Data Protection Monitor — 2026-10-04

New or updated since 2026-09-27

New to this edition or changed since the last one.

1. 1

   CZEnforcement & Redress2026-08-11

   CZK 351 million (approx. EUR 14 million) by ÚOOÚ for unauthorised processing of antivirus-user personal data, handled via the One Stop Shop mechanism

   Úřad pro ochranu osobních údajůT1Confirmed

2. 2

   FRController/Processor Duties2026-01-22

   CNIL fined France Travail €5m (22 Jan 2026) and Free/Free Mobile €42m combined (13 Jan 2026) for Article 32 security failures and DPIA-implementation gaps.

   CNILT1Confirmed

3. 3

   CHEnforcement & Redress2026-09-29

   FDPIC concluded its BLT bodycam investigation, prohibiting the processing, in a decision dated 29 September 2026 (published 1 October 2026).

   FDPICT1Confirmed

4. 4

   MTEnforcement & Redressdate pending

   A 2026 decision fined an insurer EUR 1,000 for direct-marketing recidivism; fine quanta remain far below GDPR statutory ceilings.

   Laws of Malta (via IDPC)T1Confirmed

5. 5

   US-DEController/Processor Duties2026-09-02

   HB380 imposes new third-party due-diligence and contract-flow-down duties plus prescriptive DPIA requirements; HB381 (in force) adds an early/independent 60-day AG breach-notice duty and narrows the GLBA/HIPAA safe harbor.

   National Law ReviewT3Confirmed

6. 6

   THAlgorithmic, Biometric & Surveillance Governance2025-11-01

   PDPC ordered halt and deletion of biometric data (~1.2M users) from an iris-scan-for-crypto-token service (reported as World/Worldcoin), Nov 2025.

   Chambers and PartnersT3Confirmed

7. 7

   CRAlgorithmic, Biometric & Surveillance Governance2026-05-04

   Prodhab Resolucion 029-2026-RF found the TSE's VID biometric-verification service unlawful absent informed consent; TSE's appeal is unresolved as of this cycle.

   La NacionT2Probable

8. 8

   DERegulator & Framework2026-10-01

   Hennemann succession completed 1 Oct 2026; DADG institutional split (Bundesnetzagentur / BfDI) reaffirmed from prior cycle.

   BfDI (official)T1Confirmed

9. 9

   BRChildren & Vulnerable Groups2026-08-25

   BRL 153.7M TikTok fine for minors'-data violations; Digital ECA transparency-report deadline 17 Sep 2026.

   DataGuidanceT2Probable

10. 10

    PTEnforcement & Redress2026-01-14

    Constitutional Court upheld CNPD's EUR1.25m fine against Lisbon Municipality (Jan 2026).

    CNPDT1Confirmed

11. 11

    IEEnforcement & Redress2026-09-21

    DPC fined Google Ireland EUR 403 million on 21 Sept 2026, closing a six-year inquiry; held items (HSE EUR 645,000; TikTok EUR 530m upheld) carried forward.

    The Irish TimesT3Probable

12. 12

    EGRegulator & Framework2025-11-02

    PDPC licensing portal remains unlaunched as at 10 September 2026, weeks before the 31 October 2026 grace-period expiry.

    Lexis Middle EastT3Probable

13. 13

    US-DERegulator & Framework2026-09-02

    HB380 lowers DPDPA applicability thresholds (35,000->10,000 general; 10,000->5,000 data-sale-revenue) and extends scope to third parties acquiring data from controllers, effective Jan 1 2027.

    Hunton Andrews KurthT3Probable

14. 14

    JPRegulator & Framework2026-07-17

    APPI amended by Act No. 56 of 2026, introducing a surcharge regime and new biometric category; penalties effective Jan 2027, main body ~2028.

    A&O ShearmanT3Probable

15. 15

    US-VTRegulator & Framework2026-06-16

    VDPOSA (Act 145/S.71) and AADC (Act 63/S.69) both enacted June 2026, neither yet in force; AG will be exclusive enforcer of VDPOSA from 2028.

    Troutman PrivacyT3Probable

16. 16

    KRRegulator & Framework2026-03-10

    March 2026 PIPA amendment commencing 11 Sep 2026 raises penalty ceiling and governance responsibility.

