Understanding Local Regulations

We studied 2 lakh+ Indian threat indicators in 2025. And here’s what 2026 regulators now demand (but most companies still don’t do.) 2025 changed the game. We tracked threats across every state in India, from Maharashtra to Manipur. The scale of activity is no longer random. It’s strategic, coordinated, and sector-targeted. And now, so are the regulators. Here’s what 2026-ready companies are expected to do (but 90% still haven’t): 01. State-wise Risk Mapping is now a compliance expectation. 82% of malware volume came from just 6 Indian states. But the fastest-growing threat zones were Tier-2: Punjab, Odisha, Assam. Regulators now want geo-behavioral segmentation, and not just IP logs. 02. Proof of real-time detection, not just dashboards. In sectors like BFSI and energy, response time is now being scrutinised. Can you prove your system reacts in seconds, not hours? 2026 audits will ask: “Show me what your XDR did the last time your East zone flagged an anomaly.” 03. Sector-specific threat coverage: not optional anymore. Pharma, power grids, BFSI, healthcare, they’re all being hit differently. A generic firewall rule isn’t compliance. Mapping sector threat intel to your stack is now a regulatory demand, not a suggestion. 04. The death of checkbox compliance. 68% of compromised orgs in 2025 were “fully compliant”. But only 12% had active breach simulations in place You can have 100 tools. But, if nobody’s testing them in real-world breach drills, it won’t save you in 2026. 05. From centralised to hybrid monitoring Work-from-anywhere isn’t new. But regulators now want user behavior-based controls that adapt to geolocation, risk context, and device intelligence. 2026 audits will go beyond log files. They’ll ask: “How does your system behave when a user travels from Pune to Patna?” Regulatory audits in 2026 will feel more like red-team simulations. What are you seeing across sectors? Seqrite Quick Heal #CyberSecurity #ThreatIntelligence #XDR #RegTech #CISO #Compliance #CyberRisk #IndiaCyber #BFSISecurity #CriticalInfrastructure #SecurityLeadership

DOJ Crackdown: Privacy Teams must restrict data flows before April 8, 2025! The U.S. Department of Justice (DOJ) has finalized a sweeping ban on data transactions that expose Americans' sensitive personal data and government-related data to foreign adversaries. This is one of the most aggressive data security moves in recent years. What’s covered? a) Prohibited data transactions: Selling, licensing, or sharing sensitive U.S. data with countries of concern or covered persons is now restricted. b) Data brokers in the crosshairs: The rule bans U.S. persons from selling or licensing access to bulk personal data to specific countries. This also applies to cloud, fintechs, health tech, and adtech vendors. c) Vendor & employment agreements are impacted: The rule imposes security requirements on vendors, employment agreements, and investments to prevent indirect data access. Which data elements are protected? The DOJ has identified specific high-risk data types that are now restricted: - Precise Geolocation Data (Within 1,000 meters, tracking patterns of life) - Personal Financial Data (Bank accounts, card details, investment records) - Human ‘Omic Data (Genomic, epigenomic, proteomic - critical for biometric surveillance & biosecurity threats) - Biometric Identifiers (Facial images, voiceprints, retina scans, fingerprints) - Listed Identifiers (Social Security numbers, driver’s licenses, MAC addresses, IMEIs, SIM card numbers, advertising IDs, IP addresses) - Government-Related Data (Employee records, security clearances, government contractors’ data) What should privacy professionals do? With April 8, 2025 as the enforcement deadline, privacy teams need to track and restrict cross-border data flows while ensuring compliance: 1) Scan websites & mobile apps - Identify third-party integrations, tracking pixels, SDKs, and APIs that collect protected data types and transmit them internationally. 2 ) Monitor network traffic for cross-border data flows -Analyze where sensitive data is sent, including cloud providers, analytics tools, and ad networks. 3) Review vendor & employee agreements - Ensure third-party vendors, foreign employees, and offshore teams cannot access restricted data or transfer it to high-risk jurisdictions. 4) Block unauthorised data transfers - Implement geo-blocking, access controls, and encryption to restrict data sharing with countries of concern. How prepared is your organization for these changes? What challenges do you foresee in tracking data flows? #privacy #datasecurity #DOJ #databrokers #AI

