We're proud to announce Keyless has taken home three gold awards in the 

We’re extremely proud to be recognized by the Cybersecurity Excellence Awards as a gold winner in three categories this year – a huge achievement. These prestigious awards recognize the best in the industry, so it’s a testament to the work of our team and the industry value our solutions are providing,” 

said Andrea Carmignani, co-founder and CEO at Keyless. 

The Cybersecurity Excellence Awards recognizes individuals and companies that demonstrate excellence, innovation, and leadership in information security, based on the strength of their nomination and the popular vote by members of the Information Security community.

The awards were given to Keyless for our 

world-first biometric authentication solutions 

that leverage privacy-enhancing cryptography to provide a secure, convenient, and privacy-focused way for users to authenticate their identity online. 

Keyless is also the first vendor to win gold in the newly created 

 category, attesting to not only its technology but the growing acceptance of biometrics in the wider cybersecurity community. 

“We congratulate Keyless for the recognition as an award winner in 3 separate categories in the 2023 Cybersecurity Excellence Awards," 

said Holger Schulze, CEO at Cybersecurity Insiders. 

"With over 800 entries in more than 300 award categories, the 2023 Cybersecurity Excellence Awards program is highly competitive. All winners reflect the very best in innovation and excellence in defending against today's evolving cybersecurity threats," 

Keyless Cleans Up in 2023 Cybersecurity Excellence Awards

Identity and Access Management (IAM) is an essential part of virtually every organization's security setup. IAM systems help control who has access to an organization's files and systems.

If your organization has a worldwide workforce or manages remote workers, the chances are, you’ll already be using an IAM provider to ensure safe and secure employee access to business-critical services and applications.

Today, most IAM platforms integrate with internal business applications and systems to offer a 

 for employees, helping to reduce password fatigue and improve employee productivity. While IAM platforms can help enable better digital experiences for your employees, authenticating once and gaining access to a wide range of company apps and data can pose significant security risks. 

By integrating solutions like Keyless with your IAM application, you can help keep your company's data safe and secure. Read on to find out more.

The role of IAM is to securely manage who has access to company data, files, apps, and systems. The idea is to block access to specific data and systems based on an employee's role and responsibilities. A proper IAM strategy will ensure that only authorized users gain access to business-critical systems and company data. 

Today the IAM market is dominated by companies such as Microsoft, Okta, IBM, OneLogin, and Ping Identity.

IAM platforms like these typically use magic links (one-time email links used for authentication) to offer a single-sign-on experience for employees. Once authenticated, employees can access multiple linked apps, services, and files until they log out – posing a massive problem if employee credentials are compromised. 

Magic links and OTPs can greatly increase the chances of threat actors gaining access to sensitive company data, especially if a company also uses weak authentication methods for authenticating employees to company email. 

65% spike in total global losses from business email compromise (BEC) fraud in 2022

. BEC is where bad actors aim to compromise an employee's email address to commit fraud and launch further attacks within an organization. 

Public-sector employees are at particular risk, with 

government employees making up more than 50% of all credential-stealing phishing attacks in 2021

To mitigate these risks, Keyless integrates with the world's leading IAM providers to provide a passwordless multi-factor authentication solution that is resilient against emerging fraud, phishing, and spoofing threats.

When employees sign in using Keyless, employees will be prompted from their trusted device to authenticate by looking into their device’s camera – a seamless multi-factor authentication experience that is fool-proof for employees. 

Keyless secures SSO access to IAM applications

 by combining privacy-enhancing facial recognition with background device verification checks to offer MFA with a single look into the camera.

With Keyless, employees can enjoy secure access to the systems and apps they need to complete their jobs. This approach empowers organizations to strengthen their overall network security by ensuring that only authorized users can access company data.

Our world-first technology offers a truly passwordless experience that is resilient against emerging phishing, social engineering, and credential-stuffing attacks, as well as biometric spoofing threats. 

