One Programme, Many Regimes
GDPR, UK GDPR, HIPAA, a growing list of US state laws and a fast-moving APAC region all ask for broadly the same things: know your data, assess the risk, contract your processors and justify your transfers. Organisations that build one privacy programme and map it to each regime move faster than those that chase every law separately.
AI makes this harder. Training data, automated decisions, agents and MCP integrations create new processing that traditional DPAs and DPIAs were not written for. The documents still work, but they need new clauses and new triggers.
Work through the page in order: which regimes apply to you, what is changing this year, how to map your data, the three core documents, the addendums, and a 90-day plan.
Reactive Privacy
- Chase each new law as a separate project
- DPIAs written after launch
- DPAs renegotiated for every customer
- Transfer mechanisms assumed, not tested
- AI treated as out of scope
- Regulatory change found by accident
Programme-Led Privacy
- One control set mapped to every regime
- DPIAs triggered at design stage
- One maintained DPA and addendum library
- TIAs reviewed on legal change
- AI systems inventoried and assessed
- Quarterly regulatory watch with owners
Which Regime Applies to You
Your sector decides which laws bite hardest. Start with the tile that matches your business, then layer the AI tile on top if you build or deploy AI.
Healthcare — EU & UK
Special-category health data (GDPR Art. 9, UK DPA 2018 conditions) is the highest-risk processing most organisations handle.
Healthcare — US & APAC
HIPAA for covered entities and business associates, plus state health-data laws and 42 CFR Part 2 for substance-use records.
SaaS
You are usually a processor. Customers will push their own DPAs on you.
Government / Public Sector
Public-task basis under GDPR, UK GDPR plus DPA 2018 Parts 3 and 4, federal Privacy Act and FedRAMP in the US.
AI Systems (any sector)
Training-data lawful basis and the controller or processor split are the hard questions.
Financial Services
Sector overlays sit on top of the general privacy regime.
Privacy and Data Protection Changes in 2026
Only changes to privacy and data protection law are listed. AI-specific rules are covered where they touch personal data. Where a detail could not be confirmed from a primary source it is marked for verification.
EU: Digital Omnibus — Data Track
PendingProposed GDPR changes (including the definition of personal data) and cookie rules moved into the GDPR. Still in first reading.
Where it stands
- Parliament committees tabled 1,750+ amendments
- Council could not agree a negotiating mandate
- Trilogues have not started
- Final adoption looks like late 2026 at the earliest
- Action: watch only, do not redesign around the proposal
EU–US: Data Privacy Framework
ContestedThe General Court upheld the DPF in Sept 2025. The appeal to the Court of Justice (Latombe) is pending.
What to do
- Keep SCCs as a documented fallback
- Record the appeal risk in each TIA
- Watch EO 14086 and FISA s.702 changes
- Map every US-bound data flow
UK: Data (Use and Access) Act 2025
StagedCommencing in stages. Smart Data, PECR breach alignment and ICO objectives are in force; the main UK GDPR amendments follow.
What to prepare
- Complaints-handling process due June 2026 (verify exact date)
- Legitimate interests and recognised legitimate interests
- Relaxed automated decision-making rules
- "Not materially lower" international transfer test
- Track ICO guidance as it is published
US: HIPAA Security Rule Overhaul
DelayedProposed mandatory MFA, encryption, network segmentation, annual pen tests and tested incident plans. Final rule now listed for July 2027.
What to do
- Build to the proposal now, it mostly codifies good practice
- Verify business associate safeguards
- Test the incident response plan annually
- Document a more prescriptive risk analysis
US: State Privacy Laws
In forceCalifornia ADMT, risk assessment and cyber audit rules and the Delete Act DROP platform took effect 1 Jan 2026.
New this year
- Indiana and Kentucky laws (DPIAs required)
- Rhode Island comprehensive law
- Oregon: universal opt-out, no geolocation sales
- Colorado, Texas and others: refresh the state matrix
- Run risk assessments on profiling and ADMT
India: DPDP Rules 2025
PhasedThe Data Protection Board exists. Consent Manager framework starts 12 Nov 2026. Core duties apply 12 May 2027.
