--- title: "Roundup — Data Protection Monitor — 2026-10-25" canonical: https://dataprotection.gi/roundup/2026-10-25/ source_html: /roundup/2026-10-25/index.html description: "Roundup — Data Protection Monitor — 2026-10-25 — Global Privacy, Data Protection & Cross-Border Transfer Regulatory Intelligence." generated_at: 2026-11-04T04:45:59Z content_sha256: 042021f47c5f1fc3bab2016c74d898197c25251719213067057c0c13c05bb783 generator: "fe-fleet/md-twin@1.0" --- # Roundup — Data Protection Monitor — 2026-10-25 Roundup # Data Protection Monitor — 2026-10-25 Assembled deterministically from our recent research runs and ranked by date and importance. Previous editions - [Latest edition](/roundup/) - [2026-10-18](/roundup/2026-10-18/) - [2026-10-11](/roundup/2026-10-11/) - [2026-10-04](/roundup/2026-10-04/) - [2026-09-27](/roundup/2026-09-27/) - [2026-09-20](/roundup/2026-09-20/) - [2026-09-07](/roundup/2026-09-07/) ## New or updated since 2026-10-18 New to this edition or changed since the last one. - DK · Controller/Processor Duties · 2026-10-05 ### CPR-register security incident: unauthorised party exploited a Danish company's lawful lookup access, obtaining names/addresses/CPR numbers of approx. 8.8 million registered individuals; Datatilsynet notified 4 October 2026 and opened an Art. 32 inquiry. [Datatilsynet](https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2026/okt/datatilsynet-er-opmaerksom-paa-sag-om-opslag-i-cpr) - US-NM · Algorithmic, Biometric & Surveillance Governance · 2026-08-06 ### The Aug 6, 2026 Meta judgment created a court-ordered, Meta-funded Child Safety Monitor with independent-researcher audit rights over recommendation systems, now a standing feature of this jurisdiction's algorithmic-governance landscape. [New Mexico Department of Justice](https://nmdoj.gov/press-release/after-375-million-loss-meta-tries-to-run-court-says-no/) - US-LA · Regulator & Framework · 2026-05-29 ### LDPA (R.S. 51:1780.1-1780.5) creates a comprehensive consumer-privacy statute, effective 2027-01-01, with AG-exclusive enforcement. [Louisiana Legislature](https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1475339) - PH · Children & Vulnerable Groups · 2026-09-22 ### NPC Show Cause Orders (22 Sept 2026) against Meta, Roblox, Reddit, Discord remain unresolved, framed around youth protection. [National Privacy Commission](https://privacy.gov.ph/statement-of-the-national-privacy-commission-on-intensified-oversight-of-digital-platforms-to-protect-childrens-privacy/) - US-AL · Regulator & Framework · 2026-04-16 ### APDPA enacted, Act No. 2026-552, correcting prior stale no-framework record. [Alabama Legislature (ALISON)](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) - US-OR · Enforcement & Redress · 2026-01-01 ### Mandatory 30-day cure period sunset 1 Jan 2026; AG may now proceed directly to enforcement without prior notice; no new enforcement action found in-window. [Oregon Department of Justice](https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-businesses/) - NG · Algorithmic, Biometric & Surveillance Governance · 2026-10-25 ### NDPC's 20 Oct 2026 NITHUB Frontier AI consultation mandated algorithmic transparency and privacy-by-design; 25 Oct 2026 statement warned against unauthorised use of faces/voices. [Voice of Nigeria](https://von.gov.ng/ndpc-urges-responsible-ai-use-data-protection/) - US-IA · Enforcement & Redress · 2026-10-14 ### Four new Consumer Fraud Act filings touching data/privacy risk within a nine-day window (2026-10-06 to 2026-10-14): TP-Link, ADI Global, Lorex, OpenAI. [Iowa Attorney General](https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-announces-lawsuit-against-openai-for-deceiving-iowa-parents-and-iowans) - MZ · Controller/Processor Duties · 2026-09-29 ### Cybersecurity Law (Lei n.º 13/2026) entered into force 29 Sept 2026. [Imprensa Nacional (Boletim da República, official gazette)](https://www.incm.gov.mz/?sdm_process_download=1&download_id=5244) - SE · Controller/Processor Duties · 2026-09-22 ### IMY fined Miljödata SEK1.8m for Article 32(1) security failure. [IMY](https://www.imy.se/nyheter/sanktionsavgift-mot-miljodata-for-bristande-sakerhet/) - US-VA · Lawful Processing & Special Data · 2026-07-01 ### SB338 precise-geolocation sale ban in force 2026-07-01. [Virginia Legislative Information System](https://lis.virginia.gov/bill-details/20261/SB338/text/SB338) - CA-NB · Regulator & Framework · date pending ### RTIPPA legislative review (18 June 2026) recommends biometric and AI/ADM definitions; no bill tabled. [Ombud NB](https://www.ombudnb.ca/) - CH · Enforcement & Redress · 2026-09-29 ### FDPIC concluded BLT bodycam enforcement decision; ~30% increase in enforcement staff and contested proceedings pending before the Federal Administrative Court. [FDPIC (EDÖB)](https://www.edoeb.admin.ch/en/2026-en) - US-NE · Children & Vulnerable Groups · 2026-04-14 ### LB838 materially amends the Age-Appropriate Online Design Code Act, effective July 17, 2026. [Nebraska