From strengthening security to preventing employee credential sharing and streamlining employee access, our passwordless solutions enable superior authentication experiences, which can help organizations accelerate a zero-trust environment while reducing the attack threat surface.

The benefits of using Keyless to login into your IAM applications 

Keyless can be integrated directly into a workstation via our SDK or installed on an employee's work (or personal) handheld device. Our biometric-based, passwordless MFA solution can dramatically enhance the security of IAM platforms.

Interested in learning more? Experience the simplicity of Keyless authentication today – 

How Keyless helps enhance IAM security

While it is often overlooked in light of other security concerns, account recovery is a considerable labour-intensive task for IT service desks. As the size of a business grows, so too do the challenges posed by account recovery.

In this article, we will discuss the key challenges of account recovery and reveal how companies can improve their account recovery procedures.

As a business, your account recovery processes make a major difference to the user experience of your platforms and apps.

Data shows that the average person has around 

However, forgetting login details are not the only reasons why a customer would need to recover their account. Account recovery may also be required when an account has been locked due to a previous breach. In some cases, accounts can also be locked if a customer changes the device that they log in from. 

In all of the above scenarios, account recovery should be straightforward for a customer to register a new device or reset a compromised password. 

At Keyless, we understand that poor authentication experiences negatively impact user experience. By using a 

passwordless multi-factor authentication solution

 like Keyless, customers can log in to accounts with a single look into the camera, which allows for a better and smoother user experience.

 recommends a technique known as ‘throttling’ - whereby password systems are configured so that there is a progressively increasing time delay between successive login attempts. The idea behind throttling is that it restricts the number of times that an attacker can attempt to enter an account, while also providing multiple opportunities for a legitimate user to remember their password. 

Throttling is generally preferred to a standard account lockout scheme that tends to give a limited number of login attempts before the account is frozen. Once a user's account has been frozen, they are effectively forced to contact the company’s helpdesk.

Additionally, as passwords continue to become more complex, companies are beginning to use additional account recovery methods to help customers access their accounts. For example, many organizations also ask users to set a secure PIN alongside their password. However, unless the PIN is a number or code that the customer uses elsewhere, they’re likely to forget these as (unlike a security question) there is often no context or hint provided. 

Occasionally, companies might provide users with a set of single-use authorization codes that they can enter to recover their accounts. Authorization codes are generally seen as more secure than a PIN, but again, unless the user writes them down or takes a screenshot (which itself is a security risk), they’re unlikely to remember an arbitrary string of numbers and letters with no context. 

Increasingly, companies are also implementing device-bound account recovery methods via one-time passwords (OTPs), or through device-bound biometrics. However, it’s important to note that if the customer has lost their device, they would also be unable to generate their OTP or supply their biometric data to access their account.

As a result, businesses using device-bound methods need to rely on fallback authentication methods to verify customers' identity - often a set of security questions or, at worst, contacting support. 

Calling a helpdesk to carry out a password reset isn’t just frustrating for the customer, but also a costly and time-consuming endeavor for the business as well. 

A study by the Gartner Group found that up to 

 are related to password resets, with each reset typically taking between 2 - 30 minutes to fix. In monetary terms, meanwhile, Forrester Research found that the average cost of resetting a single password is as much as 

When you consider that massive global organizations such as Amazon, Apple, or Meta deal with millions of customers a day, it’s easy to see just how expensive a password reset can become if you don’t have a sufficient account recovery method in place. 

Businesses that wish to protect their users from account takeovers, while also limiting their helpdesk expenditure, should consider using a hybrid account recovery approach that merges passwordless account recovery with a self-service solution. 

Some account recovery methods are an invitation for fraud

Typical account recovery methods, such as sending OTPs via SMS or email, can pose security risks as these can readily be intercepted by malicious actors.

Research has shown that OTP security might fail 

 and that accounts using OTPs are increasingly being targeted by hackers looking to carry out account takeovers via SIM swapping. Even OTPs sent via push notification or via an authenticator app can be intercepted using the latest phishing toolkits and keyloggers. 

