INTERNATIONAL 

UNITED STATES OF AMERICA

11. GENIUS Act enacted to regulate stablecoins^[11]

The United States enacted the Guaranteeing Essential National Infrastructure in US Stablecoins Act, commonly referred to as the GENIUS Act marking the country’s first comprehensive federal legislation governing stablecoins. The Act establishes a regulatory framework for the issuance, backing, and oversight of stablecoins pegged to the US dollar. It introduced requirements relating to reserve backing, disclosure, auditability, and operational resilience, while assigning supervisory responsibilities to federal financial regulators to oversee stablecoin issuers and related infrastructure.

The enactment of the Act reflects a significant shift in the United States’ approach to digital assets, moving from fragmented regulatory guidance toward statutory oversight. By recognising stablecoins as a critical component of national financial infrastructure, the legislation seeks to address systemic risk, consumer protection, and financial stability concerns while allowing space for innovation in digital payments. The Act is expected to influence global regulatory approaches to stablecoins and may serve as a reference point for jurisdictions considering dedicated legislative frameworks for crypto based payment instruments.

12. Eight State Privacy Laws enacted^[12]

Eight comprehensive state level privacy laws became effective across the United States, further expanding the country’s fragmented but steadily growing data protection landscape. The states include Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland, with effective dates spread between January and October 2025. These laws introduced baseline consumer rights such as access, correction, deletion, and opt out of targeted advertising and data sales, alongside obligations on businesses relating to transparency, purpose limitation, and reasonable data security safeguards.

The entry into force of these statutes underscores the accelerating momentum of state led privacy regulation in the absence of a comprehensive federal data protection law. While largely aligned in structure, the laws differ in scope, thresholds, enforcement models, and exemptions, creating a complex compliance environment for organisations operating across multiple states. The cohort reinforces the need for scalable and harmonised privacy governance frameworks capable of accommodating divergent state requirements while maintaining consistent consumer protections.

13. Video Company faced Continued Regulatory Scrutiny over Data Privacy Practices^[13]

TikTok Inc. (“TikTok”) remained under sustained regulatory and judicial scrutiny in 2025 over concerns relating to its data privacy practices, cross border data transfers, and handling of user information. Authorities in multiple jurisdictions examined whether personal data of users was being accessed or transferred in ways inconsistent with local data protection laws, particularly in the context of links to its parent entity and foreign jurisdictions. Investigations and regulatory actions focused on issues such as transparency in privacy disclosures, lawful basis for data processing, data localization commitments, and safeguards against unauthorized access to sensitive user data.

The continued focus on TikTok highlights broader regulatory unease around large social media platforms that operate across borders while processing vast volumes of personal data. For regulators, the platform has become a test case for enforcing data protection principles relating to accountability, purpose limitation, and cross border transfers in a global digital economy. The developments in 2025 signal that platform scale and popularity do not dilute regulatory expectations, and that heightened scrutiny of data governance practices for global technology companies is likely to persist.

14. New York enacted regulation to strengthen AI safety and accountability^[14]

The Governor of New York signed the Responsible Artificial Intelligence Safety and Enforcement Act, commonly referred to as the RAISE Act (“Act”) establishing a comprehensive state level framework for artificial intelligence safety. Enacted in December 2025, the Act introduced mandatory risk management and safety obligations for developers and deployers of AI systems across all scales, including requirements relating to system testing, documentation, and ongoing monitoring. A key feature of the Act is the obligation to report significant AI related incidents, including system failures, harmful outcomes, and misuse, to designated state authorities within prescribed timelines.

The Act positions New York as one of the most proactive US states in regulating AI risks through binding statutory obligations rather than voluntary guidelines. By extending safety and incident reporting requirements beyond high-risk use cases, the Act reflects a precautionary regulatory approach aimed at ensuring transparency and accountability across the AI lifecycle. The Act is expected to influence broader policy discussions at the federal and state level and adds to the growing patchwork of AI governance frameworks emerging across the United States.

