Fewer organizations affected by the Hungarian NIS2 transposition
Under the latest amendment to Act LXIX of 2024 (“Cybersecurity Act“), enterprises that qualify as large enterprises solely due to their partner or linked enterprises but do not, on their own, meet the thresholds for medium-sized enterprises are now excluded from the scope of the Cybersecurity Act.…
Japan plans to transition the regulation of crypto assets from the Payment Services Act to the Financial Instruments and Exchange Act (FIEA). The shift reflects rising retail participation and growing fraud concerns, and is anticipated to take effect around 2027.The number of crypto‑asset accounts in Japan has surpassed 13 million—roughly one in ten residents now…
In brief
Artificial Intelligence (AI) is becoming a central feature of modern corporate strategy, risk management, and organisational governance. As businesses increasingly adopt AI to enhance decision making, efficiency, and innovation, alignment with responsible practices, ethical standards, and long term value creation is required.
Existing corporate governance structures already provide a foundation for overseeing AI.…
Japan has enacted the Active Cyber Defense Law (“ACD”) — a landmark legislative framework that empowers both the public and private sectors to proactively defend against cyber threats.
This law was enacted on 16 May 2025 and will take full effect by 2027, following a phased implementation.
The ACD has four strategic pillars:
…
This article was originally published by IAPP linked here.
This “thought for the week” reflects on the geopolitical risks on global data, cyber and AI and explores what it means for organizations navigating an increasingly complex risk landscape.
I recommend a recent Bloomberg article on how increasing geopolitical risks impact the price of gold…
Heading into 2026, the intersection of technology, regulation and geopolitical dynamics will continue to reshape the global data and cyber landscape. Global businesses will face novel challenges as regulatory regimes evolve, cyber threats intensify, cross-border data flows come under greater scrutiny, and companies continue rapidly develop and deploy AI. Our top issues to watch for…
Regulations issued under the Personal Data Protection Law
In brief
More than five years after the publication of Personal Data Protection Law No. 151 of 2020 (PDPL), the government of Egypt has issued the Executive Regulations to the PDPL by virtue of Minister of Telecommunications Decree No. 816 of 2025 (“Regulations”). This significant development clarifies…
On 1 January 2026, Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) (the “Ordinance“) came into force, ushering in a new statutory regime for cyber resilience and operational continuity across essential sectors. This landmark legislation represents the city’s first comprehensive cybersecurity law tailored to safeguard critical digital infrastructure — a response to…
The UAE has taken a significant step toward safeguarding children online with theintroduction of Federal Decree-Law No. 26/2025 On Child Digital Safety (the “CDSLaw”), which came into force on 1 January 2026. In-scope entities have a one-yeargrace period to achieve compliance before the CDS Law will become fullyenforceable in January 2027. The CDS Law establishes…
On 24 December 2025, the Brazilian Data Protection Agency (ANPD) published Resolution CD/ANPD No. 30, which establishes the map of priority issues for oversight and regulatory action for the 2026-2027 biennium, and Resolution CD/ANPD No. 31/2025, which updates the regulatory agenda for the 2025-2026 biennium.
The map defines the central axes for the ANPD’s enforcement,…
