The Measures outline requirements and procedures for self-initiated and regulator-mandated compliance audits from May 1, 2025.
By Hui Xu and Bianca H. Lee
The Cyberspace Administration of China’s (CAC’s) official release of the Measures for Personal Information Protection Compliance Audits
The first updates to the COPPA Rule since 2013 impose new obligations for sharing children’s personal information with third parties.
By Jennifer C. Archie, Marissa R. Boynton, Michael H. Rubin, Molly O’Malley Clarke, and Elizabeth Yin
DOJ emphasizes need to come into full compliance with its new rule by July 8.
By Jennifer Archie, Heather B. Deixler, Clayton Northouse, Michael Rubin, Max Mazzelli, Brianna Gordon, and Kiara Vaughn
On April
New DOJ guidance helps companies understand their obligations under the DSP, whichcould severely impact investment agreements and ordinary commercial data transactions.
By Jennifer Archie, Heather B. Deixler, Clayton Northouse, Michael Rubin, Max Mazzelli, Brianna Gordon
The draft law proposes a data embassy ecosystem and comprehensive framework in Saudi Arabia, promoting its position as a global AI hub.
By Brian Meenagh, Ksenia Koroleva, and Faisal Imam*
On April 14, 2025, Saudi Arabia’s Communications,
The EU regulation designed to facilitate secondary use of clinical data for research brings benefits for health research, but also poses challenges for companies.
By Deniz Tschammler, Danielle van der Merwe, Oliver Mobasser
On 5 March 2025, Regulation
The guidelines specify the requirements for data controllers to conduct risk assessments related to the transfer or disclosure of personal data outside the Kingdom.
By Brian Meenagh, Calum Docherty, Faisal Imam,* and Ksenia Koroleva
The Saudi Data
Advocate General Spielmann opines that personal data can be pseudonymous in the hands of one party and anonymous in the hands of another.
By Gail Crawford, Fiona M. Maclean, Myria Saarinen, Tim Wybitul, Isabelle Brams,
The CJEU has decided that the maximum thresholds for GDPR fines should be calculated using the global turnover of the broader corporate group, not solely the infringing entity.
Proposals grant controllers increased flexibility for automated decision-making, provided suitable safeguards are implemented.
By Fiona Maclean, Gail Crawford, Amy Smyth, and Lorenzo Meusburger
On 23 October 2024, the UK government introduced the Data (Use and Access) Bill