement cases published Oct 2024-Sep 2025.

    Recording LawT3Confirmed

  86. 94

    GICross-Border & Adequacy2026-07-15

    LN 96/2026 replaced Art 45(1) UK-adequacy-regulations references with EU Commission adequacy decisions, and re-based DPA04 s.83A law-enforcement transfer adequacy similarly.

    HassansT3Confirmed

  87. 96

    AERegulator & Framework2026-06-14

    Federal Authority for Artificial Intelligence and Data established 14 June 2026, consolidating the UAE Data Office, AI Office and TDRA digital-government sector; PDPL Implementing Regulations still not issued.

    LexologyT3Confirmed

  88. 97

    US-ALRegulator & Framework2026-04-17

    ALDPA enacted, moving regime toward hybrid; AG remains sole enforcement authority.

    RecordingLawT3Confirmed

  89. 98

    US-OKRegulator & Framework2026-03-20

    Governor Stitt signed SB 546, enacting the Oklahoma Consumer Data Privacy Act, effective 2027-01-01, with exclusive AG enforcement.

    WilmerHaleT3Confirmed

  90. 99

    KRRegulator & Framework2026-03-10

    PIPA amended 10 March 2026 (most consequential rewrite since 2023), effective 11 September 2026; raises fine ceiling from 3% to 10% of total revenue.

    Hunton Andrews Kurth Privacy BlogT3Confirmed

  91. 100

    US-GAChildren & Vulnerable Groups2026-03-10

    Eleventh Circuit heard oral arguments in NetChoice v Carr on 10 March 2026 regarding SB 351's constitutionality; law remains enjoined pending decision.

    Chambers and PartnersT3Confirmed

  92. 101

    VNEnforcement & Redress2026-01-01

    PDPL Article 8 introduces a tiered penalty framework: up to 10x illicit gains, up to 5% of prior-year revenue for cross-border breaches, or VND 3 billion fallback fine.

    Vietnam BriefingT3Confirmed

  93. 102

    VNRegulator & Framework2026-01-01

    Law No. 91/2025/QH15 (PDPL) enacted 26 June 2025, effective 1 January 2026; Decree No. 356/2025/ND-CP replaces Decree 13/2023/ND-CP.

    DataGuidanceT3Confirmed

  94. 104

    ESLawful Processing & Special Data2025-11-01

    Biometric (special-category) processing under active AEPD enforcement scrutiny (Aena case).

    Protection ReportT3Confirmed

  95. 105

    MXRegulator & Framework2025-03-21

    SABG replaced the autonomous INAI as data-protection authority effective 21 March 2025 under new LFPDPPP/LGPDPPSO.

    Greenberg TraurigT3Confirmed

  96. 107

    IDRegulator & Framework2022-09-20

    UU PDP fully enforceable since 17 Oct 2024 but the PDP Agency remains unestablished; a June 2026 Constitutional Court petition challenges the lack of a statutory deadline.

    Pertama PartnersT3Confirmed

  97. 108

    RUCross-Border & Adequacy2015-09-01

    Challenger fold corrects the adequate-country whitelist count from ~23 to 89 (Order No. 128, effective 2023-03-01) and flags an unconfirmed Article 12 transfer-impact-assessment precondition (effective 2023-03-01) as a caveat.

    IAPPT3Confirmed

  98. 109

    TNRegulator & Framework2004-07-27

    2025 organic-law bill would replace Law 2004-63 with a GDPR-modelled framework; INPDP mandate expands from consultative to enforcement authority; full enforcement targeted 11 July 2026.

    DLA PiperT3Confirmed

  99. 110

    HREnforcement & Redress2018-05-25

    Multi-year AZOP enforcement record (EUR 5.47M EOS Matrix; EUR 350,500 aggregate across eight decisions dated 2 July 2025, corrected this cycle; EUR 12,000 DPO fine) plus new 2026 CEF activity.

    International Association of Privacy ProfessionalsT2Confirmed

  100. 111

    JPRegulator & Frameworkdate pending

    APPI Amendment Act enacted (Diet 10 Jul 2026, promulgated 17 Jul 2026), commencement by Cabinet order no later than July 2028.

    Chambers and PartnersT2Confirmed

Regulatory horizon