INTRODUCTION Contributed by: Christian Schröder, Orrick
Introduction to the Data Protection & Privacy Guide Legal and regulatory framework As we head into 2026, data privacy continues to be an important compliance topic, a fundamental concern for individuals, businesses and governments world - wide, as digital technologies and the increasing reli - ance on data-driven services, such as in the context of AI, have transformed how personal data is collected, processed and shared. This has brought about signifi - cant benefits, including enhanced connectivity, per - sonalised services and economic growth. However, it has also raised critical questions about the protection of personal data and individual privacy rights. In many jurisdictions, data privacy laws are built on the same core principles, such as transparency, account - ability and lawfulness. These principles are designed to ensure that individuals have control over their per - sonal data and that the organisations processing this data do so responsibly. Key elements of data privacy regulation include requirements for data security and data transfers, and the rights of individuals to access, correct and delete their data. Apart from this, a key aspect of this dynamic field of privacy protection is the constantly evolving legal landscape of data protection-related laws. The devel - opments in 2025 brought some consolidation in Europe, acceleration in the United States and Asia, and a steady rise in complex litigation. In the EU for instance, the AI Act and the EU Data Act (DA) moved from text to practice. In the United States, several new state privacy laws and amend - ments took effect on 1 January 2026, including the introduction of privacy requirements in Indiana and Kentucky. The Personal Data Protection Law (PDPL) of Vietnam came into force the same day, following its approval by the National Assembly. India’s privacy law, the Digital Personal Data Protection Act (DPDPA) which finally became effective in late 2025, governs the handling of digital personal data and sets out a comprehensive framework for its collection, process - ing and transfer. In many jurisdictions, existing regulations are being amended more frequently. In the EU, the draft EU
Omnibus regulation aims to simplify rules on data, AI and cybersecurity. Proposed amendments include the introduction of rules clarifying the use of personal data for AI training, a single EU entry point for incident reporting across the EU GDPR, NIS 2, DORA, and an extension of the notification time for data breaches. Meanwhile in the UK, the new Data Use and Access Act (DUAA) amends the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communica - tions Regulations (PECR). Similar developments can be observed in other jurisdictions as well, such as the amendments to Malaysia’s Personal Data Protection Act (PDPA) in 2024. Requirements for the use of and access to non- personal data In 2025, it became clear that data-related compliance programs can no longer ignore non-personal data. In order to enable data access and sharing, jurisdictions are increasingly enacting laws to ensure that non-per - sonal data is more accessible and usable, and that data-driven innovation is promoted. The DA establishes new rules in the EU for how users of connected products and related services can uti - lise the data they generate and how data holders can derive economic value from it. In order to address the key challenges in the digital economy, the DA aims to foster a competitive data market and promote data- driven innovation, introducing premature termination rights and the right to request support when switching to similar data processing services. With the DUAA, the UK has also started to manage non-personal data, aiming to unlock the effective use of such data. The DUAA establishes a structure for data-sharing arrangements like Open Banking (ena - bling third-party providers to access customer data at financial entities through application programming interfaces or APIs), which applies to both consumer and business data. This approach is comparable to the EU’s DA and Data Governance Act, although the DUAA does not exactly replicate the corresponding EU regulations.
7 CHAMBERS.COM
Powered by FlippingBook