---
title: "Roundup — Data Protection Monitor — 2026-11-01"
canonical: https://dataprotection.gi/roundup/2026-11-01/
source_html: /roundup/2026-11-01/index.html
description: "Roundup — Data Protection Monitor — 2026-11-01 — Global Privacy, Data Protection & Cross-Border Transfer Regulatory Intelligence."
generated_at: 2026-11-04T04:45:59Z
content_sha256: 353df2c0d9fa17677fbba68a89993e7a1a7dd5f4204cdf7e98723a6e8ae1f3ef
generator: "fe-fleet/md-twin@1.0"
---
# Roundup — Data Protection Monitor — 2026-11-01

Roundup

# Data Protection Monitor — 2026-11-01

Assembled deterministically from our recent research runs and ranked by date and importance.

Previous editions
- [Latest edition](/roundup/)
- [2026-10-25](/roundup/2026-10-25/)
- [2026-10-18](/roundup/2026-10-18/)
- [2026-10-11](/roundup/2026-10-11/)
- [2026-10-04](/roundup/2026-10-04/)
- [2026-09-27](/roundup/2026-09-27/)
- [2026-09-20](/roundup/2026-09-20/)
- [2026-09-07](/roundup/2026-09-07/)

## New or updated since 2026-10-25

New to this edition or changed since the last one.

- CO · Algorithmic, Biometric & Surveillance Governance · 2026-06-18 ### SIC finally confirmed (18 June 2026) definitive closure of World Foundation/Tools for Humanity's iris-biometric 'Orb' operation for unauthorised processing of sensitive biometric data. [Superintendencia de Industria y Comercio (SIC)](https://sedeelectronica.sic.gov.co/comunicado/la-sic-confirma-la-sancion-de-cierre-inmediato-y-definitivo-de-la-operacion-de-tratamiento-de-datos-sensibles-adelantada-por-world)

- US-VT · Regulator & Framework · 2026-06-16 ### Act 145 (VDPOSA) enacted 16 June 2026, effective 1 January 2028, enforced exclusively by the Vermont Attorney General. [Vermont General Assembly](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

- GR · Controller/Processor Duties · 2026-07-28 ### HDPA Decision No. 15 fined Ministry €200,000 and processor EETAA €150,000 for Art 25/28/32-34 breach. [European Data Protection Board](https://www.edpb.europa.eu/news/hellenic-dpa-decision-on-a-data-breach-involving-eetaa-sa-as-processor-for-the-ministry-of_en)

- FR · Enforcement & Redress · 2026-08-24 ### Two injunction closures (FRANCE TRAVAIL, GOOGLE) confirm ongoing active enforcement; no new sanction decision dated within the window. [CNIL](https://www.cnil.fr/en/tag/Sanctions)

- US-NM · Enforcement & Redress · 2026-10-21 ### October 21, 2026: $25 billion UPA civil penalty against Meta over the Cambridge Analytica matter, the largest identified state-level privacy-adjacent penalty globally this cycle; follows the March/August 2026 combined $942 million child-safety orders. [CNN](https://www.cnn.com/2026/10/21/tech/meta-25-billion-new-mexico-judgment)

- LK · Regulator & Framework · 2026-07-22 ### Gazette Extraordinary of 22 July 2026 fixes 1 January 2027 commencement for Parts I and III. [Ada Derana](https://adaderana.lk/news/cmsjsp2vt0005356q4pjfv4ih)

- US · Enforcement & Redress · 2026-10-19 ### FTC required Publicis to continue providing neutral data-access terms as a condition of its LiveRamp acquisition (Oct 19, 2026); FTC sent over $9.8M to consumers harmed by Walmart's wire-fraud failures (Oct 15, 2026). [Federal Trade Commission](https://www.ftc.gov/news-events/news/commission-actions)

- BD · Cross-Border & Adequacy · 2026-02-05 ### Feb 2026 Amendment Ordinance narrowed data-localisation mandate to a synchronised real-time copy requirement for restricted/CII data only. [Digital Policy Alert](https://digitalpolicyalert.org/change/18757-personal-data-protection-amendment-ordinance-2026-ordinance-no-23-of-2026)

- US-HI · Data Subject Rights · 2026-07-14 ### Act 252 (Social Media Data Deletion Act) enacted 2026-07-14, effective 2027-07-01, creating a narrow platform-specific deletion right. [Hawaii State Legislature / Office of the Governor](https://data.capitol.hawaii.gov/sessions/session2026/bills/GM1354_.pdf)

- US-LA · Enforcement & Redress · 2026-05-29 ### LDPA gives AG exclusive enforcement with a time-limited cure period (Jan-Jul 2027); no private right of action. [Bass Berry & Sims](https://bassberry.com/news/louisiana-joins-the-second-line-of-states-with-comprehensive-privacy-laws/)

- MZ · Regulator & Framework · date pending ### Data-protection bill confirmed still pending before the Assembly; no ANPD yet operational. [INTIC (Instituto Nacional de Tecnologias de Informação e Comunicação)](https://intic.gov.mz/mocambique-apresenta-avancos-no-combate-ao-cibercrime-na-conferencia-octopus-2026/)

- US-CT · Algorithmic, Biometric & Surveillance Governance · 2026-10-01 ### New facial-recognition signage/policy duty and genetic-data consent duty under PA 26-64, both effective 2026-10-01. [CT Mirror](https://ctmirror.org/2026/09/28/artificial-intelligence-data-privacy-laws-october-ct/)