Legislature](https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB838.pdf) Also tracked by financial-integrity:D3 - US · Regulator & Framework · date pending ### Three competing comprehensive federal privacy bills remain pending before the 119th Congress; SECURE Data Act remains at House committee stage with no scheduled floor vote. [Federal Trade Commission](https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement) - US-TX · Algorithmic, Biometric & Surveillance Governance · 2026-10-23 ### TRAIGA enforcement portal active; OpenAI/Sam Altman suit filed Oct 23, 2026 under DTPA/SCOPE Act. [The Texas Tribune](https://www.texastribune.org/2026/10/23/ken-paxton-chatgpt-openai-lawsuit-texas-attorney-general/) - CM · Regulator & Framework · date pending ### Law No. 2024/017 (23 Dec 2024) creates the APDP, Cameroon's first dedicated personal-data-protection authority; organisational decree not yet located. [Télé'Asu](https://teleasu.tv/cameroun-lautorite-de-protection-des-donnees-personnelles-voit-le-jour/) - HR · Enforcement & Redress · date pending ### AZOP approximately EUR 2.59m fine against unnamed gambling operator over biometric processing. [MLex](https://www.mlex.com/mlex/data-privacy-security/articles/2533667) - US-MI · Sectoral Watch · 2026-09-29 ### Michigan AG announced $2.3M multistate Labcorp/AMCA settlement on 2026-09-29. [Michigan Department of Attorney General](https://www.michigan.gov/ag/news/press-releases/2026/09/29/attorney-general-nessel-announces-multistate-settlement-with-labcorp-over-amca-data-breach) - CL · Regulator & Framework · 2026-02-05 ### Senate Constitution Committee approved a bill (Boletín N°18.623-07) in general, unanimously, to postpone Ley 21.719's effective date from 1 Dec 2026 to 1 Dec 2027; APDP Consejo Directivo remains unappointed after the Senate rejected the first nominee slate on 20 May 2026. [Diario Oficial / SEGPRES alert](https://www.doe.cl/alerta/01092026/3f3d97e66706de2d4565) - VU · Algorithmic, Biometric & Surveillance Governance · date pending ### Annual ICT service permit for ICT service providers including AI and AI-related data services [Parliament of Vanuatu](https://parliament.gov.vu/images/Bills/Second%20Ordinary%20session%202025/Bill%20for%20the%20Digital%20Transformation%20Act%20No.%20%20of%202025/Bill%20for%20the%20Digital%20Transformation%20Act%20No.%20%20of%202025.pdf) - US-CT · Enforcement & Redress · 2026-10-01 ### New DCP $200/day/consumer penalty for data-broker deletion-mechanism violations under PA 26-64, effective 2026-10-01. [Hunton Andrews Kurth](https://www.hunton.com/privacy-and-cybersecurity-law-blog/connecticut-privacy-law-updates-data-broker-rules-geolocation-sale-ban-surveillance-pricing-restrictions-and-genetic-data-regulations) - US-SD · Lawful Processing & Special Data · 2026-07-01 ### SB 49 adds an express-consent requirement for genetic data collected by DTC testing companies, effective 2026-07-01. [South Dakota Legislature](https://mylrc.sdlegislature.gov/api/Documents/SessionLaw/306540.pdf?Year=2026) - US-KS · Sectoral Watch · 2026-04-16 ### HB 2591 extends Financial Institutions Information Security Act coverage to earned-wage-access registrants. [Kansas Secretary of State / 2026 Session Laws](https://sos.ks.gov/publications/sessionlaws/2026/Chapter-102-HB-2591.html) Also tracked by crypto:crypto_licensing - US-IL · Lawful Processing & Special Data · 2026-04-01 ### 7th Circuit confirmed BIPA damages amendment applies retroactively. [Hunton Privacy & Cybersecurity Law Blog](https://www.hunton.com/privacy-and-cybersecurity-law-blog/illinois-damages-limitation-for-biometric-privacy-violations-applies-retroactively) - NP · Regulator & Framework · date pending ### IT and Cyber Security Bill 2082's enactment status remains disputed between sources; no independent DPA exists. [Law Alpine](https://lawalpine.com/blog/data-protection-bill-nepal-business-impact) - PE · Enforcement & Redress · date pending ### ANPD inspections up 67% YoY in 2025; continuing high-volume enforcement into 2026 with e-commerce newly prominent. [XMS LatAm](https://www.xmslatam.com/pe/autoridad-nacional-proteccion-datos-personales/) - US-HI · Sectoral Watch · 2026-10-19 ### Oct 19, 2026 Labcorp/AMCA multistate (44-AG) settlement enforces HIPAA-adjacent vendor-management duties via a consumer-protection action. [Office of the Governor of Hawaii](https://governor.hawaii.gov/newsroom/release-office-of-consumer-protection-announces-multistate-data-breach-settlement/) - CA · Enforcement & Redress · 2026-10-14 ### OPC closed its WestJet investigation on 14 October 2026; Bill C-36 would introduce AMPs up to the greater of $25M or 5% of global revenue. [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/about-the-opc/) - GI · Regulator & Framework · 2026-07-15 ### Data Protection Regulations 2026 in force 15 July 2026, amending the Gibraltar GDPR and DPA04. [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) - KZ · Regulator & Framework · 2026-06-24 ### Law No. 326-VIII amendments enter