On April 15, 2026, the Turkish Personal Data Protection Authority (KVKK) published a guidance document titled "Agentic Artificial Intelligence (Agentic AI)" on its official website. The document is not a binding regulation under Law No. 6698 on the Protection of Personal Data, but represents the DPA's formal position on how existing data protection obligations apply to agentic AI systems. The publication has no prior consultation period and constitutes soft-law guidance currently in force....

On February 5, 2026, the next phase of the UK Data (Use and Access) Act 2025 (DUAA) commenced, bringing into force most remaining data protection provisions of the Act. The commencement was confirmed by the UK Information Commissioner's Office (ICO) in a formal statement. The only provisions not yet commenced as of that date are the requirement for organisations to have a complaints procedure (due June 19, 2026) and certain ICO governance provisions at a later date. The commencement amends...

On 3 February 2026, the Canadian Investment Regulatory Organization (CIRO) published Administrative Bulletin 26-0033, titled "Notice on CIRO's Digital Asset Custody Framework." The bulletin is a final guidance document, operative as of its publication date, addressed to Dealer Members operating Crypto-Asset Trading Platforms (CTPs) in Canada. CIRO introduced the framework under its authority to impose terms and conditions of membership because no permanent rule in the CIRO Rulebook previously...