- EC · Cross-Border & Adequacy · 2026-01-28 ### SPDP Resolución SPDP-SPD-2026-0004 (28 Jan 2026) establishes adequacy-based and alternative-safeguard transfer mechanisms, adopting RIPD model clauses. [Allende & Brea](https://allende.com/privacidad-y-ciberseguridad/ecuador-adopta-normas-para-regular-las-transferencias-y-tratamientos-a-gran-escala-de-datos-personales-02-11-2026/)

- CA · Children & Vulnerable Groups · 2026-10-20 ### Privacy Commissioner launched Canada's first Children's Privacy Code on 20 October 2026. [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_261020)

- US-VA · Algorithmic, Biometric & Surveillance Governance · 2026-10-15 ### AG joined multistate Character.AI bankruptcy-notice coalition (2026-10-15). [Office of the Attorney General of Virginia](https://www.oag.state.va.us/media-center/news-releases/3140-attorney-general-jones-puts-character-ai-on-notice-with-bankruptcy-court-filing)

- PW · Regulator & Framework · 2026-07-21 ### RPPL 12-8 creates the Bureau of Cybersecurity, signed 21 July 2026; predates window. [Island Times](https://islandtimes.org/oek-passes-cybersecurity-bill-as-new-presidential-tech-office-raises-overlap-questions/)

- US-AL · Controller/Processor Duties · 2026-02-20 ### Processor-contract requirement established; no DPIA requirement per most secondary sources. [Privacy Law Map](https://privacylawmap.com/blog/data-breach-notification-laws-by-state-2026)

- US-MI · Controller/Processor Duties · date pending ### AG testified in support of SB 888-892 breach-notification reform package this cycle. [RecordingLaw.com](https://www.recordinglaw.com/us-laws/data-privacy-laws/michigan-data-privacy-laws/data-breach-notification/)

- IT · Regulator & Framework · 2026-10-23 ### D.Lgs. 179/2026 in force 23 October 2026 designates AgID/ACN as national AI Act authorities and sectoral financial regulators for high-risk AI in finance, leaving the Garante's DP competence distinct. [SimplyBiz](https://www.simplybiz.eu/decreto-legislativo-179-2026-ai-act-autorita-vigilanza/)

- NZ · Algorithmic, Biometric & Surveillance Governance · 2026-08-03 ### Biometric Processing Privacy Code 2025's nine-month grace period for pre-existing biometric processing expired 3 August 2026; full compliance now mandatory. [SecSolutionsHub](https://www.secsolutionshub.com/biometric-processing-privacy-code-nz-compliance/)

- US-CA · Algorithmic, Biometric & Surveillance Governance · 2026-01-01 ### ADMT/risk-assessment/cybersecurity-audit regulations (adopted July 24, 2025, in force Jan 1, 2026) remain in force with phased compliance dates through 2027-2028; no amendment located this cycle. [Lowenstein Sandler](https://www.lowenstein.com/news-insights/publications/client-alerts/automated-decision-making-under-the-microscope-cppa-finalizes-new-ccpa-rules-data-privacy)

- US-DE · Enforcement & Redress · 2026-01-01 ### Mandatory cure period sunset 2025-12-31; no new DPDPA enforcement action announced. [Centraleyes](https://www.centraleyes.com/privacy-laws/delaware/)

- VN · Controller/Processor Duties · 2026-01-01 ### New DPO qualification requirement and 60-day cross-border TIA filing deadline introduced. [LE & TRAN](https://letranlaw.com/practices/data-privacy-personal-data-protection/)

- NG · Sectoral Watch · 2027-01-01 ### CBN's payments-data-localisation mandate (1 Jan 2027) explicitly cross-references NDPA compliance, a new sectoral overlay. [Innov8tiv](https://innov8tiv.com/the-great-nigerian-cloud-migration-why-the-clock-is-ticking-for-banks-and-fintechs/) Also tracked by world-payments:W3

- US-KS · Algorithmic, Biometric & Surveillance Governance · 2026-10-14 ### Kansas AG filed a Consumer Protection Act lawsuit against OpenAI on 14 October 2026. [Newstalk KZRG](https://www.newstalkkzrg.com/2026/10/14/kansas-sues-openai-accusing-chatgpt-of-endangering-children-and-misleading-parents/)

- PL · Enforcement & Redress · 2026-09-16 ### UODO's active enforcement cadence continues: PLN 31,507 fine for non-cooperation (30 Sept 2026); sector-wide health-data inspection sweep opened 16 Sept 2026, running to end-2026. Both dated items fall before this cycle's window-open and are reported as standing recent context. [Gibson Dunn](https://www.gibsondunn.com/gibson-dunn-europe-data-protection-october-2026/)

- GI · Cross-Border & Adequacy · 2026-07-15 ### Art.45(1) amended: Gibraltar-to-UK transfers under Art.45(1)(b), Gibraltar-to-EU-Member-State transfers under Art.45(1)(c). [Gibraltarlaw.com](https://www.gibraltarlaw.com/data-protection-changes-taking-effect-under-the-uk-eu-treaty-on-gibraltar/)

- KZ · Lawful Processing & Special Data · 2026-06-24 ### Risk-based three-tier controller classification introduced; biometric data escalates tier regardless of subject count. [Bluescreen.kz](https://bluescreen.kz/novyie-obiazatielstva-dlia-kompanii-rabotaiushchikh-s-piersonalnymi-dannymi-v-kazakhstanie/)

