The U.S. Department of Health and Human Services has updated addiction treatment privacy rules to align with HIPAA and HITECH, enhancing protections for substance use disorder treatment records. Concurrently, the legal landscape for data privacy is evolving, with increasing state laws in the U.S. and recent class action rulings in Canada that clarify liability for data custodians in cyberattack cases. The B.C. Court of Appeal ruled that data custodians may face privacy claims even if they were not at fault for data breaches, affirming that victims can potentially claim against these entities under privacy statutes. In addition, organizations are emphasizing the importance of consent and transparency in their data collection practices, notably in privacy statements which outline the usage and protection of personal information. The patchwork of data privacy laws remains complex, highlighting the need for organizations to stay compliant across jurisdictions. Overall, the evolving regulatory environment reflects increasing scrutiny on how personal data is managed and protected.