- NIS-2 has a broad extra-territorial reach, and many organizations providing digital or infrastructure services into the EU may be in scope without having assessed their position.
- Non-EU organizations (including US-based businesses) may therefore be unaware that they are in scope
Active Enforcement of Saudi Arabia Privacy Regime: Implications for Businesses
Organizations should prioritize compliance efforts in light of mounting regulatory scrutiny and potential fines.
By Brian A. Meenagh, Danielle van der Merwe, and Faisal Imam*
The Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) is now firmly in its active enforcement phase. The one-year grace period granted to organizations to achieve compliance ended on September 14, 2024, and the Saudi Data and Artificial Intelligence Authority (SDAIA) has moved from awareness-building and guidance to regulatory action. Businesses operating
China’s CAC Announces New Cybersecurity Incident Reporting Measures
The measures, which take effect on November 1, 2025, position China with one of the more rigorous cybersecurity incident notification regimes in Asia.
By Hui Xu, Rhys McWhirter, and Bianca H. Lee
The Cyberspace Administration of China (CAC) issued the Measures on National Cybersecurity Incident Reporting (the Measures) on September 11, 2025. The Measures will take effect on November 1, 2025, establishing a comprehensive framework for the classification, reporting, and management of cybersecurity incidents within the People’s Republic
Cybersecurity Regulation in Flux as Trump Administration Focuses on Evolving Foreign and Tech Threats
The administration has signaled a potential softening of cyber regulation for domestic entities, with increasing focus on national security priorities and preparing for the future.
By Antony (Tony) Kim and Michael H. Rubin
The Trump administration’s focus on reshaping the cyber regulatory environment continues with executive order 14306, “Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144” (EO 14306), which was released on June 6, 2025, and issues sweeping amendments
Data Protection Compliance Audits to Take Effect in China in 2025
The Measures outline requirements and procedures for self-initiated and regulator-mandated compliance audits from May 1, 2025.
By Hui Xu and Bianca H. Lee
The Cyberspace Administration of China’s (CAC’s) official release of the Measures for Personal Information Protection Compliance Audits (the Measures) marks the CAC’s commitment to implementing the compliance audit system under the PIPL, which has been in effect since November 1, 2021. There was no formal guidance on or implementation of this requirement prior to the publication of
DOJ Data Security Program: Emerging Obligations Vary by Industry, Data Sensitivity, and Corporate Structure
DOJ emphasizes need to come into full compliance with its new rule by July 8.
By Jennifer Archie, Heather B. Deixler, Clayton Northouse, Michael Rubin, Max Mazzelli, Brianna Gordon, and Kiara Vaughn
On April 11, 2025, the US Department of Justice (DOJ) released guidance regarding its final rule, known as the “Data Security Program” (DSP). The DSP, originally issued on December 27, 2024, and effective on April 8, 2025 (with certain diligence, auditing, and
DOJ Data Security Program Now in Effect: Top Takeaways
New DOJ guidance helps companies understand their obligations under the DSP, which
could severely impact investment agreements and ordinary commercial data transactions.
By Jennifer Archie, Heather B. Deixler, Clayton Northouse, Michael Rubin, Max Mazzelli, Brianna Gordon, and Kiara Vaughn
On April 11, 2025, the US Department of Justice (DOJ) released new guidance on its final rule, known as the “Data Security Program” (DSP), which went into effect on April 8, 2025. The DSP
Preparing for the European Health Data Space — Opportunities and Challenges for Europe’s Digital Future
The EU regulation designed to facilitate secondary use of clinical data for research brings benefits for health research, but also poses challenges for companies.
By Deniz Tschammler, Danielle van der Merwe, Oliver Mobasser
On 5 March 2025, Regulation 2025/327 creating the European Health Data Space (the EHDS Regulation) was published in the Official Journal of the European Union and entered into force on 26 March 2025. The European Commission also published FAQs on the European Health Data Space
Kingdom of Saudi Arabia Issues New Data Transfer Risk Assessment Guidelines
The guidelines specify the requirements for data controllers to conduct risk assessments related to the transfer or disclosure of personal data outside the Kingdom.
By Brian Meenagh, Calum Docherty, Faisal Imam,* and Ksenia Koroleva
The Saudi Data & Artificial Intelligence Authority (SDAIA) has released non-binding guidelines for assessing risks when transferring or disclosing personal data outside the Kingdom (the Guidelines). The Guidelines supplement the updated Regulations on Personal Data Transfer Outside the Kingdom (the Regulations), which were
China Clarifies Privacy and Data Security Requirements in Network Data Security Management Regulations
The Regulations, which took effect on January 1, 2025, reiterate and clarify existing requirements and introduce new ones on privacy and network data security.
By Hui Xu and Bianca H. Lee
On September 30, 2024, the PRC State Council released the finalized Regulations on Network Data Security Management (Regulations), concluding a three-year consultation process since the initial draft in 2021.
The Regulations took effect January 1, 2025, and build upon the Cybersecurity Law (CSL), Data Security Law (DSL), and Personal Information Protection Law (PIPL), which form China’s legal framework for data protection and security. The Regulations integrate common cybersecurity requirements from these laws, applying them to “network data processing activities,” which include all electronic data processed through networks.