93← Home

November 2026 Regulatory Digest: what regulators need to know

Headline from The Modern Regulator · compiled from 2 sources

Our analysis · checked against 8 sources

Monthly digest: Australian online safety bill, NZ card caps, UK PRA proposal, Loblaw follow-up

Australia's digital duty of care bill passed the House on 28 October and awaits the Senate; New Zealand finalised commercial card fee caps of 0.7%–1.5% (draft: 0.5%–1.5%) from April 2027. The UK PRA's senior-manager changes are only proposed, and Canada's privacy commissioner accepted Loblaw's voluntary commitments, not a fine, after a breach affecting about 2 million.

The framing"Regulatory Digest" does gather developments from Australia, New Zealand, the UK and Canada in one monthly place. But the publisher calls it a curated set across four core jurisdictions, and its lead items are not yet in force: PRA responses are due 22 January 2027 and the NZ caps start 22 April 2027.

What the headline leaves out

  • The publisher calls the digest a curated set across four core jurisdictions, not a comprehensive sweep.
  • Western Australia delayed its phosphine limit by three years, from 1 December 2026 to 1 December 2029.
  • The lead items are not yet in force: PRA responses are due 22 January 2027, and the NZ caps start 22 April 2027.
  • In the joint stress test, NZ banks' capital buffers were significantly depleted, and support from Australian parents could not be guaranteed.

What happens next

The next dated steps are Canada's federal budget on 5 November, the close of the CSA public-company consultation on 13 November, the Senate committee report on Australia's duty of care bill on 20 November, and the start of Australia's automated decision disclosure duty on 10 December. The PRA expects implementation in the second half of 2027, but says significant elements depend on Parliament enacting a bill introduced in May 2026. Loblaw must give the OPC an independent security assessment by 31 October 2027, with quarterly updates meanwhile, and the investigation stays open until the Commissioner is satisfied all commitments are met. APRA will publish its detailed stress-test findings later in 2026.

Possible knock-on effects
  • If Parliament does not enact the May 2026 bill in time, significant parts of the PRA changes could slip past the second half of 2027. Firms may then keep running the certification regime for about 7,700 individuals for longer. (official assessment: The PRA states that significant elements depend on Parliament enacting a bill introduced in May 2026.. Watch for: The bill's progress through Parliament and the PRA's final policy statement after 22 January 2027.)
  • Closing the Loblaw case may hinge on the external security firm's assessment due by 31 October 2027. If that assessment finds gaps, the OPC could keep oversight in place longer or expand the investigation, which matters to the roughly 2 million affected Canadians. (official assessment: The OPC's compliance letter says the investigation stays open until the Commissioner is satisfied all commitments are fulfilled, and he retains discretion to continue or expand it if commitments are not met or new concerns arise.. Watch for: Loblaw's quarterly updates, the 31 October 2027 assessment, and any OPC announcement closing or expanding the investigation.)

Sources: November 2026 Regulatory Digest – The Modern Regulator, Five to Follow: November 2026 – The Modern Regulator, About us – The Modern Regulator, Regulatory update January 2026 – The Modern Regulator, APRA and RBNZ complete joint bank stress test – APRA (primary), New Zealand banks hold up in first joint trans-Tasman stress test – MPA, Loblaw compliance letter – Office of the Privacy Commissioner of Canada (primary), OPC news release, 26 October 2026 – Office of the Privacy Commissioner of Canada (primary)

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to The Modern Regulator's November digest, "Australia's duty of care bill reaches the Senate, the PRA proposes easing senior manager approvals, and the OPC ties closure of a privacy investigation to verified security fixes."[1]

The Modern Regulator reports that the Online Safety Amendment (Digital Duty of Care) Bill 2026 passed the House of Representatives with amendments on 28 October and is now before the Senate.[1]The publication says the bill would replace the existing industry codes and standards with a single regime enforced by the eSafety Commissioner.[1]The digest names a Senate committee report on that bill, due on 20 November, and the start of Australia's automated decision disclosure duty on 10 December[1] as the nearest decision points.In Canada, The Modern Regulator reports that the Office of the Privacy Commissioner of Canada (OPC) announced on 26 October that Loblaw signed a voluntary compliance letter[1] after a cyberattack that, according to the publication, affected about 2 million Canadians.According to the digest, Loblaw will hire an external security firm to assess its enhanced measures, and the investigation stays open until Commissioner Philippe Dufresne is satisfied[1] that Loblaw has met its commitments.The Modern Regulator also says that the Canadian Securities Administrators' consultation on modernizing the regulation of public companies closes for comment on 13 November.[1]In New Zealand, the publication's companion "Five to Follow" piece reports that the Regulatory Standards Board published its first inquiry report on 19 October[2].The digest says several items also follow up October's regulatory digest, including New Zealand's rate decision and the UK veterinary services order.[1]

Listen to the songCompliance News — November 03, 2026

Sources

  1. [1]Regulatory digest: November 2026 - The Modern Regulator
  2. [2]Five to Follow: November 2026 - The Modern Regulator

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

More in this topic

This topic, day by day

November 2026 Regulatory Digest: what regulators need to know | 93