August's clearest signal wasn't that regulators want compliance. It's that they now expect you to prove it. France's new sales-call regime doesn't just require consent; it places the burden on the business to provide evidence of it and voids any contract entered into without that proof. California kept penalizing data brokers not for what they collect but for failing to register, a documentation failure, while standing up the DROP platform to make deletion duties checkable at scale. Ghana fined EY for ignoring directives it couldn't show it had acted on, and Israel's PPA sanctioned a company simply for a missing notice at the point of collection. The pattern cuts across every region: authorities are no longer satisfied with policies that describe good intentions. They want registers, records, audit trails, and demonstrable lawful bases, the evidence that a control actually operated. Compliance is shifting from something you assert to something you can produce on demand, and “trust us” is no longer an answer that survives contact with a regulator.
North & South America Jurisdiction
1. Meta Agrees to $17.1 Billion Settlement Over Inadequate Safety Protections for Children in District of Columbia
August 26, 2026 District of Columbia., United States
Meta has reached a landmark settlement with 51 U.S. states and territories, resolving claims concerning the design and promotion of Instagram and Facebook to children. Under the agreement, Meta will pay at least $12.1 billion over ten years, with the total potentially reaching $17.1 billion depending on future settlements with other major social media companies.
Beyond the financial settlement, Meta must implement significant safeguards for younger users. These include enhanced age-assurance measures, daily usage limits and mandatory breaks, nighttime and school-time restrictions, stronger parental controls, age-appropriate content safeguards, and limits on certain social-comparison features. Implementation and effectiveness of the required safeguards will also be regularly assessed by an independent auditor under state oversight.
The settlement signals increasing regulatory expectations for platforms to incorporate age assurance, child-appropriate design, parental oversight, and protective defaults directly into services used by children.
2. Brazil's ANPD’s Actions Against Discord and TikTok for Violations of Children’s Privacy in the Country
August 25, 2026 Brazil
Brazil’s National Data Protection Authority (ANPD) has taken actions for regulatory oversight of major online platforms to safeguard children and adolescents.
On August 12, 2026, a formal investigation, regarding ineffective age-verification, flawed content removal, and failures to prevent or report content inducing self-harm and suicide, was launched against Discord after a police investigation into a potential children protection failure. As a preventative measure, Discord is ordered to suspend live broadcasts in Brazil.
Within a span of 13 days, on August 25, 2026, ByteDance Brasil Tecnologia Ltda. (the parent company of TikTok) ) was fined BRL 153.7 million (approx. $27.7 million USD) penalty for violating the General Personal Data Protection Law (LGPD). TikTok was fined for processing minors' personal data without a valid legal basis across two access modes (including its "feed without registration" mode). At the same time, TikTok’s own Age Gate mechanisms were deemed insufficient at preventing minors from accessing the platform. ByteDance is expected to execute corrective measures, including deleting all data collected from minors without valid consent and heightening its privacy protections.
Together, these actions indicate a decisive push by Brazilian regulators to hold online service providers accountable for children’s privacy protections.
3. Canada Introduces Bill C-36 to Modernize Federal Privacy Law
August 19, 2026 Canada
Canada has introduced Bill C-36, which would establish the Protecting Privacy and Consumer Data Act (PPCDA) and significantly reform the country’s federal private-sector privacy framework.
The proposed PPCDA would replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), while maintaining rules governing the collection, use, and disclosure of personal information in commercial activities.
The Bill would also introduce a new regulatory structure. The proposed Digital Safety and Data Protection Commission of Canada would oversee the regime, with a designated Privacy and Consumer Data Commissioner responsible for functions such as conducting investigations and audits, and issuing notices of contravention, penalties, and orders. A dedicated Privacy and Consumer Data Division would have additional responsibilities, including approving codes of practice and certification programs and conducting dispute resolution.
Bill C-36 also proposes administrative monetary penalties and new offenses, including for certain unauthorized re-identification of de-identified personal information.
