APRA
Retired the system it used to collect bank data
Australia's prudential regulator retired its legacy submission system after a routine test found vulnerabilities, instead of patching it.
All case studies
Regulation
12 case studies tagged regulation.
OMB
Gave agencies a deadline to stop trusting the network
The zero-trust memo starts from the premise that nothing inside the perimeter is trusted, and requires agency systems to be isolated and encrypted.
CNIL / KASPR
Ordered deletion of a LinkedIn contact database
France's data authority fined a contact-data broker €240,000, then closed the order when the company removed its LinkedIn database instead of cleaning it.
Garante / Poste Italiane
Fined app monitoring it did not need
An anti-fraud feature that read the apps installed and running on customers' phones was ruled invasive and unnecessary, and both companies were fined.
CISA
Ordered agencies to take management interfaces off the internet
Binding Operational Directive 23-02 makes federal agencies find and remove internet-reachable management interfaces on routers, switches and firewalls.
CISA and nine partner agencies
Made security a prerequisite to features
Ten national cyber agencies wrote down that product security comes before features and speed to market, and published it as guidance for manufacturers.
FTC / Illuminate Education
Ordered deletion of student data it did not need
A consent order made deletion a compliance term: the company must remove covered information it does not need and keep a retention schedule it can be held to.
India, DPDP Rules
Put a three-year ceiling on retention
The 2025 rules require large platforms to erase personal data after three years of inactivity, while setting a minimum one-year hold for traffic data and logs.
GAO
Found 11 legacy systems, aged 23 to 60, still running
Eleven systems across ten agencies are most in need of modernization; seven run with known vulnerabilities and three of the ten flagged in 2019 had been modernized by 2025.
California Privacy Protection Agency
Made brokers delete on a 45-day clock
Over 600 registered brokers must action pending deletion requests every 45 days or pay $200 a day per request, through a platform that stores no raw identifiers.
CNIL
Fined a loyalty programme EUR 3.5 million for an unagreed transfer
Email addresses and phone numbers of 10.5 million members went to a social network for advertising audiences, without consent that named the purpose.
CISA
Gave agencies eighteen months to retire end-of-support edge devices
Binding Operational Directive 26-02 requires agencies to inventory listed end-of-support devices, decommission those losing support within a year, and remove the rest.