Regulationsby GlyphAll data, privacy and AI regulations
Egypt PDPLEgypt's data protection law covers personal data processed electronically. It sets consent and lawful processing rules, strict rules for sensitive data and cross-border transfers, and a licensing and permit system run by the Personal Data Protection Center. The Executive Regulations were only issued in November 2025, which starts a one-year window to comply.Next: Nov 2 One-year compliance window ends · in 6 days
CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days
India DPDP ActIndia's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.Next: Nov 13 Consent Manager registration rule in force (12 months) · in 17 daysEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 daysPeru PDPL and 2024 RegulationPeru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.Next: Nov 30 DPO required: medium companies · in 34 daysChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU Platform Work DirectiveFirst EU law on algorithmic management at work. Digital labour platforms may not use automated systems to process emotional, psychological or certain other personal data of platform workers, must be transparent about automated monitoring and decision systems, and must ensure human oversight and human review of significant decisions. It also creates a rebuttable presumption of employment.Next: Dec 2 Transposition deadline · in 36 daysProduct Liability DirectiveModernises EU strict (no-fault) liability for defective products. Software (including AI systems and SaaS), digital manufacturing files and related digital services now count as products. Destruction or corruption of non-professional data is compensable damage, and missing security updates or cybersecurity vulnerabilities can make a product defective. Courts can order evidence disclosure and presume defectiveness in complex cases.Next: Dec 9 Transposition deadline; old PLD repealed · in 43 days
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 dayseIDAS 2 / EU Digital Identity WalletRequires every Member State to offer at least one European Digital Identity Wallet so people can identify themselves and share verified attributes with selective disclosure. It adds new qualified trust services such as electronic attestations of attributes and electronic ledgers. Private relying parties that must use strong authentication, and very large online platforms, have to accept the wallet when the user asks.Next: Dec 24 Member States must provide EU Digital Identity Wallets · in 58 days
Malaysia Online Safety ActPuts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.Next: Dec 28 Online Safety Plan due to MCMC · in 2 months
Utah App Store Accountability ActApp stores must verify each user's age category, obtain parental consent for minor accounts and share age and consent status with developers. Developers must check age and consent through the app store and cannot enforce contracts against minors without consent. Parents of harmed minors can sue.Next: Dec 31 Private right of action begins · in 2 months
California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 monthsCalifornia AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 monthsCalifornia Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 monthsCalifornia SB 53 (TFAIA)Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.Next: Jan 1, 2027 First OES anonymized incident report and CDT definition review · in 2 monthsCalifornia SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 monthsCCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
Delaware Personal Data Privacy Act (DPDPA)Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.Next: Jan 1, 2027 Amended thresholds and third-party duties take effect · in 2 monthsLouisiana Data Privacy ActLouisiana's comprehensive privacy law, signed May 29, 2026, gives consumers access, deletion, correction, portability and opt-out rights and requires conspicuous notice when sensitive or biometric data is sold. It uses CCPA-style applicability thresholds, including a $25M revenue trigger.Next: Jan 1, 2027 Louisiana Data Privacy Act takes effect · in 2 monthsNew Hampshire Privacy ActComprehensive consumer privacy law giving New Hampshire residents access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, universal opt-out signal support and data protection assessments. A 2026 amendment (HB 1460) bans selling the personal data of children under 13 starting in 2027.Next: Jan 1, 2027 Ban on selling personal data of children under 13 (HB 1460) · in 2 months
NY RAISE ActFrontier AI developers must publish transparency reports when they deploy models and report critical safety incidents to a new DFS oversight office within 72 hours, or within 24 hours to authorities where there is imminent risk of death or injury. Large frontier developers must also publish and annually update a Frontier AI Framework, submit catastrophic-risk assessments, file disclosure statements with DFS every two years, and pay a share of the office's costs. The March 2026 chapter amendment realigned the law closely with California SB 53.Next: Jan 1, 2027 RAISE Act takes effect · in 2 monthsOklahoma OKCDPANew Virginia-style comprehensive privacy law: consumers get access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, privacy notices and data protection assessments. It treats pseudonymous data as personal data and lets controllers authenticate opt-out requests.Next: Jan 1, 2027 Oklahoma Consumer Data Privacy Act takes effect · in 2 months
