Security Lights the Way

Briefings

Cyber Intelligence

What changed, why it matters and what to do next. Every briefing links to the primary source and to the relevant Academy guide.

  1. Upcoming

    Privacy & data protection India

    DPDP Rules: Consent Manager Provisions Commence in November 2026

    One year after India notified the DPDP Rules 2025, Rule 4 on Consent Managers comes into force. Core Data Fiduciary obligations follow eighteen months after publication, in May 2027.

  2. Privacy & data protection European Union

    EDPB Publishes a Statement on the Data Protection Risks of Smart Glasses

    The EDPB set out preliminary, non-binding views on smart glasses: wearers, makers and app providers can all be GDPR controllers, and bystanders need clear warning when recording is possible.

  3. Enforcement European Union

    Dutch DPA Fines Uber EUR 824,990,000 Over Automated Driver Deactivations

    The Dutch data protection authority fined Uber for unlawful solely automated decision-making and weak transparency under GDPR Articles 22 and 13. Uber has appealed.

  4. Regulatory update European Union

    EDPB Adopts Guidelines 04/2026 on When to Impose GDPR Fines

    The EDPB adopted draft guidelines on when authorities should fine rather than use other corrective powers under the GDPR. Public consultation runs until 13 November 2026.

  5. AI governance European Union

    EU Adopts the Digital Omnibus on AI: High-Risk Deadlines Move to 2027 and 2028

    Regulation (EU) 2026/1744 amends the AI Act: Annex III high-risk obligations now apply from 2 December 2027 and Annex I from 2 August 2028, with changes to AI literacy and new prohibitions.

  6. Regulatory update United States

    CMMC Phase 2 Suspended Pending Programme Review

    The US Department of War suspended CMMC Phase 2 third-party certification requirements on 13 July 2026. Self-assessments, DFARS 7012 and NIST SP 800-171 Rev. 2 obligations continue.

  7. Security advisory International

    PCI SPoC and CPoC Stop Accepting New Submissions After 31 October 2026

    The PCI Security Standards Council put the SPoC and CPoC mobile payment standards into sunset. New submissions close on 31 October 2026; existing listings run to their normal expiry.

  8. Regulatory update United States

    FedRAMP 20x Moves Past Its Pilots; New Rev5 Submissions to Close in 2027

    FedRAMP says 20x is now its standard path, with certification classes A to C available and a High-impact class in development. FedRAMP plans to stop accepting new Rev5 submissions on 11 June 2027.