- US-GA · Enforcement & Redress · 2026-05-11 ### SB 540 creates an AG-enforced civil penalty of up to $10,000 per knowing violation, effective July 1, 2027; the breach-notice statute itself remains penalty-silent with no private right of action. [Clunic](https://clunic.com/regulations/georgia-ai-healthcare-laws)

- TW · Enforcement & Redress · date pending ### A Taipei police officer was detained in part over unauthorised personal-data queries, prosecuted under PDPA criminal provisions alongside unrelated gambling charges. [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=TW)

- TH · Controller/Processor Duties · date pending ### 28 May 2026 PDPC clarification narrows mandatory breach-notification scope (no-risk exemption). [Chambers Practice Guides](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/thailand/trends-and-developments)

- CR · Sectoral Watch · date pending ### Ley 10946 (e-commerce governance, enacted June 2026) establishes consumer-protection rules for digital services; not a GDPR-style data-access instrument. [Law Library of Congress](https://www.loc.gov/item/global-legal-monitor/2026-10-07/costa-rica-government-strengthens-e-commerce-consumer-protections)

- BG · Algorithmic, Biometric & Surveillance Governance · date pending ### AI Act Article 70 market-surveillance authority remains undesignated; implementing bill scheduled for October 2026 tabling, not yet enacted. [The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/bulgaria-ai-act-implementing-law-scheduled-2026)

- RS · Algorithmic, Biometric & Surveillance Governance · date pending ### Draft replacement law introduces AI-specific risk tiers (high-risk/direct-interaction/minimal-risk) and a dedicated video-surveillance chapter with a general employee-monitoring prohibition, 6-month footage retention cap and 1-year access-log retention; not yet in force. [Captain Compliance](https://captaincompliance.com/news/serbias-draft-personal-data-protection-law-major-expansion-on-ai-surveillance-and-transfers/)

- US-WA · Enforcement & Redress · date pending ### AG's first Data Privacy Report (14 Aug 2026); 209 breaches affecting 8M+ WA residents reported in 2025; MHMDA private litigation ongoing. [RecordingLaw](https://www.recordinglaw.com/us-laws/data-privacy-laws/washington-data-privacy-laws/)

- US-MN · Algorithmic, Biometric & Surveillance Governance · 2026-10-02 ### Eighth Circuit granted xAI an injunction pending appeal against MN's AI-nudification statute on 2 Oct 2026; xAI's opening appellate brief due 29 Oct 2026. [Bloomberg Law](https://news.bloomberglaw.com/litigation/musks-xai-wins-block-on-minnesota-ai-nudification-ban)

- US-SD · Enforcement & Redress · 2026-07-01 ### SB 49 adds a new $5,000-per-violation AG civil penalty for genetic-data breaches, alongside the existing $10,000/day breach-notification penalty; neither statute creates a private right of action. [OpenAgreements](https://openagreements.org/practice-guides/privacy/us/south-dakota)

- CN · Regulator & Framework · date pending ### Amended CSL (effective 1 Jan 2026) broadens extraterritorial enforcement scope. [CMS Law](https://cms.law/en/chn/legal-updates/china-amends-its-cybersecurity-law-for-the-first-time)

- US-MA · Enforcement & Redress · date pending ### AG's Character.AI bankruptcy intervention and continuing Data Privacy Act negotiation are the most recent enforcement-adjacent developments within 180 days. [RecordingLaw](https://www.recordinglaw.com/us-laws/data-privacy-laws/massachusetts-data-privacy-laws/)

- UK · Enforcement & Redress · 2026-10-19 ### Clearview AI Court of Appeal jurisdiction challenge hearing opened 19 Oct 2026. [Resultsense (via PPC Land)](https://www.resultsense.com/news/2026-10-20-clearview-court-of-appeal-ico-fine/)

- US-NE · Sectoral Watch · date pending ### New Agricultural Data Privacy Act identified as a first-of-its-kind sectoral instrument. [Koley Jessen](https://www.koleyjessen.com/insights/publications/nebraska-joins-the-data-privacy-legislation-wave)

- CZ · Sectoral Watch · 2026-09-12 ### EU Data Act access-by-design duty live from 12 Sept 2026 as EU law; CZ implementing/penalty legislation remains unadopted past the deadline. [Lexology](https://www.lexology.com/library/detail.aspx?g=1846245b-47ca-4480-83a7-2ec2cf457c47)

- HR · Algorithmic, Biometric & Surveillance Governance · 2026-10-13 ### EDPB smart-glasses statement; AZOP biometric fine. [AZOP](https://azop.hr/naslovna-english/)

- US-IL · Enforcement & Redress · date pending ### Character.AI coalition notice and BIPA retroactivity ruling are the two most material 180-day developments. [BSG Tech](https://bsgtech.com/illinois-cybersecurity-compliance-laws/)

- PH · Data Subject Rights · 2026-10-19 ### Draft Circular on Data Subject Rights consultation closed 5 Oct 2026; in-person consultation held 19 Oct 2026; final adoption pending. [National Privacy Commission](https://privacy.gov.ph/)

- US-WY · Sectoral Watch · 2026-09-28 ### SF0020 enacted; draft 27LSO-0140 (private-sector data-ownership bill) opposed by SIIA on Sept 28, 2026. [Wyoming Legislature](https://wyoleg.gov/InterimCommittee/2026/S19-2026092827LSO-0140v0.5.pdf)

