Roundup
Data Protection Monitor — 2026-11-01
Assembled deterministically from our recent research runs and ranked by date and importance.
New or updated since 2026-10-25
New to this edition or changed since the last one.
- 1
CO · Algorithmic, Biometric & Surveillance Governance · 2026-06-18
SIC finally confirmed (18 June 2026) definitive closure of World Foundation/Tools for Humanity's iris-biometric 'Orb' operation for unauthorised processing of sensitive biometric data.
- 2
US-VT · Regulator & Framework · 2026-06-16
Act 145 (VDPOSA) enacted 16 June 2026, effective 1 January 2028, enforced exclusively by the Vermont Attorney General.
- 3
GR · Controller/Processor Duties · 2026-07-28
HDPA Decision No. 15 fined Ministry €200,000 and processor EETAA €150,000 for Art 25/28/32-34 breach.
- 4
FR · Enforcement & Redress · 2026-08-24
Two injunction closures (FRANCE TRAVAIL, GOOGLE) confirm ongoing active enforcement; no new sanction decision dated within the window.
- 5
- 6
LK · Regulator & Framework · 2026-07-22
Gazette Extraordinary of 22 July 2026 fixes 1 January 2027 commencement for Parts I and III.
- 7
- 8
BD · Cross-Border & Adequacy · 2026-02-05
Feb 2026 Amendment Ordinance narrowed data-localisation mandate to a synchronised real-time copy requirement for restricted/CII data only.
- 9
US-HI · Data Subject Rights · 2026-07-14
Act 252 (Social Media Data Deletion Act) enacted 2026-07-14, effective 2027-07-01, creating a narrow platform-specific deletion right.
- 10
US-LA · Enforcement & Redress · 2026-05-29
LDPA gives AG exclusive enforcement with a time-limited cure period (Jan-Jul 2027); no private right of action.
- 11
MZ · Regulator & Framework · date pending
Data-protection bill confirmed still pending before the Assembly; no ANPD yet operational.
- 12
US-CT · Algorithmic, Biometric & Surveillance Governance · 2026-10-01
New facial-recognition signage/policy duty and genetic-data consent duty under PA 26-64, both effective 2026-10-01.
- 13
EC · Cross-Border & Adequacy · 2026-01-28
SPDP Resolución SPDP-SPD-2026-0004 (28 Jan 2026) establishes adequacy-based and alternative-safeguard transfer mechanisms, adopting RIPD model clauses.
- 14
CA · Children & Vulnerable Groups · 2026-10-20
Privacy Commissioner launched Canada's first Children's Privacy Code on 20 October 2026.
- 15
US-VA · Algorithmic, Biometric & Surveillance Governance · 2026-10-15
AG joined multistate Character.AI bankruptcy-notice coalition (2026-10-15).
- 16
PW · Regulator & Framework · 2026-07-21
RPPL 12-8 creates the Bureau of Cybersecurity, signed 21 July 2026; predates window.
- 17
US-AL · Controller/Processor Duties · 2026-02-20
Processor-contract requirement established; no DPIA requirement per most secondary sources.
- 18
US-MI · Controller/Processor Duties · date pending
AG testified in support of SB 888-892 breach-notification reform package this cycle.
- 19
- 20
NZ · Algorithmic, Biometric & Surveillance Governance · 2026-08-03
Biometric Processing Privacy Code 2025's nine-month grace period for pre-existing biometric processing expired 3 August 2026; full compliance now mandatory.
- 21
US-CA · Algorithmic, Biometric & Surveillance Governance · 2026-01-01
ADMT/risk-assessment/cybersecurity-audit regulations (adopted July 24, 2025, in force Jan 1, 2026) remain in force with phased compliance dates through 2027-2028; no amendment located this cycle.
- 22
US-DE · Enforcement & Redress · 2026-01-01
Mandatory cure period sunset 2025-12-31; no new DPDPA enforcement action announced.
