Regulatory watch: week of 9 November 2026

This week's main date is 13 November 2026, when Consent Manager registration opens in India. Australia's privacy-policy rules on automated decisions follow on 10 December 2026. The EU Cyber Resilience Act's reporting duties have applied since 11 September 2026, and the Act applies in full from 11 December 2027.

India: Consent Manager registration opens on 13 November 2026

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Rule 4 governs registration of Consent Managers. Under rule 1 it comes into effect one year after notification, which is 13 November 2026. From that date a company can apply to register as a Consent Manager with the Data Protection Board. The conditions are in rule 4 and the First Schedule. Section 6 of the Act deals with Consent Managers: registered intermediaries who help people give, manage and withdraw consent.

A company that does not plan to become a Consent Manager has no new duty this week. Most other duties apply eighteen months after notification, which is 13 May 2027. (DPDP Rules, 2025; DPDP Act, 2023)

Australia: automated-decision transparency from 10 December 2026

From 10 December 2026, organisations bound by the Australian Privacy Principles (APP entities) must say more in their privacy policies about automated decisions. APPs 1.7 and 1.8 cover decisions that could reasonably be expected to significantly affect an individual's rights or interests and that rely on a computer program using that individual's personal information. The change comes from the Privacy and Other Legislation Amendment Act 2024. The regulator has published guidance on transparency for AI and automated decision-making.

EU: Cyber Resilience Act reporting has applied since 11 September 2026

Under Article 14, manufacturers must report actively exploited vulnerabilities and severe incidents. That duty has applied since 11 September 2026. The Act's security requirements for hardware and software products sold in the EU apply in full from 11 December 2027. (Regulation (EU) 2024/2847)

Also coming soon

Chile's Law 21.719 takes effect on 1 December 2026, although a bill to postpone it is before the Senate (BCN). In the United States, California's CCPA rules on automated decision-making technology apply from 1 January 2027 (CPPA). Colorado's SB 26-189 also takes effect on 1 January 2027 (Colorado General Assembly).

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.