A quick overview of global privacy headlines you cannot afford to miss.
April 22, 2026
United States
The U.S. House Energy and Commerce Committee and U.S. House Financial Services Committee have advanced two privacy bills: the SECURE Data Act and GUARD Financial Data Act, marking progress toward a unified federal privacy framework and updates to the Gramm-Leach-Bliley Act.
The proposals introduce established privacy principles, including data minimization, opt-in consent for sensitive data, and consumer rights such as access, deletion (for former customers), and portability. They also enhance transparency requirements and place greater accountability on organizations handling financial data
The strong opposition by EPIC and CPPA indicates a lower likelihood of the SECURE Data Act and GUARD Financial Data Act making their way through the legislative process.
Criticism from groups like the Electronic Privacy Information Center reflects a recurring tension: federal uniformity vs. preservation of stronger state rights. Practically, the bills suggest convergence toward a “baseline + sectoral uplift” model, but preemption remains the key fault line that will likely determine whether this effort succeeds where prior attempts failed. Read More on the SECURE Data Act and GUARD Financial Data Act
April 21, 2026
Alabama, United States
The Alabama Attorney General announced a $12.2 million settlement with Roblox, introducing enhanced safeguards for minors on the platform. The agreement mandates robust age verification (including facial estimation and ID checks), expanded parental controls, and restrictions on communication, such as limiting chats between adults and minors and removing encryption for minor-related interactions to support law enforcement access.
The settlement also requires proactive monitoring to detect misreported ages and introduces default protections for younger users, alongside awareness initiatives and dedicated law enforcement coordination.
From a compliance perspective, this signals a shift toward platform accountability in child safety by design, combining identity verification, behavioral monitoring, and parental governance. Organizations handling minors’ data should view this as a benchmark for integrating safety, privacy, and regulatory responsiveness into product architecture, particularly where user interaction and content access are involved.
April 20, 2026
British Columbia, Canada
The Office of the Information and Privacy Commissioner for British Columbia has released a “Quick Reference Guide” to support SMEs in managing data breaches under the Personal Information Protection Act. The guidance outlines a clear four-step response framework: containment, risk assessment, notification, and prevention, helping organizations respond effectively and limit harm.
It also provides practical direction on assessing “significant harm” to determine when notifying affected individuals is necessary, alongside emphasizing documentation and timely action.
The guidance reinforces that breach management is not just reactive but operational, requiring predefined processes, accountability, and risk-based decision-making. For SMEs, it serves as a concise playbook to strengthen incident response readiness and align with regulatory expectations.
April 17, 2026
Alabama, United States
The state Governor Kay Ivey signed the Alabama Personal Data Protection Act (APDPA), making Alabama the 21st U.S. state with a comprehensive privacy law. Effective May 2027, the law applies to organizations processing data of 25,000+ consumers or deriving 25% revenue from data sales, one of the lowest thresholds nationally.
The APDPA introduces standard obligations, including data minimization, opt-in consent for sensitive data, security safeguards, and processor contracts, alongside consumer rights such as access, correction, deletion, portability, and opt-out. Notably, it does not mandate DPIAs or recognition of opt-out signals and includes a narrower definition of “sale.”
From a compliance perspective, APDPA reflects continued convergence across U.S. state laws, while its lower thresholds and operational flexibilities signal broader applicability with comparatively lighter procedural burden.
April 13, 2026
Kentucky, United States
Andy Beshear signed HB 692, amending the Kentucky Consumer Data Protection Act (KCDPA) to classify automated content recognition (ACR) data and data from smart monitors as “sensitive data,” effective July 2027.
ACR data capturing real-time viewing behavior through device-level tracking technologies will now require explicit consumer consent prior to collection. The amendment carves out limited exclusions, including data tied to a provider’s own services or necessary for requested functionalities.
