Data Protection Monitor — 2026-10-11

New or updated since 2026-10-04

New to this edition or changed since the last one.

1. 1

   US-DCEnforcement & Redress2026-09-26

   D.C. Law 26-187 materially strengthens the AG's enforcement toolkit (asset freezes, mandatory minimum penalties, interrogatories), extending to CPPA enforcement of breach-notification violations.

   DC CouncilT1Confirmed

   Also tracked by crypto:consumer_protection, world-payments:W1b

2. 2

   US-MEChildren & Vulnerable Groups2026-08-26

   Maine joined the $17.1B multistate Meta child-safety settlement (announced Aug 26, 2026), receiving at least $56M and mandating Meta-side age/time-limit/parental-control changes.

   Maine AGT1Confirmed

3. 3

   ATEnforcement & Redress2026-06-24

   VwGH final decision (24 June 2026) in the Österreichische Post 'party-affinity' case; now-final €13,000,000 fine, Austria's largest confirmed GDPR fine.

   DatenschutzbehördeT1Confirmed

4. 4

   COAlgorithmic, Biometric & Surveillance Governance2026-06-18

   SIC's final 18 June 2026 ruling permanently shut down World/Worldcoin's iris-biometric operation.

   SICT1Confirmed

   Also tracked by crypto:consumer_protection

5. 5

   US-MNEnforcement & Redress2026-01-31

   Cure period expired 2026-01-31; full-enforcement posture announced 2026-02-05 following 200+ complaints.

   MN AG Press ReleaseT1Confirmed

6. 6

   US-OREnforcement & Redress2026-01-01

   The OCPA's mandatory 30-day cure period expired 1 January 2026; the AG may now proceed directly to enforcement, a material tightening now nine months standing.

   Oregon Department of JusticeT1Confirmed

7. 7

   CAEnforcement & Redressdate pending

   OPC 2025-26 annual report (joint TikTok investigation); new breach investigation opened 21 Sept 2026; Federal Court notice of application on Google de-listing filed 28 Aug 2026; OPC lacks binding-order/AMP power under PIPEDA pending Bill C-36.

   Office of the Privacy Commissioner of CanadaT1Confirmed

8. 8

   US-MAEnforcement & Redressdate pending

   Two settlements since mid-2026: Peabody Properties ($795,000, 2026-08-19) and the 23andMe multistate genetic-data settlement ($18M, MA one of 42 AGs).

   Massachusetts Attorney General's OfficeT1Confirmed

9. 9

   US-RIController/Processor Dutiesdate pending

   Hasbro Inc. notified the RI AG of a ~608-resident breach on 7 October 2026, the first high-profile live application of the breach-notification duty this window.

   Rhode Island General AssemblyT1Confirmed

10. 10

    JPRegulator & Frameworkdate pending

    Act No. 56 of 2026 (promulgated 2026-07-17) significantly broadens PPC enforcement powers; implementation expected within two years of promulgation.

    Personal Information Protection CommissionT1Confirmed

11. 11

    US-LALawful Processing & Special Data2026-05-29

    LDPA applicability thresholds and a drafting gap on pseudonymous data were identified.

    Louisiana State LegislatureT1Confirmed

12. 12

    DZController/Processor Duties2025-12-24

    Mandatory DPO appointment (ANPDP deliberation, 24 Dec 2025), workplace video-surveillance rules (4 Mar 2026), 5-day breach notification duty under Law 25-11.

    APST1Probable

13. 13

    LIController/Processor Dutiesdate pending

    VwbP cyberattack classified as Art. 33 personal data breach; Art. 34 individual notification ongoing since 4 Aug 2026; register access still restricted as of 5 Oct 2026.

    Government of the Principality of LiechtensteinT1Probable

14. 14

    FIEnforcement & Redress2026-05-08

    Three dated Sanctions Board fines (Mindemo, Suomen Numerokeskus, MLU B.V./Yango) plus a live Supreme Administrative Court appeal (Verkkokauppa.com).

