Moderate
Proposed regulation
Announced
United States (federal) · Oct 1, 2026
HUD announces intent to establish eVMS system of records under the Privacy Act
The Department of Housing and Urban Development (HUD) issued a Federal Register notice announcing its intent to create a new Privacy Act system of records called the Enterprise Voucher Management System (eVMS). The system will manage…
Department of Housing and Urban Development (HUD) · Privacy Act of 1974
Moderate
Guidance
Announced
United States (federal) · Sep 30, 2026
Commerce Department seeks input on digitizing and modernizing the National Technical Reports Library
The National Technical Information Service (NTIS) issued a Request for Information to gather stakeholder feedback on fully digitizing the National Technical Reports Library (NTRL). The agency aims to make the technical reports more…
National Technical Information Service
Moderate
Guidance
Proposed
United States (federal) · Sep 29, 2026
Agency seeks comment on proposed information collection for protection of human subjects
The agency announced a proposed collection of information related to the protection of human subjects and Institutional Review Boards and is requesting public comment. The notice also notes that programmatic access to FederalRegister.gov…
Food and Drug Administration · Paperwork Reduction Act of 1995
Moderate
Guidance
Published
United States (federal) · Sep 28, 2026
Federal Register restricts automated scraping, requires CAPTCHA and API use
The Federal Register warns that aggressive automated scraping of its sites is limited to access via developer APIs. Human users must complete a CAPTCHA to continue, and may be asked to do so repeatedly as a security measure.
Department of Defense · Privacy Act of 1974
Moderate
Guidance
Published
United States (federal) · Sep 25, 2026
CMS re-establishes matching program with Treasury's Do Not Pay Working System under Privacy Act
The Centers for Medicare & Medicaid Services announced the re-establishment of a data matching program with the Do Not Pay Working System, administered by the Treasury's Bureau of Fiscal Service. The notice cites subsection (e)(12) of the…
U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services · Privacy Act of 1974
Moderate
Proposed regulation
Proposed
France · Sep 24, 2026
CNIL examines draft decree creating SI-Mandoline personal data system for protection of adults
The CNIL plenary session on 24 September 2026 will examine a draft decree establishing the personal data processing system "Système d’information de la protection juridique des majeurs" (SI-Mandoline). It will also consider a draft decree…
Commission nationale de l'informatique et des libertés (CNIL) · code de commerce
Moderate
Guidance
Published
European Union · Sep 23, 2026
EDPB adopts guidelines on GDPR fines and DSA interaction (17 Sep 2026)
On 17 September 2026 the European Data Protection Board adopted guidelines on the use of administrative fines by data protection authorities and finalised guidance on the interaction between the Digital Services Act (DSA) and the GDPR. The…
European Data Protection Board (EDPB) · Digital Services Act
Moderate
Guidance
Published
France · Sep 17, 2026
CNIL outlines its status, organization and sanction powers
The CNIL, created by the 1978 Loi Informatique et Libertés, is an independent administrative authority composed of a college of 18 members. Its restricted board can impose fines up to €20 million or 4 % of global annual turnover under the…
CNIL · loi Informatique et Libertés
Moderate
Guidance
Published
KE · Sep 16, 2026
Kenya publishes new guidance on cross‑border data transfers
On 8 September 2026 Kenya’s Office of the Data Protection Commissioner released detailed Guidance Notes on cross‑border data transfers. The guidance clarifies Kenya’s transfer framework, adds operational detail, and highlights differences…
Office of the Data Protection Commissioner (ODPC) · General Data Protection Regulation
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Data protection authority action
Announced
Spain · Sep 2, 2026
AEPD to host data‑protection session at XX Jornadas STIC on 24 Nov 2026
The Spanish Data Protection Agency (AEPD) will hold a dedicated data‑protection space on 24 November 2026 during the XX Jornadas STIC conference in Madrid. The event, organized by the Centro Criptológico Nacional, the Centro Nacional de…
Agencia Española de Protección de Datos
Moderate
Proposed bill
Announced
European Union · Aug 6, 2026
EU proposes Cloud and AI Development Act (CADA) to boost AI and cloud sovereignty
The European Commission released the Cloud and AI Development Act (CADA) proposal in June 2026, aiming to enhance EU competitiveness in AI and cloud technologies. The draft sets up Cloud and AI Leadership Initiatives, national AI…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Announced
European Union · Jul 30, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between data protection and competition law. The event aims to gather…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Guidance
Announced
Spain · Jul 28, 2026
AEPD Privacy Lab invites entities to submit projects, research and initiatives
The AEPD's Privacy Lab has opened its Novedades space for publications, research projects, calls and activities related to privacy, data protection, AI and emerging technologies. Universities, research centres, public and private…
Agencia Española de Protección de Datos (AEPD) · Genetic Information Nondiscrimination Act
Moderate
Guidance
Announced
European Union · Jul 23, 2026
EDPB announces stakeholder event on upcoming data protection and competition law guidelines (15 Oct 2026)
The European Data Protection Board and the European Commission will hold a remote stakeholder event on 15 October 2026 to discuss upcoming guidelines on the interplay between competition law and data protection. The event invites…
European Data Protection Board · General Data Protection Regulation
Moderate
Guidance
Announced
Spain · Jul 23, 2026 · effective Jul 23, 2026
AEPD reopens registration for public research network on privacy and emerging technologies
The Spanish Data Protection Agency (AEPD) has reopened enrollment for its public network of research groups and projects focused on privacy and emerging technologies. The new registration phase allows groups that missed the first call and…
Agencia Española de Protección de Datos
Moderate
Guidance
Published
Spain · Jul 21, 2026
AEPD publishes technical guidance on data accuracy and minimisation in AI processing
The Spanish Data Protection Agency (AEPD) released a technical note interpreting the GDPR accuracy and data‑minimisation principles for AI‑driven personal data processing. It provides criteria for controllers, processors and DPOs to assess…
Agencia Española de Protección de Datos · RGPD
Moderate
Guidance
Announced
European Union · Jul 17, 2026
EDPB calls for legal basis for cross‑regulatory information sharing
The European Data Protection Board urged the European Commission to create a clear legal basis for regulators to share information across competences. It highlighted the need for stronger legislation to enable confidential information…
European Data Protection Board · General Data Protection Regulation
