— Sample issue preview · representative content —
Veltrixair Privacy Unit · Quarterly Digest
Q2 2026 — foundations, enforcement, and what's next.
Editor's note
— From the Privacy Unit —
Welcome to the launch issue. The plan is straightforward: one short, substantive digest per quarter, surfacing what materially changed in the regulatory landscape, the enforcement patterns we are tracking across the regulators we engage with most often, and the practitioner observations that consolidate into useful patterns over time. No interim sends, no sponsored content. If a quarter turns out to have nothing worth saying, the issue will be shorter rather than padded. — V.P.U.
01
Regulatory pulse
- DPDP Rules 2025 — month 7 of the 18-month transition window MeitY's latest clarifications on Significant Data Fiduciary criteria; what the Q2 progress signals for organisations targeting the May 2027 deadline.
- KSA PDPL — SDAIA's enforcement at 21 months from the deadline Q2 saw three additional violation decisions; the cumulative pattern after 51 decisions reveals a consistent enforcement focus.
- UAE — Federal Decree-Law 26/2025 child safety provisions activate First six months of operationalisation; what regulator engagement is looking like for digital platforms with mixed audiences.
- GCC — Bahrain PDPL implementing regulations status update Where the implementing regulations stand and what to expect for organisations with Bahrain operations.
02
Enforcement watch
- SDAIA — violation distribution after 18 months of formal enforcement Categorisation of the 51 decisions issued to date; lawful-basis failures and marketing-consent violations remain the dominant pattern.
- DIFC Commissioner — early enforcement patterns under Amendment Law 1/2025 First six months of decisions under the amended regime; emerging interpretation patterns relevant to DIFC-licensed entities.
- DPDP — first enforcement actions anticipated Indications from the Data Protection Board on enforcement timing once the transition window closes; what early enforcement is likely to focus on.
03
New insights
- "DPDP Rules — what 14 November actually changed" · 28 April 2026 Operational implications across the 18-month transition window beyond the procedural framing most coverage adopted.
- "KSA PDPL one year in — what 48 enforcement decisions tell us" · 21 April 2026 Reading the patterns in SDAIA's first year of formal enforcement; specific operational guidance for Controllers reviewing exposure.
- "What we got wrong — multi-jurisdiction DPO engagement lessons" · 06 April 2026 Three patterns we now design out of every DPO-as-a-Service engagement. Honest retrospective from a year of multi-regime work.
04
Practice notes
- Backup retention alignment — the gap that keeps surfacing Across three engagements this quarter, the same pattern: primary data retention disciplined; backup retention inadvertently extending it. The remediation playbook we are now applying upfront.
- Multi-regime DPA drafting — where standard SCCs leave gaps Working with two clients operating across Federal/DIFC/ADGM revealed three contractual provisions that need explicit treatment to satisfy all three regimes simultaneously.
05
Forward look — what's anticipated in Q3
- DPDP Rules — Q3 implementation milestones approaching Mid-window checkpoint at month 9; what early-mover Data Fiduciaries are reporting on the implementation reality.
- UAE Data Office — Executive Regulations updates expected Anticipated Q3 publication of supplementary guidance; areas where the existing Cabinet Decision 44/2022 has left interpretive ambiguity.
- ISO 27701 revised standard — final draft expected Q3 Material changes to the PIMS structure; implications for organisations currently certified or in pre-certification work.