    Edilex indexT1Probable

15. 15

    MHRegulator & Frameworkdate pending

    Personal Data Protection Act 2025 enacted (MH's first dedicated data-protection statute); EPSSO designated competent authority; binds only core Government ministries/agencies, not the private sector.

    Nitijela (RMI Parliament)T1Probable

16. 16

    GRAlgorithmic, Biometric & Surveillance Governance2026-10-11

    Law 5321/2026 assigns HDPA AI Act market-surveillance, complaints-handling and conformity-assessment roles.

    Hellenic Data Protection AuthorityT1Confirmed

17. 17

    US-MOAlgorithmic, Biometric & Surveillance Governance2026-09-16

    Executive Order 26-18 (16 Sep 2026) establishes statewide ALPR safeguards; DPS implementing guidance published 30 Sep 2026.

    Office of the Governor of MissouriT1Confirmed

18. 18

    FRSectoral Watch2026-09-12

    EU Data Act Art. 3(1) design-for-access obligation applied from 12 September 2026; French national penalty framework (DDADUE bill) remains pending before the National Assembly.

    CNILT1Confirmed

19. 19

    FRController/Processor Duties2026-09-03

    €500,000 CNIL sanction against HÔPITAL PRIVÉ DE LA LOIRE (3 September 2026) for Art. 32 security-measure failures protecting health data.

    CNILT1Confirmed

20. 20

    MXEnforcement & Redress2026-07-12

    SABG fined FMF MXN 42,849,095 for FAN ID biometric data-protection breaches, 12 Jul 2026.

    Secretaría Anticorrupción y Buen GobiernoT1Confirmed

21. 21

    US-SDLawful Processing & Special Data2026-07-01

    SB 49 Genetic Data Privacy Act entered force 2026-07-01, creating a sectoral consent regime.

    South Dakota LegislatureT1Confirmed

22. 22

    US-VALawful Processing & Special Data2026-07-01

    SB338 reclassified precise geolocation from consent-based sensitive-data processing to an outright sale ban.

    Virginia Legislative Information SystemT1Confirmed

23. 23

    NOEnforcement & Redress2026-06-04

    Datatilsynet imposed a NOK 20 million overtredelsesgebyr on Elkjøp AS on 4 June 2026 for unlawful customer-club data processing affecting over six million Nordic members.

    DatatilsynetT1Confirmed

24. 24

    US-NHChildren & Vulnerable Groups2026-06-19

    HB 1460 prohibits sale of a known child's data regardless of consent, effective 2027-01-01.

    New Hampshire General CourtT1Confirmed

25. 25

    AGSectoral Watchdate pending

    Payment Systems and Services Act 2025 s.63 financial-sector overlay newly identified.

    Government of Antigua and BarbudaT1Confirmed

    Also tracked by world-payments:W1a

26. 26

    SEController/Processor Dutiesdate pending

    IMY fined Miljödata SEK1.8m for Art 32(1) security-of-processing failures following the August 2025 ransomware attack.

    IMYT1Confirmed

27. 27

    ITEnforcement & Redress2026-09-23

    At least three enforcement decisions surfaced or were publicised within the window, led by the Eur7m IQVIA fine.

    LaPresseT2Probable

28. 28

    BREnforcement & Redress2026-09-16

    ANPD fined ByteDance (TikTok) R$153.7m in September 2026 for unlawful processing of children's data; cumulative sanctioning processes reached 33 by mid-2026; a consultation to expand ANPD's investigative powers is open to 26 October 2026.

    ANPDT2Probable

29. 29

    NLEnforcement & Redress2026-08-21

    Record-size AP fine against Uber (EUR824,990,000), under appeal.

    Computable.nlT2Probable

30. 30

    CREnforcement & Redress2026-05-22

    Prodhab Resolution 029-2026-RF cancelled the Civil Registry database's Prodhab registration as a sanction against the TSE for unlawful biometric-data practice; TSE has filed a recurso de revocatoria with no confirmed outcome.

    El Mundo CRT2Probable

31. 31

    NZAlgorithmic, Biometric & Surveillance Governance2026-08-03

    Biometric Code grace period for existing users ended 3 August 2026.