into force 25 August 2026; implementing Rules entered into force 12 July 2026. [Baker McKenzie](https://www.bakermckenzie.com/en/insight/publications/2026/07/kazakhstan-new-amendments-to-personal-data-legislation) - US-NH · Children & Vulnerable Groups · 2026-06-19 ### HB 1460 bans the sale of a known child's personal data, effective 1 January 2027. [DataGuidance](https://www.dataguidance.com/news/new-hampshire-law-prohibiting-sale-childrens-personal) - LU · Lawful Processing & Special Data · 2026-03-12 ### Administrative Court judgment No. 52757C (12 March 2026) on Amazon's legitimate-interest basis and fine annulment/remand. [CMS](https://cms.law/en/deu/publication/GDPR-Enforcement-Tracker-Report/luxembourg) - US-WY · Regulator & Framework · 2026-03-06 ### SF0020 (government-entity personal-data statute) enacted March 6, 2026, alongside continued absence of a comprehensive consumer-privacy statute or dedicated regulator. [Wyoming Legislature](https://www.wyoleg.gov/Legislation/2026/SF0020) - BD · Enforcement & Redress · 2026-02-05 ### Feb 2026 Amendment Ordinance replaced imprisonment for managing directors with monetary fines only; no enforcement decision on record yet. [Legal Research & Analysis journal](https://pdfs.semanticscholar.org/f4fe/9049104e124d7f5a8a7f56d4fae089a12ee8.pdf) - TW · Regulator & Framework · 2025-11-11 ### PDPC Preparatory Office amended internal working rules/staffing table effective 23 Oct 2026; main PDPA amendments remain enacted but not yet in force pending PDPC Organic Act and Executive Yuan commencement date. [理律法律事務所 (Lee and Li Attorneys-at-Law)](https://www.leeandli.com/TW/NewslettersDetail/7532.htm) - IM · Enforcement & Redress · date pending ### ICO increased published regulatory action (Cabinet Office reprimand, 10 Aug 2026); Dept of Infrastructure decision notice (16 Oct 2026) just outside window. [Appleby](https://www.applebyglobal.com/publications/data-protection-guide-isle-of-man/) - TH · Algorithmic, Biometric & Surveillance Governance · date pending ### PDPC/ETDA published AI data-protection guidelines v1.0 on 7 October 2026 (advisory, not binding); prior biometric-deletion order against World/Worldcoin-linked operator remains the benchmark enforcement action. [Enersys](https://enersys.co.th/en/insights/pdpa-enforcement-trends-thailand-2026) - UA · Enforcement & Redress · 2026-10-23 ### Draft Law No. 8153 penalty ceiling (UAH 90m / 5% turnover) confirmed still proposed; National Programme June 2026 target missed. [VoxUkraine](https://voxukraine.org/en/european-regulation-of-personal-data-protection) - US-CO · Algorithmic, Biometric & Surveillance Governance · 2026-05-14 ### SB 26-189 ADMT Act interim draft rules and formal rulemaking hearing [CASRAI](https://casrai.org/guides/colorado-ai-act-explained) - US-NY · Enforcement & Redress · 2026-10-16 ### BCHP/XTIUM $2.7M settlement (16 Oct 2026) continues an active 12-month enforcement pattern (23andMe, Labcorp, accounting-firm settlement). [Digwatch](https://dig.watch/updates/new-york-connecticut-settle-breach-case) - BG · Regulator & Framework · 2026-10-01 ### EU Commission October 2026 DSA assessment found CPDP's Art. 49 supervisory role left unempowered and a penalty-provision flaw. [Tech Times](https://www.techtimes.com/articles/328417/20261001/bulgaria-dsa-law-called-complete-ec-says-two-bodies-still-unempowered.htm) - CA-BC · Data Subject Rights · 2026-10-06 ### PIPA s.23(1) access order issued against a strata corporation, published ~6 Oct 2026, within this cycle's window. [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/) - BZ · Controller/Processor Duties · date pending ### Breach-notification timing disputed between two secondary sources (72-hour vs 3-day default); neither confirmed against primary text. [US Department of State](https://www.state.gov/reports/2025-investment-climate-statements/belize) - IT · Enforcement & Redress · 2026-10-06 ### Garante fined IQVIA Solutions Italy EUR 7 million (Provvedimento n. 710, 6 October 2026) for treating re-identifiable health data as anonymous, violating GDPR Articles 5, 9, 13, 25, 28, 32 and 35. [ComplexDiscovery](https://complexdiscovery.com/italys-privacy-regulator-rejects-iqvias-anonymization-claim-and-fines-it-7-million-euros/) - CA-QC · Enforcement & Redress · 2026-09-23 ### Court of Quebec confirmed (23 Sept 2026) the CAI's order against Clearview AI; no published AMP has yet been issued despite the CAI holding that power since September 2023. [Blogue SOQUIJ](https://blogue.soquij.qc.ca/2026/10/08/la-protection-du-droit-a-la-vie-privee-a-lere-des-logiciels-de-surveillance-de-masse/) - UY · Enforcement & Redress · date pending ### Disputed figure on database-suspension length (5 days vs 6 working days) between two sources. [URCDP](https://www.redipd.org/sites/default/files/inline-files/felipe_rotondo_doc_uruguay.pdf) - EG · Enforcement & Redress · 2026-10-31 ### Grace period under the Executive Regulations expires 31 Oct/1 Nov 2026; no PDPC enforcement decision yet