Malawi Has a Data Protection Law. Compliance Now Has a Regulator.
Malawi's 2024 Data Protection Act has moved privacy compliance onto a statutory footing and given the national regulator real investigative and corrective work.
Legislation
Puerto Rico Turned Government Cybersecurity Into a Legal Operating Model
Puerto Rico's Law 40-2024 creates a government CISO, an incident office and mandatory security controls across agencies, municipalities and suppliers.
The SEC’s Four-Business-Day Cyber Disclosure Clock Starts After Materiality
US public companies do not receive four days to investigate every cyber incident. They generally receive four business days after determining that an incident is material. The Securities and Exchange Commission’s cybersecurity disclosure rules changed the way public companies connect…
Ecuador’s Privacy Law Gets Its Operating Manual
Ecuador’s 2023 implementing regulation turns the country’s data-protection law into a more detailed programme of risk assessment, impact analysis, incident notification and accountable governance. Ecuador published Executive Decree No. 904 on 13 November 2023, issuing the General Regulation to the…
Argentina Adopts Regional Model Clauses for Cross-Border Data
Argentina’s adoption of Ibero-American model clauses gives organisations another standard route for protecting personal data sent to jurisdictions without an adequate level of protection. Argentina’s Agency for Access to Public Information issued Resolution No. 198/2023 on 13 October 2023. Published…
Colombia’s ‘Stop Bugging Me’ Law Turns Contact Preferences Into System Rules
Colombia’s Law 2300 regulates when, how and how often organisations may contact consumers. Compliance depends on shared preferences across diallers, messaging systems and outsourced agents. Colombia enacted Law 2300 on 10 July 2023. Known publicly as the “Dejen de Fregar”…
Quebec Law 25 Turns Privacy Engineering Into an Operational Requirement
Quebec’s Law 25 phased major privacy reforms into force between 2022 and 2024. Its lasting impact is the movement of privacy decisions into system design and executive accountability. Quebec adopted the legislation commonly known as Law 25 in 2021. The…
Hungary’s Whistleblower Law Turns Follow-Up Into a Timed Process
Hungary’s 2023 whistleblower act combines employer channels with public-interest reporting and puts clocks around receipt, investigation and feedback. A mailbox without case orchestration is not enough. Act XXV of 2023 on complaints, public-interest disclosures and rules concerning whistleblowing took effect…
The Netherlands Is Making Electronic Health-Data Exchange Mandatory
The Dutch Wegiz is a framework for turning selected exchanges of health information from optional digitisation projects into mandatory, standardised and potentially certified processes. The Wet elektronische gegevensuitwisseling in de zorg, known as the Wegiz, entered into force on 1…
The Dutch Digital Government Act Regulates How Citizens Log In
The Netherlands’ Digital Government Act treats access to public services as a trust decision. The sensitivity of the service should determine the strength of the login—not the convenience of the existing portal. The Wet digitale overheid, or Wdo, began phased…