“The cloud is just someone else’s computer… sitting on someone else’s land, drinking someone else’s water.” Google’s decision to withdraw its $2 billion data centre project from Indianapolis stayed with me. Not because projects get cancelled, but because of what it revealed. Digital convenience has a physical footprint. The cloud may feel weightless. Its infrastructure is anything but. Local reporting pointed to environmental concerns from water usage, electricity demand, & community pushback. Even one of the world’s most efficient technology companies could not make the economic, environmental, & social math add up. I am not anti-data centre. I am thinking aloud about the scale, limits, & trade-offs we gloss over when we talk about “digital” growth. Take water. Data centres need intensive cooling. Water cooled systems are more energy efficient than air cooling, but the numbers are sobering. A single hyperscale facility can consume three to five million gallons a day, roughly what a small town uses. In drought prone regions, this has already triggered conflict. The question sharpens quickly: scarce water for servers, or for citizens? Then there is energy. The IEA estimates global data centre electricity use could double by 2026, driven by AI workloads. A hyperscale facility can draw as much power as a large industrial plant. In India, where grids already juggle agricultural, industrial, & urban demand, this is not abstract. Add capacity without planning, & we risk instability or deeper dependence on coal. There is also heat. Data centres do not just consume energy; they expel it. In warmer geographies, this becomes a liability. Systems designed for “cool efficiency” often end up warming neighbourhoods. Land adds another layer. Data centres promise jobs but create few permanent ones relative to the land they occupy. Communities are questioning what they give up, farmland, housing, green space, in exchange for high security campuses with limited spillover benefits. India is one of the fastest growing data centre markets, fuelled by AI, fintech, gaming, & digital public infrastructure. These questions are urgent, not theoretical. Where will the water come from? Can we meet power demand sustainably? Will communities benefit meaningfully? This is not about slowing ambition. It is about aligning ambition with ecology. Google walking away feels less like a corporate decision & more like a signal. The digital world is hitting physical limits. Every message leaves a trace. The cloud is not magical. It is material. Sharing this as part of my thinking aloud series, questions, not conclusions. Where are we underestimating the real costs of “digital” growth? What trade offs are we still unwilling to name? #Cloud #Data #Technology #Innovation #Ai

Today, I graduate with a PhD at the Mzuzu University. It has been a tough last couple of years but that is a story for another day. Today, I want to share a synopsis of my research. My study explored the political economy of mining in Malawi, focusing on governance structures, community participation, and labour issues within the sector. Despite the government’s strategic emphasis on mining, alongside agriculture and tourism, as a driver for economic transformation, significant challenges persist in realising the sector's potential for socio-economic development. The research gap was in the insufficient understanding of the dynamics between political power, mining governance, and the role of community and labour in shaping the industry’s outcomes. The study thus aimed to analyse the interplay between politics and mining, specifically examining how governance, community participation, and labour issues affect the mining sector’s development in Malawi. Using a sample of 157 mining stakeholders, a mixed-methods approach was employed, utilising both qualitative and quantitative data collection techniques. The study used both quantitative and qualitative data analysis. The findings indicate that while the government holds substantial decision-making power, international non-governmental organisations and private mining companies exert greater influence in the sector. Additionally, the study revealed a lack of adequate governance structures to ensure meaningful community participation, despite mining communities bearing the negative externalities of mining operations. Furthermore, there is a significant skills gap within the labour market, with no coherent strategy to develop the necessary workforce to support the growing mining sector. The study concludes that the current political framework merely channels taxes, grants, and aid, without fostering sustainable sector development. The study thus recommends that the government take a more proactive role in the sector by significantly operationalising the Mining Company and the Mining Authority to address the power imbalances that hinder economic growth. Additionally, to enhance Malawi’s global competitiveness, it is crucial to focus on developing the labour and skills sector. The study’s findings are valuable for government agencies, private sector stakeholders, and mining researchers aiming to improve the sector’s governance and socio-economic impact. I have already published three papers from this study whose links I will share in the comment section but suffice to say that I shall be sharing a policy brief on an Effective Governance Framework for Malawi’s Mining Sector as a result of this study.