15. California enacted regulation establishing unified data broker opt out mechanism^[15]

California has enacted the Delete Act (“Act”) a landmark privacy law mandating the creation of the Data Broker Requests and Opt Out Platform, commonly referred to as DROP. Passed in May 2025, the law requires registered data brokers to participate in a centralized system that allows California residents to submit a single verified request to delete their personal information held by all registered data brokers. The platform is scheduled to go live on January 1, 2026 and is intended to simplify the exercise of deletion rights that were previously fragmented across multiple entities under the California Consumer Privacy Act framework.

The Act significantly strengthens consumer control over personal data by shifting the burden of compliance from individuals to data brokers. By introducing a mandatory, state operated opt out mechanism, California has addressed long standing concerns around ineffective and repetitive deletion requests. The Act also increases accountability for data brokers by reinforcing registration, verification, and response obligations.

EUROPEAN UNION

16. Crypto regulation took full effect across EU Member States^[16]

The European Union’s Markets in Crypto Assets Regulation (“MiCA”) became fully effective across Member States during 2025, completing the transition to a harmonized regulatory framework for crypto assets not previously covered under existing financial services laws. MiCA establishes uniform requirements for the issuance, offering, and trading of crypto assets, including obligations relating to authorization, governance, disclosure, consumer protection, and operational resilience. The regulation applies to a wide range of crypto asset service providers and issuers, replacing divergent national approaches with a single EU wide regime.

The full applicability of MiCA represents a significant step toward regulatory clarity and legal certainty for the crypto industry in the European Union. By introducing consistent standards across jurisdictions, the framework aims to enhance consumer confidence, reduce regulatory arbitrage, and strengthen market integrity. For crypto businesses operating in or targeting the EU market, MiCA’s entry into full effect necessitates alignment of licensing, compliance, and risk management practices with the new harmonized requirements.

17. Council adopted procedural reforms for cross border GDPR enforcement^[17]

The Council of the European Union adopted new procedural rules aimed at expediting the handling of cross border data protection complaints under the GDPR. Adopted in November 2025, the rules seek to address long standing delays in multi-state enforcement by introducing harmonised timelines, clearer cooperation mechanisms, and structured information sharing between lead supervisory authorities and concerned national regulators. The new rules are intended to improve consistency and predictability in cross border GDPR cases, particularly those involving large multinational technology companies operating across several EU member states.

The procedural rules are expected to strengthen the effectiveness of GDPR enforcement by reducing bottlenecks in coordination and decision making. By streamlining cooperation between data protection authorities, the new rules aim to ensure faster resolution of complaints, quicker remedies for data subjects, and more timely regulatory outcomes. For organisations operating across the European Union, the changes signal a move toward more efficient and coordinated enforcement, reinforcing the importance of proactive compliance and early engagement with supervisory authorities in cross border matters.

18.  AI Act implementation advanced with new compliance milestones^[18]

EU’s AI Act, which entered into force in August 2024, saw the rollout of additional implementation milestones in 2025, activating key compliance obligations for artificial intelligence systems across the Union. During the year, governance and transparency requirements applicable to general purpose AI models were operationalised, including documentation, risk disclosure, and downstream information sharing obligations. Regulators also issued early guidance restricting certain AI uses in sensitive contexts such as employment decision making, online content moderation, website analytics, and law enforcement, reflecting a cautious approach toward high impact and intrusive AI applications.

These developments marked the transition of the AI Act from a legislative framework to an enforceable regulatory regime. By progressively activating obligations through phased implementation and guidance, the EU has sought to provide legal certainty while allowing organisations time to adapt compliance frameworks. The 2025 milestones signal increased regulatory scrutiny of general purpose and high-risk AI systems and are expected to shape supervisory priorities, enforcement strategies, and industry practices across the European digital ecosystem.

19. Enforcement of Health Data Space Regulation^[19]

EU’s European Health Data Space Regulations (“EHDS”) entered into force in March 2025, establishing a comprehensive framework for the governance, use, and sharing of electronic health data across Member States. The regulation creates a harmonized system for both primary use of health data in healthcare delivery and secondary use for purposes such as research, innovation, public health, and policy making. It introduced common standards for electronic health records, interoperability requirements, and cross border access mechanisms, while reinforcing patient rights over access, portability, and control of their health data.

