Cross-border data transfers to China are moving back into the European regulatory spotlight. Ireland’s Data Protection Commission (DPC) has launched a formal GDPR investigation into Shein over the transfer of European user data to China. Key Focus Areas • Whether…
Two Chinese State Council decrees entered into force on April 7, 2026 — with no transition period, no grace period, and no implementing guidelines. For any organization subject to EU law that maintains commercial relationships with Chinese entities, these regulations…
Two Chinese State Council decrees. No transition period. No implementing guidelines. Immediate effect. If your organization is subject to NIS2, the CRA, or GDPR — and you have Chinese suppliers or processors — you are now operating inside a structural…
South Korea just delivered a clear signal: data retention failures + weak security + delayed response = one enforcement event The Personal Information Protection Commission (PIPC) fined matchmaking company Duo after a cyberattack exposed 420,000+ users’ data, including highly sensitive…
Brazil’s Federal Medical Council has issued Resolution No. 2.454/2026, creating a mandatory AI governance framework for medical use—without waiting for a national AI law. What’s Enforced • Binding compliance scope: Covers AI across research, development, deployment, auditing, and monitoring in healthcare…
Not just policy, but penalties-backed control over data value. What’s Happening Two bills advancing in parallel: • National Digital Economy & E-Governance Bill (AI governance) • Digital Sovereignty & Fair Data Compensation Bill (data localisation + economic control) Key Enforcement Signals • Fines…
AI training startup Mercor is facing five contractor lawsuits in a single week following a recent data breach—before any regulator has formally stepped in. What Happened • Company: Mercor (AI training data platform) • Legal exposure: 5 lawsuits filed within days • Data…
A Danish court has fined a public authority DKK 500,000 for failing to remediate a known security vulnerability — marking a clear enforcement signal on operational security. The ruling by Vestre Landsret clarifies when data controllers are held liable under…
A recent Reuters report reveals that the U.S. has instructed diplomats to actively oppose foreign data localization and sovereignty initiatives—elevating data governance into a coordinated diplomatic priority. Why it Matters Two competing models are hardening: • Open data flows (U.S.)…
If you think compliance risk sits only in cybersecurity… you’re already exposed. In March, Intesa Sanpaolo was hit twice by the Garante per la protezione dei dati personali—for very different failures, but with a single underlying message: 1. Strategic failure:…