located. [SOG](https://sog.eg/en/blog/egypt-pdpl-website-compliance-checklist) - PW · Controller/Processor Duties · 2026-10-25 ### Mandatory breach-notification duty for government agencies under RPPL 12-8; immediate reporting duty under Digital Residency Program regulation. [Ministry of Finance, Republic of Palau](https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf) - US-VT · Enforcement & Redress · 2026-06-16 ### VDPOSA enforced exclusively by the Attorney General, up to $10,000 per violation, no private right of action, 60-day cure period 2028-01-01 to 2029-06-30. [Didomi](https://www.didomi.io/blog/vermont-data-privacy-and-online-surveillance-act-vdposa) - US-IN · Enforcement & Redress · 2026-01-01 ### Civil penalties up to $7,500/violation; permanent 30-day cure period; AG Rokita has signalled intent to narrow sectoral exemptions in a future legislative session; disputed date of active enforcement commencement. [Measured Collective](https://measuredcollective.com/indiana-consumer-data-protection-act-101-what-you-need-to-know/) - NZ · Regulator & Framework · date pending ### Cyber Security Action Plan 2026-2027 (Action 8) proposes Ministry of Justice advice on a civil pecuniary penalty regime for the Privacy Act 2020; policy-proposal stage only. [Office of the Privacy Commissioner](https://www.privacy.org.nz/privacy-principles/) - EC · Regulator & Framework · date pending ### LOPDP in force since 2021; SPDP operational since Sept/Oct 2024; 2026 Institutional Regulatory Plan set the secondary-rulemaking agenda. [SPDP (via Fielweb)](https://www.fielweb.com/App_Themes/InformacionInteres/Resoluci_n_N_SPDP_SPD_2026_0009_R_1771459633.pdf) - EE · Sectoral Watch · 2026-10-21 ### New 936 SE financial-fraud-prevention law creates a personal-data-sharing gateway between PSPs, banks, police and CERT-EE; GDPR legal-basis interaction unconfirmed. [Riigikogu](https://www.riigikogu.ee/pressiteated/riigikogu-kiitis-heaks-finantspettuste-ennetamise-ja-tokestamise-seaduse/) Also tracked by financial-integrity:D7, world-payments:W10 - RU · Algorithmic, Biometric & Surveillance Governance · date pending ### Internet-governance regulation effective March 2026 authorises Runet disconnection/site-blocking; VPN-hosting-register bill reported 8 Oct 2026 would add ~RUB60bn traffic-filtering funding and a hosting-provider register. [Meduza](https://meduza.io/en/feature/2026/10/08/russia-has-spent-a-decade-trying-to-stop-people-from-bypassing-internet-censorship-now-it-plans-to-spend-nearly-60-billion-rubles-over-three-years-on-traffic-filtering) - US-CA · Enforcement & Redress · 2026-08-11 ### CalPrivacy's first-ever CCPA/Delete Act data-broker enforcement action (LocateSmarter LLC, Aug 11, 2026, $52,400 fine) and 100+ concurrent open investigations signal escalating enforcement. [Paul, Weiss](https://www.paulweiss.com/insights/client-memos/california-privacy-protection-agency-s-first-enforcement-action-against-data-broker-signals-industry-scrutiny) - PL · Algorithmic, Biometric & Surveillance Governance · 2026-07-03 ### Act of 3 July 2026 on AI Systems establishes KRiBSI as sole AI Act market-surveillance authority; UODO's role is advisory (non-voting), a position UODO has publicly criticised. [Glacis](https://www.glacis.io/guide-eu-ai-act-poland) - PA · Cross-Border & Adequacy · 2026-03-26 ### ANTAI Resolution ANTAI-DG-003-2026 approved the RIPD Standard Contractual Clauses as a concrete transfer mechanism. [Morgan & Morgan](https://morimor.com/panama-updates-rules-for-international-data-transfers/) - TN · Regulator & Framework · date pending ### Reform bill enactment status disputed; INPDP council mandate reportedly unrenewed; digital-rights forum calls for INPDP reactivation. [DPO Consulting](https://www.dpo-consulting.com/fr-fr/blog/loi-tunisienne-sur-la-protection-des-donnees) - US-WA · Algorithmic, Biometric & Surveillance Governance · date pending ### HB 1170 (AI provenance, effective 2027-02-01), RCW 19.375 biometric regime confirmed, SB 5956 pending. [RecordingLaw](https://www.recordinglaw.com/us-laws/data-privacy-laws/washington-data-privacy-laws/biometric-privacy/) - US-DE · Regulator & Framework · 2026-09-02 ### HB 380 substantially amends the DPDPA, effective 2027-01-01. [Hunton Andrews Kurth](https://www.hunton.com/privacy-and-cybersecurity-law-blog/delaware-expands-state-privacy-law) - US-SC · Children & Vulnerable Groups · 2026-02-05 ### AADC (Act No. 96) newly documented as in-force standing baseline. [Goodwin Procter](https://www.goodwinlaw.com/en/insights/publications/2026/07/alerts-technology-south-carolina-age-appropriate-design-code-how-impact-business) - IN · Regulator & Framework · 2026-08-25 ### DPDP (Removal of Difficulties) Order 2026 issued; Consent Manager registration commences 13/14 Nov 2026. [India Data Law](https://indiadatalaw.org/is-the-board-operational/) - VN · Enforcement & Redress · 2026-08-19 ### Decree 330/2026/ND-CP supplies first dedicated administrative-sanctions framework; no named enforcement decision