A quick overview of global privacy headlines you cannot afford to miss.
September 27, 2026
California, United States
California Governor Gavin Newsom signed SB 923 (Expanding Privacy Rights Act), broadening consumers’ ability to have their personal information deleted under the California Consumer Privacy Act (CCPA).
Beginning January 1, 2027, consumers may request the deletion of personal information collected from or about them, including data obtained from third parties. Existing exceptions, such as information needed to meet legal obligations, maintain security or fulfill qualifying contractual requirements, will continue to apply.
Businesses may retain a limited suppression record containing only what is necessary to honor the request, thereby preventing deleted information from being restored through later data purchases. However, that information cannot be used for unrelated purposes.
The law further updates the requirements for submitting requests. Businesses operating exclusively online and maintaining a direct relationship with consumers must offer an online method, such as a web form or privacy portal, along with an email address for access, deletion and correction requests.
With the updated deletion right, businesses should review their compliance with the applicable requirements before the effective date of the law, i.e., 1 January, 2027.
September 24, 2026
United States
A coalition of 44 State Attorneys General, led by Attorney General Tong, has reached a $2.3 million settlement with Laboratory Corporation of America (Labcorp). The settlement is regarding the data breach that occurred in 2019 data breach involving Labcorp’s debt-collection vendor, American Medical Collection Agency (AMCA).
The incident potentially affected 27.5 million people, including 10.2 million Labcorp patients. Under the settlement, Labcorp has been asked to strengthen its vendor-risk management program by assigning a dedicated team, assessing vendors, verifying compliance and limiting unnecessary data sharing.
The case highlights the responsibility of the HIPAA-covered entities to protect patient information, including data handled by third-party vendors.
September 10, 2026
California, United States
California has enacted Assembly Bill 2246, Assembly Bill 1856 and Assembly Bill 1709, strengthening privacy and online safety protections for children.
AB 2246 requires covered online services likely to be accessed by children to adopt high privacy defaults, provide age-appropriate notices and tools, and limit profiling, precise geolocation, unnecessary data collection and manipulative design. AB 1856 creates an age-signal framework for operating systems, app stores and developers, using four age brackets, i.e., under 13, 13–15, 16–17 and 18 or older. AB 1709 targets platforms offering addictive features, restricting addictive feeds and autoplay for users under 16. It also requires age assurance, preventive measures and, in some circumstances, deletion of minors’ accounts and associated data.
The laws reflect California’s broader shift toward stronger privacy, safety and age-assurance protections for children and minors. Companies should closely monitor legislative and regulatory developments in this rapidly evolving area. Read More. on AB 2246, AB 1856, and AB 1709
September 10, 2026
United States
The New York State Department of Financial Services (NYDFS) has released guidance for covered financial services organizations, clarifying how to ensure compliance with cybersecurity risk-assessment requirements under 23 NYCRR Part 500.
The covered financial entities must maintain documented assessments of cyber risks and existing controls, using the results to guide mitigation, risk acceptance and their wider cybersecurity programs. Assessments should be reviewed at least annually and updated after material business or technology changes, such as system migrations or major technology deployments. The guidance does not create new obligations or deadlines but recommends considering cloud and vendor dependencies, concentration risk, emerging threats and AI-related risks.
The guidance does not create new obligations or deadlines, but covered entities must review their compliance with applicable requirements to avoid penalties.
September 2, 2026
California, United States
Delaware Governor Matt Meyer signed HB 381, amending the state’s computer security breach law. The law clarifies businesses’ obligation to notify the Attorney General of any breach. If an organization cannot determine within 60 days, despite reasonable diligence, which Delaware residents’ personal information was involved in a breach, it must notify the Attorney General within that original 60-day period instead of waiting for its investigation to conclude.
The amendment further adds Attorney General reporting to Delaware’s substitute-notice process and narrows the compliance safe harbor for entities subject to sector-specific rules, including certain organizations regulated under HIPAA or the Gramm-Leach-Bliley Act. The existing requirement to notify the Attorney General when more than 500 Delaware residents must be notified remains in place.