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 monthsUtah UCPABusiness-friendly comprehensive privacy law with access, deletion, portability and opt-out rights (targeted advertising, sale); sensitive data needs notice and a chance to opt out rather than opt-in consent, and data protection assessments are not required. A right to correct was added from July 1, 2026, and from Jan 1, 2027 the law covers motor vehicle manufacturers regardless of thresholds.Next: Jan 1, 2027 UCPA extends to motor vehicle manufacturers · in 2 months
Vermont Kids CodeCovered online businesses owe minors a minimum duty of care, must set high-privacy defaults and offer tools, and must avoid prohibited data and design practices. Age assurance data has privacy limits.Next: Jan 1, 2027 Takes effect · in 2 monthsEU Data ActGives users of connected products and related services the right to access and share the data those products generate, and sets rules for business-to-business data sharing. It bans unfair data-sharing contract terms imposed on businesses and lets public bodies obtain data in cases of exceptional need. Cloud and other data processing service providers must make switching easy, and switching charges are phased out.Next: Jan 12, 2027 Cloud switching charges abolished · in 3 months
Indonesia PDP LawIndonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.Next: Jan 16, 2027 Implementing regulation GR 33/2026 takes effect · in 3 monthsNY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 monthsCalifornia Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 monthsEU Cyber Solidarity ActSets up a European Cybersecurity Alert System of national and cross-border Cyber Hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve of trusted private incident response providers, and a Cybersecurity Incident Review Mechanism for significant and large-scale incidents.Next: Feb 5, 2027 First Commission evaluation · in 3 monthsDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 months
Vietnam AI LawVietnam's first standalone AI law (35 articles). It classifies AI systems as high, medium or low risk based on their impact on life, health, rights and public order, requires human oversight, and requires disclosure when users interact with AI and labeling of AI-generated audio, image and video content. It applies to domestic and foreign actors in AI activities in Vietnam, with transition periods for existing systems.Next: Mar 1, 2027 Transition ends for existing AI systems (general) · in 4 monthsEuropean Health Data Space (EHDS)Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.Next: Mar 26, 2027 EHDS general application date · in 5 monthsCFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months
Maryland Online Data Privacy Act (MODPA)The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.Next: Apr 1, 2027 Discretionary 60-day cure period ends · in 5 monthsGDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 monthsNIS2Requires medium and large entities in 18 critical sectors, including cloud, data centres, managed services, online marketplaces, search and social networks, to adopt cybersecurity risk-management measures. They must report significant incidents within 24 hours (early warning), 72 hours (notification) and one month (final report). Management bodies are accountable. Obligations apply through national transposing laws.Next: Apr 17, 2027 Next biennial entity notification · in 6 months
Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 monthsCalifornia SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
South Korea PIPAKorea's comprehensive privacy law, with consent-centric processing, breach notification, cross-border transfer rules, automated decision rights (since 2024), and revenue-based penalty surcharges. The 2026 amendment, effective 11 September 2026, raises the maximum fine to 10% of total revenue for aggravated cases, makes the CEO the ultimate responsible person, requires notice when a breach is merely possible, and makes ISMS-P certification mandatory for certain entities from 1 July 2027.Next: Jul 1, 2027 Mandatory ISMS-P certification · in 8 monthsUtah AI Policy ActMakes businesses liable under Utah consumer protection law for deceptive acts committed through generative AI. Businesses must disclose generative AI use when a consumer clearly and unequivocally asks, and must disclose it proactively in high-risk interactions and regulated-occupation services. The act created the Office of Artificial Intelligence Policy and a regulatory learning lab. In 2025, SB 226 narrowed the disclosure duties and added a safe harbor, and SB 332 moved the act's repeal date to July 1, 2027.Next: Jul 1, 2027 Scheduled repeal of Title 13, Ch. 72 · in 8 monthsVietnam Cybersecurity Law 2025A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.Next: Jul 1, 2027 Transition ends for existing systems and products · in 8 monthsPeru AI Law and RegulationPeru's AI law and its 2025 regulation set a risk-based framework with prohibited uses and high-risk uses (for example in credit, employment, health and education access). Developers and deployers of high-risk systems must run impact assessments, keep human oversight and give transparency. Obligations phase in by sector and company size over one to four years.Next: Sep 10, 2027 Private sector: transport, commerce, labour · in 10 months