located yet. [Viet An Law](https://vietanlaw.com/decree-330-2026-nd-cp-on-administrative-penalties-for-personal-data-protection-violations-in-vietnam/) - US-PA · Regulator & Framework · 2026-10-06 ### HB 78 (Consumer Data Privacy Act) was 'removed from table' in the Senate Oct 6, 2026, without passing the full Senate; BOPINA as amended by Act 33 of 2024 remains the primary in-force instrument. [Pennsylvania General Assembly](https://www.palegis.us/legislation/bills/2025/hb78) - SN · Cross-Border & Adequacy · 2026-08-20 ### Loi n°25/2026 (adopted 20 Aug 2026) imposes a new public-sector data-localisation obligation; implementing decrees not yet confirmed. [Bref Crypto](https://brefcrypto.com/cybersecurite-senegal-infrastructures-critiques-amende/) - CZ · Algorithmic, Biometric & Surveillance Governance · 2026-08-02 ### EU AI Act high-risk requirements directly enforceable from 2 Aug 2026; Czech Adaptation Act remains draft. [RegulatoryAI.eu](https://www.regulatoryai.eu/ai-act-czechia/) - BE · AdTech & Commercial Privacy · 2026-05-28 ### EDPB Binding Decision 1/2026 (adopted 28 May 2026, published 14 July 2026) rejected the APD's abuse-of-rights dismissal of the VRT cookie-banner complaint and ordered a merits assessment under Art.60(3) GDPR. [Digital Watch Observatory](https://dig.watch/updates/edpb-vrt-cookie-banner-complaint-belgian-dpa) - US-MN · Algorithmic, Biometric & Surveillance Governance · 2026-05-26 ### Minn. Stat. §325M.40 (Laws 2026 ch. 111), signed 2026-05-26, creates a $10,000 statutory-damages claim for a child or parent over addictive/algorithmic social-media design features, effective 2027-07-01. [Madgett Law](https://www.madgettlaw.com/news/minnesota-social-media-manipulation-act-325m/) - US-GA · Algorithmic, Biometric & Surveillance Governance · 2026-05-11 ### SB 540 (Conversational AI Safety Act, O.C.G.A. §39-5-6) and SB 444 (O.C.G.A. §33-46-7.1), both signed May 11, 2026, impose new minor-protection and AI-utilization-review duties; neither yet in force (effective Jul 1 2027 / Jan 2027 respectively). [IntelliSee](https://intellisee.com/legislation/georgia-conversational-ai-safety-act-sb-540-2026/) - DZ · Algorithmic, Biometric & Surveillance Governance · 2026-05-06 ### ANPDP Decisions 02 (video surveillance) and 03 (biometric attendance) confirmed; no ADM-specific statutory test located. [Gide](https://www.gide.com/en/news-insights/protection-of-personal-data-focus-on-algerian-regulations/) - RS · Regulator & Framework · date pending ### Draft replacement law published 30 July 2026, consultation closed 10 September 2026, proposing to expand 102 to 175 articles. [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=RS) - AG · Algorithmic, Biometric & Surveillance Governance · 2026-06-18 ### Electronic Crimes (Amendment) Act (reported June 2026) strengthens law-enforcement production-order powers over electronic data; a criminal-procedure instrument distinct from the DPA's own national-security exemption. [Jamaica Gleaner / CMC](https://jamaica-gleaner.com/article/world-news/20260618/antigua-toughens-legislation-dealing-cybercrime) - CN · Enforcement & Redress · date pending ### Amended CSL raised maximum fines to RMB 10 million; named 13 June 2026 Shanghai CAC enforcement action against an online travel platform. [UL Solutions Inc. SEC Filing](https://www.sec.gov/Archives/edgar/data/1901440/000162828024039710/ulsolutions-424b4.htm) - FR · Controller/Processor Duties · 2026-09-23 ### CNIL closed FRANCE TRAVAIL and GOOGLE injunctions this cycle, confirming compliance. [CNIL](https://www.cnil.fr/fr/actualites) - US-MS · Controller/Processor Duties · 2026-07-01 ### HB1596 (effective 2026-07-01) imposes an information-security-program duty and a 72-hour DBCF-notification duty on MTMA licensees; general breach law (§75-24-29) remains unchanged with no AG-notification threshold (SB2128 died 2026-02-03). [Orrick InfoBytes](https://infobytes.orrick.com/2026-04-24/mississippi-enacts-data-security-and-consumer-protection-requirements-for-money-transmitters/) - GG-ALD · Regulator & Framework · date pending ### ODPA's annual registration fee for Alderney organisations rose 3.7% (RPI-linked) to GBP 62.22 / GBP 2,488.80 effective 1 January 2026, confirming the registration duty extended to Alderney since 1 January 2021 remains in force. [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=authority&c=GG) - SK · Cross-Border & Adequacy · date pending ### UK adequacy extended to 27 Dec 2031 via EU-wide implementing decisions. [najpravo.sk](https://premium.najpravo.sk/gdpr-rozhodnutia-o-primeranosti-pre-spojene-kralovstvo/) - US-NJ · Enforcement & Redress · 2026-07-01 ### Mandatory 30-day cure period sunset 2026-07-01; 10 cure letters issued between 2025-03-24 and the cure period's close. [recordinglaw.com](https://www.recordinglaw.com/us-laws/data-privacy-laws/new-jersey-data-privacy-laws/) - UK · Algorithmic, Biometric & Surveillance Governance · 2026-10-08 ### ICO opened agentic-AI call for evidence (8 Oct-20 Nov 2026) with