The Latest Developments in Global Data Privacy Law, and Data Breach Prevention and Response – Fox Rothschild LLP

A single organization may fall under GDPR (EU residents), CCPA (California residents), HIPAA (health data), the AI Act (AI systems), and sector rules such as GLBA, SOX, or PCI DSS. Over the past five years the regulatory landscape has moved from fragmented regional rules to overlapping regimes that apply at once. In this article, we summarize a few principles, flag commonly relevant issues, and suggest practical approaches for attorneys advising Internet businesses.

While similar to the phenomenon of shadow IT, shadow AI goes beyond unapproved software by involving systems that process, generate, and potentially retain sensitive data. When sales messaging fails to bridge this divide, prospects tend to view cybersecurity as a cost center instead of a strategic investment. PCI DSS v4.0.1 closes that gap with two requirements, now…

The directive harmonizes bribery and corruption offenses across member states and sets penalties at up to 5% of worldwide turnover or €40 million — a penalty structure that brings anti-corruption enforcement to a scale comparable to GDPR. The first half of 2026 has been a stress test of the broader assumption that rules, accountability, and the fear of consequences are enough to keep organizations honest. Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Modern Perimeter Has Expanded For decades, cybersecurity strategy revolved around a defined perimeter. The consequence is a widening gap between what the security organizations think th…

Health Insurance Portability and Accountability Act (HIPAA)

An independent PCI assessor tested Reflectiz against the new PCI DSS rules. It moves downstream, to the moments where systems still trust a human to prove who they are. Even PCI DSS – the strictest compliance framework in the industry – allows 30 days to remediate a critical vulnerability. Security leaders who build fast, visible paths to AI adoption are becoming the most valued partners in their organizations. EU regulators are increasing their focus on DORA implementation, Information and Communication Technology (ICT) incident analysis, and the effectiveness of ICT risk supervision.

• For a practical guide to DORA’s specific requirements, see our DORA compliance guide.
• Eight new state laws took effect in 2025 alone, including Delaware, Iowa, Nebraska, and New Hampshire (all January 1), followed by Tennessee, Indiana, Montana, Oregon, and Texas later in the year.
• In 2025, cybersecurity and data protection became explicit components of Environmental, Social, and Governance (ESG) reporting for the first time at scale.
• Organizations that had structured their incident response plans around specific regulatory timelines (4 business days for SEC, 72 hours for GDPR supervisory authorities, 36 hours for U.S. banking regulators) handled the first live test of these requirements without improvising.
• The directive now covers 18 sectors including energy, transport, banking, healthcare, public administration, digital infrastructure (DNS, data centers, cloud), waste management, space, and manufacturing of critical products.

Now in its second year, the harder part of DORA is demonstrating how well frameworks work in practice. Secure sensitive data and strengthen privacy controls across hybrid environments with centralized monitoring and automated risk reduction. Get market-leading performance, efficiency and cyber resilience while streamlining complexity across all environments. Identity and access management (IAM) is a cybersecurity discipline that deals with user access and resource permissions. Access https://www.gurlitt.info/the-essential-laws-of-explained-9/ this Gartner guide to learn how to manage the complete AI inventory and secure your AI workloads with guardrails. The KuppingerCole data security platforms report offers guidance and recommendations to find sensitive data protection and governance products that best meet clients’ needs.

Building trust with customers and partners

• To keep up with the speed of business, organizations need to move fast to stay competitive and improve their market share.
• This guide explores the essentials of data compliance, key regulations, and best practices for 2026.
• How leading institutions are approaching cross-asset oversight and building more resilient, future-ready compliance frameworks
• Businesses must comply with the privacy requirements to avoid heavy fines and legal repercussions.

Although there was previously uncertainty regarding the definition of a “reporting company” under the Act, on 31 December 2025, the New York Department of State confirmed that the Act is only applicable to limited liability companies formed outside the US that are authorized to do business in New York State. The specialist publication providing expert-led, practical insights to help professionals navigate legal, ethical, and operational risks in artificial intelligence Without human oversight, companies subject themselves to additional legal risk, said Stacey Brandenburg, shareholder at ZwillGen PLLC.“Having a human in the loop to filter and understand what the AI is identifying is really important,” she said.