Japan Active Cyber Defense ActJapan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.Next: Nov 22, 2027 Communications data measures in force (latest date) · in 13 monthsCyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsVermont VDPOSANew comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.Next: Jan 1, 2028 Vermont Data Privacy and Online Surveillance Act takes effect · in 14 monthsTaiwan AI Basic ActTaiwan's framework law for AI. It sets seven principles (including privacy, security, transparency, fairness and accountability), names the National Science and Technology Council as the lead authority, and has the Ministry of Digital Affairs build a risk classification framework that sector regulators use for risk-based rules. High-risk AI must carry warnings, and the government must set liability and remedy rules for high-risk AI.Next: Jan 14, 2028 Agencies must align laws with the Act · in 15 monthsEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsMinnesota Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with distinctive rights to question the result of profiling decisions and to obtain a list of specific third parties that received the consumer's data. Requires data inventories, documented privacy policies and procedures, and data protection assessments.Next: Jul 31, 2029 Postsecondary institutions must comply · in 2.8 yearsAI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date setArkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025Bahrain PDPLBahrain's general data protection law. It sets lawful bases for processing, stricter rules for sensitive data, individual rights, transfer limits and registration duties, and creates the Personal Data Protection Authority. It carries both administrative and criminal penalties.In effect since Aug 1, 2019
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setBrazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026California Senate Bill 813Establishes a framework for independent verification organizations to assess AI systems and models for compliance with state law.No date setCalifornia social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setChina AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023China Facial Recognition MeasuresSets rules for using facial recognition to process face data in China. Handlers need a specific purpose and necessity, separate consent (guardian consent under 14), a prior impact assessment, local storage on the device unless consent or law allows otherwise, and a non-face alternative. Handlers storing face data of 100,000 people or more must file with the provincial CAC within 30 working days.In effect since Jun 1, 2025China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024China Network Data Security RegulationsImplementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.In effect since Jan 1, 2025China PI Compliance Audit MeasuresImplements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.In effect since May 1, 2025China PI Export Certification MeasuresSets the third route for exporting personal information from China: certification by an accredited certification body. Available to non-CII handlers exporting personal information of 100,000 to under 1 million people (non-sensitive) or under 10,000 people's sensitive data in a year. Certificates last three years; overseas handlers apply through a local entity or representative.In effect since Jan 1, 2026China PI Export Standard Contract MeasuresLets personal information handlers export personal information by signing China's standard contract with the overseas recipient instead of a security assessment, if volume limits are met. Handlers must do a personal information protection impact assessment and file the signed contract with the provincial CAC. Transfers already under way had six months to comply.In effect since Jun 1, 2023China PIPLChina's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.In effect since Nov 1, 2021China Small PI Handler Simplified MeasuresEases PIPL compliance for handlers processing personal information of fewer than 100,000 people. They can use short notices, rely on platform privacy rules, run simplified compliance audits at least every five years using a self-check form, and use simplified impact assessments. It also exempts common cross-border transfers from the assessment, contract and certification routes and limits penalties for minor first violations.In effect since Sep 1, 2026CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date setCoE AI Framework ConventionFirst binding international treaty on AI. Parties must ensure AI activities across the lifecycle respect human rights, democracy and the rule of law, with risk and impact assessments, transparency, oversight and remedies. Each party chooses how to apply it to private actors.No date setColorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025DORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023ePrivacy Directive (cookie law)Requires prior consent to store or access information on a user's device (cookies, SDKs, fingerprinting), except where strictly necessary. Also covers confidentiality of communications, traffic and location data, and unsolicited direct marketing (opt-in for email/SMS to individuals). Telecom providers must notify personal data breaches. Enforced through national laws.In effect since Jul 31, 2002EU Cybersecurity ActGives ENISA a permanent mandate and sets up the EU framework for voluntary cybersecurity certification schemes for ICT products, services and processes, such as the EUCC scheme. On 2026-01-20 the Commission proposed a replacement, the Cybersecurity Act 2 (COM(2026) 11), adding an ICT supply chain security framework aimed at high-risk suppliers.In effect since Jun 27, 2019EU e-Evidence PackageLets judicial authorities in one Member State order service providers in another to produce or preserve electronic evidence, such as subscriber, traffic and content data, directly and within tight deadlines. Non-EU providers offering services in the EU must appoint a designated establishment or legal representative to receive orders.In effect since Aug 18, 2026EU Financial Data Access (FIDA) proposalWould create a right for customers to have their financial data beyond