4. Washington AG Releases First Data Privacy Report and Sets Policy Priorities
August 14, 2026 Washington, United States
Washington Attorney General Nick Brown has released the state Attorney General’s first Data Privacy Report, outlining key concerns in the data economy and recommendations for strengthening consumer privacy protections.
The report identifies four recurring concerns: overcollection and secondary use of personal information, weak consent requirements and deceptive design practices, collection and sale of sensitive data, and limited transparency in the data broker industry. It recommends action across three areas: strengthening baseline protections for personal data, expanding privacy enforcement and institutional capacity, and improving digital literacy. The Attorney General’s Office also plans to develop plain-language resources for consumers and small businesses covering data collection and sharing, privacy settings, cookies, deceptive design practices, and privacy obligations.
The report signals potential future policy and enforcement priorities in Washington, particularly around data minimization, meaningful consent, sensitive data, transparency, and data brokers.
5. CalPrivacy Fines Data Broker Cybba for Registration Failure
August 13, 2026 California, United States
The California Privacy Protection Agency (CalPrivacy) has ordered data broker Cybba, Inc. to pay a $52,400 fine for failing to register with the Agency’s Data Broker Registry by the 2025 deadline, marking CalPrivacy’s second data broker enforcement action in less than a week.
Cybba sells personal information, including geolocation data, internet activity, and consumer inferences, for targeted advertising purposes. In addition to the monetary penalty, Cybba must publish metrics concerning consumer privacy rights on its website and comply with requirements relating to California’s Delete Request and Opt-Out Platform (DROP). Under the Delete Act, data brokers must register annually with CalPrivacy and, beginning with applicable DROP requirements, process deletion requests submitted through the centralized platform.
The action signals continued enforcement scrutiny of California’s data broker ecosystem, with DROP becoming a central mechanism for consumers to exercise deletion rights across registered data brokers.
6. New Jersey Enacts Kids Code Act to Strengthen Children’s Online Privacy
August 12, 2026 New Jersey, United States
New Jersey has enacted the Kids Code Act, introducing privacy and online safety requirements for certain businesses offering online services reasonably likely to be accessed by children or minors. The law is scheduled to take effect on September 1, 2027.
Covered online services will be required to apply the strongest privacy settings by default for users known to be under 18, including restrictions on location sharing and certain communications with adults. The law also limits notifications to minors and requires businesses to retain only the minimum amount of minors’ personal data necessary to provide features they have selected.
Additional restrictions apply to the use of minors’ data for targeted content, while certain advertising involving tobacco and gambling is prohibited. Notably, the Act provides both enforcement by the New Jersey Attorney General and a private right of action, with potential remedies including $5,000 per violation or treble damages.
For online service providers, the Act is a major compliance requirement.
7. CalPrivacy Brings First Data Broker Action Under Both CCPA and Delete Act
August 11, 2026 California, United States
The California Privacy Protection Agency (CalPrivacy) has ordered data broker LocateSmarter LLC to pay $116,490 and change its practices in the Agency’s first enforcement action against a data broker under both the California Consumer Privacy Act (CCPA) and the Delete Act.
LocateSmarter failed to register in a timely manner as a data broker and required consumers to provide unnecessary information, including the last four digits of their Social Security numbers, before exercising their right to opt out of the sale of personal information. CalPrivacy found that requiring such information created unnecessary friction and conflicted with the CCPA’s data minimization requirements for consumer rights requests.
The decision also reinforces California’s broader scrutiny of the data broker sector as the state expands use of its Delete Request and Opt-Out Platform (DROP), which enables consumers to submit deletion requests across registered data brokers through a centralized mechanism.
8. New Mexico Court Orders Meta to Pay $567 Million in Major Child Safety Ruling
August 6, 2026 New Mexico, United States
A New Mexico court has ordered Meta to pay $567 million in the second phase of a child-safety case concerning risks posed to minors on its platforms, bringing total monetary awards in the matter to $942 million.
