Data breach notification
Data breach notification obligations for Technology, AI and Competition companies are tightening on multiple fronts simultaneously. The Federal Trade Commission has expanded its Safeguards Rule breach reporting requirements, the European Data Protection Board continues issuing binding guidance on 72-hour notification timelines under GDPR Article 33, and the Cybersecurity and Infrastructure Security Agency is pressing sector operators under new CIRCIA incident reporting rules that carry their own separate clock. Compliance teams are currently reconciling at least three overlapping notification windows across jurisdictions, each with different triggering thresholds and recipient lists.
Watch
- CIRCIA proposed rules: final rulemaking timeline and covered entity scope for tech firms
- FTC Safeguards Rule: which non-banking tech companies now fall under its breach notice trigger
- EDPB enforcement pattern on 72-hour GDPR notifications when AI systems are the breach vector
- State AG activity: California, New York breach notice laws diverging from federal floors
Recent material activity in Technology, AI & Competition
A selection of recent published briefs; this is not a complete archive.
CMA publishes determination and order in RWE appeal against GEMA rejection of CUSC modification
The CMA published its determination and order on October 19, 2026, resolving an appeal brought by RWE group companies against GEMA's May 1, 2026 decision to reject a proposed modification to the Connection and Use of Sys…
Read a full sample brief →European Commission publishes EN 18286:2026 in the Official Journal as the only AI Act QMS harmonised standard conferring presumption of conformity
The European Commission has published EN 18286:2026 in the Official Journal through Commission Implementing Decision (EU) 2026/2274, activating a presumption of conformity with the Article 17 quality management system re…
Read a full sample brief →FTC distributes $9.8 million to 65,022 consumers under June 2025 Walmart wire-transfer fraud settlement
The FTC announced on October 15, 2026 that it is sending payments totaling more than $9.8 million to 65,022 consumers harmed by Walmart's failure to stop fraud-induced wire transfers. The distribution follows a June 2025…
Read a full sample brief →Japan and South Korea AI Safety Institutes hold inaugural joint technical workshop on AI safety evaluation
Japan's AI Safety Institute (AISI) and South Korea's AI Safety Institute held a two-day joint technical workshop on October 8 and 9, 2026. The session covered AI safety evaluation methodologies, multilingual and multicul…
Read a full sample brief →CERT-In documents AI agent intrusions into Indian ICT assets and issues defensive guidance to developers and operators
CERT-In's October 15, 2026 advisory identifies AI agents as an active threat class targeting Indian information and communication technology assets. The advisory documents two categories of incidents: inadvertent overrea…
Read a full sample brief →CISA adds Fortinet path traversal vulnerability to Known Exploited Vulnerabilities catalog with October 19 federal remediation deadline
CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on October 16, 2026. The vulnerability is a path traversal flaw affecting FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, with a federal rem…
Read a full sample brief →CISA adds BeyondTrust Remote Support authentication bypass flaw to Known Exploited Vulnerabilities catalog with October 19 federal remediation deadline
CISA added CVE-2026-102764, an authentication bypass by spoofing vulnerability in BeyondTrust Remote Support, to its Known Exploited Vulnerabilities catalog on October 16, 2026. The federal remediation deadline is Octobe…
Read a full sample brief →CMA proposes to designate Microsoft with strategic market status in its business software ecosystem
The CMA published a proposed decision on October 16, 2026, provisionally finding that Microsoft meets the statutory conditions for strategic market status (SMS) designation in its business software ecosystem. Comments ar…
Read a full sample brief →CMA proposes strategic market status designation for Microsoft in UK business software and opens consultation
The Competition and Markets Authority (CMA) proposed on October 16, 2026 to designate Microsoft with strategic market status (SMS) in its business software ecosystem, opening a consultation before any final decision. The…
Read a full sample brief →Secretary of State declines to refer RedBird IMI / Telegraph Media Group merger to phase 2 on grounds transactions are no longer in progress
The Secretary of State for Digital, Culture, Media and Sport announced on 16 October 2026 that the anticipated RedBird IMI acquisition of Telegraph Media Group will not be referred to a phase 2 investigation. The stated …
Read a full sample brief →