payment accounts, such as savings, investments, insurance and credit data, shared with authorised third parties. Data holders would join financial data sharing schemes and customers would manage permissions through dashboards.No date setEU KIDS ActA legislative initiative designed to restrict social media platforms' access to children within the European Union.No date setEU Political Advertising Regulation (TTPA)Sets EU-wide transparency rules for paid political advertising, including labels, transparency notices and a public ad repository. Online targeting and ad delivery using personal data is only allowed with explicit consent, on data collected from the person, and never using special category data or profiling.In effect since Oct 10, 2025EU-US Data Privacy FrameworkGDPR Art 45 adequacy decision letting personal data flow from the EEA to US organisations self-certified under the Data Privacy Framework with the US Department of Commerce, with no further transfer mechanism needed. It relies on US Executive Order 14086 safeguards and the Data Protection Review Court for redress. The EU General Court upheld it in Latombe v Commission (T-553/23) on 3 Sep 2025, and an appeal is pending before the Court of Justice.In effect since Jul 10, 2023FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024
Florida Digital Bill of RightsPrivacy law aimed at very large tech companies: access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data, voice/face recognition limits, data retention schedules and protections for known children. Separately, any for-profit business that sells sensitive data must post a notice, and the sale-of-sensitive-data consent rule applies beyond the big-tech controllers.In effect since Jul 1, 2024FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003HIPAASets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.In effect since Apr 14, 2003HIPAA Security Rule update (NPRM)Proposed overhaul of the HIPAA Security Rule. It would remove the addressable versus required distinction, and require a technology asset inventory and network map, encryption, multi-factor authentication, vulnerability scanning, penetration testing and 72-hour restoration planning. No final rule has been issued.No date set
Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong's critical infrastructure cybersecurity law. Designated critical infrastructure operators (CIOs) must keep a Hong Kong office, set up a computer-system security management unit, run risk assessments and audits, keep security and emergency plans, take part in drills, and report incidents. Serious incidents must be reported within 12 hours and other incidents within 48 hours.In effect since Jan 1, 2026Hong Kong PDPOHong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.In effect since Dec 20, 1996
Illinois AI in Employment Law (HB 3773)Makes it a civil-rights violation for an employer to use AI that has the effect of discriminating against employees or applicants on the basis of a protected class in recruitment, hiring, promotion, discipline, discharge or the terms of employment. It also bars using ZIP codes as a proxy for a protected class. Employers must notify employees when they use AI for these decisions; IDHR is to set the notice rules.In effect since Jan 1, 2026Illinois BIPAPrivate entities must publish a biometric retention and destruction policy, give written notice, and obtain a written release before collecting biometric identifiers such as fingerprints, face geometry or voiceprints. They may not sell or profit from biometric data and need consent to disclose it. The 2024 SB 2979 amendment treats repeated collection or disclosure from the same person by the same method as a single violation and allows electronic signatures for consent. The Seventh Circuit held on April 1, 2026 that the amendment applies retroactively to pending cases.In effect since Oct 3, 2008India CERT-In Cyber Security DirectionsRequires service providers, intermediaries, data centres, body corporates and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them. Entities must sync clocks to Indian NTP servers, keep ICT logs for a rolling 180 days within India, and name a point of contact. Data centre, VPS, cloud and VPN providers must keep validated subscriber details for 5 years.In effect since Jun 27, 2022India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026Indiana Consumer Data Protection Act (ICDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires consent for sensitive data processing and data protection impact assessments for high-risk processing.In effect since Jan 1, 2026Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025Interoperable Europe ActCreates a cooperation framework for cross-border interoperability of public sector digital services and data exchange. Public bodies must carry out interoperability assessments before changing binding requirements for trans-European digital public services, and an Interoperable Europe Board steers common solutions.In effect since Jul 12, 2024
Iowa Consumer Data Protection Act (ICDPA)Business-friendly comprehensive privacy law giving rights to confirm, access, delete, obtain a copy of, and opt out of sale and targeted advertising (no correction right, no profiling opt-out). Sensitive data requires notice and an opt-out opportunity rather than opt-in consent.In effect since Jan 1, 2025
