Roundup
Data Protection Monitor — 2026-11-08
Assembled deterministically from our recent research runs and ranked by date and importance.
New or updated since 2026-11-01
New to this edition or changed since the last one.
- 1
NO · Enforcement & Redress · 2026-11-03
Datatilsynet's NOK 92m Xandr fine, its largest to date, became final 3 November 2026.
- 2
- 3
US-CT · Enforcement & Redress · 2026-10-29
GM $220M multistate settlement; CT share >$6M; first major CTDPA-linked enforcement action.
- 4
US-DE · Regulator & Framework · 2026-09-02
HB380 and HB381, both signed 2026-09-02, amend the DPDPA and the breach-notification statute respectively.
- 5
GI · Cross-Border & Adequacy · 2026-07-15
Data Protection Regulations 2026 re-base outward transfer legal basis from UK adequacy regulations to EU Commission adequacy decisions and direct UK/EU-member-state carve-outs; Gibraltar ceases to be a third country under EU data-protection instruments from 15 July 2026…
- 6
US · Cross-Border & Adequacy · 2026-06-15
DOJ bulk-sensitive-data rule in force; EU-US DPF adequacy decision under live CJEU appeal.
- 7
- 8
US-KY · Algorithmic, Biometric & Surveillance Governance · 2026-01-08
First KCDPA enforcement action targeted an AI chatbot company (Character.AI), signalling willingness to apply KCDPA to AI-adjacent data practices.
- 9
BD · Regulator & Framework · date pending
PDPA 2026 (Law 63 of 2026) in force from 10 April 2026; Data Protection Authority established within the PM's Office.
- 10
FR · AdTech & Commercial Privacy · date pending
Record 2025 CNIL sanctions against Google (EUR 325m) and Shein (EUR 150m) for cookie-consent dark patterns.
- 11
- 12
UK · Cross-Border & Adequacy · 2025-12-19
European Commission adopted final renewed UK GDPR and LED adequacy decisions on 19 December 2025, valid until 27 December 2031.
- 13
US-LA · Regulator & Framework · 2026-05-29
Louisiana Data Privacy Act enacted 2026-05-29, effective 2027-01-01, enforced exclusively by the Attorney General.
- 14
- 15
CW · Regulator & Framework · 2026-10-14
Curacao's statutory 'College bescherming persoonsgegevens' is reported as still 'in oprichting' (being established), per an official Dutch parliamentary document; the Council of Ministers received a Convention 108+ implementation options briefing on 14 October 2026.
- 16
US-MA · Enforcement & Redress · 2026-10-29
Two material multistate enforcement developments this cycle: $220M GM settlement; Character.AI bankruptcy coalition notice.
- 17
US-WV · Children & Vulnerable Groups · 2026-10-29
WV AG filed suits against TikTok (2026-10-29, backfill) and Snap Inc. (2026-11-05, new) over child-safety/design/age-verification issues under general consumer-protection law.
- 18
BE · Enforcement & Redress · 2026-07-13
EDPB ordered Belgian DPA to re-examine NOYB/VRT cookie complaint; published by APD on 13 July 2026.
- 19
US-MN · Enforcement & Redress · 2026-10-29
36-state AG coalition settlement with General Motors, announced 2026-10-29; Minnesota's recovery is $7,095,664.
- 20
US-PA · Enforcement & Redress · 2026-10-29
PA joined 36-state $220M GM connected-vehicle data settlement, announced 2026-10-29; PA receiving ~$8.67M.
- 21
NL · Algorithmic, Biometric & Surveillance Governance · date pending
AP consultation on automated-decision-making explanations is open; historical algorithmic-discrimination enforcement (DUO, Belastingdienst FSV, toeslagenaffaire) remains the standing record.
- 22
TW · Regulator & Framework · 2025-11-11
PDPC remains a Preparatory Office; Organic Act not yet passed; PDPA amendment enacted but commencement date not yet set.
- 23
US-WA · Regulator & Framework · 2026-08-01
No omnibus privacy statute; AG enforces via CPA and targeted statutes.