- IS · AdTech & Commercial Privacy · 2026-03-01 ### Supreme Court revoked five Google Workspace fines against municipalities in March 2026 on evidentiary grounds; underlying GDPR-violation findings reportedly stand. [Clickport](https://clickport.io/blog/privacy-analytics-iceland)

- SE · Algorithmic, Biometric & Surveillance Governance · date pending ### IMY 2026 priority: AI in the public sector. [IMY](https://www.imy.se/om-oss/vart-uppdrag/vagledning-och-tillsyn-2026/)

- EE · AdTech & Commercial Privacy · date pending ### 796 SE, transposing EU Distance Marketing of Financial Services Directive, would prohibit manipulative interface design and require a right to a human agent; exact reading stage unconfirmed. [Ecovis](https://ecovis.lt/regrally-insights-legal-and-investment-update-in-estonia-october-2026/)

- CA-QC · AdTech & Commercial Privacy · 2026-10-22 ### CAI published new guidance (22 Oct 2026) on dark patterns and its quinquennial report recommended legally prohibiting deceptive-design interfaces affecting personal-information protection. [CAI](https://www.cai.gouv.qc.ca/)

- LU · Enforcement & Redress · date pending ### 2025: 8 corrective decisions, 7 fines, EUR216,061 aggregate; Law of 20 November 2025 introduced a class-action framework. [Klarproof](https://klarproof.com/regulators/luxembourg/cnpd/)

- DK · Enforcement & Redress · 2026-10-09 ### CPR-register breach is the cycle's lead development; Minister for Research, Education and Digitalisation acknowledged inadequate security and ordered a review; no Datatilsynet decision issued yet. [Sermitsiaq](https://www.sermitsiaq.ag/samfund/medie-it-kriminel-havde-adgang-til-cpr-register-i-21-dage-og-17-timer/2434811)

- TN · Regulator & Framework · 2026-02-23 ### INPDP interim-presidency change amid lapsed council mandate; GDPR-aligned reform bill remains unenacted. [WebManagerCenter](https://www.webmanagercenter.com/2026/02/23/562193/tunisie-vers-un-nouveau-cadre-legal-pour-renforcer-la-protection-des-donnees-personnelles/)

- CW · Algorithmic, Biometric & Surveillance Governance · 2026-10-21 ### CGA licensing-portal breach exposed confidential UBO/licensing data; criminal complaints filed in three countries. [Gamblingclub.be](https://gamblingclub.be/en/curacao-criminal-complaints-gambling-hack/)

- US-WI · Algorithmic, Biometric & Surveillance Governance · date pending ### WI DOJ joined 38-40-state Character.AI bankruptcy notice on Oct 16, 2026 [WisBusiness.com (quoting Wisconsin DOJ press release)](https://www.wisbusiness.com/2026/dept-of-justice-seeks-consumer-protections-in-character-ai-bankruptcy/)

- EEA · Cross-Border & Adequacy · 2026-10-13 ### EDPB adopted three Art 64 BCR opinions (Michelin, Snowflake x2) on 13 October 2026. [EDPB](https://www.edpb.europa.eu/documents_en)

- BZ · Sectoral Watch · 2026-08-25 ### Draft National Data and Statistical Systems Act, 2026 briefed to agencies 25 Aug 2026; still at consultation/drafting stage. [Breaking Belize News](https://www.breakingbelizenews.com/2026/08/26/sib-pushes-new-data-law-to-modernize-belizes-statistical-system/)

- LV · AdTech & Commercial Privacy · 2026-07-02 ### DVI's cookie-compliance sweep resulted in a EUR 1,000 fine against SIA 4YOU MEBELES (2 July 2026) for cookie deficiencies and insufficient cooperation. [Enforcement Tracker](https://enforcementtracker.com/ETid-3304)

- CA-NB · Enforcement & Redress · 2026-06-04 ### OPC national complaint volume rose 109% YoY; no NB-specific action identified. [OPC](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/nr-c_260604/)

- BE · Data Subject Rights · 2026-05-08 ### An 8 May 2026 APD decision fined a law firm EUR 4,920 for improperly charging for an access request and lacking a privacy policy. [Enforcement Tracker](https://www.enforcementtracker.com/ETid-3145)

- US-ND · Children & Vulnerable Groups · 2026-10-20 ### AI chatbot-and-minors proposal considered but not advanced Oct 20, 2026; remains live for further work before 2027 session. [InForum / Jamestown Sun](https://www.jamestownsun.com/news/north-dakota/north-dakota-lawmakers-consider-rules-for-ai-chatbots-and-children)

- ZM · Sectoral Watch · 2026-06-01 ### BoZ's June 2026 Open Finance position paper proposes phased mandatory data-sharing, currently bilateral-agreement-based, contingent on stronger data-protection systems. [Bank of Zambia](https://www.boz.zm/sites/default/files/2026-06/Bank%20of%20Zambia%20Position%20Paper%20on%20Open%20Finance%20in%20Zambia.pdf)

- SN · Children & Vulnerable Groups · 2026-10-21 ### ENA's October 2026 competitive-exam communiqué (reported 21 Oct 2026, within this window) limits published candidate fields citing Loi n°2008-12 compliance. [Social Net Link](https://www.socialnetlink.org/2026/10/21/data-privacy-la-loi-n-2008-12-au-coeur-de-la-demarche-numerique-de-lena/)