    DGC Briefings - Korea's New PIPA AmendmentsT3Probable

17. 17

    GG-ALDEnforcement & Redress2025-11-26

    ODPA partially upheld a complaint against the States of Alderney (26 Nov 2025), finding a breach of subject-access rights (s.15).

    ODPA public statement - States of Alderney complaintT1Confirmed

18. 18

    LATAMEnforcement & Redressdate pending

    ANPD's BRL 153.7M fine against ByteDance Brazil is its largest enforcement action to date.

    Daniel LawT3Probable

19. 19

    TWRegulator & Frameworkdate pending

    PDPA amendments establish the independent PDPC; commencement and Organic Act passage still pending.

    Acclime - Taiwan's 2026 Personal Data Protection Act Changes for InvestorsT3Probable

20. 20

    BRRegulator & Framework2026-02-25

    Lei 15.352/2026 confirms ANPD's permanent independent-agency status with cessation powers.

    AI Risk AwareT3Probable

21. 21

    IELawful Processing & Special Data2026-09-25

    DPC's 21 Sept 2026 Google decision found infringements of Arts 5, 6, 12 and 13 in location-data processing.

    LicentiumT4Probable

22. 22

    TWController/Processor Dutiesdate pending

    Mandatory breach notification introduced; draft subordinate regulations propose a 72-hour reporting deadline; DPO requirements reported for large organisations.

    Legal 500 Country Comparative Guides - Taiwan TMTT3Probable

23. 23

    KREnforcement & Redress2026-03-10

    Fine ceiling raised from 3% to 10% of total turnover; NCRC fined KRW885.2m.

    RecordingLaw - South Korea Data Privacy LawsT4Probable

24. 24

    US-CTAdTech & Commercial Privacy2026-10-01

    PA 26-64 (eff. 1 October 2026) bans sale/sharing/transfer of precise geolocation data and imposes surveillance-pricing restrictions.

    WilmerHaleT3Probable

25. 25

    US-CTAlgorithmic, Biometric & Surveillance Governance2026-10-01

    PA 26-64 adds facial-recognition and genetic-data requirements (eff. 1 October 2026); PA 25-113 adds an LLM-training-disclosure duty (eff. 1 July 2026).

    ProskauerT3Probable

26. 26

    US-CTRegulator & Framework2026-07-01

    PA 25-113 (eff. 1 July 2026) lowered the CTDPA applicability threshold to 35,000 consumers; PA 26-64 (eff. 1 October 2026) adds data-broker registration, geolocation-sale ban, surveillance-pricing restrictions, facial-recognition and genetic-data provisions.

    Snell & WilmerT3Probable

27. 27

    BREnforcement & Redress2026-02-25

    Seven sanctioning decisions to date; ANPD gains cessation power under Lei 15.352/2026; procedural-review consultation opened.

    RecordingLawT3Probable

28. 28

    PTRegulator & Framework2026-04-15

    CNPD approved 2027-2029 strategic plan; Lei 12-A/2026 gives CNPD new DSA co-competences.

    ANACOM / Diário da RepúblicaT1Probable

29. 29

    US-DELawful Processing & Special Data2026-09-08

    HB380 expands sensitive-data definition to include inferred national origin, immigration status, diagnosis/treatment status, gender identity, neural data, financial credentials and government ID.

    Consumer Financial Services Law MonitorT3Probable

30. 30

    US-OKRegulator & Framework2026-05-06

    SB 546 (OKCDPA) and SB 626 establish Oklahoma's first comprehensive privacy regime.

    ClymT4Probable

31. 31

    BRController/Processor Dutiesdate pending

    Breach-notification duty unchanged; ANPD opened a procedural-review consultation that could change enforcement process in a future cycle.

    DLA Piper Data Protection Laws of the WorldT3Probable

32. 32

    TZEnforcement & Redressdate pending

    PDPC penalties range TZS 100,000-20,000,000 and/or up to 10 years imprisonment; on-site inspections commenced 31 August 2026 following the final registration ultimatum.

    Tanzania InsightT3Probable

33. 33

    SGEnforcement & Redress2026-01-08

    8 January 2026 penalties against People Central and Singapore Data Hub; 26 February 2026 ransomware-linked decision with penalty and voluntary undertakings.

