🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi

Roundup

Data Protection Monitor — 2026-09-27

Assembled deterministically from our recent research runs and ranked by date and importance.

Previous editions

New or updated since 2026-09-20

New to this edition or changed since the last one.

  1. 1

    US-COAlgorithmic, Biometric & Surveillance Governance2027-01-01

    SB26-189 (ADMT Act) repeals SB24-205, shifting from risk-management duties to transparency/notice/human-review rights, effective Jan 1, 2027.

    Colorado General AssemblyT1Confirmed

  2. 2

    USRegulator & Framework2026-09-28

    Three additional states (IN, KY, RI) joined the comprehensive-privacy-law landscape effective January 1, 2026, bringing the total to twenty.

    Federal Trade CommissionT1Confirmed

  3. 3

    IEEnforcement & Redress2026-09-21

    Two material fines within one month: EUR403m against Google Ireland (21 Sept 2026) and EUR645,000 against the HSE (2 Sept 2026).

    Data Protection CommissionT1Confirmed

  4. 4

    US-DERegulator & Framework2026-09-02

    HB380/HB381 signed September 2, 2026; HB380 effective Jan 1 2027, HB381 effective on signing.

    State of Delaware NewsT1Confirmed

  5. 5

    UKRegulator & Framework2026-06-19

    All DUAA 2025 data protection provisions fully in force from 19 June 2026; ICO added new-powers guidance section.

    Information Commissioner's OfficeT1Confirmed

  6. 6

    US-ALChildren & Vulnerable Groups2026-04-17

    App Store Accountability Act (HB161) enacted, establishing four age categories and mandatory parental consent for minors before app download/purchase.

    Alabama Legislature (HB161 engrossed)T1Confirmed

  7. 7

    US-ALRegulator & Framework2026-04-17

    APDPA (HB351) enacted, establishing exclusive AG enforcement, no private right of action, and a 45-day cure period; effective 2027-05-01.

    Alabama Legislature (HB351 enrolled)T1Confirmed

  8. 8

    US-OREnforcement & Redress2026-01-01

    30-day notice-and-cure requirement expired January 1, 2026; AG may now proceed directly to CID or lawsuit, penalties up to $7,500/violation.

    Oregon DOJ - Privacy Law FAQs for BusinessesT1Confirmed

  9. 9

    CARegulator & Frameworkdate pending

    Federal privacy reform returned as Bill C-36 (PPCDA), following Bill C-27's death on the Order Paper in January 2025.

    Office of the Privacy Commissioner of CanadaT1Confirmed

  10. 10

    NLCross-Border & Adequacy2026-05-08

    AP fined MLU B.V. (Yango) EUR100 million on 8 May 2026 for transferring personal data of Norwegian/Finnish users to Russia without ensuring adequate protection.

    Autoriteit Persoonsgegevens (AP)T1Confirmed

  11. 11

    US-KYRegulator & Framework2026-01-01

    KCDPA effective 1 January 2026; AG's Office of Data Privacy has exclusive enforcement authority.

    Kentucky Attorney General — Office of Data PrivacyT1Confirmed

  12. 12

    IMRegulator & Frameworkdate pending

    Core statutory framework stable; fee-revision consultation ongoing.

    Isle of Man GovernmentT1Confirmed

  13. 13

    US-CAController/Processor Duties2026-01-01

    New cybersecurity-audit and privacy-risk-assessment obligations took effect January 1, 2026, with phased compliance deadlines from 2028-2030.

    CPPAT1Confirmed

  14. 14

    MYRegulator & Frameworkdate pending

    PDPA 2010 as amended by Act A1727 (2024) modernises Malaysia's DP regime with staged Ministerial-Gazette commencement.

    JPDP / Attorney General's ChambersT1Confirmed

  15. 15

    IELawful Processing & Special Data2026-09-21

    Google decision found infringements of GDPR Articles 5, 6, 12, 13 concerning location-data processing lawfulness/transparency.

    European Data Protection BoardT1Confirmed

  16. 16

    GIRegulator & Framework2026-07-15

    Data Protection Regulations 2026 re-instate EU GDPR standards effective 15 July 2026.

    Gibraltar Regulatory AuthorityT1Confirmed

  17. 17

    US-LARegulator & Framework2026-05-29

    LDPA (SB 386) enacted; effective 2027-01-01, moving Louisiana to a hybrid omnibus-plus-sectoral regime.