A central feature of the EHDS framework is the creation of strict safeguards governing secondary access to health data, including purpose limitation, secure processing environments, and oversight by designated health data access bodies. The regulation seeks to balance enhanced data availability with strong privacy and security protections, ensuring that sensitive health information is used responsibly and lawfully. By providing greater individual control alongside regulated access for public interest uses, the EHDS represents a significant step in the EU’s effort to build a trusted and innovation friendly health data ecosystem

20. Data Act became fully applicable across the digital economy^[20]

EU’s Data Act (“Act”) became fully applicable from 12 September 2025, marking a significant milestone in the regulation of non-personal and mixed data generated by connected products and digital services. The Act established clear rights for users and businesses to access, use, and share data generated through Internet of Things devices, smart products, and related services. It also introduced obligations on manufacturers, service providers, and data holders to make such data available under fair, reasonable, and non-discriminatory terms, while setting safeguards for trade secrets, security, and interoperability.

The Act is designed to unlock data driven innovation and competition by reducing data silos and rebalancing control over industrial and machine generated data. By extending access and portability rights beyond personal data governed by the GDPR, the regulation complements the EU’s broader digital regulatory framework alongside the Digital Markets Act and Digital Services Act. For businesses operating in the EU, full applicability of the Data Act signals the need to review contractual arrangements, technical interfaces, and data governance practices to ensure compliance with the new data access and sharing standards.

21. EDPB issued guidelines on blockchain and data protection compliance^[21]

EDPB issued guidelines in April 2025 clarifying the application of GDPR to the processing of personal data through blockchain and distributed ledger technologies. The guidelines addressed the inherent tension between blockchain features such as immutability, decentralisation, and transparency and core GDPR principles including data minimisation, purpose limitation, and storage limitation. They provided interpretative guidance on identifying data controllers and processors in decentralised environments and assess the circumstances in which on chain data may qualify as personal data.

A key focus of the guidelines is on compliance by design and by default, requiring organisations to assess data protection implications at the architecture stage. The EDPB emphasises the use of off chain storage, cryptographic techniques, and governance models that enable effective exercise of data subject rights. The guidelines also highlighted the importance of conducting data protection impact assessments for blockchain based use cases involving high risks to individuals, reinforcing the need for careful design choices when deploying decentralised systems under the GDPR framework.

22. Member States faced Action over Weak Implementation of Digital Services Regulations^[22]

Five EU Member States were brought before the European Court of Justice for failure to adequately implement and enforce key obligations under the Digital Services Act (“DSA”) The proceedings were initiated by the European Commission (“Commission”), which alleged that the concerned Member States had not designated competent authorities, empowered Digital Services Coordinators, or established effective enforcement mechanisms as required under the DSA. The Commission emphasized that delayed or incomplete national implementation undermines the uniform application of platform accountability, content moderation, and systemic risk mitigation obligations across the Union.

The action underscores the EU’s commitment to ensuring that DSA operates as a harmonized and enforceable regulatory framework rather than a fragmented national regime. By invoking infringement proceedings, the Commission has signaled that Member States themselves will be held accountable for regulatory inaction, not merely online platforms. The outcome of the cases is expected to reinforce supervisory consistency and accelerate operational readiness across jurisdictions, strengthening the DSA’s role as a cornerstone of EU digital governance.

23. Italy became First Member State to enact Comprehensive National AI law^[23]

Italy became the first European Union Member State to pass a comprehensive national law regulating artificial intelligence, adopting a statutory framework that aligns with the EU AI Act while introducing additional domestic enforcement measures. Enacted in September 2025, the legislation imposes obligations relating to ethical AI use, transparency, human oversight, and risk management, with heightened restrictions on high-risk applications such as biometric surveillance, deepfakes, and AI enabled fraud. The law also established national supervisory authorities empowered to monitor compliance and investigate violations alongside EU level oversight mechanisms.

While closely aligned with the EU AI Act’s risk-based approach, the Italian law goes further by introducing national penalties and sentencing provisions for harmful or abusive AI use. This includes significant fines and potential criminal consequences in cases involving deception, identity manipulation, or large-scale societal harm.

