Date: October 20, 2026 I Country: Canada
October 20, 2026
Canada
The Office of the Privacy Commissioner of Canada (OPC) published its Children’s Privacy Code, outlining expectations under the Personal Information Protection and Electronic Documents Act (PIPEDA) for online services directed at, or likely to be accessed by, children under 18. It addresses meaningful consent, high-privacy defaults, data minimization and protections against harmful profiling and deceptive design. The Code interprets existing obligations and provides recommendations; it does not amend legislation. Comments are open until January 20, 2027.
Organizations serving children should assess consent processes, default settings and data practices against the regulator’s expectations.
October 19, 2026
California, United States
California Attorney General Rob Bonta announced a proposed $6.01 million settlement with Chrome Holding Co., formerly 23andMe, addressing alleged security failures and misleading representations regarding its 2023 data breach, as well as a bankruptcy dispute over the transfer of genetic data without separate, explicit consent under the California Genetic Information Privacy Act (GIPA). Subject to court approval, the agreement would impose five-year restrictions on the debtor entities’ direct consumer sales and handling of personally identifiable information, with specified exceptions.
Organizations handling genetic data should assess security safeguards and consent requirements before transferring sensitive information, including during bankruptcy.
October 19, 2026
California, United States
New Mexico’s First Judicial District Court ordered Meta Platforms, Inc. to pay $25 billion in civil penalties following jury findings of 43,899,725 willful violations of the New Mexico Unfair Practices Act (UPA). This comes after Meta was accused of misleading representatives, including users’ control over personal information, third-party data access, and investigations following the Cambridge Analytica revelations. The Court reduced a calculated statutory-maximum penalty of approximately $219.5 billion to $25 billion and imposed 15% annual interest until paid in full.
The Order highlights New Mexico’s efforts towards the implementation of UPA. Companies that come under the scope of the law must review their policies to ensure timely compliance.
October 16, 2026
Pennsylvania and New York, United States
On October 8, the United States Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $140,000 settlement with Pennsylvania dental practice Shen Smiles over potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule involving inadequate policies and patient-record safeguards.
On October 16, the New York and Connecticut attorneys general announced a settlement described as $2.7 million with Boston Children’s Health Physicians and XTIUM following a 2024 breach affecting approximately 888,000 residents across both states. That agreement resolves agency findings of state-law and HIPAA security violations and requires stronger safeguards and vendor oversight; the companies neither admit nor deny the findings.
These settlements highlight continued action by United States federal and state regulators on healthcare privacy and data security, reinforcing the importance of effective safeguards, privacy procedures and vendor oversight, as both patient complaints and data breaches can trigger enforcement.
Read More on HHS Settlement and New York AG’s Settlement.
October 14, 2026
Florida and Georgia, United States
The United States Court of Appeals for the Eleventh Circuit reversed a preliminary injunction against Florida House Bill 3 and Georgia Senate Bill 351. Florida House Bill 3 prohibits covered platforms from allowing accounts for children under 14 and requires parental consent for users aged 14 and 15. Additionally, Georgia Senate Bill 351 covered age verification, parental consent for users under 16 and restrictions on personal-data-based advertising to those users. The Georgia case was remanded without deciding the substantive First Amendment merits. Neither ruling represents a final resolution of the underlying litigation.
Covered platforms should reassess state-specific age-verification, parental-consent and advertising requirements while monitoring further proceedings to avoid hefty penalties.
Read More on Florida HB 3, Georgia SB 351.
October 8, 2026
Canada
The OPC has updated its PIPEDA guidance related to recording customer calls, clarifying that organizations must disclose recording purposes and obtain meaningful consent. The guidance also clarifies that voiceprints used for authentication constitute sensitive biometric information, for which express consent may be required. Organizations subject to PIPEDA must provide alternatives where recording is not integral to the service, subject to statutory exceptions, and address access rights, safeguards, limited retention and third-party compliance.
Organizations recording customer calls should review consent notices, alternatives to recording and voiceprint safeguards, including how third-party providers handle recordings.
October 1, 2026
British Columbia, Canada
The Office of the Information and Privacy Commissioner (OIPC) found that the Restorative Justice Association of British Columbia missed the statutory deadline for responding to a personal-information access request, contrary to Section 29(1) of the Personal Information Protection Act (PIPA). It ordered the Association to respond by October 15, 2026, in accordance with statutory assistance and response requirements.
Organizations should maintain clear responsibility and handover procedures for access requests to prevent missed deadlines during personnel changes.
