United States: Data Protection

Every U.S. state has enacted some form of data breach notification law, and each applies based on where the affected individual resides, not where the business in question is located.

On February 17, 2026, California Assembly Member Pilar Schiavo introduced California Assembly Bill 2021 (AB 2021)...

On March 11, 2026, independent reports confirmed that one of the largest medical device companies in the United States was the target of a significant cyberattack attributed to Iran-linked threat actors.

Cyber risk is no longer limited to “data companies.” In this episode of the Cybersecurity Awareness Series, Amy S. Mushahwar and Kathleen A. McGee explore how ransomware and nation-state threats are disrupting manufacturing floors...

On February 12, 2026, a bipartisan group of legislators in Maryland proposed the Maryland Artificial Intelligence Toy Safety Act. This proposed legislation would amend the Maryland Consumer Protection Act to establish a sweeping regulatory framework for AI-enabled toys sold in the state, covering any device that uses machine learning, conversational AI, behavioral modeling, or similar computational processes and is marketed to or primarily used by children.

This GT Newsletter summarizes recent class-action decisions from across the United States.

Nonetheless, it certainly underscores the need for covered entities and their vendors to tighten vendor oversight, security controls, and incident response around outsourced operations.

If you own a business with a customer-facing website, you are likely already familiar with the wave of litigation surrounding Americans with Disabilities...

On February 5, 2026, Governor Henry McMaster signed into law South Carolina's Age-Appropriate Code Design Act. South Carolina joins California, Maryland and Vermont...