developer-commitments supervisory report and live enquiries into agentic-AI testing incidents. [Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/10/ico-secures-changes-from-leading-ai-developers-as-scrutiny-extends-to-ai-agents/) Also tracked by aic:authorities_and_enforcement - CR · Regulator & Framework · date pending ### Prodhab maintains three open investigative files (opened Sept 2026) into an alleged dark-web exposure of Costa Ricans' personal data; no resolution this cycle. [SCIJ](https://pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=29254) - KM-A · Regulator & Framework · date pending ### Sources materially disagree on whether a comprehensive data-protection law was ever enacted. [Consentstack](https://www.consentstack.io/regulations/km-dpl) - SA · AdTech & Commercial Privacy · date pending ### Marketing without consent remains the most cited SDAIA enforcement violation category; draft amendments touch the Direct Marketing definition. [Waqi](https://waqi.ai/blog/saudi-pdpl-fines-penalties-explained) - CO · Enforcement & Redress · date pending ### Confirmed severe enforcement outcome (definitive closure) against a major biometric operator; standing sanctions regime includes fines up to 2,000 SMMLV, suspension up to 6 months. [MS Legal](https://mslegal.com.co/sanciones-sic-colombia-proteccion-datos/) - US-ND · Algorithmic, Biometric & Surveillance Governance · 2026-10-20 ### LC draft 27.0359.1000 recommended by committee on Oct 20, 2026, proposing AI-disclosure duty and biometric/image-consent restrictions. [The Dakotan](https://mydakotan.com/2026/10/north-dakota-lawmakers-advance-ai-regulation-bill-consider-additional-protections/) - TR · Data Subject Rights · 2026-10-01 ### KVKK Board clarified that final responses must be in writing or electronically, published 1 October 2026. [Erdem & Erdem](https://www.erdem-erdem.av.tr/en/insights/public-announcement-on-the-notification-procedure-for-responses-to-data-subject-applications-published) - IS · Controller/Processor Duties · 2026-07-07 ### Personuvernd reprimanded Borgarholtsskoli (7 July 2026) for unlawful retention of an anonymous tip naming a teacher, but could not order deletion due to public-records retention duties. [DV](https://www.dv.is/frettir/2026/07/07/personuvernd-veitir-borgarholtsskola-aminningu-fyrir-brot-gegn-kennara-ohrodur) - US-MA · Regulator & Framework · date pending ### Data Privacy Act conference committee continued negotiating as of 21 Oct 2026, with reconciliation referenced for January 2027. [IAPP](https://iapp.org/news/a/mass-ags-data-privacy-security-division-an-advocate-for-consumers) - HK · Enforcement & Redress · 2025-12-31 ### Cumulative doxxing enforcement statistics to 31 Dec 2025 reported (3,634 cases, 43 convictions). [PCPD](https://www.pcpd.org.hk/misc/dpoc/newsletter189.html) - SG · Cross-Border & Adequacy · 2026-03-02 ### Global CBPR/PRP certification routes added 2 March 2026 (S 86/2026) remain the standing position. [Sorena](https://www.sorena.io/artifacts/apac/singapore-pdpa/cross-border-transfers) - FI · Algorithmic, Biometric & Surveillance Governance · 2026-01-01 ### National AI Act enforcement layer (HE 46/2025) in force since 1 January 2026 alongside the EU AI Act's high-risk obligations from 2 August 2026, both outside this window. [Global Law Experts](https://globallawexperts.com/technology-lawyers-finland-2026-eu-ai-act-obligations-contract-drafting-and-enforcement-risks/) - LATAM · Algorithmic, Biometric & Surveillance Governance · 2026-10-01 ### RIPD 2026 Standards newly incorporate AI, automated decisions, bias prevention and neurodata provisions. [Gobierno de Argentina / AAIP](https://www.argentina.gob.ar/noticias/la-aaip-participo-del-encuentro-2026-de-la-red-iberoamericana-de-proteccion-de-datos-ripd) - LV · Algorithmic, Biometric & Surveillance Governance · date pending ### DVI's 2025 annual activity report designated DVI as Latvia's supervisory authority for personal data protection under the EU AI Act; VARAM coordinates overall implementation. [Beeble](https://beeble.com/en/blog/latvia-s-data-state-inspectorate-releases-2025-report-ai-regulation-and-enforcement-take-center-stage) - KH · Regulator & Framework · date pending ### Draft LPDP under continuing consultation since July 2025; MPTC/EU Delegation workshop held 5 August 2026; law remains unenacted. [AKP Khmer / News Brain](https://news-brain.net/news/57adce58-bd74-4c8b-b3a1-69f03c348464) - GG · Algorithmic, Biometric & Surveillance Governance · 2026-02-23 ### ODPA co-signed a 61-authority Joint Statement on AI-Generated Imagery (23 Feb 2026); GFSC declined to issue AI-specific financial-sector rules (29 Jan 2026). [Office of the Data Protection Authority (ODPA)](https://www.odpa.gg/news/guernsey-joins-international-data-protection-authorities-signing-joint-statement-privacy-risks) - US-AR · Enforcement & Redress · date pending ### Secondary sources directly conflict over whether PIPA carries a private right of action; unresolved this