October 1, 2026
California, United States
California enacted Senate Bill 690, amending California Penal Code §637.2 to reserve the right to Attorney General to bring lawsuits under that section against private actors for alleged website- or application-related pen-register and trap-and-trace violations. The restriction extends to pending claims in actions commenced within two years before the law’s operative date. It does not repeal the underlying prohibition or eliminate private claims under other provisions of the California Invasion of Privacy Act (CIPA).
Businesses should reassess exposure to tracking-related litigation without treating the amendment as permission to use otherwise unlawful tracking technologies.
October 1, 2026
California, United States
Governor Gavin Newsom signed Senate Bill 354, revising California’s Insurance Information and Privacy Protection Act to strengthen protections for personal information collected, used and shared in insurance transactions. The framework expands privacy notices, consumer rights and data-handling requirements. Implementation begins July 1, 2028, with later deadlines for specified producer obligations and records-retention and deletion policies.
Insurers and affected intermediaries should assess privacy-process changes against the phased deadlines rather than treating July 2028 as a single compliance date.
October 1, 2026
California, United States
California enacted Assembly Bill 883, reducing data brokers’ required intervals for accessing the Delete Request and Opt-Out Platform (DROP) and processing deletion requests from 45 to 30 days. The law also requires specified public bodies to notify elected officials and judges about their deletion rights and adds enforcement protections for these individuals.
California is strengthening data-broker accountability through faster deletion requirements. Covered brokers must review processing timelines, while businesses using broker-sourced data should assess supplier compliance.
October 1, 2026
California, United States
California enacted Assembly Bill 2561, prohibiting operating systems and applications from reversing privacy settings affirmatively selected by users without their consent, subject to specified exceptions. The law strengthens protection for users’ choices concerning how their personal information is processed.
Software providers should assess whether updates or other product changes override users’ preferences without consent.
October 19, 2026
Germany
The BSI has published consumer guidance to help parents protect children from the risks of smartwatches, following its security study of three children’s smartwatches and their companion apps. The guidance sets out questions parents should ask before buying a watch. These include how long the manufacturer guarantees security updates, whether location tracking can be controlled, and whether parents can restrict calls and messages to approved contacts so that strangers cannot reach the child.
October 19, 2026
Netherlands
The ACM has published guidance clarifying the Data Act rules on switching between cloud services, so that customers can move to another provider quickly, easily and, from January 12, 2027, without switching charges. The guidance groups providers’ obligations into four themes. Providers must not obstruct switching or parallel use of another provider, must give customers clear information about switching in advance, and must provide technical support. They must also put safeguards in place against unlawful access by non-EU governments to non-personal data.
October 16, 2026
France
The CNIL has published guidance on how the GDPR applies to email addresses reconstructed from publicly available data. Reconstructing business email addresses involves inferring or "guessing" the email address from information available online, such as a person's first and last name and the identity of the organization that employs them (e.g., [email protected]).
The CNIL has recommended that organizations ensure this practice does not disproportionately harm data subjects' rights and interests. To do this, they must examine, based on the context, whether individuals can reasonably expect their data to be used in this way and what measures can be taken to limit the impact of the processing.
October 13, 2026
EU
The EDPB has adopted a statement providing preliminary guidance on the data protection challenges posed by smart glasses. It identifies transparency toward bystanders as a key challenge and recommends clear recording signals, such as visible LED lights or audio cues. The statement notes that users may themselves be controllers, for example when sharing recordings publicly. Manufacturers and providers of linked services cannot shift their transparency obligations onto users.
October 13, 2026
Poland
The Polish Council of Ministers has adopted the draft Law on Fair Access to and Use of Data, prepared by the Ministry of Digital Affairs, which now goes to Parliament. The bill designates the President of the Office of Electronic Communications (UKE) as the authority responsible for enforcing the EU Data Act, as well as the data coordinator. The UKE will be able to handle complaints, conduct proceedings and impose fines. It will also oversee the Data Act’s phase-out of cloud switching charges, which ends on January 12, 2027, and handle public-sector requests for privately held data in exceptional situations such as emergencies.
October 10, 2026
Turkey
Turkey has published a regulation barring social network providers from offering services to children under 15. The regulation was prepared by the Cybersecurity Presidency. Providers must verify users’ ages through an age-verification token issued via the e-Government portal. Accounts of users aged 15 to 17 must be private by default, and infinite scrolling is not allowed for them. Users can object to account closures and age-verification decisions. The regulation takes effect for new accounts on November 1, 2026, and existing accounts must be verified by March 31, 2027.
