Updata: Your quarterly privacy & cybersecurity update

Our latest edition covers July to September 2025, and includes the following highlights:

• artificial intelligence (AI) regulation and strategy - updates include the EU’s consultation on AI Act transparency guidelines, the final EU GPAI Code of Practice, California’s new Transparency in Frontier AI Act, NIST’s concept paper on securing AI systems, and the Italian implementation of the EU AI Act. The Dutch DPA’s report on AI and algorithms and the UK’s regulatory guidance on responsible AI use are also featured.

• smart data laws - developments on the EU Data Act and local legislative requirements, the EDPB’s statement on data sharing under the Data Act, and the phased commencement of the UK’s Data (Use and Access) Act 2025. The UK government’s response to its data intermediaries consultation is also covered.

• data security and cybersecurity - there is increased regulatory scrutiny of security practices, new incident reporting guidance in Italy, China, and Hong Kong, and notable fines in Italy and Spain. The UK has proposed a ban on ransomware payments, and new guidance has been issued on encryption and AI-related cyberthreats. Reports highlight rising cyber threats in Lithuania and Singapore.

• regulatory scrutiny over data sharing practices - notable cases include a Dutch financial institution ordered to disclose its data sharing practices and a US lawsuit against the Health and Human Services for sharing sensitive health data with Homeland Security.

• children and data - the European Commission has published new guidelines and a prototype age verification app to help service providers comply with the DSA. Other developments include the Bulgarian DPA’s recommendations on school CCTV, the EDPB’s opinion on the interplay between the DSA and GDPR, China’s draft requirements on minors’ data protection, and the UK’s Final Statement of Strategic Priorities for Online Safety.

• health and biometric data - key updates include California’s new Privacy Health Data Location and Research Act, amendments to Virginia and Colorado privacy laws, new guidance in Germany on employee health data, and a new working group in Portugal on health data retention. Enforcement actions and regulatory focus on biometrics are highlighted in Italy, the Netherlands, and the UK.

• regional and country-specific updates - the edition provides in-depth coverage of legal and regulatory changes across Europe (including Austria, Belgium, France, Germany, Italy, Lithuania, the Netherlands, Portugal, Romania, Slovakia, Spain, Switzerland, and the UK), Asia Pacific (China, Hong Kong, Singapore), Africa (South Africa), the Middle East, and the United States.

• case law and regulatory guidance - recent rulings and guidance on GDPR, including the ECJ’s clarification on pseudonymous data, the EU-US Data Privacy Framework, and the EDPB’s guidelines on the interplay between the DSA and GDPR. There are also updates on the right of access, data subject rights, and the use of CCTV and biometric data in employment and education contexts.

• cybersecurity regulation advancements - progress on the EU’s NIS2 Directive, new technical guidance from ENISA, and national implementations in Austria, Portugal, and Italy. The UK and France have announced a partnership to enhance the resilience of critical infrastructure.

• AI, data, and digital market consultations - the EU and UK have launched multiple consultations on AI, data, and digital market regulation, including the Digital Markets Act, Digital Services Act, and the Chips Act 2.0.

Read Updata