2027 build list
- Plain-language notice and consent withdrawal
- Security safeguards and processor contracts
- Breach report to the Board within 72 hours
- Verifiable parental consent for children
- Significant Data Fiduciary assessments every 12 months
Australia: Privacy Act Reforms
Dates setAutomated decision-making disclosure starts 10 Dec 2026. The Children's Online Privacy Code is due for registration by the same date.
What to do
- Audit ADM systems and disclose what they decide
- Check APP 8 cross-border practices (parent and cloud)
- Treat transient processing as collection (Bunnings decision)
- Assess whether services are likely to be accessed by children
Singapore, Japan, Korea, China
VerifyOngoing amendments to breach, transfer and AI-related rules across the region.
Before relying on this
- Dated 2026 updates not yet verified
- Check each regulator's official site
- Map transfers and local representative duties
- Confirm breach-notification timelines per country
Data Mapping: Know What Your Systems Process
Every other privacy document depends on knowing what personal data you hold, where it sits, why you process it and who receives it. A data mapping exercise answers that, and its output is your ROPA (Record of Processing Activities, GDPR Art. 30). DPIAs, DPAs, TIAs, breach response and data subject requests all start from the map.
When It Applies
TriggerYou need a data map whenever you process personal data at any real scale, and almost always before any of the events below.
Typical triggers
- GDPR and UK GDPR Art. 30: ROPA required for controllers and processors (limited exemption for under 250 staff, lost if processing is regular, risky or involves special-category data)
- Building a privacy programme from scratch
- Before a DPIA, TIA or AI risk assessment
- Customer or regulator asks for your ROPA
- New system, vendor, acquisition or AI use case
- Also feeds CCPA data inventories, HIPAA risk analysis, India DPDP and Australia APP 8 transfer checks
What a ROPA Records
Art. 30The minimum fields regulators expect, and the ones customers ask for in due diligence.
Per processing activity
- Purpose and lawful basis
- Categories of data subjects and personal data
- Special-category or children's data flags
- Recipients, processors and sub-processors
- International transfers and mechanism used
- Retention period and deletion method
- Security measures and system owner
Set scope and owners
Decide which systems and business units are in the first pass, and name a privacy lead plus a data owner per system.
What it needs
- Start with HR, customer, marketing, finance and product data
- Include shadow IT and AI tools staff already use
- Agree one template and one tool (a spreadsheet is fine)
Watch for
- Trying to map everything at once
- No named owner per system
Build the system inventory
List every system that holds or touches personal data, including SaaS, internal tools, backups and AI services.
What it needs
- Pull from the IT asset list, SSO app catalogue and finance vendor list
- Note hosting location and the vendor for each system
- Flag systems with special-category data or children's data
Watch for
- Unapproved SaaS found only in the finance ledger
- Data copied into spreadsheets, email and chat
Interview owners and trace the flows
For each system, ask what data comes in, why, who sees it, where it goes and how long it stays. Record the source, the recipients and any transfer abroad.
What it needs
- Run 30-minute structured interviews, not long surveys
- Draw simple flow diagrams for the top systems
- Capture lawful basis and retention against each activity
Watch for
- Owners describing the policy, not the practice
- Missing downstream sharing with vendors
Turn the map into the ROPA and risk register
Convert findings into Art. 30 records, then use them to trigger DPIAs, TIAs and DPA reviews where the data is high risk or leaves the region.
What it needs
- One row per processing activity
- Link each row to its DPA, DPIA and TIA references
- Flag gaps: no lawful basis, no retention, unknown vendor
Watch for
- A ROPA that is never updated
- Not connecting it to change management
Keep it current
Make updates part of normal change control so the record stays true without a yearly scramble.
What it needs
- Trigger an update for any new system, vendor or AI use case
- Review high-risk entries quarterly and the rest annually
- Report coverage and gaps to leadership
Watch for
- Annual refresh only
- No owner accountable for accuracy
Treat the map as a living record, not a project. The first pass is imperfect by design: start with your highest-risk systems, ship a usable ROPA, then improve it as DPIAs and vendor reviews surface what you missed.