    Louisiana State Legislature - SB 386 EnrolledT1Confirmed

  18. 18

    US-MNEnforcement & Redress2026-02-05

    30-day cure period sunset Jan 31, 2026; AG announced Feb 5, 2026 it can now enforce without advance notice and described ongoing early enforcement activity.

    Minnesota Attorney General's OfficeT1Probable

  19. 19

    US-FLEnforcement & Redress2026-06-26

    Roku settlement (June 2026) is the first disclosed FDBR enforcement matter; CHINA Prevention Unit issuing subpoenas since Feb 2026.

    Florida Office of the Attorney GeneralT1Probable

  20. 20

    US-MSController/Processor Duties2026-07-01

    HB1596 and HB1220 impose new security-program and breach-notification duties on money transmitters and insurance licensees respectively.

    Mississippi Legislature Bill Status SystemT1Confirmed

    Also tracked by world-payments:W3

  21. 21

    NZLawful Processing & Special Data2026-05-01

    IPP 3A indirect-collection notification requirement came into force 1 May 2026; Biometrics Processing Privacy Code grace period for historical processing expired 3 August 2026.

    New Zealand Ministry of JusticeT1Confirmed

  22. 22

    US-ORAdTech & Commercial Privacy2026-01-01

    Mandatory opt-out signal recognition and geolocation-sale ban both effective January 1, 2026.

    Oregon DOJ - opt-out signal requirementT1Confirmed

  23. 23

    MYController/Processor Dutiesdate pending

    First mandatory breach-notification and DPO requirements introduced; terminology changed from Data User to Data Controller; three new implementing guidelines released 8 May 2026.

    Department of Personal Data Protection (JPDP)T1Confirmed

  24. 24

    CMEnforcement & Redress2026-06-23

    Sanctions under Law No. 2024/017 apply from 23 June 2026 for consent-condition breaches or lack of Authority authorisation; regulator capacity not yet observable.

    TechHive AdvisoryT3Confirmed

  25. 25

    ESLawful Processing & Special Data2026-03-10

    AEPD holds biometric facial-match data as special-category data even with claimed immediate deletion; pre-ticked-box consent for ancillary R&D use held invalid.

    Biometric UpdateT2Probable

  26. 26

    US-NJRegulator & Framework2026-06-30

    New data broker/data collector registration law (A5328/P.L.2026 c.25) enacted 30 June 2026, materially expanding the regulator's registration and enforcement remit.

    New Jersey LegislatureT1Probable

  27. 27

    MACross-Border & Adequacydate pending

    Transfers abroad require dedicated CNDP notification/authorisation under Article 20; a secondary-sourced adequacy list (EU, Switzerland, Canada, Iceland, Norway, Liechtenstein) is reported but not independently confirmed against a primary CNDP list.

    CNDPT1Confirmed

  28. 28

    KHRegulator & Framework2026-08-05

    MPTC held a Validation Workshop on the Draft LPDP on 5 August 2026, with EU Delegation participation, moving the draft toward the formal legislative process.

    Ministry of Post and Telecommunications (MPTC)T1Confirmed

  29. 29

    BRRegulator & Framework2026-02-25

    Lei 15.352/2026 upgraded ANPD to full regulatory-agency status with 200 new specialist posts.

    Senado FederalT1Probable

  30. 30

    LIEnforcement & Redressdate pending

    DSS may impose GDPR Art 83(4)-(6) fines up to CHF 11 million; active in EDPB Coordinated Enforcement Framework on Art 17 erasure; no named fining decision located this cycle.

    Datenschutzgesetz (DSG) - official English translationT1Confirmed

  31. 31

    PACross-Border & Adequacy2026-03-26

    ANTAI approved Resolution ANTAI-DG-003-2026 (26 Mar 2026) implementing RIPD Standard Contractual Clauses for international transfers, the principal transfer-mechanism development this cycle.

    Morgan & MorganT2Confirmed

  32. 32

    LTEnforcement & Redressdate pending

    2024 annual enforcement statistics, June 2026 doctor fine, and May 2026 decision cluster establish active enforcement baseline.

    GRIP (Global Relay)T2Confirmed

  33. 33

    CA-NBCross-Border & Adequacydate pending

    Federal PCMLTFA/PIPEDA information-sharing regulation now overlays PIPEDA for AML-regulated NB entities.

