Data Privacy Frontline Report

October 2026

Here are key highlights from October 2026 detailing global news and regulatory updates.

 

US & Canada

  • California’s data protection authority proposes privacy-rule amendments clarifying how businesses must honor Global Privacy Control, a browser-based signal that automatically communicates consumers’ opt-out preferences.

  • Canada and UK renew their AI security partnership, strengthening cooperation on emerging AI risks, security standards, information sharing, resilience, evaluation methods, and technical expertise (also in EMEA).

  • US Supreme Court will consider whether the Video Privacy Protection Act applies when online businesses disclose users’ video-viewing information, potentially clarifying who qualifies as a protected “consumer” in the internet age.

  • US Department of Justice officials announce a $220 million settlement with a major automaker over allegations it sold drivers’ driving and location data to brokers without proper consent for insurance-related uses.

EMEA

  • Danish government confirms a major breach of its central citizen database, with hackers stealing names, addresses, social security numbers and other information affecting approximately eight million people.

  • Dutch data protection authority establishes a dedicated AI and algorithm supervision directorate to coordinate oversight, prepare for AI Act enforcement and market surveillance, and support responsible AI innovation.

  • EU Council of the European Union members agree on their Digital Omnibus negotiating position, retaining the GDPR’s existing definition of personal data while introducing pseudonymization standards and simplifying broader digital compliance requirements.

  • French data protection authority clarifies that reconstructing professional email addresses from publicly available online information must comply with the GDPR and may rely on legitimate interest only when specific conditions are met (article in French).

  • Ghana's data protection authority begins compliance spot checks, targeting organizations that process personal data without required registration or other statutory safeguards, with enforcement action and potential prosecution for non-compliance.

  • Lithuania's data protection authority issues guidance to help organizations assess the risks posed by personal data breaches and determine appropriate responses under GDPR requirements (article in Lithuanian).

  • Spanish data protection authority reports that data breach notifications more than doubled in the first three quarters of 2026 compared with all of 2025, prompting calls for stronger security, risk management, and third-party oversight (article in Spanish).

  • UK government research organization outlines priorities for safer frontier AI development, including stronger risk assessment, lifecycle oversight, incident response, independent evaluation, and development of voluntary technical standards.

  • UK government will consult on potentially holding technology companies liable for cyber breaches caused by insecure products, marking a possible shift from voluntary security standards toward greater legal accountability for software vendors.

  • UK and Canada renew their AI security partnership, strengthening cooperation on emerging AI risks, security standards, information sharing, resilience, evaluation methods, and technical expertise (also in US & Canada).

Gain confidence to use and share sensitive data
Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.
Watch On-Demand Now
APAC

  • Australian government is finalizing laws requiring AI companies to demonstrate effective safety systems and continually test and manage risks, drawing on regulatory approaches used in banking and aviation.

  • Malaysia plans to introduce an AI Governance Bill in early 2027, establishing a risk-based, cross-sector framework addressing AI safety, human rights, individual welfare, and oversight.

  • Singapore government board launches new AI safety initiatives, including guidance for testing agentic AI systems, accreditation for third-party AI testing firms, and a taskforce addressing AI-enabled cybersecurity threats.

  • South Korea’s data protection authority begins reviewing whether the UK provides personal data protections equivalent to Korea’s, potentially facilitating safer and simpler cross-border data transfers between the countries.

LATAM

  • Argentina considers significantly increasing fines for personal data protection violations, with proposed penalties reaching approximately US$13 million, and using inflation-adjusted units to prevent their value from eroding over time (article in Spanish).

  • Brazilian data protection authority updates 40 entries in its privacy glossary, incorporating new terminology reflecting recent regulations and promoting clearer understanding of Brazil’s data protection rules and principles (article in Portuguese).

Global

  • OECD publishes recommendations for governing sensitive brain data, calling for risk-based, context-specific safeguards, clearer regulatory responsibilities and data classifications, secure data-sharing standards, and stronger international cooperation.

  • OECD launches a global repository for privacy-enhancing technologies, providing resources on real-world use cases, policies, regulatory guidance, and emerging trends to support understanding and adoption of these technologies.