Scammers are increasingly aware of the pain points of account recovery and are actively targeting customers by offering 

In addition to offering personalized “support” to customers who have forgotten their passwords, fraudsters are increasingly exploiting outdated account recovery methods to impersonate users and access their accounts. 

For example, scammers have used stolen personal information (often obtained through 

) to impersonate genuine users while initiating account recovery processes.

The rate of data breaches is increasing globally, which has contributed to the rise in identity theft and impersonation. Since 2001, the victim count has increased from 6 victims per hour to 97 - making for a 

Passwords, PINs, and OTPs are all “written” information which opens the door to a number of fraud and security concerns, as outlined previously.

Companies that use Keyless are resilient to credential-based authentication fraud, such as phishing and man-in-the-middle attacks, as there is no written password or code, that can be compromised. With Keyless, businesses and customers alike can benefit from a 

 that enhances security, eliminates overheads, and improves user experience.

Interested in learning more? Contact us today to discover how Keyless can help your business overcome the challenges of account recovery.

Solving Account Recovery Challenges with Keyless

The average business typically has multiple subscriptions to a vast number of cloud services or online-enabled software such as Microsoft OneDrive, Teams, and the Google Workspace suite. With every site or service requiring unique and often complex login credentials, employees will often reuse passwords to make their login information easier to remember.

, passwords are no longer able to fulfill the simple role they were designed for and have lost both their intuitiveness and effectiveness when it comes to mitigating unauthorized access. Unfortunately, despite a steady increase in 

hacking attacks and data breaches caused by compromised credentials

, passwords are still the most common method of verifying a user’s identity online.

 to both employee and company security. While Single Sign-On (SSO) authentication can somewhat reduce this threat by allowing users login to multiple applications with a single password, there are still security risks. With SSO, it only takes one password to be compromised for a bad actor to access a wide range of internal apps and systems. SSO security can be improved by replacing passwords with Keyless’ passwordless authentication solution.

SSO is a session and user authentication service

 that allows a user to access multiple applications and services using only one singular set of login credentials. 

One of the main benefits for both employees and businesses using SSO is the fact that it allows enterprise users to avoid having to create a unique password for all the applications that they need throughout their working day. As such, this means that businesses using SSO can reduce their security vulnerabilities while also increasing employee productivity and collaboration. 

 between an application (service provider) and an identity provider. This “relationship” between identity and service provider is based on a certificate of authentication that is exchanged between the two parties when the user attempts to log into an application. 

One thing is clear - SSO improves the user experience. But at what cost? Let’s take a look at the security risks associated with an SSO authentication model.

Verizon Business 2022 Data Breach Investigations Report

 showed that hacking was the most common form of data breaches, with a Denial of Service (DoS) attack and the use of stolen credentials both equally responsible for 40% of the hacking actions taken last year. 

An SSO service is a potential golden ticket for cybercriminals because once a hacker has obtained the SSO login credentials, they can automatically get access to any number of applications that are linked to that specific account. Depending on how a user is authenticated (i.e., via OTPs to an email), a hacker could also take full control of an employee's email account and use this to register for even more services.

SSO authentication can also raise issues for businesses that have multiple users on a single device. For example, if the previous user forgets to completely log out of the SSO service before leaving the device, any accounts authenticated to that user will still be accessible on that same device for the next employee. Depending on the intentions of the second employee using the device, they could use their colleague's account to defame others, which could result in the termination of the wrong employee. 

 (such as Apple, Facebook or AWS) for Identity and Access Management (IAM) to verify and authenticate a user. However, should the third-party identity partners service be unavailable for whatever reason, the end user will be unable to access any of their accounts.

In practice, this means that even if the application’s (or service provider’s) service is available, a user will not be able to access their account directly. Instead, the user must wait until the identity provider's services are back online in order to use their account.

