All data, privacy and AI regulations

Data (Use and Access) Act 2025

Connecticut Data Privacy Act (Public Act 22-15), Conn. Gen. Stat. 42-515 et seq., as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4)

Cyber Security and Resilience (Network and Information Systems) Bill

Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170) and DFARS acquisition rule (48 CFR Parts 204, 212, 217, 252)

Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025

Ley Nº 21.719 que regula la protección y el tratamiento de los datos personales y crea la Agencia de Protección de Datos Personales

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)

Directive (EU) 2024/2853 on liability for defective products (new Product Liability Directive)

Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024

Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2)

California AI Transparency Act (SB 942, Stats. 2024, ch. 291), as amended by AB 853 (Stats. 2025, ch. 674)

California SB 53, Transparency in Frontier Artificial Intelligence Act (Stats. 2025, ch. 138)

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11, 7000 et seq.)

Colorado SB 24-205 (Consumer Protections for Artificial Intelligence), as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology)

Delaware Personal Data Privacy Act (HB 154), 6 Del. C. ch. 12D

Louisiana Data Privacy Act (SB 386, 2026 Regular Session, Act No. 502), La. R.S. 51:1780.1-1780.5

New Hampshire Privacy Act (SB 255, 2024), RSA chapter 507-H

New York Responsible AI Safety and Education (RAISE) Act (S6953-B/A6453-B of 2025), as amended by chapter amendment S8828 of 2026

Oklahoma Consumer Data Privacy Act (SB 546, 2026)

Utah Consumer Privacy Act (SB 227, 2022)

Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)

Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi)

California Delete Act (SB 362, 2023), Cal. Civ. Code 1798.99.80 et seq., and DROP regulations

Law on Artificial Intelligence (Law No. 134/2025/QH15)

Regulation (EU) 2025/327 on the European Health Data Space

Maryland Online Data Privacy Act of 2024 (SB 541 / HB 567), Md. Code, Com. Law 14-4601 et seq.

Regulation (EU) 2016/679 (General Data Protection Regulation)

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)

Alabama Personal Data Protection Act (HB 351, 2026 Regular Session)

California SB 243, Companion Chatbots (Stats. 2025, ch. 677)

Personal Information Protection Act (as amended by Act No. 21445, 2026)

Utah Artificial Intelligence Policy Act (SB 149, 2024), as amended by SB 226 and SB 332 (2025)

Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)

Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026)

Minnesota Consumer Data Privacy Act (HF 4757, 2024 Minn. Laws ch. 121, art. 5), Minn. Stat. 325M.10-325M.21

Cyber Security Act 2024 (Cth) and Cyber Security (Ransomware Payment Reporting) Rules 2025

Online Safety Amendment (Social Media Minimum Age) Act 2024

Projeto de Lei nº 2338/2023 (Brazilian AI Legal Framework)

Estatuto Digital da Criança e do Adolescente (Law No. 15.211/2025)

Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018)

California AB 2013, Generative Artificial Intelligence: Training Data Transparency (Stats. 2024, ch. 817)

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act

Critical Cyber Systems Protection Act (enacted by Bill C-8, An Act respecting cyber security)

Measures for Labeling AI-Generated Synthetic Content

Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16)

Cybersecurity Law of the People's Republic of China (as amended by the NPC Standing Committee Decision of 28 October 2025)

Data Security Law of the People's Republic of China

Regulations on Network Data Security Management (State Council Order No. 790)

Administrative Measures for Personal Information Protection Compliance Audits (CAC Order No. 18)

Personal Information Protection Law of the People's Republic of China

Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) and proposed implementing rule (6 CFR Part 226)

Colorado Privacy Act (SB 21-190), C.R.S. 6-1-1301 et seq., as amended by HB 24-1130, SB 24-041 and SB 25-276

Children's Online Privacy Protection Rule (16 CFR Part 312), as amended April 2025

Regulation (EU) 2022/868 on European data governance (Data Governance Act)

Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act)

Proposal for a Regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, 2022/2555 and 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus)

Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act)

Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (28 CFR Part 202) - DOJ Data Security Program

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (Digital Operational Resilience Act)

Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive), as amended by Directive 2009/136/EC

EU KIDS Act

Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework

FCC Data Breach Reporting Requirements for telecommunications carriers, interconnected VoIP and TRS providers (47 CFR 64.2011, 64.5111)

Florida Digital Bill of Rights (CS/CS/SB 262, 2023)

FTC Health Breach Notification Rule (16 CFR Part 318), as amended 2024

FTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314, under the Gramm-Leach-Bliley Act

HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164)

Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)

Illinois HB 3773 (Public Act 103-0804), amending the Illinois Human Rights Act on artificial intelligence in employment

Illinois Biometric Information Privacy Act (740 ILCS 14), as amended by SB 2979 (Public Act 103-0769)

Indiana Consumer Data Protection Act (SEA 5, 2023), Ind. Code 24-15

Iowa Consumer Data Protection Act (SF 262, 2023), Iowa Code ch. 715D

Privacy Protection Law, 5741-1981 (Amendment No. 13)

Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-Related Technology

Act on the Protection of Personal Information (Act No. 57 of 2003), as amended including the 2026 amendment act

Kentucky Consumer Data Protection Act (HB 15, 2024), KRS 367.3611-367.3629

Data Protection Act, 2019 (No. 24 of 2019)

Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727)

Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025)

Montana Consumer Data Privacy Act (SB 384, 2023), Mont. Code Ann. 30-14-2801 et seq., as amended by SB 297 (2025)

Nebraska Data Privacy Act (LB 1074, 2024)

New Jersey Data Privacy Act (P.L.2023, c.266; S332)

Privacy Act 2020 (New Zealand), as amended by the Privacy Amendment Act 2025

Nigeria Data Protection Act, 2023 and NDPA General Application and Implementation Directive (GAID) 2025

New York City Local Law 144 of 2021, Automated Employment Decision Tools (NYC Admin. Code 20-870 et seq.)

New York DFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500), Second Amendment

Oregon Consumer Privacy Act (SB 619, 2023)

Protecting Americans' Data from Foreign Adversaries Act of 2024

Personal Information Protection and Electronic Documents Act

Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64)

Rhode Island Data Transparency and Privacy Protection Act

Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, as amended by Royal Decree M/148 of 5/9/1444H)

SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (Release No. 33-11216)

Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information (2024 amendments)

Personal Data Protection Act 2012 (Singapore)

Protection of Personal Information Act, 2013 (Act No. 4 of 2013)

Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act)

Federal Act on Data Protection (revised FADP) of 25 September 2020

Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act)

Tennessee Information Protection Act (HB 1181 / SB 73, 2023)

Texas Data Privacy and Security Act (HB 4, 2023)

Personal Data Protection Act B.E. 2562 (2019)

Texas Responsible Artificial Intelligence Governance Act (HB 149, 89th Legislature)

Law No. 6698 on the Protection of Personal Data (KVKK), as amended by Law No. 7499

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data

UK General Data Protection Regulation and Data Protection Act 2018

Online Safety Act 2023

Law on Personal Data Protection (Law No. 91/2025/QH15)

Virginia Consumer Data Protection Act (SB 1392 / HB 2307, 2021)

Washington My Health My Data Act (HB 1155, Laws of 2023, ch. 191; RCW 19.373)