Data Privacy News: GDPR, CCPA & Privacy Law Updates

Privacy laws are changing faster than ever. New jurisdictions are enacting comprehensive data protection laws, existing frameworks are being amended, and regulators are stepping up enforcement worldwide.

This page tracks the developments that matter for businesses handling personal data. Updated regularly with regulatory changes, enforcement actions, and new requirements that affect your DSAR processes and data protection obligations.

Bookmark this page. When a new privacy law takes effect or enforcement priorities shift, check here first.

September 2026

Delaware cuts its privacy law threshold to 10,000 consumers

On 2 September 2026, Delaware's Governor signed HB 380, a sweeping amendment to the Delaware Personal Data Privacy Act that takes effect on 1 January 2027. The headline change is the applicability threshold. The law will apply to any business that controls or processes the personal data of 10,000 or more Delaware consumers, down from 35,000. Where more than 20% of gross revenue comes from selling personal data, the threshold drops to 5,000. The Governor's office calls it the lowest threshold in the nation.

The amendments go well beyond scope:

Third parties are brought in. Businesses that acquire personal data from controllers become subject to the Act, controllers must carry out due diligence on them, and a recipient that makes a legally significant decision using that data must give the consumer an adverse-action notice.
A new right to see inferences. Consumers can ask whether a controller has drawn inferences about them or is profiling them, and obtain that data. They can also opt out of profiling used in decisions about loans, housing, and jobs.
Sensitive data expands to include citizenship and immigration status, pregnancy status, neural data, financial account credentials, government ID numbers, and any inference that reveals a sensitive category. Selling sensitive data is barred unless strictly necessary, and only with notice and consent.
Narrower exemptions. The GLBA entity-level exemption now covers only banks, credit unions, savings associations, insurers, and their affiliates, and the employee-data exclusion is narrowed for AI screening tools.

A companion bill, HB 381, took effect on signing and requires breach notification to the Delaware Department of Justice within 60 days.

What to do: Re-run your applicability check against the 10,000 figure. Many mid-size e-commerce and SaaS businesses will be newly in scope and need a working consumer-rights process, a way to disclose inferences, and updated vendor contracts before 1 January 2027. See our Delaware guide.

Irish DPC fines the HSE €645,000 over records it could not secure or find

On 2 September 2026, Ireland's Data Protection Commission announced a €645,000 fine against the Health Service Executive following a two-year inquiry into how it stored paper records. Investigators found patient files in disused bathrooms and cubicles, a shipping container in a turf shed, and derelict buildings, with documents damaged by mould, water, rubble, and animal droppings.

The fine breaks down as €300,000 for security failures under Articles 5(1)(f) and 32, €300,000 for breaching the storage limitation principle in Article 5(1)(e), €30,000 for notifying the breach late, and €15,000 for failing to tell affected individuals. The DPC also ordered the HSE to audit every paper storage facility, remove records from unfit sites, destroy records it no longer needs, and implement tracking systems.

The storage limitation penalty is the part to note. Half the fine was for keeping records with no retention justification at all, not for the conditions they were kept in.

What to do: Your retention policy has to cover paper and archived records, not just live systems. If you cannot locate a record, you cannot answer a subject access request about it, and you cannot tell a regulator what was exposed in a breach. See what personal data do you hold for how to build the inventory.

California: deletion-rights bill heads to the Governor as broker enforcement continues

California's SB 923 passed the Assembly 49 to 14 on 26 August after a unanimous Senate vote in May, and now sits with the Governor, who has until 30 September 2026 to sign or veto. If signed, it takes effect on 1 January 2027 and extends the CCPA right to delete to personal information collected "from or about" the consumer, which pulls in data bought from brokers and other third parties. Businesses would be allowed to keep only a record of the request and the minimum data needed to stop re-collecting the same information. Online-only businesses with a direct customer relationship would also have to offer a web form or portal for privacy requests, not just an email address.

Meanwhile the California Privacy Protection Agency, now branding itself CalPrivacy, kept up its data broker enforcement. On 1 September it fined SalesIntel Research $36,400 for late registration, and on 3 September it issued an enforcement advisory warning brokers that inaccurate registry entries (request metrics, data types, recipients) carry exposure of $200 per day.

What to do: If SB 923 becomes law, your deletion workflow has to reach enriched and purchased data, so start mapping third-party data feeds now. See our CCPA right to delete guide. Registered brokers should correct their registry entries before the next filing.

August 2026

Dutch regulator fines Uber €825 million for automated driver deactivations

On 21 August 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Uber €824,990,000, the second-largest GDPR fine ever, for deactivating drivers' accounts through fully automated decisions with no meaningful human review. Between 2018 and 2022, Uber's software temporarily blocked drivers on suspicion of fraud and permanently deactivated them for persistently low ratings, without a person reviewing the decision before it took effect and with no effective way for drivers to contest it.