    Office of the Privacy CommissionerT1Confirmed

32. 32

    GICross-Border & Adequacy2026-07-15

    UK-EU Treaty on Gibraltar's data-protection provisions in force since 15 July 2026, amending Art 45(1) transfer-destination list and Art 46 fallback mechanisms.

    HM GovernmentT1Probable

33. 33

    GIEnforcement & Redress2026-07-15

    Higher Art 83 fine tier confirmed at £17.5m/4% (lower tier £8.7m/2%), in force from 15 July 2026.

    Gibraltar LawsT1Probable

34. 34

    TRChildren & Vulnerable Groups2026-10-10

    New Presidency-of-Cybersecurity regulation bans under-15 social-media accounts from 1 November 2026.

    PPC LandT2Probable

35. 35

    US-KYEnforcement & Redress2026-10-07

    AG filed an unredacted version of the Character.AI complaint on 2026-10-07/08, disclosing specific chatbot exchanges; reported by Reuters on 2026-10-11.

    NWA Online (Reuters)T2Probable

36. 36

    GRController/Processor Duties2026-07-28

    HDPA Decision No. 15 (28 July 2026): EUR350,000 combined fine for Art 28(3)/32(1) violations following a breach affecting ~2.5m data subjects.

    DataGuidanceT2Probable

37. 37

    PLEnforcement & Redress2026-03-11

    Multiple 2026 fines (DPD Polska PLN 11m, Glovo ~PLN 5.9m, court bailiff PLN 15,500, Kraków entrepreneur PLN 31,507) and a significant reversal: a Provincial Administrative Court overturned UODO's PLN 27m fine against Poczta Polska.

    DataGuidanceT2Probable

38. 38

    UGCross-Border & Adequacy2026-02-20

    PDPO confirmed WhatsApp's compliance (17 July 2026) with the five corrective orders from its 20 Feb 2026 decision.

    New VisionT2Probable

39. 39

    BDRegulator & Framework2025-12-15

    PDPA 2026 and National Data Management Act 2026 establish the NDMA as supervisory authority; prior baseline of no regime is materially stale.

    The Daily StarT2Probable

40. 40

    CNRegulator & Framework2026-08-07

    Order No. 25 (small processors) in force 1 Sept 2026; Large Processor Provisions remain at consultation.

    Cyberspace Administration of ChinaT1Confirmed

41. 41

    TWRegulator & Framework2025-11-11

    PDPA amended 2025-11-11 to create the PDPC as sole competent authority; commencement date not yet fixed.

    LawBankT1Probable

42. 42

    GIChildren & Vulnerable Groups2026-07-15

    Digital age of consent recodified to 13 in Gibraltar GDPR Art 8(1) from 15 July 2026.

    Gibraltar LawsT1Confirmed

43. 43

    GHAlgorithmic, Biometric & Surveillance Governance2026-06-09

    L.I. 2523 mandatory biometric Ghana Card verification entered force 9 June 2026.

    National Identification AuthorityT1Confirmed

44. 44

    US-COEnforcement & Redressdate pending

    Meta settlement and reported AdTech GPC enforcement action both fall within the 180-day window.

    Colorado Attorney GeneralT1Probable

45. 45

    FIController/Processor Duties2026-10-08

    Mindemo Oy EUR33,000 fine for security-of-processing failures in health-adjacent booking data.

    Tietosuojavaltuutetun toimisto press releaseT1Probable

46. 46

    EEController/Processor Duties2026-10-01

    Record 251 breach notifications in 2025; EDPB Art 60 decision published October 2026; Apotheka appeal ongoing.

    EDPB / Estonian Data Protection InspectorateT1Probable

47. 47

    TRController/Processor Duties2026-10-08

    Principle Decision 2026/2035 imposes new employer-monitoring compliance duties following a Board finding of widespread unlawfulness.

    CBC LawT3Probable

48. 48

    ITAdTech & Commercial Privacy2026-10-05

    Tracking-pixel email-marketing guidelines entered into force; a separate decision sanctioned a bank over direct-marketing objection rights.