- 24
GG · Regulator & Framework · date pending
ODPA registration fees adjusted for inflation from 1 Jan 2026; further increase approved for Jan 2027.
- 25
PH · Controller/Processor Duties · 2026-11-06
St. Luke's breach and multi-agency government data-leak investigation active.
- 26
GR · Controller/Processor Duties · date pending
HDPA fined the Ministry of Migration and Asylum EUR 175,000 for lack of cooperation and substantially incomplete DPIAs relating to its 'Centaur' AI-enabled monitoring system.
- 27
EC · Cross-Border & Adequacy · date pending
General Norm on National and International Transfers (SPDP-SPD-2026-0004-R) establishes the transfer framework; SPDP may act ex officio to recognise adequacy.
- 28
CL · Enforcement & Redress · 2026-11-08
Fine-ceiling figures (20,000 UTM) secondary-sourced; Art. 23 tutela procedure confirmed from primary text.
- 29
APAC · Regulator & Framework · date pending
Global CBPR Program Requirements updated 23 March 2026, expanding from 50 to 57 requirements; ASEAN Framework on PDP remains non-binding.
- 30
EG · Enforcement & Redress · 2026-11-01
Penalty framework now operative; no enforcement decision yet located.
- 31
PE · Controller/Processor Duties · 2026-01-01
Medium-enterprise ODP designation tranche becomes exigible 30 November 2026.
- 32
- 33
- 34
- 35
VN · Enforcement & Redress · 2026-01-01
Decree 330/2026/ND-CP (effective 19 Aug 2026) sets administrative sanctions for cybersecurity/PDP violations; PDPL carries fines up to 5% of prior-year VN revenue for cross-border-transfer breaches and VND 3bn+ (up to 10x illegal gain) for illegal data sale/purchase…
- 36
KZ · Lawful Processing & Special Data · 2026-07-11
Personal-data definition changed to an identifier test effective 11 July 2026; new statutory definitions of automated processing, anonymisation, masking and hashing effective 25 August 2026.
- 37
US-CO · Algorithmic, Biometric & Surveillance Governance · 2026-05-14
SB26-189 (signed 2026-05-14) replaces the stalled Colorado AI Act with an ADMT law applicable from 2027-01-01.
- 38
- 39
MZ · Regulator & Framework · 2026-09-29
Cybersecurity/Cybercrime Laws in force 29 Sept 2026; Personal Data Protection Bill pending in Assembly.
- 40
PA · Cross-Border & Adequacy · date pending
ANTAI Resolution ANTAI-DG-003-2026 of 26 March 2026 approves RIPD SCCs as a recognised transfer mechanism.
- 41
CA-NB · Regulator & Framework · date pending
PIPEDA remains in force and unamended; Bill C-36 remains at second reading as of this cycle.
- 42
SE · Enforcement & Redress · 2026-11-03
IMY issued decisions on 3 November 2026 against four Swedish people-search services (Lexbase, Krimfup, MrKoll, Upplysning) for GDPR breaches, with formal orders against Lexbase and Krimfup under Article 10 and reprimands against MrKoll and Upplysning under Article 17.
- 43
CM · Cross-Border & Adequacy · 2026-06-23
Cross-border transfer now subject to prior APDP authorisation; ANTIC must approve international data transfers.
- 44
US-OK · Regulator & Framework · 2027-01-01
OCDPA (SB546) signed 2026-03-20, a new comprehensive Virginia-model statute, superseding the prior 'no comprehensive statute' position.
- 45
US-VT · Regulator & Framework · 2026-06-16
Vermont enacted a comprehensive consumer privacy statute (Act 145), not yet in force, plus Act 138 amending the data-broker law.
- 46
US-AL · Regulator & Framework · 2026-04-16
APDPA (HB351/Act 2026-552) enacted, pending 1 May 2027 effective date.
- 47
US-NY · Algorithmic, Biometric & Surveillance Governance · 2026-03-27
RAISE Act (GBL Article 44-B) finalized by chapter amendment 27 March 2026, effective 1 January 2027, creating a new NYDFS frontier-AI oversight office with mandatory Frontier AI Framework and incident-reporting duties.
