Covered institutions will need to review their cybersecurity and incident response policies and procedures ahead of the applicable compliance deadline.
By Robert Blamires, Laura Ferrell, Daniel Filstrup, Jennifer Howes, and Sarah Zahedi
The Securities and Exchange Commission (SEC) recently1 adopted amendments to Regulation S-P that expand the scope of requirements
The Act establishes the world’s first comprehensive regulatory framework for AI, and is expected to shape the future of AI regulation and governance both within and beyond the EU.
By Elisabetta Righini, Hanno F. Kaiser, Tim Wybitul, Fiona M. Maclean, and Michael H. Rubin
After three years of legislative debate, the
Businesses need to be proactive in updating their compliance measures to meet the ever-evolving set of privacy laws and regulatory expectations in 2024 and beyond.
By Michael H. Rubin, Robert W. Brown, Max G. Mazzelli, Jennifer Howes, and Sarah Zahedi
Following the notable uptick in state-level privacy laws in 2023, a
Understanding the ICO’s approach to assessing financial penalties should be a key element of an organisation’s data protection strategy and risk profile.
By James Lloyd and Sami Qureshi
In an era when data protection infringements can tarnish business reputations overnight, understanding the financial ramifications is more crucial than ever. The UK’s Information Commissioner’s Office (ICO)
The PDPL has broad extraterritorial scope and substantial penalties for non-compliance, with full enforcement expected to start in September.
By Brian A. Meenagh and Lucy Tucker
The Personal Data Protection Law (PDPL) is the first comprehensive data protection law in Saudi Arabia. The Saudi Data and Artificial Intelligence Authority (SDAIA) is expected to start full
The new framework provides an additional route for personal data transfers from the EEA to the US.
By Robert Blamires, Gail E. Crawford, James Lloyd, Clayton Northouse, Alice Brunning, Alexander Ford-Cox, and Jennifer Howes
On 10 July 2023, the European Commission (EC) took the final step to enable businesses
Florida’s law introduces novel provisions that depart from existing US state privacy laws, which businesses will need to carefully consider.
By Jennifer C. Archie, Clayton Northouse, Joseph C. Hansen, and Austin L. Anderson
Key Takeaways:
A California court has held that the regulations the California Privacy Protection Agency adopted in March 2023 may not be enforced until March 2024.
By Michael Rubin, Joseph Hansen, Austin Anderson, and Max Mazzelli
On June 30, 2023, a day before the California Consumer Privacy Act (CCPA) as amended by the California
The French Data Protection Authority has imposed a €40 million fine for GDPR infringements.
By Myria Saarinen and Charlotte Guerin
On 15 June 2023 the French Data Protection Authority (the CNIL), acting as Lead Supervisory Authority pursuant to the cooperation procedure under Article 60 GDPR, handed down a decision against the French adtech company Criteo
The amended PDPL diverges from international privacy laws in several areas, including personal data transfers, penalties, and breach notification.
By Brian A. Meenagh and Lucy Tucker
An amended version of the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) was published in the Official Gazette of the Kingdom of Saudi Arabia on April 7,
