# Regulations: full list (190 regulations, generated 2026-11-09) Format: regulation | jurisdiction | status | effective date | source, then one indented line per deadline: date | what | source. Alabama Personal Data Protection Act (APDPA) | Alabama | Enacted | effective 2027-05-01 | https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf | https://regulations.fru.dev/regulations/us-al-apdpa 2027-05-01 | APDPA takes effect | https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf Alberta POPA | Alberta, Canada | In force | effective 2025-06-11 | https://kings-printer.alberta.ca/1266.cfm?page=p28p5.cfm&leg_type=Acts&isbncln=9780779861309&display=html | https://regulations.fru.dev/regulations/ca-ab-popa 2025-06-11 | POPA in force | https://kings-printer.alberta.ca/1266.cfm?page=p28p5.cfm&leg_type=Acts&isbncln=9780779861309&display=html 2026-06-11 | Privacy management programs required | https://kings-printer.alberta.ca/1266.cfm?page=p28p5.cfm&leg_type=Acts&isbncln=9780779861309&display=html Argentina Law 25.326 | Argentina | In force | effective not set | https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/norma.htm | https://regulations.fru.dev/regulations/ar-pdpl 2000-10-04 | Law sanctioned | https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/norma.htm 2000-11-02 | Published in Boletín Oficial | https://servicios.infoleg.gob.ar/infolegInternet/verNorma.do?id=64790 Arkansas COPPA 2.0 | Arkansas | In force | effective 2026-07-01 | https://arkleg.state.ar.us/Bills/Detail?id=HB1717&ddBienniumSession=2025%2F2025R | https://regulations.fru.dev/regulations/us-ar-cttoppa 2025-04-21 | Approved by Governor | https://arkleg.state.ar.us/Bills/Detail?id=HB1717&ddBienniumSession=2025%2F2025R 2026-07-01 | Takes effect | https://arkleg.state.ar.us/Bills/Detail?id=HB1717&ddBienniumSession=2025%2F2025R Australia Cyber Security Act (ransomware reporting) | Australia | In force | effective 2024-11-30 | https://www.legislation.gov.au/C2024A00098/asmade | https://regulations.fru.dev/regulations/au-cyber-security-act 2025-05-30 | Ransomware payment reporting starts | https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf 2026-01-01 | Ransomware reporting moves to compliance phase | https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf 2026-03-04 | Smart device security standard applies | https://www.legislation.gov.au/F2025L00276/asmade Australia Online Safety Act | Australia | Amended | effective 2022-01-23 | https://www.legislation.gov.au/C2021A00076/asmade | https://regulations.fru.dev/regulations/au-online-safety-act 2022-01-23 | Online Safety Act commences | https://www.legislation.gov.au/C2021A00076/asmade Australia Privacy Act | Australia | Amended | effective 2024-12-11 | https://www.legislation.gov.au/C2024A00128/asmade | https://regulations.fru.dev/regulations/au-privacy-act 2024-12-11 | Most POLA Act 2024 amendments commence | https://www.legislation.gov.au/C2024A00128/asmade 2025-06-10 | Statutory tort for serious invasions of privacy commences | https://www.legislation.gov.au/C2024A00128/asmade 2026-12-10 | Children's Online Privacy Code must be registered | https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code 2026-12-10 | Automated decision-making transparency applies | https://www.legislation.gov.au/C2024A00128/asmade Australia SOCI Act | Australia | Amended | effective 2018-07-11 | https://www.legislation.gov.au/C2018A00029/asmade | https://regulations.fru.dev/regulations/au-soci-act 2018-07-11 | SOCI Act commences | https://www.legislation.gov.au/C2018A00029/asmade 2022-07-08 | Mandatory cyber incident reporting starts for most assets (tentative) | https://www.legislation.gov.au/F2022L00562/asmade Australia Social Media Minimum Age | Australia | In force | effective 2025-12-10 | https://www.legislation.gov.au/C2024A00127/asmade | https://regulations.fru.dev/regulations/au-social-media-min-age 2025-12-10 | Social media minimum age obligation applies | https://www.legislation.gov.au/C2024A00127/asmade 2026-09-12 | Strengthened enforcement amendments commence | https://www.legislation.gov.au/C2026A00083/asmade Bahrain PDPL | Bahrain | In force | effective 2019-08-01 | https://www.lloc.gov.bh/Legislation/HTM/K3018 | https://regulations.fru.dev/regulations/bh-pdpl 2019-08-01 | PDPL takes effect (tentative) | https://www.lloc.gov.bh/Legislation/HTM/K3018 Brazil AI Bill (PL 2338/2023) | Brazil | Proposed | effective not set | https://www25.senado.leg.br/web/atividade/materias/-/materia/157233 | https://regulations.fru.dev/regulations/br-ai-bill 2024-12-10 | Approved by the Federal Senate | https://www25.senado.leg.br/web/atividade/materias/-/materia/157233 Brazil ECA Digital | Brazil | In force | effective 2026-03-17 | https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm | https://regulations.fru.dev/regulations/br-eca-digital 2026-03-17 | ECA Digital in force | https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm Brazil LGPD | Brazil | In force | effective 2020-09-18 | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm | https://regulations.fru.dev/regulations/br-lgpd 2020-09-18 | LGPD in force | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm 2021-08-01 | ANPD sanctions enforceable | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm 2024-08-23 | International transfer regulation published | https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396 2025-08-23 | Deadline to adopt ANPD standard contractual clauses | https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396 California AB 2013 (AI training data transparency) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 | https://regulations.fru.dev/regulations/us-ca-ab2013 2024-09-28 | AB 2013 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 2026-01-01 | Training-data documentation due | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 California ADS employment regulations | California | In force | effective 2025-10-01 | https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/ | https://regulations.fru.dev/regulations/us-ca-ads-regs 2025-06-27 | OAL approves regulations | https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/ 2025-10-01 | ADS regulations take effect | https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/ California AI Auditor Registry | California | Enacted | effective 2027-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1405 | https://regulations.fru.dev/regulations/us-ca-ab1405 2026-09-09 | Signed by Governor | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1405 2027-01-01 | Act takes effect | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1405 2029-01-01 | Registry opens and registration required | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1405 California AI autonomous-harm defense ban | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB316 | https://regulations.fru.dev/regulations/us-ca-ab316 2025-10-13 | Signed by Governor | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB316 2026-01-01 | Takes effect | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB316 California AI Transparency Act (SB 942) | California | Amended | effective 2026-08-02 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 | https://regulations.fru.dev/regulations/us-ca-sb942 2024-09-19 | SB 942 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942 2025-10-13 | AB 853 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2026-01-01 | Original operative date (superseded) | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942 2026-08-02 | Covered provider duties apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2027-01-01 | Large online platform and hosting platform duties | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2028-01-01 | Capture device manufacturer duties | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 California Delete Act / DROP | California | In force | effective 2024-01-01 | https://www.cppa.ca.gov/data_brokers/ | https://regulations.fru.dev/regulations/us-ca-delete-act 2026-01-01 | DROP opens to consumers | https://www.cppa.ca.gov/data_brokers/ 2026-01-31 | Annual data broker registration deadline | https://www.cppa.ca.gov/data_brokers/ 2026-08-01 | Data brokers must begin processing DROP deletion requests | https://www.cppa.ca.gov/data_brokers/ 2027-01-31 | Annual data broker registration deadline | https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.99.82 2028-01-01 | Independent third-party audits begin | https://www.cppa.ca.gov/data_brokers/ California Digital Age Assurance Act | California | Enacted | effective 2027-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043 | https://regulations.fru.dev/regulations/us-ca-ab1043 2025-10-13 | Signed by Governor | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043 2027-01-01 | Age signal duties begin | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043 2027-07-01 | Deadline for existing devices and apps | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043 California SB 243 (companion chatbots) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 | https://regulations.fru.dev/regulations/us-ca-sb243 2025-10-13 | SB 243 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 2026-01-01 | Chatbot safeguards apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 2027-07-01 | First annual report to Office of Suicide Prevention | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 California SB 53 (TFAIA) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 | https://regulations.fru.dev/regulations/us-ca-sb53 2025-09-29 | SB 53 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 2026-01-01 | Frontier developer obligations apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 2027-01-01 | First OES anonymized incident report and CDT definition review | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 California SB 976 addictive feeds | California | In force | effective 2025-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB976 | https://regulations.fru.dev/regulations/us-ca-sb976 2024-09-20 | Signed by Governor | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB976 2025-01-01 | Takes effect | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB976 2027-01-01 | Age assurance duty and AG rules | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB976 California Senate Bill 813 | California | Enacted | effective not set | https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/ | https://regulations.fru.dev/regulations/us-ca-us-ca-sb813 | UNVERIFIED 2026-09-09 | Signed by Governor | https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/ California social media account deletion | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB656 | https://regulations.fru.dev/regulations/us-ca-ab656 2025-10-08 | Signed by Governor | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB656 2026-01-01 | Takes effect | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB656 CCPA / CPRA | California | Amended | effective 2020-01-01 | https://cppa.ca.gov/regulations/ccpa_updates.html | https://regulations.fru.dev/regulations/us-ca-ccpa 2020-01-01 | CCPA takes effect | https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf 2023-01-01 | CPRA amendments operative | https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf 2025-01-01 | CPI adjustment of thresholds and fines | https://cppa.ca.gov/regulations/cpi_adjustment.html 2025-09-22 | ADMT, risk assessment and cybersecurity audit regulations approved | https://cppa.ca.gov/regulations/ccpa_updates.html 2026-01-01 | New CCPA regulations take effect | https://cppa.ca.gov/regulations/ccpa_updates.html 2027-01-01 | ADMT requirements compliance date | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2027-01-01 | Browsers must support opt-out preference signal (AB 566) | https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB566 2027-12-31 | Risk assessments for pre-existing processing due | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2028-04-01 | First risk assessment submission to CPPA | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2028-04-01 | Cybersecurity audit due: revenue over $100M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2029-04-01 | Cybersecurity audit due: revenue $50M-$100M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2030-04-01 | Cybersecurity audit due: revenue under $50M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf Canada Bill C-36 (PPCDA) | Canada | Proposed | effective not set | https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading | https://regulations.fru.dev/regulations/ca-c36-ppcda 2026-06-15 | Bill C-36 tabled (first reading) | https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading Canada Bill C-8 / CCSPA | Canada | Enacted | effective not set | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 | https://regulations.fru.dev/regulations/ca-ccspa 2025-06-18 | Bill C-8 introduced | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 2026-06-15 | Royal Assent | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 PIPEDA | Canada | In force | effective 2001-01-01 | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ | https://regulations.fru.dev/regulations/ca-pipeda 2001-01-01 | PIPEDA Part 1 in force (phase 1) | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ 2004-01-01 | PIPEDA applies to all commercial activity | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ 2018-11-01 | Mandatory breach reporting | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ Chile Personal Data Protection Law (Ley 21.719) | Chile | Enacted | effective 2026-12-01 | https://www.bcn.cl/leychile/navegar?idNorma=1209272 | https://regulations.fru.dev/regulations/cl-pdpl 2024-12-13 | Published in Diario Oficial | https://www.bcn.cl/leychile/navegar?idNorma=1209272 2026-12-01 | Law in force | https://www.bcn.cl/leychile/navegar?idNorma=1209272 2027-12-01 | Proposed postponement of entry into force (tentative) | https://tramitacion.senado.cl/appsenado/templates/tramitacion/index.php?boletin_ini=18623-07 China AI Content Labeling Measures | China | In force | effective 2025-09-01 | https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm | https://regulations.fru.dev/regulations/cn-ai-labeling 2025-09-01 | AI content labeling measures and GB 45438-2025 take effect | https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm China Algorithmic Recommendation Provisions | China | In force | effective 2022-03-01 | https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm | https://regulations.fru.dev/regulations/cn-algorithm-recommendation 2022-03-01 | Algorithmic recommendation provisions take effect | https://www.cac.gov.cn/2022-01/04/c_1642894606364259.htm China Anthropomorphic AI Measures | China | In force | effective 2026-07-15 | https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm | https://regulations.fru.dev/regulations/cn-anthropomorphic-ai 2026-07-15 | Anthropomorphic AI measures take effect | https://www.cac.gov.cn/2026-04/10/c_1777558395078289.htm China Cross-Border Data Flow Provisions | China | In force | effective 2024-03-22 | https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm | https://regulations.fru.dev/regulations/cn-cross-border 2024-03-22 | Cross-border data flow provisions take effect | https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm China Cyber Incident Reporting Measures | China | In force | effective 2025-11-01 | https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm | https://regulations.fru.dev/regulations/cn-incident-reporting 2025-11-01 | Incident reporting measures take effect | https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm China Cybersecurity Law | China | Amended | effective 2017-06-01 | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm | https://regulations.fru.dev/regulations/cn-csl 2017-06-01 | Cybersecurity Law takes effect | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm 2026-01-01 | 2025 amendments take effect | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm China Data Export Security Assessment Measures | China | In force | effective 2022-09-01 | https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm | https://regulations.fru.dev/regulations/cn-sa-measures 2022-09-01 | Security assessment measures take effect | https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm 2023-03-01 | Remediation window for existing transfers ends (tentative) | https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm China Data Security Law | China | In force | effective 2021-09-01 | http://www.cac.gov.cn/2021-06/11/c_1624994566919140.htm | https://regulations.fru.dev/regulations/cn-dsl 2021-09-01 | Data Security Law takes effect | http://www.cac.gov.cn/2021-06/11/c_1624994566919140.htm China Data Security Risk Assessment Measures | China | In force | effective 2026-08-20 | https://www.cac.gov.cn/2026-06/18/c_1783525609815499.htm | https://regulations.fru.dev/regulations/cn-data-risk-assessment 2026-08-20 | Risk assessment measures take effect | https://www.cac.gov.cn/2026-06/18/c_1783525609815499.htm China Deep Synthesis Provisions | China | In force | effective 2023-01-10 | https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm | https://regulations.fru.dev/regulations/cn-deep-synthesis 2023-01-10 | Deep synthesis provisions take effect | https://www.cac.gov.cn/2022-12/11/c_1672221949354811.htm China Facial Recognition Measures | China | In force | effective 2025-06-01 | https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm | https://regulations.fru.dev/regulations/cn-facial-recognition 2025-06-01 | Facial recognition measures take effect | https://www.cac.gov.cn/2025-03/21/c_1744174262156096.htm China Generative AI Measures | China | In force | effective 2023-08-15 | https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm | https://regulations.fru.dev/regulations/cn-genai-measures 2023-08-15 | Generative AI measures take effect | https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm China Minors Online Protection Regulations | China | In force | effective 2024-01-01 | https://www.cac.gov.cn/2023-10/24/c_1699806932316206.htm | https://regulations.fru.dev/regulations/cn-minors-online-protection 2024-01-01 | Minors online protection regulations take effect | https://www.cac.gov.cn/2023-10/24/c_1699806932316206.htm 2026-03-01 | Classification measures for content harmful to minors take effect | https://www.cac.gov.cn/2026-01/23/c_1770728781060093.htm 2026-04-01 | Measures identifying large or influential platforms for minors take effect | https://www.cac.gov.cn/2026-02/28/c_1774010730056867.htm China Network Data Security Regulations | China | In force | effective 2025-01-01 | https://www.gov.cn/zhengce/content/202409/content_6977766.htm | https://regulations.fru.dev/regulations/cn-network-data-regs 2025-01-01 | Network Data Regulations take effect | https://www.gov.cn/zhengce/content/202409/content_6977766.htm China PI Compliance Audit Measures | China | In force | effective 2025-05-01 | https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm | https://regulations.fru.dev/regulations/cn-pi-compliance-audit 2025-05-01 | PI compliance audit measures take effect | https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm China PI Export Certification Measures | China | In force | effective 2026-01-01 | https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm | https://regulations.fru.dev/regulations/cn-pi-certification 2026-01-01 | PI export certification measures take effect | https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm China PI Export Standard Contract Measures | China | In force | effective 2023-06-01 | https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm | https://regulations.fru.dev/regulations/cn-scc-measures 2023-06-01 | Standard contract measures take effect | https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm 2023-12-01 | Remediation window for existing transfers ends (tentative) | https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm China PIPL | China | In force | effective 2021-11-01 | http://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm | https://regulations.fru.dev/regulations/cn-pipl 2021-11-01 | PIPL takes effect | http://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm China Small PI Handler Simplified Measures | China | In force | effective 2026-09-01 | https://www.cac.gov.cn/2026-07/24/c_1786638889704872.htm | https://regulations.fru.dev/regulations/cn-small-pi-handlers 2026-09-01 | Simplified measures for small handlers take effect | https://www.cac.gov.cn/2026-07/24/c_1786638889704872.htm Colorado AI Act | Colorado | Enacted | effective 2027-01-01 | https://leg.colorado.gov/bills/sb26-189 | https://regulations.fru.dev/regulations/us-co-ai-act 2024-05-17 | SB 24-205 signed | https://leg.colorado.gov/bills/sb24-205 2025-08-28 | SB 25B-004 delays the act | https://leg.colorado.gov/bills/sb25b-004 2026-02-01 | Original effective date (superseded) | https://leg.colorado.gov/bills/sb24-205 2026-05-14 | SB 26-189 signed (repeal and reenact) | https://leg.colorado.gov/bills/sb26-189 2026-06-30 | Delayed effective date (superseded) | https://leg.colorado.gov/bills/sb25b-004 2027-01-01 | ADMT obligations apply | https://leg.colorado.gov/bills/sb26-189 2027-01-01 | AG rules due | https://leg.colorado.gov/bills/sb26-189 2030-01-01 | Mandatory cure period ends | https://leg.colorado.gov/bills/sb26-189 Colorado Privacy Act (CPA) | Colorado | Amended | effective 2023-07-01 | https://leg.colorado.gov/bills/sb21-190 | https://regulations.fru.dev/regulations/us-co-cpa 2023-07-01 | CPA takes effect | https://leg.colorado.gov/bills/sb21-190 2024-07-01 | Universal opt-out mechanism recognition required | https://leg.colorado.gov/bills/sb21-190 2025-01-01 | 60-day cure period expires | https://leg.colorado.gov/bills/sb21-190 2025-05-23 | SB 25-276 geolocation and sensitive-data sale amendment effective | https://leg.colorado.gov/bills/sb25-276 2025-07-01 | Biometric identifier amendment (HB 24-1130) effective | https://leg.colorado.gov/bills/hb24-1130 2025-10-01 | Minors' data amendment (SB 24-041) effective | https://leg.colorado.gov/bills/sb24-041 Connecticut Data Privacy Act (CTDPA) | Connecticut | Amended | effective 2023-07-01 | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF | https://regulations.fru.dev/regulations/us-ct-ctdpa 2023-07-01 | CTDPA takes effect | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2024-12-31 | Mandatory 60-day cure period expires | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2025-01-01 | Universal opt-out preference signals required | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2026-07-01 | PA 25-113 (SB 1295) amendments take effect | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF 2026-08-01 | Profiling impact assessments apply | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF 2026-10-01 | PA 26-64 (SB 4) amendments take effect | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF 2027-01-01 | Data broker registration required | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF 2028-10-01 | Data brokers must process state deletion mechanism requests | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF CoE AI Framework Convention | Council of Europe | Enacted | effective not set | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:22026A01081 | https://regulations.fru.dev/regulations/coe-ai-convention 2024-09-05 | Opened for signature | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:22026A01081 2026-04-21 | EU concludes the Convention | https://eur-lex.europa.eu/eli/dec/2026/1080/oj/eng Delaware Personal Data Privacy Act (DPDPA) | Delaware | Amended | effective 2025-01-01 | https://delcode.delaware.gov/title6/c012d/index.html | https://regulations.fru.dev/regulations/us-de-dpdpa 2025-01-01 | DPDPA takes effect | https://delcode.delaware.gov/title6/c012d/index.html 2025-12-31 | Mandatory 60-day cure period expires | https://delcode.delaware.gov/title6/c012d/index.html 2026-01-01 | Opt-out preference signals must be honored | https://delcode.delaware.gov/title6/c012d/index.html 2027-01-01 | Amended thresholds and third-party duties take effect | https://delcode.delaware.gov/title6/c012d/index.html Egypt PDPL | Egypt | In force | effective 2020-10-16 | https://www.pdpc.gov.eg/assets/pdf-data/PDPL%20no.