October 8, 2026
Turkey
The KVKK has published a principle decision setting out how employers may monitor corporate email accounts and other workplace communication channels, including internal messaging apps and meeting platforms. Owning the equipment or having technical access does not give employers unlimited power to monitor employee communications. Content should be reviewed only where there is a concrete suspicion or a specific incident. Generic notices that “corporate email may be monitored” do not satisfy the duty to inform employees, and employee consent should not generally be the primary legal basis. Non-compliance may lead to investigations and administrative sanctions under Law No. 6698 on the Protection of Personal Data.
October 8, 2026
Denmark
The Digitaliseringsstyrelsen has launched two online guides to help companies navigate EU digital regulation. The Legislation Guide helps companies identify the rules that apply to them on AI, data protection, cybersecurity, digital markets, digital services and financial digital resilience. The Guide to the EU Data Act explains obligations for connected products (IoT devices), including how the data they generate must be accessed, shared and protected.
October 2, 2026
Sweden
The PTS has adopted regulations defining what constitutes a significant incident for telecommunications operators under Sweden’s Cybersecurity Act. An incident is significant and triggers mandatory reporting if it has caused or may cause serious operational disruption, financial damage, or significant harm to other individuals or organizations.
October 1, 2026
Mozambique
The Cybersecurity Law (Law No. 13/2026) and the Cybercrime Law (Law No. 14/2026) came into effect in Mozambique on September 29, 2026. The Cybersecurity Law establishes a national cybersecurity system and imposes obligations on public and private entities covering cyber risk management, network and information system security, incident detection and response, and cooperation with the authorities. The Cybercrime Law creates criminal offenses and procedural rules for investigating cybercrimes and collecting electronic evidence, including mechanisms for international cooperation.
October 1, 2026
Sweden
New regulations on security measures and management training under Sweden’s Cybersecurity Act entered into force on October 1, 2026. Operators must take a risk-based approach to cybersecurity, assessing risks and implementing proportionate security measures that meet a set minimum level. The regulations also clarify management’s responsibility for cybersecurity and require management to undergo training. Responsibility for the regulations now lies with the National Cyber Security Centre (NCSC), which plans to publish detailed guidance around the turn of 2026/2027.
October 1, 2026
Estonia
On October 1, 2026, the Estonian government approved legislative amendments to implement the EU Digital Identity Wallet (Digikukkur), a mobile app that lets people identify themselves, sign documents and share e-certificates across the EU. The wallet will complement existing eID tools, with the Information System Authority (RIA) appointed as the competent authority and relying parties required to register and request only specified data. Public launch is planned for 2028, and the amendments now move to the Riigikogu (parliament of Estonia).
October 1, 2026
Latvia
The Latvian Cabinet has adopted Regulation No. 602 on information system placement and data center security requirements. The regulation sets rules for placing the information systems of entities covered by the National Cybersecurity Law in data centers, sets security requirements for data centers, establishes the procedure for assessing and supervising data center compliance, and governs the establishment of Security Operations Centers (SOCs).
October 1, 2026
Sweden
The Swedish Post and Telecom Authority (PTS) has set fees under the Cybersecurity Act (CSL) for 2026, totaling SEK 12M to fund its CSL supervision. The fees apply to operators notified under the CSL that provide public electronic communications networks or services and have an annual turnover above SEK 30M, capped at 0.0166% of turnover. Number-independent interpersonal communication services are exempt for 2026.
October 1, 2026
United Kingdom
TikTok has withdrawn its appeal against the £12.7M fine imposed by the UK ICO in 2023, making the penalty final. The ICO found that TikTok failed to prevent children under 13 from using its platform, did not obtain parental consent and failed to process their personal data lawfully. The withdrawal follows the Upper Tribunal’s August ruling rejecting TikTok’s argument that its processing was for artistic purposes. TikTok has also dropped its appeal against an ICO information notice, allowing a separate investigation into how its recommender systems use the personal data of 13-to-17-year-olds to proceed.
October 1, 2026
Spain
The Agencia Española de Protección de Datos (AEPD) has analyzed the data protection risks associated with EUDI wallets, including the risk that relying parties or other third parties could link transactions and infer information about wallet users without any direct disclosure. The AEPD recommends data protection by design and by default, including local storage, encryption and selective disclosure.