The court found that the harms associated with Meta’s platforms amounted to a public nuisance and ordered the company to fund measures aimed at mitigating those harms. Meta has said it disagrees with the ruling and intends to appeal. The order also requires Meta to implement significant protections for users under 18, including restrictions on adult-to-minor messaging and recommendations, limits on push notifications, removal of visible “like” counts for minors, restrictions involving nudity, and monthly usage limits across Instagram and Facebook.
The ruling reflects increasing U.S. scrutiny of platform design, recommendation systems, and safeguards governing minors’ interactions and exposure online.
9. California’s Delete Request and Opt-Out Platform (DROP) Becomes Operational
August 2, 2026 California, United States
California has entered a key implementation phase of the Delete Act, with registered data brokers now required to access the Delete Request and Opt-Out Platform (DROP) and begin processing consumer deletion requests submitted through the centralized platform.
Beginning August 1, data brokers must access DROP at least once every 45 days to retrieve new or updated deletion requests. They must search their records for matching consumers, delete applicable personal information, and report the status of each request through the platform. Where required, data brokers must also direct relevant service providers and contractors to delete personal information associated with the consumer’s request.
DROP significantly changes how deletion rights are operationalized in California by allowing consumers to submit a single request that can be transmitted to registered data brokers, rather than requiring consumers to approach each broker individually.
10. Illinois Enacts Children’s Social Media Safety Act
August 1, 2026 Illinois, United States
Illinois Governor JB Pritzker has signed the Children’s Social Media Safety Act, introducing new requirements governing how social media platforms interact with users under 18. The law is scheduled to take effect in 2028.
Under the Act, platforms must confirm users’ ages through device operating systems and apply enhanced protections to minors. Platforms will be prohibited from using a minor’s viewing history or information stored on their device to determine content displayed in their feeds, subject to permitted content such as searches, followed creators, and direct messages. The law also requires stronger privacy settings by default, including protections for minors’ precise geolocation, and restricts notifications between 10 p.m. and 7 a.m.
The Illinois Attorney General will enforce the law, with penalties of up to $2,500 per child for unintentional violations and $7,500 per child for intentional violations.
11. Latvia DPA Issues Guidance on Responding to Personal Data Breaches
August 19, 2026 Latvia
Latvia’s Data State Inspectorate (DVI) has issued guidance explaining how organizations and individuals should respond to personal data breaches and how the authority assesses reported incidents.
The DVI clarified that organizations must notify the authority of a personal data breach where it may pose a risk to individuals’ rights and freedoms. When assessing a notification, the DVI considers the circumstances and causes of the incident, the technical and organizational security measures in place, identified risks, and measures taken to prevent or mitigate the consequences. Importantly, the authority emphasized that the occurrence of a data breach does not automatically establish non-compliance with data protection requirements, as incidents may occur even where appropriate safeguards have been implemented.
For affected individuals, the DVI advised reviewing information provided by the organization and contacting the authority where they have new information relevant to its assessment of the incident.
12. Ghana Cyber Security Authority Fines EY Ghana for Unlicensed Cybersecurity Services
August 18, 2026 Ghana
Ghana’s Cyber Security Authority (CSA) has fined Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid Cybersecurity Service Provider (CSP) license, including services provided to owners of Critical Information Infrastructure.
The CSA imposed three administrative penalties totaling GH¢360,000 following EY Ghana’s failure to comply with regulatory directives requiring it to obtain the necessary license. The Authority also issued an immediate cease-and-desist order requiring the company to stop providing regulated cybersecurity services without a license, including Governance, Risk and Compliance (GRC) services.
The CSA further warned that it may take enforcement action against both unlicensed cybersecurity providers and organizations that engage them, emphasizing that cybersecurity licensing is a statutory requirement under Ghana’s Cybersecurity Act, 2020.
13. Apple Agrees to Modify App Tracking Consent Prompts Across the EU
August 15, 2026
Apple has agreed to modify its App Tracking Transparency (ATT) consent framework across the European Union following an investigation by Germany’s Federal Cartel Office into the treatment of third-party app developers.