The decision rests on Article 22 GDPR, which prohibits decisions based solely on automated processing where they have legal or similarly significant effects, together with the transparency duties in Articles 13 and 14. The regulator's reading of "human intervention" is the important part. It has to be a real power to overturn the algorithm's decision, actually exercised, not a formality applied after the fact. As the AP's deputy chair put it, "A computer should not make decisions on its own that have major consequences for you." The case began with complaints from 171 French drivers in 2020 and was handled under the one-stop-shop mechanism with France's CNIL participating. Uber says it will appeal, which suspends payment. The Dutch DPA's announcement is the primary source, and Pearl Cohen's summary covers the detail.

What to do: List every decision your systems make about people without a human in the loop: account suspensions, credit decisions, hiring screens, fraud blocks. For each one that has a significant effect, add documented human review with the power to overturn, tell people it is happening in your privacy notice, and give them a route to contest it. See our guide to automated decision-making rights.

California's DROP goes live for brokers, and the first Delete Act fines land

From 1 August 2026, every data broker registered in California must process deletion requests submitted through the state's Delete Request and Opt-Out Platform (DROP), the one-stop deletion mechanism created by the Delete Act. Consumers have been able to sign up since January. By 25 August, the CPPA reported that more than 500,000 Californians had signed up, 654 brokers were registered, and about a quarter of them had already reported processing, deleting "tens of millions" of records.

Enforcement followed within days. On 11 August, the agency ordered LocateSmarter LLC to pay $116,490, the first action under both the CCPA and the Delete Act. The Iowa broker had registered late and demanded partial Social Security numbers and mailing addresses before honouring opt-outs, breaching the CCPA's data-minimisation rules. The board imposed the fine "even though a mere handful of consumers submitted requests." Two days later, Boston-based Cybba, Inc. was ordered to pay $52,400 for missing its 2025 registration deadline. The board has also voted to raise the annual registration fee from $6,000 to $9,500 from January 2027.

What to do: Check whether you meet California's data broker definition (you sell personal information about consumers you have no direct relationship with). If you do, register, log into DROP at least every 45 days, and strip unnecessary identity checks from your opt-out and deletion flows. Ask only for what you need to match a record. See our guide on DSAR identity verification for where the line sits.

Australia releases the second tranche of Privacy Act reforms for consultation

On 31 August 2026, the Attorney-General's Department published an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 with submissions due by 18 September 2026. This is the long-promised second tranche following the December 2024 reforms. The draft would:

Replace the current collection rule with a "fair and reasonable" test covering all collection, use, and disclosure, weighing reasonable expectations, data minimisation, genuine choice, and the best interests of children.
Redefine consent as voluntary, informed, current, specific, and unambiguous. Bundled or stale consents would not count.
Introduce a right to erasure, but only against "large digital platforms" (A$500 million or more in revenue, or 2.5 million or more Australian users), with exceptions for legal retention and technical infeasibility.
Cut the data breach notification window to the OAIC from 30 days to 72 hours.
Expand sensitive information to include genomic data and precise geolocation, and require consent plus a simple unsubscribe for direct marketing.

What the draft does not do matters just as much. The small business exemption for businesses with turnover under A$3 million survives, with only a tightening of the carve-out for small businesses that trade in personal information, and the employee records exemption is untouched. No commencement date has been published. Johnson Winter Slattery has a detailed breakdown.

What to do: If you handle Australian personal information, consider making a submission by 18 September. Start mapping your consent records, marketing flows, and breach response plan against the 72-hour clock. See our Australian Privacy Act guide and reforms timeline.

Canada's Privacy Commissioner takes Google to court over de-listing

On 28 August 2026, the Office of the Privacy Commissioner of Canada filed an application in the Federal Court seeking a binding order against Google under PIPEDA. The underlying investigation, concluded a year earlier, found that Google contravened the Act by continuing to display certain news articles when the complainant's name was searched. The Commissioner's position is that Canadians have a right to have information de-listed from name searches in limited circumstances, and that Google's refusal to act on the findings leaves court enforcement as the only route.

De-listing removes results from searches of a person's name only. The source articles stay online. The case is being fought under the existing PIPEDA while Bill C-36, which would replace it, sits at second reading with no activity over the summer recess.

What to do: If your business indexes, republishes, or aggregates personal information, have a documented process for assessing erasure and de-listing requests on their merits rather than refusing by default. See our guides to the right to erasure and PIPEDA access requests.

July 2026

Connecticut's privacy law expands: thousands more businesses now in scope

On 1 July 2026, sweeping amendments to the Connecticut Data Privacy Act (CTDPA), enacted as Public Act 25-113 and signed on 24 June 2025, took effect, widening both who must comply and what the law protects.

