Privacy & Cybersecurity #63: EU Cyber Reporting and Regulatory Changes
Summary
A March 2026 roundup covers EU proposals to expand ENISA’s role and create a single incident-reporting portal, alongside possible NIS 2 and GDPR reporting changes and other privacy, AI and cybersecurity regulatory developments.
Key points
- The EDPB and EDPS called for clear safeguards and legal authorization for ENISA’s proposed expanded role, including handling threat-related information that may contain personal data.
- The proposed EU Single-Entry Point would let organizations submit one incident notification for routing to relevant authorities; it would not replace existing regulators or harmonize underlying reporting obligations.
- The Digital Omnibus proposal would extend the GDPR breach-notification deadline from 72 to 96 hours and narrow the trigger to high-risk breaches; it has not been adopted.
- Proposed NIS 2 amendments would make European Digital Identity Wallet and European Business Wallet providers essential entities and introduce information-reporting mechanisms for ransomware incidents.
- Oklahoma’s new privacy law, effective January 1, 2027, requires reasonable security safeguards alongside consumer data rights and other controller obligations.
Article Details
- Event Type
- Cybersecurity and data-protection regulatory developments
- Impact
- The article reports proposed and enacted measures across the EU, Poland, Sweden, and the United States. They address incident-reporting processes, cybersecurity oversight and safeguards, privacy obligations, and regulation of AI systems. Several measures are proposals or have future effective dates; the EU Digital Omnibus proposal has not been finally adopted.