    Garante PrivacyT1Confirmed

49. 49

    TZEnforcement & Redress2026-08-28

    Nationwide on-site inspections began 28 August 2026; eighth-phase DPO training ran 7-8 October 2026 with 15,146 registrations and 445 complaints reported.

    The RespondentsT3Probable

50. 50

    KZController/Processor Duties2026-08-25

    Risk-based controller classification (small/medium/large), new breach register, and higher fines (up to 2,000 MCI) effective 25 August 2026.

    Rödl & PartnerT3Probable

51. 51

    KZRegulator & Framework2026-08-25

    Law No. 326-VIII (signed 24 June 2026) restructured the national statute; new personal-data definition effective 11 July 2026, most provisions effective 25 August 2026.

    EY KazakhstanT3Probable

52. 52

    NLAdTech & Commercial Privacy2026-07-01

    Telemarketing existing-customer exception removed.

    Business.gov.nlT1Confirmed

53. 53

    US-NJEnforcement & Redress2026-07-01

    Mandatory cure period sunset July 1, 2026; A5328 added $2,500/day and $50,000/record penalties.

    RecordingLawT3Probable

54. 54

    CLRegulator & Framework2026-05-20

    Senate rejected the Executive's first Consejo Directivo slate (20 May 2026); Agencia remains unseated; postponement bill (entered 1 Sept 2026) would delay full commencement from 1 Dec 2026 to 1 Dec 2027.

    Diario FinancieroT3Probable

55. 55

    VNCross-Border & Adequacy2026-01-01

    CBTIA dossier mandatory before cross-border transfer, submitted within 60 days, updated every 6 months or within 10 days of major corporate events; no adequacy mechanism exists.

    Vietnam BriefingT3Probable

56. 56

    VNRegulator & Framework2026-01-01

    PDPL (Law 91/2025/QH15) and Decree 356/2025/ND-CP, both effective 1 Jan 2026, replace Decree 13/2023/ND-CP as the primary instruments.

    Mori Hamada & MatsumotoT3Probable

57. 57

    INRegulator & Framework2025-11-14

    DPBI staffing status disputed between sources this cycle.

    Shardul Amarchand Mangaldas & CoT3Probable

58. 58

    EGRegulator & Framework2025-11-01

    PDPC electronic portal launched for licence/permit/accreditation applications ahead of 31 October 2026 grace-period expiry.

    Baker McKenzie InsightPlusT3Probable

59. 59

    AURegulator & Frameworkdate pending

    Exposure draft of second-tranche Privacy Amendment (Personal Data Protection) Bill 2026 published late August 2026; consultation closed 18 September 2026; intended introduction to Parliament before year-end 2026.

    Office of the Australian Information CommissionerT1Confirmed

60. 60

    MZRegulator & Frameworkdate pending

    Draft Personal Data Protection Law approved by Council of Ministers 4 March 2026, forwarded to Assembly; no enactment found through 2026-10-11.

    O PaísT2Probable

61. 61

    US-PARegulator & Framework2026-10-06

    HB 78 removed from the Senate table on 2026-10-06, still without a full floor vote.

    Pennsylvania General AssemblyT1Probable

62. 62

    US-NYEnforcement & Redress2026-09-24

    24 Sept 2026 multistate $2.3M Labcorp settlement is the most recent enforcement data point.

    New York Office of the Attorney GeneralT1Confirmed

63. 63

    LKRegulator & Framework2026-07-22

    Gazette Extraordinary No. 2498/16 fixed 1 January 2027 for Section 2, Section 3, Part I and Part III commencement.

    The Leveraged YearsT3Probable

64. 64

    IDCross-Border & Adequacy2026-07-16

    GR 33/2026 establishes a three-tier transfer framework, but instruments cannot yet be operationalised absent the PDP Authority.

    OneAsia LegalT3Probable

65. 65

    US-LARegulator & Framework2026-05-29

    Louisiana Data Privacy Act enacted 29 May 2026, effective 1 Jan 2027, with AG as exclusive enforcer.

