As we enter the second half of 2026, data protection and privacy regulators continue to focus on governance, accountability, AI oversight, and children’s online safety. As a result, across major jurisdictions, organisations are facing increased expectations around operational compliance, transparency, and risk management.
Below are the key developments from the second quarter of 2026.
Europe
The UK’s Data (Use and Access) Act 2025 introduced new complaint-handling obligations from 19 June 2026. Organisations acting as data controllers must now maintain a formal privacy complaints process, provide a dedicated complaints channel, acknowledge complaints within 30 days, and clearly explain individuals’ rights to complain in privacy notices.
The EU continued preparations for the implementation of the EU AI Act, publishing draft guidance on Article 50 transparency obligations. The guidance focuses on informing individuals when they are interacting with AI systems and ensuring AI-generated or synthetic content is appropriately labelled. Final supporting guidance and codes of practice are expected later this year.
Cybersecurity compliance also advanced under NIS2, with the Network and Information Systems (NIS) Cooperation Group agreeing common incident-reporting templates intended to simplify and harmonise reporting requirements across Member States.
The European Commission also recommended that Member States deploy privacy-preserving age-verification tools by the end of 2026, reflecting growing regulatory focus on children’s online safety.
Meanwhile, enforcement activity remains high. Spain’s supervisory authority, the AEPD, continued issuing significant GDPR fines across multiple sectors, demonstrating that fundamental compliance obligations remain a key enforcement priority.
Africa
Several African jurisdictions made notable progress in AI and data governance.
Ghana launched its National AI Strategy, a ten-year framework focused on responsible AI development, data governance, skills development, and public-sector innovation. The government is also developing a new data protection bill addressing AI, automated decision-making, and international data transfers.
In the Democratic Republic of Congo, authorities established a National Network of Data Protection Officers to support implementation of the country’s Digital Code and strengthen privacy governance across public and private sectors.
South Africa’s Information Regulator issued clarification and guidance confirming that POPIA’s direct marketing requirements continue to apply alongside the new anti-spam rules introduced under the Consumer Protection Act. Organisations engaged in direct marketing must therefore comply with both regimes.
Morocco’s data protection authority, the CNDP, released key recommendations on the protection of genomic data. The framework aims to regulate genomic data processing and prevent data mishandling as medical and research applications accelerate.
Americas
The United States continues to see significant developments at State level. From 1 July 2026, amendments to Virginia’s Consumer Data Protection Act prohibit the sale of precise geolocation data, creating one of the strictest state-level restrictions on location data processing.
Colorado also passed Senate Bill 189 into law, repealing and replacing the state’s 2024 AI Act with a narrower framework governing Automated Decision-Making Technology (ADMT) used in consequential decisions. The revised law takes effect on 1 January 2027, giving organisations a clear window in which to review their use of ADMT and align disclosures, documentation, and consumer-facing processes with the new requirements.
Across Latin America, regulators are increasingly addressing AI governance. Mexico is progressing proposals for a comprehensive AI framework that would introduce a dedicated regulator, mandatory human oversight for high-risk AI systems, and restrictions on biometric surveillance.
Argentina’s proposed data protection reform would introduce a risk-based compliance framework, strengthen individual rights, and establish new rules governing AI-related processing activities.
In Canada, the federal government has launched consultations on reforming the Privacy Act, including proposals to strengthen protections relating to automated decision-making and recognition of privacy as a fundamental right.
Brazil’s data protection authority also continued its work on age-assurance requirements, publishing preliminary guidance supporting privacy-preserving age verification mechanisms.
Asia-Pacific
Children’s online safety emerged as a major regulatory theme across the region.
Malaysia’s Child Protection Code came into force on 1 June 2026, requiring covered online service providers to implement age-verification measures and stronger protections for children online. New obligations around harmful content management, advertiser verification, and synthetic media labelling have also been introduced.
South Korea expanded its Privacy by Design certification programme, reinforcing expectations that privacy and security controls be embedded throughout product and service development lifecycles. Regulators are increasingly scrutinising cloud providers, SaaS platforms, and large-scale data processors.
Japan approved amendments to its privacy legislation, strengthening protections for biometric data and enhancing enforcement powers, while China introduced additional standards and regulations affecting AI-enabled systems, electronic records, and data security obligations.
New Zealand’s new Information Privacy Principle 3A entered into force in May, requiring organisations to notify individuals when personal information is collected indirectly, subject to limited exceptions.
Priorities and practical steps to take now
For organisations operating across multiple jurisdictions, the most immediate compliance pressures stem from the UK’s new complaint-handling requirements, emerging AI governance obligations under the EU AI Act, growing regulatory expectations around age assurance and child safety, and increasing scrutiny of cybersecurity governance under frameworks such as NIS2.
As such, recommended focus areas and a practical action plan as we move into the second half of 2026 would be:
- AI governance and transparency: assess AI systems against emerging transparency and governance requirements, including US state-level ADMT obligations
- Children’s data and age verification: review age verification and child protection controls where services are accessible to minors
- Complaint handling and data subject rights: ensure UK complaint-handling procedures are fully operational and reflected in privacy notices
- Cybersecurity and third-party risk management: confirm incident reporting, vendor oversight, and cybersecurity governance arrangements are aligned with evolving regulatory expectations
At HewardMills, we help clients stay ahead of evolving regulations by continuously monitoring the data protection and privacy landscape. Acting as an external, independent Data Protection Officer (DPO), we help assess regulatory exposure, strengthen governance frameworks, and respond confidently to complex, evolving compliance obligations.
If your organisation needs support, our team is here to help. Get in touch today.
