Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

As AI adoption accelerates across business functions, December’s expert roundup focuses on a question many organizations are now confronting in practice rather than theory: how should companies prepare for AI related data processing under GDPR. Unlike traditional automation, AI systems often rely on large, dynamic datasets, continuous learning, and opaque decision logic.

Mexico has taken a major step toward strengthening its digital defenses with the official unveiling of its first National Cybersecurity Plan, a landmark initiative that establishes the country’s first specialized policy framework for cybersecurity.

Applicability thresholds of state privacy laws often hinge on size or scale. TDPSA is different. It puts no revenue thresholds like CCPA or CPRA. So if your business operates in Texas or reaches the state’s residents, you’re most likely inside the scope already. The law took effect on July 1, 2024, and by January 2025, the universal opt-out obligations became fully enforceable. That transition is what moved TDPSA from a policy update to a website-level requirement.

Most websites today are more complex than their owners realise. A single page can load a mix of analytics, pixels, and vendor scripts, all shaping how personal data flows through the browser. And because GDPR now treats this browser activity as processing, it becomes part of the compliance picture even when it comes from third-party tools. Which means regulators naturally expect organizations to understand this activity as it happens.