    Canada GazetteT1Probable

  34. 34

    CA-QCEnforcement & Redressdate pending

    Statutory SAP up to $10M/2% and penal fines up to $25M/4% confirmed; Metro Inc. biometric decision is a concrete recent-enforcement example this cycle.

    GAM Tech (vendor commentary)T4Confirmed

  35. 35

    US-NHChildren & Vulnerable Groups2026-06-19

    HB 1460 (2026, Ch.168) prohibits sale of a known child's sensitive/location data regardless of consent, effective 1 Jan 2027.

    New Hampshire General Court - HB 1460-FN Final Version (Chapter 168)T1Probable

  36. 36

    US-NHEnforcement & Redress2026-01-01

    Mandatory cure period sunset 1 Jan 2026 (now discretionary); NH joined a CPPA-led multistate privacy-enforcement consortium Oct. 2025; Data Privacy Unit had received 27 complaints and filed no suit as of Oct. 2025.

    New Hampshire General Court - RSA 507-H:11 (cure-period sunset provision)T1Probable

  37. 37

    ZMRegulator & Frameworkdate pending

    ODPC fully operational; Cyber Security/Cyber Crimes Acts 2025 split enacted.

    ZambiaLIIT1Probable

  38. 38

    ITAlgorithmic, Biometric & Surveillance Governance2026-07-29

    Favourable opinion on draft AI Act implementing decree; workplace-AI provvedimento; biometric-scraping ban push; character.ai provvedimento.

    Privacy.itT2Probable

  39. 39

    AREnforcement & Redress2026-09-28

    Three competing comprehensive reform bills pending in Congress; none enacted.

    AAIPT1Confirmed

  40. 40

    SEController/Processor Duties2026-09-22

    Miljödata SEK 1.8M fine for systemic Article 32(1) security failures.

    GblockT3Probable

  41. 41

    KRController/Processor Duties2026-09-11

    Maximum administrative penalty raised from 3% to 10% of total revenue in aggravated cases; CPO board-approval requirement; ISMS-P certification mandate phasing in to 2027/2028.

    Hunton Andrews KurthT3Probable

  42. 42

    ZAController/Processor Duties2026-09-01

    Over 8,000 security-compromise notifications since POPIA's enforcement provisions commenced; SABS enforcement notice issued following 2024 ransomware attack citing inadequate security safeguards.

    Werksmans AttorneysT3Probable

  43. 43

    US-NEChildren & Vulnerable Groups2026-07-17

    LB383 age-verification and parental-consent provisions preliminarily enjoined; LB838 broadens AAODCA applicability threshold.

    Sheppard MullinT3Probable

  44. 44

    KREnforcement & Redress2026-06-10

    Record KRW624.681bn Coupang fine (June 2026), the largest privacy penalty in Korean history, surpassing the prior KRW134.8bn SK Telecom record; obstruction referral for deleted access logs.

    BleepingComputerT3Probable

  45. 45

    KRRegulator & Framework2026-03-10

    Major PIPA amendment (Act No. 21445, promulgated 10 Mar 2026) took effect 11 Sept 2026; companion Network Act amendment effective 1 Oct 2026.

    Yulchon LLCT3Probable

  46. 46

    US-MASectoral Watch2026-02-26

    MGC granted DraftKings a conditional waiver over a crypto-to-cash segregation tool with full transaction-reporting and audit conditions; c.169B MTL regime layers onto existing GLBA/BSA data-handling duties for licensees.

    Massachusetts Gaming CommissionT1Confirmed

  47. 47

    UKCross-Border & Adequacy2026-01-15

    New 'not materially lower' data protection test replaces 'essentially equivalent' test for adequacy and SCC reliance, effective 15 Jan 2026.

    Clifford ChanceT3Probable

  48. 48

    INRegulator & Framework2025-11-13

    DPDP Rules, 2025 notified 13 November 2025, establishing the DPBI, with phased commencement through to 13 May 2027.

    Legal 500T3Probable

  49. 49

    CA-NBEnforcement & Redressdate pending

    Bill 46 (RTIPPA amendment) received Royal Assent; Ombud NB submitted 2025 legislative-review input.

    Legislative Assembly of New BrunswickT1Confirmed

  50. 50

    EEEnforcement & Redressdate pending

    AKI imposed a EUR 3,000,000 fine on Allium UPI OU on 5 September 2025 over the Apotheka loyalty-programme breach affecting more than 750,000 people; under appeal with hearings beginning 6 April 2026, following the earlier annulment of AKI's Asper Biogene fine.

