The Changing Landscape of Privacy, Cybersecurity and Technology Regulation

Privacy, cybersecurity, and technology regulation are evolving rapidly around the world, but not necessarily in the same direction or at the same pace. For multinational organizations, the challenge is not just understanding individual regulatory developments, but determining how overlapping requirements can be addressed across jurisdictions in a practical and coordinated way.

World Law Group’s Privacy & Data Protection Group brought together member firm lawyers earlier this month to compare developments in Europe, the United States, Brazil, and Vietnam, and discuss what they mean for clients operating across borders. Stefano Mele of Gianni & Origoni (Italy), Ted Augustinos of Troutman Pepper Locke (Massachusetts, USA), Carla do Couto Battilana of TozziniFreire (Brazil), and Esko Cate of VILAF (Vietnam) shared perspectives from their respective jurisdictions before opening the discussion to colleagues across the network.

While the regulatory frameworks and developments varied considerably, the discussion highlighted how privacy, cybersecurity, and AI regulation are increasingly intersecting, requiring businesses and their advisors to look beyond individual compliance requirements and consider how they fit together across an organization’s operations.

Connecting Regulation to Business Decisions in Europe

In Europe, Mele noted that decisions such as choosing a technology provider, introducing AI or launching a connected product can now involve several legal frameworks, each addressing a different aspect of the same decision.

Cybersecurity requirements under NIS2, DORA, and the Cyber Resilience Act illustrate the breadth of that impact. Requirements can affect management oversight, relationships with technology providers and suppliers, product development, and the resources needed to support products throughout their lifecycle.

For businesses, this means regulatory deadlines are only one part of the preparation. Decisions being made now about product development, technology purchases, and contracts may have implications under requirements that take effect later.

AI presents a similar issue. Businesses are introducing AI into their operations while the regulatory framework continues to develop. Mele suggested that the starting point should be understanding what a particular system will actually do. An internal drafting tool and a system used to assess employment candidates, for example, may rely on similar technology but raise very different legal questions.

That also requires coordination among different functions within an organization. Privacy teams may examine the data involved, security teams assess the provider, procurement negotiates the contract, and the business considers the expected benefit. Legal advisors can help bring those assessments together so management has a clear understanding of the conditions under which a technology can be used.

For multinational organizations, even a common European framework does not necessarily result in identical requirements in every country. National implementation, employment law, corporate responsibilities, and supervisory arrangements can all affect the analysis, making it important to distinguish between controls that can be adopted across the organization and legal steps that require local attention.

Brazil Expands its Regulatory and Enforcement Focus

Brazil has seen significant developments over the past year, with its data protection authority taking on a broader role across privacy and digital regulation.

Battilana highlighted the protection of children and adolescents online as a major priority. Brazil’s new Digital Act for Children and Adolescents imposes requirements and restrictions that can apply not only to social media, but also to games and other internet applications that may be accessed by children or teenagers. The changes are already requiring technology companies, including multinational businesses, to review their services and implement additional protections.

Biometric data is another area receiving attention. Facial recognition and other forms of biometric authentication are widely used in Brazil, and the data protection authority has been examining their use more closely.

Enforcement is also increasing. Battilana discussed recent monitoring and enforcement activity involving data breaches, data protection officers, channels for data subject requests, and the processing of children’s data. Companies that receive inquiries from the Brazilian data protection authority should be prepared to respond and cooperate, particularly as monitoring activity can lead to formal investigations.

Data breaches also demonstrate why a purely local analysis may not be enough. Battilana described a recent Brazilian decision involving health data in which the authority considered not only the circumstances of the breach in Brazil, but also what had occurred in other jurisdictions. For multinational organizations responding to an incident across several countries, coordination among local counsel can therefore be an important part of the response.

States in the US Continue to Tighten Privacy Requirements

In the United States, the privacy landscape remains largely state-driven, with requirements continuing to expand.

Augustinos noted that some states are lowering the thresholds that determine which businesses are subject to privacy laws, potentially bringing more organizations within their scope. States are also tightening requirements around sensitive data, requiring recognition of universal opt-out signals and, in some cases, eliminating cure periods that previously gave businesses an opportunity to address certain violations before enforcement.

Risk assessments are another developing area. Privacy and security requirements do not always align, but Augustinos noted that businesses may be able to address them through a more comprehensive assessment of their data processing rather than treating each requirement separately.

AI and automated decision-making are also receiving greater attention, particularly when used in consequential decisions involving areas such as employment, insurance, and lending.

Online tracking technologies remain an enforcement and litigation concern as well. Organizations may not always have a complete picture of the tracking technologies deployed across their websites, particularly when different business units or vendors are involved. Understanding what is being used, where it is operating, and what information is being collected is an important first step in providing appropriate disclosures and opt-out rights.

As in Brazil, the protection of children using social media and other online services continues to be a significant focus for U.S. regulators.

Vietnam Sees a Rapid Pace of Regulatory Change

Vietnam has experienced an especially active period of regulatory development. Cate reported that approximately 18 regulations relevant to the group’s work had been introduced since July 1 alone.

Among the developments are new penalties connected to Vietnam’s personal data protection law. For offshore processors handling the personal data of Vietnamese citizens, certain violations can result in penalties calculated as a percentage of the prior year’s revenue.

Foreign e-commerce businesses may also face new requirements even if they have no physical presence in Vietnam. Platforms meeting certain criteria, including offering a Vietnamese-language option, using a .vn domain, or exceeding specified transaction levels involving Vietnamese buyers, may need to register with Vietnamese authorities. Certain platforms may also need to appoint or establish a representative office in Vietnam.

New cybersecurity requirements include breach notification obligations and data localization requirements for certain sectors. Vietnam has also introduced an AI classification system requiring providers and deployers to assess whether their systems fall into low-, medium-, or high-risk categories, with additional considerations for uses in areas including banking, healthcare, education, and biometric processing.

A new data law adds another layer. Companies processing information classified as "core data” or "important data” may face reporting or impact assessment requirements, depending on the type and scale of the information involved.

With regulations developing so quickly, Cate noted that foreign businesses operating in or reaching into Vietnam may not realize that new local requirements apply to them.

Finding the Right Balance Between Global and Local

The discussion turned from individual regulatory developments to a practical question for multinational businesses: when can one global approach work, and when is a local solution necessary?

Augustinos shared an example involving a multinational client for which WLG member firms worked together on privacy disclosures across several jurisdictions. In some markets, the requirements could be incorporated into a coordinated disclosure. In Mexico, differences in the applicable requirements and how disclosures are presented led the team to use a separate disclosure for the Mexican-facing website.

Battilana similarly noted the importance of understanding a multinational company’s existing practices in other jurisdictions when advising on Brazilian requirements. In some cases, explaining those global practices to the Brazilian regulator can be part of determining how they can be adapted to meet local expectations.

Cate described another approach that has worked for multinational clients in Vietnam: using a global policy as the foundation and adding jurisdiction-specific supplements and definitions where necessary. This can allow businesses to maintain greater consistency while still addressing local requirements.

The examples underscored that there is no uniform approach to cross-border compliance. The appropriate structure depends on the regulation, the jurisdiction, and the business itself. For multinational clients, the ability of counsel across jurisdictions to compare requirements and determine where a coordinated approach works, and where local differences require another solution, can make that process considerably more manageable.

As privacy, cybersecurity, AI, and other technology regulations continue to develop, that coordination will remain an important part of advising businesses operating across borders.

Author: Hanna Shea, World Law Group