Israel Privacy Protection Law Amendment 13Major overhaul of Israel's privacy law: broadens definitions (personal and highly sensitive information), narrows database registration, requires privacy protection officers for certain entities, and gives the Privacy Protection Authority powers to impose large administrative fines and orders, plus statutory damages.In effect since Aug 14, 2025Japan AI Promotion ActA framework law to promote AI R&D and use, not to restrict it. It sets up the AI Strategy Headquarters under the Prime Minister and an AI Basic Plan. The government can investigate cases where AI causes harm to rights and publish guidance and names. It sets no direct compliance obligations or fines for businesses, beyond a duty to cooperate with government measures.In effect since Jun 4, 2025Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005Kazakhstan AI LawKazakhstan's first AI statute. Owners sort their AI systems into minimal, medium or high risk and must run yearly risk management, keep documentation and inform users when AI is used. Some AI functions are banned outright, including manipulation, exploiting vulnerable people, social scoring, biometric categorisation for discrimination and emotion recognition without consent. AI-generated synthetic content must carry machine-readable marking and a visible warning.In effect since Jan 18, 2026
Kentucky Consumer Data Protection Act (KCDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires opt-in consent for sensitive data and data protection assessments for high-risk processing.In effect since Jan 1, 2026
Kenya Computer Misuse and Cybercrimes ActKenya's main cybercrime law. It creates offences such as unauthorised access, interference, cyber harassment and false publication, sets up a National Computer and Cybercrimes Co-ordination Committee, and requires critical infrastructure owners to report threatening incidents. The 2025 amendment adds identity theft rules and lets the Committee order websites or apps that promote unlawful activity, child sexual content, terrorism or extremism to be blocked.In effect since May 30, 2018Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019Louisiana app store age verification lawApp stores must use age verification methods, affiliate minor accounts with a parent account and give parents consent disclosures before minors use apps. Developers have matching duties to use age and consent data and protect it.In effect since Jul 1, 2026Malaysia Cyber Security ActMalaysia's first standalone cybersecurity law. It sets up the National Cyber Security Committee, gives powers to the Chief Executive of NACSA, and places duties on national critical information infrastructure (NCII) sector leads and entities. NCII entities must follow codes of practice, run a risk assessment at least once a year and an audit at least once every two years, and notify cybersecurity incidents within 6 hours. Cybersecurity service providers must be licensed.In effect since Aug 26, 2024Malaysia PDPAMalaysia's commercial-sector data protection law. The 2024 amendments, phased in during 2025, rename 'data users' as 'data controllers', add biometric data to sensitive data, apply the Security Principle directly to processors, replace the transfer whitelist with adequacy and safeguards tests, raise fines, and add mandatory DPOs, data breach notification and data portability.In effect since Nov 15, 2013Maryland Kids CodeOnline products reasonably likely to be accessed by children must be designed in the best interests of children, use high-privacy defaults and avoid certain data collection and profiling. Covered entities must complete data protection impact assessments.In effect since Oct 1, 2024Mexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025
Montana Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.In effect since Oct 1, 2024
Nebraska Kids CodeCovered online services must use reasonable care to avoid harms to minors from design features, provide default privacy and safety tools, and designate a compliance officer.In effect since Jan 1, 2026Nebraska NDPAComprehensive consumer privacy law modeled on the Texas TDPSA: consumers get access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling). Controllers must post privacy notices, obtain opt-in consent for sensitive data, honor universal opt-out signals and run data protection assessments.In effect since Jan 1, 2025Nevada consumer health data lawWashington-style consumer health data law. Regulated entities need consent to collect and share consumer health data, must publish a health data privacy policy, honor access and deletion rights, and cannot geofence health care facilities. Selling consumer health data needs written authorization.In effect since Mar 31, 2024
New Jersey NJDPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, consent for targeted advertising/sale/profiling of known 13-17 year olds, universal opt-out signal support and data protection assessments. It has no revenue-share floor for the smaller threshold, and the Division of Consumer Affairs has rulemaking authority. A June 2026 law (A5328) bans selling sensitive data and creates a data broker registry.In effect since Jan 15, 2025
New Zealand Biometric Processing Privacy CodeA binding code of practice under the Privacy Act 2020. It sets the privacy rules for organisations that collect and use biometric information, such as face, fingerprints, voice, keystroke patterns or gait, in automated biometric processing like facial recognition. Agencies already using biometrics had a nine-month grace period, which ended on 3 August 2026. Amendment No. 1 aligns the code with the new indirect collection principle (IPP 3A) from 1 May 2026.In effect since Nov 3, 2025New Zealand Privacy ActNew Zealand's privacy law, built on 13 Information Privacy Principles plus mandatory notification of serious privacy breaches. The Privacy Amendment Act 2025 adds IPP 3A from 1 May 2026: agencies that collect personal information indirectly (from third parties) must take reasonable steps to tell the individual about the collection, its purpose, recipients and their rights.In effect since Dec 1, 2020
