IT Security & Privacy

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable privacy statement template for small and medium-sized enterprises (SMEs) across 10 industries, along with a companion template for a processing register. The templates are voluntary guidance rather than new obligations, but they signal the regulator's baseline expectations for GDPR transparency and record-keeping. Compliance teams should note this benchmark, particularly when assessing SME customers, vendors, and counterparties in the Netherlands.

New Zealand's financial regulators have told banks and other regulated institutions to examine whether their cybersecurity arrangements are keeping pace with advances in artificial intelligence, warning that the technology is creating new problems for corporate oversight and increasing dependence on outside technology providers.

South Korea's privacy regulator received 432 data breach reports in the first six months of 2026, nearly matching the 447 recorded throughout the whole of last year. The increase has prompted a substantial overhaul of how the country intends to investigate breaches, particularly those involving companies responsible for the personal information of millions of people.

OSFI will hold its third Quarterly Release Day on September 10, 2026, followed by a virtual Industry Day on September 24, 2026. The sessions cover the final Capital Adequacy Requirements (CAR) Guideline 2027, the final crypto-asset capital and liquidity guideline, Guideline E-15 peer review expectations, AI-driven cyber threats, and Data Collection Modernization. Compliance teams at federally regulated institutions should register and prepare questions, since these topics carry near-term implementation obligations.

FinCEN issued an alert and financial trend analysis on digital asset investment scams ("pig butchering") run by Southeast Asia-based scam centers. The analysis covers 33,904 BSA reports filed between September 8, 2023, and December 31, 2025, totaling approximately USD $12.7 Billion in suspected activity. Compliance teams should update detection scenarios with the newly published red flags and strengthen SAR reporting and information sharing.

The Netherlands Data Protection Authority (Autoriteit Persoonsgegevens) has published a downloadable GDPR processing register template, plus a companion privacy notice template, for small and medium-sized enterprises in 10 industries. The templates are practical guidance rather than new law, but they signal the regulator's expectations for Article 30 recordkeeping. Compliance teams should use them as a benchmark for their own programs and for assessing SME vendors and partners.

APRA has imposed license conditions, a higher minimum liquidity requirement, and an AUD $50 Million operational risk capital add-on on ING Bank Australia Limited after the bank disclosed multi-year miscalculations that overstated its Liquidity Coverage Ratio (LCR). Reported LCR was around 160 percent, but the true figure was substantially lower and at times fell below the 100 percent minimum under APS 210. The action shows that APRA treats inaccurate prudential reporting as a governance and risk management failure, not a technical error.