Here are key highlights from August 2025 detailing global news and regulatory updates.
US & Canada
- Canada’s data protection authority issues new guidance on the use of biometric technologies—such as facial recognition and fingerprint scanning—for both public- and private-sector organizations.
- Colorado lawmakers postpone the implementation of the Colorado AI Act (CAIA)—the first comprehensive U.S. law regulating high-risk AI systems—from February 1, 2026 to June 30, 2026.
- US Department of Health and Human Services (HHS) publishes guidance clarifying that Protected Health Information (PHI) may be disclosed between separate entities, provided the disclosure supports treatment activities.
- US administration launches attacks against the EU Digital Services Act and threatens to impose major tariffs on countries with digital regulations considered discriminatory toward American companies.
EMEA
- EU European Commission conducts its first review of the Digital Markets Act (DMA) to assess whether it is effectively promoting fair digital markets and to gather feedback on how it can address emerging challenges, including the rise of AI-powered services.
- Israel enacts Amendment 13 to its Protection of Privacy Law (1981), marking the most significant reform in the country’s data protection framework to date.
- UK’s data protection authority launches consultations to support implementation of the Data (Use and Access) Act 2025 (DUAA), which adds ‘recognized legitimate interest’ as a new lawful basis distinct from the legitimate interests lawful basis.
Gain confidence to use and share sensitive data
Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.
APAC
- Australia’s data protection authority declines regulatory action against a company that used patient data to train an AI model, concluding the data had been sufficiently de-identified.
- Malaysia’s data protection authority initiates a public consultation on proposed amendments to the Personal Data Protection Regulations 2013, focusing on strengthening security requirements and increasing penalties.
- New Zealand issues a Biometric Processing Privacy Code, establishing legally binding rules for the automated use of biometric technologies such as facial recognition.
LATAM
- Ecuador’s data protection authority publishes a regulation on anonymization and pseudonymization (in Spanish).
Global
- UN General Assembly adopts a resolution to establish a global scientific panel and dialogue on AI governance, emphasizing inclusive participation and alignment with sustainable development goals.