Nigeria just told Google, Microsoft, and Amazon: build local data centers or lose access to our market. They’re not alone. India forces payment companies to park transaction data at home. Vietnam makes every foreign platform open a local office and keep user data on-shore. Why the push? After decades of exporting raw data while importing slim pickings of tax and jobs, emerging economies want the full value chain—servers, talent, and revenue—anchored locally. Their message: our citizens’ data isn’t your free fuel anymore. Strategic takeaway: The borderless cloud is splintering into a patchwork of “mini-sovereign” clouds. If your architecture still assumes friction-free data flows, you’re one regulation away from a shutdown—or a cap-ex surge to replicate infrastructure country by country. Boardroom reflection: ⚡ What happens to your margin model when every jurisdiction demands its own copy of the stack? ⚡ Are you prepared to trade global efficiency for local legitimacy? Power dynamics are shifting. Build sovereignty into your roadmap now, before someone else rewrites it for you. https://lnkd.in/ekMyHHst #Tech #Data #Business #Money

The EU just published its official guidance on the Packaging & Packaging Waste Regulation (PPWR) and more businesses than expected are impacted. The European Commission has released a 57-page guidance document clarifying how Regulation (EU) 2025/40 will work in practice. With the regulation applying from 12 August 2026, the clock is ticking. Here's what businesses should know: → What counts as "packaging" is broader than you think. IV bags, candle containers, and adhesive process films may be excluded but dust bags for shoes and garments, flower pots sold with plants, and beverage cups filled at point of sale are likely in scope. → Know whether you're a "manufacturer" or a "producer." These are two distinct roles with very different obligations. Manufacturers are responsible for sustainability and labelling compliance across the EU. Producers handle extended producer responsibility (EPR) fees in whichever Member State the packaging becomes waste. → PFAS in food-contact packaging is banned from August 2026 with no transitional period for existing stock placed on the market after that date. → Re-use targets kick in from 2030, covering transport, beverage, and sales packaging. At least 40% of transport packaging must be reusable by then. For beverages, final distributors must offer at least 10% in reusable packaging. → Deposit Return Systems must be operational by 2029, targeting 90% separate collection of plastic bottles and metal cans. → Labelling rules are being harmonised and national sorting labels will no longer be permitted alongside EU harmonised labels from August 2028. The guidance is non-binding but reflects the Commission's interpretation. Businesses that move early will be far better placed when enforcement begins. #ppwr #packaging #sustainability #circulareconomy #euregulation #esg #compliance

Any organisation developing or fine tuning AI systems, particularly LLMs, needs to be ALL OVER how their IP is protected. IP protection for model components such as weights is a complex legal issue. Model weights in AI are numerical values that determine the strength of connections between nodes in a neural network. AI models adjust these weights during training to improve predictions or decisions based on input data. This adjustment process allows the model to "learn" from vast amounts of data, fine-tuning its accuracy in tasks such as image recognition or language translation. Traditionally, copyright does not extend to facts or the functional aspects of a creation. Model weights straddle this boundary, being both a product of immense computational effort and a representation of the underlying data on which the AI was trained. Current legal frameworks do not explicitly address the status of AI-generated data, including model weights (however in the USA it seems to be the case AI generated data is not protected by copyright). The principles underlying the EU’s Software and Database Directives provide a foundation for analysis. While the software enabling AI functionalities might be copyrightable as a literary work, the status of model weights is more ambiguous due to their nature as outputs from processing vast datasets, rather than direct human creation. The key question revolves around originality and the role of human authors in the creation process. According to the CJEU, for a work to be protected under copyright, it must be the author's own intellectual creation, reflecting the author's personality and choices (the Painer case). These criteria becomes blurred when considering model weights, where the "creation" process is largely automated and driven by algorithms following predefined objectives. Given the challenges associated with copyright protection, the sui generis rights established under the EU Database Directive offer an alternative approach. These rights protect substantial investments in obtaining, verifying, or presenting the contents of a database, regardless of originality. Model weights could potentially be viewed as part of a database, particularly if one considers the extensive computational resources and expertise required to train AI models. However, this interpretation hinges on whether model weights can be considered a "database" in the legal sense. The Directive's broad definition of databases may provide sufficient ground for this argument, especially given the structured nature of model weights within an AI's architecture. The potential application of copyright or sui generis database rights to AI model weights has significant implications for the commercialisation of AI technologies. Recognising these protections would grant developers legal mechanisms to control the use, distribution, and modification of their AI models, influencing licensing agreements and business models within the AI industry.