    LexLintT3Probable

  51. 51

    UARegulator & Frameworkdate pending

    Draft Law No. 8153 passed first reading Nov 2024, still pending second reading as of mid-2026.

    AequoT3Probable

  52. 52

    UYCross-Border & Adequacydate pending

    URCDP Resolution No. 8/2026 (17 April 2026) recommends use of model/standard contractual clauses for international data transfers.

    Recording LawT3Probable

  53. 53

    US-SCChildren & Vulnerable Groups2026-04-20

    AADC (Act No. 96) took effect Feb 5, 2026; NetChoice v. Wilson preliminary-injunction motion fully briefed April 20, 2026 with no ruling yet.

    NetChoiceT2Probable

  54. 54

    US-ILSectoral Watch2027-01-01

    DACPA/DAKA financial-sector overlay and HB3773's AI-in-employment-decision notice requirement (effective 2026-01-01) both materially expand sectoral coverage this cycle.

    Illinois Department of Financial and Professional RegulationT1Confirmed

    Also tracked by crypto:consumer_protection, world-payments:W10

  55. 55

    US-VTRegulator & Framework2026-06-16

    Vermont enacted VDPOSA (Act 145/S.71) on 16 June 2026, its first comprehensive consumer privacy statute, effective 1 January 2028; AG is sole enforcer.

    Koley JessenT3Probable

  56. 56

    USEnforcement & Redress2026-03-30

    Active FTC enforcement cadence: Match/OkCupid, Hims & Hers, plus a proposed personalized-pricing policy statement.

    Federal Trade CommissionT1Confirmed

  57. 57

    NZController/Processor Duties2026-01-12

    Manage My Health privacy breach was notified to OPC on 12 January 2026 under the Privacy Act 2020's mandatory breach-notification regime.

    Office of the Privacy CommissionerT1Confirmed

  58. 58

    BDRegulator & Framework2025-11-06

    New Personal Data Protection Ordinance 2025 (as amended 2026) establishes the National Data Governance Authority, contradicting the prior no-DPA baseline.

    Anurag Verma WorldwatchT3Probable

  59. 59

    EGRegulator & Framework2025-11-02

    Executive Regulations (Decree 816/2025) entered force 2 Nov 2025, formally activating the PDPC's supervisory role after five years' delay; one-year grace period runs to 1 Nov 2026.

    Access PartnershipT3Probable

  60. 60

    INCross-Border & Adequacydate pending

    Rule 13(4) prohibits Significant Data Fiduciaries from transferring traffic data outside India; no EU-style adequacy/SCC/BCR framework exists.

    ssrana.inT3Probable

  61. 61

    PHChildren & Vulnerable Groupsdate pending

    NPC issued Show Cause Orders to Meta, Roblox, Reddit, and Discord over youth-privacy non-compliance.

    DataGuidanceT3Probable

  62. 62

    RORegulator & Framework2026-09-05

    GDPR applies directly, supplemented by Law 190/2018; ANSPDCP is the sole national supervisory authority. No material change to the framework itself.

    ANSPDCPT1Confirmed

  63. 63

    MARegulator & Frameworkdate pending

    CNDP remains sole DPA under Law 09-08 (2009) and Decree 2-09-165 (2009); prior declaration/authorisation regime confirmed with 24-hour receipt / 8-day escalation timelines.

    CNDPT1Confirmed

  64. 64

    US-ARRegulator & Frameworkdate pending

    No comprehensive privacy statute; PIPA (breach notification) and ADTPA (deceptive-practices) form the framework. SB258 (comprehensive bill) died in 2025.

    Arkansas Attorney GeneralT1Confirmed

  65. 65

    THEnforcement & Redressdate pending

    PDPC announced 8 administrative fines across 5 cases (1 Aug 2025); cumulative fines ~THB 21.5M by May 2026; Eagle Eye Crawler automated-surveillance tool rolled out.

    Transatlantic Law InternationalT3Confirmed

  66. 66

    US-PARegulator & Framework2026-06-24

    HB78 reached Senate second consideration June 25, 2026; committee amendment raised the threshold from 50,000 to 100,000.

    Pennsylvania General Assembly (HB 78, PN 3688)T1Probable

  67. 67

    CNCross-Border & Adequacy2026-01-01

    Three-pathway CBDT framework completed and operational as of 1 Jan 2026.