    Troutman PepperT3Probable

66. 66

    BDCross-Border & Adequacy2026-05-20

    Feb 2026 Amendment Ordinance narrowed data-localisation to restricted/CII data only; general/internal/confidential data on foreign cloud exempted from mandatory local-copy rule.

    RecordingLawT3Probable

67. 67

    US-KSSectoral Watch2026-04-09

    New financial-institution elder-exploitation data-sharing/trusted-contact gateway enacted.

    Kansas LegislatureT1Confirmed

68. 68

    US-ILEnforcement & Redress2026-04-01

    Seventh Circuit held BIPA's 2024 damages-limitation amendment applies retroactively to pending cases, narrowing statutory-damages exposure in the litigation pipeline.

    Hunton Andrews KurthT3Probable

69. 69

    US-SDData Subject Rights2026-03-10

    SB 49 access/deletion rights (in force) and SB 111 portability rights (enacted, future-effective) both newly identified.

    South Dakota LegislatureT1Confirmed

70. 70

    US-ILAlgorithmic, Biometric & Surveillance Governance2026-01-01

    HB 3773's AI-employment notice duty remains in force, but implementing rules (Subpart J) were withdrawn 2026-06-02 with no refiling timeline announced.

    Gordon Rees Scully MansukhaniT3Probable

71. 71

    US-OKController/Processor Duties2026-01-01

    SB 626 strengthens breach notification (in force Jan 1, 2026) including a new AG-notice duty; OCDPA DPIA duties enacted but not yet effective.

    RecordingLaw.comT3Probable

72. 72

    CA-ONRegulator & Frameworkdate pending

    Bill C-36 would replace PIPEDA and the OPC; Bill C-15 data-mobility Division enacted but not in force

    recordinglaw.comT3Probable

73. 73

    LKController/Processor Dutiesdate pending

    Section 24 PDPIA duty (including amended call-in power at s.24(5)) now has a confirmed effective date of 1 January 2027.

    Concentric AIT3Probable

74. 74

    MTEnforcement & Redressdate pending

    Court of Appeal reduced a 2022 EUR250,000 fine to EUR200,000 (20 May 2026); IDPC fined an insurer EUR1,000 total for continued direct marketing after objection.

    IDPCT1Confirmed

75. 75

    SIController/Processor Dutiesdate pending

    ZVOP-2 Art 23 transitional deadline passed 26 Jan 2026; two employment-monitoring enforcement decisions illustrate current IP focus.

    Informacijski pooblascenec RST1Confirmed

76. 76

    RORegulator & Framework2026-09-05

    GDPR applies directly, supplemented by Law 190/2018; ANSPDCP is the sole national supervisory authority. No material change to the framework itself.

    ANSPDCPT1Confirmed

77. 77

    US-NMEnforcement & Redress2026-03-24

    Meta litigation produced a combined $942 million exposure across Phase 1 ($375m, 2026-03-24) and Phase 2 ($567m abatement fund, 2026-08-06); Meta has stated it will appeal.

    CNBCT2Probable

78. 78

    LUEnforcement & Redress2026-03-12

    Amazon EUR 746m fine annulled 12 March 2026; CNPD must reassess.

    Paperjam/DelanoT2Probable

79. 79

    CA-ABCross-Border & Adequacydate pending

    Bill C-36 (PPCDA), at second reading as of this cycle, expressly preserves PIPA's substantially-similar exemption for intra-Alberta commercial activity.

    Parliament of CanadaT1Probable

80. 80

    PWRegulator & Frameworkdate pending

    No dedicated DPA or omnibus statute; Privacy Act §205-206 and a Digital Residency Program sectoral cybersecurity regulation are the only instruments of record.

    Ministry of Finance, Republic of PalauT1Probable

81. 81

    US-CARegulator & Frameworkdate pending

    CPPA's ADMT/risk-assessment/cybersecurity-audit regulatory package took effect 1 January 2026; data-broker registration fee lowered to $6,000 for 2026.