Under binding commitments lasting seven years, Apple will more closely align the consent prompts displayed by third-party apps with those used for Apple’s own services. Changes include removing potentially discouraging wording and visual elements, providing developers with greater space to explain their use of data for personalized advertising, and allowing them to request consent annually. The commitments follow the German authority’s preliminary concerns that Apple’s existing framework applied different consent requirements to third-party apps compared with Apple’s own services, potentially restricting competition.
The action highlights increasing regulatory scrutiny of how consent interfaces are designed, particularly where platform operators control both the privacy architecture and compete with businesses subject to those controls.
14. German BfDI Calls for EU-Wide Solution to Reduce Cookie Banners
August 14, 2026 Germany
Germany’s Federal Commissioner for Data Protection and Freedom of Information (BfDI) has called for an EU-wide framework enabling users to centrally manage and communicate their cookie and privacy preferences through machine-readable signals.
The BfDI recommends addressing the issue through the EU Digital Omnibus process, allowing preferences to be stored through browsers, operating systems, or independent consent management services and communicated consistently across websites. The recommendations follow a BfDI survey indicating limited understanding of cookies and strong consumer interest in centralized preference management. Germany has already established a framework for recognized consent management services under its Consent Management Regulation.
The BfDI also emphasized that any European framework should enable consent management services to address GDPR-compliant consent for subsequent processing, including profile-based advertising, while avoiding unnecessary expansion to connected devices where there is no demonstrated need.
15. ICO Launches Data Protection Essentials Programme for Smaller Organizations
August 11, 2026 United Kingdom
The UK Information Commissioner’s Office (ICO) has launched Data Protection Essentials, a free online training and self-assessment programme designed to help small and medium-sized organizations and sole traders strengthen their data protection practices.
The self-paced programme provides practical guidance on everyday data protection activities, including securely managing records, sharing personal information, marketing and customer engagement, and reducing the risk of data breaches. It also includes sector-specific examples covering education and childcare, health and social care, professional services, retail, and property. Individuals completing the training receive a digital certificate, while organizations can undertake a separate self-assessment to identify areas for improvement. Organizations completing the assessment can receive a certificate and opt to join the ICO’s public Data Protection Essentials register.
The initiative reflects the ICO’s focus on providing practical compliance support to smaller organizations that may lack dedicated data protection expertise.
16. France Introduces Prior Consent Requirement for Telemarketing
August 11, 2026 France
France has introduced a new consent-based regime for telemarketing, generally prohibiting businesses from making unsolicited commercial calls unless consumers have provided prior consent.
Consent must be actively given, informed and revocable. Businesses must identify themselves, explain the purpose of the proposed calls and specify the consent period, which cannot exceed one year. Silence or pre-ticked boxes do not constitute valid consent, and businesses cannot call consumers solely to obtain consent for future telemarketing. Certain exceptions apply, including calls connected with an existing contract and newspaper or magazine subscriptions. Telemarketing concerning energy-efficient renovations, home adaptations and Personal Training Accounts remains prohibited, subject to limited circumstances where the consumer expressly requests contact.
Businesses must retain evidence of consent for three years, while violations may result in substantial financial penalties. The reform also replaces France’s previous Bloctel opt-out approach with a general opt-in model.
17. The French CNIL Publishes Guide On How To Manage Conflict Of Interest For DPOs
August 10, 2026 France
France's data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), has published its guide on how DPOs, as well as appointing organizations, should identify, manage, and resolve conflicts of interest.
The guide aims to alleviate some of the conflicts of interest that arise whenever a DPO’s functions undermine their independence. This includes roles with an inherently high risk of incompatibility, such as senior management positions like CEO or HR Manager, IT and security leads such as CISOs, staff and union representatives, and external consultants acting for both a data controller and its subcontractor. Hence, organizations are expected to evaluate these potential conflicts on a case-by-case basis prior to appointing a DPO or assigning new operational duties.