- RO · Enforcement & Redress · 2026-10-01 ### ANSPDCP fined MyConnector Platform S.R.L. approx. 6,000 EUR in October 2026 for inadequate technical/organisational security measures. [GDPR Complet](https://gdprcomplet.ro/lista-amenzi-gdpr-2026/)

- LATAM · Children & Vulnerable Groups · 2026-05-26 ### RIPD 2026 Standards strengthen children's digital protections (age verification, profiling restrictions). [El Derecho / Lefebvre](https://elderecho.com/la-red-iberoamericana-actualiza-el-marco-comun-de-privacidad)

- AT · Enforcement & Redress · 2026-03-26 ### DSB 2025 activity report confirms published-decision growth (19 to 67) attributed to IFG. [Datenschutzbehörde](https://www.onlinesicherheit.gv.at/Services/Publikationen/Sicherheitsberichte/2025-DSB-Taetigkeitsbericht.html)

- LT · Enforcement & Redress · 2026-09-30 ### VDAI published a summary of significant 2025 court decisions on 30 Sept 2026, covering LVAT and Regional Administrative Court review of corrective-measure discretion, video-surveillance lawfulness, and legal-obligation/service-fee processing grounds. [ECOVIS ProventusLaw](https://ecovis.lt/regrally-insights-personal-data-protection-ict-regulation-october-2026/)

- SK · Sectoral Watch · date pending ### UOOU 2026 control plan names gambling-operator and biometric-employment processing as inspection priorities. [CMS](https://cms.law/en/deu/publication/GDPR-Enforcement-Tracker-Report/slovakia)

- SG · Algorithmic, Biometric & Surveillance Governance · 2026-07-20 ### PDPC's July 2026 advisory guidelines on generative-AI consent notifications remain the standing position; no new dated item this cycle. [Wikipedia](https://en.wikipedia.org/wiki/Personal_Data_Protection_Act_2012)

- KH · Enforcement & Redress · date pending ### Draft law proposes fines up to 600 million riel plus imprisonment for repeated offences, enforced by MPTC inspectors with judicial-police status; unenacted, so no enforcement activity exists. [DataGuidance / DFDL](https://www.dataguidance.com/opinion/cambodia-personal-data-protection-draft-law-what)

- ES · Enforcement & Redress · 2026-10-23 ### AEPD proposed EUR 5,000 fine and redaction order against investigative outlet El Salto over reporting on undercover police infiltration of social movements. [Resumen Latinoamericano](https://www.resumenlatinoamericano.org/2026/10/23/comunicacion-frente-a-la-ofensiva-contra-el-periodismo-de-investigacion-nuestra-solidaridad-con-el-salto)

- PT · Sectoral Watch · 2026-10-25 ### CNPD Parecer/2026/39 on draft decree integrating digital/AI systems into public procurement flagged auditability and DPIA-type safeguards; exact in-window date unconfirmed. [CNPD](https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/123309)

- CL · Enforcement & Redress · 2026-10-19 ### Pending bill (Boletín N°18.623-07) proposes extending the 12-month written-warning-instead-of-fine leniency under art. sexto transitorio to all companies regardless of size; APDP not yet operational so no enforcement activity possible. [Varela Abogados](https://www.varelaabogados.cl/post/ley-proteccion-datos-personales-chile-21719)

- US-CO · Controller/Processor Duties · 2026-10-15 ### ADMT interim draft AML/sanctions disclosure carve-out [Consumer Financial Services Law Monitor (Ballard Spahr)](https://www.consumerfinancialserviceslawmonitor.com/2026/10/colorado-releases-interim-draft-rules-for-automated-decision-making-technology-and-chatbot-safety-what-changed-and-how-it-affects-financial-services-institutions/)

- US-NY · Sectoral Watch · 2026-09-10 ### NYDFS's 10 September 2026 cybersecurity risk-assessment industry letter (reported 22 October) sets new examination-standard expectations for Part 500 covered entities. [WilmerHale](https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20261022-nydfs-issues-guidance-on-risk-assessments)

- US-SC · Algorithmic, Biometric & Surveillance Governance · date pending ### S.963 high-risk AI bill remains at introduction stage; AADC profiling restrictions apply to minors. [DataGuidance](https://www.dataguidance.com/jurisdiction/south-carolina)

- HU · Regulator & Framework · 2026-10-09 ### NAIH recommendation on bank probate-data minimisation. [gdpr.blog.hu](https://gdpr.blog.hu/?token=581e1d9e0eb7ab2b6734965ec7f2c8b9)

- CI · Algorithmic, Biometric & Surveillance Governance · 2026-05-18 ### RAPDP 2026 adopted Déclaration d'Abidjan 2026-2030; policy-dialogue level only. [Financial Afrik](https://www.financialafrik.com/2026/05/19/cote-divoire-rapdp-2026-la-gouvernance-des-donnees-personnelles-au-coeur-de-leconomie-numerique-africaine/)

- GG-ALD · Algorithmic, Biometric & Surveillance Governance · 2026-05-11 ### ODPA co-chairs the Global Privacy Assembly's International Enforcement Cooperation Working Group, which coordinated a Joint Statement on AI Imagery and deepfakes signed by 61 data protection authorities globally (reported May 2026). [Channel Eye](https://channeleye.media/guernseys-data-protection-authority-elected-to-executive-of-the-global-privacy-assembly/)

- US-PA · Enforcement & Redress · date pending ### HB 78's Oct 6 2026 'removed from table' Senate action is the principal development; a separate House-passed private-right-of-action bill for breach damages remains pending in the Senate. [CyberGL](https://cybergl.com/pennsylvania/philadelphia/blog/pennsylvanias-updated-breach-notification-law-what-changed/)

- MA · Regulator & Framework · 2026-10-21 ### CNDP-NIIAT Data-Tika partnership signed 21 Oct 2026. [Aujourd'hui Le Maroc](https://aujourdhui.ma/societe/protection-de-la-vie-privee-lancement-dune-initiative-pour-former-20-000-jeunes)

## Still developing

Carried from earlier editions, unchanged.

