REGULATORY WATCH

Moderate Guidance Announced United States (federal) · Oct 16, 2026

FFIEC Extends Regulatory Capital Reporting Collection (FFIEC 101) for Three Years

The Federal Financial Institutions Examination Council (FFIEC) announced a three‑year extension of the Regulatory Capital Reporting collection for institutions subject to the Advanced Capital Adequacy Framework (FFIEC 101). No public…

Federal Financial Institutions Examination Council (FFIEC) · Paperwork Reduction Act of 1995

High Guidance In effect United States (federal) · Oct 15, 2026 · effective Nov 24, 2026

Farm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026

The Farm Credit Administration announced an amendment to its FCA-1 system of records covering employee attendance, leave, and payroll. The amendment updates the categories of individuals and records maintained and revises the policies and…

Farm Credit Administration · Privacy Act of 1974

Moderate Guidance Published European Union · Oct 13, 2026

CEPD issues guidance on data protection challenges of smart glasses

The European Data Protection Board adopted a declaration on connected glasses and released a report outlining privacy risks. It clarifies when users act as data controllers under the GDPR and stresses that manufacturers and service…

European Data Protection Board (CEPD) · RGPD

Moderate Guidance Published France · Oct 9, 2026

CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions

The French data‑protection authority CNIL held its second Rencontres Informatique & Libertés on 29 September 2026, featuring panels on the privacy impact of connected glasses and the role of sanctions under the GDPR. The event gathered…

CNIL · RGPD

Low Guidance Published European Union · Oct 2, 2026

EDPB adopts Guidelines 04/2026 on GDPR fines and corrective powers for public consultation

The European Data Protection Board adopted Guidelines 04/2026 on the application of administrative fines and other corrective powers under the EU GDPR. The guidelines were released on September 17, 2026 for public consultation.

European Data Protection Board · General Data Protection Regulation

Moderate Guidance Announced United States (federal) · Sep 30, 2026

Commerce Department seeks input on digitizing and modernizing the National Technical Reports Library

The National Technical Information Service (NTIS) issued a Request for Information to gather stakeholder feedback on fully digitizing the National Technical Reports Library (NTRL). The agency aims to make the technical reports more…

National Technical Information Service

Moderate Guidance Proposed United States (federal) · Sep 29, 2026

Agency seeks comment on proposed information collection for protection of human subjects

The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…

Food and Drug Administration · Paperwork Reduction Act of 1995

Moderate Guidance Published United States (federal) · Sep 28, 2026

Federal Register restricts automated scraping, requires CAPTCHA and API use

The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.

Department of Defense · Privacy Act of 1974

Moderate Guidance Published United States (federal) · Sep 25, 2026

CMS re-establishes matching program with Treasury's Do Not Pay Working System under Privacy Act

The Centers for Medicare & Medicaid Services announced the re-establishment of a data matching program with the Do Not Pay Working System, administered by the Treasury's Bureau of Fiscal Service. The notice cites subsection (e)(12) of the…

U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services · Privacy Act of 1974

High Guidance In effect United States (federal) · Sep 25, 2026 · effective Oct 26, 2026

Peace Corps announces new CRM system of records (PC 38) effective Oct 26, 2026

The Peace Corps Office of Planning and Performance issued a public notice of a new system of records, the Peace Corps Customer Relationship Management (PC 38) system. The system will monitor, track, and analyze interactions with…

Peace Corps Office of Planning and Performance · Privacy Act of 1974

Moderate Guidance Published European Union · Sep 23, 2026

EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)

On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The…

European Data Protection Board (EDPB) · Digital Services Act

Moderate Guidance Published France · Sep 17, 2026

CNIL outlines its status, organization and sanction powers

The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…

CNIL · loi Informatique et Libertés

Moderate Guidance Published KE · Sep 16, 2026

Kenya publishes new guidance on cross‑border data transfers

On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…

Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation

Moderate Guidance In effect France · Sep 10, 2026 · effective Sep 1, 2026

CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026

The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…

CNIL · réforme relative à la facturation électronique

Moderate Guidance Announced Spain · Jul 28, 2026

AEPD Privacy Lab invites entities to submit projects, research and initiatives

The AEPD's Privacy Lab has opened its Novedades space for publications, research projects, calls and activities related to privacy, data protection, AI and emerging technologies. Universities, research centres, public and private…

Agencia Española de Protección de Datos (AEPD) · Genetic Information Nondiscrimination Act

Moderate Guidance Announced European Union · Jul 23, 2026

EDPB announces stakeholder event on upcoming data protection and competition law guidelines (15 Oct 2026)

The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between competition law and data protection. The event invites…

European Data Protection Board · General Data Protection Regulation

Moderate Guidance Announced Spain · Jul 23, 2026 · effective Jul 23, 2026

AEPD reopens registration for public research network on privacy and emerging technologies

The Spanish Data Protection Agency (AEPD) has reopened enrollment for its public network of research groups and projects focused on privacy and emerging technologies. The new registration phase allows groups that missed the first call and…

Agencia Española de Protección de Datos

Moderate Guidance Published Spain · Jul 21, 2026

AEPD publishes technical guidance on data accuracy and minimisation in AI processing

The Spanish Data Protection Agency (AEPD) released a technical note interpreting the GDPR accuracy and data‑minimisation principles for AI‑driven personal data processing. It provides criteria for controllers, processors and DPOs to assess…

Agencia Española de Protección de Datos · RGPD

Moderate Guidance Announced European Union · Jul 17, 2026

EDPB calls for legal basis for cross‑regulatory information sharing

The European Data Protection Board urged the European Commission to create a clear legal basis for regulators to share information across competences. It highlighted the need for stronger legislation to enable confidential information…

European Data Protection Board · General Data Protection Regulation

Moderate Guidance Announced European Union · Dec 10, 2025

EU‑US data transfers face imminent risk as US legal changes could undermine TAFPF and SCCs

The blog notes that most EU‑US transfers rely on the Transatlantic Data Privacy Framework (TAFPF) or Standard Contract Clauses (SCCs), which depend on fragile US laws and executive orders. It warns that upcoming US Supreme Court decisions…

EDPB · General Data Protection Regulation