When a conflict of interest is identified, the organization must take remedial measures to restore compliance, such as either removing the conflicting operational duties from the DPO or replacing the officer entirely with a new candidate. Alternatively, an organization can implement a formal recusal procedure and appoint a deputy DPO to handle specific processing areas.
18. French CNIL Clarifies Right to Erasure for Online Press Articles
August 4, 2026 France
The French Data Protection Authority (CNIL) has issued guidance clarifying how individuals’ rights to erasure and objection apply to personal data contained in online press articles.
The CNIL emphasized that while certain GDPR rights are subject to exemptions for journalistic activities, the rights to erasure and objection remain applicable. However, these rights are not absolute and must be balanced against freedom of expression and information on a case-by-case basis. Media organizations receiving deletion requests should consider factors including the nature and age of the information, its current relevance and contribution to matters of public interest, the individual’s reputation, potential adverse consequences and the accessibility of the content online.
The CNIL further clarified that media outlets must provide specific justification when refusing a request rather than relying on general assertions of public interest. Where a request is accepted, the appropriate response will generally be to anonymize identifying information rather than delete the entire article.
19. Norwegian Financial Supervisory Authority Announced Additions To The Recent Financial Institutions Act In Norway
August 1, 2026
The Norwegian Financial Supervisory Authority has announced that the Finance Ministry has adopted new regulations on information sharing to strengthen overall efforts against fraud and identity theft.
These new changes are meant to supplement the recent amendments to the Financial Institutions Act, which allows financial institutions to share confidential information within set limits such as among financial institutions, the police, and other relevant entities, where necessary, to prevent or detect financial crime such as the Norwegian Tax Administration, the Norwegian Labor and Welfare Administration (NAV) and Brønnøysund Register Center, providers of electronic communication networks and services.
20. EDPB Raises Concerns Over Impact of US Supreme Court Ruling on EU-US Data Privacy Framework
August 1, 2026 European Union
The European Data Protection Board (EDPB) has asked the European Commission to assess whether the US Supreme Court’s decision in Trump v. Slaughter could affect the functioning of the EU-US Data Privacy Framework (DPF).
The Supreme Court ruling removed longstanding statutory protections limiting the US President’s ability to remove Federal Trade Commission (FTC) Commissioners, concluding that the FTC exercises executive power and must therefore remain subject to presidential control. The EDPB highlighted that the independence and effective functioning of supervisory authorities are key considerations when assessing whether a third country provides an adequate level of data protection under Article 45 GDPR. It noted that the EU’s existing US adequacy decision expressly references protections for the independence of FTC Commissioners.
The EDPB therefore called on the European Commission to closely assess the judgment’s potential implications for the DPF and continue sharing relevant developments with the Board.
21. South Korea PIPC Designates Specialized Personal Information Management Agency
August 28, 2026 South Korea
South Korea’s Personal Information Protection Commission (PIPC) has issued Notice No. 2026-109 designating Viva Republica Co., Ltd. as a specialized personal information management agency under the Personal Information Protection Act (PIPA).
The designation was made pursuant to Article 35-3(1) of PIPA and Article 42-12(1) of its Enforcement Decree and forms part of South Korea’s broader implementation of its personal data portability and MyData framework. Specialized personal information management agencies play a role in facilitating the exercise of individuals’ rights to transmit their personal information under the PIPA framework, supporting mechanisms through which individuals can manage and utilize personal data held by different organizations.
The designation reflects the PIPC’s continued operationalization of South Korea’s MyData ecosystem and its framework for enabling individuals to exercise greater control over the movement and use of their personal information.
22. South Korea PIPC Imposes Record Penalty on Public Agency Over Personal Data Breaches
August 27, 2026 South Korea
South Korea’s Personal Information Protection Commission (PIPC) has imposed fines and penalties totaling KRW 885.2 million on the National Center for the Rights of the Child following multiple personal data breaches affecting more than 1.17 million records.