cycle. [databreachcost.com](https://databreachcost.com/breach-notification-laws/arkansas) - US-WI · Enforcement & Redress · date pending ### Multistate enforcement-adjacent AI-chatbot bankruptcy filing [DataBreachCost.com](https://databreachcost.com/breach-notification-laws/wisconsin) - EEA · Regulator & Framework · 2026-10-21 ### Council adopted negotiating mandate on Digital Omnibus (GDPR amendment) 21 Oct 2026; trilogue not yet started. [Legal247](https://legal247.no/en/insights/digital-omnibus-gdpr/) - CW · Cross-Border & Adequacy · 2026-06-19 ### Dutch AP has warned Curacao's oversight falls short of EU-equivalent standards and intends to intensify supervision of intra-Kingdom data flows. [Curacao Chronicle](https://www.curacaochronicle.com/post/unknown/dutch-privacy-authority-warns-curacao-lacks-effective-data-protection-oversight) - LK · Enforcement & Redress · date pending ### Penalty-escalation rule reported; DPA/NCCSL readiness session scheduled for 28 October 2026. [HashtagCoders](https://hashtagcoders.lk/blogs/data-privacy-laws-sri-lanka-2026) ## Regulatory horizon - AR[Expediente 3397-D-2026 omnibus DP reform bill](/jurisdictions/argentina/) · 2026-Q4multi year - BG[Bulgaria AI Act implementing bill tabling expected](/jurisdictions/bulgaria/) · closed 2026-10quarter - BR[ANPD fiscalização/sanctions regulation consultation closes](/jurisdictions/brazil/) · 2026-10-26quarter - BR[ANPD sanctions dosimetry update consultation closes](/jurisdictions/brazil/) · 2026-11-30quarter - BZ[National Data and Statistical Systems Act, 2026 finalisation](/jurisdictions/belize/) · 2027-Q2year - CA-NB[RTIPPA reform legislation expected](/jurisdictions/new-brunswick-canada/) · 2026-Q4half year - CA-ON[Bill 97 FIPPA/MFIPPA final amendment tranche](/jurisdictions/ontario-canada/) · 2027-01-01quarter - CL[Ley 21.719 commencement date (1 Dec 2026, possibly postponed to 1 Dec 2027)](/jurisdictions/chile/) · 2026-12-01quarter - CM[APDP organisational decree publication pending](/jurisdictions/cameroon/) · 2026-Q4half year - CO[SIC post-consultation protocol under Ley 2573/2026 expected](/jurisdictions/colombia/) · 2026-Q4quarter - CR[TSE recurso de revocatoria against Prodhab Resolution 029-2026-RF](/jurisdictions/costa-rica/) · 2026-Q4half year - CW[Possible Convention 108+ implementing legislation](/jurisdictions/curacao/) · 2027-Q2multi year - CY[AI Act high-risk obligations deadline deferred (Digital Omnibus)](/jurisdictions/cyprus/) · 2027-12-02year - CZ[Czech Data Act implementing/penalty legislation (unadopted, deadline elapsed)](/jurisdictions/czech-republic/) · 2027-Q1year - CZ[Czech AI Act Adaptation Act (draft)](/jurisdictions/czech-republic/) · 2027-Q1year - DO[INDOTEL draft General Telecommunications, Digital Infrastructure and Connectivity Law](/jurisdictions/dominican-republic/) · 2026-Q4half year - DZ[ANPDP regional audit poles implementing regulation](/jurisdictions/algeria/) · 2026-Q4half year - EE[936 SE awaiting Riigi Teataja publication](/jurisdictions/estonia/) · 2026-Q4quarter - EE[796 SE dark-patterns/distance-financial-services transposition pending](/jurisdictions/estonia/) · 2026-Q4half year - EEA[Data Act switching-charge ban takes full effect](/jurisdictions/european-economic-area-bloc/) · 2027-01-12quarter - EEA[EDPB fine-methodology guidelines consultation closes](/jurisdictions/european-economic-area-bloc/) · 2026-11-13quarter - FI[HE 46/2026 vp public-sector GDPR fines reform](/jurisdictions/finland/) · 2027-Q1half year - HU[EDPB smart-glasses guideline public consultation close](/jurisdictions/hungary/) · 2026-11-13quarter - IN[DPDP Act substantive-compliance tranche commences](/jurisdictions/india/) · 2027-05-13quarter - IN[Consent Manager registration commences](/jurisdictions/india/) · 2026-11-13quarter - JP[APPI amendment (Act No. 56/2026) commencement, including administrative fine system and biometric-data category](/jurisdictions/japan/) · 2027-Q2year - JP[PPC technical safety-management-measure guideline revision](/jurisdictions/japan/) · 2027-Q2half year - KR[PIPA Enforcement Decree implementing 11 Sept 2026 fine-ceiling amendment](/jurisdictions/south-korea/) · closed 2026-09-11quarter - LATAM[RIPD Estándares possible formal adoption at Ibero-American Summit](/jurisdictions/latin-america-bloc/) · 2026-Q4half year - LK[PDPA Parts I and III come into force](/jurisdictions/sri-lanka/) · 2027-01-01quarter - LK[PDPA Part II (data subject rights) commencement date still unannounced](/jurisdictions/sri-lanka/) · 2027-Q2multi year - LU[EU Data Act cloud-switching charge abolition](/jurisdictions/luxembourg/) · 2027-01-12quarter - LU[EU Data Act access-by-design duty for connected products](/jurisdictions/luxembourg/) · closed 2026-09-12quarter - MT[AI regulatory sandbox deadline postponed](/jurisdictions/malta/) · 2027-08-02quarter - MZ[Proposta de Lei de Protecção de Dados Pessoais pending before Assembleia da República](/jurisdictions/mozambique/) · 2027-Q1multi year - NG[CBN payments data-localisation deadline