The headline change is a lower applicability threshold. Businesses that control or process the personal data of 35,000 or more Connecticut consumers now fall within scope, down from 100,000. That single change pulls a large tranche of mid-size businesses into the regime for the first time, and many of them have never had to run a consumer data-rights process.

Other changes now in force, per the Connecticut General Assembly bill record:

Neural data (information generated by measuring the activity of an individual's central nervous system) is now "sensitive data", joining biometric, health, and other special categories that require stricter handling.
Expanded minors' protections and new obligations around profiling and automated decision-making, with a related impact-assessment requirement following on 1 August 2026.

What to do: If you handle personal data of Connecticut residents, re-check whether the lower 35,000 threshold now brings you into scope. If it does, you need a DSAR and consumer-rights process that can handle access, correction, deletion, and opt-out requests within the CTDPA's deadlines. See our US jurisdiction guides for state-by-state details.

June 2026

UK data protection complaints regime now in force

From 19 June 2026, the new statutory complaints-handling rules under the Data (Use and Access) Act 2025, commenced by the Commencement No. 6 Regulations, apply to all UK controllers. Organisations must now operate a formal process for handling data protection complaints, and individuals are expected to raise a complaint with the controller before they can escalate it to the Information Commissioner's Office.

Key requirements for controllers, per the ICO's complaints-handling guidance:

Provide an accessible way to complain. Accept complaints however they arrive, and tell people about their right to complain in your privacy notice and when you respond to a rights request such as a DSAR.
Acknowledge within 30 days and investigate without undue delay, keeping the complainant informed of progress and of the outcome.

This sits directly alongside your DSAR process: the same teams that field subject access requests will now receive, and have to log, data protection complaints.

What to do: Publish a written complaints procedure, give people at least one easy way to submit a complaint, update your privacy notice to flag the right to complain, and make sure complaints are recorded end to end. See our DUA Act 2025 DSAR changes guide.

May 2026

EU "Digital Omnibus" advances: GDPR simplification on the table

The European Commission's Digital Omnibus, tabled on 19 November 2025, continued through the EU legislative process, with the Council and Parliament reaching a provisional agreement on the package's AI provisions on 7 May 2026. The data protection elements remain under negotiation and are not yet law.

For privacy teams, the most consequential, and most contested, proposal is a change to the definition of personal data: information would not count as personal data for a particular organisation where re-identification is not "reasonably likely," judged on legal access, technical capability, cost and incentives. The package also proposes widening the exemption from records-of-processing obligations for smaller, lower-risk organisations.

The EDPB and EDPS have publicly urged co-legislators not to adopt the personal-data definition change, warning it goes well beyond a technical fix and would significantly narrow the scope of the GDPR.

What to do: Nothing changes today. Don't assume any data falls outside the GDPR on the strength of this proposal. The definition change is unsettled and faces strong regulator opposition. Track the file before adjusting any processing decisions.

March 2026

EDPB targets transparency in 2026 coordinated enforcement

The European Data Protection Board announced on 14 October 2025 that the 2026 coordinated enforcement action will focus on compliance with transparency and information obligations under GDPR Articles 12 to 14. This follows the 2025 coordinated action, which targeted the right to erasure under Article 17.

Data protection authorities across the EU will be scrutinising privacy notices, collection notices, and the information provided to individuals when their data is collected. If your privacy notice is vague, outdated, or missing required information, 2026 is the year that catches up with you.

What to do: Review your privacy notice against GDPR Article 13 and 14 requirements. Ensure you are clearly disclosing purposes of processing, legal bases, retention periods, recipient categories, and all individual rights.

UK DUA Act data protection provisions now in force

A principal tranche of the data protection and privacy provisions in Part 5 of the Data Use and Access Act 2025 came into force on 5 February 2026 via the Commencement No. 6 Regulations. This includes changes to recognised legitimate interests, research processing provisions, and amendments to law enforcement data processing rules.

The requirement for controllers to implement a formal data protection complaints-handling process takes effect on 19 June 2026, twelve months after Royal Assent. Organisations subject to UK GDPR should be building their complaints procedures now.

For the full breakdown, see our DUA Act 2025 DSAR changes guide.

January 2026

Three more US states begin privacy law enforcement

Indiana, Kentucky, and Rhode Island consumer privacy laws took effect on 1 January 2026, continuing the wave of US state-level privacy legislation.

All three laws grant consumers rights to access, correct, and delete personal data, and require businesses to respond within 45 days. Indiana and Kentucky follow the Virginia/Connecticut model with a 30-day cure period for violations; Rhode Island's law is drafted differently, enforcing through the state's deceptive-trade-practices statute rather than the standard cure-period template.

