How we put the news together

What we cover

Rules, guidance, consultations, deadlines and enforcement actions for HIPAA, GDPR, NIST CSF, ISO 27001, SOC 2, PCI-DSS, DORA, CCPA and India’s DPDP Act, plus closely related data protection and cybersecurity regulation. We deliberately leave out vendor marketing, general cyber news without a regulatory angle, and financial-market rules that don’t touch security or privacy.

Where stories come from

We follow regulators, standards bodies and government agencies directly, alongside specialist trade publications. When several outlets report the same event, they’re grouped into one story and every source is listed, so you can always read the original. How we rate sources.

How summaries are written

Summaries, key facts and checklists are drafted automatically from the source articles, using written rules: state only what the sources say, never guess dates or amounts, and say why a story matters to the people it affects. Severity follows a fixed rubric — for example, “critical” means a fine of 10 million or more, or a new mandatory obligation due within six months.

Automated drafts can be wrong. Treat them as a fast way in, and check the original publication before you act.

“Reviewed by an editor”

Stories that our checks are less sure about, and every reader submission, wait in a moderation queue. An editor reads them against the sources before they’re published, and they carry a “Reviewed by an editor” label.

Corrections

If something is wrong, use “Report an error” at the bottom of the story. We correct mistakes and, where a correction changes the meaning of a story, say so on the story.