with NDPA cross-reference](/jurisdictions/nigeria/) · 2027-01-01quarter - NO[Norwegian KI-loven targeted for Storting presentation](/jurisdictions/norway/) · 2027-Q2half year - NP[IT and Cyber Security Bill 2082 — disputed enactment status](/jurisdictions/nepal/) · 2026-Q4half year - NZ[Civil pecuniary penalty regime advice to Ministry of Justice](/jurisdictions/new-zealand/) · 2027-Q2multi year - PH[NPC Draft Circular on Data Subject Rights adoption](/jurisdictions/philippines/) · 2026-Q4half year - PH[NPC Draft PIA Circular adoption](/jurisdictions/philippines/) · 2026-Q4half year - RS[Serbia draft replacement Law on Personal Data Protection](/jurisdictions/serbia/) · 2026-Q4multi year - SA[SDAIA PDPL Implementing Regulation amendments consultation closes](/jurisdictions/saudi-arabia/) · 2026-11-05quarter - SN[Loi n°25/2026 implementing decrees and cybersecurity authority commencement](/jurisdictions/senegal/) · 2027-Q1year - TN[GDPR-aligned Tunisian data-protection reform bill](/jurisdictions/tunisia/) · 2026-Q4year - UA[Draft Law No. 8153 GDPR-alignment adoption (missed target)](/jurisdictions/ukraine/) · closed 2026-06-01multi year - UK[ICO agentic-AI call for evidence closes](/jurisdictions/united-kingdom/) · 2026-11-20quarter - US[Connecticut data-broker registry registration date](/jurisdictions/united-states/) · 2027-01-01quarter - US-AK[HB 367 Consumer Data Privacy Act — possible future action](/jurisdictions/alaska-usa/) · 2027-Q1multi year - US-AL[APDPA effective date](/jurisdictions/alabama-usa/) · 2027-05-01quarter - US-AL[App Store Accountability Act in force](/jurisdictions/alabama-usa/) · 2027-01-01quarter - US-AL[App Store Accountability Act retroactive deadline for existing accounts](/jurisdictions/alabama-usa/) · 2027-10-01quarter - US-CO[Colorado ADMT Act and Chatbot Safety Act take effect](/jurisdictions/colorado-usa/) · 2027-01-01quarter - US-CO[ADMT formal rulemaking hearing and comment close](/jurisdictions/colorado-usa/) · 2026-10-26quarter - US-DE[DPDPA HB 380 amendments take effect](/jurisdictions/delaware-usa/) · 2027-01-01quarter - US-GA[Georgia Conversational AI Safety Act (SB 540) in force](/jurisdictions/georgia-usa/) · 2027-07-01quarter - US-GA[Georgia SB 444 AI health-plan utilization-review limits in force](/jurisdictions/georgia-usa/) · 2027-01-01quarter - US-ID[Idaho Conversational AI Safety Act takes effect](/jurisdictions/idaho-usa/) · 2027-07-01quarter - US-KY[KCDPA DPIA duty takes effect for post-trigger-date processing](/jurisdictions/kentucky-usa/) · closed 2026-06-01quarter - US-LA[Louisiana Data Privacy Act takes effect](/jurisdictions/louisiana-usa/) · 2027-01-01quarter - US-LA[LDPA 30-day cure-period window closes](/jurisdictions/louisiana-usa/) · 2027-07-31quarter - US-MA[Massachusetts Data Privacy Act conference-committee reconciliation](/jurisdictions/massachusetts-usa/) · 2027-01half year - US-MA[Mandatory AG rulemaking deadline under House Data Privacy Act bill (if enacted)](/jurisdictions/massachusetts-usa/) · 2027-05-01year - US-MI[Senate Bills 888-892 breach-notification reform](/jurisdictions/michigan-usa/) · 2027-Q2year - US-MI[Proposed Michigan Consumer Privacy Act (HB 5989)](/jurisdictions/michigan-usa/) · 2027-Q4multi year - US-MN[Minn. Stat. §325M.40 private-damages claim and age-estimation disclosure take effect](/jurisdictions/minnesota-usa/) · 2027-07-01quarter - US-NE[LB838 AADC amendment effective](/jurisdictions/nebraska-usa/) · closed 2026-07-17quarter - US-NH[HB 1460 children's-data sale ban in force](/jurisdictions/new-hampshire-usa/) · 2027-01-01quarter - US-NJ[NJDPA data broker/collector registry launch](/jurisdictions/new-jersey-usa/) · 2027-Q2half year - US-NJ[NJDPA implementing rulemaking restart (unconfirmed timeline)](/jurisdictions/new-jersey-usa/) · 2027multi year - US-NM[Anticipated NM social-media-safety / age-verification bill](/jurisdictions/new-mexico-usa/) · 2027-Q1year - US-NY[RAISE Act takes effect](/jurisdictions/united-states-new-york/) · 2027-01-01quarter - US-OK[Oklahoma Consumer Data Privacy Act (OKCDPA) takes effect](/jurisdictions/oklahoma-usa/) · 2027-01-01quarter - US-RI[RI AI Companion Models Act (S 2195/H 7350) takes effect](/jurisdictions/rhode-island-usa/) · 2027-01-01quarter - US-TN[TN TACIR AI study report due](/jurisdictions/tennessee-usa/) · 2027-01-31quarter - US-UT[HB 357 motor-vehicle-data amendments to UCPA take effect](/jurisdictions/utah-usa/) · 2027-01-01quarter - US-VT[VDPOSA in force](/jurisdictions/vermont-usa/) · 2028-01-01quarter - US-VT[Data Broker Security Breach Notice Act (Act 138) effective](/jurisdictions/vermont-usa/) · 2027-01-01quarter - US-VT[Age-Appropriate Design Code (Act 63) effective](/jurisdictions/vermont-usa/) · 2027-01-01quarter - US-WA[HB 1170 AI content-provenance disclosure comes into force](/jurisdictions/washington-state-usa/) · 2027-02-01quarter Ranked within this monitor (per_consumer); tie-break recency_date_desc, jid_asc, module_asc, url_asc. Index tool 1.5.0, edition policy 1.2.0.