If you process personal data of residents in any of these states, you need a DSAR response process that can handle requests under their specific requirements. See our US jurisdiction guides for state-by-state details.

CCPA automated decision-making rules take effect

The California Privacy Protection Agency's automated decision-making technology (ADMT) rules became effective on 1 January 2026, with a compliance deadline of 1 January 2027.

Under the new rules, businesses using ADMT must inform consumers about their use of automated decision-making and provide the right to opt out of decisions that produce legal or similarly significant effects. This is the first US regulation to create enforceable rights around automated decision-making, broadly comparable to GDPR Article 22.

See our automated decision-making rights guide for the full requirements.

November 2025

India DPDP Rules 2025 notified: phased compliance begins

India's Ministry of Electronics and Information Technology (MeitY) notified the DPDP Rules 2025 on 14 November 2025, operationalising the Digital Personal Data Protection Act 2023. The Data Protection Board of India (DPB) was constituted the same month.

Implementation is phased:

November 2025: DPB constituted and initial provisions in force
November 2026: Consent Manager registration and obligations framework opens
May 2027: Full substantive compliance required, including Data Principal rights infrastructure

Organisations processing personal data of individuals in India should be building compliance infrastructure now. See our India DPDP Act guide.

South Africa: Information Regulator ramps up enforcement

The South African Information Regulator held a media briefing on 13 November 2025 outlining enforcement activities under POPIA. Notable actions include a R5 million fine against the Department of Basic Education and a R100,000 fine against Lancet Laboratories for security compromise notification failures.

Breach notifications are surging: 1,947 security compromises were reported in the first seven months of the 2025/26 financial year, a 40% increase over the prior period.

Earlier in 2025, the Regulator introduced an e-Portal for breach reporting (from 7 April 2025) as the channel for notifying security compromises, in place of the previous email-based process.

New Zealand Biometric Processing Privacy Code takes effect

New Zealand's Biometric Processing Privacy Code 2025 came into force on 3 November 2025, with existing processors given until 3 August 2026 to comply. The Code imposes specific requirements on organisations collecting and using biometric information, including fingerprints, facial recognition data, and voiceprints.

September 2025

New Zealand Privacy Amendment Act 2025

The Privacy Amendment Act 2025 received Royal Assent on 23 September 2025, introducing a new Information Privacy Principle 3A (IPP 3A). IPP 3A requires agencies to notify individuals when their personal information is collected indirectly, from sources other than the individual themselves. The new principle takes effect on 1 May 2026.

CPPA finalises CCPA automated decision-making rules

The California Privacy Protection Agency's ADMT rules were adopted by its Board on 24 July 2025 and approved by the Office of Administrative Law on 22 September 2025. The rules create new consumer rights around automated decision-making technology and take effect 1 January 2026 (see January 2026 above).

June 2025

UK Data Use and Access Act receives Royal Assent

The Data Use and Access Act 2025 received Royal Assent on 19 June 2025, marking the most significant update to UK data protection law since the Data Protection Act 2018.

Key changes include a recognised legitimate interests framework, a codified reasonable-and-proportionate-search standard for subject access requests (with the burden on the controller to show a request is "manifestly unfounded or excessive"), and enhanced powers for the Information Commissioner.

Provisions are being commenced in stages throughout 2025 and 2026. See our DUA Act 2025 guide for the detailed breakdown.

Late 2024 to Early 2025

Australia's first tranche of privacy reforms passes

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, the first major update to Australia's Privacy Act in years. Key changes include a children's privacy code, a statutory tort for serious invasions of privacy, and automated decision-making transparency requirements (commencing 10 December 2026).

The removal of the small business exemption, which currently excludes around 2.3 million businesses (roughly 95% of all Australian businesses, those with annual turnover under AUD 3 million), was not included in this first tranche but remains agreed to in principle by the government. A second tranche of reforms addressing the exemption, updated consent definitions, and a "fair and reasonable" processing test is expected.

Update (August 2026): The second tranche exposure draft was released on 31 August 2026. It keeps the small business exemption. See the August 2026 entry above.

See our Australian Privacy Act guide.

GDPR enforcement fines exceed €7 billion cumulative

Cumulative GDPR penalties since 2018 reached an estimated €7.1 billion by end of 2025 (per the CMS Enforcement Tracker; no regulator publishes an official running total). The year's headline enforcement action was TikTok's €530 million fine from the Irish Data Protection Commission for transferring European users' personal data to servers in China.

The EU's 2025 coordinated enforcement action focused on the right to erasure under Article 17, with data protection authorities across member states conducting joint investigations into how organisations handle deletion requests.

Last updated: September 2026. This page is updated regularly as privacy law developments occur. Bookmark it and check back for the latest changes.