Little adherence to the principle of least privilege

The principle of least privilege dictates that a user should only have access to the minimum data, applications, and files needed to do their job. For example, under this principle, if a user wishes to access a file outside of their job range, they will need to request access before they can view or edit the file.

However, SSO systems do not necessarily limit certain users from only accessing content that is relevant to their position. The security concern with this is that you could potentially have senior-level, company-sensitive information being viewed by junior or freelance staff. Depending on what security procedures are in place, a rogue employee could also sabotage company documents if they haven’t been write-protected.

Keyless partners with major identity providers by combining authentication with SSO to provide customers with a best-of-both-worlds passwordless SSO authentication technology, offering greater security for businesses and employees, as well as improved usability for the end user.

Unlike traditional password-based systems that have the potential to be hacked due to compromised details or phishing attacks, with passwordless SSO, there is no password to steal.

As shown in the video above, passwordless SSO allows individuals to use several different services, without the risk to user privacy. Users who wish to log in to a particular service or application only need to tap a notification on their linked device to be authenticated.

Lastly, passwordless SSO also alleviates the workload of IT teams, which are often burdened by password reset requests. According to a study by Gartner, 

40% of an IT team's time is taken up by such tasks

If you’re interested in discovering the enhanced employee experiences that SSO identity systems offer but are concerned about the potential security threat to your organization, why not give passwordless SSO a try?

Discover how Keyless can help your organization securely authenticate employees without passwords OTPs, or hard tokens by clicking 

What is SSO and how Keyless helps improve SSO security

Improving liveness detection and anti-spoofing systems has become a key goal in the biometric authentication industry. However, it's important for businesses to note that, when it comes to mitigating account takeover threats, liveness detection can sometimes create a false sense of security.

 the advancement of deepfakes and the ease at which they can now be created is posing serious security threats for both businesses and individuals.  

With biometric authentication becoming more ubiquitous in everyday life, the need to guard against deepfakes is driving discussion around enhancing the security and effectiveness of facial recognition technologies.

In this article, we will explain why liveness detection can sometimes be undependable when it comes to detecting anomalies and threats during biometric authentication.

Liveness detection is an essential part of biometrics. Using AI-based algorithm techniques, liveness detection helps to verify that there is a real person behind the camera rather than a photograph, video, mask, or deepfake.

At present, liveness detection is used to help strengthen security and reliability during both identity verification and authentication processes.

However, while liveness detection can help strengthen security when applied correctly, it’s important to understand that it can sometimes create a false sense of security. The truth is, liveness detection on its own is not enough to ensure that the real person is authenticating.

According to recent reports, biometric spoofing threats are rising and could become increasingly scalable as hacking technology becomes sophisticated. 

highly-scalable biometric spoofing attacks are about to explode

 (otherwise known as deepfakes) that are “injected” directly into a victim’s device. 

 that the Fincrime outlook for 2023 will include more deepfake threats as digital payments using technologies like Apple’s FaceID surpass credit card payments. According to the article, Jumio’s CEO Robert Prigge warned:

To eliminate the risk of spoofing threats, it’s important that biometric authentication solutions combine liveness detection with a secondary, strong authentication factor.

At Keyless, we strengthen the reliability of our biometric authentication solutions by combining liveness detection with device verification software, which runs device background checks to verify that a person is attempting to log in from one of their trusted devices (essentially binding a user’s device to their Keyless account). 

Unlike with solutions like FaceID, users can log in using Keyless facial recognition software to multiple devices. Bound devices can be linked and unlinked at the discretion of the customer, giving them more control over managing their identity online. 

Biometric authentication solutions that combine liveness detection with a strong, second authentication factor, like device verification, are much more secure than those that rely on liveness detection alone or those that combine biometric challenges with knowledge challenges such as passwords, PINs, and OTPs (which can easily be compromised).

currently states that OTPs are a possession factor, but with 

, we advise our customers to view them as knowledge factor authentication challenges.

