INTERNATIONAL 

EUROPEAN UNION

9. Guidance on Approval of Crypto-Asset Service Providers[9]

The European Securities and Markets Authority (“ESMA”) has issued guidance to help national regulators across the EU consistently approve CASP under the new MiCA regulation. ESMA treats all CASPs as high-risk due to their direct dealings with consumers and the relatively new and volatile nature of crypto markets. Therefore, regulators are expected to conduct thorough reviews before granting any authorisations.

Key points include the need for CASPs to have a real presence and decision-making power in the country where they apply, not just a shell setup. Companies must also retain full responsibility for any outsourced activities and show that their management is competent and trustworthy. Complex structures, large user bases, cross-border operations, or issuing their own tokens may increase regulatory scrutiny.

10. French Competition Authority fines Apple €150 Million over Data Tracking Practices[10]

On March 21, 2025, the Autorité de la concurrence (“French Competition Authority”) imposed a €150 million fine on Apple Inc. (“Apple”) for abusing its dominant position in the distribution of mobile applications on iOS and iPadOS between 2021 to 2023. The sanction followed an investigation into Apple’s App Tracking Transparency Framework (“ATT”), introduced in April 2021 with iOS 14.5. While the goal of enhancing user privacy was not disputed, the French Competition Authority found that Apple’s implementation of ATT was neither necessary nor proportionate. ATT created excessive complexity for third-party app publishers, particularly smaller ones, by requiring multiple consent pop-ups and limiting access to user data needed for targeted advertising. Additionally, it was noted that there is an asymmetry in how Apple treated its own apps compared to third-party apps, particularly in terms of consent requirements. Apple was not subject to the same double consent obligations until iOS 15, which was found to be unjustified and harmful to competition. The decision also reflected collaboration with France’s data protection authority – CNIL, whose expert opinions supported the conclusion that minor modifications to ATT could have ensured compliance with both privacy and competition laws. Apple is required to publish a summary of the decision on its website for 7 consecutive days.

UNITED STATES OF AMERICA

11. Virginia introduces AI Bill to ensure Accountability[11]

The Virginia General Assembly has passed the High-Risk Artificial Intelligence Developer and Deployer Act (HB 2094) (“AI Bill”) to establish accountability for AI systems that influence significant life decisions. The AI Bill aims to reduce algorithmic discrimination by setting compliance standards for entities that develop or use ‘high-risk’ AI — systems that impact areas such as education, employment, healthcare, housing, financial services, and legal determinations. The AI Bill adopts a risk-based regulatory model and designates exclusive enforcement authority to the Virginia Attorney General. Developers of high-risk AI must implement safeguards, test for bias, maintain documentation on system functionality, and provide transparency through summaries and disclosures. Deployers must ensure proper data governance, monitor outcomes, and conduct regular impact assessments.

12. SEC Clarifies Regulatory Position on Certain Proof-of-Work Mining Activities[12]

SEC clarified that certain proof-of-work (PoW) crypto mining activities—such as those used in Bitcoin mining—do not constitute the offer or sale of securities under U.S. federal law. The statement specifically addresses situations where crypto assets are earned through participation in a public, permissionless network’s consensus mechanism.

The SEC affirmed that entities or individuals who earn tokens by supporting the operation and security of such networks, in accordance with the protocol rules, are not engaging in securities transactions. This clarification provides greater regulatory certainty to miners and other stakeholders participating in PoW-based blockchain ecosystems.

13. US established Specialized Enforcement Division for AI, Blockchain and Cyber-security[13]

U.S. established the Cyber and Emerging Technologies Unit (“CETU”), aimed at addressing fraud and misconduct linked to evolving technologies. Replacing the earlier ‘Crypto Assets and Cyber Unit’, CETU brings together around 30 attorneys and enforcement experts from across the SEC’s offices. CETU will focus on identifying and addressing fraudulent schemes involving emerging tools such as artificial intelligence, social media misuse, blockchain-related misconduct, and cybersecurity violations by public issuers and regulated firms. CETU is also tasked with investigating breaches involving unauthorized access to confidential information and the compromise of retail investor accounts. The SEC emphasized that CETU’s formation supports its broader mission to protect investors, support fair capital markets, and respond effectively to the risks posed by emerging technologies. This initiative also works in tandem with the efforts of the ‘Crypto Task Force’, reinforcing the Commission’s commitment to strengthening investor trust in an increasingly digital market landscape.

