Brazil’s data-protection authority has replaced an open-ended breach-notification standard with a defined three-business-day clock and a detailed test for deciding which incidents must be reported. Brazil’s Lei Geral de Proteção de Dados, or LGPD, has always required controllers to communicate…
From 29 April 2024, consumer connectable products placed on the UK market became subject to three deceptively simple security requirements. The difficult part is proving that the whole supply chain meets them. The United Kingdom’s Product Security and Telecommunications Infrastructure…
Chile’s Cybersecurity Framework Law creates a national regulator, defines essential services and requires an early incident alert within three hours. That first message is designed for speed, not forensic certainty. Chile published Law No. 21.663, the Cybersecurity Framework Law, on…
Tanzania's privacy regime is no longer a statute waiting for machinery. Its commission is operational, registration is live and enforcement has begun.
Nigeria's 2024 cybercrime amendment is usually discussed as a levy story, but its deeper effects reach traffic retention, sectoral monitoring and enforcement architecture.
The AfCFTA Digital Trade Protocol sets a shared direction for data flows, privacy, cybersecurity, digital identity and electronic trade across Africa.
The Digital Services Act, applicable from 17 February 2024, regulates intermediary services within the EU, imposing varying obligations based on service type and size. It mandates effective notice, classification, and moderation workflows while ensuring transparency in automated decision-making. Large platforms are held to higher standards, requiring systemic risk assessments and accountability measures.
Malawi's 2024 Data Protection Act has moved privacy compliance onto a statutory footing and given the national regulator real investigative and corrective work.
Puerto Rico's Law 40-2024 creates a government CISO, an incident office and mandatory security controls across agencies, municipalities and suppliers.
US public companies do not receive four days to investigate every cyber incident. They generally receive four business days after determining that an incident is material. The Securities and Exchange Commission’s cybersecurity disclosure rules changed the way public companies connect…
