Bridewell’s 2026 Guide Maps Global Cybersecurity and Privacy Regulatory Changes
Summary
Bridewell’s 2026 regulatory guide outlines global cybersecurity and privacy changes, highlighting NIS2 implementation, breach reporting, third-party risk oversight and tighter cross-border data transfer controls.
Key points
- The guide tracks enacted laws, proposals and advisory measures across the UK, Europe, the US and other jurisdictions, with differing implementation timelines.
- European coverage includes German and Portuguese NIS2 implementation and Cyber Resilience Act rules identifying important and critical digital products subject to stricter conformity assessments.
- UK coverage details phased Data Use and Access Act changes affecting complaints, international transfers and enforcement, alongside proposed resilience requirements for IT and cybersecurity providers.
- The guide reports that California’s breach notification requirements effective January 2026 include notifying affected consumers within 30 calendar days, subject to specified exceptions.
- Third-party risk oversight is a recurring theme, including NYDFS guidance calling for tailored provider risk management and Canadian proposals addressing critical systems and supply-chain risks.
- Global privacy developments include Vietnam’s comprehensive data protection law, India’s phased DPDPA rules and more structured safeguards for international data transfers.
- The guide highlights Singapore’s expanded critical infrastructure oversight and South Korean AI security guidance addressing confidentiality, integrity and availability across the AI lifecycle.
Article Details
- Publisher
- Bridewell
- Report Period
- 2026
- Scope
- Global cybersecurity, data privacy, and AI regulatory developments, including enacted requirements and proposed legislation.
- Key Statistics
- California's breach notification requirements, effective 2026-01-01, require notification to affected consumers within 30 calendar days of discovery or notification of a breach, subject to stated exceptions.
- For breaches affecting more than 500 California residents, the attorney general must be notified within 15 calendar days after affected individuals are notified.
- Vietnam's PDPL provides for fines up to 10 times illegal gains for unlawful personal data trading and up to 5% of prior-year revenue for cross-border transfer violations.
- New EU cross-border GDPR complaint rules, described as effective in February 2027, establish investigation timelines of 15 months for complex cases and 12 months for simpler cooperation proceedings.
- Under California's DELETE Act, an unregistered data broker may face a $200-per-day administrative fine, overdue registration fees, and investigation or administration costs.
- Recommendations
- For entities subject to New York third-party service provider guidance, develop tailored, risk-based mitigation plans and conduct ongoing provider due diligence.
- Maintain complete, accurate asset inventories and strengthen data retention and secure disposal controls in accordance with applicable New York cybersecurity requirements.
- For Australian Government AI procurement, embed AI impact assessment into governance, risk, and procurement workflows.
- For private-sector controllers relying on legitimate interest in Ecuador, perform a prior documented balancing assessment and meet transparency requirements.
- For organisations subject to the UK Data Use and Access Act, implement direct complaint processes for data subjects.