    China BriefingT3Probable

  68. 68

    CRLawful Processing & Special Datadate pending

    Consent remains the primary lawful basis; 10-year retention amendment to Decree 37554-JP confirmed.

    Global Privacy Laws HubT3Confirmed

  69. 69

    MAData Subject Rightsdate pending

    Access, rectification, blocking/erasure and objection rights confirmed, including a free right to object to commercial-prospecting processing; no data-portability right exists.

    Korte Law (AMERELLER)T3Confirmed

  70. 70

    SGController/Processor Duties2026-12-31

    PDPC announced NRIC-authentication ban with compliance deadline 31 December 2026 and stepped-up enforcement from 1 January 2027.

    Baker McKenzieT3Confirmed

  71. 71

    COEnforcement & Redressdate pending

    2026 public reporting indicates SIC-imposed fines for personal-data non-compliance now exceed 100 billion COP annually, with active fiscalization especially on AI-driven automated decisions.

    ImpactoTICT3Confirmed

  72. 72

    MAEnforcement & Redressdate pending

    CNDP has stepped up enforcement, issuing warnings to major data controllers and opening investigations into high-volume processors; fines of MAD 10,000-600,000 and/or 3 months-4 years imprisonment remain the statutory ceiling. GDPR-alignment reform to Law 09-08 remains under…

    Chambers and PartnersT3Confirmed

  73. 73

    US-NJController/Processor Duties2026-07-01

    The NJDPA's 30-day right-to-cure period sunset on 1 July 2026; the Division may now proceed directly to enforcement.

    New Jersey Division of Consumer AffairsT1Probable

  74. 74

    US-SDLawful Processing & Special Data2026-07-01

    SB49 imposes a sectoral consent requirement for genetic data sharing with third parties.

    South Dakota LegislatureT1Probable

  75. 75

    US-DCRegulator & Frameworkdate pending

    DC has no comprehensive consumer-privacy statute; standing regime is breach-notification-only (DC Code §28-3851 et seq., as amended by D.C. Law 23-98) enforced by the DC OAG.

    DC OAG — Requirements of the District's Data Breach Notification LawT1Confirmed

  76. 76

    PHData Subject Rightsdate pending

    Draft Circular on Data Subject Rights under public consultation; comments due 5 October 2026.

    National Privacy CommissionT1Confirmed

  77. 77

    NLAlgorithmic, Biometric & Surveillance Governance2026-08-21

    AP fined Uber EUR824,990,000 (21 August 2026) for unlawful solely-automated driver-deactivation decisions, breaching GDPR Art 22; AP has enforced EU AI Act prohibited-practices provisions since February 2025.

    GblockT4Probable

  78. 78

    CA-BCRegulator & Framework2026-02-26

    Bill 9 (FIPPA Amendment Act, 2026) introduced 2026-02-26; PIPA private-sector statute unamended.

    Office of the Information and Privacy Commissioner for British ColumbiaT1Confirmed

  79. 79

    BDController/Processor Duties2026-02-05

    February 2026 amendment introduces data-localisation requirement and softens managing-director criminal penalties to fines only.

    Digital Policy AlertT2Probable

  80. 80

    US-TXChildren & Vulnerable Groups2026-06-04

    App Store Accountability Act (SB 2420) enforcement began June 4, 2026 after Fifth Circuit stayed a district-court injunction; constitutional appeal remains pending.

    Recording LawT4Probable

  81. 81

    FIController/Processor Duties2026-06-01

    Supreme Administrative Court upheld the Verkkokauppa.com ~EUR 795,000 retention-period fine (June 2026); KHO:2023:82 creates tension between accountability duties and self-incrimination privilege.

    LinklatersT3Probable

  82. 82

    GIEnforcement & Redress2026-03-31

    18 cases resolved Q1 2026 including an Article 12(3) breach finding; BIIDPA conference hosted.

    Gibraltar Regulatory AuthorityT1Confirmed

  83. 83

    US-CAAlgorithmic, Biometric & Surveillance Governance2026-01-01

    New binding ADMT transparency/opt-out/access regime took effect January 1, 2026.

    CASRAIT3Probable

  84. 84

    VNEnforcement & Redress2026-01-01

    PDPL sets statutory three-tier fine structure (up to VND 3bn, 5% revenue, 10x unlawful revenue); implementing Sanctioning Decree remained undrafted-into-force as of most recent reporting.