The investigation found that storage media containing information relating to adoptees and missing children had been lost after being inadequately secured in office cabinets and drawers. The affected data included names, addresses, contact information, biological parent details and hundreds of thousands of resident registration numbers, some of which were stored without encryption. The PIPC also identified failures to notify affected individuals and report the breaches within the legally required timeframe, as well as inadequate oversight of contractor access credentials.
A separate system design error resulted in information belonging to 47 individuals being exposed to other users. The PIPC issued corrective measures and recommended strengthening the agency’s internal personal information management controls.
23. New Zealand Introduces Bill to Ban Under-16s from Social Media
August 24, 2026 New Zealand
The New Zealand Government has introduced the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill, proposing new obligations on social media platforms to protect children online.
Under the Bill, high-risk social media platforms would be required to take reasonable steps to verify that users are over 16. Permitted age-assurance methods could include existing account information, facial age estimation, digital identity services and formal identification. Platforms used by children would also be required to regularly assess risks to children and report on measures taken to identify and mitigate those risks. The proposed framework would extend to emerging technologies, including AI companion platforms.
An online safety regulator would be established within the Department of Internal Affairs to oversee compliance and enforcement. Companies failing to meet their obligations could face penalties of up to 10% of global revenue, while children, parents and caregivers would not face penalties.
The Bill signals New Zealand’s move toward platform-level accountability for age assurance and children’s online safety.
24. India’s Telecommunications (User Identification) Rules Come Into Effect
August 21, 2026 India
India has notified the Telecommunications (User Identification) Rules, 2026, introducing mandatory biometric identification requirements for users of covered telecommunications services.
The Rules establish two identification processes: e-KYC for users with Aadhaar numbers and D-KYC for users without Aadhaar. Telecommunications entities must implement the prescribed identification processes and maintain relevant subscriber records, while also meeting requirements relating to user assistance, complaints and acknowledgment of identification activities. Notably, the final Rules do not proceed with the previously proposed Biometric Identity Verification System (BIVS), which would have enabled biometric information to be matched across telecommunications providers and had attracted privacy concerns.
Covered entities have three months from August 21, 2026, to implement the requirements, with the possibility of an extension of up to three additional months. Failure to comply with the Rules constitutes a breach of the entity’s authorization conditions.
25. Australia eSafety Secures Enforceable Undertaking from Roblox Over Child Safety
August 20, 2026 Australia
Australia’s eSafety Commissioner has accepted a court-enforceable undertaking from Roblox requiring the platform to strengthen protections for children following concerns about its compliance with the Online Safety Act’s codes and standards.
eSafety identified gaps that allowed adults to contact children, made children’s connections and profile information publicly visible, and permitted interactions between adults and children on forums without parental or carer consent. Under the undertaking, Roblox has committed to preventing adults from contacting unknown children without parental consent, making children’s accounts private by default, strengthening complaint and reporting mechanisms, and notifying users of the outcomes of complaints. Roblox must also appoint an independent third-party auditor to assess the effectiveness of its safety measures, including its age-estimation mechanisms, the first time eSafety has required such third-party auditing under Australia’s Online Safety Act.
Roblox has three months to implement the measures, after which non-compliance with the undertaking may result in enforcement by the Federal Court.
26. South Korea Passes PIPA Amendment Enabling Personal Data Use for AI Development
August 20, 2026 South Korea
South Korea’s National Assembly has passed an amendment to the Personal Information Protection Act (PIPA) establishing special provisions for the use of personal information in AI technology development.
The amendment allows lawfully collected personal information to be used for AI development without relying solely on existing processing grounds where specified conditions are met. The special provisions apply where AI development is difficult using only pseudonymized or anonymized data, there is a recognized public interest and social necessity, enhanced safeguards are implemented, and the Personal Information Protection Commission (PIPC) approves the processing following deliberation. Additional safeguards apply where sensitive or unique identification information is involved and risks to individuals are significant, including advance risk assessments and mitigation measures. Organizations relying on the provisions must also disclose key information in their privacy policies.
The amendment will take effect six months after promulgation, following submission to and approval by the Cabinet.