With the law taking effect immediately, organizations that hold Delaware residents’ personal information should update their incident-response procedures to ensure compliance with the law.
September 2, 2026
Delaware, United States
HB 380, which significantly expands the Delaware Personal Data Privacy Act (DPDPA), was signed into law by Delaware Governor Matt Meyer.
The law’s applicability thresholds have been lowered, bringing more businesses within scope and narrowing the entity-level exemption. The amendment further broadens the definition of sensitive data, strengthens consent and data minimization requirements, and introduces additional protections relating to minors, profiling and automated decisions with legal or similarly significant effects. Organizations that disclose personal data to third parties are subject to new obligations, while giving consumers more visibility into which third parties receive their information.
With the amendment set to take effect on January 1, 2027, the organizations handling Delaware residents’ data should reassess their compliance with DPDPA before 2027.
September 1, 2026
California, United States
The California Privacy Protection Agency (CalPrivacy) ordered Virginia-based SalesIntel Research, Inc. to pay a $36,400 fine for failure to register on time with California’s Data Broker Registry. SalesIntel sells access to professional contact details, mobile phone numbers and career-related inferences used for targeted advertising.
Along with the fine, SalesIntel must publish metrics concerning consumer privacy requests on its website, access California’s Delete Request and Opt-out Platform (DROP) and process future deletion requests submitted through the platform. Under California’s Delete Act, qualifying data brokers must register with the agency every January and pay the applicable registration fee.
The action forms part of CalPrivacy’s broader enforcement campaign against unregistered data brokers. Businesses must assess whether they qualify as data brokers, complete registration on time and prepare to process consumer deletion requests through DROP.
September 22, 2026
Turkey
The Turkish Personal Data Protection Authority (KVKK) has published the implementation guide addressing lawyers' professional activities under Law No. 6698 on the Protection of Personal Data. The guide includes the qualifications of lawyers, detained lawyers, lawyer employees, and relevant persons within the scope of Law No. 6698, the legal bases of personal data processing activities carried out by lawyers, the conditions of processing personal data, the use of productive artificial intelligence tools, general principles, data controller's obligations, and data security issues.
September 22, 2026
Sweden
The Swedish Authority for Privacy Protection (IMY) has fined Miljödata SEK 1.8M for inadequate security measures. This comes after Miljödata fell victim to a ransomware attack, during which the affected data was published on the dark web and included 870k unique email addresses across various compromised files. The data also included names, phone numbers, physical addresses, dates of birth, and government-issued personal identity numbers. Miljödata faces a SEK 1.8 million fine due to its failure to implement appropriate security measures in accordance with GDPR requirements.
September 21, 2026
Ireland
The Irish Data Protection Commission (DPC) has fined Google €403M over its handling of location data. This comes after several complaints from European consumer rights organizations that led to a DPC investigation. The scope of the Inquiry concerned Google’s processing of location data in three specific features, “Web & App Activity”, “Location History,” and “Location Accuracy” between the date of application of the GDPR, 25 May 2018 to 4 February 2020. This investigation found that each feature resulted in separate violations, with Web & App Activity and Location History practices allegedly breaching the lawfulness and fairness principles. In contrast, Location Accuracy breached accountability obligations under the GDPR, and retention of location data in Web & App Activity and Location History also infringed the GDPR principles.
September 21, 2026
The European Data Protection Board (EDPB) has adopted guidelines for data protection authorities (DPAs) for imposing fines under the General Data Protection Regulation (GDPR). These new guidelines include a five-step methodology for member state DPAs to consider when imposing an administrative fine. This includes checking whether the infringement can lead to a fine under the GDPR or national law; determining whether the party may be fined for the infringement; whether the infringement has been committed intentionally or negligently; any aggravating and mitigating factors; and whether imposing an administrative fine would be effective, proportionate, and dissuasive.
The EDPB also adopted the final version of its guidelines on the interplay between the DSA and the GDPR, which support the consistent application of both legal acts, particularly where DSA provisions concern the processing of personal data by intermediary service providers and refer to concepts and definitions laid down in the GDPR.
