Cameroon’s New Privacy Law Is Past Its Grace Period
Cameroon's 2024 data protection law is now past its 18-month compliance period, turning privacy governance, breach handling and transfer controls into current obligations.
Legislation
Australia Can Intervene in a Critical-Infrastructure Cyber Incident
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident. Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened…
Poland’s NIS2 Law Brings 38,000 Organisations into the Cybersecurity System
Poland’s amended National Cybersecurity System Act is now in force. Its scale, registration timetable and management duties turn NIS2 into a board-level implementation programme. Poland’s amendment to the National Cybersecurity System Act took effect on 3 April 2026. The Act…
Paraguay Enacts a Comprehensive Data Protection Law With a Two-Year Runway
Paraguay’s first comprehensive personal-data law creates a regulator, reaches some overseas processing and gives organisations 24 months from official publication before the regime takes effect. Paraguay’s Law No. 7.593/2025 represents a major change from a privacy landscape previously centred on…
Burundi Has a Personal Data Protection Law. The Compliance Map Just Expanded.
Burundi's Law No. 1/03 creates a dedicated personal-data regime, regulator and enforcement framework for public and private processing.
South Korea’s AI Basic Act Is Now Live
South Korea’s AI Basic Act entered into force on 22 January 2026, combining industrial promotion with obligations for high-impact and generative AI. Europe is not the only jurisdiction turning AI principles into law. South Korea’s Framework Act on the Development…
Somalia’s Data Protection Act Now Has Operating Regulations
Somalia's 2026 regulations turn the 2023 Data Protection Act into a more operational regime for registration, supervision and breach response.
The EU Data Act Is a Cloud-Exit Law as Much as an IoT Law
The EU Data Act, effective from 12 September 2025, grants users rights to access and share data from connected products, aiming to enhance data portability and interoperability. It imposes new requirements on cloud service providers to facilitate easier switching and data extraction, fundamentally altering infrastructure and user access dynamics.
Uruguay Created a Legal Path for AI Regulatory Sandboxes
Uruguay's Decree 276/025 creates governed test environments and data spaces for innovative projects, including AI and data uses.
Mexico Ended Anonymous Mobile Lines Without Building a Central Registry
Mexico's mobile-line identification rules require operators to link active numbers to verified people or organisations before the June 2026 deadline.