Data protection and privacy regulation saw a surge of activity in the first quarter of 2026. Against a backdrop of evolving requirements and upcoming deadlines, organisations should ensure the following developments are firmly on their radar.
In the United States, Montana’s cure period expired on 1 April 2026, meaning violations of the Montana Consumer Data Privacy Act are now enforceable without any grace period. Indiana’s cure period closes on 1 July, leaving a narrow window for organisations to achieve compliance.
Across multiple states, including California, Colorado, Connecticut, and Oregon, honouring Global Privacy Control signals is now a legal requirement, not just best practice.
In the United Kingdom, the Data (Use and Access) Act 2025 reached a major milestone in February 2026 when its core provisions entered into force. The Act introduced a new ‘recognised legitimate interests’ lawful basis, strengthened the Information Commissioner’s Office (ICO) enforcement powers, and significantly raised Privacy and Electronic Communications Regulations (PECR) fines to £17.5 million or 4% of global turnover, placing cookie compliance in the same risk category as serious data security failures.
Organisations now have until June 2026 to implement a formal data protection complaint handling process, a new statutory obligation many have yet to address. The ICO is also publishing a wave of updated guidance to support compliance with new requirements in force.
At EU level, the GDPR Procedural Regulation entered into force on 1 January 2026, designed to streamline cross-border enforcement, reduce forum shopping, and introduce structured timelines for resolving complaints between supervisory authorities. The Regulation will apply to new cross-border cases from 2 April 2027.
The European Commission’s Digital Omnibus proposals are advancing through the legislative process and, if adopted, could fundamentally reshape key aspects of the GDPR, including the definition of personal data, the introduction of a legitimate interest basis for AI training, and modernised cookie consent rules.
Priorities and practical steps to take now
Recommended focus areas for organisations this month are:
- complaint handling,
- children’s data,
- universal opt-out mechanisms, and
- vendor transparency.
For businesses operating across multiple jurisdictions, these are the areas most likely to create immediate compliance pressure. Regulators are also paying close attention to automated decision-making (ADM) and operational controls, not just privacy policies.
A practical April 2026 action plan would be to review UK complaint-handling processes, update cookie and ADM workflows, confirm U.S. opt-out mechanisms are working properly, and monitor EU legislative developments.
At HewardMills, we help clients stay ahead of evolving regulations by continuously monitoring the data protection and privacy landscape. Acting as an external, independent Data Protection Officer (DPO), we help assess regulatory exposure, strengthen governance frameworks, and respond confidently to complex, evolving compliance obligations.
If your organisation needs support, our team is here to help. Get in touch today.