- 23
VN · Controller/Processor Duties · 2026-01-01
New DPO qualification requirement and 60-day cross-border TIA filing deadline introduced.
- 24
NG · Sectoral Watch · 2027-01-01
CBN's payments-data-localisation mandate (1 Jan 2027) explicitly cross-references NDPA compliance, a new sectoral overlay.
Also tracked by world-payments:W3
- 25
US-KS · Algorithmic, Biometric & Surveillance Governance · 2026-10-14
Kansas AG filed a Consumer Protection Act lawsuit against OpenAI on 14 October 2026.
- 26
PL · Enforcement & Redress · 2026-09-16
UODO's active enforcement cadence continues: PLN 31,507 fine for non-cooperation (30 Sept 2026); sector-wide health-data inspection sweep opened 16 Sept 2026, running to end-2026. Both dated items fall before this cycle's window-open and are reported as standing recent context.
- 27
GI · Cross-Border & Adequacy · 2026-07-15
Art.45(1) amended: Gibraltar-to-UK transfers under Art.45(1)(b), Gibraltar-to-EU-Member-State transfers under Art.45(1)(c).
- 28
KZ · Lawful Processing & Special Data · 2026-06-24
Risk-based three-tier controller classification introduced; biometric data escalates tier regardless of subject count.
- 29
- 30
- 31
TH · Controller/Processor Duties · date pending
28 May 2026 PDPC clarification narrows mandatory breach-notification scope (no-risk exemption).
- 32
- 33
BG · Algorithmic, Biometric & Surveillance Governance · date pending
AI Act Article 70 market-surveillance authority remains undesignated; implementing bill scheduled for October 2026 tabling, not yet enacted.
- 34
RS · Algorithmic, Biometric & Surveillance Governance · date pending
Draft replacement law introduces AI-specific risk tiers (high-risk/direct-interaction/minimal-risk) and a dedicated video-surveillance chapter with a general employee-monitoring prohibition, 6-month footage retention cap and 1-year access-log retention; not yet in force.
- 35
US-WA · Enforcement & Redress · date pending
AG's first Data Privacy Report (14 Aug 2026); 209 breaches affecting 8M+ WA residents reported in 2025; MHMDA private litigation ongoing.
- 36
US-MN · Algorithmic, Biometric & Surveillance Governance · 2026-10-02
Eighth Circuit granted xAI an injunction pending appeal against MN's AI-nudification statute on 2 Oct 2026; xAI's opening appellate brief due 29 Oct 2026.
- 37
- 38
CN · Regulator & Framework · date pending
Amended CSL (effective 1 Jan 2026) broadens extraterritorial enforcement scope.
- 39
US-MA · Enforcement & Redress · date pending
AG's Character.AI bankruptcy intervention and continuing Data Privacy Act negotiation are the most recent enforcement-adjacent developments within 180 days.
- 40
UK · Enforcement & Redress · 2026-10-19
Clearview AI Court of Appeal jurisdiction challenge hearing opened 19 Oct 2026.
- 41
US-NE · Sectoral Watch · date pending
New Agricultural Data Privacy Act identified as a first-of-its-kind sectoral instrument.
- 42
- 43
HR · Algorithmic, Biometric & Surveillance Governance · 2026-10-13
EDPB smart-glasses statement; AZOP biometric fine.
- 44
US-IL · Enforcement & Redress · date pending
Character.AI coalition notice and BIPA retroactivity ruling are the two most material 180-day developments.
- 45
PH · Data Subject Rights · 2026-10-19
Draft Circular on Data Subject Rights consultation closed 5 Oct 2026; in-person consultation held 19 Oct 2026; final adoption pending.
- 46
US-WY · Sectoral Watch · 2026-09-28
SF0020 enacted; draft 27LSO-0140 (private-sector data-ownership bill) opposed by SIIA on Sept 28, 2026.