    Baker McKenzieT3Confirmed

34. 34

    BELawful Processing & Special Data2026-01-01

    New Recommendation 01/2026 on direct marketing published, clarifying consent/profiling/ADM treatment.

    Linklaters Data ProtectedT3Confirmed

35. 35

    CARegulator & Frameworkdate pending

    Bill C-36 (Protecting Privacy and Consumer Data Act), introduced 15 June 2026, is the privacy-only successor to the dead Bill C-27, unbundling AI regulation.

    PolicyGenT4Probable

36. 36

    US-UTData Subject Rights2026-07-01

    Right to correct inaccuracies commenced 2026-07-01, bringing Utah to five statutory consumer rights.

    CookiebotT3Probable

37. 37

    NOAdTech & Commercial Privacy2026-06-01

    Datatilsynet found six websites unlawfully shared visitor data with third parties (June 2026); fined Elkjøp AS EUR 1.82m for unlawful marketing/profiling.

    Enforcement Tracker — ETid-3193, Elkjøp AST3Probable

38. 38

    US-MDChildren & Vulnerable Groups2026-05-31

    HB711 (passed May 31, 2026) struck MODPA's age-13 floor, extending minor-data protections to all consumers under 18.

    EnzuzoT3Probable

39. 39

    MZRegulator & Framework2026-02-01

    Council of Ministers approved the Personal Data Protection Bill and referred it to the Assembly in March 2026; INTIC is designated to become the ANPD once enacted.

    DataProtection.AfricaT3Probable

40. 40

    US-ORChildren & Vulnerable Groups2026-01-01

    Ban on sale of minors' personal data effective January 1, 2026.

    Mac Murray & Shuster - One Year Into Oregon's OCPAT3Probable

41. 41

    US-VAChildren & Vulnerable Groups2026-01-01

    SB854 (effective Jan 1, 2026) mandates age-screening and screen-time limits for under-16 social media users; under active NetChoice First Amendment/Commerce Clause challenge.

    Woods RogersT3Probable

42. 42

    BGEnforcement & Redressdate pending

    CPDP published no decisions in 2024-2025; NRA-breach damages case referred to CJEU.

    Lex MundiT3Probable

43. 43

    CNRegulator & Frameworkdate pending

    Amended CSL effective 1 Jan 2026 is the most substantial amendment since 2017; extraterritorial scope broadened.

    DLA Piper Data Protection Laws of the WorldT3Probable

44. 44

    US-OKLawful Processing & Special Data2026-03-27

    Sensitive-data opt-in consent regime under SB 546.

    WilmerHale Privacy and Cybersecurity Law BlogT3Probable

45. 45

    IDEnforcement & Redressdate pending

    Administrative sanctions under UU PDP remain structurally unavailable pending Agency establishment, notwithstanding the statute's criminal-sanction enforceability via the public prosecutor.

    DLA Piper Data Protection Laws of the WorldT3Probable

46. 46

    US-KYEnforcement & Redress2026-01-01

    30-day cure period, penalties up to $7,500 per violation, no private right of action; AG posture educational in early 2026.

    Bricker GraydonT3Probable

47. 47

    SKController/Processor Dutiesdate pending

    UOOU's own procedural deadline (90 days, extendable by 180) confirmed; draft criminal-justice law would add a 72-hour breach-notification duty for that sector.

    UOOUT1Confirmed

48. 48

    MYEnforcement & Redressdate pending

    Maximum fine for a data-protection-principle breach raised to RM1,000,000, more than tripling the prior RM300,000 cap.

    InCorp MalaysiaT4Probable

49. 49

    TZController/Processor Duties2026-08-31

    PDPC on-site inspections began 31 August 2026, assessing DPO appointment/function.

    The RespondentsT3Probable

50. 50

    DOEnforcement & Redress2026-08-01

    New Penal Code (in force August 2026) establishes offences against private information in automated systems, extending liability to legal entities, outside but materially relevant to this window.

    MultilawT3Probable

51. 51

    US-NEAdTech & Commercial Privacy2026-07-17

    LB838's AAODCA amendment prohibits privacy-degrading dark patterns targeting minors.

