EU’s Cyber Resilience Act introduced Single Reporting Platform (SRP) for vulnerability and incident reporting in products with digital elements.
French CNIL issued guidance on data protection requirements for electronic invoicing, emphasising data minimisation, GDPR compliance and access controls.
Ireland’s DPC fined the Health Service Executive EUR 645,000 for GDPR violations relating to data security implementation, principle of data storage limitation and personal data breach reporting requirements.
Estonia’s new Information Security Standard came into force, strengthening requirements relating to risk management, system continuity and information security.
The UK Parliament’s Joint Committee on Human Rights called for new AI legislation, to address the extent and gravity of threats posed to human rights by artificial intelligence systems.
The Netherlands’ AP introduced mandatory publication of GDPR sanctions following amendments to the Implementation Act General Data Protection Regulation.
The CJEU held that unrestricted online publication of shareholders’ personal data is incompatible with EU law where access is not conditional upon demonstrating a legitimate interest.
Liechtenstein’s Data Protection Authority published its 2025 activity report, highlighting AI, cloud services, video surveillance and international data transfers as key areas of focus.
Turkey’s Personal Data Protection Authority issued guidance on the use of personal data obtained from third parties for advertising and marketing purposes.

Americas

New York’s Department of Financial Services issued guidance on cybersecurity risk assessments, outlining best practices for financial services entities.
A coalition of U.S. Attorneys General secured a preliminary injunction preventing the government from obtaining sensitive personal information of commercial drivers.
Colombia’s House of Representatives introduced a bill to amend Statutory Law 1581 of 2012 to strengthen the legal framework relating to the fundamental right to the protection of personal data.
Delaware Governor signed the House Bill 380, expanding the applicability of Personal Data Privacy Act and consumer rights.
California Department of Insurance advanced 10 legislations establishing privacy requirements for insurance consumers, covering the collection, use, retention and disclosure of personal information.
The Office of the Privacy Commissioner Canada issued guidance on assessing third-party service providers, emphasizing accountability, due diligence and appropriate safeguards.

APAC

Cyberspace Administration of China issued clarifications on cross-border transfers of personal information, including the thresholds for information protection certification and data export security assessments.
Personal Information Protection Commission in South Korea fined social media platforms KRW 10.3 billion for unlawfully collecting users’ behavioural data.
Vietnam issued an implementation plan for the Personal Data Protection Law, setting out measures for implementation of the new data protection framework.
National Privacy Commission of Philippines published a draft Circular on Data Subject Rights for public consultation.

Click here to read the complete newsletter with official links

Gurugram office: 1st Floor, AIHP Palms, 242 & 243, Udyog Vihar Phase-IV, Gurugram - 122015

Dubai office: Unit: 9, 9th Floor, Arabian Sky Business Centre, CitiBank Building, Sheikh Rashid Road, Dubai, UAE

Phone: +91-124-4309062 | Email: newsletter@Privacydesk.in

Delhi (NCR) | Dubai

Privacy Desk

Twitter

Disclaimer: This update is the copyright of Reina Legal. The update is not intended to be a form of solicitation or advertising. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate thereafter. No person should act on such information without appropriate professional advice based on the circumstances of a particular situation. Unsubscribe