Also tracked by aic:sectoral_and_public_sector_ai
- 48
CH · Enforcement & Redress · date pending
Federal Administrative Court's first judicial interpretation of Art 24 FADP breach-notification exceptions; criminal penalty ceiling CHF 250,000 (natural person) / CHF 50,000 (undertaking fallback); FDPIC has no fining power; civil remedies and Art 89 CPC representative…
- 49
PW · Regulator & Framework · 2026-07-21
Bureau of Cybersecurity created by RPPL 12-8 (signed 21 July 2026); Privacy Act (6 PNCA ss.205-206) remains the government-scoped baseline.
- 50
SN · Algorithmic, Biometric & Surveillance Governance · date pending
Video-surveillance/biometric processing is CDP's leading supervisory focus in 2026; over 75% of Q1 declarations concerned video-surveillance, and CDP refused authorisation for a public-road vehicle camera (12 June 2026).
- 51
AFR · Regulator & Framework · 2026-02-02
Malabo Convention ratification rose from 16 to 20 of 55 AU member states per the AU's status list dated 2 Feb 2026; Equatorial Guinea signed 28 July 2026, a precursor step. No continental enforcement mechanism exists; NADPA/RAPDP remains a cooperation network, not a regulator.
- 52
US-OR · Children & Vulnerable Groups · 2026-01-01
Under-16 data sale prohibition took effect Jan 1, 2026 via HB 2008.
- 53
US-NH · Children & Vulnerable Groups · 2026-06-19
2026 N.H. Laws ch. 168 adds a child-data-sale ban, effective 2027-01-01.
- 54
US-NJ · Controller/Processor Duties · 2027-04-01
A5328's data-broker/data-collector registration and disclosure duties take effect April 1, 2027; no new breach-notification/DPIA/DPO-threshold instrument independently verified.
- 55
US-RI · Enforcement & Redress · 2026-01-01
Kim Ahern elected RI Attorney General 3 November 2026; takes office January 2027 inheriting RIDTPPA's exclusive enforcement authority. Civil penalty structure (up to $10,000/violation under Title 6, plus $100-$500 for intentional unlawful disclosure) unchanged.
- 56
- 57
US-ID · Enforcement & Redress · 2026-10-14
AG filed suit against OpenAI (2026-10-14) and joined the Character.AI multistate bankruptcy notice (2026-10-26), both under the general Consumer Protection Act.
- 58
US-KS · Regulator & Framework · date pending
AG-elect Chris Mann (D) takes office Jan 2027; stated agenda shift expected.
- 59
KE · Cross-Border & Adequacy · 2026-09-08
ODPC Guidance Notes for Cross-border Data Transfers finalised 8 Sept 2026, confirming draft-to-final status.
- 60
RO · Enforcement & Redress · 2026-11-05
ANSPDCP fined ING Bank N.V. Amsterdam - Sucursala București EUR 5,000 for GDPR Art. 32 breaches, 5 Nov 2026.
- 61
MO · Regulator & Framework · date pending
Regulator identity corrected from legacy GPDP to PDPB (established under Administrative Regulation 42/2023, in force since 1 Feb 2024).
- 62
MT · Algorithmic, Biometric & Surveillance Governance · 2026-08-02
AI Act authority designations confirmed (MDIA lead, IDPC law-enforcement AI).
- 63
CR · Regulator & Framework · 2026-05-01
Prodhab Resolution 029-2026-RF vs TSE revocatoria dispute unresolved.
- 64
SA · Cross-Border & Adequacy · 2026-10-06
New draft Article 23(2) introduces an express data-localisation requirement for the first time.
- 65
US-NV · Regulator & Framework · date pending
No dedicated DPA; AG exercises general consumer-protection authority over NRS 603A's three sectoral layers.
- 66
DK · Algorithmic, Biometric & Surveillance Governance · 2026-11-05
Datatilsynet severe-criticism decision against municipal AI deployment.