This marks a shift toward device-level behavioral data being treated as inherently sensitive, even outside traditional categories like health or biometrics. Organizations operating in connected device ecosystems should reassess consent flows, transparency disclosures, and tracking technologies embedded in smart devices to align with heightened regulatory expectations.
April 13, 2026
Virginia, United States
Virginia's Governor signed SB338, amending the Virginia Consumer Data Protection Act (VCDPA) to prohibit the sale of consumers’ precise geolocation data, effective July 1, 2026. The law defines precise geolocation as location data within a 1,750-foot radius and restricts its sale for monetary consideration.
Virginia joins states like Maryland and Oregon in tightening controls around location data, though with a narrower definition of “sale.”
This reflects growing regulatory focus on highly granular location tracking as sensitive data in practice, even where not explicitly categorized as such. Organizations should reassess location data collection, ensure alignment with data minimization principles, and implement clear controls around data sharing and monetization practices to mitigate regulatory risk.
April 27, 2026
Germany
Germany's Federal Office for Information Security (BSI) has launched the C3A (Criteria enabling Cloud Computing Autonomy), a new framework designed to protect Germany's digital sovereignty against what it describes as the risk of "cyber dominance" by cloud providers who maintain permanent, unilateral access to customer systems and data.
Unlike the existing C5 catalog, which focuses on security, C3A introduces verifiable criteria for operational and legal autonomy, including data localization requirements and controls over provider influence. The framework aligns with the European Cloud Sovereignty Framework and enables audit-based validation.
The BSI expects to publish the full guidelines and audit processes by the end of Q2 2026. From a compliance perspective, C3A reflects a growing shift beyond security toward digital sovereignty as a governance priority. Organizations leveraging cloud services, especially in regulated or cross-border contexts, should incorporate sovereignty assessments into vendor risk management and cloud strategy.
April 21, 2026
Italy
The Italian Data Protection Authority has issued guidelines on the use of tracking pixels in emails, classifying them as intrusive technologies that monitor user behavior. Under the guidance, the use of such pixels requires prior, free, specific, and informed consent, aligning with Article 122 of Italy’s Privacy Code.
Organizations must also provide clear disclosures and easy mechanisms for withdrawing consent, while implementing privacy by design and default to limit data exposure. Limited exceptions apply for security or strictly necessary service communications.
This reinforces that email tracking practices fall within broader ePrivacy-style consent requirements, not just general transparency obligations. Businesses using email analytics or marketing tools should reassess tracking mechanisms, consent flows, and notice practices to ensure alignment within the six-month compliance window.
April 20, 2026
Italy
The Italian Data Protection Authority (Garante) has fined Poste Italiane and Postepay a combined €12.5 million for unlawfully processing personal data.
The investigation found that users were required to allow monitoring of all installed and running mobile apps as a condition of service, deemed disproportionate despite fraud prevention claims. Additional violations included inadequate transparency, absence of a Data Protection Impact Assessment (DPIA), insufficient security measures, unclear data retention practices, and issues in controller designation.
The decision reinforces that security justifications cannot override proportionality and data minimization principles. Organizations must ensure intrusive monitoring practices are strictly necessary, well-documented, and supported by robust governance measures.
April 16, 2026
Latvia
The Data State Inspectorate (DVI) has issued guidance on the commercial reuse of personal data from the Enterprise Register, a public database containing information on companies, representatives, and beneficial owners.
The DVI clarified that publicly accessible data is not free from GDPR obligations. Organizations scraping and reusing such data must rely on a valid legal basis, typically legitimate interest, which requires a balanced assessment. Crucially, if individuals object, processing must stop unless compelling grounds can be demonstrated.
The guidance reinforces that “publicly available” does not mean “freely exploitable.” Businesses leveraging public datasets for commercial purposes should ensure proper legal basis assessments, objection-handling mechanisms, and transparency to remain compliant.
April 16, 2026
Mozambique
Mozambique’s Assembly of the Republic has approved the Cyber Security Act and Cybercrimes Act to enhance national cyber resilience amid rising cyber threats.
