--- title: "Roundup — Data Protection Monitor — 2026-11-08" canonical: https://dataprotection.gi/roundup/2026-11-08/ source_html: /roundup/2026-11-08/index.html description: "Roundup — Data Protection Monitor — 2026-11-08 — Global Privacy, Data Protection & Cross-Border Transfer Regulatory Intelligence." generated_at: 2026-11-10T12:10:01Z content_sha256: 7ae36b8e274e192b06ed6e21d5349c374233a65b486e4b4ffff475e5ba9f2ea4 generator: "fe-fleet/md-twin@1.0" --- # Roundup — Data Protection Monitor — 2026-11-08 Roundup # Data Protection Monitor — 2026-11-08 Assembled deterministically from our recent research runs and ranked by date and importance. Previous editions - [Latest edition](/roundup/) - [2026-11-01](/roundup/2026-11-01/) - [2026-10-25](/roundup/2026-10-25/) - [2026-10-18](/roundup/2026-10-18/) - [2026-10-11](/roundup/2026-10-11/) - [2026-10-04](/roundup/2026-10-04/) - [2026-09-27](/roundup/2026-09-27/) - [2026-09-20](/roundup/2026-09-20/) - [2026-09-07](/roundup/2026-09-07/) ## New or updated since 2026-11-01 New to this edition or changed since the last one. - NO · Enforcement & Redress · 2026-11-03 ### Datatilsynet's NOK 92m Xandr fine, its largest to date, became final 3 November 2026. [Datatilsynet](https://www.datatilsynet.no/en/news/news-2026/microsoft-company-fined-nok-92-million-for-unlawfully-sharing-personal-data/) - AR · Enforcement & Redress · 2026-11-02 ### AAIP published two enforcement decisions on 2 November 2026: a database suspension against 5 ON LINE S.R.L. and a sanction against a second company for failing to provide requested information. [AAIP / Argentina.gob.ar](https://www.argentina.gob.ar/noticias/la-aaip-sanciono-empresas-por-incumplimientos-la-ley-ndeg-25326) - US-CT · Enforcement & Redress · 2026-10-29 ### GM $220M multistate settlement; CT share >$6M; first major CTDPA-linked enforcement action. [Connecticut Office of the Attorney General](https://portal.ct.gov/ag/press-releases/2026-press-releases/attorney-general-tong-announces-settlement-with-gm) - US-DE · Regulator & Framework · 2026-09-02 ### HB380 and HB381, both signed 2026-09-02, amend the DPDPA and the breach-notification statute respectively. [Delaware General Assembly (HB381 bill detail)](https://legis.delaware.gov/BillDetail/143107) - GI · Cross-Border & Adequacy · 2026-07-15 ### Data Protection Regulations 2026 re-base outward transfer legal basis from UK adequacy regulations to EU Commission adequacy decisions and direct UK/EU-member-state carve-outs; Gibraltar ceases to be a third country under EU data-protection instruments from 15 July 2026… [Laws of Gibraltar / Gibraltar Gazette](https://www.gibraltarlaws.gov.gi/uploads/legislations/data-protection/2004-01/2026=096.pdf) - US · Cross-Border & Adequacy · 2026-06-15 ### DOJ bulk-sensitive-data rule in force; EU-US DPF adequacy decision under live CJEU appeal. [Office of Congresswoman Alma S. Adams](https://adams.house.gov/media-center/press-releases/rep-adams-statement-expiration-fisa) - BR · Cross-Border & Adequacy · 2026-01-26 ### ANPD's first adequacy decision (Resolução 32/2026) recognises the EU/EEA, reciprocated by the European Commission, easing transfer mechanics with those destinations. [Autoridade Nacional de Proteção de Dados (ANPD)](https://www.gov.br/anpd/pt-br/assuntos/noticias/brasil-e-uniao-europeia-reconhecem-adequacao-mutua-em-protecao-de-dados-pessoais) - US-KY · Algorithmic, Biometric & Surveillance Governance · 2026-01-08 ### First KCDPA enforcement action targeted an AI chatbot company (Character.AI), signalling willingness to apply KCDPA to AI-adjacent data practices. [Kentucky Attorney General — official press release](https://www.kentucky.gov/Pages/Activity-stream.aspx?n=AttorneyGeneral&prId=1857) - BD · Regulator & Framework · date pending ### PDPA 2026 (Law 63 of 2026) in force from 10 April 2026; Data Protection Authority established within the PM's Office. [Bangladesh Laws Database (Ministry of Law, Justice and Parliamentary Affairs)](http://bdlaws.minlaw.gov.bd/act-print-1692.html) - FR · AdTech & Commercial Privacy · date pending ### Record 2025 CNIL sanctions against Google (EUR 325m) and Shein (EUR 150m) for cookie-consent dark patterns. [CNIL](https://www.cnil.fr/en/dark-patterns-cookie-banners-cnil-issues-formal-notice-website-publishers) - HK · Enforcement & Redress · date pending ### PCPD served an Enforcement Notice on a private club following a ransomware breach affecting 9,045 members; PCPD retains no power to impose administrative fines directly. [Office of the Privacy Commissioner for Personal Data (PCPD)](https://www.pcpd.org.hk/misc/files/grg_private_sector.pdf) - UK · Cross-Border & Adequacy · 2025-12-19 ### European Commission adopted final renewed UK GDPR and LED adequacy decisions on 19 December 2025, valid until 27 December 2031. [European Commission](https://commission.europa.eu/document/download/b36eedab-43b8-46eb-ac30-a8d1e6e69f51_en?filename=Renewal%20UK%20adequacy%20GDPR.pdf) - US-LA · Regulator & Framework · 2026-05-29 ### Louisiana Data Privacy Act enacted 2026-05-29, effective 2027-01-01, enforced exclusively by the Attorney General. [Louisiana Legislature - SB 386 Enrolled (Act 502 of 2026)](https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1475339) - NP · Regulator & Framework · date pending ### An Information Technology and Cyber Security Bill, 2082 has been tabled in Parliament and remains pending; if passed it would tighten data-handling rules including purpose limitation. [Ministry of Communication and Information Technology](https://moics.gov.np/) - CW · Regulator & Framework · 2026-10-14 ### Curacao's statutory 'College bescherming persoonsgegevens' is reported as still 'in oprichting' (being established), per an official Dutch parliamentary document; the Council of Ministers received a Convention 108+ implementation options briefing on 14 October 2026. [Dutch Government (Rijksoverheid)](https://open.overheid.nl/documenten/2153cdd9-1ab4-4f07-9fcd-5b5a7b0fa10e/file) - US-MA · Enforcement & Redress · 2026-10-29 ### Two material multistate enforcement developments this cycle: $220M GM settlement; Character.AI bankruptcy coalition notice. [Massachusetts Attorney General](https://www.mass.gov/news/ag-campbell-secures-57-million-for-massachusetts-in-settlement-with-general-motors-over-alleged-data-privacy-violations) - US-WV · Children & Vulnerable Groups · 2026-10-29 ### WV AG filed suits against TikTok (2026-10-29, backfill) and Snap Inc. (2026-11-05, new) over child-safety/design/age-verification issues under general consumer-protection law. [Office of the WV Attorney General](https://ago.wv.gov/article/attorney-general-mccuskey-sues-tiktok-putting-west-virginia-kids-risk) - BE · Enforcement & Redress · 2026-07-13 ### EDPB ordered Belgian DPA to re-examine NOYB/VRT cookie complaint; published by APD on 13 July 2026. [Belgian Data Protection Authority — Press releases](https://www.dataprotectionauthority.be/citizen/pressreleases) - US-MN · Enforcement & Redress · 2026-10-29 ### 36-state AG coalition settlement with General Motors, announced 2026-10-29; Minnesota's recovery is $7,095,664. [Office of the Minnesota Attorney General](https://www.ag.state.mn.us/Office/Communications/2026/10/29_General-Motors.asp) - US-PA · Enforcement & Redress · 2026-10-29 ### PA joined 36-state $220M GM connected-vehicle data settlement, announced 2026-10-29; PA receiving ~$8.67M. [Pennsylvania Office of Attorney General](https://www.attorneygeneral.gov/taking-action/attorney-general-sunday-secures-220-million-national-settlement-over-allegations-that-general-motors-shared-drivers-private-data/) - NL · Algorithmic, Biometric & Surveillance Governance · date pending ### AP consultation on automated-decision-making explanations is open; historical algorithmic-discrimination enforcement (DUO, Belastingdienst FSV, toeslagenaffaire) remains the standing record. [Rijksoverheid (Algoritmekader)](https://algoritmes.overheid.nl/algoritmekader/voldoen-aan-wetten-en-regels/vereisten/avg-10-recht-op-niet-geautomatiseerde-besluitvorming/) - TW · Regulator & Framework · 2025-11-11 ### PDPC remains a Preparatory Office; Organic Act not yet passed; PDPA amendment enacted but commencement date not yet set. [PDPC Preparatory Office](https://www.pdpc.gov.tw/News_Content/20/1001/) - US-WA · Regulator & Framework · 2026-08-01 ### No omnibus privacy statute; AG enforces via CPA and targeted statutes. [Washington State Attorney General's Office](https://agportal-s3bucket.s3.us-west-2.amazonaws.com/Data%20Privacy/DPR_2026_final.pdf) - GG · Regulator & Framework · date pending ### ODPA registration fees adjusted for inflation from 1 Jan 2026; further increase approved for Jan 2027. [ODPA -- 2026 registration fee adjustment](https://www.odpa.gg/news/data-protection-authority-adjusts-2026-registration-fees-line-inflation) - PH · Controller/Processor Duties · 2026-11-06 ### St. Luke's breach and multi-agency government data-leak investigation active. [Philippine Star](https://www.philstar.com/headlines/2026/11/08/2568660/npc-probing-government-data-leaks) - GR · Controller/Processor Duties · date pending ### HDPA fined the Ministry of Migration and Asylum EUR 175,000 for lack of cooperation and substantially incomplete DPIAs relating to its 'Centaur' AI-enabled monitoring system. [Hellenic Data Protection Authority (HDPA)](https://www.dpa.gr/en/Organisations/Data_Breach_notification) - EC · Cross-Border & Adequacy · date pending ### General Norm on National and International Transfers (SPDP-SPD-2026-0004-R) establishes the transfer framework; SPDP may act ex officio to recognise adequacy. [SPDP](https://spdp.gob.ec/wp-content/uploads/2026/01/04.01.01-SPSP-SPD-2026-0004-R-Norma-general-de-transferencias-signed.pdf) - CL · Enforcement & Redress · 2026-11-08 ### Fine-ceiling figures (20,000 UTM) secondary-sourced; Art. 23 tutela procedure confirmed from primary text. [BCN - Ley Chile](https://www.bcn.cl/leychile/navegar?idNorma=1209272) - APAC · Regulator & Framework · date pending ### Global CBPR Program Requirements updated 23 March 2026, expanding from 50 to 57 requirements; ASEAN Framework on PDP remains non-binding. [Global CBPR Forum](https://www.globalcbpr.org/) - EG · Enforcement & Redress · 2026-11-01 ### Penalty framework now operative; no enforcement decision yet located. [Al Majidi Law Firm](https://almajidilaw.com/egypt-data-protection-law-compliance-deadline-2026/) - PE · Controller/Processor Duties · 2026-01-01 ### Medium-enterprise ODP designation tranche becomes exigible 30 November 2026. [ANPD — Informes y publicaciones](https://www.gob.pe/institucion/anpd/informes-publicaciones/) - KR · Enforcement & Redress · date pending ### PIPA 10% turnover fine ceiling effective 2026-09-11; record SK Telecom fine (KRW 134.8bn, under appeal), open Coupang investigation (potential ~KRW 1 trillion), Kakao Pay/Alipay enforcement, TikTok fine. [InHouse APAC](https://www.inhouseapac.com/insights/korea-pipa-enforcement-trends-2026-what-the-pipc-is-watching) - MY · Regulator & Framework · date pending ### JPDP published Public Consultation Paper No. 1/2026 (5 Oct 2026) on a draft AI and Personal Data Protection Framework (10 parts, 43 sections), comment period closed 23 Oct 2026. [Department of Personal Data Protection](https://www.pdp.gov.my/en/main-page/) - CA-AB · Regulator & Framework · 2026-05-14 ### Bill 31 creates a narrow POPA carve-out permitting AGLC to sell Play Alberta customer personal information, subject to Order in Council; commencement date not confirmed. [Legislative Assembly of Alberta (Bill Status Report)](https://assembly.ab.ca/LAO/Bills/bsr31-2.pdf) - VN · Enforcement & Redress · 2026-01-01 ### Decree 330/2026/ND-CP (effective 19 Aug 2026) sets administrative sanctions for cybersecurity/PDP violations; PDPL carries fines up to 5% of prior-year VN revenue for cross-border-transfer breaches and VND 3bn+ (up to 10x illegal gain) for illegal data sale/purchase… [Vietnam Law Magazine](https://vietnamlawmagazine.vn/businesses-face-tightened-personal-data-protection-requirements-79374.html) - KZ · Lawful Processing & Special Data · 2026-07-11 ### Personal-data definition changed to an identifier test effective 11 July 2026; new statutory definitions of automated processing, anonymisation, masking and hashing effective 25 August 2026. [Morgan Lewis — KZ Data Protection Law Amendments 2026](https://www.morganlewis.com/pubs/2026/07/republic-of-kazakhstan-data-protection-law-amendments-in-2026) - US-CO · Algorithmic, Biometric & Surveillance Governance · 2026-05-14 ### SB26-189 (signed 2026-05-14) replaces the stalled Colorado AI Act with an ADMT law applicable from 2027-01-01. [Security Boulevard](https://securityboulevard.com/2026/11/us-state-ai-laws-in-force-what-an-enterprise-deployer-actually-owes/) - IE · Sectoral Watch · date pending ### The Health Information Act 2026, signed by the President on 30 April 2026, establishes a legal basis for a national Digital Health Record and patient access rights, relevant to sectoral health-data rules outside this cycle's core coverage range. [Citizens Information (Government of Ireland)](https://www.citizensinformation.ie/en/health/legal-matters-and-health/access-to-medical-records/) - MZ · Regulator & Framework · 2026-09-29 ### Cybersecurity/Cybercrime Laws in force 29 Sept 2026; Personal Data Protection Bill pending in Assembly. [DataGuidance](https://www.dataguidance.com/news/mozambique-assembly-approves-cybersecurity-law-and) - PA · Cross-Border & Adequacy · date pending ### ANTAI Resolution ANTAI-DG-003-2026 of 26 March 2026 approves RIPD SCCs as a recognised transfer mechanism. [Morgan & Morgan](https://morimor.com/panama-updates-rules-for-international-data-transfers/) - CA-NB · Regulator & Framework · date pending ### PIPEDA remains in force and unamended; Bill C-36 remains at second reading as of this cycle. [Office of the Ombud, New Brunswick](https://www.ombudnb.ca/) - SE · Enforcement & Redress · 2026-11-03 ### IMY issued decisions on 3 November 2026 against four Swedish people-search services (Lexbase, Krimfup, MrKoll, Upplysning) for GDPR breaches, with formal orders against Lexbase and Krimfup under Article 10 and reprimands against MrKoll and Upplysning under Article 17. [SVT](https://www.svt.se/kultur/mydighet-lexbase-far-inte-gora-personer-sokbara) - CM · Cross-Border & Adequacy · 2026-06-23 ### Cross-border transfer now subject to prior APDP authorisation; ANTIC must approve international data transfers. [Global Center on AI Governance](https://www.globalcenter.ai/research/data-privacy-and-responsible-ai-adoption-in-cameroon) - US-OK · Regulator & Framework · 2027-01-01 ### OCDPA (SB546) signed 2026-03-20, a new comprehensive Virginia-model statute, superseding the prior 'no comprehensive statute' position. [Hunton Andrews Kurth Privacy & Cybersecurity Law Blog](https://www.hunton.com/privacy-and-cybersecurity-law-blog/oklahoma-enacts-comprehensive-consumer-privacy-law) - US-VT · Regulator & Framework · 2026-06-16 ### Vermont enacted a comprehensive consumer privacy statute (Act 145), not yet in force, plus Act 138 amending the data-broker law. [recordinglaw.com](https://www.recordinglaw.com/news/vermont-data-privacy-online-surveillance-act-s71/) - US-AL · Regulator & Framework · 2026-04-16 ### APDPA (HB351/Act 2026-552) enacted, pending 1 May 2027 effective date. [Privacy Law Map](https://privacylawmap.com/states/alabama) - US-NY · Algorithmic, Biometric & Surveillance Governance · 2026-03-27 ### RAISE Act (GBL Article 44-B) finalized by chapter amendment 27 March 2026, effective 1 January 2027, creating a new NYDFS frontier-AI oversight office with mandatory Frontier AI Framework and incident-reporting duties. [Wiley Rein](https://www.wiley.law/alert-New-York-Finalizes-RAISE-Act-for-Frontier-AI-Models-Law-Takes-Effect-January-1-2027) Also tracked by aic:sectoral_and_public_sector_ai - CH · Enforcement & Redress · date pending ### Federal Administrative Court's first judicial interpretation of Art 24 FADP breach-notification exceptions; criminal penalty ceiling CHF 250,000 (natural person) / CHF 50,000 (undertaking fallback); FDPIC has no fining power; civil remedies and Art 89 CPC representative… [MME Legal](https://www.mme.ch/en/magazine/articles/who-will-be-penalised-for-infringements-of-the-new-federal-data-protection-act) - PW · Regulator & Framework · 2026-07-21 ### Bureau of Cybersecurity created by RPPL 12-8 (signed 21 July 2026); Privacy Act (6 PNCA ss.205-206) remains the government-scoped baseline. [Island Times News](https://islandtimes.org/palau-extends-interim-ship-registry-contract-through-cybersecurity-act-rider/) - SN · Algorithmic, Biometric & Surveillance Governance · date pending ### Video-surveillance/biometric processing is CDP's leading supervisory focus in 2026; over 75% of Q1 declarations concerned video-surveillance, and CDP refused authorisation for a public-road vehicle camera (12 June 2026). [Osiris.sn](https://www.osiris.sn/protection-des-donnees-au-senegal-la-cdp-tire-la-sonnette-d-alarme-face-a-la.html) - AFR · Regulator & Framework · 2026-02-02 ### Malabo Convention ratification rose from 16 to 20 of 55 AU member states per the AU's status list dated 2 Feb 2026; Equatorial Guinea signed 28 July 2026, a precursor step. No continental enforcement mechanism exists; NADPA/RAPDP remains a cooperation network, not a regulator. [Siberson](https://www.siberson.com/africa-data-security-compliance.html) - US-OR · Children & Vulnerable Groups · 2026-01-01 ### Under-16 data sale prohibition took effect Jan 1, 2026 via HB 2008. [Stoel Rives LLP](https://www.stoel.com/insights/publications/oregon-privacy-compliance-in-2026-what-businesses-need-to-know) - US-NH · Children & Vulnerable Groups · 2026-06-19 ### 2026 N.H. Laws ch. 168 adds a child-data-sale ban, effective 2027-01-01. [DPO School](https://dposchool.com/state-privacy-laws/state/new-hampshire) - US-NJ · Controller/Processor Duties · 2027-04-01 ### A5328's data-broker/data-collector registration and disclosure duties take effect April 1, 2027; no new breach-notification/DPIA/DPO-threshold instrument independently verified. [Freshfields](https://www.freshfields.com/en/our-thinking/blogs/a-fresh-take/new-jerseys-new-data-privacy-rules-what-organizations-need-to-know-102ncxe) - US-RI · Enforcement & Redress · 2026-01-01 ### Kim Ahern elected RI Attorney General 3 November 2026; takes office January 2027 inheriting RIDTPPA's exclusive enforcement authority. Civil penalty structure (up to $10,000/violation under Title 6, plus $100-$500 for intentional unlawful disclosure) unchanged. [CLIClaw](https://www.cliclaw.com/legal_compliance/rhode-island-data-transparency/) - LK · Enforcement & Redress · date pending ### DPA issued Circular No. 01/2026 encouraging public-sector implementation ahead of 1 Jan 2027; Part VII administrative-penalty regime (up to LKR 10 million) not yet in force. [Neelakandan & Neelakandan](https://neelakandan.lk/insights/data-protection-in-transition-understanding-sri-lankas-new-legal-framework) - US-ID · Enforcement & Redress · 2026-10-14 ### AG filed suit against OpenAI (2026-10-14) and joined the Character.AI multistate bankruptcy notice (2026-10-26), both under the general Consumer Protection Act. [Idaho Office of the Attorney General](https://www.ag.idaho.gov/content/uploads/2026/10/OpenAI-2026-10-14-Complaint.pdf) - US-KS · Regulator & Framework · date pending ### AG-elect Chris Mann (D) takes office Jan 2027; stated agenda shift expected. [KSNW - Mann defeats Kobach in Kansas AG race, AP reports](https://www.ksn.com/news/your-local-election-hq/kansas-attorney-general-election-results-2/) - KE · Cross-Border & Adequacy · 2026-09-08 ### ODPC Guidance Notes for Cross-border Data Transfers finalised 8 Sept 2026, confirming draft-to-final status. [Servercore](https://servercore.com/blog/articles/kenya-data-protection-act-data-residency/) - RO · Enforcement & Redress · 2026-11-05 ### ANSPDCP fined ING Bank N.V. Amsterdam - Sucursala București EUR 5,000 for GDPR Art. 32 breaches, 5 Nov 2026. [JURIDICE.ro](https://www.juridice.ro/866420/anspdcp-a-amendat-o-banca.html) - MO · Regulator & Framework · date pending ### Regulator identity corrected from legacy GPDP to PDPB (established under Administrative Regulation 42/2023, in force since 1 Feb 2024). [Chambers Data Protection & Privacy 2026 - Macau](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/macau-sar-china/trends-and-developments) - MT · Algorithmic, Biometric & Surveillance Governance · 2026-08-02 ### AI Act authority designations confirmed (MDIA lead, IDPC law-enforcement AI). [The Leveraged Years](https://www.theleveragedyears.com/ai-regulation-news/malta-mdia-ai-act-market-surveillance-authority-2026) - CR · Regulator & Framework · 2026-05-01 ### Prodhab Resolution 029-2026-RF vs TSE revocatoria dispute unresolved. [El Mundo CR](https://elmundo.cr/costa-rica/tse-anuncia-que-recurrira-resolucion-de-la-prodhab-y-advierte-posibles-afectaciones-a-servicios-publicos/) - SA · Cross-Border & Adequacy · 2026-10-06 ### New draft Article 23(2) introduces an express data-localisation requirement for the first time. [Clyde & Co](https://www.clydeco.com/en/insights/2026/10/sdaia-publishes-draft-amendments-to-the-pdpl) - US-NV · Regulator & Framework · date pending ### No dedicated DPA; AG exercises general consumer-protection authority over NRS 603A's three sectoral layers. [RecordingLaw.com](https://www.recordinglaw.com/us-laws/data-privacy-laws/nevada-data-privacy-laws/) - DK · Algorithmic, Biometric & Surveillance Governance · 2026-11-05 ### Datatilsynet severe-criticism decision against municipal AI deployment. [Kortlex](https://kortlex.com/news) - LT · Controller/Processor Duties · 2026-03-23 ### VDAI fined processor UAB DELSKA Lithuania (successor to UAB Rakrėjus) EUR 4,500 for breach of Art 32(1)(b), holding the processor's security duty independent of the controller's. [The DPO](https://thedpo.eu/en/decisions/7327db79-a01a-4d29-bd72-449e21629703) - LU · Regulator & Framework · 2026-11-02 ### CNPD Collegiate Body partially renewed 02/11/2026 (new Chair and Commissioner); statutory basis unchanged. [CNPD](https://cnpd.public.lu/en.html) - TN · Regulator & Framework · 2026-05-01 ### INPDP council mandate reported lapsed since 2024, delaying research-project authorisations; reform bill 095/2025 remains in first reading before the Rights and Freedoms Committee, which extended consultations in May 2026 with no adoption date set. [Elair Avocat](https://www.elair-avocat.com/en/news/gdpr-tunisian-law-ai-obligations-2026/) - JP · Enforcement & Redress · date pending ### 2026 amendment expands PPC order-making flexibility (removes 'imminent' requirement) and introduces Japan's first administrative-fine power, pending commencement. [NHI Mgmt Group](https://nhimg.org/japan-appi-guide) - US-MS · Enforcement & Redress · date pending ### Corrects secondary-source error: HB 1220 (insurance cybersecurity safe-harbor) died in Senate committee 2026-03-03 and was never enacted, contrary to at least one secondary source claiming it was signed into law; SB 2128 (AG-notification threshold) also died in committee. [Justia (Mississippi Code Section 75-24-29)](https://law.justia.com/codes/mississippi/title-75/chapter-24/general-provisions/section-75-24-29/) - CO · Regulator & Framework · 2026-05-19 ### Ley 2573 commencement approaching (around 19 Nov 2026). [Pirani Risk](https://www.piranirisk.com/es/hub-regulatorio/ley-2573-2026-suplantacion-identidad-bancos-telcos-colombia) - PL · Enforcement & Redress · 2026-10-06 ### NSA upheld PLN 45,697 health-data-consent fine (2026-10-06, reported 2026-11-02); UODO fined a Kraków entrepreneur PLN 31,507 (2026-09-30) for non-cooperation. [Poland Insight](https://polandinsight.com/poland-health-data-oral-consent-fine-14085/) - SG · Cross-Border & Adequacy · 2026-03-02 ### No cross-border transfer or adequacy findings researched this cycle. [NHIMG](https://nhimg.org/singapore-pdpa-guide) - CY · Enforcement & Redress · 2026-09-23 ### EUR6,000 fine against Agora platform, now under appeal. [Cyprus Mail](https://cyprus-mail.com/2026/09/23/fidias-to-fight-e6000-data-fine-over-agora-app-in-court) - LATAM · Regulator & Framework · 2026-11-03 ### Madrid ministerial validated updated RIPD data-protection and digital-government-interoperability standards. [Secretaría General Iberoamericana (SEGIB)](https://segib.org/es/los-paises-iberoamericanos-acuerdan-en-madrid-la-alianza-iberoamericana-de-inteligencia-artificial/) - US-FL · Children & Vulnerable Groups · 2026-10-22 ### AG-proposed Safe Screens Act would extend age-verification, parental-consent and AI-chatbot restrictions for minors. [Florida Attorney General / My Florida Legal](https://www.myfloridalegal.com/newsrelease/attorney-general-james-uthmeier-proposes-safe-screens-act-protect-minors-app-stores) - UA · Enforcement & Redress · date pending ### Draft Law No. 8153 reported to raise maximum fines substantially above current UAH 1,700-34,000 range; figure disputed. [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/ukraine-data-privacy-laws/) - ES · Algorithmic, Biometric & Surveillance Governance · date pending ### EUR 10.04m Aena biometric DPIA-failure fine; preventive warning against AI recruitment-screening tool. [Cuatrecasas](https://www.cuatrecasas.com/es/spain/propiedad-intelectual/art/an-anula-guia-biometricos-ahora-que) - US-UT · Regulator & Framework · 2026-07-01 ### HB418 added a right to correct inaccuracies, effective 2026-07-01. [Privacy Rights Clearinghouse](https://privacyrights.org/resources-tools/law-overviews/utah-consumer-privacy-act) - CA-ON · Regulator & Framework · 2026-11-02 ### IPC Ontario FIPPA significant-harm-threshold guidance published. [Information and Privacy Commissioner of Ontario](https://www.ipc.on.ca/en) - GH · Sectoral Watch · date pending ### Bank of Ghana Cyber and Information Security Directive imposes cyber-incident reporting duties on fintechs/payment firms, overlapping the financial-sector data-protection perimeter. [Stackweaver](https://stackweaver.cloud/atlas/ghana/) - CA-TFN · Regulator & Framework · 2026-10-22 ### No confirmed local DP framework; federal PIPEDA presumed applicable. New TPMA permit regime imposes KYC data-collection duties as a financial-regulatory (not DP-law) obligation. [RG.org](https://rg.org/en-ca/news/gambling-industry/tobique-first-nation-prediction-markets-act-tpma-permits) Also tracked by advennt:licensing_and_regulation, crypto:crypto_licensing, financial-integrity:D3, world-payments:W13 - US-GA · Regulator & Framework · date pending ### AG leadership change pending Jan 2027; no comprehensive privacy statute in force. [Budget Security](https://budgetsecurity.com/blog/georgia-data-breach-law-penetration-testing/) - US-IL · Enforcement & Redress · date pending ### Dated BIPA-adjacent private class settlement milestones (opt-out Nov 10 2026, claims Nov 25 2026, hearing Dec 17 2026) reported this window. [SecurePrivacy.ai](https://secureprivacy.ai/blog/illinois-bipa-2026-guide) - TH · Regulator & Framework · 2026-11-08 ### PDPC held its first public consultation on draft sector-specific PDPA guidelines for 11 industries under its 2024-2027 National Master Plan. [Athentic Consulting](https://www.athenticconsulting.co.th/en/article/thailand-to-introduce-sector-specific-pdpa-guidelines-for-11-industries) - KM-A · Regulator & Framework · date pending ### Secondary sources conflict on whether a 2021 data-protection statute and National Authority exist and are operational. [Techhive Advisory — Review of the Comoros Data Protection Law](https://www.techhiveadvisory.africa/insights/review-of-the-comoros-data-protection-law) - BZ · Algorithmic, Biometric & Surveillance Governance · 2026-11-03 ### Belize Police Department exploring AI-based surveillance technology via its Crime Fusion and Operations Centre, reported 3 November 2026; no implementation date, funding agreement, DPIA or Commissioner review identified. [Breaking Belize News](https://www.breakingbelizenews.com/2026/11/03/police-pursuing-artificial-intelligence-surveillance-technology-to-strengthen-crime-investigations/) ## Regulatory horizon - AE · [Federal Artificial Intelligence and Data Authority merger of AI Office, TDRA digital sector and UAE Data Office](/jurisdictions/united-arab-emirates/) · closed 2026-06-14 - AE · [PDPL Executive Regulations and Article 26 penalty-schedule Cabinet decision still pending](/jurisdictions/united-arab-emirates/) · 2027-Q4 - APAC · [Global CAPE expansion goals](/jurisdictions/asia-pacific-bloc/) · 2026-Q4 - APAC · [ASEAN DEFA cross-border data provisions](/jurisdictions/asia-pacific-bloc/) · 2026-Q4 - AU · [Privacy Act Tranche 1 automated-decision-making transparency commences](/jurisdictions/australia/) · 2026-12-10 - BG · [Bulgaria DSA formal-notice response deadline](/jurisdictions/bulgaria/) · 2026-12-01 - CA · [Bill C-36 (Protecting Privacy and Consumer Data Act) progress](/jurisdictions/canada/) · 2027 - CA · [Consumer-Driven Banking Regulations consultation close](/jurisdictions/canada/) · 2026-Q3 - CA · [Bill C-36 (Protecting Privacy and Consumer Data Act) federal privacy reform](/jurisdictions/canada/) · 2027 - CA · [PIPEDA data-mobility (portability) right commencement](/jurisdictions/canada/) · 2027 - CA · [Bill C-36 (Protecting Privacy and Consumer Data Act) pending second reading](/jurisdictions/canada/) · 2026-Q4 - CA-AB · [Bill 31 POPA carve-out proclamation pending](/jurisdictions/alberta-canada/) · 2026-Q4 - CA-BC · [BC PIPA reform recommendations pending government response](/jurisdictions/british-columbia-canada/) · 2027 - CH · [Swiss AI legislation consultation draft (CoE AI Convention implementation)](/jurisdictions/switzerland/) · 2026-Q4 - CH · [VUPF/OSCPT surveillance ordinance revision](/jurisdictions/switzerland/) · 2026-Q4 - CH · [Latombe appeal on EU-US DPF adequacy (Case C-703/25 P)](/jurisdictions/switzerland/) · 2027 - CL · [Ley 21.719 entry into force](/jurisdictions/chile/) · 2026-12-01 - CL · [Possible postponement bill (Boletín 18.623-07) resolution](/jurisdictions/chile/) · 2026-Q4 - CM · [Implementing Decree to Law No. 2024/017 (authorisation tracks) adoption status](/jurisdictions/cameroon/) · 2026-Q4 - CO · [Ley 2573 de 2026 general regime commencement](/jurisdictions/colombia/) · 2026-11-19 - CO · [SIC Título V draft resolution finalisation](/jurisdictions/colombia/) · 2026-Q4 - CW · [Convention 108+ implementation legislative scenario selection pending](/jurisdictions/curacao/) · 2027-Q2 - EC · [Draft General Norm on Biometric Data Processing — adoption pending](/jurisdictions/ecuador/) · 2026-Q4 - EEA · [Digital Omnibus GDPR amendment — further legislative progress awaited](/jurisdictions/european-economic-area-bloc/) · 2027-Q1 - EG · [PDPC enforcement decisions expected following grace-period expiry](/jurisdictions/egypt/) · 2027-Q1 - FR · [Pending social-media age/digital-majority legislation (two competing texts)](/jurisdictions/france/) · 2026-Q4 - FR · [Ddadue bill would designate CNIL as lead AI Act market-surveillance authority](/jurisdictions/france/) · 2026-Q2 - GI · [Gibraltar AI regulatory taskforce (proposed, principles-based, DLT-modelled)](/jurisdictions/gibraltar/) · 2028 - GI · [Formal EU Commission adequacy decision for Gibraltar outstanding](/jurisdictions/gibraltar/) · 2027-Q2 - GI · [GRA guidance on prediction-market operator KYC/AML data processing expected](/jurisdictions/gibraltar/) · 2026-Q4 - GI · [Data Protection Regulations 2026 (LN 96/2026) in force](/jurisdictions/gibraltar/) · closed 2026-07-15 - GR · [HDPA AI Act implementation law consultation closes](/jurisdictions/greece/) · closed 2026-07-06 - GR · [EU AI Act Article 70 national regulatory sandbox operational deadline](/jurisdictions/greece/) · 2027-08-02 - GR · [EU Digital Omnibus data package (GDPR/ePrivacy amendments) — Council draft diverges from Commission proposal](/jurisdictions/greece/) · 2026-Q4 - GR · [Latombe v Commission CJEU appeal on EU-US DPF adequacy decision](/jurisdictions/greece/) · 2027 - HK · [PDPO reform: mandatory breach notification and administrative fines](/jurisdictions/hong-kong/) · 2027 - ID · [GR 33/2026 (UU PDP implementing regulation) enters into force](/jurisdictions/indonesia/) · 2027-01-16 - IE · [CJEU appeal of EU-US Data Privacy Framework adequacy decision](/jurisdictions/ireland/) · 2027-Q1 - IM · [ICO tiered registration-fee model possible commencement](/jurisdictions/isle-of-man/) · 2027-Q2 - IN · [DPDP Rules notice-to-Data-Principal provision commences](/jurisdictions/india/) · 2027-05-13 - JP · [APPI criminal-penalty changes take effect](/jurisdictions/japan/) · 2027-01-17 - JP · [PPC implementing-regulation consultation closes](/jurisdictions/japan/) · 2026-Q4 - JP · [PPC implementing regulations promulgated and implemented](/jurisdictions/japan/) · 2027-01-15 - KE · [Data Protection (Amendment) Bill, 2025 pending enactment](/jurisdictions/kenya/) · 2027-Q1 - KR · [ISMS-P certification mandatory for designated large controllers](/jurisdictions/south-korea/) · 2027-07-01 - MZ · [Personal Data Protection Bill — pending Assembly debate](/jurisdictions/mozambique/) · 2027-Q2 - MZ · [Cybersecurity Law implementing regulations due](/jurisdictions/mozambique/) · 2027-Q1 - NL · [UAVG biometric-data provision (art. 29) not yet in force](/jurisdictions/netherlands/) · 2027-Q1 - NL · [AP guidance on automated-decision-making explanations](/jurisdictions/netherlands/) · 2026-Q3 - NL · [Latombe CJEU appeal against DPF ruling](/jurisdictions/netherlands/) · 2027-Q2 - NP · [Information Technology and Cyber Security Bill, 2082 pending enactment](/jurisdictions/nepal/) · 2027-Q2 - PE · [Medium-enterprise ODP designation duty exigible](/jurisdictions/peru/) · 2026-11-30 - RS · [RS draft replacement Law on Personal Data Protection adoption pending](/jurisdictions/serbia/) · 2027 - SA · [SA PDPL Implementing Regulation amendments take effect](/jurisdictions/saudi-arabia/) · 2027-01-04 - TW · [PDPA amendment commencement date and PDPC formal establishment](/jurisdictions/taiwan/) · 2027-Q1 - UG · [PDPO Annual Compliance Report filing deadline](/jurisdictions/uganda/) · 2026-11-23 - UK · [ICO agentic-AI call for evidence closes](/jurisdictions/united-kingdom/) · 2026-11-20 - US · [CCPA ADMT substantive-compliance deadline](/jurisdictions/united-states/) · 2027-01-01 - US · [Latombe v Commission CJEU appeal of EU-US DPF adequacy decision](/jurisdictions/united-states/) · 2027-Q1 - US · [FISA Section 702 further legislative/judicial development](/jurisdictions/united-states/) · 2027-03 - US · [CFPB Section 1033 Personal Financial Data Rights Rule reconsideration](/jurisdictions/united-states/) · 2026-Q4 - US · [CPPA risk-assessment first annual submission to agency](/jurisdictions/united-states/) · 2028-04-01 - US-AL · [APDPA takes effect](/jurisdictions/alabama-usa/) · 2027-05-01 - US-CA · [CPPA ADMT compliance deadline](/jurisdictions/united-states-california/) · 2027-01-01 - US-CO · [SB26-189 ADMT law takes effect](/jurisdictions/colorado-usa/) · 2027-01-01 - US-CO · [CPA minors' addictive-design rule amendments pending publication](/jurisdictions/colorado-usa/) · closed 2025-Q4 - US-GA · [SB 540 AI companion chatbot disclosure law in force](/jurisdictions/georgia-usa/) · 2027-07-01 - US-ID · [Idaho Conversational AI Safety Act effective date](/jurisdictions/idaho-usa/) · 2027-07-01 - US-KS · [New Kansas AG Chris Mann takes office](/jurisdictions/kansas-usa/) · 2027-01-12 - US-KY · [HB 692 automated content recognition sensitive-data category in force](/jurisdictions/kentucky-usa/) · 2027-07-01 - US-LA · [Louisiana Data Privacy Act in force](/jurisdictions/louisiana-usa/) · 2027-01-01 - US-LA · [LDPA 30-day cure period sunsets](/jurisdictions/louisiana-usa/) · 2027-07-31 - US-NH · [NH RSA 507-H amendment: child-data-sale ban in force](/jurisdictions/new-hampshire-usa/) · 2027-01-01 - US-NJ · [NJ data-broker/data-collector registry opens for registration](/jurisdictions/new-jersey-usa/) · 2027-04-01 - US-NY · [RAISE Act frontier-AI oversight regime comes into force](/jurisdictions/united-states-new-york/) · 2027-01-01 - US-OK · [OCDPA (SB546) expected in force](/jurisdictions/oklahoma-usa/) · 2027-01-01 - US-PA · [Consumer Data Privacy Act (HB78) pending Senate floor action](/jurisdictions/pennsylvania-usa/) · 2026-11-30 - US-SC · [South Carolina Attorney General transition (Stumbo succeeds Wilson)](/jurisdictions/south-carolina-usa/) · 2027-Q1 - US-UT · [UCPA HB357 motor-vehicle data amendment in force](/jurisdictions/utah-usa/) · 2027-01-01 - US-UT · [Utah Digital Choice Act data-portability provisions effective](/jurisdictions/utah-usa/) · 2027-07-01 - US-VT · [Vermont Data Privacy and Online Surveillance Act (Act 145) in force](/jurisdictions/vermont-usa/) · 2028-01-01 - US-VT · [Vermont Act 138 data-broker amendments in force](/jurisdictions/vermont-usa/) · 2027-01-01 - VE · [Ley de los Derechos Digitales (Venezuela) — proposed, no bill text](/jurisdictions/venezuela/) · 2027-Q4 - VN · [National Portal for Personal Data Protection launch](/jurisdictions/vietnam/) · 2027-Q1 - VU · [Digital Transformation Act AI-permit regime commencement unconfirmed](/jurisdictions/vanuatu/) · 2026-Q4 Ranked within this monitor (per_consumer); tie-break recency_date_desc, jid_asc, module_asc, url_asc. Index tool 1.5.0, edition policy 1.2.0.