Alabama Subpoenaed OpenAI. An AI Sandbox Escape Is Now a Consumer-Protection Case.
Alabama has subpoenaed OpenAI over the Hugging Face agent incident, testing whether an AI containment failure can become a consumer-protection case.
Legislation & Acts
An EU Data Order Can Now Cross Borders Directly. The Provider May Have Eight Hours.
The EU e-Evidence Regulation makes cross-border data orders an eight-hour operational challenge for service providers, not merely a legal process.
The CRA Reporting Clock Starts on 11 September 2026
CRA Article 14 reporting is now operational. ENISA's portal has no API, and its 72-hour display can run early, so manufacturers must calculate legal deadlines independently from the awareness timestamp.
The Gambia Assented to a Modern Privacy Law. The Next Step Is Operational.
The Gambia has assented to a modern privacy framework covering extraterritorial processing, data rights, security, breaches and transfers.
Kenya Expanded Its Cybercrime Law. The Courts Have Already Drawn a Boundary.
Kenya expanded its cybercrime law in 2025, then saw the High Court invalidate administrative website blocking and a vague speech offence in 2026.
Cameroon’s New Privacy Law Is Past Its Grace Period
Cameroon's 2024 data protection law is now past its 18-month compliance period, turning privacy governance, breach handling and transfer controls into current obligations.
Australia Can Intervene in a Critical-Infrastructure Cyber Incident
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident. Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened…
Poland’s NIS2 Law Brings 38,000 Organisations into the Cybersecurity System
Poland’s amended National Cybersecurity System Act is now in force. Its scale, registration timetable and management duties turn NIS2 into a board-level implementation programme. Poland’s amendment to the National Cybersecurity System Act took effect on 3 April 2026. The Act…
Paraguay Enacts a Comprehensive Data Protection Law With a Two-Year Runway
Paraguay’s first comprehensive personal-data law creates a regulator, reaches some overseas processing and gives organisations 24 months from official publication before the regime takes effect. Paraguay’s Law No. 7.593/2025 represents a major change from a privacy landscape previously centred on…
Burundi Has a Personal Data Protection Law. The Compliance Map Just Expanded.
Burundi's Law No. 1/03 creates a dedicated personal-data regime, regulator and enforcement framework for public and private processing.