%20151%20of%202020%20(ar).pdf | https://regulations.fru.dev/regulations/eg-pdpl 2020-10-16 | PDPL takes effect (tentative) | https://www.pdpc.gov.eg/assets/pdf-data/PDPL%20no.%20151%20of%202020%20(ar).pdf 2025-11-02 | Executive Regulations take effect | https://www.pdpc.gov.eg/assets/pdf-data/Executive%20Regulation.pdf 2026-11-02 | One-year compliance window ends (tentative) | https://www.pdpc.gov.eg/assets/pdf-data/PDPL%20no.%20151%20of%202020%20(ar).pdf Cyber Resilience Act | European Union | Enacted | effective 2024-12-10 | https://eur-lex.europa.eu/eli/reg/2024/2847/oj | https://regulations.fru.dev/regulations/eu-cra 2024-12-10 | CRA enters into force | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2026-06-11 | Conformity assessment body provisions apply | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2026-09-11 | Vulnerability and incident reporting obligations apply | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2027-12-11 | CRA fully applies | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2028-06-11 | Legacy type-examination certificates expire | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2028-09-11 | Report on single reporting platform | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2030-12-11 | First CRA evaluation | https://eur-lex.europa.eu/eli/reg/2024/2847/oj Data Governance Act | European Union | Amended | effective 2022-06-23 | https://eur-lex.europa.eu/eli/reg/2022/868/oj | https://regulations.fru.dev/regulations/eu-dga 2022-06-23 | DGA enters into force | https://eur-lex.europa.eu/eli/reg/2022/868/oj 2023-09-24 | DGA applies | https://eur-lex.europa.eu/eli/reg/2022/868/oj 2025-09-24 | Legacy data intermediaries must comply | https://eur-lex.europa.eu/eli/reg/2022/868/oj Digital Markets Act | European Union | In force | effective 2022-11-01 | https://eur-lex.europa.eu/eli/reg/2022/1925/oj | https://regulations.fru.dev/regulations/eu-dma 2022-11-01 | DMA enters into force | https://eur-lex.europa.eu/eli/reg/2022/1925/oj 2023-05-02 | DMA applies | https://eur-lex.europa.eu/eli/reg/2022/1925/oj 2023-09-06 | First six gatekeepers designated | https://digital-markets-act.ec.europa.eu/gatekeepers_en 2024-03-07 | Gatekeeper compliance deadline (first designations) | https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328 2026-05-03 | DMA first review | https://eur-lex.europa.eu/eli/reg/2022/1925/oj/eng Digital Omnibus (data/GDPR) | European Union | Proposed | effective not set | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837 | https://regulations.fru.dev/regulations/eu-digital-omnibus Digital Services Act | European Union | In force | effective 2022-11-16 | https://eur-lex.europa.eu/eli/reg/2022/2065/oj | https://regulations.fru.dev/regulations/eu-dsa 2022-11-16 | DSA enters into force | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2023-02-17 | Platforms publish EU user numbers | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2023-04-25 | First VLOP/VLOSE designations | https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses 2024-02-17 | DSA applies to all intermediary services | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2025-07-01 | DSA transparency report templates mandatory | https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng 2025-10-29 | DSA delegated act on researcher data access in force | https://eur-lex.europa.eu/eli/reg_del/2025/2050/oj/eng 2025-11-17 | DSA review report on VLOP scope and interplay | https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng 2026-01-01 | DSA first harmonised transparency reporting cycle | https://eur-lex.europa.eu/eli/reg_impl/2024/2835/oj/eng 2026-08-31 | ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs | https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act 2027-02-18 | DSA SME impact report | https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng DORA | European Union | In force | effective 2023-01-16 | https://eur-lex.europa.eu/eli/reg/2022/2554/oj | https://regulations.fru.dev/regulations/eu-dora 2023-01-16 | DORA enters into force | https://eur-lex.europa.eu/eli/reg/2022/2554/oj 2025-01-17 | DORA applies | https://eur-lex.europa.eu/eli/reg/2022/2554/oj 2025-04-30 | First registers of information submitted to the ESAs | https://www.eba.europa.eu/publications-and-media/press-releases/esas-announce-timeline-collect-information-designation-critical-ict-third-party-service-providers 2025-07-08 | TLPT regulatory technical standards enter into force | https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj 2025-11-18 | First critical ICT third-party providers designated | https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital eIDAS 2 / EU Digital Identity Wallet | European Union | Enacted | effective 2024-05-20 | https://eur-lex.europa.eu/eli/reg/2024/1183/oj | https://regulations.fru.dev/regulations/eu-eidas2 2024-05-20 | eIDAS 2 enters into force | https://eur-lex.europa.eu/eli/reg/2024/1183/oj 2024-12-24 | First wallet implementing acts enter into force | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj 2026-05-21 | Legacy qualified trust service providers conformity report | https://eur-lex.europa.eu/eli/reg/2024/1183/oj 2026-12-24 | Member States must provide EU Digital Identity Wallets | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj 2027-12-24 | Private relying parties must accept wallets | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj ePrivacy Directive (cookie law) | European Union | Amended | effective 2002-07-31 | https://eur-lex.europa.eu/eli/dir/2002/58/oj | https://regulations.fru.dev/regulations/eu-eprivacy 2002-07-31 | ePrivacy Directive enters into force | https://eur-lex.europa.eu/eli/dir/2002/58/oj 2003-10-31 | Original transposition deadline | https://eur-lex.europa.eu/eli/dir/2002/58/oj 2011-05-25 | Cookie consent amendment transposition deadline | https://eur-lex.europa.eu/eli/dir/2009/136/oj EU AI Act | European Union | Amended | effective 2024-08-01 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj | https://regulations.fru.dev/regulations/eu-ai-act 2024-08-01 | AI Act enters into force | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2025-02-02 | Prohibited practices and AI literacy apply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2025-08-02 | GPAI, governance, notified bodies and penalties apply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2026-07-27 | Digital Omnibus on AI enters into force | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2026-08-02 | General application: transparency obligations, GPAI fines, most other rules | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2026-12-02 | New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2027-08-02 | Legacy GPAI models must comply; national AI sandboxes operational | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2027-12-02 | High-risk obligations apply to Annex III systems | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2028-08-02 | High-risk obligations apply to Annex I product-embedded systems | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2030-08-02 | Public-authority high-risk systems must comply | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2030-12-31 | Large-scale EU IT systems must comply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj EU Consumer Credit Directive 2 (CCD2) | European Union | Enacted | effective 2026-11-20 | https://eur-lex.europa.eu/eli/dir/2023/2225/oj/eng | https://regulations.fru.dev/regulations/eu-ccd2 2025-11-20 | Transposition deadline | https://eur-lex.europa.eu/eli/dir/2023/2225/oj/eng 2026-11-20 | National rules apply | https://eur-lex.europa.eu/eli/dir/2023/2225/oj/eng EU CSAM Interim Regulation | European Union | In force | effective 2026-07-31 | https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng | https://regulations.fru.dev/regulations/eu-csam-interim 2026-04-03 | Previous interim regulation expires | https://eur-lex.europa.eu/eli/reg/2024/1307/oj/eng 2026-07-31 | New interim regulation enters into force | https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng 2028-02-01 | Commission implementation report | https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng 2028-04-03 | Interim derogation expires | https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng EU Cyber Solidarity Act | European Union | In force | effective 2025-02-04 | https://eur-lex.europa.eu/eli/reg/2025/38/oj/eng | https://regulations.fru.dev/regulations/eu-cyber-solidarity-act 2025-02-04 | Cyber Solidarity Act enters into force | https://eur-lex.europa.eu/eli/reg/2025/38/oj/eng 2027-02-05 | First Commission evaluation | https://eur-lex.europa.eu/eli/reg/2025/38/oj/eng EU Cybersecurity Act | European Union | Amended | effective 2019-06-27 | https://eur-lex.europa.eu/eli/reg/2019/881/oj/eng | https://regulations.fru.dev/regulations/eu-cybersecurity-act 2019-06-27 | Cybersecurity Act enters into force | https://eur-lex.europa.eu/eli/reg/2019/881/oj/eng 2021-06-28 | Certification enforcement articles apply | https://eur-lex.europa.eu/eli/reg/2019/881/oj/eng 2026-01-20 | Cybersecurity Act 2 proposed | https://publications.europa.eu/resource/celex/52026PC0011 EU Data Act | European Union | In force | effective 2024-01-11 | https://eur-lex.europa.eu/eli/reg/2023/2854/oj | https://regulations.fru.dev/regulations/eu-data-act 2024-01-11 | Data Act enters into force | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2024-01-11 | Reduced switching charges period begins | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2025-09-12 | Data Act applies | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2025-09-12 | Member States notify penalty rules | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2026-09-12 | Access-by-design for new connected products | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2027-01-12 | Cloud switching charges abolished | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2027-09-12 | Unfair-terms rules extend to older long-term contracts | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2028-09-12 | Commission evaluation | https://eur-lex.europa.eu/eli/reg/2023/2854/oj EU e-Evidence Package | European Union | In force | effective 2026-08-18 | https://eur-lex.europa.eu/eli/reg/2023/1543/oj/eng | https://regulations.fru.dev/regulations/eu-e-evidence 2023-08-17 | Package enters into force | https://eur-lex.europa.eu/eli/reg/2023/1543/oj/eng 