The Cyber Security Act establishes a framework for protecting critical infrastructure, managing cyber risks, and coordinating incident response, while introducing a National Cyber Security Authority with oversight and enforcement powers. The Cybercrimes Act complements this by defining cyber offences, setting rules for electronic evidence, and enabling international cooperation.
From a compliance perspective, the laws reflect a shift toward integrated cybersecurity governance, combining prevention, enforcement, and cross-border coordination. Organizations operating in or with Mozambique should prepare for increased regulatory oversight, incident reporting expectations, and stricter accountability in handling cyber risks.
April 14, 2026
France
The Commission Nationale de l'Informatique et des Libertés (CNIL) has published final recommendations on the use of tracking pixels in emails, clarifying when consent is required and how it must be obtained, withdrawn, and documented.
The guidance distinguishes between tracking requiring consent and limited exemptions, such as measuring email deliverability or sending transactional communications (e.g., invoices, password resets). It also outlines responsibilities across stakeholders and provides a three-month transition period for organizations to inform users and enable objections.
This reinforces a move toward granular, use-case-based consent frameworks. Organizations using email tracking should reassess practices to clearly separate analytics from service-related communications and ensure robust consent management.
April 3, 2026
The EU's interim ePrivacy derogation, which since 2021 had allowed communications services to voluntarily scan private messages for Child Sexual Abuse Material (CSAM), expired on April 3, 2026, after the European Parliament voted against extending it.
The exemption had applied to number-independent interpersonal communications services such as messaging, webmail, and internet telephony platforms, allowing them to use specific technologies to detect, report, and remove child sexual abuse material in private communications. With its expiry, the current legal basis for such scanning has ended, pushing online platforms into a legal vacuum.
Negotiations on a permanent framework, the CSA Regulation, are ongoing, with the European Parliament expected to vote on its negotiating mandate in plenary in June 2026. Major tech companies had criticized the EU lawmakers for allowing the derogation to expire.
April 2, 2026
France
France's CNIL has issued a practical framework to guide organizations on retaining personal data across HR functions, covering recruitment, payroll, employee management, monitoring, and litigation.
The framework outlines standard retention periods and storage practices, combining legal requirements under French law with CNIL-recommended benchmarks. For example, unsuccessful candidate CVs may be retained for up to two years in active systems and longer in restricted storage for potential legal claims.
The guidance reinforces the need for structured data lifecycle management in HR operations, linking retention periods to legal obligations and risk exposure. Multinational organizations should treat this as jurisdiction-specific and align it with local laws across their operating regions.
April 1, 2026
United Kingdom
The Information Commissioner's Office (ICO) has released its Recruitment Rewired report, highlighting gaps in how organizations use automated decision-making (ADM) tools in hiring. Based on engagement with 30 organizations, the ICO identified shortcomings in bias monitoring, transparency, and human oversight.
The report emphasizes that employers should test ADM systems for bias, clearly inform candidates of their use, and provide mechanisms to challenge decisions or request human review. The ICO also reinforced candidate rights through accompanying guidance.
This signals increased scrutiny of AI use in recruitment, with a clear expectation for fairness, accountability, and explainability. Organizations using such tools should strengthen governance, validation processes, and candidate-facing transparency.
April 1, 2026
Italy
The Italian Data Protection Authority (Garante) has fined Intesa Sanpaolo €31.8 million following a serious data breach after an employee conducted over 6,600 unauthorized queries into the accounts of more than 3,500 customers, including high-profile individuals, without detection.
The regulator identified serious gaps in the bank’s technical and organizational measures, particularly the absence of effective monitoring and access controls to prevent misuse of internal systems.
This highlights that insider threats are a critical risk area, and that access governance must go beyond formal permissions to include continuous monitoring, anomaly detection, and audit mechanisms, especially when handling highly sensitive financial data.
