NexaPulse
Subscribe

Governance and regulation

What organisations are now required to do about security and personal data, when each obligation starts, and what has happened to the ones that did not. Every entry is the issuing body’s own publication, linked to the original.

1
Deadlines ahead
9
Rules tracked
4
Enforcement actions
5
Guidance

What is coming

EverythingRulesEnforcementGuidanceUSEU
GDPR3CIRCIA1
RuleUS2026-09-03

FTC Extends Public Comment on Proposed Policy Statement Regarding Personalized Pricing

The Federal Trade Commission extended by seven days the public comment period on the proposed enforcement policy statement regarding personalized pricing . The new deadline to submit comments is Sept. 25, 2026. On Aug. 19, 2026, the Commission invited the public to submit comments electronically until Sept. 18, 2026 on the proposed policy statement related to personalized pricing. Personalized pricing refers to the use of personal data to set prices according to the amount that a company believes an individual consumer is willing to spend.

US Federal Trade Commission
RuleUS2026-08-19

FTC Seeks Comment on Enforcement Policy Statement Regarding Personalized Pricing

This release was updated on August 31, 2026 at 2:40 PM to correct an earlier error. The Federal Trade Commission today announced it is seeking public comment on an enforcement policy statement regarding personalized pricing, which is the use of personal data to set prices according to the amount that a company believes an individual consumer is willing to spend. “When consumers see a listed price, they expect it to be same price that everyone else sees, not the retailer’s estimate of how much they are willing to pay based on their personal data,” said FTC Chairman Andrew Ferguson. “The FTC does not have the legal authority to ban personalized pricing in all circumstances, but businesses that fail to tell consumers how their personal data is being used to set a price may be in violation of the FTC Act and other laws we enforce. We are seeking public input on this draft statement, which would put businesses engaged in or considering personalized pricing on notice that the Trump-Vance FTC will not hesitate to enforce the law in this space.” This is the latest in a series of actions by the Commission, under President Donald Trump’s leadership, against businesses that mislead consumers

US Federal Trade Commission
RuleUS2026-07-16Proposed Rule

Request for Information; Clinical Laboratory Improvement Amendments of 1988 (CLIA) Regulations

Clinical laboratory testing technology has advanced significantly since the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations were implemented in 1992. This request for information (RFI) seeks input from the public regarding various topics related to the CLIA regulations, including: breath testing; laboratory processes and procedures; emergency preparedness, biosafety and biosecurity, and cybersecurity; and specialty testing areas. Responses to this RFI may be used to help inform CMS and the CDC as to what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking.

Health and Human Services DepartmentComments close 2026-09-14
RuleUS2026-07-06Rule

Counter-UAS Authority for State, Local, Tribal, and Territorial Law Enforcement and Correctional Agencies

In this interim final rule ("IFR"), the Department of Justice ("DOJ") and the Department of Homeland Security ("DHS") (collectively, "the Departments") codify the framework for implementing the SAFER SKIES Act, which authorizes State, local, Tribal, and territorial law enforcement or correctional ("SLTT") agencies to conduct counter-unmanned aircraft system ("C-UAS") operations. This framework governs training and certification (including a two-tiered structure for detection and warning operations and for mitigation operations), authorized technologies, spectrum coordination, airspace approval, real-time air traffic control notification, mitigation reporting, privacy protections, and compliance requirements for SLTT agencies in relation to the exercise of C-UAS authority.

Homeland Security DepartmentEffective 2026-07-01
RuleUS2026-05-26Proposed Rule

Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking

This notice announces a revised town hall meeting schedule to allow external stakeholders a limited additional opportunity to provide input on refining the scope and burden of the CIRCIA Notice of Proposed Rulemaking (NPRM) issued in the Federal Register on April 4, 2024. The proposed CIRCIA rulemaking seeks to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022, as amended, by implementing covered cyber incident and ransom payment reporting requirements for covered entities.

Homeland Security DepartmentCIRCIA
RuleUS2026-04-23Proposed Rule

Improving Customer Service and Protecting Consumers Through Onshoring

In this document, the Federal Communications Commission (Commission) proposes actions that would encourage and facilitate the onshoring of foreign call centers. Specifically, the Commission proposes rules and otherwise explore ways to improve customer service communications and better protect consumers' sensitive personal information by limiting use of foreign call centers and by improving standards applicable to a company's remaining foreign call center operations. It also seeks comment on extending these protections to modes of customer service communications other than calls, such as emails, texts, and on-line chats, and on ideas to deter scam and other unlawful calls made to the United States from foreign countries. Finally, it explore steps we can take to financially deter unlawful foreign-originated calls, such as bond requirements. The Commission proposes to apply these requirements to providers of telecommunications services, CMRS, interconnected VoIP service, cable television service, and DBS services, or affiliates of such providers. It also proposes to apply these requirements to the use of foreign call centers for consumer communications relating to internet access service offered by any of the foregoing providers or their affiliates and seeks comment on whether it should extend some or all of the proposed rules to providers of other types of services.

Federal Communications CommissionComments close 2026-05-26
RuleUS2026-04-20Proposed Rule

Concept Release on Consolidated Audit Trail and Other Audit Trails and Data Sources

The Securities and Exchange Commission (the "Commission") is publishing this concept release to solicit comments in support of a comprehensive review of the Consolidated Audit Trail and other audit trails and related data sources currently used in the regulation of U.S. securities markets, including comments regarding the funding mechanisms for these audit trails and/or related data sources. There have been several developments since the Commission last evaluated the scope and sufficiency of these audit trails and related data sources. These developments have prompted the Commission to consider whether changes should be made to the rules and regulations governing existing audit trails and related data sources to better respond to and reflect current market conditions; demonstrated regulatory needs; civil liberty, privacy, and confidentiality concerns; cost-efficient technology solutions; and cybersecurity considerations.

Securities and Exchange CommissionComments close 2026-06-22

Sources: the US Federal Register, the Securities and Exchange Commission, the Federal Trade Commission, the European Data Protection Board and the UK National Cyber Security Centre. Dates are as published and are shown in UTC. This is a tracker, not legal advice, and an obligation that applies to you is a question for your own counsel.