2026-02-18 | Legal representatives Directive transposition | https://eur-lex.europa.eu/eli/dir/2023/1544/oj/eng 2026-08-18 | e-Evidence Regulation applies | https://eur-lex.europa.eu/eli/reg/2023/1543/oj/eng EU Financial Data Access (FIDA) proposal | European Union | Proposed | effective not set | https://publications.europa.eu/resource/celex/52023PC0360 | https://regulations.fru.dev/regulations/eu-fida 2023-06-28 | FIDA proposed | https://publications.europa.eu/resource/celex/52023PC0360 EU KIDS Act | European Union | Proposed | effective not set | https://digital-strategy.ec.europa.eu/en/news/eu-kids-act-restrict-social-media-platforms-access-children-eu | https://regulations.fru.dev/regulations/eu-eu-kids-act | UNVERIFIED EU Platform Work Directive | European Union | Enacted | effective 2024-12-01 | https://eur-lex.europa.eu/eli/dir/2024/2831/oj/eng | https://regulations.fru.dev/regulations/eu-platform-work 2024-12-01 | Directive enters into force | https://eur-lex.europa.eu/eli/dir/2024/2831/oj/eng 2026-12-02 | Transposition deadline | https://eur-lex.europa.eu/eli/dir/2024/2831/oj/eng EU Political Advertising Regulation (TTPA) | European Union | In force | effective 2025-10-10 | https://eur-lex.europa.eu/eli/reg/2024/900/oj/eng | https://regulations.fru.dev/regulations/eu-ttpa 2024-04-09 | TTPA enters into force | https://eur-lex.europa.eu/eli/reg/2024/900/oj/eng 2025-10-10 | TTPA applies | https://eur-lex.europa.eu/eli/reg/2024/900/oj/eng 2026-01-10 | Member States notify sanction rules | https://eur-lex.europa.eu/eli/reg/2024/900/oj/eng EU-US Data Privacy Framework | European Union | In force | effective 2023-07-10 | https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj | https://regulations.fru.dev/regulations/eu-us-dpf 2023-07-10 | DPF adequacy decision adopted and effective | https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj 2025-09-03 | General Court upholds DPF (Latombe v Commission) | https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf 2025-10-31 | Latombe appeal lodged at the Court of Justice | https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework European Health Data Space (EHDS) | European Union | Enacted | effective 2025-03-25 | https://eur-lex.europa.eu/eli/reg/2025/327/oj | https://regulations.fru.dev/regulations/eu-ehds 2025-03-25 | EHDS enters into force | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2027-03-26 | EHDS general application date | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2029-03-26 | Primary use for first data categories; secondary use framework applies | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2031-03-26 | Primary use for second data categories; EHR systems in service; extra secondary-use categories | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2035-03-26 | Third-country participation in secondary use | https://eur-lex.europa.eu/eli/reg/2025/327/oj GDPR | European Union | Amended | effective 2016-05-24 | https://eur-lex.europa.eu/eli/reg/2016/679/oj | https://regulations.fru.dev/regulations/eu-gdpr 2016-05-24 | GDPR enters into force | https://eur-lex.europa.eu/eli/reg/2016/679/oj 2018-05-25 | GDPR applies | https://eur-lex.europa.eu/eli/reg/2016/679/oj 2025-11-26 | GDPR Procedural Regulation adopted | https://eur-lex.europa.eu/eli/reg/2025/2518/oj 2026-01-01 | GDPR Procedural Regulation enters into force | https://eur-lex.europa.eu/eli/reg/2025/2518/oj 2027-04-02 | GDPR Procedural Regulation applies | https://eur-lex.europa.eu/eli/reg/2025/2518/oj Interoperable Europe Act | European Union | In force | effective 2024-07-12 | https://eur-lex.europa.eu/eli/reg/2024/903/oj/eng | https://regulations.fru.dev/regulations/eu-interoperable-europe 2024-04-11 | Act enters into force | https://eur-lex.europa.eu/eli/reg/2024/903/oj/eng 2024-07-12 | Act applies | https://eur-lex.europa.eu/eli/reg/2024/903/oj/eng 2025-01-12 | Interoperability assessments mandatory | https://eur-lex.europa.eu/eli/reg/2024/903/oj/eng NIS2 | European Union | Amended | effective 2023-01-16 | https://eur-lex.europa.eu/eli/dir/2022/2555/oj | https://regulations.fru.dev/regulations/eu-nis2 2023-01-16 | NIS2 enters into force | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-10-17 | Transposition deadline | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-10-18 | National NIS2 measures apply; NIS1 repealed | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-11-07 | Implementing Regulation 2024/2690 enters into force | https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj 2025-01-17 | Digital infrastructure entities submit registration data | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2025-04-17 | Member States establish entity lists | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2027-04-17 | Next biennial entity notification | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2027-10-17 | Commission review of NIS2 | https://eur-lex.europa.eu/eli/dir/2022/2555/oj Product Liability Directive | European Union | Enacted | effective 2024-12-08 | https://eur-lex.europa.eu/eli/dir/2024/2853/oj | https://regulations.fru.dev/regulations/eu-pld 2024-12-08 | New PLD enters into force | https://eur-lex.europa.eu/eli/dir/2024/2853/oj 2026-12-09 | Transposition deadline; old PLD repealed | https://eur-lex.europa.eu/eli/dir/2024/2853/oj Florida Digital Bill of Rights | Florida | In force | effective 2024-07-01 | https://www.flsenate.gov/Session/Bill/2023/262 | https://regulations.fru.dev/regulations/us-fl-fdbr 2024-07-01 | Florida Digital Bill of Rights takes effect | https://www.flsenate.gov/Session/Bill/2023/262 Hong Kong Critical Infrastructure Cyber Ordinance | Hong Kong | In force | effective 2026-01-01 | https://www.elegislation.gov.hk/hk/cap653 | https://regulations.fru.dev/regulations/hk-pcico 2026-01-01 | PCICSO comes into operation | https://www.info.gov.hk/gia/general/202506/27/P2025062700238.htm Hong Kong PDPO | Hong Kong | Amended | effective 1996-12-20 | https://www.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html | https://regulations.fru.dev/regulations/hk-pdpo 1996-12-20 | PDPO takes effect (tentative) | https://www.pcpd.org.hk/english/data_privacy_law/ordinance_at_a_Glance/ordinance.html 2021-10-08 | Anti-doxxing amendments take effect | https://www.pcpd.org.hk/english/data_privacy_law/amendments_2021/amendment_2021.html Illinois AI in Employment Law (HB 3773) | Illinois | In force | effective 2026-01-01 | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html | https://regulations.fru.dev/regulations/us-il-hb3773 2024-08-09 | HB 3773 signed | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html 2026-01-01 | AI anti-discrimination and notice duties apply | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html 2026-05-15 | IDHR proposed notice rules published | https://ogletree.com/insights-resources/blog-posts/illinois-postpones-proposed-regulations-on-ai-in-employment/ 2026-06-02 | IDHR withdraws and postpones proposed rules | https://ogletree.com/insights-resources/blog-posts/illinois-postpones-proposed-regulations-on-ai-in-employment/ Illinois BIPA | Illinois | Amended | effective 2008-10-03 | https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 | https://regulations.fru.dev/regulations/us-il-bipa 2008-10-03 | BIPA effective | https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 2024-08-02 | SB 2979 amendment effective | https://www.ilga.gov/Legislation/publicacts/view/103-0769 2026-04-01 | Seventh Circuit: amendment applies retroactively | https://law.justia.com/cases/federal/appellate-courts/ca7/25-2185/25-2185-2026-04-01.html India CERT-In Cyber Security Directions | India | In force | effective 2022-06-27 | https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf | https://regulations.fru.dev/regulations/in-certin-directions 2022-06-27 | CERT-In Directions take effect (tentative) | https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf 2022-09-25 | Extended date for MSMEs and subscriber validation | https://www.cert-in.org.in/PDF/CERT-In_directions_extension_MSMEs_and_validation_27.06.2022.pdf India DPDP Act | India | Enacted | effective 2025-11-13 | https://egazette.gov.in/WriteReadData/2025/267650.pdf | https://regulations.fru.dev/regulations/in-dpdp 2025-11-13 | DPDP Rules published; Board and procedural rules in force | https://egazette.gov.in/WriteReadData/2025/267650.pdf 2026-11-13 | Consent Manager registration rule in force (12 months) | https://egazette.gov.in/WriteReadData/2025/267650.pdf 2027-05-13 | Main data fiduciary obligations apply (18 months) | https://egazette.gov.in/WriteReadData/2025/267650.pdf India IT Rules amendment on synthetic content | India | In force | effective 2026-02-20 | https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf | https://regulations.fru.dev/regulations/in-it-rules-sgi 2026-02-20 | Synthetic content rules take effect | https://www.meity.gov.in/static/uploads/2026/02/f55fe52418b03f58b0669f6a8bc03b6d.pdf Indiana Consumer Data Protection Act (ICDPA) | Indiana | In force | effective 2026-01-01 | https://iga.in.gov/legislative/2023/bills/senate/5/details | https://regulations.fru.dev/regulations/us-in-icdpa 2026-01-01 | ICDPA takes effect | https://iga.in.gov/legislative/2023/bills/senate/5/details Indonesia PDP Law | Indonesia | Amended | effective 2022-10-17 | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 | https://regulations.fru.dev/regulations/id-pdp 2022-10-17 | PDP Law enacted and in force | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 2024-10-17 | PDP Law transition ends | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 2027-01-16 | Implementing regulation GR 33/2026 takes effect | https://www.kk-advocates.com/news/read/indonesia-gr-pdp-personal-data-protection-compliance-regime-new-phase Indonesia PP 17/2025 (Child Protection Online) | Indonesia | In force | effective 2025-03-27 | https://peraturan.bpk.go.id/Details/316698/pp-no-17-tahun-2025 | https://regulations.fru.dev/regulations/id-child-online-protection 2025-03-27 | PP 17/2025 in force | https://peraturan.bpk.go.id/Details/316698/pp-no-17-tahun-2025 Iowa Consumer Data Protection Act (ICDPA) | Iowa | In force | effective 2025-01-01 | https://www.legis.iowa.gov/docs/code/715D.pdf | https://regulations.fru.dev/regulations/us-ia-icdpa 2025-01-01 | ICDPA takes effect | https://www.legis.iowa.gov/docs/code/715D.pdf Israel Privacy Protection Law Amendment 13 | Israel | Amended | effective 2025-08-14 | https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page | https://regulations.fru.dev/regulations/il-ppl-amendment-13 2025-08-14 | Amendment 13 in force | https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page Japan Active Cyber Defense Act | Japan | Enacted | effective 2026-10-01 | https://laws.e-gov.go.jp/law/507AC0000000042 | https://regulations.fru.dev/regulations/jp-active-cyber-defense 2025-05-23 | Act promulgated | https://laws.e-gov.go.jp/api/2/law_revisions/507AC0000000042?response_format=json 2026-04-01 | Supervisory Commission provisions in force | https://laws.e-gov.go.jp/api/2/law_revisions/507AC0000000042?response_format=json 2026-10-01 | Registration and incident reporting duties start | https://laws.e-gov.go.jp/api/2/law_revisions/507AC0000000042?response_format=json 2027-11-22 | Communications data measures in force (latest date) (tentative) | https://laws.e-gov.go.jp/api/2/law_revisions/507AC0000000042?response_format=json Japan AI Promotion Act | Japan | In force | effective 2025-06-04 | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html | https://regulations.fru.dev/regulations/jp-ai-act 