Google’s decision to withdraw its appeal in Ssekamwa Frank & 3 Others vs Google LLC and comply with the ruling from Uganda’s Personal Data Protection Office (PDPO) is a clear message that compliance with local data protection laws is not a peripheral concern but a critical prerequisite for market access. We are witnessing a fundamental shift from mere procedural box-ticking to a deeper, more consequential scrutiny of fundamental business models. In the Ugandan ruling, a critical precedent was set: a global privacy policy does not supersede specific national mandates. Google’s defense, which leaned on its global standards, was firmly rejected in favor of Uganda’s requirement for local registration and demonstrable safeguards for cross-border data transfers. This establishes that digital sovereignty is not a theoretical concept but a legal reality. What we are seeing is not a series of isolated incidents, but a clear trend demonstrating the 𝐞𝐦𝐞𝐫𝐠𝐞𝐧𝐜𝐞 𝐨𝐟 𝐫𝐨𝐛𝐮𝐬𝐭 𝐝𝐚𝐭𝐚 𝐠𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 𝐚𝐜𝐫𝐨𝐬𝐬 𝐀𝐟𝐫𝐢𝐜𝐚. Regulators are no longer hesitant to flex their authority, and their sophistication is growing. They are moving beyond initial requirements like registration to challenge core practices. The compliance of Google in Uganda and the settlement of Meta in Nigeria are powerful indicators of a 𝐦𝐚𝐭𝐮𝐫𝐢𝐧𝐠 𝐝𝐢𝐠𝐢𝐭𝐚𝐥 𝐞𝐜𝐨𝐬𝐲𝐬𝐭𝐞𝐦 𝐢𝐧 𝐀𝐟𝐫𝐢𝐜𝐚. For business leaders, the takeaway is clear: • 𝐀 𝐨𝐧𝐞-𝐬𝐢𝐳𝐞-𝐟𝐢𝐭𝐬-𝐚𝐥𝐥 𝐠𝐥𝐨𝐛𝐚𝐥 𝐝𝐚𝐭𝐚 𝐩𝐨𝐥𝐢𝐜𝐲 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐬𝐮𝐟𝐟𝐢𝐜𝐢𝐞𝐧𝐭. • 𝐀 𝐩𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞, 𝐜𝐨𝐮𝐧𝐭𝐫𝐲-𝐛𝐲-𝐜𝐨𝐮𝐧𝐭𝐫𝐲 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐬𝐭𝐫𝐚𝐭𝐞𝐠𝐲 𝐢𝐬 𝐧𝐨𝐰 𝐞𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥. • 𝐄𝐧𝐠𝐚𝐠𝐞𝐦𝐞𝐧𝐭 𝐰𝐢𝐭𝐡 𝐥𝐨𝐜𝐚𝐥 𝐫𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐬 𝐚𝐧𝐝 𝐚 𝐠𝐞𝐧𝐮𝐢𝐧𝐞 𝐫𝐞𝐬𝐩𝐞𝐜𝐭 𝐟𝐨𝐫 𝐫𝐞𝐠𝐢𝐨𝐧𝐚𝐥 𝐝𝐚𝐭𝐚 𝐠𝐨𝐯𝐞𝐫𝐧𝐚𝐧𝐜𝐞 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 𝐚𝐫𝐞 𝐭𝐡𝐞 𝐧𝐞𝐰 𝐜𝐨𝐬𝐭 𝐨𝐟 𝐞𝐧𝐭𝐫𝐲. Find more detailed analysis of the compliance implications here: https://lnkd.in/dfyNnAEH Congratualtions to Ssekamwa Frank on this victory! #datagovernance #dataprotection 