Nigeria NDPANigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.In effect since Jun 12, 2023NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025NYC Local Law 144 (AEDT)Employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion unless the tool has had an independent bias audit within the past year. They must publish a summary of the audit results and give candidates at least 10 business days' notice that an AEDT will be used.In effect since Jul 5, 2023NYDFS Cybersecurity Regulation (Part 500)DFS-licensed financial companies must keep a risk-based cybersecurity program, CISO, policies, access controls, MFA, encryption, an asset inventory, and incident response and business continuity plans. They must notify DFS within 72 hours of a cybersecurity event and within 24 hours of any extortion payment, and certify compliance or acknowledge non-compliance each April 15. The 2023 Second Amendment added governance duties, Class A company requirements and phased controls through November 1, 2025.In effect since Mar 1, 2017Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
Oregon OCPAComprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.In effect since Jul 1, 2024PADFAMakes it unlawful for a data broker to sell, license, transfer, disclose or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (China, Iran, North Korea, Russia) or to an entity controlled by one. Covered data is broad, including health, financial, biometric, genetic, precise geolocation, private communications and data about minors.In effect since Jun 23, 2024Pakistan PECAPakistan's main cybercrime law, covering unauthorised access, data interference, cyber stalking and related offences, plus investigation powers. The 2025 amendment creates a Social Media Protection and Regulatory Authority that enlists social media platforms, orders removal or blocking of unlawful content, and can block non-compliant platforms. It also adds a Social Media Protection Tribunal, a new National Cyber Crime Investigation Agency, and an offence of spreading false information.No date setPhilippines Data Privacy ActThe Philippines' general data privacy law. It sets consent and lawful processing rules, protects sensitive personal information, gives data subjects access, correction, erasure and portability rights, and creates the National Privacy Commission. Its 2016 Implementing Rules require breach notice to the NPC and affected people within 72 hours, plus registration of data processing systems.In effect since Sep 8, 2012PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001
Quebec Law 25Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.In effect since Sep 22, 2022
Rhode Island RIDTPPAComprehensive consumer privacy law giving access, correction, deletion, portability and opt-out rights, requiring opt-in consent for sensitive data and data protection assessments. A notable extra: any commercial website or ISP that sells personally identifiable information must disclose the categories collected and every third party it has sold or may sell data to, whatever its size.In effect since Jan 1, 2026Rwanda DPP LawRwanda's data protection law, modelled on the GDPR. Controllers and processors must register with the supervisory authority, report breaches within 72 hours, and store personal data in Rwanda unless they hold a certificate allowing storage abroad. Cross-border transfers need authorisation or another listed ground.In effect since Oct 15, 2021
Saudi PDPLSaudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.In effect since Sep 14, 2023SEC Cyber Disclosure RulesPublic companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material (foreign private issuers use Form 6-K), and describe cybersecurity risk management, strategy and governance annually in Form 10-K (Item 106) or Form 20-F (Item 16K).In effect since Sep 5, 2023SEC Regulation S-PRequires broker-dealers, investment companies, registered investment advisers and transfer agents to adopt a written incident response program and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Service providers must be overseen and must notify the covered institution within 72 hours of a breach; recordkeeping and annual privacy notice changes also apply.In effect since Aug 2, 2024Singapore Cybersecurity ActSingapore's framework for protecting critical information infrastructure (CII). CII owners must meet codes of practice, run audits and risk assessments, and report prescribed cybersecurity incidents to the Commissioner of Cybersecurity. Providers of licensable services (penetration testing and managed SOC) need a licence. The 2024 amendments extend oversight to foundational digital infrastructure providers, entities of special cybersecurity interest, systems of temporary cybersecurity concern, and CII located overseas, and add civil penalties.In effect since Aug 31, 2018Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026Singapore PDPASingapore's baseline private-sector data protection law covering consent, purpose limitation, notification, access and correction, protection, retention, transfer limitation, and the Do Not Call registry. The 2020 amendments added mandatory breach notification, expanded deemed consent and legitimate-interests exceptions, and raised fines.In effect since Jul 2, 2014