September 17, 2026
The European Commission has released the EU KIDS Act proposal. The proposed regulation imposes a blanket ban on children under age 13 from creating social media accounts and also includes requirements for implementing "privacy-preserving" age-assurance tools. As part of the proposal, children ages 13 and 14 will be allowed to create limited social media accounts that can be accessed only through a parent or guardian's own account. Platforms may demonstrate compliance by integrating with the European Commission's open-source EU Age Verification Solution, which is expected to be released by the end of the year.
September 11, 2026
Italy
Agenzia Regionale per il lavoro dell’Emilia Romagna, an employment agency, has been fined €30,000 for publishing applicants' personal data. Applicants registered with the employment agency to apply for a job. The Garante clarified that transparency rules requiring publication of final rankings apply only to public recruitment competitions, not to selections from employment placement lists, where appearing on the list could reveal sensitive information such as disability or economic hardship. The agency had no legal basis for the publication and should have anonymized the data instead.
September 11, 2026
Italy
Garante has fined ASIS €8,000 for using video surveillance in the changing rooms. Moreover, Garante identified the information provided to users regarding the activation of the video surveillance system as inadequate to enable them to know exactly what the system was recording and for how long. The authority also contested the retention of the images for 72 hours, which was not supported by a specific assessment demonstrating its necessity. ASIS removed the cameras and complied with data protection requirements.
September 11, 2026
Italy
ASUFC has been fined €24,000 by the Italian Data Protection Authority (Garante) for inadequate access controls over health records, allowing staff to freely view their colleagues' health status via the company's health report, despite the system not being configured to prevent it. This comes after a complaint from a hospital employee who was also a patient. ASUFC failed to restrict access to health records and implement adequate security measures. ASUFC must implement technical and organizational measures within 60 days and report on them within 90 days.
September 11, 2026
Latvia
The Latvian Datu Valsts Inspekcija (DVI) has clarified conditions for disclosing personal data of missing persons to third parties. For missing persons, relatives need to deal with various practical issues (bill payments, loan payments, property management, etc.). Before handing over the information, data controllers must verify the requester's identity, confirm the missing status, and receive a relationship declaration. Disclosure is based on legitimate interests under Article 6(1)(f) of GDPR. Only the necessary information should be disclosed to settle obligations.
September 10, 2026
Ireland
The Irish National Cyber Security Centre (NCSC) has published guidelines to help manufacturers comply with the Cyber Resilience Act's (CRA) new reporting obligations. These guidelines provide practical information on reporting thresholds, timelines, notification procedures, and the specific information required when submitting reports.
As of September 11, 2026, manufacturers must report certain events. Specifically, manufacturers who become aware of an actively exploited vulnerability or a severe incident impacting a product's security must report the information through the CRA Single Reporting Platform, provide an initial notification within 24 hours of becoming aware of the event, and, where required, submit additional incident details in line with the CRA's requirements.
September 10, 2026
France
France’s Commission Nationale de l'Informatique et des Libertés (CNIL) has released guidance on data protection for electronic invoicing, emphasizing General Data Protection Regulation (GDPR) compliance and robust security measures. Per this guidance, the company that issues or receives the invoices is considered the data controller. The approved platform that facilitates the transmission acts as a data processor. As a processor, the platform must adhere to specific security and confidentiality obligations and may reuse data only for its own purposes, provided it is compatible with the initial processing and authorized in writing by the data controller.
Moreover, any approved platforms must ensure a high level of data security, including ISO 27001 certification and, where applicable, qualification by the National Cybersecurity Agency of France (ANSSI) under the SecNumCloud standard. The platforms are also required to implement robust user identification and authentication mechanisms, eventually reaching a 'substantial' level of assurance under the eIDAS Regulation. In the interim, two-factor authentication (2FA) is permitted.
September 10, 2026
Germany
Hamburg's Commissioner for Data Protection and Freedom of Information released a technical and data protection audit report on Meta's AI smart glasses. The report states that Meta would not be able to provide a legal basis for training AI using footage from users’ glasses, as an individual's use of smart glasses would not be legal outside of use in the proximity of one's close friends and family. In contrast, general public use may be permissible under the exception of "rare cases" of legitimate interest.