Italy’s move signals a growing willingness among Member States to supplement EU wide AI regulation with domestic enforcement frameworks, and may influence how other jurisdictions balance harmonized EU obligations with national policy priorities in the governance of artificial intelligence.

24. Commission proposed Simplification Of Digital Regulatory Framework ^[24]

The European Commission (“Commission”)  proposed a package of measures aimed at simplifying and streamlining the EU’s digital regulatory landscape, including targeted revisions affecting the implementation of the GDPR and the AI Act. Announced in November 2025, the proposal seeks to reduce compliance burdens, particularly for small and medium enterprises and emerging technology companies, by revisiting overlapping obligations, reporting requirements, and phased implementation timelines. The Commission indicated that the objective is not to dilute substantive protections, but to improve regulatory coherence and ease of compliance across multiple digital laws.

The proposal reflects growing concern within the EU about regulatory fragmentation and compliance fatigue resulting from the rapid rollout of digital legislation. By recalibrating implementation timelines and clarifying procedural obligations, the Commission aims to strike a balance between effective digital governance and economic competitiveness. If adopted, the changes could provide operational relief to regulated entities while preserving the core principles of data protection, accountability, and risk based AI regulation underpinning the EU’s digital policy framework.

OTHERS

25. Major Data Use and Data Protection Framework Enacted in UK^[25]

The Data (Use and Access) Act, 2025 (“Act”) was enacted, formally replacing earlier legislative proposals such as the Data Protection and Digital Information Bill and marking a major overhaul of the UK’s data protection and data use framework following Brexit. The Act, which received Royal Assent on June 19, 2025, seeks to modernise the UK’s data regime by introducing reforms aimed at facilitating responsible data sharing, reducing administrative burdens, and supporting innovation while maintaining core privacy protections. It amends key aspects of the UK GDPR framework and associated data laws to enable more flexible data use across public and private sectors.

The Government has positioned the Act as a growth-oriented reform, estimating that the changes could contribute up to ten billion pounds to the UK economy over the next decade.

By recalibrating compliance requirements and promoting data driven innovation, the Act reflects the UK’s broader strategy of differentiating its post Brexit data governance model while seeking to retain adequacy status with the European Union. The legislation is expected to significantly influence how organisations manage data access, sharing, and compliance in the UK going forward.

26. Canada tightened Data Protection Rules in Hiring Practices^[26]

The Commission d’accès à l’information (“CAI”) in Quebec, Canada issued new guidance establishing stricter limits on personal data collection during recruitment. Employers may now gather only information essential to assessing a candidate’s suitability such as name, contact details, and work or academic history at the initial stage. Requests for references, medical, or background checks must be deferred to later stages and tied directly to the role’s requirements. Written candidate consent is mandatory before verifying references, qualifications, or criminal history. Employers using AI or psychometric tools must disclose their use upfront and ensure assessments remain relevant to job performance. The guidelines also restrict social media screening to professional profiles and require prompt destruction of applicant data once hiring concludes. The CAI emphasized that necessity not convenience remains the standard, and over-collection or irrelevant questioning may result in enforcement action. These rules promote fairness, transparency, and data minimization throughout the hiring process.

27. Vietnam enacted Digital Technology Law Recognising Cryptocurrency Assets^[27]

Vietnam enacted the Law on Digital Technology Industry (“Law”) in June 2025, becoming one of the first countries globally to adopt standalone legislation explicitly recognising and regulating cryptocurrency assets. The Law marked a significant departure from Vietnam’s earlier restrictive approach by providing legal recognition to digital assets and establishing a regulatory framework for their issuance, trading, custody, and use. It also addressesed broader aspects of the digital technology ecosystem, including blockchain infrastructure, digital innovation, and technology driven financial services, positioning crypto assets within a formal legal and economic framework.

The Law represents a strategic policy shift aimed at fostering innovation while introducing regulatory oversight and safeguards. By moving from prohibition to regulated recognition, Vietnam has signalled its intent to attract investment and talent in the digital asset and blockchain space while mitigating risks associated with fraud, money laundering, and market instability. The Law positions Vietnam as an emerging regional hub for digital assets and may influence regulatory approaches across Southeast Asia as jurisdictions reassess their stance on cryptocurrency and digital technology governance.