The global compliance environment is shifting quickly, with some cybersecurity and privacy expectations already affecting what organizations should report, protect, and prepare for.
With the significant rise in the frequency and sophistication of attacks, more severe consequences of non-compliance, and stricter expectations from regulators, organizations now face multi-directional pressure to retune their defenses and align their security posture to compliance expectations.
Through this edition of the Journal, we will explore some of the major updates that security teams should be prepared for.
1. EU Cyber Resilience Act – The 24-hour reporting clock has started
Reporting obligations live – 11th September 2026
Under the new EU Cyber Resilience Act (CRA), manufacturers of products with digital elements must now report:
- Actively exploited vulnerabilities – early warning within 24 hours
- Severe security incidents – early warning within 24 hours
- More detailed notification – within 72 hours
The EU’s CRA Single Reporting Platform for reporting is now operational for these notifications.
If you manufacture digital products in the EU, this matters!
2. Singapore’s Personal Data Protection Act – NRIC numbers can’t be used for authentication
Phase-out deadline – 31st December 2026
Singapore’s PDPC has given private organizations until 31st December 2026 to stop using full or partial NRIC numbers as authentication credentials. From 1st January 2027, the PDPC will step up enforcement against organizations that continue using NRIC numbers.
3. GDPR – Fines are getting a more structured playbook
Adopted – consultation until 13th November 2026
A new five-step methodology has been adopted by the European Data Protection Board (EDPB) for deciding when administrative fines and other measures must be imposed.
Regulators will now consider:
Intent
(Was the violation intentional or accidental?)
Severity
(How serious was the violation? How much risk/harm did it create?)
Aggravation/Mitigation
(What makes a violation worse or less serious?)
Effectiveness/Proportionality
(Is the measure/fine effective without being excessive?)
4. GDPR – transparency is a major enforcement focus
Launched in March 2026
The EDPB has launched a coordinated enforcement action, with 25 European DPAs participating, examining whether organizations are properly telling individuals what personal data they collect, why they collect, and how it is processed (as per Articles 12, 13, and 14).
This is relevant for organizations using:
- AI
- Tracking technology
- Data analytics
- Profiling
- Data brokers
- Third-party platforms
5. California CCPA – Deletion rights are expanding
Effective – 1st January 2027
California’s CCPA has been amended through SB 923, the Expanding Privacy Rights Act. This change means organizations may have broader obligations to delete personal information obtained from third parties.
If your organization handles personal data of Californians, third-party data may still create a privacy obligation.
6. Australia Privacy Act 1988 – scope expansion
Effective – 1st July 2026
Australia expanded the scope of its Privacy Act 1988 as part of its AML/CTF framework. It now includes additional businesses, including:
- Lawyers
- Accountants
- Conveyancers
- Real-estate professionals
- Dealers in precious metals and stones
- Trust and company service providers
If your organization comes under the new coverage, your privacy obligations have changed.
7. Hong Kong’s PDPO (Personal Data Privacy Ordinance) – privacy guidance for Agentic AI
Published – August 2026
Hong Kong’s Privacy Commissioner for personal data (PCPD) has published comprehensive guidance addressing privacy risks associated with agentic AI. It also offers recommendations to organizations that use agentic AI while handling personal data.
It highlights risks like
- Excessive access
- Function creep
- Inaccurate data
- Autonomous AI actions
If your organization has deployed agentic AI, your privacy controls need to keep up with AI autonomy.
8. India’s DPDPA – new transition underway
Phased implementation – 2026 onwards
India’s Digital Personal Data Protection framework is moving from legislation to implementation. Organizations need to be prepared to meet new requirements for:
- Security safeguards
- Protecting personal data
- Retaining and deleting personal data
- Handling personal data breaches
- Consent and notices
- Data fiduciary accountability
If your organization is processing digital personal data in India, DPDP compliance should be on your roadmap.
The compliance change isn’t just for one region. It is impacting organizations globally. Here is a deadline-based summary:
Live (Jul-Sep 2026)
Already in effect
- Australia Privacy Act scope expansion
- EU Cyber Resilience Act reporting obligations
Soon (Nov-Dec 2026)
Prepare now
- GDPR – EDPB fine methodology consultation closes November 13
- Singapore NRIC authentication phase-out deadline: December 31
Next (2027 onwards)
- Build a roadmap
- California CCPA deletion changes
- India’s DPDPA implementation requirements
If you are planning to identify (and address) gaps in your security posture against applicable compliance obligations, you can start with our comprehensive security and compliance assessment.