South Africa Cybercrimes ActCreates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.In effect since Dec 1, 2021South Africa POPIASouth Africa's comprehensive data protection law built on eight conditions for lawful processing, with Information Officer registration, security compromise notification to the Regulator and data subjects, and restrictions on direct marketing and cross-border transfers. Protects juristic persons as well as individuals.In effect since Jul 1, 2020South Korea AI Basic ActKorea's comprehensive AI law: transparency duties (notify users in advance that AI is used, label generative AI outputs and deepfakes), risk management, explainability and human oversight for 'high-impact' AI (e.g. hiring, lending, healthcare), safety duties for very large models (10^26 FLOPs+ training compute), and a domestic representative for large foreign providers. MSIT is running a grace period of at least one year, deferring fact-finding and fines except in serious cases.In effect since Jan 22, 2026
Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023Taiwan PDPATaiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.In effect since Oct 1, 2012TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025
Tennessee ELVIS ActReplaces the Personal Rights Protection Act of 1984 and adds voice to the protected property right in name, photograph and likeness. It targets unauthorized AI voice clones and deepfakes, including liability for distributing tools whose primary purpose is producing unauthorized voice or likeness.In effect since Jul 1, 2024Tennessee TIPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data and data protection assessments. Controllers must keep a written privacy program that reasonably conforms to the NIST Privacy Framework, which also serves as an affirmative defense.In effect since Jul 1, 2025
Texas App Store Accountability ActApp stores must verify user ages, link minor accounts to a parent and obtain parental consent before minors download or buy apps. Developers must use the app store's age and consent signals. A federal court has preliminarily enjoined enforcement.In effect since Jan 1, 2026Texas TDPSAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, data protection assessments and a universal opt-out signal requirement. Scope turns on the SBA small-business definition instead of consumer-count thresholds, so it reaches most non-small businesses.In effect since Jul 1, 2024Thailand Cybersecurity ActThailand's cybersecurity framework for government agencies and critical information infrastructure (CII) operators. It creates the National Cyber Security Committee and the National Cyber Security Agency (NCSA). It also sets codes of practice and standards, incident reporting and response duties, and escalating powers for serious and critical cyber threats. The Committee issues binding standards under the Act, such as the Website Security Standard B.E. 2568.In effect since May 28, 2019Thailand PDPAThailand's GDPR-style data protection law: lawful bases including explicit consent for sensitive data, data subject rights, DPOs for large-scale or sensitive processing, breach notification to the PDPC within 72 hours, and cross-border transfer restrictions. Main obligations applied from 1 June 2022 after two postponements.In effect since Jun 1, 2022TRAIGABans developing or deploying AI with the intent to incite self-harm or crime, to unlawfully discriminate against a protected class, to produce child sexual abuse material or unlawful sexual deepfakes, or to infringe constitutional rights. Government agencies must also disclose AI use and may not use it for social scoring or biometric identification without consent. Creates a Texas AI regulatory sandbox, where approved participants can test systems for up to 36 months, and a Texas AI Council. Liability generally turns on intent, not disparate impact alone.In effect since Jan 1, 2026
Turkey KVKKTurkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).In effect since Apr 7, 2016UAE PDPLFederal GDPR-style data protection law for the onshore UAE covering consent and other bases, data subject rights, breach notification, DPOs and cross-border transfers. Key details (including fines and some thresholds) depend on Executive Regulations that have not been issued.In effect since Jan 2, 2022UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date setUK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date setUK Online Safety ActImposes duties of care on user-to-user services and search engines to assess and mitigate illegal content risks and, where children can access the service, to protect children (including highly effective age assurance for pornography and other primary priority content). Categorised services face additional transparency, user empowerment and fraudulent advertising duties.In effect since Mar 17, 2025UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024UK Telecommunications Security ActImposes strengthened security duties on UK public telecoms providers, backed by detailed security measures regulations and a code of practice. It also gives the government powers to restrict the use of high-risk vendors' equipment through designated vendor directions.In effect since Oct 1, 2022Uruguay Law 18.331Uruguay's data protection law, which treats data protection as a human right and covers consent, purpose limits, security, sensitive data, data subject rights and international transfers. Law 19.670 of 2018 added accountability duties, regulated by Decree 64/020. Uruguay holds EU adequacy status.In effect since Aug 18, 2008Vietnam Law on DataVietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.In effect since Jul 1, 2025Vietnam PDPLVietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.In effect since Jan 1, 2026
Virginia VCDPAThe second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.In effect since Jan 1, 2023Washington My Health My Data ActRegulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.In effect since Mar 31, 2024