Brazil’s ECA Digital Makes Child Safety a Platform Governance Duty
Brazil's ECA Digital requires digital services likely to be used by children to build safety, age assurance and parental controls into products.
Legislation
Peru’s AI Law Now Has an Operating Regulation
Peru's Decree 115-2025-PCM classifies AI by risk and adds rules for transparency, human oversight, privacy and security.
The EU AI Act After 2 August 2026: What Applies and What Comes Next
The EU AI Act's phased application reached a significant milestone on 2 August 2026, with new transparency obligations enforced. While high-risk rules have extended deadlines, organisations must remain proactive in governance, ensuring AI literacy and accountability. Compliance should not hinder innovation, as effective inventory management aids both.
Panama Modernised Cybercrime Law and Protected Legitimate Security Work
Panama's Law 478 updates cybercrime offences, digital evidence and international cooperation while recognising authorised security testing.
Ecuador Clarified That Data Transfers Carry Two Layers of Compliance
Ecuador's Resolution SPDP-SPD-2025-0024-R clarifies how general privacy duties and transfer-specific rules operate together.
The UK Data (Use and Access) Act Changes Privacy Operations Without Replacing UK GDPR
The Data (Use and Access) Act 2025 did not sweep away the UK’s privacy framework. It changed how parts of that framework operate—and added complaint, research, digital-verification and smart-data provisions around it. The Act received Royal Assent on 19 June…
Malaysia’s Privacy Reform Puts DPOs and Breach Notices on the Clock
Malaysia’s 2024 privacy amendments introduced mandatory breach notification, Data Protection Officers for qualifying processing and direct security duties for processors through a three-stage commencement schedule. Malaysia’s Personal Data Protection (Amendment) Act 2024, Act A1727, received Royal Assent on 9 October…
Zambia Split Cybersecurity Regulation From Cybercrime. The Obligations Got Sharper.
Zambia's two 2025 cyber laws separate regulatory security duties from criminal offences while sharpening incident, audit, hosting and licensing obligations.
Peru’s New Privacy Regulation Brings a 48-Hour Breach Clock
Peru’s replacement data-protection regulation turns security incidents, advertising consent and privacy governance into defined operating processes. Peru’s new Regulation of Law No. 29.733 entered into force on 31 March 2025. Approved by Supreme Decree No. 016-2024-JUS, it replaces the earlier…
The European Health Data Space Is Not Just Another GDPR Article
The European Health Data Space creates infrastructure and governance for exchanging and reusing health data. It entered into force in March 2025, but most operational duties arrive through a long, staged implementation. Regulation (EU) 2025/327 entered into force on 26…