    Troutman Pepper LockeT3Probable

52. 52

    NGSectoral Watch2026-06-15

    CBN's 2026 payments-data-localisation circular explicitly invokes the NDPA framework for the financial sector.

    Economic ConfidentialT3Probable

53. 53

    US-VAAdTech & Commercial Privacy2026-04-13

    SB338 (effective July 1, 2026) prohibits controllers from selling or offering to sell consumers' precise geolocation data, making Virginia the third US state with such a ban.

    Regulatory Oversight (law firm blog)T3Probable

54. 54

    US-MDRegulator & Framework2026-04-01

    MODPA remains in force with AG enforcement active since April 1, 2026; no change to the statute's core scope this cycle.

    Verified CredentialsT3Probable

55. 55

    PLEnforcement & Redress2026-02-23

    Standing enforcement posture: UODO continues active fining practice in 2026, with decisions totalling close to PLN 7 million, the largest (~PLN 5.9M) against Restaurant Partner Polska (Glovo). DPD Polska PLN 11M fine (Feb 2026) and NSA affirmance of a PLN 52,000 fine (Aug…

    DataGuidanceT3Probable

56. 56

    EEACross-Border & Adequacy2026-01-26

    EU-Brazil mutual adequacy decision (Jan 2026) extends to the EEA-EFTA states.

    Baker McKenzieT3Probable

57. 57

    ROEnforcement & Redressdate pending

    ANSPDCP maintained an active enforcement cadence through 2026: fines against Continental Automotive Products (health-data breach), SC Hayat Dent SRL (non-cooperation), evita-teparii.ro operator (four fines, special-category data), and Roumasport.

    Recording LawT3Probable

58. 58

    THController/Processor Duties2025-10-09

    9 October 2025 Royal Gazette notification made DPO appointment mandatory for all state agencies.

    Cookie InformationT3Confirmed

59. 59

    US-MESectoral Watchdate pending

    New workplace-surveillance statute LD 61 takes effect July 2026, enforced via Department of Labor.

    State Regs TodayT3Confirmed

60. 60

    ATEnforcement & Redress2026-06-24

    DSB conducted 4,030 proceedings in 2023 but issued only 55 fines (1.36%); Österreichische Post fine litigation continues, with a reported EUR 13m + EUR 100,000 costs figure disputed against an earlier EUR 16m figure.

    Recording LawT4Disputed

61. 61

    CA-BCLawful Processing & Special Data2026-05-05

    Joint OIPC/OPC OpenAI investigation found PIPA's consent framework inadequate for AI processing.

    Office of the Information and Privacy Commissioner for British ColumbiaT1Probable

62. 62

    INEnforcement & Redress2027-05-13

    Penalty schedule up to INR 250 crore per violation; DPBI operational/staffing status is disputed between sources; appeals lie to TDSAT.

    syslabs.inT4Probable

63. 63

    US-ALEnforcement & Redress2026-04-17

    APDPA and HB161 both vest exclusive enforcement in the AG with no private right of action; APDPA carries civil penalties up to $15,000/violation with mandatory 45-day cure.

    RecordingLaw.comT4Probable

64. 64

    LKEnforcement & Redressdate pending

    Penalty regime (Part VII) not yet in force; once commenced, penalties up to LKR 10 million per non-compliance instance apply.

    Hashtag CodersT4Probable

65. 65

    AUAlgorithmic, Biometric & Surveillance Governance2026-09-28

    New automated-decision-making transparency obligation commences 10 December 2026.

    MinterEllisonT3Probable

66. 66

    AULawful Processing & Special Data2026-08-31

    Proposed statutory 'fair and reasonable' test would replace much of APP 3/4/6, supported by simplified APP 5 notification.

    Ashurst Perkins CoieT3Probable

67. 67

    MZAdTech & Commercial Privacy2026-06-02

    INCM Resolution of 2 June 2026 requires prior opt-in consent for promotional SMS, with a free global-blocking mechanism and phased compliance deadlines.

    360 MozambiqueT2Probable

    Also tracked by advennt:operational_obligations

68. 68

    KEEnforcement & Redressdate pending

    96 complaints determined in 2025; High Court upheld ODPC's Regus Kenya determination; Amendment Bill proposes graduated administrative penalties above current KES 5m/1% cap.