- 47
IS · AdTech & Commercial Privacy · 2026-03-01
Supreme Court revoked five Google Workspace fines against municipalities in March 2026 on evidentiary grounds; underlying GDPR-violation findings reportedly stand.
- 48
SE · Algorithmic, Biometric & Surveillance Governance · date pending
IMY 2026 priority: AI in the public sector.
- 49
- 50
CA-QC · AdTech & Commercial Privacy · 2026-10-22
CAI published new guidance (22 Oct 2026) on dark patterns and its quinquennial report recommended legally prohibiting deceptive-design interfaces affecting personal-information protection.
- 51
LU · Enforcement & Redress · date pending
2025: 8 corrective decisions, 7 fines, EUR216,061 aggregate; Law of 20 November 2025 introduced a class-action framework.
- 52
- 53
TN · Regulator & Framework · 2026-02-23
INPDP interim-presidency change amid lapsed council mandate; GDPR-aligned reform bill remains unenacted.
- 54
CW · Algorithmic, Biometric & Surveillance Governance · 2026-10-21
CGA licensing-portal breach exposed confidential UBO/licensing data; criminal complaints filed in three countries.
- 55
US-WI · Algorithmic, Biometric & Surveillance Governance · date pending
WI DOJ joined 38-40-state Character.AI bankruptcy notice on Oct 16, 2026
- 56
EEA · Cross-Border & Adequacy · 2026-10-13
EDPB adopted three Art 64 BCR opinions (Michelin, Snowflake x2) on 13 October 2026.
- 57
BZ · Sectoral Watch · 2026-08-25
Draft National Data and Statistical Systems Act, 2026 briefed to agencies 25 Aug 2026; still at consultation/drafting stage.
- 58
LV · AdTech & Commercial Privacy · 2026-07-02
DVI's cookie-compliance sweep resulted in a EUR 1,000 fine against SIA 4YOU MEBELES (2 July 2026) for cookie deficiencies and insufficient cooperation.
- 59
CA-NB · Enforcement & Redress · 2026-06-04
OPC national complaint volume rose 109% YoY; no NB-specific action identified.
- 60
BE · Data Subject Rights · 2026-05-08
An 8 May 2026 APD decision fined a law firm EUR 4,920 for improperly charging for an access request and lacking a privacy policy.
- 61
US-ND · Children & Vulnerable Groups · 2026-10-20
AI chatbot-and-minors proposal considered but not advanced Oct 20, 2026; remains live for further work before 2027 session.
- 62
- 63
SN · Children & Vulnerable Groups · 2026-10-21
ENA's October 2026 competitive-exam communiqué (reported 21 Oct 2026, within this window) limits published candidate fields citing Loi n°2008-12 compliance.
- 64
RO · Enforcement & Redress · 2026-10-01
ANSPDCP fined MyConnector Platform S.R.L. approx. 6,000 EUR in October 2026 for inadequate technical/organisational security measures.
- 65
LATAM · Children & Vulnerable Groups · 2026-05-26
RIPD 2026 Standards strengthen children's digital protections (age verification, profiling restrictions).
- 66
AT · Enforcement & Redress · 2026-03-26
DSB 2025 activity report confirms published-decision growth (19 to 67) attributed to IFG.
- 67
- 68
SK · Sectoral Watch · date pending
UOOU 2026 control plan names gambling-operator and biometric-employment processing as inspection priorities.
- 69
SG · Algorithmic, Biometric & Surveillance Governance · 2026-07-20
PDPC's July 2026 advisory guidelines on generative-AI consent notifications remain the standing position; no new dated item this cycle.
- 70
- 71
ES · Enforcement & Redress · 2026-10-23
AEPD proposed EUR 5,000 fine and redaction order against investigative outlet El Salto over reporting on undercover police infiltration of social movements.