    CPPA rulemaking pageT1Confirmed

82. 82

    CMRegulator & Framework2026-06-23

    New comprehensive statute (Law 2024/017) and independent authority (APDP) identified, superseding the prior ANTIC/cybersecurity-law-only framing; APDP not yet operational.

    AnoveT3Disputed

83. 83

    EEAAlgorithmic, Biometric & Surveillance Governance2026-07-27

    AI Act Digital Omnibus timeline re-verified unchanged.

    PraxikonT3Probable

84. 84

    CA-BCLawful Processing & Special Data2026-05-06

    OIPC-BC joint finding narrows implicit-consent reliance for AI training on scraped data.

    Office of the Information and Privacy Commissioner for BCT1Probable

85. 85

    MORegulator & Frameworkdate pending

    PDPB (not GPDP) is the current regulator per Administrative Regulation No. 42/2023, effective 1 February 2024.

    Personal Data Protection Bureau (PDPB), Macau SART1Confirmed

86. 86

    US-IDEnforcement & Redress2026-07-21

    AG recovered over $616,000 from two 2026 multistate data-related settlements (Block/Cash App, 23andMe); 49 formal enforcement cases in 2025, up from 17 in 2024.

    Idaho Office of Attorney GeneralT1Confirmed

87. 87

    JERegulator & Framework2026-02-02

    JOIC launched its 2026-2028 Strategic Plan (2 Feb 2026) with a more assertive enforcement posture; registration fee-model consultation ran Dec 2025-Feb 2026.

    Jersey Office of the Information CommissionerT1Confirmed

88. 88

    CARegulator & Framework2026-06-15

    Bill C-36 tabled 15 June 2026, proposing a new Digital Safety and Data Protection Commission with order-making/AMP powers, dropping AIDA entirely.

    baseline.quebecT3Probable

89. 89

    PLController/Processor Duties2026-10-07

    UODO issued a public reminder (6 October 2026) of the Art. 33(1) GDPR breach-notification duty; UODO fined a court bailiff PLN 15,500 for DPO independence/notification failures.

    VitalLawT2Probable

90. 90

    PHChildren & Vulnerable Groups2026-09-22

    NPC Show Cause Orders against Meta, Roblox, Reddit and Discord (22 Sep 2026), explicitly framed around youth/children's data protection.

    Manila TimesT2Probable

91. 91

    US-UTChildren & Vulnerable Groups2026-09-17

    SB 73 implementing rule for age-verification/VPN compliance may take effect 2026-10-08; Aylo enforcement paused pending rule finalisation or court ruling.

    Electronic Frontier FoundationT2Probable

92. 92

    ZAAdTech & Commercial Privacy2026-08-31

    OUTsurance and MTN direct-marketing matters referred to the Enforcement Committee over s69 interpretation for telemarketing calls, per the 31 Aug/1 Sept 2026 briefing.

    MichalsonsT2Probable

93. 93

    US-UTEnforcement & Redress2026-07-17

    AG/DCP sued Hims & Hers Health on 2026-07-17; Snap litigation proceeding in state court following March 2026 dismissal of Snap's federal counter-suit.

    MultiStateT2Probable

94. 94

    US-NJRegulator & Framework2027-04-01

    A5328 (data broker registration regime) and A5017 (exemptions/de-identification expansion) both enacted in 2026.

    NJ Division of Consumer AffairsT1Probable

95. 95

    BEEnforcement & Redress2026-01-01

    CJEU AG opinion bears on Litigation Chamber enforcement powers over religious-register erasure requests; multiple 2026 fine decisions on record.

    APD/GBAT1Probable

96. 96

    US-AKEnforcement & Redress2026-09-25

    Alaska joined a 44-state coalition settlement with Labcorp (2026-09-25, 82,958 AK residents affected), following a 2026-07-14 $18M 42-state settlement with 23andMe (19,541 Alaskans affected).

    Alaska Department of LawT1Confirmed

97. 97

    CMEnforcement & Redressdate pending

    APDP enforcement powers and disputed penalty figures newly identified; Authority's sanctioning power suspended pending organisational decree.