Many states may have decided it was not necessary to duplicate provisions businesses already implemented based on other state laws Internationally, regulators are expected to continue prioritizing cross-border data transfers, AI governance, and accountability measures, further complicating compliance for multinational organizations. For organizations operating across borders, these developments highlight the importance of staying informed about jurisdiction-specific obligations, rather than relying entirely on a single global privacy framework. These laws largely follow existing state models but introduce additional compliance obligations, including requirements related to opt-out mechanisms, sensitive data consent, and data protection impact assessments. For organizations that collect, use, or share personal data across jurisdictions, the past year highlighted growing regulatory complexity, expanding compliance obligations, and heightened enforcement risk.

Fines can reach €20 million or 4% of worldwide annual revenue, whichever is higher, for the most serious violations. Regulations change, systems are reconfigured, and controls that were compliant six months ago are quietly bypassed, for example when a new data lake is provisioned without the access controls in the governance framework. The common choices are ISO/IEC (information security management), the NIST Cybersecurity Framework and NIST Privacy Framework, and SOC 2 for service providers. See Regulatory Compliance for AI Systems and the EU AI Act data governance guide. Twenty states now have comprehensive privacy laws in effect, including Virginia, Colorado, Connecticut, Texas, and, as of January 1, 2026, Indiana, Kentucky, and Rhode Island.

• PCI DSS is a security standard ensuring that businesses handling credit card transactions implement robust data security measures to prevent fraud.
• The CCPA, and its amendment CPRA, grants California residents rights over their personal data, including the right to opt out of data sales and request data deletion.
• Organizations recognize that data compliance can help them foster customer trust and build their reputation as a transparent, responsible steward of personal data.
• These fines can reach up to 4% of an organization's annual global turnover or EUR 20 million, whichever is greater.
• The landscape of data compliance is constantly evolving, and businesses that handle customer information must proactively adapt to stay ahead of emerging trends.
• It establishes the guidelines for how healthcare entities and businesses handle patients' personal health information (PHI) to guarantee its confidentiality and security.

A Data Compliance Officer (DCO) is a key figure in an organisation responsible for ensuring that all data-handling practices align with legal requirements and compliance frameworks. The Payment Card Industry Data Security Standard (PCI DSS) and the Federal Information Security Management Act (FISMA) are examples of data security laws. Conduct impact assessments, risk assessments, and cybersecurity resilience testing to proactively address potential threats. Fines for violating HIPAA, set by the HITECH Act, are adjusted annually for cost-of-living increases to maintain their deterrent effect.

Types of data compliance regulations and standards

Even more—data compliance often helps businesses increase their security and enhance their efficiency and profitability. Unsurprisingly, all this data can be incredibly valuable to organizations, helping them turn data into insights to make better business decisions. At the same time, organizations are shifting toward cloud services and digital apps as part of their digital transformation and accumulating ever-increasing data sets. Some of the most common data compliance regulations include the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA) and the California Consumer Privacy Act (CCPA).

Join this webinar to explore practical strategies for operating and governing AI agents responsibly at scale, with expert insights on observability, risk management and accountable AI operations. Learn how to turn governance and security into drivers of resilience, smarter decision-making and confident growth with practical strategies from this buyer’s guide. Download the guidebook to learn how to move beyond recovery assumptions and build greater confidence in your organization's ability to recover when it matters most. Even if a third-party service is involved in credit card transactions, the company remains responsible for PCI-DSS https://exomedx.com/privacy-policy?noamp=mobile compliance and must take the necessary measures to manage and store cardholder data securely.

Under SOX, every publicly traded company in the United States must meet strict financial reporting and governance standards. Since the CCPA came into effect, organizations have actively reassessed their data handling processes and adopted comprehensive data protection strategies to meet compliance requirements. Under the CCPA, California residents can request details about the data collected on them by businesses, opt out of data sales, and request data deletion. Like the GDPR, it also places the onus on businesses to be transparent about their data practices and empowers individuals to have more control over their personal information. For this reason, GDPR has caused businesses worldwide to reevaluate their data collection and handling practices, emphasizing the importance of robust data security and compliance. It imposes substantial fines for those who fail to adhere to its privacy regulations and data compliance standards.