- 72
- 73
- 74
US-CO · Controller/Processor Duties · 2026-10-15
ADMT interim draft AML/sanctions disclosure carve-out
- 75
- 76
US-SC · Algorithmic, Biometric & Surveillance Governance · date pending
S.963 high-risk AI bill remains at introduction stage; AADC profiling restrictions apply to minors.
- 77
HU · Regulator & Framework · 2026-10-09
NAIH recommendation on bank probate-data minimisation.
- 78
CI · Algorithmic, Biometric & Surveillance Governance · 2026-05-18
RAPDP 2026 adopted Déclaration d'Abidjan 2026-2030; policy-dialogue level only.
- 79
GG-ALD · Algorithmic, Biometric & Surveillance Governance · 2026-05-11
ODPA co-chairs the Global Privacy Assembly's International Enforcement Cooperation Working Group, which coordinated a Joint Statement on AI Imagery and deepfakes signed by 61 data protection authorities globally (reported May 2026).
- 80
- 81
MA · Regulator & Framework · 2026-10-21
CNDP-NIIAT Data-Tika partnership signed 21 Oct 2026.
Still developing
Carried from earlier editions, unchanged.
- 82
US-IA · Enforcement & Redress · 2026-10-14
Four new Consumer Fraud Act filings touching data/privacy risk within a nine-day window (2026-10-06 to 2026-10-14): TP-Link, ADI Global, Lorex, OpenAI.
- 83
US-TX · Algorithmic, Biometric & Surveillance Governance · 2026-10-23
TRAIGA enforcement portal active; OpenAI/Sam Altman suit filed Oct 23, 2026 under DTPA/SCOPE Act.
- 84
CM · Regulator & Framework · date pending
Law No. 2024/017 (23 Dec 2024) creates the APDP, Cameroon's first dedicated personal-data-protection authority; organisational decree not yet located.
- 85
VU · Algorithmic, Biometric & Surveillance Governance · date pending
Annual ICT service permit for ICT service providers including AI and AI-related data services
- 86
NP · Regulator & Framework · date pending
IT and Cyber Security Bill 2082's enactment status remains disputed between sources; no independent DPA exists.
- 87
PE · Enforcement & Redress · date pending
ANPD inspections up 67% YoY in 2025; continuing high-volume enforcement into 2026 with e-commerce newly prominent.
- 88
US-NH · Children & Vulnerable Groups · 2026-06-19
HB 1460 bans the sale of a known child's personal data, effective 1 January 2027.
- 89
IM · Enforcement & Redress · date pending
ICO increased published regulatory action (Cabinet Office reprimand, 10 Aug 2026); Dept of Infrastructure decision notice (16 Oct 2026) just outside window.
- 90
UA · Enforcement & Redress · 2026-10-23
Draft Law No. 8153 penalty ceiling (UAH 90m / 5% turnover) confirmed still proposed; National Programme June 2026 target missed.
- 91
CA-BC · Data Subject Rights · 2026-10-06
PIPA s.23(1) access order issued against a strata corporation, published ~6 Oct 2026, within this cycle's window.
- 92
UY · Enforcement & Redress · date pending
Disputed figure on database-suspension length (5 days vs 6 working days) between two sources.
- 93
EG · Enforcement & Redress · 2026-10-31
Grace period under the Executive Regulations expires 31 Oct/1 Nov 2026; no PDPC enforcement decision yet located.
- 94
- 95
RU · Algorithmic, Biometric & Surveillance Governance · date pending
Internet-governance regulation effective March 2026 authorises Runet disconnection/site-blocking; VPN-hosting-register bill reported 8 Oct 2026 would add ~RUB60bn traffic-filtering funding and a hosting-provider register.
- 96
PA · Cross-Border & Adequacy · 2026-03-26
ANTAI Resolution ANTAI-DG-003-2026 approved the RIPD Standard Contractual Clauses as a concrete transfer mechanism.
- 97
DZ · Algorithmic, Biometric & Surveillance Governance · 2026-05-06
ANPDP Decisions 02 (video surveillance) and 03 (biometric attendance) confirmed; no ADM-specific statutory test located.