- US-IA · Enforcement & Redress · 2026-10-14 ### Four new Consumer Fraud Act filings touching data/privacy risk within a nine-day window (2026-10-06 to 2026-10-14): TP-Link, ADI Global, Lorex, OpenAI. [Iowa Attorney General](https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-announces-lawsuit-against-openai-for-deceiving-iowa-parents-and-iowans)

- US-TX · Algorithmic, Biometric & Surveillance Governance · 2026-10-23 ### TRAIGA enforcement portal active; OpenAI/Sam Altman suit filed Oct 23, 2026 under DTPA/SCOPE Act. [The Texas Tribune](https://www.texastribune.org/2026/10/23/ken-paxton-chatgpt-openai-lawsuit-texas-attorney-general/)

- CM · Regulator & Framework · date pending ### Law No. 2024/017 (23 Dec 2024) creates the APDP, Cameroon's first dedicated personal-data-protection authority; organisational decree not yet located. [Télé'Asu](https://teleasu.tv/cameroun-lautorite-de-protection-des-donnees-personnelles-voit-le-jour/)

- VU · Algorithmic, Biometric & Surveillance Governance · date pending ### Annual ICT service permit for ICT service providers including AI and AI-related data services [Parliament of Vanuatu](https://parliament.gov.vu/images/Bills/Second%20Ordinary%20session%202025/Bill%20for%20the%20Digital%20Transformation%20Act%20No.%20%20of%202025/Bill%20for%20the%20Digital%20Transformation%20Act%20No.%20%20of%202025.pdf)

- NP · Regulator & Framework · date pending ### IT and Cyber Security Bill 2082's enactment status remains disputed between sources; no independent DPA exists. [Law Alpine](https://lawalpine.com/blog/data-protection-bill-nepal-business-impact)

- PE · Enforcement & Redress · date pending ### ANPD inspections up 67% YoY in 2025; continuing high-volume enforcement into 2026 with e-commerce newly prominent. [XMS LatAm](https://www.xmslatam.com/pe/autoridad-nacional-proteccion-datos-personales/)

- US-NH · Children & Vulnerable Groups · 2026-06-19 ### HB 1460 bans the sale of a known child's personal data, effective 1 January 2027. [DataGuidance](https://www.dataguidance.com/news/new-hampshire-law-prohibiting-sale-childrens-personal)

- IM · Enforcement & Redress · date pending ### ICO increased published regulatory action (Cabinet Office reprimand, 10 Aug 2026); Dept of Infrastructure decision notice (16 Oct 2026) just outside window. [Appleby](https://www.applebyglobal.com/publications/data-protection-guide-isle-of-man/)

- UA · Enforcement & Redress · 2026-10-23 ### Draft Law No. 8153 penalty ceiling (UAH 90m / 5% turnover) confirmed still proposed; National Programme June 2026 target missed. [VoxUkraine](https://voxukraine.org/en/european-regulation-of-personal-data-protection)

- CA-BC · Data Subject Rights · 2026-10-06 ### PIPA s.23(1) access order issued against a strata corporation, published ~6 Oct 2026, within this cycle's window. [Office of the Information and Privacy Commissioner for British Columbia](https://www.oipc.bc.ca/)

- UY · Enforcement & Redress · date pending ### Disputed figure on database-suspension length (5 days vs 6 working days) between two sources. [URCDP](https://www.redipd.org/sites/default/files/inline-files/felipe_rotondo_doc_uruguay.pdf)

- EG · Enforcement & Redress · 2026-10-31 ### Grace period under the Executive Regulations expires 31 Oct/1 Nov 2026; no PDPC enforcement decision yet located. [SOG](https://sog.eg/en/blog/egypt-pdpl-website-compliance-checklist)

- US-IN · Enforcement & Redress · 2026-01-01 ### Civil penalties up to $7,500/violation; permanent 30-day cure period; AG Rokita has signalled intent to narrow sectoral exemptions in a future legislative session; disputed date of active enforcement commencement. [Measured Collective](https://measuredcollective.com/indiana-consumer-data-protection-act-101-what-you-need-to-know/)

- RU · Algorithmic, Biometric & Surveillance Governance · date pending ### Internet-governance regulation effective March 2026 authorises Runet disconnection/site-blocking; VPN-hosting-register bill reported 8 Oct 2026 would add ~RUB60bn traffic-filtering funding and a hosting-provider register. [Meduza](https://meduza.io/en/feature/2026/10/08/russia-has-spent-a-decade-trying-to-stop-people-from-bypassing-internet-censorship-now-it-plans-to-spend-nearly-60-billion-rubles-over-three-years-on-traffic-filtering)

- PA · Cross-Border & Adequacy · 2026-03-26 ### ANTAI Resolution ANTAI-DG-003-2026 approved the RIPD Standard Contractual Clauses as a concrete transfer mechanism. [Morgan & Morgan](https://morimor.com/panama-updates-rules-for-international-data-transfers/)