14. Genetic Company’s Bankruptcy sparks Personal Data Security Concerns[14]

New York Attorney General has issued a consumer alert following genetic testing company, 23andMe Holding Co.’s (“Company”) bankruptcy filing and plans of selling. Citing concerns over the vast amount of sensitive genetic and personal data collected by the Company, Attorney General is urging New Yorkers to take immediate steps to delete their data and request the destruction of any stored DNA samples. Company collects and analyses DNA to help users trace ancestry or assess health risks. Given the potential risks involved in the sale or transfer of this sensitive data, consumers are being advised to protect their information by deleting their account and stored data. The alert also specifies the steps to delete data and withdrawing consent.

CHINA

15. Mandatory Labelling of AI Generated Content[15]

Effective September 1, 2025, China will enforce rules requiring the labelling of AI-generated content. Labelling refers to clearly marking material produced by artificial intelligence—such as text, images, audio, video, and virtual content—to show that it was not created by a human. The aim is to promote transparency, help users identify synthetic content generated by using AI, and reduce the risks of misinformation and manipulation. This places compliance obligation on AI service providers and online platforms, who must ensure proper labelling mechanisms are in place. Failure to comply may lead to regulatory consequences.

16. New Measures on Facial Recognition Released[16]

China has announced measures to set out requirements for lawful, ethical, and secure use of facial recognition technology. Data processing must have a specific purpose and necessity, use the least intrusive methods, and ensure strict data protection. Additionally, informed consent must be obtained from individuals, with parental or guardian consent required for minors (aged under 14). Data related to facial recognition must be stored locally on devices and not transmitted online unless legally permitted and with separate consent. Data retention must be limited to what is strictly necessary, and personal information protection impact assessments must be conducted in advance. The measures also prohibit using facial recognition as the sole method of identity verification when alternatives exist and ban coercion or deception in requiring individuals to use such technology. Installation in private areas like hotel rooms or restrooms is prohibited, and clear signs must be posted in public areas where the technology is used. Entities storing facial data of 100,000 or more individuals must file with provincial-level internet authorities within 30 working days. Supervisory departments are tasked with monitoring compliance, and violations will lead to legal liability as provided under the measures.

17. New Rules on Personal Information Protection Audits Released[17]

China has issued Personal Information Protection Compliance Audit Management Measures (“Measures”) providing stricter guidelines for companies handling user data. Measures clarify requirements for data audits, strengthen accountability for enterprises, and set enforcement mechanisms to ensure compliance. The Measures apply to all organizations within mainland China, excluding state organs and public authorities, and require organizations processing data of over 10 million individuals, to carry out audits at least once every 2 years. Regulatory authorities may also compel organizations to conduct external audits if significant data protection risks or large-scale data incidents are identified. Organizations processing data of over 1 million individuals must appoint a dedicated ‘Data Protection Officer’, while major internet platforms with vast user bases and complex services must set up independent oversight bodies. Audits may be conducted internally or by certified professional institutions. When mandated by authorities, audits must be completed within a set timeframe, and the resulting reports submitted for review. Professional bodies involved in such audits must maintain independence, confidentiality, and objectivity, and are prohibited from subcontracting or repeatedly auditing the same entity more than twice in a row. Violations of the Measures—either by organizations or audit firms—may attract administrative penalties or even criminal liability, depending on the severity. Authorities are also empowered to investigate complaints related to audit misconduct.