- 98
AG · Algorithmic, Biometric & Surveillance Governance · 2026-06-18
Electronic Crimes (Amendment) Act (reported June 2026) strengthens law-enforcement production-order powers over electronic data; a criminal-procedure instrument distinct from the DPA's own national-security exemption.
- 99
- 100
US-NJ · Enforcement & Redress · 2026-07-01
Mandatory 30-day cure period sunset 2026-07-01; 10 cure letters issued between 2025-03-24 and the cure period's close.
Regulatory horizon
- AR · Expediente 3397-D-2026 omnibus DP reform bill · 2026-Q4 · multi year
- BG · Bulgaria AI Act implementing bill tabling expected · closed 2026-10 · quarter
- BR · ANPD fiscalização/sanctions regulation consultation closes · closed 2026-10-26 · quarter
- BR · ANPD sanctions dosimetry update consultation closes · 2026-11-30 · quarter
- BZ · National Data and Statistical Systems Act, 2026 finalisation · 2027-Q2 · year
- CA-NB · RTIPPA reform legislation expected · 2026-Q4 · half year
- CA-ON · Bill 97 FIPPA/MFIPPA final amendment tranche · 2027-01-01 · quarter
- CL · Ley 21.719 commencement date (1 Dec 2026, possibly postponed to 1 Dec 2027) · 2026-12-01 · quarter
- CM · APDP organisational decree publication pending · 2026-Q4 · half year
- CO · SIC post-consultation protocol under Ley 2573/2026 expected · 2026-Q4 · quarter
- CR · TSE recurso de revocatoria against Prodhab Resolution 029-2026-RF · 2026-Q4 · half year
- CY · AI Act high-risk obligations deadline deferred (Digital Omnibus) · 2027-12-02 · year
- CZ · Czech Data Act implementing/penalty legislation (unadopted, deadline elapsed) · 2027-Q1 · year
- CZ · Czech AI Act Adaptation Act (draft) · 2027-Q1 · year
- DO · INDOTEL draft General Telecommunications, Digital Infrastructure and Connectivity Law · 2026-Q4 · half year
- DZ · ANPDP regional audit poles implementing regulation · 2026-Q4 · half year
- EE · 936 SE awaiting Riigi Teataja publication · 2026-Q4 · quarter
- EE · 796 SE dark-patterns/distance-financial-services transposition pending · 2026-Q4 · half year
- EEA · Data Act switching-charge ban takes full effect · 2027-01-12 · quarter
- EEA · EDPB fine-methodology guidelines consultation closes · 2026-11-13 · quarter
- HU · EDPB smart-glasses guideline public consultation close · 2026-11-13 · quarter
- JP · APPI amendment (Act No. 56/2026) commencement, including administrative fine system and biometric-data category · 2027-Q2 · year
- JP · PPC technical safety-management-measure guideline revision · 2027-Q2 · half year
- KR · PIPA Enforcement Decree implementing 11 Sept 2026 fine-ceiling amendment · closed 2026-09-11 · quarter
- LATAM · RIPD Estándares possible formal adoption at Ibero-American Summit · 2026-Q4 · half year
- LK · PDPA Parts I and III come into force · 2027-01-01 · quarter
- LK · PDPA Part II (data subject rights) commencement date still unannounced · 2027-Q2 · multi year
- LU · EU Data Act cloud-switching charge abolition · 2027-01-12 · quarter
- LU · EU Data Act access-by-design duty for connected products · closed 2026-09-12 · quarter
- MT · AI regulatory sandbox deadline postponed · 2027-08-02 · quarter
- MZ · Proposta de Lei de Protecção de Dados Pessoais pending before Assembleia da República · 2027-Q1 · multi year
- NG · CBN payments data-localisation deadline with NDPA cross-reference · 2027-01-01 · quarter