    Télé'AsuT3Disputed

98. 98

    US-PAAlgorithmic, Biometric & Surveillance Governance2026-07-14

    PA's $491,902 share of the 23andMe 42-state genetic-data-breach settlement (2026-07-14) under general BPINA/UTPCPL authority.

    PA Office of Attorney GeneralT1Confirmed

99. 99

    BDLawful Processing & Special Data2026-06-23

    Consent-based lawful-processing regime confirmed with defined thresholds; special categories not yet confirmed.

    DataGuidance / TheLawCounselT3Probable

100. 100

     US-MDLawful Processing & Special Data2026-04-01

     Mandatory data-minimization duty and outright sensitive-data sale ban now substantively enforceable.

     Koley Jessen (law firm)T3Probable

Regulatory horizon

• ARPossible enactment of Expte. 3397-D-2026 data-protection reform2026-Q4multi year
• AUChildren's Online Privacy Code registration deadline2026-12-10quarter
• AUPrivacy Amendment (Personal Data Protection) Bill 2026 expected introduction to Parliament2026-Q4half year
• BECJEU final judgment expected in APD/GBA v. Diocese of Ghent2027-Q1half year
• BRANPD fiscalização-regulation public consultation closes2026-10-26quarter
• CADraft Consumer-Driven Banking Regulations2026-Q4half year
• CABill C-36 (Protecting Privacy and Consumer Data Act)2027-Q4year
• CA-NBBill C-36 progress toward Royal Assent2027-Q1year
• CA-NBNB RTIPPA review legislation expected spring 20272027-Q2half year
• CMAPDP organisational decree still unpublished past compliance deadline2026-Q4half year
• CNLarge Personal Information Processor Provisions - expected finalization2026-Q4half year
• CYRegulation (EU) 2025/2518 cross-border GDPR enforcement procedure applies2027-04-01quarter
• DKDanish social-media age-limit bill consultation outcome2026-Q4half year
• DOINDOTEL draft General Telecommunications, Digital Infrastructure and Connectivity Law2026-Q4half year
• EEAEU Data Act switching-charge ban takes full effect2027-01-12quarter
• EEADigital Omnibus (GDPR track) possible adoption2026-Q4multi year
• EGPDPL grace period expires2026-10-31quarter
• GHData Protection Bill 2025 / Emerging Technologies Bill introduction2026-Q4half year
• GIEEA-EFTA transfer-destination list status under amended Art 45(1) not confirmed2026-Q4half year
• HKRevived PDPO mandatory breach-notification and administrative-fine reform2026-Q4half year
• IMData Asset Register (Fees) Regulations expected to be made2026-Q4quarter
• JEJersey registration fee-model consultation outcome2026-Q2half year
• JPAct No. 56/2026 implementation by Cabinet Order2028-Q2year
• KEData Protection (Amendment) Bill, 2025 enactment2026-Q4half year
• KEArtificial Intelligence Bill, 2026 - parliamentary tabling2027-Q1year
• KHDraft Law on Personal Data Protection — two-year implementation clock from promulgation2027-Q3multi year
• KRPIPA amendment (penalty ceiling, CEO liability, CPO governance) takes effectclosed 2026-09-11quarter
• KRISMS-P certification deadline for certain entities2028-12-31multi year
• KRISMS-P audit-strengthening Enforcement Decree consultation closes2026-10-26quarter
• LARelationship between Law on Cybersecurity No. 87/NA and Law on Electronic Data Protection No. 25/NA to be clarified2026-Q4quarter
• LATAMIbero-American Summit possible adoption of RIPD 2026 Standards2026-11-04quarter
• LKPDPA Sections 2, 3, Part I and Part III come into force2027-01-01quarter
• LKPDPA Part II (data subject rights) commencement status unresolved2027-01-01half year
• LULuxembourg Bill 8476 (AI Act competent-authority designation) adoption2026-Q4half year
• LUCNPD fresh decision on Amazon fine following annulment2027-Q1multi year