OTHERS

18. Cyber Security Law enforced in Turkey[18]

Turkey enforced the Cybersecurity Law No. 7545 (“Legislation”), marking a major step in strengthening its national cybersecurity regime. The Legislation sets out a structured framework to enhance cyber resilience by defining key obligations for institutions, regulating cybersecurity service providers, and establishing a centralized authority for oversight. A significant feature of the Legislation is the creation of a ‘Cybersecurity Authority’, tasked with risk monitoring, response coordination, certification procedures, and setting security standards. The Legislation also mandates that companies offering cybersecurity products or services must notify the authority of structural changes such as mergers, share transfers, or sales, with certain transactions requiring prior approval to ensure security oversight. Further, the Legislation imposes obligations on organizations operating in the digital space to implement appropriate safeguards, procure certified cybersecurity solutions, report incidents promptly, and comply with audits. To support these measures, equipment and materials imported for cybersecurity purposes are exempt from customs duties and associated taxes.

19. Switzerland mandates Reporting of Cyberattacks on Critical Infrastructure[19]

Effective April 1, 2025, Switzerland will require operators of critical infrastructure—such as those in energy, healthcare, transport, and communications—to report cyberattacks to the NCSC within 24 hours of detection. This mandate, introduced under the revised FAIS and the new Cybersecurity Ordinance, aims to strengthen national cybersecurity and streamline incident response. Reports must be filed if an attack disrupts essential services, results in data breaches or manipulation, or involves blackmail. Initial reports can be submitted via the NCSC’s Cyber Security Hub or by email using the official form. A detailed follow-up report must be submitted within 14 days. While the reporting obligation begins in April, penalties for non-compliance will only apply from October 1, 2025, giving entities a 6-month window to prepare. The Cybersecurity Ordinance also outlines exemptions for bodies such as the Swiss National Bank, Intelligence Services, and Law Enforcement, and details the NCSC’s responsibilities in managing and sharing cyber incident information.

20. Saudi Arabia issues Guidelines for Cross-Border Data Transfers[20]

The SDAIA has released a Risk Assessment Guideline (“Guidelines”) to assist entities comply with the Personal Data Protection Law when transferring personal data outside the Kingdom. Although, the Guidelines are not legally binding, it outlines a clear, four-phase process to assess and manage risks in cross border transfers. Under the Guidelines, entities are required to assess whether a risk assessment is required—especially when sensitive data, emerging technologies, or automated decision-making are involved. Entities must describe the service, map the full data lifecycle (from collection to deletion), and identify risks and impacts on individuals. If personal data is being transferred, especially on a large scale or if it involves sensitive information, entities must evaluate the legal safeguards in the receiving country and ensure they match Saudi standards. Entities also need to assess whether the transfer could affect the vital interests of the Kingdom, such as national security or economic stability. The Guidelines emphasizes that if serious risks remain—even after safeguards—organizations should reconsider or modify their data processing methods. It also requires special attention to individuals with limited legal capacity and encourages a careful review of all countries, systems, and recipients involved in the data transfer.

21. Singapore issues Advisory Guidelines for Data Centres [21]

The IMDA has issued Advisory Guidelines for Resilience and Security of Data Centres (“Guidelines”). The Guidelines apply to all data centres operating in Singapore, regardless of their size or tier classification, and are intended to promote best practices for enhancing operational resilience, business continuity, and cybersecurity. Data centre operators are advised to identify and mitigate risks such as power failures, cooling disruptions, cable damage, fire, water leaks, and unauthorised access. Regular maintenance, monitoring systems, and physical safeguards are recommended. Further, a Business Continuity Management System based on a Plan-Do-Check-Act framework must be implemented. This includes conducting risk assessments, business impact analyses, and continuity planning, as well as appointing a senior management representative to oversee resilience and security. Additionally, the data centre operators are encouraged to establish an Information Security Management System and adopt recognised standards such as ISO/IEC 27001 or the CSA Cyber Trust Mark. Key measures include incident response plans, penetration testing, internal audits, employee training, and vendor risk management. The Guidelines not legally binding but are intended to complement existing regulatory requirements and industry standards. IMDA encourages data centre operators to adopt these practices to strengthen their security posture and ensure continuous, reliable service.