Is passive or active liveness detection better?

Passive liveness detection requires no prompted action from a user. Instead, the liveness detection systems will look for subtle observations in facial movements, such as eye & lip movement and blinking. Active liveness detection methods require users to consciously make physical gestures, such as looking from left to right or blinking. This is known as a "challenge-response" approach.

, active liveness detection has been known to be easier to spoof, with hackers reportedly using realistic masks, photos, and deepfake videos to fraudulently bypass challenge responses. However, 

the debate around active and passive liveness detection 

effectiveness is a complex one, with strong arguments for and against both methods. 

Perhaps the biggest drawback to active liveness detection is that user experience becomes more arduous – while this may not be a problem when implementing authentication solutions in high-risk sectors like government, military, and aviation, challenge-response systems would undoubtedly increase friction during day-to-day activities, such as authenticating payments or unlocking your phone.

How does Keyless improve liveness detection?

At Keyless, we use offline passive liveness detection, which does not require any interaction with the user, nor does it require an internet connection (or backend computation for more technical audiences). 

Our advanced biometric authentication systems use state-of-the-art deep learning models capable of detecting signals and patterns that can determine whether or not an image or video is fake.

Our advanced biometric authentication solutions combine liveness detection with anti-spoofing techniques that detect the slightest obstructions and distortions in a multitude of environments, including in low light conditions, which have undergone rigorous testing and have been 

certified for commercial use by the FIDO Alliance

Liveness detection cannot be used without a second, strong authentication factor

While liveness detection is a critical component of any facial recognition solution, it’s not a fail-safe when it comes to preventing spoofing and deep fake threats that threaten to upend business operations and cause long-lasting reputational and compliance consequences. 

To protect against a rise in biometric threats, it’s critical to combine facial recognition systems with an additional, strong authentication challenge such as device binding (device verification).

For more information on what Keyless can do to improve your business's security, 

schedule a free demo with one of our passwordless experts.

Why liveness detection is not enough to prevent spoofing threats

 shows that 81% of customers view biometrics as the more secure form of identity verification compared to passwords. So why, then, have some businesses been reluctant to implement passwordless logins? 

As biometric technologies become increasingly commonplace in online authentication and identity management, it's important that businesses properly evaluate solutions to ensure that personally identifiable information is protected against mounting privacy and security threats. 

Over the course of this article, we will highlight some of the privacy risks associated with biometric data, and look at how companies can use privacy-enhancing technologies (PETs) to make it safer to store biometric data while complying with cross-jurisdictional data protection laws.

What are the privacy risks of storing biometric data?

As mentioned above, data breaches are a very real threat and have the capacity to affect 

While much of the focus on data breaches tends to be on “written down” customer information (passwords, email addresses, telephone numbers, etc.), skilled hackers also 

Biometric data such as fingerprints are immutable and cannot be altered. As such, biometric data theft is far more dangerous than a standard password leak, as its could have wide ramifications for the person who has been hacked. 

Biometric data theft can pose a legitimate security concern, as a well-equipped and highly funded group of hackers could create a 

 to unlock any device or account that is linked to the hacked user. 

Due to the sensitive nature of biometrics, there are a number of policies around the world that govern how biometric data is collected, stored, and used. 

What are the regional differences in biometric legislation?

, the European Union leads the way when it comes to data protection regulation, and biometric data is no exception.

“special categories of personal data”

, the General Data Protection Regulation (GDPR) establishes that it is forbidden for any company to share the biometric data of EU citizens and long-term residents with third parties without their consent. 

Legislation for the protection of biometric data also exists outside of the EU, with India and China, in particular, having 

 on what can and can’t be done with biometric data.

In the United States, meanwhile, there is no single unified law that regulates biometric data (or any type of personal data for that matter), with individual states deciding on their own policies. However, the state of Illinois does have the 

, which is the most expansive policy in the country.

