On 17 September 2026, the European Data Protection Board (EDPB) published its final guidelines on the interplay between the General Data Protection Regulation (GDPR) and the Digital Services Act (DSA) (available here). While the GDPR regulates the processing of personal
Privacy, Cyber & Data Strategy Blog
Blog Authors
Latest from Privacy, Cyber & Data Strategy Blog
State Privacy Laws Are Moving Beyond Disclosures: What Businesses Need to Know in 2026
State privacy laws are increasingly regulating how businesses collect, use, share, and govern personal information in practice, not just what they say in privacy notices. Compliance challenges now extend beyond disclosures to areas such as digital advertising, sensitive data, consumer…
New AI Rules for Lawyers? California Codifies Attorney Obligations for the Use of Generative AI
On September 30, 2026, California Governor Gavin Newsom signed Senate Bill 574, authored by Senator Thomas Umberg, which regulates the use of generative artificial intelligence (“GenAI”) by attorneys, arbitrators, judicial officers, and alternative dispute resolution providers. The California Legislature had…
White House Secures Voluntary Industry Commitments on Independent AI Audits
On September 29, 2026, the President met with executives of several leading artificial intelligence developers at the White House. The parties announced a voluntary framework titled “The White House Accord on Super Intelligence” (the “Accord”). Under the Accord, signatories commit…
NYDFS Issues Guidance on the Million Dollar Question—How to Conduct Cybersecurity Risk Assessments Under Part 500
On September 10, 2026, the New York State Department of Financial Services (“NYDFS”) published an Industry Letter (the “Letter”) to regulated entities (“Covered Entities”) addressing what is probably the most frequently asked Part 500 question: “How to Conduct and Use…
Trump Administration Unveils New Program for Targeting Cyber Criminals
On August 12, 2026, President Trump signed a National Security Presidential Memorandum regarding Expanding Capabilities to Combat Transnational Cyber-Enabled Crime (the “Memorandum”) directing U.S. law enforcement to target and disrupt transnational criminal organizations. To accomplish this goal, the Memorandum establishes…
Connecticut Court Issues First Prompt Injection Sanctions
A Connecticut pro se plaintiff has been caught—and sanctioned for—attempting to manipulate a court he believed was relying on an Artificial Intelligence tool to reach decisions by hiding instructions directed to the tool in court filings. The court held that…
IBM’s 2026 Cost of a Data Breach Report Signals a New Era of AI-Driven Cyber Risk
IBM recently released its Cost of a Data Breach Report 2026, which highlights the changing cyber threat landscape in which artificial intelligence (AI) is accelerating how threat actors identify vulnerabilities, launch attacks, and exploit compromised systems. These trends are reflected…
European Commission Publishes New Guidelines and Code of Practice on GenAI Transparency
On July 20, 2026, the European Commission (EC) published new Guidelines on Transparency of AI-Generated Content to complement the Code of Practice on Transparency of AI-Generated Content it released on June 10, 2026. The materials arrive just weeks before the…
CMMC Phase II is Suspended, but Defense Contractors’ Cybersecurity Obligations are Not
The Department of Defense (“DOD”) has announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which were scheduled to take effect on November 10, 2026. This announcement is significant because, as we noted in our…