US federal data and cybersecurity rules

Federal statutes and agency rules: COPPA, HIPAA, GLBA, SEC cyber disclosure, the DOJ bulk data rule and more.

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days

EnactedUnited States

CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months

In forceUnited States

AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025

EnactedUnited States (Federal)

CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set

AmendedUnited States (Federal)

COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000

In forceUnited States (Federal)

DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025

AmendedUnited States (Federal)

FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024

AmendedUnited States (Federal)

FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009

AmendedUnited States (Federal)

GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003

AmendedUnited States (Federal)

HIPAASets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.In effect since Apr 14, 2003

ProposedUnited States

HIPAA Security Rule update (NPRM)Proposed overhaul of the HIPAA Security Rule. It would remove the addressable versus required distinction, and require a technology asset inventory and network map, encryption, multi-factor authentication, vulnerability scanning, penetration testing and 72-hour restoration planning. No final rule has been issued.No date set

In forceUnited States (Federal)

PADFAMakes it unlawful for a data broker to sell, license, transfer, disclose or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (China, Iran, North Korea, Russia) or to an entity controlled by one. Covered data is broad, including health, financial, biometric, genetic, precise geolocation, private communications and data about minors.In effect since Jun 23, 2024

In forceUnited States (Federal)

SEC Cyber Disclosure RulesPublic companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material (foreign private issuers use Form 6-K), and describe cybersecurity risk management, strategy and governance annually in Form 10-K (Item 106) or Form 20-F (Item 16K).In effect since Sep 5, 2023

AmendedUnited States (Federal)

SEC Regulation S-PRequires broker-dealers, investment companies, registered investment advisers and transfer agents to adopt a written incident response program and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Service providers must be overseen and must notify the covered institution within 72 hours of a breach; recordkeeping and annual privacy notice changes also apply.In effect since Aug 2, 2024

In forceUnited States (Federal)

TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025

Upcoming deadlines

ComplianceNov 10 · in 14 days

CMMC 2.0Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).United States (Federal)

ComplianceTentativeApr 1, 2027 · in 5 months

CFPB Open Banking Rule (Section 1033)Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.United States

ComplianceNov 10, 2027 · in 12 months

CMMC 2.0Phase 3: Level 3 certificationPhase 3 begins one year after Phase 2; Level 3 (DIBCAC) requirements added to applicable solicitations (32 CFR 170.3(e)(3)).United States (Federal)

ComplianceTentativeApr 1, 2028 · in 17 months

CFPB Open Banking Rule (Section 1033)Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.United States

ComplianceNov 10, 2028 · in 2 years

CMMC 2.0Phase 4: full implementationCMMC requirements included in all applicable DoD solicitations and contracts, including option periods (32 CFR 170.3(e)(4)).United States (Federal)

ComplianceTentativeApr 1, 2029 · in 2.4 years

CFPB Open Banking Rule (Section 1033)Tier 4 compliance date (original)Banks with $1.5B to $3B in assets. Original date; subject to stay, extension and injunction.United States

ComplianceTentativeApr 1, 2030 · in 3.4 years

CFPB Open Banking Rule (Section 1033)Tier 5 compliance date (original)Banks with $850M to $1.5B in assets. Original date; subject to stay, extension and injunction.United States

Past deadlines

ReportingJul 31 · 3 months ago

AI state-law preemption EOFTC policy statement comments closeComment deadline on the proposed FTC AI policy statement.United States

Transition endsJul 7 · 4 months ago

AI state-law preemption EOFTC proposes AI accuracy policy statementFTC publishes a proposed policy statement on deceptive suppression of accuracy in AI systems (91 FR 41638), linked to Section 7 of the EO.United States

MilestoneTentativeJun 30 · 4 months ago

CFPB Open Banking Rule (Section 1033)First compliance date (stayed, enjoined)Largest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally 2026-04-01, moved 90 days by court stay. Not enforceable while the injunction stands.United States

ComplianceJun 3 · 5 months ago

SEC Regulation S-PSmaller entities must complySmaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.United States (Federal)

ComplianceMay 19 · 5 months ago

TAKE IT DOWN ActPlatform notice-and-removal process requiredCovered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment).United States (Federal)

ComplianceApr 22 · 6 months ago

COPPA RuleFull compliance with amended COPPA RuleOperators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated notices); excludes Safe Harbor provisions 312.11(d)(1), (d)(4) and (g), which had earlier dates.United States (Federal)

ComplianceMar 11 · 8 months ago

AI state-law preemption EOCommerce state-law evaluation, BEAD notice and FTC statement dueWithin 90 days of the order: Commerce publishes its list of onerous state AI laws, NTIA issues the BEAD policy notice, and the FTC issues a policy statement (date computed from signing).United States

ComplianceFeb 16 · 8 months ago

HIPAANotice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.United States (Federal)

ComplianceJan 10 · 10 months ago

AI state-law preemption EOAI Litigation Task Force dueAttorney General to set up a task force to challenge state AI laws within 30 days of the order (date computed from signing).United States

MilestoneDec 16, 2025 · 10 months ago

AI state-law preemption EOEO published in Federal RegisterSigned 2025-12-11 and published at 90 FR 58499.United States

ComplianceDec 3, 2025 · 11 months ago

SEC Regulation S-PLarger entities must complyLarger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.United States (Federal)

Takes effectNov 10, 2025 · 12 months ago

CMMC 2.0DFARS rule effective; Phase 1 beginsCMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).United States (Federal)