27. Vietnam Issues Four Major Cybersecurity and Data Protection Decrees
August 19, 2026 Vietnam
Vietnam has issued four significant decrees implementing its cybersecurity and personal data protection framework.
Decree No. 327/2026/ND-CP expands obligations on digital service providers to prevent and address unlawful activity online, including requirements to preserve and provide electronic data, cooperate with cybersecurity authorities, and comply with content removal and platform restriction measures. Decree No. 331/2026/ND-CP establishes cybersecurity protection requirements for information systems, strengthening risk-based security and governance obligations across system operations. Decree No. 330/2026/ND-CP introduces a dedicated administrative sanctions framework for violations of Vietnam’s cybersecurity and personal data protection laws, including monetary penalties and additional corrective measures. Decree No. 333/2026/ND-CP further implements the Cybersecurity Law, setting out detailed responsibilities and measures applicable to organizations and service providers operating in cyberspace.
Together, the measures significantly strengthen Vietnam’s cybersecurity enforcement, data governance and platform accountability framework.
28. Vietnam Amends Electronic Identification and Authentication Rules
August 13, 2026 Vietnam
Vietnam has issued Decree No. 320/2026/ND-CP, amending its framework for electronic identification and authentication.
The Decree introduces a social security benefit account within Vietnam’s national identification application, allowing individuals to integrate payment accounts, e-wallets or mobile money accounts to receive social assistance, pensions and other lawful payments.
It also expands the use of integrated electronic identity information across administrative procedures, public services and other transactions. Where information or documents have already been integrated into the national identification application, organizations generally cannot require individuals to submit or present the corresponding original documents or copies.
The amendments further strengthen the integration and use of electronic identity accounts across Vietnam’s digital infrastructure while requiring electronic identity information to be handled in accordance with personal data protection and privacy requirements.
The Decree will take effect on September 28, 2026.
29. India’s Central Electricity Authority Releases New Cybersecurity Regulations for the Power Sector
August 12, 2026 India
India’s Central Electricity Authority (CEA) has published the Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026, establishing a comprehensive cybersecurity framework for entities operating critical power-sector infrastructure.
The Regulations apply to covered entities that own, operate or manage Operational Technology (OT) infrastructure associated with the interconnected power system and related Information Technology (IT) systems. Key requirements include appointing a dedicated Chief Information Security Officer (CISO), conducting cybersecurity audits, continuously monitoring critical systems, implementing incident-response measures and strengthening OT and supply-chain security. The framework also designates CSIRT-Power as the coordinating agency for cybersecurity incident reporting and response across the power sector.
The Regulations were officially notified on July 31, 2026, and will generally take effect on April 1, 2027, with certain provisions subject to separate commencement dates.
30. Singapore Introduces Bill to Strengthen Anti-Scam Enforcement
August 6, 2026 Singapore
Singapore’s Ministry of Home Affairs has introduced the Scams (Countermeasures) and Other Matters Bill in Parliament to strengthen the country’s ability to detect, disrupt and prevent scams.
The Bill proposes amendments to the Protection from Scams Act, Online Criminal Harms Act (OCHA) and other legislation. It would empower the police to issue Disclosure Orders requiring service providers to provide scam-related account information and Account Disabling Orders requiring specified accounts to be disabled for up to 30 days, extendable once. Police could also issue Service Limitation Orders, restricting identified individuals from accessing scam-enabling services for up to three years.
The Bill further strengthens OCHA enforcement by allowing authorities to issue directions using computer programs and introducing financial penalties of up to S$10 million per instance of non-compliance with applicable Codes of Practice or Implementation Directives.
The measures apply across financial institutions, telecommunications providers and designated online services.
31. Israel PPA Fines AD Karting for Failure to Provide Required Privacy Notice
August 5, 2026 Israel
Israel’s Privacy Protection Authority (PPA) has imposed a NIS 12,000 financial sanction on AD Karting for violating notice requirements under Israel’s Privacy Protection Law.