Illegal small scale mining, or galamsey, continues to scar Ghana’s landscape and undermine the health of our ecosystems. Forests are stripped bare, rivers once teeming with life now run brown with silt and mercury, and communities are left with poisoned water sources and degraded farmland. Beyond the environmental cost, galamsey erodes livelihoods, public health, and the nation’s long-term economic stability. It’s not simply an environmental issue, it’s a sustainability and governance challenge that demands collective responsibility. To address it, Ghana must strengthen enforcement while creating viable alternatives for those who depend on mining for survival. Investment in sustainable livelihoods, formalized small-scale mining with proper environmental controls, and community-led monitoring can turn the tide. Protecting our natural resources is not a choice — it’s an obligation to future generations. Ghana’s gold should shine from the integrity of our actions, not from the destruction of our environment. #Sustainability #EnvironmentalProtection #Ghana #Mining #ESG #HSE #SustainableDevelopment #tspconf25

We just published our 𝐄𝐮𝐫𝐨𝐩𝐞𝐚𝐧 𝐔𝐧𝐢𝐨𝐧 𝐂𝐥𝐞𝐚𝐧 𝐄𝐧𝐞𝐫𝐠𝐲 𝐏𝐥𝐚𝐲𝐛𝐨𝐨𝐤– a practical guide to help companies move from climate ambition to executable clean electricity strategies across EU markets into the Sustainability Exchange https://lnkd.in/eK9PDr_C • 𝐅𝐨𝐫 𝐬𝐮𝐬𝐭𝐚𝐢𝐧𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐥𝐞𝐚𝐝𝐞𝐫𝐬: it connects regulatory pressure (CSRD and national rules), investor expectations, and net‑zero targets with concrete choices on GOs, green tariffs, on‑site renewables, and PPAs. • 𝐅𝐨𝐫 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐚𝐧𝐝 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐥𝐞𝐚𝐝𝐞𝐫𝐬: it translates complex local market realities into clear pathways for site‑level action, risk management, and cost visibility. This playbook, developed by the Clean Energy Buyers Association (CEBA) through extensive research, aims to make it easier for SMEs in Europe (and any other company size too in early stages of their strategy) to accelerate progress on their carbon-free energy journey. The playbook walks teams through 𝚏̲𝚒̲𝚟̲𝚎̲ 𝚜̲𝚝̲𝚎̲𝚙̲𝚜̲: (1) clarifying the 𝐰𝐡𝐲, (2) understanding the 𝐥𝐨𝐚𝐝 𝐚𝐧𝐝 𝐞𝐦𝐢𝐬𝐬𝐢𝐨𝐧𝐬 𝐩𝐫𝐨𝐟𝐢𝐥𝐞, (3) mapping 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞 𝐦𝐞𝐜𝐡𝐚𝐧𝐢𝐬𝐦𝐬 by country, (4) designing a 𝐛𝐚𝐥𝐚𝐧𝐜𝐞𝐝 𝐩𝐫𝐨𝐜𝐮𝐫𝐞𝐦𝐞𝐧𝐭 𝐩𝐨𝐫𝐭𝐟𝐨𝐥𝐢𝐨, and (5) turning it into an 𝐢𝐦𝐩𝐥𝐞𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧 𝐫𝐨𝐚𝐝𝐦𝐚𝐩 with timelines and responsibilities. If you’re responsible for decarbonising operations in Europe or need to make informed decisions on clean power procurement, I’d love your feedback and examples of how you’re tackling this in your own organisation! #Sustainability #CleanEnergy #Decarbonization #CorporateSustainability #theclimatepledge