April 1, 2026
The ICO has updated its draft guidance on automated decision-making and profiling to reflect the changes introduced by the Data (Use and Access) Act. The updated guidance adds a material explanation on how to determine whether processing falls within the scope of Article 22A of the UK GDPR, which applies solely to automated decisions with significant effects.
Moreover, the ICO has introduced new sections that cover safeguards organizations must implement and the rights individuals have in relation to automated decision-making that affects them.
This update reinforces the need for clear assessment of ADM use cases and stronger governance controls, including transparency, human intervention mechanisms, and rights handling, as regulatory expectations around automated decision-making continue to evolve.
April 30, 2026
Malaysia
The Personal Data Protection Department (JPDP) has released a new set of guidelines under the Personal Data Protection Act 2010, covering Data Protection Impact Assessments (DPIA), Data Protection by Design (DPbD), and Automated Decision-Making and Profiling (ADMP).
The DPIA guideline introduces triggers, methodology, and potential notification requirements. The DPbD guideline embeds privacy considerations across the data lifecycle, including specific safeguards for children. The ADMP guideline brings automated decision-making into scope, outlining rights such as access to information, refusal, and human review, along with provisions addressing AI and biometric use.
This marks a shift toward more structured and proactive data governance, requiring organizations to operationalize risk assessments, embed privacy into system design, and evaluate automated processing practices.
April 28, 2026
South Korea
The Personal Information Protection Commission (PIPC) held a nationwide briefing to support the implementation of its revised guidelines for drafting personal information processing policies. The session, attended by over 650 public and private sector representatives, focused on the practical application of updated requirements under the Personal Information Protection Act (PIPA).
The revised guidelines introduce new provisions on generative AI, including disclosure of whether user inputs are used for model training and how individuals can opt out. Additional guidance covers pseudonymized data handling, third-party disclosures, and policy transparency.
From a compliance perspective, this reflects increased emphasis on operationalizing privacy policies as accountability tools, particularly in AI-driven environments. Organizations should ensure policies clearly reflect actual processing practices and emerging AI use cases.
April 23, 2026
Australia
eSafety Commissioner and the Office of the Australian Information Commissioner (OAIC) have signed a Memorandum of Understanding to enhance collaboration on issues where privacy and online safety intersect.
The agreement formalizes information sharing and coordination, particularly around age assurance measures, social media age restrictions, and emerging risks linked to technologies such as AI. It aims to ensure that platforms implement safety controls while maintaining compliance with privacy obligations.
This reflects a growing regulatory expectation for integrated governance across privacy and safety domains. Organizations, especially those offering online or age-restricted services, should ensure that safety mechanisms like age verification are designed and deployed in a way that also upholds data protection principles.
April 22, 2026
Australia
The Office of the Australian Information Commissioner (OAIC) has found that rental platform 2Apply, operated by InspectRealEstate, collected excessive personal data and did so through unfair practices. The platform has been directed to stop collecting non-essential information such as gender, citizenship status, and detailed rental history.
The decision highlights violations of data minimization and fairness principles, noting the power imbalance faced by renters. It also marks a notable use of “choice architecture” analysis, identifying practices like confirmshaming and bundled consent.
This signals increasing scrutiny of dark patterns and coercive consent mechanisms. Organizations should ensure data collection is strictly necessary and that user interfaces enable genuinely free and informed choice.
April 20, 2026
South Korea
South Korea’s Korea Communications Commission has approved 75 organizations, including major platforms and financial institutions, to generate and process Connecting Information (CI)- an encrypted identifier derived from resident registration numbers used for online identity verification.
The approval followed an assessment of security measures, processing procedures, and user protection mechanisms. CI, while non-reversible, remains a high-risk identifier due to its linkage to national identity data.
This reflects a controlled approach to digital identity infrastructure, allowing usage while enforcing strict safeguards. Organizations handling such identifiers must ensure robust security controls, purpose limitation, and ongoing regulatory compliance, particularly given the sensitivity and scale of identity-linked data processing.