• MACNDP AI and personal-data decision in preparation2027-Q2multi year
• MHPersonal Data Protection Act 2025 full commencement2026-11-01quarter
• MYJPDP AI and Personal Data Protection Framework consultation closes2026-10-23quarter
• NLDutch AI Implementation Act (Uvai) anticipated entry into force2027-08-02year
• NLData Act full ban on cloud-switching charges2027-01-12quarter
• NOEU Data Act connected-product access-by-design obligation appliesclosed 2026-09-12quarter
• NOEU Data Act free cloud-switching requirement begins2027-01-12half year
• NPIT and Cybersecurity Bill 2082 National Assembly / authentication status2026-Q4year
• NPDigital-wallet National ID update deadline for existing users2026-10-17quarter
• PTANACOM AI Act Art.5 recommendations finalisation pending2026-Q4half year
• RSSerbia draft replacement Law on Personal Data Protection — legislative progress pending2026-Q4half year
• SASDAIA Implementing Regulation amendment consultation closes2026-11-05quarter
• SESwedish EU Data Act supplementary legislation in forceclosed 2026-07-01quarter
• SESweden final AI Act implementing act (SOU 2025:101) expectedclosed 2026-08-02half year
• SEInterim AI Act competent-authority designation expires2026-12-31quarter
• SGPDPC stepped-up NRIC-authentication enforcement begins2027-01-01quarter
• SKReplacement Slovak data-protection act enactment2027-Q1year
• THETDA Draft Act on Artificial Intelligence - post-consultation outcome2026-Q4half year
• TRUnder-15 social-media ban takes effect2026-11-01quarter
• TWPDPA 2025 amendment commencement and PDPC stand-up2027-Q1year
• UADraft Law No. 8153 second reading (GDPR alignment)2027-Q1year
• USCFPB revised Section 1033 proposal publication2026-Q4half year
• US-AKSB134 insurance data-security final commencement stage2027-01-01quarter
• US-AKHB367 next legislative opportunity2027-01-19quarter
• US-ALAlabama Personal Data Protection Act enters into force2027-05-01quarter
• US-COSB26-189 ADMT regime effective date2027-01-01quarter
• US-COADMT/chatbot-safety rule comment period closes2026-10-26quarter
• US-COMinors'-protection CPA cure period sunset2026-12-31quarter
• US-DCB26-0670 DC Government Data Privacy and Protection Act pending Council action2026-Q4year
• US-KSSB 372 App Store Accountability Act age-verification duty (failed to enact)2027-01-01year
• US-LALouisiana Data Privacy Act enters into force2027-01-01quarter
• US-LALouisiana LDPA Attorney General cure-period window closes2027-07-31quarter
• US-MDMODPA 60-day cure period sunsets2027-04-01quarter
• US-MIMichigan Personal Data Privacy Act (SB 359) pending2026-Q4multi year
• US-MIMichigan Kids Code Act (SB 758/759) commencement status unresolved2027-01-01half year
• US-NHHB 1460 child-data-sale prohibition takes effect2027-01-01quarter
• US-NJNJ data-broker registration window opens2027-04-01quarter
• US-NMNM AI-accountability bill expected at 2027 session opening2027-01-01half year
• US-NYRAISE Act frontier-AI safety statute takes effect2027-01-01quarter
• US-OHOhio Social Media Parental Notification Act (R.C. 1349.09) verification pending2026-Q4quarter
• US-OKOklahoma Consumer Data Privacy Act (OCDPA) in force2027-01-01quarter
• US-PAHB 78 Consumer Data Privacy Act — pending Senate floor vote2026-Q4half year
• US-SDSB 111 social-media data-portability/interoperability duty in force2027-07-01quarter
• US-UTSB 73 implementing age-verification/VPN rule possible effective dateclosed 2026-10-08quarter
• US-UTHB 357 motor-vehicle data rights take effect2027-01-01quarter
• ZACode of Conduct for Processing of Personal Information at Gated Accesses2026-Q4half year
• ZAJudicial Matters Amendment Bill PAIA 180-day self-help power2027-Q1year