2025-06-04 | AI Promotion Act promulgated and partly in force | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html 2025-09-01 | AI Promotion Act fully in force | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html Japan APPI | Japan | Amended | effective 2005-04-01 | https://www.ppc.go.jp/files/pdf/260731_shiryou-1.pdf | https://regulations.fru.dev/regulations/jp-appi 2022-04-01 | 2020 amendments in force | https://www.ppc.go.jp/en/legal/ 2026-07-17 | 2026 APPI amendment act promulgated | https://www.ppc.go.jp/files/pdf/260731_shiryou-1.pdf Kazakhstan AI Law | Kazakhstan | In force | effective 2026-01-18 | https://adilet.zan.kz/rus/docs/Z2500000230 | https://regulations.fru.dev/regulations/kz-ai-law 2026-01-18 | AI Law takes effect (tentative) | https://adilet.zan.kz/rus/docs/Z2500000230 Kentucky Consumer Data Protection Act (KCDPA) | Kentucky | In force | effective 2026-01-01 | https://apps.legislature.ky.gov/record/24rs/hb15.html | https://regulations.fru.dev/regulations/us-ky-kcdpa 2026-01-01 | KCDPA takes effect | https://apps.legislature.ky.gov/recorddocuments/bill/24RS/hb15/bill.pdf Kenya Computer Misuse and Cybercrimes Act | Kenya | Amended | effective 2018-05-30 | https://new.kenyalaw.org/akn/ke/act/2018/5/eng@2022-12-31 | https://regulations.fru.dev/regulations/ke-cmca 2018-05-30 | Act commences | https://new.kenyalaw.org/akn/ke/act/2018/5/eng@2022-12-31 2025-11-04 | 2025 amendments commence | https://new.kenyalaw.org/akn/ke/act/2025/17 Kenya Data Protection Act | Kenya | In force | effective 2019-11-25 | https://www.odpc.go.ke/ | https://regulations.fru.dev/regulations/ke-dpa 2019-11-25 | Data Protection Act in force | https://www.odpc.go.ke/ Louisiana app store age verification law | Louisiana | In force | effective 2026-07-01 | https://legis.la.gov/legis/BillInfo.aspx?s=25RS&b=HB570&sbi=y | https://regulations.fru.dev/regulations/us-la-app-store 2025-06-30 | Signed by Governor | https://legis.la.gov/legis/BillInfo.aspx?s=25RS&b=HB570&sbi=y 2026-07-01 | Takes effect | https://legis.la.gov/legis/ViewDocument.aspx?d=1427667 Louisiana Data Privacy Act | Louisiana | Enacted | effective 2027-01-01 | https://legis.la.gov/legis/BillInfo.aspx?s=26RS&b=SB386&sbi=y | https://regulations.fru.dev/regulations/us-la-ldpa 2027-01-01 | Louisiana Data Privacy Act takes effect | https://legis.la.gov/legis/ViewDocument.aspx?d=1480202 2027-07-31 | 30-day cure period expires | https://legis.la.gov/legis/ViewDocument.aspx?d=1480202 Malaysia Cyber Security Act | Malaysia | In force | effective 2024-08-26 | https://lom.agc.gov.my/act-detail.php?a=YWN0PTg1NCZsYW5nPUJJfDM3MjhhYmRhY2U0YWNlOTZlMGI3MmRlODVkNjQ2YzM4ZTNmMTE0YzA3YzY5ZGJhOGExZTNmYmQ4ZTc0OWJlYWY= | https://regulations.fru.dev/regulations/my-cyber-security-act 2024-08-26 | Act 854 and first regulations in force | https://lom.agc.gov.my/act-detail.php?a=YWN0PTg1NCZsYW5nPUJJfDM3MjhhYmRhY2U0YWNlOTZlMGI3MmRlODVkNjQ2YzM4ZTNmMTE0YzA3YzY5ZGJhOGExZTNmYmQ4ZTc0OWJlYWY= Malaysia Online Safety Act | Malaysia | In force | effective 2026-01-01 | https://lom.agc.gov.my/act-detail.php?a=YWN0PTg2NiZsYW5nPUJJ | https://regulations.fru.dev/regulations/my-online-safety-act 2026-01-01 | Online Safety Act and first regulations in force | https://lom.agc.gov.my/act-detail.php?a=YWN0PTg2NiZsYW5nPUJJ 2026-07-01 | Online Safety Plan and compounding regulations in force | https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3582105/PUA%20244_2026.pdf 2026-12-28 | Online Safety Plan due to MCMC | https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3582105/PUA%20244_2026.pdf Malaysia PDPA | Malaysia | Amended | effective 2013-11-15 | https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdf | https://regulations.fru.dev/regulations/my-pdpa 2025-01-01 | PDPA amendments phase 1 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ 2025-04-01 | PDPA amendments phase 2 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ 2025-06-01 | PDPA amendments phase 3 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ Maryland Kids Code | Maryland | In force | effective 2024-10-01 | https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0603?ys=2024RS | https://regulations.fru.dev/regulations/us-md-kids-code 2024-05-09 | Approved by Governor | https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0603?ys=2024RS 2024-10-01 | Takes effect | https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0603?ys=2024RS 2026-04-01 | Data protection impact assessments due | https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0603?ys=2024RS Maryland Online Data Privacy Act (MODPA) | Maryland | Amended | effective 2025-10-01 | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf | https://regulations.fru.dev/regulations/us-md-modpa 2025-10-01 | MODPA takes effect | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf 2026-04-01 | MODPA applies to personal data processing | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf 2027-04-01 | Discretionary 60-day cure period ends | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf Mexico LFPDPPP 2025 | Mexico | In force | effective 2025-03-21 | https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf | https://regulations.fru.dev/regulations/mx-lfpdppp 2025-03-21 | New LFPDPPP in force | https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf Minnesota Consumer Data Privacy Act (MCDPA) | Minnesota | In force | effective 2025-07-31 | https://www.revisor.mn.gov/statutes/cite/325M.20 | https://regulations.fru.dev/regulations/us-mn-mcdpa 2025-07-31 | MCDPA takes effect | https://www.revisor.mn.gov/statutes/cite/325M.20 2026-01-31 | 30-day cure period expires | https://www.revisor.mn.gov/statutes/cite/325M.20 2029-07-31 | Postsecondary institutions must comply | https://www.revisor.mn.gov/statutes/cite/325M.20 Montana Consumer Data Privacy Act (MCDPA) | Montana | Amended | effective 2024-10-01 | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html | https://regulations.fru.dev/regulations/us-mt-mcdpa 2024-10-01 | MCDPA takes effect | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html 2025-10-01 | SB 297 amendments take effect; cure period eliminated | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html Nebraska Kids Code | Nebraska | In force | effective 2026-01-01 | https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB504.pdf | https://regulations.fru.dev/regulations/us-ne-aadc 2025-05-30 | Approved by Governor | https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB504.pdf 2026-01-01 | Operative date | https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB504.pdf 2026-07-01 | Civil penalties available | https://nebraskalegislature.gov/FloorDocs/109/PDF/Slip/LB504.pdf Nebraska NDPA | Nebraska | In force | effective 2025-01-01 | https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103 | https://regulations.fru.dev/regulations/us-ne-ndpa 2025-01-01 | Nebraska Data Privacy Act takes effect | https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=54904 Nevada consumer health data law | Nevada | In force | effective 2024-03-31 | https://www.leg.state.nv.us/Session/82nd2023/Bills/SB/SB370_EN.pdf | https://regulations.fru.dev/regulations/us-nv-sb370 2023-06-16 | Approved by Governor | https://www.leg.state.nv.us/App/NELIS/REL/82nd2023/Bill/10323/Overview 2024-03-31 | Takes effect | https://www.leg.state.nv.us/Session/82nd2023/Bills/SB/SB370_EN.pdf New Hampshire Privacy Act | New Hampshire | Amended | effective 2025-01-01 | https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm | https://regulations.fru.dev/regulations/us-nh-privacy 2025-01-01 | New Hampshire Privacy Act takes effect | https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm 2026-01-01 | Mandatory 60-day cure period expires | https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm 2027-01-01 | Ban on selling personal data of children under 13 (HB 1460) | https://gc.nh.gov/bill_status/billinfo.aspx?id=2443&inflect=2 New Jersey NJDPA | New Jersey | Amended | effective 2025-01-15 | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF | https://regulations.fru.dev/regulations/us-nj-njdpa 2025-01-15 | NJDPA takes effect | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF 2025-06-02 | Division of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L) | https://www.njoag.gov/murphy-administration-announces-proposed-rules-establishing-comprehensive-consumer-data-privacy-protections/ 2025-07-15 | Universal opt-out mechanism must be honored | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF 2026-06-30 | A5328 sensitive data sale ban takes effect | https://www.njleg.state.nj.us/bill-search/2026/A5328 2026-07-01 | Mandatory 30-day cure period expires | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF NY Algorithmic Pricing Disclosure Act | New York | In force | effective 2025-11-10 | https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes | https://regulations.fru.dev/regulations/us-ny-algo-pricing 2025-05-09 | Signed as part of FY2026 budget | https://www.nysenate.gov/legislation/bills/2025/S3008/amendment/C 2025-11-10 | Disclosure duty takes effect | https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes NY Child Data Protection Act | New York | In force | effective 2025-06-20 | https://www.nysenate.gov/legislation/bills/2023/S7695/amendment/B | https://regulations.fru.dev/regulations/us-ny-cdpa 2024-06-20 | Signed by Governor | https://www.nysenate.gov/legislation/bills/2023/S7695/amendment/B 2025-06-20 | Takes effect | https://www.nysenate.gov/legislation/bills/2023/S7695/amendment/B NY RAISE Act | New York | Enacted | effective 2027-01-01 | https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models | https://regulations.fru.dev/regulations/us-ny-raise 2025-12-19 | RAISE Act signed | https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models 2026-03-27 | Chapter amendment S8828 signed | https://www.nysenate.gov/legislation/bills/2025/S8828 2027-01-01 | RAISE Act takes effect | https://www.nysenate.gov/legislation/bills/2025/S8828 NY SAFE for Kids Act | New York | Enacted | effective 2027-01-25 | https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules | https://regulations.fru.dev/regulations/us-ny-safe-kids 2024-06-20 | Signed by Governor | https://ag.ny.gov/press-release/2024/attorney-general-james-governor-hochul-and-bill-sponsors-announce-nation-leading 2026-07-28 | Final SAFE for Kids rules released | https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules 2026-07-29 | Rules published in State Register | https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules 2027-01-25 | Act and rules take effect | https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules NYDFS Cybersecurity Regulation (Part 500) | New York | Amended | effective 2017-03-01 | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 | https://regulations.fru.dev/regulations/us-ny-dfs-500 2017-03-01 | Part 500 effective | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2023-11-01 | Second Amendment effective | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2023-12-01 | Amended notification requirements (500.17) | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-04-15 | Annual compliance notification | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-04-29 | General 180-day transition ends | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-11-01 | Governance, encryption, IR/BCDR, exemptions | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2025-05-01 | Vulnerability scans, access privileges, malware controls, Class A monitoring | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2025-11-01 | Universal MFA and asset inventory | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2026-04-15 | Annual compliance notification | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 NYC Local Law 144 (AEDT) | New York City, New York | In force | effective 2023-07-05 | https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page | https://regulations.fru.dev/regulations/us-nyc-ll144 2023-07-05 | DCWP enforcement begins | https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page New Zealand Biometric Processing Privacy Code | New Zealand | In force | effective 2025-11-03 | https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/ | https://regulations.fru.dev/regulations/nz-biometric-code 2025-11-03 | Biometric code in force | https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/ 2026-05-01 | Amendment No. 1 applies (IPP 3A) | https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/ 2026-08-03 | Grace period ends for existing biometric processing | https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/ New Zealand Privacy Act | New Zealand | Amended | effective 2020-12-01 | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ | https://regulations.fru.dev/regulations/nz-privacy-act 2020-12-01 | Privacy Act 2020 in force | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ 2025-09-24 | Privacy Amendment Act 2025 technical changes commence | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ 2026-05-01 | IPP 3A indirect-collection notification applies | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ Nigeria NDPA | Nigeria | Amended | effective 2023-06-12 | https://ndpc.gov.ng/resources/ | https://regulations.fru.dev/regulations/ng-ndpa 2023-06-12 | NDPA signed into law | https://ndpc.gov.ng/resources/ 2025-09-19 | GAID 2025 takes effect | https://ndpc.gov.ng/resources/ Oklahoma OKCDPA | Oklahoma | Enacted | effective 2027-01-01 | http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600 | https://regulations.fru.dev/regulations/us-ok-okcdpa 2027-01-01 | Oklahoma Consumer Data Privacy Act takes effect | https://www.okhouse.gov/posts/news-20260323_2 Ontario Bill 194 | Ontario, Canada | In force | effective 2025-01-29 | https://www.ontario.ca/laws/statute/s24024 | https://regulations.fru.dev/regulations/ca-on-bill194 2024-11-25 | Royal Assent | https://www.ontario.ca/laws/statute/s24024 2025-01-29 | Enhancing Digital Security and Trust Act in force | https://www.ontario.ca/laws/oic/o250361 2025-07-01 | FIPPA privacy amendments in force | https://www.ontario.ca/laws/oic/o250361 Oregon OCPA | Oregon | Amended | effective 2024-07-01 | https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html | https://regulations.fru.dev/regulations/us-or-ocpa 2024-07-01 | OCPA takes effect for most controllers | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ 2025-07-01 | OCPA applies to nonprofits | https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-nonprofits/ 2026-01-01 | Cure period sunsets | https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html 2026-01-01 | Universal opt-out signals must be honored | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ 2026-01-01 | Sale ban on precise geolocation and under-16 data (HB 2008) | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ Pakistan PECA | Pakistan | Amended | effective not set | https://na.gov.pk/uploads/documents/679b243193585_457.pdf | https://regulations.fru.dev/regulations/pk-peca 2025-01-29 | PECA amendment takes effect | https://na.gov.pk/uploads/documents/679b243193585_457.pdf Peru AI Law and Regulation | Peru | In force | effective 2026-01-20 | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm | https://regulations.fru.dev/regulations/pe-ai-law 2023-07-05 | Law 31814 published | https://www.gob.pe/institucion/congreso-de-la-republica/normas-legales/4565760-31814 2025-09-09 | Regulation published | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm 2026-01-20 | Regulation in force (tentative) | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm 2026-09-10 | Private sector: health, education, justice, security, finance (tentative) | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm 2027-09-10 | Private sector: transport, commerce, labour (tentative) | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm 2028-09-10 | Private sector: production, agriculture, energy, mining (tentative) | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm 2029-09-10 | Private sector: all other uses (tentative) | https://www.gob.pe/institucion/pcm/normas-legales/7133522-115-2025-pcm Peru PDPL and 2024 Regulation | Peru | Amended | effective 2025-03-30 | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus | https://regulations.fru.dev/regulations/pe-pdpl 2024-11-30 | New regulation published | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2025-03-30 | New regulation in force | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2025-09-30 | Data portability applies (tentative) | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2025-11-30 | DPO required: large companies | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2026-11-30 | DPO required: medium companies | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2027-11-30 | DPO required: small companies | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus 2028-11-30 | DPO required: micro companies | https://www.gob.pe/institucion/smv/normas-legales/6426760-016-2024-jus Philippines Data Privacy Act | Philippines | In force | effective 2012-09-08 | https://privacy.gov.ph/data-privacy-act/ | https://regulations.fru.dev/regulations/ph-dpa 2012-09-08 | Data Privacy Act takes effect (tentative) | https://privacy.gov.ph/data-privacy-act/ 2016-09-09 | Implementing Rules take effect (tentative) | https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/ Quebec Law 25 | Quebec, Canada | In force | effective 2022-09-22 | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 | https://regulations.fru.dev/regulations/ca-qc-law25 2021-09-22 | Assent | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2022-09-22 | Phase 1: privacy officer and incident reporting | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2023-09-22 | Phase 2: main obligations and penalties | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2024-09-22 | Phase 3: data portability | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 Rhode Island RIDTPPA | Rhode Island | In force | effective 2026-01-01 | https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm | https://regulations.fru.dev/regulations/us-ri-dtppa 2026-01-01 | RIDTPPA takes effect | https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm Rwanda DPP Law | Rwanda | In force | effective 2021-10-15 | https://www.minijust.gov.rw/fileadmin/user_upload/Minijust/Official_gazettes_2/_________2021_Official_Gazettes/October/OG_Special_of_15.10.2021_Amakuru_bwite.pdf | https://regulations.fru.dev/regulations/rw-dpp 2021-10-15 | Law published and in force | https://www.minijust.gov.rw/fileadmin/user_upload/Minijust/Official_gazettes_2/_________2021_Official_Gazettes/October/OG_Special_of_15.10.2021_Amakuru_bwite.pdf 2023-10-15 | Two-year transition ends | https://www.minijust.gov.rw/fileadmin/user_upload/Minijust/Official_gazettes_2/_________2021_Official_Gazettes/October/OG_Special_of_15.10.2021_Amakuru_bwite.pdf Saudi PDPL | Saudi Arabia | In force | effective 2023-09-14 | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf | https://regulations.fru.dev/regulations/sa-pdpl 2023-09-14 | PDPL in force | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf 2024-09-14 | One-year grace period ends | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf Singapore Cybersecurity Act | Singapore | Amended | effective 2018-08-31 | https://sso.agc.gov.sg/Acts-Supp/9-2018/Published/20211231?DocDate=20180312 | https://regulations.fru.dev/regulations/sg-cybersecurity-act 2018-08-31 | Cybersecurity Act main provisions commence | https://sso.agc.gov.sg/Acts-Supp/9-2018/Published/20211231?DocDate=20180312 2022-04-11 | Cybersecurity service provider licensing commences | https://sso.agc.gov.sg/Acts-Supp/9-2018/Published/20211231?DocDate=20180312 2025-10-31 | 2024 amendments commence | https://sso.agc.gov.sg/Acts-Supp/19-2024/Published/20240704?DocDate=20240704 Singapore Online Safety (Relief and Accountability) Act | Singapore | In force | effective 2026-06-29 | https://sso.agc.gov.sg/Acts-Supp/23-2025/Published/20251208?DocDate=20251208 | https://regulations.fru.dev/regulations/sg-online-safety-act 2025-11-25 | Act assented to | https://sso.agc.gov.sg/Acts-Supp/23-2025/Published/20251208?DocDate=20251208 2026-06-29 | OSC begins operations and first provisions commence | https://www.osc.gov.sg/newsroom/the-online-safety-commission-begins-operations-on-29-june-2026/ Singapore PDPA | Singapore | In force | effective 2014-07-02 | https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act | https://regulations.fru.dev/regulations/sg-pdpa 2014-07-02 | PDPA data protection obligations take effect | https://sso.agc.gov.sg/Act/PDPA2012 2021-02-01 | 2020 amendments largely in force | https://sso.agc.gov.sg/Act/PDPA2012 2022-10-01 | Higher financial penalty cap applies | https://sso.agc.gov.sg/Act/PDPA2012 South Africa Cybercrimes Act | South Africa | In force | effective 2021-12-01 | https://www.gov.za/documents/cybercrimes-act-19-2020-1-jun-2021-0000 | https://regulations.fru.dev/regulations/za-cybercrimes-act 2021-12-01 | Most of the Act commences | https://www.gov.za/documents/cybercrimes-act-19-2020-1-jun-2021-0000 South Africa POPIA | South Africa | In force | effective 2020-07-01 | https://www.gov.za/documents/protection-personal-information-act | https://regulations.fru.dev/regulations/za-popia 2020-07-01 | Main POPIA provisions commence | https://www.gov.za/documents/protection-personal-information-act 2021-07-01 | Compliance grace period ends | https://www.gov.za/documents/protection-personal-information-act South Korea AI Basic Act | South Korea | In force | effective 2026-01-22 | https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법 | https://regulations.fru.dev/regulations/kr-ai-basic-act 2026-01-22 | AI Basic Act and Enforcement Decree take effect | https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법 South Korea PIPA | South Korea | Amended | effective 2011-09-30 | https://www.law.go.kr/법령/개인정보보호법 | https://regulations.fru.dev/regulations/kr-pipa 2026-03-10 | 2026 PIPA amendment promulgated (Act No. 21445) | https://www.law.go.kr/법령/개인정보보호법 2026-09-11 | 2026 PIPA amendments take effect | https://www.law.go.kr/법령/개인정보보호법 2027-07-01 | Mandatory ISMS-P certification | https://www.law.go.kr/법령/개인정보보호법 Swiss revised FADP (nFADP) | Switzerland | In force | effective 2023-09-01 | https://www.fedlex.admin.ch/eli/cc/2022/491/en | https://regulations.fru.dev/regulations/ch-fadp 2023-09-01 | Revised FADP enters into force | https://www.fedlex.admin.ch/eli/cc/2022/491/en Taiwan AI Basic Act | Taiwan | In force | effective 2026-01-14 | https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=H0160093 | https://regulations.fru.dev/regulations/tw-ai-basic-act 2026-01-14 | AI Basic Act in force | https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=H0160093 2028-01-14 | Agencies must align laws with the Act (tentative) | https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=H0160093 Taiwan PDPA | Taiwan | Amended | effective 2012-10-01 | https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=I0050021 | https://regulations.fru.dev/regulations/tw-pdpa 