April 17, 2026
China
The Cyberspace Administration of China, along with multiple national authorities, has issued the Regulations on Promoting and Regulating the Application of Electronic Documents, effective September 1, 2026.
The regulations establish a unified framework for the use of electronic documents across trade, logistics, and finance, emphasizing system reliability, data integrity, traceability, and security. They also introduce requirements around identity verification, electronic signatures, cross-border data handling, and alignment with China’s data protection laws, including the Personal Information Protection Law.
The rules signal a push toward standardized and secure digital documentation ecosystems, requiring organizations to align technical systems, data governance, and cross-border practices with stricter regulatory expectations.
April 16, 2026
Australia
The Australian Communications and Media Authority (ACMA) has fined Latitude Finance $3.96 million for over 2.7 million breaches of Australia’s spam laws
The investigation found that the company sent millions of marketing messages without accurate sender details, and over 344,000 messages lacked a functional unsubscribe mechanism. This marks a repeat violation, following a prior penalty in 2022.
The case highlights that basic marketing compliance failures, such as valid consent, accurate identification, and working unsubscribe options, remain heavily enforced. Organizations should ensure ongoing monitoring and testing of communication systems, especially where prior regulatory action has already highlighted compliance gaps.
April 10, 2026
South Korea
The Personal Information Protection Commission (PIPC) and the Ministry of Science and ICT (MSIT) have announced major reforms to the ISMS/ISMS-P certification framework following concerns over breaches at certified organizations.
The overhaul shifts from document-based audits to continuous, risk-based monitoring, introduces tiered certification levels, and expands mandatory certification to high-impact data processors. It also strengthens audit methods through on-site verification, vulnerability testing, and enhanced post-certification oversight, including potential revocation.
From a compliance perspective, this signals a move toward continuous assurance over point-in-time compliance, requiring organizations to maintain demonstrable, real-time security and data protection practices rather than relying solely on certification status.
April 9, 2026
South Korea
The Personal Information Protection Commission (PIPC) has fined Christie's 280 million won for a data breach affecting 620 individuals.
The breach occurred after a help desk employee fell victim to a phishing attack, allowing unauthorized access to internal systems. The investigation found inadequate authentication procedures, failure to encrypt sensitive data, unlawful collection of national ID information, and delayed breach notification.
From a compliance perspective, the case highlights critical gaps in access controls, identity verification, and incident response. Organizations should ensure strong authentication mechanisms, encryption of high-risk data, and timely breach reporting to mitigate regulatory and operational risks.
April 7, 2026
South Korea
The Personal Information Protection Commission (PIPC) has designated the Daegu Digital Innovation Agency as a new operator of its Personal Information Innovation Zone, expanding the program to eight locations nationwide.
The initiative supports the safe use of pseudonymized data by providing controlled environments for research and innovation, particularly in AI, robotics, and healthcare. It also integrates with existing support centers offering consulting, training, and infrastructure for data utilization.
From a compliance perspective, this reflects a continued push toward structured, secure data-sharing ecosystems, enabling innovation while maintaining safeguards against re-identification and misuse. Organizations should consider leveraging such controlled environments while ensuring strong governance over pseudonymized data processing.
April 3, 2026
China
The Cyberspace Administration of China has released draft provisions introducing simplified compliance measures for small personal information processors (handling data of fewer than 100,000 individuals) under the Personal Information Protection Law.
The draft allows reduced obligations, including simplified notice requirements, lighter compliance audits, and exemptions from certain cross-border data transfer mechanisms in defined scenarios. It also enables reliance on platform-level compliance and introduces flexibility in notification and governance practices, while maintaining core protections, especially for sensitive data.
From a compliance perspective, this reflects a move toward proportionate regulation, balancing data protection with SME innovation. Smaller organizations can adopt streamlined frameworks, but must still ensure baseline safeguards, transparency, and incident response readiness.
Several upcoming regulatory developments are worth monitoring:
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