- 67
LT · Controller/Processor Duties · 2026-03-23
VDAI fined processor UAB DELSKA Lithuania (successor to UAB Rakrėjus) EUR 4,500 for breach of Art 32(1)(b), holding the processor's security duty independent of the controller's.
- 68
LU · Regulator & Framework · 2026-11-02
CNPD Collegiate Body partially renewed 02/11/2026 (new Chair and Commissioner); statutory basis unchanged.
- 69
- 70
JP · Enforcement & Redress · date pending
2026 amendment expands PPC order-making flexibility (removes 'imminent' requirement) and introduces Japan's first administrative-fine power, pending commencement.
- 71
US-MS · Enforcement & Redress · date pending
Corrects secondary-source error: HB 1220 (insurance cybersecurity safe-harbor) died in Senate committee 2026-03-03 and was never enacted, contrary to at least one secondary source claiming it was signed into law; SB 2128 (AG-notification threshold) also died in committee.
- 72
CO · Regulator & Framework · 2026-05-19
Ley 2573 commencement approaching (around 19 Nov 2026).
- 73
- 74
SG · Cross-Border & Adequacy · 2026-03-02
No cross-border transfer or adequacy findings researched this cycle.
- 75
CY · Enforcement & Redress · 2026-09-23
EUR6,000 fine against Agora platform, now under appeal.
- 76
LATAM · Regulator & Framework · 2026-11-03
Madrid ministerial validated updated RIPD data-protection and digital-government-interoperability standards.
- 77
US-FL · Children & Vulnerable Groups · 2026-10-22
AG-proposed Safe Screens Act would extend age-verification, parental-consent and AI-chatbot restrictions for minors.
- 78
UA · Enforcement & Redress · date pending
Draft Law No. 8153 reported to raise maximum fines substantially above current UAH 1,700-34,000 range; figure disputed.
- 79
ES · Algorithmic, Biometric & Surveillance Governance · date pending
EUR 10.04m Aena biometric DPIA-failure fine; preventive warning against AI recruitment-screening tool.
- 80
US-UT · Regulator & Framework · 2026-07-01
HB418 added a right to correct inaccuracies, effective 2026-07-01.
- 81
CA-ON · Regulator & Framework · 2026-11-02
IPC Ontario FIPPA significant-harm-threshold guidance published.
- 82
- 83
CA-TFN · Regulator & Framework · 2026-10-22
No confirmed local DP framework; federal PIPEDA presumed applicable. New TPMA permit regime imposes KYC data-collection duties as a financial-regulatory (not DP-law) obligation.
Also tracked by advennt:licensing_and_regulation, crypto:crypto_licensing, financial-integrity:D3, world-payments:W13
- 84
US-GA · Regulator & Framework · date pending
AG leadership change pending Jan 2027; no comprehensive privacy statute in force.
- 85
US-IL · Enforcement & Redress · date pending
Dated BIPA-adjacent private class settlement milestones (opt-out Nov 10 2026, claims Nov 25 2026, hearing Dec 17 2026) reported this window.
- 86
TH · Regulator & Framework · 2026-11-08
PDPC held its first public consultation on draft sector-specific PDPA guidelines for 11 industries under its 2024-2027 National Master Plan.
- 87
KM-A · Regulator & Framework · date pending
Secondary sources conflict on whether a 2021 data-protection statute and National Authority exist and are operational.
- 88
BZ · Algorithmic, Biometric & Surveillance Governance · 2026-11-03
Belize Police Department exploring AI-based surveillance technology via its Crime Fusion and Operations Centre, reported 3 November 2026; no implementation date, funding agreement, DPIA or Commissioner review identified.
Regulatory horizon
- AE · Federal Artificial Intelligence and Data Authority merger of AI Office, TDRA digital sector and UAE Data Office · closed 2026-06-14 · quarter
- AE · PDPL Executive Regulations and Article 26 penalty-schedule Cabinet decision still pending · 2027-Q4 · multi year
- APAC · Global CAPE expansion goals · 2026-Q4 · half year
- APAC · ASEAN DEFA cross-border data provisions · 2026-Q4 · year
- AU · Privacy Act Tranche 1 automated-decision-making transparency commences · 2026-12-10 · quarter
- BG · Bulgaria DSA formal-notice response deadline · 2026-12-01 · quarter
- CA · Bill C-36 (Protecting Privacy and Consumer Data Act) progress · 2027 · year
- CA · Consumer-Driven Banking Regulations consultation close · 2026-Q3 · quarter
- CA · Bill C-36 (Protecting Privacy and Consumer Data Act) federal privacy reform · 2027 · multi year
- CA · PIPEDA data-mobility (portability) right commencement · 2027 · year
- CA · Bill C-36 (Protecting Privacy and Consumer Data Act) pending second reading · 2026-Q4 · multi year
- CA-AB · Bill 31 POPA carve-out proclamation pending · 2026-Q4 · half year
- CA-BC · BC PIPA reform recommendations pending government response · 2027 · multi year
- CH · Swiss AI legislation consultation draft (CoE AI Convention implementation) · 2026-Q4 · half year
- CH · VUPF/OSCPT surveillance ordinance revision · 2026-Q4 · half year
- CH · Latombe appeal on EU-US DPF adequacy (Case C-703/25 P) · 2027 · year
- CL · Ley 21.719 entry into force · 2026-12-01 · quarter
- CL · Possible postponement bill (Boletín 18.623-07) resolution · 2026-Q4 · quarter
- CM · Implementing Decree to Law No. 2024/017 (authorisation tracks) adoption status · 2026-Q4 · half year
- CO · Ley 2573 de 2026 general regime commencement · 2026-11-19 · quarter
- CO · SIC Título V draft resolution finalisation · 2026-Q4 · half year
- CW · Convention 108+ implementation legislative scenario selection pending · 2027-Q2 · half year
- EC · Draft General Norm on Biometric Data Processing — adoption pending · 2026-Q4 · half year
- EEA · Digital Omnibus GDPR amendment — further legislative progress awaited · 2027-Q1 · year
- EG · PDPC enforcement decisions expected following grace-period expiry · 2027-Q1 · half year
- FR · Pending social-media age/digital-majority legislation (two competing texts) · 2026-Q4 · year
- FR · Ddadue bill would designate CNIL as lead AI Act market-surveillance authority · 2026-Q2 · half year
- GI · Gibraltar AI regulatory taskforce (proposed, principles-based, DLT-modelled) · 2028 · multi year
- GI · Formal EU Commission adequacy decision for Gibraltar outstanding · 2027-Q2 · multi year
- GI · GRA guidance on prediction-market operator KYC/AML data processing expected · 2026-Q4 · quarter
- GI · Data Protection Regulations 2026 (LN 96/2026) in force · closed 2026-07-15 · quarter
- GR · HDPA AI Act implementation law consultation closes · closed 2026-07-06 · quarter
- GR · EU AI Act Article 70 national regulatory sandbox operational deadline · 2027-08-02 · year
- GR · EU Digital Omnibus data package (GDPR/ePrivacy amendments) — Council draft diverges from Commission proposal · 2026-Q4 · half year
- GR · Latombe v Commission CJEU appeal on EU-US DPF adequacy decision · 2027 · multi year
- HK · PDPO reform: mandatory breach notification and administrative fines · 2027 · multi year
- ID · GR 33/2026 (UU PDP implementing regulation) enters into force · 2027-01-16 · quarter
- IE · CJEU appeal of EU-US Data Privacy Framework adequacy decision · 2027-Q1 · year
- IM · ICO tiered registration-fee model possible commencement · 2027-Q2 · year
- IN · DPDP Rules notice-to-Data-Principal provision commences · 2027-05-13 · quarter
- JP · APPI criminal-penalty changes take effect · 2027-01-17 · quarter
- JP · PPC implementing-regulation consultation closes · 2026-Q4 · quarter
- JP · PPC implementing regulations promulgated and implemented · 2027-01-15 · quarter
- KE · Data Protection (Amendment) Bill, 2025 pending enactment · 2027-Q1 · multi year
- KR · ISMS-P certification mandatory for designated large controllers · 2027-07-01 · year
- MZ · Personal Data Protection Bill — pending Assembly debate · 2027-Q2 · multi year
- MZ · Cybersecurity Law implementing regulations due · 2027-Q1 · quarter
- NL · UAVG biometric-data provision (art. 29) not yet in force · 2027-Q1 · year
- NL · AP guidance on automated-decision-making explanations · 2026-Q3 · half year
- NL · Latombe CJEU appeal against DPF ruling · 2027-Q2 · multi year
- NP · Information Technology and Cyber Security Bill, 2082 pending enactment · 2027-Q2 · multi year
- PE · Medium-enterprise ODP designation duty exigible · 2026-11-30 · quarter
- RS · RS draft replacement Law on Personal Data Protection adoption pending · 2027 · multi year
- SA · SA PDPL Implementing Regulation amendments take effect · 2027-01-04 · quarter
- TW · PDPA amendment commencement date and PDPC formal establishment · 2027-Q1 · multi year
- UG · PDPO Annual Compliance Report filing deadline · 2026-11-23 · quarter
- UK · ICO agentic-AI call for evidence closes · 2026-11-20 · quarter
- US · CCPA ADMT substantive-compliance deadline · 2027-01-01 · quarter
- US · Latombe v Commission CJEU appeal of EU-US DPF adequacy decision · 2027-Q1 · year
- US · FISA Section 702 further legislative/judicial development · 2027-03 · half year
- US · CFPB Section 1033 Personal Financial Data Rights Rule reconsideration · 2026-Q4 · half year
- US · CPPA risk-assessment first annual submission to agency · 2028-04-01 · multi year
- US-AL · APDPA takes effect · 2027-05-01 · quarter
- US-CA · CPPA ADMT compliance deadline · 2027-01-01 · quarter
- US-CO · SB26-189 ADMT law takes effect · 2027-01-01 · quarter
- US-CO · CPA minors' addictive-design rule amendments pending publication · closed 2025-Q4 · quarter
- US-GA · SB 540 AI companion chatbot disclosure law in force · 2027-07-01 · quarter
- US-ID · Idaho Conversational AI Safety Act effective date · 2027-07-01 · quarter
- US-KS · New Kansas AG Chris Mann takes office · 2027-01-12 · quarter
- US-KY · HB 692 automated content recognition sensitive-data category in force · 2027-07-01 · quarter
- US-LA · Louisiana Data Privacy Act in force · 2027-01-01 · quarter
- US-LA · LDPA 30-day cure period sunsets · 2027-07-31 · quarter
- US-NH · NH RSA 507-H amendment: child-data-sale ban in force · 2027-01-01 · quarter
- US-NJ · NJ data-broker/data-collector registry opens for registration · 2027-04-01 · quarter
- US-NY · RAISE Act frontier-AI oversight regime comes into force · 2027-01-01 · quarter
- US-OK · OCDPA (SB546) expected in force · 2027-01-01 · half year
- US-PA · Consumer Data Privacy Act (HB78) pending Senate floor action · 2026-11-30 · quarter
- US-SC · South Carolina Attorney General transition (Stumbo succeeds Wilson) · 2027-Q1 · quarter
- US-UT · UCPA HB357 motor-vehicle data amendment in force · 2027-01-01 · quarter
- US-UT · Utah Digital Choice Act data-portability provisions effective · 2027-07-01 · quarter
- US-VT · Vermont Data Privacy and Online Surveillance Act (Act 145) in force · 2028-01-01 · quarter
- US-VT · Vermont Act 138 data-broker amendments in force · 2027-01-01 · quarter
- VE · Ley de los Derechos Digitales (Venezuela) — proposed, no bill text · 2027-Q4 · multi year
- VN · National Portal for Personal Data Protection launch · 2027-Q1 · half year
- VU · Digital Transformation Act AI-permit regime commencement unconfirmed · 2026-Q4 · half year
Ranked within this monitor (per_consumer); tie-break recency_date_desc, jid_asc, module_asc, url_asc. Index tool 1.5.0, edition policy 1.2.0.