In light of the current security challenges facing every online business, organizations are beginning to adopt an approach known as 

 to help keep customer data safe. This approach has seen businesses implement one of five emerging PETs to ensure that any personal data processed has been safeguarded to prevent it from falling into the wrong hands. 

As highlighted above, there are five emerging PETs that are vital for safely using personal data online. Large organizations that handle sensitive customer data - such as banks - use PETs to ensure that their customers' data remain safe.

As highlighted above, by using secure multi-party computation, Keyless removes the need to store or process biometric data. This greatly enhances the security of Keyless, making it a no-brainer when it comes to safeguarding the identity of your customers.

 enables organizations to safely implement Keyless into their business without breaching regulations and exposing themselves to compliance risk.

So what are you waiting for? Give your customers the joy of a smooth, frictionless, 

Biometrics: Solving data protection challenges

Physical SIM cards have been present in mobile technology since the beginning of the smartphone revolution. However, unlike phones of the past, Apple’s latest release, the iPhone 14 series, comes without a physical SIM slot. Instead, these handsets exclusively use embedded SIMs (eSIMs), which can’t be removed. This design change makes it easier for users to change providers, enables users to connect to more than one network, and allows for extra physical space on the phone to enhance the design.

However, as the SIM has traditionally been the gateway to any connected device, what does its removal mean for security? Account takeover, a form of identity theft involving hijacking a user's account, is an ongoing problem that 

 in 2021. Could eSIMs be the answer to preventing threats posed by malicious actors?

In this article, we’ll examine the benefits and drawbacks of eSIMs from a security perspective and discuss why financial institutions must remain vigilant to the threats posed by eSIMs and data security.

In recent years SIM swapping has become an increasingly prevalent fraud technique. SIM swapping involves cybercriminals tricking mobile phone carriers into porting a genuine user’s phone number into the criminal’s device. They will pretend to be the genuine user and say that their device has been lost or damaged. When asked to provide identification, the criminal will provide real information on the user - often either stolen beforehand or bought on the dark web.

Once the cybercriminal has convinced the carrier to transfer the number, they will then be able to conduct account takeovers across any accounts linked to the compromised phone number. 

With an eSIM, however, as there is no physical SIM card, a cybercriminal cannot fraudulently claim that the SIM card got lost or damaged - which negates the ability of criminals to carry out a SIM swap. 

Apple’s iPhone 14 series has been seen as a key driver for eSIMs, which follows the US government’s 

. However, while enhanced data security is one of the key driving factors for this switch, iPhones sold outside of the US still feature a physical SIM card slot.

One of the most significant changes with the eSIM-enabled iPhones is that users must sign into their Apple iCloud ID to activate the device. The logic behind this is that Apple iCloud passwords are more complex than standard Apple ID passwords, thus making them more resistant to brute-force attacks.

However, despite the increased security of Apple iCloud passwords, any system that relies on a password (including those that use temporary one-time passwords - OTPs) are still vulnerable. For example, Apple ID passwords can be leaked, breached, or phished from users through various email and keylogging scams.

As with all new technologies, it will take some time to understand the full scale of security vulnerabilities. This is because cybercriminals generally follow the path of least resistance, meaning it might only make economic sense to focus their attention on compromising eSIMs once they are more broadly adopted. In the UK, for example, the adoption of eSIMs has been somewhat slow, with only three major networks offering eSIMs without any caveats. 

However, with Apple being the largest mobile phone manufacturer in the US, with 

, the likelihood is that eSIM security will be heavily tested in the coming months and years. 

Why biometrics are more reliably secure than eSIMs

While eSIMs help negate SIM-swap attacks, embedded SIMs such as those found on the iPhone 14 still rely on typed Apple ID passwords and OTPs. For the ultimate level of security, organizations should be utilizing biometric security, which replaces access via typed passwords with access via biological features. By using behavioral or biological characteristics for access control, data is at far less risk of being compromised.

