# Privacy Regulators Update Data Security Rules

A September 2026 Fasken bulletin outlines privacy and cybersecurity developments in Canada, the United States, and the European Union, with implications for public-sector suppliers and contractors that handle personal or sensitive data. It identifies no solicitation or contract award. Organizations covered by EU product-security rules face a 24-hour incident-reporting requirement that has been in force since September 11, 2026; Delaware’s expanded privacy-law scope takes effect January 1, 2027; and comments on Canadian guidance for third-party service providers are due December 4, 2026. The FTC’s personalized-pricing comment deadline, September 25, 2026, has passed.

- Contractors handling sensitive data should review third-party due diligence and contractual safeguards in light of the Canadian guidance and the broader regulatory changes described in the bulletin.
- Organizations subject to EU product-security rules should confirm their incident-reporting processes support the 24-hour reporting requirement already in force.
- Businesses with potential Delaware exposure should assess whether the expanded privacy-law scope applies to them before January 1, 2027.
- Interested organizations can submit comments on the Canadian third-party service-provider guidance by December 4, 2026; the FTC comment period on personalized pricing is closed.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** September 29, 2026

### Government Entities
- Office of the Privacy Commissioner of Canada (OPC)
- Federal Trade Commission (FTC)
- European Union Agency for Cybersecurity (ENISA)
- Commission nationale de l'informatique et des libertés (CNIL)
- Office of the Information and Privacy Commissioner for British Columbia (OIPC)

### Sources
- [Fasken’s Noteworthy News: Privacy & Cybersecurity in Canada, the US, and the EU (September 2026) | Knowledge | Fasken](https://www.fasken.com/en/knowledge/2026/09/faskens-noteworthy-news-privacy-cybersecurity-in-canada-the-us-and-the-eu-september-2026) - Fasken