September 8, 2026
Kenya
The Office of the Data Protection Commissioner issued new guidance for organizations conducting international data transfers in Kenya. The guidance aims to assist data controllers and processors to understand their obligations under the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021. Many of its features will be familiar to organizations used to the EU GDPR, including its approach to adequacy, appropriate safeguards, Binding Corporate Rules (BCRs), assessments of third-country laws and supplementary safeguards. However, the guidance also highlights key differences from the GDPR, particularly regarding sensitive personal data, data localization, legitimate interests and onward transfers, which multinational organizations relying on global transfer frameworks will need to consider.
September 5, 2026
Spain
The Spanish Data Protection Agency (AEPD) has issued a report on the draft law for a digital working hours registry that emphasizes a detailed DPIA, stringent security requirements, and a precise scope of data collection.
Among other things, the report notes that the new draft improves on the previous version by setting out essential security requirements. The AEPD welcomes the mandate that systems must ensure data is secure, integral, traceable, and unalterable, which aligns with Article 32 of the General Data Protection Regulation (GDPR). The report also positively assesses new rules for third-party system providers that limit their access and require security measures such as encryption and contractual clauses, aligning with data protection by design principles under Article 25 of the GDPR.
Additionally, the report positively notes a clarification that rules on the physical location of registry devices only apply to in-person work, accommodating remote work arrangements. The AEPD remains concerned about the lack of technical justification for how the system will limit access to ensure employees can only make entries for their own workday.
September 3, 2026
Netherlands
The Dutch Data Protection Authority (DPA) has released customizable, ready-made templates for processing registers and privacy statements for SMEs, developed after consultations with MKB-Nederland and the Ministry of Economic Affairs and Climate Policy. These documents feature sample tables tailored across 10 major sectors, including retail, healthcare, IT, and construction, allowing business owners to simply delete irrelevant entries and input their specific data.
The processing register template assists companies in tracking collected personal data, making it easier to navigate processor agreements, fulfill customer privacy requests, and respond rapidly to potential data breaches. Meanwhile, the privacy statement template provides a clear framework to explain data practices transparently, helping businesses meet legal requirements while building customer trust.
September 1, 2026
Denmark
The Danish Financial Supervisory Authority (Finanstilsynet) has published a press release on AI-driven cyberattacks, stating that advanced AI models are rapidly changing the cyber threat landscape for the financial sector by enabling malicious actors to exploit information technology vulnerabilities on a greater scale and at greater speed.
Its recommendations in this press release include encouraging financial companies to create an overview of how AI and frontier AI models are used internally and the associated risks, continuously evaluate how advanced AI impacts the company's specific threat profile, assign clear responsibility for AI risks to the board of directors and executive management, ensure effective processes for monitoring vulnerabilities and managing security updates, update contingency and recovery plans to account for AI-driven scenarios and test these plans, secure access to necessary expertise in AI and cybersecurity, share knowledge and experiences regarding AI risks both internally and with other sector participants.
September 1, 2026
Netherlands
The Dutch Data Protection Authority (AP) will now be required to publish GDPR sanctions to improve compliance and legal certainty.
The AP has been advocating for this amendment to the GDPR Implementation Act (UAVG) for several years. Previously, the authority imposed sanctions under its internal policy, but the new legal requirement aims to enhance legal certainty and protection.
Before publishing, the AP will notify the organization, which will have an opportunity to respond. A sanction will not be published earlier than 10 working days after the organization receives the publication decision, unless the organization has already disclosed it or objects. Organizations have the right to object to the sanction and its publication and can seek a court order to prevent it.
September 1, 2026
The European Commission has designated OpenAI's ChatGPT as a very large online search engine (VLOSE) under the EU Digital Services Act. At the same time, Reddit and Roblox are now very large online platforms (VLOPs) after they surpassed the 45 million average monthly users threshold.
Following this notification, these platforms now have four months, i.e., by January 2027, to comply with the additional DSA obligations for VLOPs and VLOSEs, such as assessing and mitigating the systemic risks stemming from their service and algorithmic systems related to the dissemination of illegal content, the negative effects on minors, users' physical and mental well-being, fundamental rights, electoral processes and public security.
Additionally, with this new designation, the Commission now has the authority to assess the functionality of these services and, where applicable, any related systems. The Commission will be competent to supervise compliance with the DSA, in cooperation with Coimisiún na Meán for ChatGPT and Reddit, and the Authority for Consumers and Markets (ACM) for Roblox. These entities serve as the Digital Services Coordinators respectively for Ireland and for the Netherlands, where the designated services are established.
September 1, 2026
Sweden
Sweden’s Authority for Privacy Protection (IMY) launched an app to help individuals ages 10-15 learn how to protect their personal information better while using social platforms. FantomApp, also used by the French DPA, provides information on cybersecurity and personal safety risks and shows users how to enable privacy-protective safeguards.
September 1, 2026
Poland
The Polish Ministry of Digital Affairs has proposed new data protection rules that would focus on medical data security and mandatory risk assessments.
Key facets of this proposal include requiring entities entrusted with processing medical data to obtain certification under the national cybersecurity certification system set out in Poland's Act on the National Cybersecurity System, requiring entities meeting minimum technological requirements for the information systems they use to handle that data, mandating a risk assessment before an entity begins processing data, providers must notify patients whenever they entrust patients' data to an external processor, and introducing new obligations for data processors that handle data on behalf of more than 100 controllers or that process the personal data of more than 100,000 individuals.
Under this new proposal, any breach would require processors to transmit a minimum set of personal data (i.e., first name, last name, PESEL number) to CSIRT NASK through the police; data processors will be responsible for providing information regarding security measures; and a mandatory risk assessment must be conducted before data processing can begin.
September 1, 2026
Latvia
Latvia’s Parliament (Saeima) adopted amendments to the Credit Information Bureaus Law on August 20, 2026. These amendments were published in the official gazette on September 1, 2026. Latvia’s latest amendments to its Credit Information Bureaus Law have enhanced individuals’ access and control over their credit information.
Key aspects of the amendments include granting natural persons the right to obtain their credit information to ensure its accuracy and to monitor creditworthiness assessments, providing individuals with the right to register in a credit information bureau's database and add a note indicating they do not wish to receive credit, and making this note indicating that the person does not wish to receive credit, visible to all users of the credit information bureau's system. The amendments state that the bureau must delete the self-exclusion note within three days, calculated from receipt of the withdrawal request.
These amendments entered into effect on September 15, 2026, with the self-exclusion mechanism provisions taking effect on November 20, 2026.
September 1, 2026
The European Commission has opened a public consultation on a draft implementing regulation for the European Health Data Space (EHDS), aiming to secure cross-border access to electronic data.
The proposed regulation sets out the technical and functional framework for the HealthData@EU infrastructure, which will enable secure and interoperable cross-border access to electronic health data for secondary use.
Among other things, the proposal includes the technical and functional specifications for the infrastructure that enables secure, cross-border access to electronic health data for secondary purposes, and the specifications for an IT tool to support cooperation and information sharing on enforcement measures among health data access bodies.
The draft is open to public consultation until September 29, 2026. Following the consultation period, the Commission plans to adopt the regulation in the fourth quarter of 2026.
September 23, 2026
Vietnam
Vietnam’s Government has issued Decree No. 363/2026/ND-CP, signed by Deputy Prime Minister Ho Quoc Dung, establishing comprehensive administrative penalties to enforce data governance, strengthen data security, and penalize illegal data collection practices. Effective November 11, 2026, the Decree sets a maximum fine of 100 million VND for individuals and introduces tiered penalties and remedial measures for both domestic and foreign entities operating in Vietnam. Under the new framework, illegal data collection or data creation without consent, or beyond specified purposes and scopes, may result in fines of up to 40 million VND. More serious violations, including leaks of sensitive information, impacts on national security, or targeting core national data, may incur fines of 40 to 60 million VND and mandatory database suspensions of 6 to 9 months. The Decree also penalizes interference with state databases, including fines of up to 60 million VND for data falsification and up to 80 million VND for database attacks or system disruption. Supplementary measures include license revocations, asset confiscation, forced data restoration, and the return of illegal profits.
September 22, 2026
Philippines
The Philippines’ National Privacy Commission (NPC) has issued Show Cause Orders to Meta, Roblox, Reddit, and Discord for alleged non-compliance with mandatory registration requirements under the Data Privacy Act of 2012 and NPC Circular 2022-04. The action forms part of an intensified compliance monitoring and investigation initiative targeting major digital platforms operating in the Philippines, with a focus on transparency, lawful processing, accountability, and security standards. The NPC emphasized particular concern for the protection of minors’ personal data, given children’s significant engagement with online platforms for social interaction, entertainment, and learning. The Commission also called for stronger collaboration among digital platforms, government agencies, schools, and parents to promote safer online environments, warning that entities failing to comply with Philippine data protection requirements may face strict regulatory sanctions.
September 19, 2026
Egypt
Egypt’s Supreme Council for Media Regulation (SCMR) and the National Telecom Regulatory Authority (NTRA) have formally directed social media platforms to adopt measures that strengthen the protection of children and adolescents in the digital environment. As a result, platforms are now prohibited from creating, activating, or providing independent personal accounts for children under 13. For ages 13-15, platforms may provide accounts to this group, provided that ‘safe mode’ is enabled automatically as a mandatory setting. To enforce these provisions, platforms must have means to verify age and prevent circumvention of the age limit.
September 18, 2026
China
The Cyberspace Administration of China (CAC) has published draft regulations titled the Regulations of the State Council on Ensuring the Healthy and Safe Use of the Internet by Minors (Draft for Comments), seeking public feedback until October 17, 2026. Drafted under China’s Law on the Protection of Minors, Network Security Law, and Personal Information Protection Law, the proposed rules would prohibit network service providers from offering minors certain services, including online social services for strangers, virtual intimate relationship services, live broadcasting for users under 16, and content that may induce addiction or harm. For users under 16, services such as online games, social media, audio and video streaming, and cognitive-impacting AI must be provided through a dedicated “minor mode.” The draft also requires service providers, smart terminal manufacturers, and app stores to implement minor-mode standards, including one-click switching, usage-time controls, anti-circumvention measures, and identity verification through legal IDs or face verification. Platforms would also need to file their minor-mode configurations with provincial network information departments. In addition, algorithm models designed to induce emotional dependence or excessive spending would be banned, and service providers would be required to intervene where minors show signs of self-harm or suicide.
September 18, 2026
India
India’s Telecom Regulatory Authority of India (TRAI) has issued the Telecom Commercial Communication Customer Preference (Third Amendment) Regulations, 2026, introducing a strengthened, technology-driven framework to curb Unsolicited Commercial Communications (UCC) and protect consumers from spam. The amended regulations require telecom providers to integrate AI/ML-based detection systems to identify suspected spam callers, introduce a 15-day consumer appeal mechanism for complaint resolutions, and impose stricter controls on Application-to-Person (A2P) automated calls through mandatory pre-declaration and termination charges for unauthorized originations. The framework also lowers complaint thresholds for AI-flagged senders, tightens rules for inquiry-based communications, restricts third-party call management applications from blanket-blocking official commercial numbering series, and increases contractual accountability for telemarketers to prevent misuse of telecom resources.
September 16, 2026
Japan
Japan’s PPC has announced discussions on the "Basic concept for developing cabinet orders and rules" under the amended Act on the Protection of Personal Information (APPI), which was promulgated on July 17, 2026. Under it, a unified, cross-sectoral regulatory framework overseen by the PPC to govern data processing across administrative agencies, local public bodies, and private business operators would be established.
September 16, 2026
South Korea
The PIPC in South Korea has issued a public notice regarding a proposed amendment to the Enforcement Decree of the Personal Information Protection Act, which is open for feedback from September 16 through October 26. The proposal states it would introduce new mandates, including concurrent written and on-site audits and mandatory vulnerability assessments, such as penetration testing by qualified security experts, conducted during initial reviews and annual surveillance evaluations, particularly following security incidents. This would be in addition to tiered certification standards based on processing scale and societal impact, and would include a pragmatic one-year grace period for administrative fines for entities whose certification is revoked.
September 15, 2026
China
CAC has published a major enforcement report detailing recent regulatory actions against enterprises violating cybersecurity, data protection, and AI compliance standards under the Cybersecurity Law, Data Security Law, Personal Information Protection Law, and Regulations on Network Data Security Management. This comes as part of a larger enforcement change in the country that now focuses on webpage tampering, malicious programs, data theft, data leakage risk, personal information leakage, forced data collection, illegal facial recognition, excessive collection and cross-border transfer, AI content labeling non- compliance, and Generative AI Security Assessment.
September 11, 2026
South Korea
The PIPC has launched an investigation into Google after sensitive personal data submitted by digital sex crime victims seeking content removal was publicly disclosed on an external database. The investigation focuses on potential violations of the Personal Information Protection Act (PIPA), scrutinizing whether systemic failures, flawed data-handling protocols, or automated third-party data-sharing workflows led to the breach.
September 10, 2026
South Korea
PIPC has issued official guides for appointing and reporting Chief Privacy Officers (CPOs) under the amended Personal Information Protection Act (PIPA), reinforcing executive accountability as enterprise data processing and AI deployments expand. Under these requirements, organizations must report any CPO designation or status changes to the PIPC within 6 months, with noncompliance subject to administrative fines of up to KRW 30 million.
September 10, 2026
South Korea
The amended Personal Information Protection Act (PIPA) officially went into effect on September 11, 2026, in South Korea. Organizations handling Korean personal data now face administrative penalties reaching up to 10% of total revenue for severe or repeated data breaches. However, companies can qualify for fine reductions through verified, proactive security investments.
September 4, 2026
Vietnam
The Vietnamese government has issued Decree No. 343/2026/ND-CP, providing detailed implementation guidelines under the Law on Cybersecurity to address and mitigate information conflicts in cyberspace. Under this decree, joint operational responsibilities are assigned to information system administrators and specialized cybersecurity forces, including those under the Ministry of National Defense, to identify, manage, and resolve online information conflicts.
As a result, telecommunications and internet service providers must deploy content-filtering and technical countermeasures under specified conditions, supported by cross-agency government coordination to eliminate non-compliant or disruptive material.
September 2, 2026
Indonesia
Indonesia has enacted Government Regulation No. 33 of 2026, the implementing regulation for the Personal Data Protection Law (UU PDP). The regulation covers core operational requirements, including data classification, detailed processing conditions, data subject rights mechanisms, rules for international data transfers, and a compliance supervision framework. It will take effect on January 16, 2027, with organizations having six months to prepare for compliance.
September 1, 2026
South Korea
GS Retail has been handed a KRW 12.836 billion penalty in South Korea after credential-stuffing attacks exposed the personal information of more than 1.6 million users. GS Retail failed to take appropriate action and, as a result, must now pay the penalty and implement adequate corrective measures.
September 1, 2026
Cambodia
Cambodia's National Standards Council has adopted three ISO standards as national standards on August 28, 2026: ISO/IEC 27017:2026 (information security controls for cloud services), ISO/IEC 27018:2025 (protection of PII in public clouds acting as PII processors), and ISO 7637-1:2023 (electrical disturbances in road vehicles.
September 1, 2026
Australia
The Australian government has released the draft Privacy Amendment (Personal Data Protection) Bill 2026 for public consultation. Key aspects of the new bill include updated core definitions, strengthened consent requirements, and the reclassification of geolocation and genomic data as sensitive information that requires heightened protection.
September 1, 2026
South Korea
South Korea has handed fines to Hyundai’s two group affiliates, HD Hyundai Construction Machinery (KRW 73.5 million) and HD Korea Shipbuilding & Offshore Engineering (KRW 4.8 million), after a server vulnerability was exploited to expose the personal information of more than 9,000 employees and business partners, and the companies failed to take appropriate remedial measures.
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
info@securiti.ai
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