DPA, DPIA and TIA: What Each Needs
Three documents carry most of the privacy compliance load. Get these right and most customer and regulator questions have an answer.
DPA — Data Processing Agreement
The contract that makes a processor relationship lawful. One template, maintained, beats a new negotiation each time.
What it needs
- Subject matter, duration, nature and purpose of processing
- Processing on documented instructions only
- Confidentiality and security measures
- Sub-processor flow-down with change notice
- Assistance with data subject rights and DPIAs
- Breach notice, deletion or return, audit rights
- US add-on: CCPA service-provider clauses
Watch for
- Breach clock the ops team cannot actually meet
- No sub-processor list or change process
- Audit rights that block your own SOC 2 or ISO reports
- Missing processor duties for India and Australia
DPIA — Data Protection Impact Assessment
Required for high-risk processing: large-scale health data, profiling, monitoring and new technology such as AI. California and new US states now require comparable assessments.
What it needs
- Describe the processing and data flows
- Test necessity and proportionality
- Assess risks to individuals
- Record mitigations and residual risk
- DPO input; consult the regulator if risk stays high
- AI add-ons: training-data provenance, drift, human review, explainability
Watch for
- Treating it as a one-off document
- Doing it after the system is built
- No link to the AI Act or ADMT risk assessments
TIA — Transfer Impact Assessment
Evidence that personal data leaving the EU or UK stays protected. Needed alongside SCCs, the UK IDTA or Addendum, and BCRs.
What it needs
- Map the transfer and choose the mechanism
- Assess destination law and government access
- Add supplementary measures: encryption with your own keys, pseudonymisation
- Document DPF reliance and the fallback
- Re-review on a schedule and on legal change
Watch for
- DPF appeal still pending at the Court of Justice
- UK "not materially lower" test is coming
- Remote access counts as a transfer
Addendums by Context
The base DPA is the same. What changes is the layer on top, driven by the type of system and the data it handles. These cover the US, UK and EU, and APAC.
AI Systems Addendum
Highest scrutinyThe clauses most customers now ask for, and most vendors do not yet have.
Include
- Controller or processor role stated per use case
- No training on customer data without explicit permission
- Model and sub-processor disclosure
- Human oversight and output-accuracy commitments
- Deletion that covers embeddings and fine-tunes
- Incident notice for model-related leaks
SaaS Addendum
StandardThe standard DPA plus a security schedule.
Include
- Security schedule referencing SOC 2 or ISO 27001
- Sub-processor change process with objection right
- Audit-rights compromise: reports first, on-site last
- Exit and deletion timeline
- Regional transfer terms (SCCs, UK Addendum)
Healthcare Addendum
RegulatedLayered on top of the DPA wherever health data is processed.
Include
- HIPAA Business Associate Agreement in the US
- GDPR Art. 9 safeguards in the EU and UK
- Minimum-necessary access
- Breach notice shorter than the regulatory clock
- Ban on secondary use and re-identification
Government Addendum
Procurement-ledPublic bodies bring their own terms; know what to expect.
Include
- Data residency and sovereignty clauses
- Personnel security and clearance terms
- Records, FOI and retention obligations
- Sub-processor restrictions by jurisdiction
A 90-Day Path
A practical order of work for a team starting from scratch or tightening an existing programme.
Map & inventory
Run the data mapping exercise: systems, processing activities, AI use cases and international flows. Draft the ROPA and the applicability matrix.
Paper
Refresh DPA, sub-processor and BAA templates. Start DPIAs on AI and health-data processing.
Transfers
Run TIAs for US-bound flows and document the DPF fallback. Stand up the UK complaints process.
Brief & watch
Brief leadership on Dec 2026 (Australia), May 2027 (India) and July 2027 (HIPAA). Set a quarterly regulatory review.
Privacy is a programme, not a project
Laws will keep changing. A mapped control set, a maintained contract library and a standing regulatory watch let you absorb each change as an update instead of an emergency.
Informational only, not legal advice. Dates and status reflect public sources as of 27 October 2026 and may change. Confirm with qualified counsel and the regulator before relying on any item.