El Salvador enacted privacy and cybersecurity legislation together, placing the protection of personal information and the security of public digital systems under a connected institutional model. El Salvador published two linked statutes on 15 November 2024: Legislative Decree No. 143,…
Belgium’s NIS2 regime combines risk-management and incident-reporting duties with something many national implementations leave less explicit: registration followed by a structured route to independent assurance. The Act of 26 April 2024 establishing a cybersecurity framework for networks and information systems…
Italy’s NIS2 implementation begins with a deceptively simple question: has the organisation correctly identified itself, its services and the entities connected to it before it tries to prove the quality of its controls? Legislative Decree No. 138 of 4 September…
The Critical Entities Resilience (CER) Directive enhances Europe’s resilience strategies beyond the NIS2 framework, addressing broader risks such as natural disasters and human threats. Critical entities in various sectors must conduct assessments and report disruptions promptly. This regulatory shift emphasizes the need for comprehensive risk management and operational resilience in essential services.
The EU AI Act introduces a risk-based framework for governing artificial intelligence but does not replace existing laws like GDPR. Organisations must navigate overlapping regulations, ensuring compliance across multiple obligations. Effective governance requires a unified approach that integrates risk management, transparency, security, and accountability throughout the AI system's lifecycle.
Uruguay’s 2024 cybercrime law does more than add offences to the Criminal Code. It gives financial institutions tools to share fraud information and temporarily immobilise suspicious funds. Uruguay published Law No. 20.327 on 25 September 2024. The statute regulates the…
The Digital Operational Resilience Act (DORA) is vital for maintaining continuous financial services amidst technological failures. Effective implementation requires a comprehensive approach to ICT risk management, incident handling, testing, supplier oversight, and information sharing. Organisations must prioritise resilience as an ongoing cycle rather than a one-off compliance exercise to adapt to evolving risks.
Saudi Arabia’s Personal Data Protection Law took effect in September 2023. Its general one-year grace period ended on 14 September 2024, moving compliance from preparation to operation. Saudi Arabia’s PDPL establishes rules for processing personal data and is supported by…
Nicaragua's Law 1219 expands the Special Cybercrime Law's territorial reach, participant liability and online information offences.
The Netherlands will implement the Cyberbeveiligingswet (Cbw) on 15 August 2026, enforcing the NIS2 Directive to enhance cybersecurity for over 8,000 organisations across various sectors. Key responsibilities include registration, risk analysis, incident reporting, and management accountability, aimed at strengthening overall cyber resilience and integrating security measures into governance.