    RouseT3Probable

  85. 85

    VNRegulator & Framework2026-01-01

    PDPL (Law 91/2025/QH15) and Decree 356/2025/ND-CP took effect 1 January 2026, replacing Decree 13/2023/ND-CP; MPS Cybersecurity Department (A05) enforces; extraterritorial scope applies.

    DFDLT3Probable

  86. 86

    ESController/Processor Duties2025-11-01

    Multiple large fines (Aena EUR10.04m, FC Barcelona EUR500k, Yoti EUR950k) turning on inadequate biometric DPIAs; AEPD Strategic Plan 2025-2030 commits to proactive AI-assisted supervision.

    Spanish Compliance InstituteT3Probable

  87. 87

    AURegulator & Framework2026-08-31

    Tranche 2 Privacy Amendment Bill exposure draft released 31 Aug 2026, proposing ~40 reforms across 8 areas; consultation closed 17-18 Sept 2026.

    Spruson & FergusonT3Probable

  88. 88

    FRAdTech & Commercial Privacy2026-04-14

    CNIL's final recommendation on email tracking pixels (14 April 2026) sets a 14 July 2026 consent deadline for existing subscribers, no transitional period for new contacts collected from 14 April 2026.

    GblockT4Confirmed

  89. 89

    US-IDChildren & Vulnerable Groups2026-04-02

    SHASM Act (HB542, Ch. 268) enacted, requiring age estimation, verifiable parental consent, and disabling addictive design features for minors on large social-media platforms; effective July 1, 2026.

    BillTrack50T2Probable

  90. 90

    JPController/Processor Duties2026-07-17

    2026 amendment expands PPC enforcement powers including administrative fines; PPC indicated possible review of breach-reporting requirements.

    Fisher Phillips LLPT3Probable

  91. 91

    JPLawful Processing & Special Data2026-07-17

    New consent exemption for statistical/AI-development processing; stricter rules for biometric personal information.

    Mori Hamada & MatsumotoT3Probable

  92. 92

    JPRegulator & Framework2026-07-17

    2026 APPI amendment act promulgated 17 July 2026, introducing an administrative fine system and expanded PPC enforcement powers.

    PwC Japan GroupT3Probable

  93. 93

    US-ALLawful Processing & Special Data2026-04-17

    APDPA requires consent before processing sensitive data (race/ethnicity, immigration status, religion, health, sexual orientation, genetic/biometric, precise geolocation, children's data); no DPIA requirement, unlike peer states.

    Mayer BrownT3Probable

  94. 94

    BRCross-Border & Adequacy2026-01-26

    EU-Brazil mutual adequacy decisions (EC 26 Jan 2026; ANPD Resolução 32/2026, 27 Jan 2026) established.

    Mayer BrownT3Probable

  95. 95

    TWController/Processor Duties2025-11-11

    New mandatory breach-notification regime (Art. 12); PDPC gains baseline security-rulemaking power (Art. 20-1); DPO mandate limited to government agencies (Art. 18).

    Jones DayT3Probable

  96. 96

    TWRegulator & Framework2025-11-11

    PDPA Amendment establishes independent PDPC (promulgated 2025-11-11); effective date disputed between sources.

    K&L GatesT3Probable

  97. 97

    US-FLChildren & Vulnerable Groups2025-10-14

    Roku enforcement resolution tests and publicizes the FDBR children's-data provision (s.501.1735).

    Regulatory Oversight (Troutman Pepper Locke)T3Probable

  98. 98

    DKEnforcement & Redressdate pending

    Netcompany case (DKK 15m recommended, 2024) pending in courts; Region of Southern Denmark fined DKK 500,000.

    Secure PrivacyT3Probable

  99. 99

    INController/Processor Dutiesdate pending

    DPDP Rules impose 72-hour breach notification, one-year minimum retention, and enhanced SDF duties (DPIAs, audits, DPO appointment); Rule 13(4) restricts SDF traffic-data transfer.

    EY IndiaT3Probable

  100. 100

    TRCross-Border & Adequacydate pending

    Law No. 7499 replaced the rigid explicit-consent model with a GDPR-aligned architecture (adequacy, SCCs, BCRs); consent now limited to incidental transfers.

    Istanbul AttorneysT3Probable

Regulatory horizon