April 2025

Data Privacy Frontline Report

April 2025

Here are key highlights from April 2025 detailing global news and regulatory updates.

US & Canada

  • California and UK data protection authorities sign a declaration to cooperate on international privacy and data protection (also in EMEA).
  • Colorado legislators propose significant changes to the Colorado Artificial Intelligence Act less than a year after it was signed into law, part of a larger shift toward prioritizing innovation.
  • US Department of Justice provides best practices for complying with the Data Security Program established to protect the sensitive data of Americans from foreign adversaries.
  • US state attorneys general form coalition to challenge the firing without cause of Commissioners from the Federal Trade Commission (FTC).
  • US senators call on the FTC to investigate companies collecting neural data using brain computer interface (BCI) technology, citing evidence that access to this data is not sufficiently restricted.
  • US National Institute for Standards and Technology (NIST) releases a draft update to their Privacy Framework so organizations can use it seamlessly with the Cybersecurity Framework.

EMEA

  • EU and Japan begin talks on extending Japan’s adequacy decision to cover academia and research data flows, as well as data flows to the public sector (also in APAC).
  • EU European Commission to propose reforms in coming weeks to simplify the GDPR and help make European businesses more competitive.
  • Israel’s data protection authority publishes draft guidance on AI and data protection compliance.
  • UAE approves the creation of the Regulatory Intelligence Office, which will be supported by an unprecedented AI-powered regulatory system.
  • UK and California data protection authorities sign a declaration to cooperate on international privacy and data protection (also in US & Canada).

Gain confidence to use and share sensitive data

Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.

APAC

  • China’s internet regulation agency releases Q&A clarifying cross-border data transfer rules and providing interpretations of how companies can comply with these rules.
  • Japan and EU begin talks on extending Japan’s adequacy decision to cover academia and research data flows, as well as data flows to the public sector (also in EMEA).
  • South Korea’s data protection authority signs a memorandum of understanding with six local governments to strengthen pseudonymized data use for purposes of AI.

LATAM

  • Brazil’s data protection authority completes inspection of companies’ compliance with data protection officer requirements under the General Personal Data Protection Law (in Portuguese).

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...

OUR SOLUTION

Value Retention

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.

Evaluating

Are you achieving intended outcomes from data?

Your Challenge

Do you need help...

OUR SOLUTION

Unbiased Results

Client Success

Client: Integrate.ai

Situation: Integrate.ai’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.

Accessing

Do the right people have the right data?

Your Challenges

Do you need help...

OUR SOLUTION

Usable and Reusable Data

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.

 

Maintaining

Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...

OUR SOLUTION

Security / compliance efficiency

CLIENT SUCCESS

Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.

 

Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...

OUR SOLUTIONS

Consent / Contracting strategy

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 

 

Planning

Are You Effectively Planning for Success?

Your Challenges

Do you need help...

OUR SOLUTION

Build privacy in by design

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.

 

Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.