EnforcementOct 29, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Court enjoins enforcementE.D. Ky. enjoins the CFPB from enforcing the rule until it completes its reconsideration.United States

ReportingOct 21, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration comment period closesComments on the ANPR due.United States

ComplianceOct 6, 2025 · 13 months ago

DOJ Bulk Data RuleDue diligence, audit and reporting obligations applySubpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.United States (Federal)

MilestoneAug 22, 2025 · 14 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration ANPR publishedCFPB seeks comment on representatives, fees, data security and privacy, and on extending compliance dates.United States

Transition endsJul 29, 2025 · 15 months ago

CFPB Open Banking Rule (Section 1033)Court stays Forcht Bank litigationE.D. Ky. stays the industry challenge after the CFPB says it will reconsider the rule; compliance dates stayed by 90 days.United States

Takes effectJun 23, 2025 · 16 months ago

COPPA RuleAmended COPPA Rule takes effectThe April 2025 amendments to 16 CFR Part 312 became effective; during the transition operators could comply with either the pre-2025 or the amended Rule.United States (Federal)

Takes effectMay 19, 2025 · 17 months ago

TAKE IT DOWN ActCriminal provisions effective on enactmentPublishing or threatening to publish non-consensual intimate images, including digital forgeries, became a federal crime upon signature.United States (Federal)

Takes effectApr 8, 2025 · 19 months ago

DOJ Bulk Data RuleProhibitions and restrictions take effectCore prohibitions on covered data transactions and security requirements for restricted transactions apply.United States (Federal)

ReportingMar 7, 2025 · 20 months ago

HIPAA Security Rule update (NPRM)Comment period closesPublic comments on the NPRM due.United States

Transition endsMar 7, 2025 · 20 months ago

HIPAASecurity Rule NPRM comment period closedComments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.United States (Federal)

Takes effectJan 17, 2025 · 21 months ago

CFPB Open Banking Rule (Section 1033)Final rule effectiveRule published 2024-11-18 takes effect.United States

MilestoneJan 6, 2025 · 22 months ago

HIPAA Security Rule update (NPRM)NPRM publishedProposed Security Rule changes published in the Federal Register.United States

ComplianceDec 23, 2024 · 22 months ago

HIPAAReproductive health privacy compliance date (vacated)Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.United States (Federal)

ComplianceDec 18, 2024 · 22 months ago

SEC Cyber Disclosure RulesInline XBRL tagging of Item 1.05 disclosuresForm 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.United States (Federal)

Takes effectDec 16, 2024 · 22 months ago

CMMC 2.0CMMC Program rule (32 CFR Part 170) effectiveThe program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.United States (Federal)

ComplianceDec 15, 2024 · 22 months ago

SEC Cyber Disclosure RulesInline XBRL tagging of annual cybersecurity disclosuresItem 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.United States (Federal)

Takes effectAug 2, 2024 · 2.2 years ago

SEC Regulation S-PAmendments effectiveThe Regulation S-P amendments became effective; compliance tiered by entity size.United States (Federal)

Takes effectJul 29, 2024 · 2.2 years ago

FTC Health Breach Notification Rule2024 amendments effectiveAmendments clarifying health app coverage, unauthorized disclosure as breach, email notice and FTC notice timing took effect.United States (Federal)

Transition endsJul 3, 2024 · 2.3 years ago

CIRCIANPRM comment period closedExtended comment period on the CIRCIA proposed rule closed.United States (Federal)

Takes effectJun 25, 2024 · 2.3 years ago

HIPAAReproductive health care privacy rule effective (later vacated)The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).United States (Federal)

Takes effectJun 23, 2024 · 2.3 years ago

PADFAPADFA takes effectThe prohibition takes effect 60 days after enactment (April 24, 2024).United States (Federal)

ComplianceJun 15, 2024 · 2.4 years ago

SEC Cyber Disclosure RulesSmaller reporting companies: Item 1.05 complianceSmaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.United States (Federal)

Takes effectMay 13, 2024 · 2.5 years ago

GLBA Safeguards RuleFTC breach notification requirement effectiveSection 314.4(j) requires notice to the FTC within 30 days of discovering a notification event involving at least 500 consumers.United States (Federal)

Takes effectMar 13, 2024 · 2.6 years ago

FCC CPNI Breach RuleOrder effective except revised notification rulesDefinitions and other parts of the order took effect; the revised 64.2011 and 64.5111 notification requirements were delayed pending OMB approval.United States (Federal)

ComplianceDec 18, 2023 · 2.9 years ago

SEC Cyber Disclosure RulesForm 8-K Item 1.05 incident disclosure beginsAll registrants other than smaller reporting companies must file material incident disclosures from this date.United States (Federal)

ComplianceDec 15, 2023 · 2.9 years ago

SEC Cyber Disclosure RulesAnnual cybersecurity disclosures begin (Item 106 / 16K)Required in annual reports for fiscal years ending on or after this date.United States (Federal)

ComplianceJun 9, 2023 · 3.4 years ago

GLBA Safeguards RuleCompliance with expanded security program elementsApplicability of the 314.5 provisions (qualified individual, written risk assessment, encryption, MFA, pen testing, incident response plan, board reporting) was delayed from December 9, 2022 to this date.United States (Federal)

Takes effectJan 10, 2022 · 4.8 years ago

GLBA Safeguards Rule2021 Safeguards Rule amendments effectiveThe amended Safeguards Rule published December 9, 2021 took effect, with the more detailed program elements in 314.5 deferred.United States (Federal)