The PPA’s investigation found that the company collected personal information through an online customer registration form without providing the legally required notice at the point of collection. The form failed to adequately inform individuals about key aspects of the processing, including the purposes for which their personal information would be used, whether the information would be transferred to third parties, the identity and contact details of the database controller, and individuals’ rights to access and correct their information.
The enforcement action highlights the importance of providing transparent and complete privacy information directly when personal data is collected through online forms.
32. Japan Promulgates Amendments to the Act on the Protection of Personal Information
August 1, 2026 Japan
Japan’s Personal Information Protection Commission (PPC) announced the promulgation of amendments to the Act on the Protection of Personal Information (APPI) following their passage by the National Diet on July 10, 2026.
The amendments will generally take effect on a date specified by government ordinance within two years of promulgation, with certain provisions subject to different commencement arrangements.
Ahead of implementation, the PPC will develop the necessary government ordinances, Commission rules and guidelines to operationalize the amended framework.
WHAT'S NEXT: Key Privacy Developments to Watch For
Germany Meta Smart Glasses: Hamburg’s Data Protection Commissioner has raised the possibility of restrictions on Meta’s smart glasses over concerns that their recording indicator may not be sufficiently noticeable. Germany’s Federal Network Agency is considering the issue.
EU Sovereign AI Infrastructure: The European Commission is considering replacing AWS and Anthropic’s Claude in its AI-powered Job Matching Application with European sovereign cloud and AI alternatives.
Nigeria Unlawful Data Use Investigation: Nigeria’s Data Protection Commission is investigating the University of Lagos, Lotus Bank and Hackerbella over allegations that students’ personal data was used to open bank accounts without a lawful basis.
Pakistan National Data Governance Policy: Pakistan’s Digital Authority issued its draft National Data Governance Policy 2026, which aims to establish a government-wide framework for data classification, interoperability, secure data sharing and regulatory oversight.
Saudi Arabia PDPL Audit & Inspection Licensing: SDAIA is consulting on licensing standards for entities conducting personal-data audits and inspections, potentially introducing more standardized assessments of PDPL compliance.
Vietnam Draft Data Security Law: Vietnam is considering a new Data Security Law introducing four levels of data-security risk, lifecycle controls, risk assessments and tighter requirements for important and core data.
China Large-Scale Personal Information Processors: China’s CAC is consulting on new requirements for organizations processing personal information at a significant scale, including localization, privacy officers, audits, risk assessments and enhanced individual rights.
Philippines Updated PIA Rules: The National Privacy Commission is consulting on updated Privacy Impact Assessment guidelines, with proposed requirements targeting high-risk processing activities.
South Korea Cross-Border Privacy Certification: The PIPC has proposed updates to its cross-border privacy certification framework to align it with the Global CBPR system and amendments to PIPA.
US Personalized Pricing: The FTC is seeking feedback on a draft enforcement policy addressing undisclosed personalized pricing practices that use consumer data to determine individualized prices.
Vermont Age-Appropriate Design Code: Vermont is developing implementing rules for its Age-Appropriate Design Code ahead of the law taking effect on January 1, 2027.
Brazil Children’s Transparency Reports: Digital platforms with more than one million minor users must publish their first ECA Digital transparency report by September 17, 2026, making this an immediate compliance deadline to watch.
Following Veeam’s acquisition of Securiti, the launch of Agent Commander marks an important step toward helping enterprises adopt AI agents with greater confidence. In...
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
Picture this: a fictional but entirely plausible scenario. An Australian financial institution's AI systems spend six months accessing a customer data repository nobody has...
Hidden cloud storage costs add up fast. Learn how redundant, obsolete, and trivial data drives unnecessary spend, expands risk, and why automated data minimization...
Learn how to prepare enterprise data for safe Gemini Enterprise adoption with upstream governance, sensitive data discovery, and pre-index policy controls.
Securiti's eBook is a practical guide to HITRUST certification, covering everything from choosing i1 vs r2 and scope systems to managing CAPs & planning...