- DZ · Algorithmic, Biometric & Surveillance Governance · 2026-05-06 ### ANPDP Decisions 02 (video surveillance) and 03 (biometric attendance) confirmed; no ADM-specific statutory test located. [Gide](https://www.gide.com/en/news-insights/protection-of-personal-data-focus-on-algerian-regulations/)

- AG · Algorithmic, Biometric & Surveillance Governance · 2026-06-18 ### Electronic Crimes (Amendment) Act (reported June 2026) strengthens law-enforcement production-order powers over electronic data; a criminal-procedure instrument distinct from the DPA's own national-security exemption. [Jamaica Gleaner / CMC](https://jamaica-gleaner.com/article/world-news/20260618/antigua-toughens-legislation-dealing-cybercrime)

- US-MS · Controller/Processor Duties · 2026-07-01 ### HB1596 (effective 2026-07-01) imposes an information-security-program duty and a 72-hour DBCF-notification duty on MTMA licensees; general breach law (§75-24-29) remains unchanged with no AG-notification threshold (SB2128 died 2026-02-03). [Orrick InfoBytes](https://infobytes.orrick.com/2026-04-24/mississippi-enacts-data-security-and-consumer-protection-requirements-for-money-transmitters/)

- US-NJ · Enforcement & Redress · 2026-07-01 ### Mandatory 30-day cure period sunset 2026-07-01; 10 cure letters issued between 2025-03-24 and the cure period's close. [recordinglaw.com](https://www.recordinglaw.com/us-laws/data-privacy-laws/new-jersey-data-privacy-laws/)

## Regulatory horizon

- AR · [Expediente 3397-D-2026 omnibus DP reform bill](/jurisdictions/argentina/) · 2026-Q4

- BG · [Bulgaria AI Act implementing bill tabling expected](/jurisdictions/bulgaria/) · closed 2026-10

- BR · [ANPD fiscalização/sanctions regulation consultation closes](/jurisdictions/brazil/) · closed 2026-10-26

- BR · [ANPD sanctions dosimetry update consultation closes](/jurisdictions/brazil/) · 2026-11-30

- BZ · [National Data and Statistical Systems Act, 2026 finalisation](/jurisdictions/belize/) · 2027-Q2

- CA-NB · [RTIPPA reform legislation expected](/jurisdictions/new-brunswick-canada/) · 2026-Q4

- CA-ON · [Bill 97 FIPPA/MFIPPA final amendment tranche](/jurisdictions/ontario-canada/) · 2027-01-01

- CL · [Ley 21.719 commencement date (1 Dec 2026, possibly postponed to 1 Dec 2027)](/jurisdictions/chile/) · 2026-12-01

- CM · [APDP organisational decree publication pending](/jurisdictions/cameroon/) · 2026-Q4

- CO · [SIC post-consultation protocol under Ley 2573/2026 expected](/jurisdictions/colombia/) · 2026-Q4

- CR · [TSE recurso de revocatoria against Prodhab Resolution 029-2026-RF](/jurisdictions/costa-rica/) · 2026-Q4

- CY · [AI Act high-risk obligations deadline deferred (Digital Omnibus)](/jurisdictions/cyprus/) · 2027-12-02

- CZ · [Czech Data Act implementing/penalty legislation (unadopted, deadline elapsed)](/jurisdictions/czech-republic/) · 2027-Q1

- CZ · [Czech AI Act Adaptation Act (draft)](/jurisdictions/czech-republic/) · 2027-Q1

- DO · [INDOTEL draft General Telecommunications, Digital Infrastructure and Connectivity Law](/jurisdictions/dominican-republic/) · 2026-Q4

- DZ · [ANPDP regional audit poles implementing regulation](/jurisdictions/algeria/) · 2026-Q4

- EE · [936 SE awaiting Riigi Teataja publication](/jurisdictions/estonia/) · 2026-Q4

- EE · [796 SE dark-patterns/distance-financial-services transposition pending](/jurisdictions/estonia/) · 2026-Q4

- EEA · [Data Act switching-charge ban takes full effect](/jurisdictions/european-economic-area-bloc/) · 2027-01-12

- EEA · [EDPB fine-methodology guidelines consultation closes](/jurisdictions/european-economic-area-bloc/) · 2026-11-13

- HU · [EDPB smart-glasses guideline public consultation close](/jurisdictions/hungary/) · 2026-11-13

- JP · [APPI amendment (Act No. 56/2026) commencement, including administrative fine system and biometric-data category](/jurisdictions/japan/) · 2027-Q2

- JP · [PPC technical safety-management-measure guideline revision](/jurisdictions/japan/) · 2027-Q2

- KR · [PIPA Enforcement Decree implementing 11 Sept 2026 fine-ceiling amendment](/jurisdictions/south-korea/) · closed 2026-09-11

- LATAM · [RIPD Estándares possible formal adoption at Ibero-American Summit](/jurisdictions/latin-america-bloc/) · 2026-Q4

- LK · [PDPA Parts I and III come into force](/jurisdictions/sri-lanka/) · 2027-01-01

- LK · [PDPA Part II (data subject rights) commencement date still unannounced](/jurisdictions/sri-lanka/) · 2027-Q2

- LU · [EU Data Act cloud-switching charge abolition](/jurisdictions/luxembourg/) · 2027-01-12

- LU · [EU Data Act access-by-design duty for connected products](/jurisdictions/luxembourg/) · closed 2026-09-12

- MT · [AI regulatory sandbox deadline postponed](/jurisdictions/malta/) · 2027-08-02