    OLM LawT3Probable

69. 69

    US-MERegulator & Frameworkdate pending

    LD 1822 (Maine Online Data Privacy Act) reportedly stalled on procedural House vote as of April 2026; no comprehensive law in force.

    Recording LawT3Confirmed

70. 70

    CA-ABData Subject Rights2026-08-19

    OIPC Order PIPA2026-03 (Aug 19, 2026) clarified access-right scope boundary against Wawanesa Mutual Insurance.

    OIPC AlbertaT1Confirmed

71. 71

    LULawful Processing & Special Data2026-03-12

    Amazon case remand confirms legitimate interest insufficient for behavioural-advertising processing.

    LuxgapT3Probable

72. 72

    CA-TFNRegulator & Frameworkdate pending

    TGC Privacy Policy retrieved; no dedicated statute or supervisory authority identified for CA-TFN.

    Tobique Gaming CommissionT1Confirmed

73. 73

    US-VTEnforcement & Redress2026-06

    AG joined the Consortium of Privacy Regulators August 4, 2026, ahead of VDPOSA's 2028 enforcement start.

    DataBreachCost.comT4Probable

74. 74

    KHController/Processor Duties2026-04-07

    April 2026 anti-scam law criminalises malicious personal-data collection; general controller/processor duty framework remains pending.

    Phnom Penh PostT2Probable

75. 75

    TRAlgorithmic, Biometric & Surveillance Governance2026-01-09

    Draft Law (9 Jan 2026) proposes amending KVKK Art. 18 to impose 5% turnover-based platform liability for unconsented AI-generated-content sharing.

    CMS LawT3Probable

76. 76

    US-CTLawful Processing & Special Data2026-07-01

    PA 25-113 expanded the sensitive-data definition (government IDs, financial-account data, SSNs, neural data) and newly prohibits sale of sensitive data without consent.

    Legal 500 / BeneschT3Probable

77. 77

    US-SDData Subject Rights2026-07-01

    SB49 grants access/deletion rights for genetic data and biological samples.

    KOTA TVT3Probable

78. 78

    UKEnforcement & Redress2026-06-19

    New statutory complaints-handling duty (s.164A DPA 2018) in force since June 2026; new right to complain directly to controllers.

    KennedysT3Probable

79. 79

    LUEnforcement & Redressdate pending

    Amazon EUR 746m fine annulled on fault-standard grounds; case remitted to CNPD for fault/penalty reassessment.

    LinklatersT3Probable

80. 80

    MYCross-Border & Adequacydate pending

    CBPDT Guidelines officially launched, replacing the original whitelist-only cross-border transfer approach.

    Mayer BrownT3Probable

81. 81

    CA-ABController/Processor Dutiesdate pending

    Bill 31's AGLC/POPA data-sale carve-out is a material standing exception flagged by the OIPC as a 'concerning precedent'.

    Sherlock ForensicsT4Probable

82. 82

    JPChildren & Vulnerable Groupsdate pending

    New Article 40-2 parental/legal-representative consent duty for minors under 16, enacted but not yet in force.

    Hello World JapanT4Probable

83. 83

    GREnforcement & Redressdate pending

    HDPA launched the EDPB 2026 Coordinated Enforcement Action (CEF) on Transparency and the Right to Information of Data Subjects.

    Hellenic Data Protection AuthorityT1Confirmed

84. 84

    CASectoral Watchdate pending

    Joint OPC/CAI/BC/Alberta investigation into OpenAI's ChatGPT (PIPEDA Findings #2026-002) illustrates multi-regulator cross-sectoral coordination on AI-adjacent personal-information handling.

    Office of the Privacy Commissioner of CanadaT1Probable

85. 85

    RURegulator & Frameworkdate pending

    152-FZ amended by 266-FZ (2022), 23-FZ (2025), 420-FZ (2025), 421-FZ (2024/2025); Roskomnadzor remains the primary DPA and site-blocking authority.

    Recording LawT4Uncertain

86. 86

    US-CTEnforcement & Redress2027-01-01

    PA 26-64 authorizes DCP civil penalties of up to $200/day/consumer for data-broker-registration violations, effective 1 January 2027.