- NP · IT and Cyber Security Bill 2082 — disputed enactment status · 2026-Q4 · half year
- NZ · Civil pecuniary penalty regime advice to Ministry of Justice · 2027-Q2 · multi year
- PH · NPC Draft Circular on Data Subject Rights adoption · 2026-Q4 · half year
- PH · NPC Draft PIA Circular adoption · 2026-Q4 · half year
- RS · Serbia draft replacement Law on Personal Data Protection · 2026-Q4 · multi year
- SN · Loi n°25/2026 implementing decrees and cybersecurity authority commencement · 2027-Q1 · year
- UA · Draft Law No. 8153 GDPR-alignment adoption (missed target) · closed 2026-06-01 · multi year
- UK · ICO agentic-AI call for evidence closes · 2026-11-20 · quarter
- US · Connecticut data-broker registry registration date · 2027-01-01 · quarter
- US-AK · HB 367 Consumer Data Privacy Act — possible future action · 2027-Q1 · multi year
- US-AL · APDPA effective date · 2027-05-01 · quarter
- US-AL · App Store Accountability Act in force · 2027-01-01 · quarter
- US-AL · App Store Accountability Act retroactive deadline for existing accounts · 2027-10-01 · quarter
- US-CO · Colorado ADMT Act and Chatbot Safety Act take effect · 2027-01-01 · quarter
- US-CO · ADMT formal rulemaking hearing and comment close · closed 2026-10-26 · quarter
- US-DE · DPDPA HB 380 amendments take effect · 2027-01-01 · quarter
- US-GA · Georgia Conversational AI Safety Act (SB 540) in force · 2027-07-01 · quarter
- US-GA · Georgia SB 444 AI health-plan utilization-review limits in force · 2027-01-01 · quarter
- US-ID · Idaho Conversational AI Safety Act takes effect · 2027-07-01 · quarter
- US-KY · KCDPA DPIA duty takes effect for post-trigger-date processing · closed 2026-06-01 · quarter
- US-LA · Louisiana Data Privacy Act takes effect · 2027-01-01 · quarter
- US-LA · LDPA 30-day cure-period window closes · 2027-07-31 · quarter
- US-MA · Massachusetts Data Privacy Act conference-committee reconciliation · 2027-01 · half year
- US-MA · Mandatory AG rulemaking deadline under House Data Privacy Act bill (if enacted) · 2027-05-01 · year
- US-MI · Senate Bills 888-892 breach-notification reform · 2027-Q1 · half year
- US-NE · LB838 AADC amendment effective · closed 2026-07-17 · quarter
- US-NH · HB 1460 children's-data sale ban in force · 2027-01-01 · quarter
- US-NJ · NJDPA data broker/collector registry launch · 2027-Q2 · half year
- US-NJ · NJDPA implementing rulemaking restart (unconfirmed timeline) · 2027 · multi year
- US-NM · Anticipated NM social-media-safety / age-verification bill · 2027-Q1 · year
- US-NY · RAISE Act takes effect · 2027-01-01 · quarter
- US-OK · Oklahoma Consumer Data Privacy Act (OKCDPA) takes effect · 2027-01-01 · quarter
- US-RI · RI AI Companion Models Act (S 2195/H 7350) takes effect · 2027-01-01 · quarter
- US-TN · TN TACIR AI study report due · 2027-01-31 · quarter
- US-UT · HB 357 motor-vehicle-data amendments to UCPA take effect · 2027-01-01 · quarter
- US-VT · VDPOSA (Act 145) comes into force · 2028-01-01 · quarter
- US-VT · Vermont AADC in force · 2027-01-01 · quarter
- US-WA · HB 1170 AI content-provenance disclosure comes into force · 2027-02-01 · quarter
Ranked within this monitor (per_consumer); tie-break recency_date_desc, jid_asc, module_asc, url_asc. Index tool 1.5.0, edition policy 1.2.0.