- MZ · [Proposta de Lei de Protecção de Dados Pessoais pending before Assembleia da República](/jurisdictions/mozambique/) · 2027-Q1

- NG · [CBN payments data-localisation deadline with NDPA cross-reference](/jurisdictions/nigeria/) · 2027-01-01

- NP · [IT and Cyber Security Bill 2082 — disputed enactment status](/jurisdictions/nepal/) · 2026-Q4

- NZ · [Civil pecuniary penalty regime advice to Ministry of Justice](/jurisdictions/new-zealand/) · 2027-Q2

- PH · [NPC Draft Circular on Data Subject Rights adoption](/jurisdictions/philippines/) · 2026-Q4

- PH · [NPC Draft PIA Circular adoption](/jurisdictions/philippines/) · 2026-Q4

- RS · [Serbia draft replacement Law on Personal Data Protection](/jurisdictions/serbia/) · 2026-Q4

- SN · [Loi n°25/2026 implementing decrees and cybersecurity authority commencement](/jurisdictions/senegal/) · 2027-Q1

- UA · [Draft Law No. 8153 GDPR-alignment adoption (missed target)](/jurisdictions/ukraine/) · closed 2026-06-01

- UK · [ICO agentic-AI call for evidence closes](/jurisdictions/united-kingdom/) · 2026-11-20

- US · [Connecticut data-broker registry registration date](/jurisdictions/united-states/) · 2027-01-01

- US-AK · [HB 367 Consumer Data Privacy Act — possible future action](/jurisdictions/alaska-usa/) · 2027-Q1

- US-AL · [APDPA effective date](/jurisdictions/alabama-usa/) · 2027-05-01

- US-AL · [App Store Accountability Act in force](/jurisdictions/alabama-usa/) · 2027-01-01

- US-AL · [App Store Accountability Act retroactive deadline for existing accounts](/jurisdictions/alabama-usa/) · 2027-10-01

- US-CO · [Colorado ADMT Act and Chatbot Safety Act take effect](/jurisdictions/colorado-usa/) · 2027-01-01

- US-CO · [ADMT formal rulemaking hearing and comment close](/jurisdictions/colorado-usa/) · closed 2026-10-26

- US-DE · [DPDPA HB 380 amendments take effect](/jurisdictions/delaware-usa/) · 2027-01-01

- US-GA · [Georgia Conversational AI Safety Act (SB 540) in force](/jurisdictions/georgia-usa/) · 2027-07-01

- US-GA · [Georgia SB 444 AI health-plan utilization-review limits in force](/jurisdictions/georgia-usa/) · 2027-01-01

- US-ID · [Idaho Conversational AI Safety Act takes effect](/jurisdictions/idaho-usa/) · 2027-07-01

- US-KY · [KCDPA DPIA duty takes effect for post-trigger-date processing](/jurisdictions/kentucky-usa/) · closed 2026-06-01

- US-LA · [Louisiana Data Privacy Act takes effect](/jurisdictions/louisiana-usa/) · 2027-01-01

- US-LA · [LDPA 30-day cure-period window closes](/jurisdictions/louisiana-usa/) · 2027-07-31

- US-MA · [Massachusetts Data Privacy Act conference-committee reconciliation](/jurisdictions/massachusetts-usa/) · 2027-01

- US-MA · [Mandatory AG rulemaking deadline under House Data Privacy Act bill (if enacted)](/jurisdictions/massachusetts-usa/) · 2027-05-01

- US-MI · [Senate Bills 888-892 breach-notification reform](/jurisdictions/michigan-usa/) · 2027-Q1

- US-NE · [LB838 AADC amendment effective](/jurisdictions/nebraska-usa/) · closed 2026-07-17

- US-NH · [HB 1460 children's-data sale ban in force](/jurisdictions/new-hampshire-usa/) · 2027-01-01

- US-NJ · [NJDPA data broker/collector registry launch](/jurisdictions/new-jersey-usa/) · 2027-Q2

- US-NJ · [NJDPA implementing rulemaking restart (unconfirmed timeline)](/jurisdictions/new-jersey-usa/) · 2027

- US-NM · [Anticipated NM social-media-safety / age-verification bill](/jurisdictions/new-mexico-usa/) · 2027-Q1

- US-NY · [RAISE Act takes effect](/jurisdictions/united-states-new-york/) · 2027-01-01

- US-OK · [Oklahoma Consumer Data Privacy Act (OKCDPA) takes effect](/jurisdictions/oklahoma-usa/) · 2027-01-01

- US-RI · [RI AI Companion Models Act (S 2195/H 7350) takes effect](/jurisdictions/rhode-island-usa/) · 2027-01-01

- US-TN · [TN TACIR AI study report due](/jurisdictions/tennessee-usa/) · 2027-01-31

- US-UT · [HB 357 motor-vehicle-data amendments to UCPA take effect](/jurisdictions/utah-usa/) · 2027-01-01

- US-VT · [VDPOSA (Act 145) comes into force](/jurisdictions/vermont-usa/) · 2028-01-01

- US-VT · [Vermont AADC in force](/jurisdictions/vermont-usa/) · 2027-01-01

- US-WA · [HB 1170 AI content-provenance disclosure comes into force](/jurisdictions/washington-state-usa/) · 2027-02-01

Ranked within this monitor (per_consumer); tie-break
recency_date_desc, jid_asc, module_asc, url_asc. Index tool
1.5.0, edition policy 1.2.0.