Passwords are the biggest driver behind account takeovers, yet 

 say that changing their password was the only action they took after experiencing an attack. By sticking with a typed password authentication method, users are keeping themselves vulnerable to further data breaches.

Here at Keyless, we don’t rely on SIMs to authenticate users and we don’t send OTPs anywhere because we know that one-time passwords can and will be compromised, no matter the method by which they’re delivered to the customer.

By combining our patented privacy-preserving facial biometrics with device verification software, we provide a multi-factor authentication solution that is resilient against SIM-swapping malicious actors who try to capture OTPs sent to the user’s device or accounts. 

Our passwordless verification method also offers straightforward yet effective biometric-based authentication solutions for all users, allowing them to simply look into the camera for access – no passwords, PINs, or OTPs required.

To chat with a member of our team and see our technology in action, 

Will e-SIMs help to eliminate threats or make account takeovers easier?

Over the past five years, a raft of global jurisdiction changes has forced multinational corporations to rethink their business practices regarding data handling. 

Following the implementation of the European Union’s GDPR in 2018, a wide range of countries across the globe began to implement variants of data protection rules. The challenge for any global organization is to be aware of and remain compliant across multiple jurisdictions.

Throughout this article, we will provide a snapshot of data laws, analyzing how data protection rights are handled in different regions of the world and how these laws are driving the adoption of privacy-enhancing technologies. We will also be taking a look at what happens when companies fail to comply with changes to data protection laws.

Understanding data sovereignty, residency, and privacy

There are three main terms that are important when understanding how data protection works and the nuances associated with the topic. These are as follows:

A common example of data residency is when a company chooses a particular location to base itself in - typically, this is done in order to take advantage of a better tax regime. 

Businesses will then often be required to prove that they are predominately doing business and storing data within the borders of their chosen data residency in order to enjoy the benefits of their chosen location.

Every region has a different approach to how data is governed; for example, in Europe, data is governed and protected by the European Union under the General Data Protection Regulation (GDPR), which serves as a framework for how personal data is collected and processed from individuals who live both inside and outside of the EU.

What does data regulation look like around the world?

Outside of Europe, several differences exist in how each region (and sometimes even individual countries within the same region) handle data.

60% of countries in Africa have data protection and privacy legislation, with 20% reporting no legislation whatsoever. 

Meanwhile, in the Middle East, most nations have at least a draft form of legislation (Saudi Arabia & UAE, for example, have draft privacy and data protection legislation in place). However, as with some parts of Africa, Islamic countries operate under Sharia Law which has multiple principles regarding the divulging of personal secrets. Under the realm of privacy, Islam considers the safeguarding of people’s privacy as not only an individual duty of all people but also as the Islamic state and government’s obligation. Any violation of privacy is illegal.

Like in Africa, around 60% of countries in APAC have some form of data protection and privacy legislation. Of these, only Japan, New Zealand, and South Korea have adopted laws similar to Europe’s GDPR. 

Meanwhile, Australia has a system known as the Australian Privacy Principles (APP) that covers collecting, using, and disclosing personal information. A breach of an APP is considered to interfere with an individual's privacy and can lead to a number of penalties. 

Canada is the only North American nation with GDPR-like data protection legislation, while the US has legislation on a state level only.

In South America, only three countries have successfully passed GDPR-like legislation (Argentina, Brazil & Uruguay), with Paraguay also in the draft stages of creating said legislation.

Central America meanwhile has data protection and privacy legislation across most of the region, however, unlike GDPR, Central American nations’ laws are independent laws that aren't recognized outside of their respective countries borders. 

Across the Americas, 75% of countries have some form of legislation in place with a further 10% implementing draft legislation.

How are regulations driving the adoption of privacy-enhancing technologies?

Due to the rise in data protection laws around the world, the need for privacy-enhancing technologies (PETs) has never been greater.

As outlined by the ICO, the UK government’s independent regulatory office that deals with data protection, PETs can help organizations operate under the concept of 

Blog

Blog