    Hunton Andrews KurthT3Probable

87. 87

    US-DEAlgorithmic, Biometric & Surveillance Governance2026-07-17

    HB380 broadens profiling-opt-out scope by removing the 'solely' automated-decision qualifier and prohibits profiling that violates anti-discrimination law; no biometric-specific change identified.

    Global Policy Watch (Epstein Becker Green)T3Probable

88. 88

    US-VTLawful Processing & Special Data2026-05-29

    VDPOSA's sensitive-data definition and health-data sale prohibition are enacted but not yet in force.

    McDermott Will & EmeryT3Probable

89. 89

    US-MDEnforcement & Redress2026-04-01

    AG enforcement of MODPA began April 1, 2026; penalties up to $10,000/$25,000; no private right of action.

    OneTrustT3Probable

90. 90

    US-OKController/Processor Duties2026-01-01

    DPIA duty prospectively; breach-notification duty already in force under SB 626.

    Constangy Cyber AdvisorT3Probable

91. 91

    COEnforcement & Redressdate pending

    Current statutory fine cap is 2,000 SMMLV; a Proyecto de Ley Estatutaria filed Aug 2025 proposes raising the ceiling to 10,000 SMMLV or 5% of operational revenue, still pending, not enacted.

    Asesorias JuridicasT3Probable

92. 92

    LKController/Processor Dutiesdate pending

    Part III (Controllers and Processors) set to commence 1 January 2027; substantive DPIA/DPO/breach-notification detail not yet independently verified.

    VarnersT3Probable

93. 93

    NZEnforcement & Redressdate pending

    OPC lacks GDPR-equivalent direct administrative fining powers despite NZ's EU adequacy status; the Manage My Health breach notification is the notable enforcement-adjacent event this cycle.

    Chambers and PartnersT3Probable

94. 94

    SKAdTech & Commercial Privacydate pending

    EUR 355,188 fine for GDPR Art 13 information-duty breach, now under CJEU preliminary reference; cookie fine band up to 5% of turnover under Electronic Communications Act s124(3).

    Securion.skT3Probable

95. 95

    US-NEEnforcement & Redressdate pending

    NetChoice v. Hilgers preliminary injunction is the dominant recent development.

    White & CaseT3Probable

96. 96

    DZAlgorithmic, Biometric & Surveillance Governance2026-05-06

    ANPDP Decision No.3 (6 May 2026) regulates biometric attendance-monitoring systems, requiring prior declaration and purpose-limitation.

    GideT3Probable

97. 97

    RSAdTech & Commercial Privacy2026-04-23

    New Consumer Protection Act (Art 20.1) targets fake reviews and non-transparent sponsored search placement, effective 23 April 2026.

    BDK AdvokatiT3Probable

98. 98

    SGLawful Processing & Special Data2026-07-20

    PDPC finalised GenAI Advisory Guidelines 20 July 2026 clarifying publicly-available exception and notification insufficiency for AI-training use.

    IAPPT3Confirmed

99. 99

    SGAlgorithmic, Biometric & Surveillance Governance2026-05-20

    IMDA published Model AI Governance Framework for Agentic AI (v1.5) 20 May 2026, updated 5 June 2026, alongside GenAI Guidelines addressing transparency/hallucination-bias risk.

    Latham & WatkinsT3Confirmed

100. 100

     AEData Subject Rights2026-09-28

     PDPL provides access, rectification, erasure, restriction and portability rights per secondary commentary.