2012-10-01 | 2010 PDPA rewrite takes effect | https://law.moj.gov.tw/LawClass/LawHistory.aspx?pcode=I0050021 2023-05-31 | Higher fines take effect | https://law.moj.gov.tw/LawClass/LawHistory.aspx?pcode=I0050021 2024-01-01 | PDPC Preparatory Office takes over | https://law.moj.gov.tw/LawClass/LawHistory.aspx?pcode=I0050021 2025-11-11 | 2025 amendment promulgated (tentative) | https://law.moj.gov.tw/LawClass/LawHistory.aspx?pcode=I0050021 Tennessee ELVIS Act | Tennessee | In force | effective 2024-07-01 | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB2091&GA=113 | https://regulations.fru.dev/regulations/us-tn-elvis 2024-03-26 | Signed by Governor | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB2091&GA=113 2024-07-01 | Takes effect | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB2091&GA=113 Tennessee TIPA | Tennessee | In force | effective 2025-07-01 | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1181&GA=113 | https://regulations.fru.dev/regulations/us-tn-tipa 2025-07-01 | TIPA takes effect | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1181&GA=113 Texas App Store Accountability Act | Texas | Enacted | effective 2026-01-01 | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420 | https://regulations.fru.dev/regulations/us-tx-app-store 2025-05-27 | Signed by Governor | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420 2025-12-23 | Preliminary injunction | https://www.govinfo.gov/content/pkg/USCOURTS-txwd-1_25-cv-01660/pdf/USCOURTS-txwd-1_25-cv-01660-0.pdf 2026-01-01 | Scheduled effective date (enjoined) | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=SB2420 2026-05-06 | Stay pending appeal denied | https://www.govinfo.gov/content/pkg/USCOURTS-txwd-1_25-cv-01660/pdf/USCOURTS-txwd-1_25-cv-01660-1.pdf Texas TDPSA | Texas | In force | effective 2024-07-01 | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 | https://regulations.fru.dev/regulations/us-tx-tdpsa 2024-07-01 | TDPSA takes effect | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 2025-01-01 | Universal opt-out mechanism requirement applies | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 TRAIGA | Texas | In force | effective 2026-01-01 | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 | https://regulations.fru.dev/regulations/us-tx-traiga 2025-06-22 | HB 149 signed | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 2026-01-01 | TRAIGA takes effect | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 Thailand Cybersecurity Act | Thailand | In force | effective 2019-05-28 | https://www.ncsa.or.th/about | https://regulations.fru.dev/regulations/th-cybersecurity-act 2019-05-28 | Cybersecurity Act in force | https://www.ncsa.or.th/about 2026-09-16 | Website Security Standard B.E. 2568 enforced | https://www.ncsa.or.th/news/3a613ca26532320a0b000264 Thailand PDPA | Thailand | In force | effective 2022-06-01 | https://www.ratchakitcha.soc.go.th/DATA/PDF/2562/A/069/T_0052.PDF | https://regulations.fru.dev/regulations/th-pdpa 2022-06-01 | PDPA main obligations take effect | https://www.ratchakitcha.soc.go.th/DATA/PDF/2562/A/069/T_0052.PDF Turkey KVKK | Turkey | Amended | effective 2016-04-07 | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm | https://regulations.fru.dev/regulations/tr-kvkk 2024-06-01 | Law 7499 amendments take effect | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm 2024-09-01 | Old transfer regime ends | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm UAE Child Digital Safety Law | United Arab Emirates | In force | effective 2026-01-01 | https://uaelegislation.gov.ae/en/legislations/3912 | https://regulations.fru.dev/regulations/ae-child-digital-safety 2026-01-01 | Child Digital Safety Law takes effect | https://uaelegislation.gov.ae/en/legislations/3912 2026-06-30 | Social media minimum age resolution takes effect | https://uaelegislation.gov.ae/en/legislations/4506 2027-01-01 | Compliance deadline under the Decree by Law | https://uaelegislation.gov.ae/en/legislations/3912 2027-06-30 | Social media platforms' transition ends | https://uaelegislation.gov.ae/en/legislations/4506 UAE PDPL | United Arab Emirates | In force | effective 2022-01-02 | https://uaelegislation.gov.ae/en/legislations/1972 | https://regulations.fru.dev/regulations/ae-pdpl 2022-01-02 | PDPL enters into force | https://uaelegislation.gov.ae/en/legislations/1972 Data (Use and Access) Act | United Kingdom | In force | effective 2025-08-20 | https://www.legislation.gov.uk/ukpga/2025/18/contents | https://regulations.fru.dev/regulations/uk-duaa 2025-06-19 | Royal Assent | https://www.legislation.gov.uk/ukpga/2025/18/contents 2025-08-20 | Stage 1 commencement | https://www.legislation.gov.uk/ukpga/2025/18/contents 2026-02-05 | Stage 3: main data protection changes commence | https://www.legislation.gov.uk/uksi/2026/82/contents/made 2026-06-19 | Mandatory data protection complaints procedure | https://www.legislation.gov.uk/uksi/2026/82/contents/made 2026-09-30 | ICO abolished; Information Commission takes over | https://www.legislation.gov.uk/uksi/2026/1015/regulation/2/made UK Cyber Security and Resilience Bill | United Kingdom | Proposed | effective not set | https://bills.parliament.uk/bills/4035 | https://regulations.fru.dev/regulations/uk-csr-bill 2025-11-12 | Introduced (Commons first reading) | https://bills.parliament.uk/bills/4035 2026-06-16 | Passes House of Commons | https://bills.parliament.uk/bills/4035 2026-10-26 | Lords report stage scheduled (tentative) | https://bills.parliament.uk/bills/4035 UK Data Protection Act 2018 | United Kingdom | Amended | effective 2018-05-25 | https://www.legislation.gov.uk/ukpga/2018/12/contents | https://regulations.fru.dev/regulations/uk-dpa-2018 2018-05-23 | Royal Assent | https://www.legislation.gov.uk/ukpga/2018/12/introduction/enacted 2018-05-25 | Main provisions commence | https://www.legislation.gov.uk/uksi/2018/625/made 2018-07-23 | Age appropriate design code powers commence | https://www.legislation.gov.uk/uksi/2018/625/made UK GDPR | United Kingdom | Amended | effective 2018-05-25 | https://www.legislation.gov.uk/ukpga/2018/12/contents | https://regulations.fru.dev/regulations/uk-gdpr 2018-05-25 | Data Protection Act 2018 and GDPR apply | https://www.legislation.gov.uk/ukpga/2018/12/contents 2021-01-01 | UK GDPR takes effect after Brexit transition | https://www.legislation.gov.uk/eur/2016/679/contents 2026-02-05 | DUAA amendments to UK GDPR commence | https://www.legislation.gov.uk/uksi/2026/82/contents/made UK Investigatory Powers (Amendment) Act 2024 | United Kingdom | Enacted | effective not set | https://www.legislation.gov.uk/ukpga/2024/9/contents | https://regulations.fru.dev/regulations/uk-ipa-2024 2024-04-25 | Royal Assent | https://www.legislation.gov.uk/ukpga/2024/9/introduction/enacted UK Online Safety Act | United Kingdom | In force | effective 2025-03-17 | https://www.legislation.gov.uk/ukpga/2023/50/contents | https://regulations.fru.dev/regulations/uk-osa 2023-10-26 | Royal Assent | https://www.legislation.gov.uk/ukpga/2023/50/contents 2025-03-17 | Illegal harms duties enforceable | https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content 2025-04-16 | Children's access assessments due | https://www.ofcom.org.uk/online-safety/protecting-children/protection-of-children-duties-under-the-online-safety-act 2025-07-25 | Protection of children duties apply | https://www.ofcom.org.uk/online-safety/protecting-children/protection-of-children-duties-under-the-online-safety-act 2026-04-11 | Fee notification window closes (2026/27) | https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-fees-and-penalties UK PSTI Act (product security) | United Kingdom | In force | effective 2024-04-29 | https://www.legislation.gov.uk/ukpga/2022/46/contents | https://regulations.fru.dev/regulations/uk-psti 2022-12-06 | Royal Assent | https://www.legislation.gov.uk/ukpga/2022/46/introduction/enacted 2024-04-29 | Product security requirements apply | https://www.legislation.gov.uk/uksi/2023/1007/made UK Telecommunications Security Act | United Kingdom | In force | effective 2022-10-01 | https://www.legislation.gov.uk/ukpga/2021/31/contents | https://regulations.fru.dev/regulations/uk-telecom-security 2021-11-17 | Royal Assent | https://www.legislation.gov.uk/ukpga/2021/31/introduction/enacted 2022-10-01 | Security measures regulations in force | https://www.legislation.gov.uk/uksi/2022/933/made AI state-law preemption EO | United States | In force | effective 2025-12-11 | https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence | https://regulations.fru.dev/regulations/us-eo-14365-ai-preemption 2025-12-16 | EO published in Federal Register | https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence 2026-01-10 | AI Litigation Task Force due | https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence 2026-03-11 | Commerce state-law evaluation, BEAD notice and FTC statement due | https://www.federalregister.gov/documents/2025/12/16/2025-23092/ensuring-a-national-policy-framework-for-artificial-intelligence 2026-07-07 | FTC proposes AI accuracy policy statement | https://www.federalregister.gov/documents/2026/07/07/2026-13628/policy-statement-concerning-the-suppression-of-accuracy-in-artificial-intelligence-systems 2026-07-31 | FTC policy statement comments close | https://www.federalregister.gov/documents/2026/07/07/2026-13628/policy-statement-concerning-the-suppression-of-accuracy-in-artificial-intelligence-systems CFPB Open Banking Rule (Section 1033) | United States | Enacted | effective 2025-01-17 | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights | https://regulations.fru.dev/regulations/us-cfpb-1033 2025-01-17 | Final rule effective | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights 2025-07-29 | Court stays Forcht Bank litigation | https://www.federalregister.gov/documents/2025/08/22/2025-16139/personal-financial-data-rights-reconsideration 2025-08-22 | Reconsideration ANPR published | https://www.federalregister.gov/documents/2025/08/22/2025-16139/personal-financial-data-rights-reconsideration 2025-10-21 | Reconsideration comment period closes | https://www.federalregister.gov/documents/2025/08/22/2025-16139/personal-financial-data-rights-reconsideration 2025-10-29 | Court enjoins enforcement | https://www.govinfo.gov/content/pkg/USCOURTS-kyed-5_24-cv-00304/pdf/USCOURTS-kyed-5_24-cv-00304-1.pdf 2026-06-30 | First compliance date (stayed, enjoined) (tentative) | https://www.federalregister.gov/documents/2025/08/22/2025-16139/personal-financial-data-rights-reconsideration 2027-04-01 | Tier 2 compliance date (original) (tentative) | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights 2028-04-01 | Tier 3 compliance date (original) (tentative) | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights 2029-04-01 | Tier 4 compliance date (original) (tentative) | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights 2030-04-01 | Tier 5 compliance date (original) (tentative) | https://www.federalregister.gov/documents/2024/11/18/2024-25079/required-rulemaking-on-personal-financial-data-rights HIPAA Security Rule update (NPRM) | United States | Proposed | effective not set | https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information | https://regulations.fru.dev/regulations/us-hhs-hipaa-security-nprm 2025-01-06 | NPRM published | https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information 2025-03-07 | Comment period closes | https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information CIRCIA | United States (Federal) | Enacted | effective not set | https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements | https://regulations.fru.dev/regulations/us-circia 2024-07-03 | NPRM comment period closed | https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements CMMC 2.0 | United States (Federal) | In force | effective 2024-12-16 | https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of | https://regulations.fru.dev/regulations/us-cmmc 2024-12-16 | CMMC Program rule (32 CFR Part 170) effective | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2025-11-10 | DFARS rule effective; Phase 1 begins | https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of 2026-11-10 | Phase 2: Level 2 C3PAO certification | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2027-11-10 | Phase 3: Level 3 certification | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2028-11-10 | Phase 4: full implementation | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program COPPA Rule | United States (Federal) | Amended | effective 2000-04-21 | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule | https://regulations.fru.dev/regulations/us-coppa 2025-06-23 | Amended COPPA Rule takes effect | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule 2026-04-22 | Full compliance with amended COPPA Rule | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule DOJ Bulk Data Rule | United States (Federal) | In force | effective 2025-04-08 | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern | https://regulations.fru.dev/regulations/us-doj-bulk-data 2025-04-08 | Prohibitions and restrictions take effect | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern 2025-10-06 | Due diligence, audit and reporting obligations apply | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern FCC CPNI Breach Rule | United States (Federal) | Amended | effective 2024-03-13 | https://www.federalregister.gov/documents/2024/02/12/2024-01667/data-breach-reporting-requirements | https://regulations.fru.dev/regulations/us-fcc-cpni-breach 2024-03-13 | Order effective except revised notification rules | https://www.federalregister.gov/documents/2024/02/12/2024-01667/data-breach-reporting-requirements FTC Health Breach Notification Rule | United States (Federal) | Amended | effective 2009-09-24 | https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule | https://regulations.fru.dev/regulations/us-ftc-hbnr 2010-02-22 | Full compliance with original Rule | https://www.federalregister.gov/citation/74-FR-42962 2024-07-29 | 2024 amendments effective | https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule GLBA Safeguards Rule | United States (Federal) | Amended | effective 2003-05-23 | https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 | https://regulations.fru.dev/regulations/us-glba-safeguards 2022-01-10 | 2021 Safeguards Rule amendments effective | https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-information 2023-06-09 | Compliance with expanded security program elements | https://www.federalregister.gov/documents/2022/11/23/2022-25201/standards-for-safeguarding-customer-information 2024-05-13 | FTC breach notification requirement effective | https://www.federalregister.gov/documents/2023/11/13/2023-24412/standards-for-safeguarding-customer-information HIPAA | United States (Federal) | Amended | effective 2003-04-14 | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 | https://regulations.fru.dev/regulations/us-hipaa 2024-06-25 | Reproductive health care privacy rule effective (later vacated) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy 2024-12-23 | Reproductive health privacy compliance date (vacated) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy 2025-03-07 | Security Rule NPRM comment period closed | https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information 2026-02-16 | Notice of Privacy Practices updates (Part 2 alignment) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy PADFA | United States (Federal) | In force | effective 2024-06-23 | https://www.govinfo.gov/content/pkg/PLAW-118publ50/html/PLAW-118publ50.htm | https://regulations.fru.dev/regulations/us-padfa 2024-06-23 | PADFA takes effect | https://www.govinfo.gov/content/pkg/PLAW-118publ50/html/PLAW-118publ50.htm SEC Cyber Disclosure Rules | United States (Federal) | In force | effective 2023-09-05 | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure | https://regulations.fru.dev/regulations/us-sec-cyber 2023-12-15 | Annual cybersecurity disclosures begin (Item 106 / 16K) | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2023-12-18 | Form 8-K Item 1.05 incident disclosure begins | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-06-15 | Smaller reporting companies: Item 1.05 compliance | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-12-15 | Inline XBRL tagging of annual cybersecurity disclosures | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-12-18 | Inline XBRL tagging of Item 1.05 disclosures | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure SEC Regulation S-P | United States (Federal) | Amended | effective 2024-08-02 | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information | https://regulations.fru.dev/regulations/us-sec-reg-sp 2024-08-02 | Amendments effective | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information 2025-12-03 | Larger entities must comply | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information 2026-06-03 | Smaller entities must comply | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information TAKE IT DOWN Act | United States (Federal) | In force | effective 2025-05-19 | https://www.congress.gov/bill/119th-congress/senate-bill/146 | https://regulations.fru.dev/regulations/us-take-it-down 2025-05-19 | Criminal provisions effective on enactment | https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm 2026-05-19 | Platform notice-and-removal process required | https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm Uruguay Law 18.331 | Uruguay | Amended | effective 2008-08-18 | https://www.impo.com.uy/bases/leyes/18331-2008 | https://regulations.fru.dev/regulations/uy-pdpl 2008-08-11 | Law promulgated | https://www.impo.com.uy/bases/leyes/18331-2008 2008-08-18 | Law published | https://www.impo.com.uy/bases/leyes/18331-2008 2018-10-15 | Law 19.670 amendments | https://www.impo.com.uy/bases/leyes/18331-2008 2020-02-17 | Decree 64/020 | https://www.impo.com.uy/bases/leyes/18331-2008 Utah AI Policy Act | Utah | Amended | effective 2024-05-01 | https://le.utah.gov/~2025/bills/static/SB0332.html | https://regulations.fru.dev/regulations/us-ut-aipa 2024-05-01 | AI Policy Act effective | https://le.utah.gov/~2024/bills/static/SB0149.html 2025-05-07 | SB 226 amendments effective | https://le.utah.gov/~2025/bills/static/SB0226.html 2027-07-01 | Scheduled repeal of Title 13, Ch. 72 | https://le.utah.gov/~2025/bills/static/SB0332.html Utah App Store Accountability Act | Utah | In force | effective 2025-05-07 | https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf | https://regulations.fru.dev/regulations/us-ut-app-store 2025-05-07 | Act takes effect | https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf 2026-05-06 | App store and developer duties apply | https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf 2026-12-31 | Private right of action begins | https://le.utah.gov/Session/2025/bills/enrolled/SB0142.pdf Utah UCPA | Utah | Amended | effective 2023-12-31 | https://le.utah.gov/xcode/Title13/Chapter61/13-61.html | https://regulations.fru.dev/regulations/us-ut-ucpa 2023-12-31 | UCPA takes effect | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S402.html 2026-07-01 | Right to correct takes effect | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html 2027-01-01 | UCPA extends to motor vehicle manufacturers | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html Vermont Kids Code | Vermont | Enacted | effective 2027-01-01 | https://legislature.vermont.gov/bill/status/2026/S.69 | https://regulations.fru.dev/regulations/us-vt-aadc 2025-06-12 | Signed by Governor | https://legislature.vermont.gov/bill/status/2026/S.69 2027-01-01 | Takes effect | https://legislature.vermont.gov/bill/status/2026/S.69 Vermont VDPOSA | Vermont | Enacted | effective 2028-01-01 | https://legislature.vermont.gov/bill/status/2026/S.71 | https://regulations.fru.dev/regulations/us-vt-vdposa 2028-01-01 | Vermont Data Privacy and Online Surveillance Act takes effect | https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf 2029-06-30 | Mandatory 60-day cure period expires | https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf Vietnam AI Law | Vietnam | In force | effective 2026-03-01 | https://beta-en.mic.gov.vn/first-ever-law-on-artificial-intelligence-approved-197251215231241888.htm | https://regulations.fru.dev/regulations/vn-ai-law 2026-03-01 | AI Law takes effect | https://beta-en.mic.gov.vn/first-ever-law-on-artificial-intelligence-approved-197251215231241888.htm 2027-03-01 | Transition ends for existing AI systems (general) | https://www.vilaf.com.vn/blog/vietnam-enacts-its-first-law-on-artificial-intelligence-key-regulatory-obligations-from-1-march-2026/ 2027-09-01 | Transition ends for existing AI systems in health, education and finance | https://www.vilaf.com.vn/blog/vietnam-enacts-its-first-law-on-artificial-intelligence-key-regulatory-obligations-from-1-march-2026/ Vietnam Cybersecurity Law 2025 | Vietnam | In force | effective 2026-07-01 | https://vanban.chinhphu.vn/?pageid=27160&docid=216499 | https://regulations.fru.dev/regulations/vn-cybersecurity-law 2026-07-01 | Cybersecurity Law 2025 takes effect | https://vanban.chinhphu.vn/?pageid=27160&docid=216499 2027-07-01 | Transition ends for existing systems and products | https://vanban.chinhphu.vn/?pageid=27160&docid=216499 Vietnam Law on Data | Vietnam | In force | effective 2025-07-01 | https://vanban.chinhphu.vn/?pageid=27160&docid=212488 | https://regulations.fru.dev/regulations/vn-data-law 2025-07-01 | Law on Data takes effect | https://vanban.chinhphu.vn/?pageid=27160&docid=212488 Vietnam PDPL | Vietnam | In force | effective 2026-01-01 | https://vanban.chinhphu.vn/?pageid=27160&docid=214590 | https://regulations.fru.dev/regulations/vn-pdpl 2026-01-01 | PDPL and Decree 356/2025 take effect | https://vanban.chinhphu.vn/?pageid=27160&docid=214590 Virginia VCDPA | Virginia | Amended | effective 2023-01-01 | https://law.lis.virginia.gov/vacode/title59.1/chapter53/ | https://regulations.fru.dev/regulations/us-va-vcdpa 2023-01-01 | VCDPA takes effect | https://law.lis.virginia.gov/vacode/title59.1/chapter53/ 2026-01-01 | Under-16 social media time limit (SB 854) takes effect | https://netchoice.org/wp-content/uploads/2026/02/Virginia-PI-Opinion_Granted.pdf 2026-02-27 | SB 854 preliminarily enjoined (NetChoice v. Jones) | https://netchoice.org/wp-content/uploads/2026/02/Virginia-PI-Opinion_Granted.pdf 2026-07-01 | Ban on selling precise geolocation data (SB 338) | https://lis.virginia.gov/bill-details/20261/SB338 Washington My Health My Data Act | Washington | In force | effective 2024-03-31 | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy | https://regulations.fru.dev/regulations/us-wa-mhmda 2023-04-27 | HB 1155 signed | https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023 2023-07-23 | Geofencing ban (Section 10) effective | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy 2024-03-31 | Regulated entities must comply | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy 2024-06-30 | Small businesses must comply | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy