Breach and incident notification rules

South Korea PIPASouth Korea

2026 PIPA amendments take effect

10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.

Vulnerability and incident reporting obligations apply

Art 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).

Japan APPIJapan

2026 APPI amendment act promulgated

Amendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.

UK Cyber Security and Resilience BillUnited Kingdom

Passes House of Commons

Report stage and third reading completed in the Commons after carry-over into the new session.

Canada Bill C-8 / CCSPACanada

Royal Assent

Bill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.

Canada Bill C-36 (PPCDA)Canada

Bill C-36 tabled (first reading)

Government introduces the PPCDA in the House of Commons.

Conformity assessment body provisions apply

Chapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).

SEC Regulation S-PUnited States (Federal)

Smaller entities must comply

Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.

New Zealand Privacy ActNew Zealand

IPP 3A indirect-collection notification applies

Agencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.

NYDFS Cybersecurity Regulation (Part 500)New York

Annual compliance notification

Annual certification or acknowledgment covering calendar year 2025 due.

South Korea PIPASouth Korea

2026 PIPA amendment promulgated (Act No. 21445)

Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.

HIPAAUnited States (Federal)

Notice of Privacy Practices updates (Part 2 alignment)

Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.

UK GDPRUnited Kingdom

DUAA amendments to UK GDPR commence

Main Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.

Vietnam PDPLVietnam

PDPL and Decree 356/2025 take effect

Personal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.

Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong

PCICSO comes into operation

Commissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.

GDPR Procedural Regulation enters into force

Regulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware reporting moves to compliance phase

The education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.

SEC Regulation S-PUnited States (Federal)

Larger entities must comply

Larger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.

GDPR Procedural Regulation adopted

Regulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.

First critical ICT third-party providers designated

The ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.

India DPDP ActIndia

DPDP Rules published; Board and procedural rules in force

Rules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.

UK Cyber Security and Resilience BillUnited Kingdom

Introduced (Commons first reading)

Bill introduced in the House of Commons.

NYDFS Cybersecurity Regulation (Part 500)New York

Universal MFA and asset inventory

500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.

New Zealand Privacy ActNew Zealand

Privacy Amendment Act 2025 technical changes commence

Technical amendments commence the day after Royal Assent (23 Sep 2025).

Nigeria NDPANigeria

GAID 2025 takes effect

General Application and Implementation Directive becomes effective, replacing the NDPR 2019 and NDPR Implementation Framework.

Brazil LGPDBrazil

Deadline to adopt ANPD standard contractual clauses

Agents relying on contractual clauses for international transfers must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.

Israel Privacy Protection Law Amendment 13Israel

Amendment 13 in force

Amended Privacy Protection Law, PPA enforcement powers and statutory damages take effect.

TLPT regulatory technical standards enter into force

Commission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.

Canada Bill C-8 / CCSPACanada

Bill C-8 introduced

First reading in the House of Commons.

Australia Privacy ActAustralia

Statutory tort for serious invasions of privacy commences

Individuals can sue for serious invasions of privacy (Schedule 2), 6 months after Royal Assent.

Malaysia PDPAMalaysia

PDPA amendments phase 3

Mandatory DPO appointment, data breach notification, and data portability take effect.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware payment reporting starts

Reporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.

NYDFS Cybersecurity Regulation (Part 500)New York

Vulnerability scans, access privileges, malware controls, Class A monitoring

500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.

First registers of information submitted to the ESAs

Competent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.

Member States establish entity lists

Member States had to establish lists of essential and important entities and notify the Commission of entity numbers (Art 3(3) and (5)). Repeated every two years.

Malaysia PDPAMalaysia

PDPA amendments phase 2

'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.

HIPAAUnited States (Federal)

Security Rule NPRM comment period closed

Comments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.

Digital infrastructure entities submit registration data

DNS providers, TLD registries, domain registration services, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks had to submit registration details to competent authorities (Art 27(2)).

DORA applies

All DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).

Malaysia PDPAMalaysia

PDPA amendments phase 1

Miscellaneous provisions commence (e.g. electronic service of notices).