IT Security & Privacy

The FCA has published findings from its Defence, Security, and Resilience (DSR) Lab, a joint exercise with the Ministry of Defence that tested firms' preparedness for systemic, sector-wide shocks such as satellite spoofing, subsea cable damage, and cyberattacks on critical infrastructure. While not formal guidance or a statement of regulatory obligations, the update signals growing supervisory focus on shared dependencies and national resilience, and provides a self-assessment framework compliance teams should use proactively.

A gambling operator in Croatia offered its casino customers a shortcut. Instead of producing an identity card on every visit, players could use an RFID chip or their fingerprints to identify themselves more quickly. For 34,933 players, consent to biometric processing was recorded. But when Croatia’s Personal Data Protection Agency examined how that system actually worked, it found that the operator was collecting more than it said it was collecting.

The SEC is hosting a roundtable to discuss the regulatory, operational, and infrastructure requirements necessary to transition toward 24-hour trading markets. This announcement signals an upcoming regulatory focus on market integrity, enhanced surveillance capabilities, and robust systems readiness during non-traditional hours.

Italy’s privacy regulator has fined IQVIA Solutions Italy €7 million over a database containing the health information of roughly 1 million patients, finding that data the company regarded as anonymous could, in fact, be traced back to individuals.

More than 1,000 organizations in Wales already work under the Wales Accord on the Sharing of Personal Information. What changes now is the footing beneath that work. WASPI has launched its UK GDPR Code of Conduct for Information Sharing Protocols, an Article 40 Code designed to give organizations a consistent framework for sharing personal information across health, education, social care, safeguarding, and other public services.

TikTok has agreed to pay a £12.7 million fine imposed by the Information Commissioner’s Office in 2023 after the company dropped two appeals against the UK’s data protection regulator, bringing one long-running children’s privacy case to an end and allowing another to move forward.. TikTok has separately abandoned its challenge to an information notice seeking documents and details about how it processes teenagers’ personal information through its recommender systems. The first case reaches back to TikTok’s handling of children under 13, who were not supposed to be on the platform in the first place.

New Zealand’s Privacy Commissioner has ordered Manage My Health and Health New Zealand to strengthen their handling of patient data, nine months after a cyberattack exposed weaknesses in the systems meant to protect some of the country’s most sensitive personal information. Commissioner Michael Webster issued separate compliance notices to the two organizations on September 23, following the first phase of his investigation into the December 2025 Manage My Health cyber incident. The inquiry found that, at the time of the attack, both organizations had failed to comply with security requirements under Rule 5 of the Health Information Privacy Code.