Covered financial institutions now face heightened expectations in relation to cybersecurity governance, risk assessment, and incident reporting.
By Jenny Cieplak, Tony Kim, Arthur Long, Clayton Northouse, Serrin Turner, Yvette D. Valdez, Deric Behar,
The final Implementing Regulations are generally business-friendly and bring the law closer to the EU GDPR.
By Brian A. Meenagh and Lucy Tucker
The Saudi Data & AI Authority (SDAIA) recently issued the final Implementing and Transfer Regulations for the
The new general data privacy laws in Oregon and Delaware expand on existing requirements under other state privacy laws.*
By Robert Blamires, Clayton Northouse, Austin L. Anderson, and Jennifer Howes
Key Takeaways:
The new framework provides an additional route for personal data transfers from the EEA to the US.
By Robert Blamires, Gail E. Crawford, James Lloyd, Clayton Northouse, Alice Brunning, Alexander Ford-Cox, and Jennifer Howes
Washington State’s landmark privacy law has inspired other states to pass similar laws with stringent requirements on a broad range of companies and processing activities.
By Heather B. Deixler, Clayton Northouse, Austin L. Anderson, Kiara E. Vaughn
The guidance encourages organisations to formulate a data breach response plan, and outlines recommendations for handling an increasing number of data breach incidents.
By Kieran Donovan and Jacqueline Van
On 30 June 2023, the Office of the Privacy Commissioner for
The California Attorney General’s investigative sweep is a potential harbinger of increased focus on employers’ data privacy compliance with respect to employee data.
By Robert Blamires, Michael H. Rubin, Joseph C. Hansen, and Kathryn Parsons-Reponte
On July
Covered companies will need to take additional steps to comply with the law in light of the new obligations relating to consumer health data and minors under 18 years old.
Florida’s law introduces novel provisions that depart from existing US state privacy laws, which businesses will need to carefully consider.
By Jennifer C. Archie, Clayton Northouse, Joseph C. Hansen, and Austin L. Anderson
Key Takeaways:
A California court has held that the regulations the California Privacy Protection Agency adopted in March 2023 may not be enforced until March 2024.
By Michael Rubin, Joseph Hansen, Austin Anderson, and Max Mazzelli