     DLA Piper Data Protection Laws of the WorldT3Probable

Regulatory horizon

• ARExpediente 3397-D-2026 comprehensive DP reform bill2026-Q4year
• ARExpediente 1751-D-2026 comprehensive DP reform bill2026-Q4year
• ATEU-US DPF adequacy ruling expected2027year
• ATEU Digital Omnibus cookie-consent exemption2027-Q2multi year
• ATEU cross-border GDPR enforcement cooperation rules apply2027-04year
• AUChildren's Online Privacy Code registered2026-12-10quarter
• AUAutomated-decision-making transparency obligation commences2026-12-10quarter
• AUPrivacy Tranche 2 Bill expected introduction to Parliament2026-Q4half year
• BDNational Data Governance Authority reaches full operability2027-Q2half year
• CA-NBPossible RTIPPA amendment bill implementing June 2026 review recommendations2026-Q4half year
• CA-ONBill 97 remaining commencement tranches2027-01-01half year
• CLLey 21.719 effective date (current, contested)2026-12-01quarter
• CLProposed postponement of Ley 21.719 to Dec 20272027-12-01half year
• CMLaw No. 2024/017 transition period ends; full enforcement appliesclosed 2026-06-23quarter
• EEAEU AI Act EEA Joint Committee incorporation decision (draft, pending)2027-Q1multi year
• FRCNIL email tracking pixel consent deadlineclosed 2026-07-14quarter
• INDPDP Rules Consent Manager registration (Phase 2)2026-11-13quarter
• INDPDP full substantive-obligation enforcement2027-05-13quarter
• KHDraft Law on Personal Data Protection enactment2027year
• KRPIPA amendment (penalty ceiling, CEO liability, CPO governance) takes effectclosed 2026-09-11quarter
• KRISMS-P certification deadline for certain entities2028-12-31multi year
• KRISMS-P audit-strengthening Enforcement Decree consultation closes2026-10-26quarter
• LAPossible GDPR-inspired revision of Law on Electronic Data Protection2027-Q1multi year
• LKPDPA Parts I and III commence2027-01-01quarter
• LKPDPA Part II (data-subject rights) and Part VII (penalties) commencement2027-Q2half year
• MOMacau Advertising Law (Law No. 7/2026) enters into force2027-01-01quarter
• NORegulation (EU) 2025/2518 cross-border GDPR enforcement procedure applies2027-04-01quarter
• NOProposed increase of digital consent age from 13 to 152026-Q4half year
• SASDAIA proposed Implementing Regulations amendments (DPO, registration, marketing/complaints)closed 2025-05-27year
• SGNRIC-authentication use ban compliance deadline2026-12-31quarter
• THPDPC six-area guideline consultation outcome expected2026-Q4half year
• TWPDPA amendments effective date to be set by Executive Yuan2027-Q1half year
• TWPDPC breach-notification subordinate regulations expected2026-Q4half year
• US-ALAPDPA becomes effective2027-05-01quarter
• US-ALApp Store Accountability Act (HB161) takes general effect2027-01-01quarter
• US-ALHB161 retroactive account-verification deadline2027-10-01quarter
• US-COSB26-189 ADMT Act takes effect2027-01-01quarter
• US-COCPA minors'/biometric notice-and-cure sunsets2026-12-31quarter
• US-CTCT data-broker registration program commences2027-01-01quarter
• US-DEHB380 DPDPA amendments take effect2027-01-01quarter
• US-GASB 540 (Conversational AI Safety Act) in force2027-07-01quarter
• US-IDIdaho digital-ID limitation law (SB1299 / Idaho Code §67-2364) in forceclosed 2026-07-01quarter
• US-IDIdaho Stop Harms from Addictive Social Media Act (HB542) in forceclosed 2026-07-01quarter
• US-MELD 1822 (Maine Online Data Privacy Act) final disposition2026-Q4year
• US-MELD 61 workplace-surveillance law takes effectclosed 2026-07-01quarter
• US-MNMCDPA postsecondary institution compliance deadline2029-07-31multi year
• US-NEAAODCA amendment (LB838) enters into forceclosed 2026-07-17quarter
• US-NYStatewide NY Biometric Privacy Act (S1422A) Assembly action2027-Q1half year
• US-OROCPA notice-and-cure requirement expiredclosed 2026-01-01quarter
• US-OROCPA opt-out signal recognition and geolocation-sale ban take effectclosed 2026-01-01quarter
• US-OROCPA ban on sale of minors' personal data takes effectclosed 2026-01-01quarter
• US-TXCCIA v. Paxton Fifth Circuit constitutional hearing on App Store Accountability Act2026-Q4half year
• US-UTHB 357 motor-vehicle data scope expansion in force2027-01-01quarter
• US-WVWV crypto-kiosk elder-fraud due-diligence mandate effective2027-01-01quarter
• US-WYDeepfake/synthetic-imagery reporting duty effectiveclosed 2026-07-01quarter
• US-WYSelect Committee AI/surveillance bill drafts discussed2027-Q1half year
• UYOpen Finance bill Chamber of Deputies progress2026-Q4half year