October 20, 2026
China
The Cyberspace Administration of China (CAC) has officially initiated the recognition process for online platforms with significant influence on minors, enforcing measures that took effect on April 1, 2026. Under the new guidelines, platforms meeting specific thresholds, such as having over 10 million registered minor users or 1 million monthly active minor users, are required to complete the identification procedure. Platform providers must submit a comprehensive application package, including a self-assessment report, a recognition application form, and supporting documentation, within 20 working days. Providers hold full responsibility for the completeness and authenticity of their submissions, and online platforms must closely review their user data and application materials to ensure full compliance with CAC requirements and avoid regulatory penalties for inaccurate filings.
October 15, 2026
China
The MIIT in China has released the sixth batch of 2026 notifications targeting APPs and SDKs that infringe on users’ personal data rights. The announcement is part of a joint special action campaign with the Central Cyberspace Information Office and the Ministry of Public Security, enforcing laws including the Personal Information Protection Law and the Network Security Law. Consequently, the MIIT has directed the listed entities to rectify their compliance issues immediately, warning that non-compliant platforms will face strict legal and regulatory enforcement actions.
October 14, 2026
Singapore
Singapore’s CSA has issued new quantum-safe migration guidance addressing the long-term threat posed by quantum computing to current cryptographic standards. Along with this guidance, the CSA has published an advisory urging non-CII entities to establish migration plans by 2027, complemented by an updated Quantum Readiness Index and Quantum-Safe Handbook, and has launched the Quantum-Safe Kickstarter Grant. Priority for this grant will be given to CII owners and projects that demonstrate high strategic impact on Singapore's overall cybersecurity resilience.
October 13, 2026
Vietnam
Vietnam has issued its Cybersecurity Assurance Index under Decision No. 1964/QD-TTg, signed by Deputy Prime Minister Pham Gia Tuc. Meant to standardize cybersecurity governance across state agencies, the index focuses on piloting, evaluating, and refining the index structure, which organizes its 29 sub-criteria into three distinct categories: General Evaluation Criteria (focusing on system safety levels and assurance plans), Specific Evaluation Criteria (comprising 18 operational technical requirements including asset management, access controls, incident response, and vendor security), and Guidance and Management Criteria (nine quantitative performance metrics tracking incident response speed, data leaks, and financial losses).
October 12, 2026
Vietnam
The Vietnamese government has now mandated that electronic transaction accounts across 11 key sectors must complete linking and verification with the VNeID electronic identity system no later than December 31, 2026. Additionally, the regulation also requires accounts serving defense, security, and cross-border digital platforms to verify with VNeID prior to use, provided the platforms meet eligibility criteria.
October 7, 2026
Japan
PPC has issued a warning related to response measures for large-scale data leaks, setting out revised technical safety management expectations for entities handling personal information. The guidance is targeted at business operators processing large volumes of personal data. Per the framework, this applies to entities handling sensitive, financial, or fraud-vulnerable data. Under the framework, operators must adhere to five key technical safety obligations: access control, user identification and authentication, prevention of unauthorized external access, prevention of leaks during system usage (including path/content encryption and secure cloud data disposal), and detection/containment of unauthorized access through log analysis and real-time monitoring.
October 7, 2026
Australia
The OAIC has published a blog by Privacy Commissioner Carly Kind highlighting the privacy compliance obligations and regulatory scrutiny surrounding surveillance wearables and smart glasses. It includes various details related to the preliminary inquiries launched in August 2026 into five hardware and software entities (including Meta, Google, Kmart, and BDI Technology). The OAIC clarified key application principles under the Privacy Act, emphasizing that compliance obligations fall on software entities holding personal information rather than hardware sellers.
October 5, 2026
Saudi Arabia
The SDAIA has opened registration for the Personal Data Protection Track within the Data Regulatory Sandbox. The move aims to facilitate compliance with the Kingdom’s Personal Data Protection Law and its Implementing Regulations through the National Data Governance Platform. All eligible entities must be registered in the National Personal Data Protection Register and submit their applications via the National Data Governance Platform to participate.
October 5, 2026
India
MeitY has published the Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E)) in the Gazette of India on October 6, 2026. The Order makes two narrow, editorial corrections that take effect immediately upon publication. First, Section 9(1), which governs verifiable parental or guardian consent for processing children's data, is amended to read "child or of a person with disability." The second, Section 10(2)(c)(ii) is amended so that "audit" becomes "data audit”.
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
[email protected]
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
