Cybersecurity regulations

Regulations worldwide that deal with cybersecurity, with every phased deadline and the official source for each.

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days

EnactedEuropean Union

Product Liability DirectiveModernises EU strict (no-fault) liability for defective products. Software (including AI systems and SaaS), digital manufacturing files and related digital services now count as products. Destruction or corruption of non-professional data is compensable damage, and missing security updates or cybersecurity vulnerabilities can make a product defective. Courts can order evidence disclosure and presume defectiveness in complex cases.Next: Dec 9 Transposition deadline; old PLD repealed · in 43 days

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceEuropean Union

EU Cyber Solidarity ActSets up a European Cybersecurity Alert System of national and cross-border Cyber Hubs, a Cybersecurity Emergency Mechanism with an EU Cybersecurity Reserve of trusted private incident response providers, and a Cybersecurity Incident Review Mechanism for significant and large-scale incidents.Next: Feb 5, 2027 First Commission evaluation · in 3 months

EnactedUnited States

CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months

AmendedEuropean Union

NIS2Requires medium and large entities in 18 critical sectors, including cloud, data centres, managed services, online marketplaces, search and social networks, to adopt cybersecurity risk-management measures. They must report significant incidents within 24 hours (early warning), 72 hours (notification) and one month (final report). Management bodies are accountable. Obligations apply through national transposing laws.Next: Apr 17, 2027 Next biennial entity notification · in 6 months

In forceVietnam

Vietnam Cybersecurity Law 2025A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.Next: Jul 1, 2027 Transition ends for existing systems and products · in 8 months

EnactedJapan

Japan Active Cyber Defense ActJapan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.Next: Nov 22, 2027 Communications data measures in force (latest date) · in 13 months

EnactedEuropean Union

Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 months

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

EnactedCanada

Canada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date set

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

In forceChina

China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022

In forceChina

China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021

In forceChina

China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026

In forceChina

China Network Data Security RegulationsImplementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.In effect since Jan 1, 2025

EnactedUnited States (Federal)

CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set

ProposedEuropean Union

Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date set

In forceUnited States (Federal)

DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025

In forceEuropean Union

DORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023

AmendedEuropean Union

EU Cybersecurity ActGives ENISA a permanent mandate and sets up the EU framework for voluntary cybersecurity certification schemes for ICT products, services and processes, such as the EUCC scheme. On 2026-01-20 the Commission proposed a replacement, the Cybersecurity Act 2 (COM(2026) 11), adding an ICT supply chain security framework aimed at high-risk suppliers.In effect since Jun 27, 2019

AmendedUnited States (Federal)

FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024

AmendedUnited States (Federal)

GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003

AmendedUnited States (Federal)

HIPAASets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.In effect since Apr 14, 2003

ProposedUnited States

HIPAA Security Rule update (NPRM)Proposed overhaul of the HIPAA Security Rule. It would remove the addressable versus required distinction, and require a technology asset inventory and network map, encryption, multi-factor authentication, vulnerability scanning, penetration testing and 72-hour restoration planning. No final rule has been issued.No date set

In forceHong Kong

Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong's critical infrastructure cybersecurity law. Designated critical infrastructure operators (CIOs) must keep a Hong Kong office, set up a computer-system security management unit, run risk assessments and audits, keep security and emergency plans, take part in drills, and report incidents. Serious incidents must be reported within 12 hours and other incidents within 48 hours.In effect since Jan 1, 2026

In forceIndia

India CERT-In Cyber Security DirectionsRequires service providers, intermediaries, data centres, body corporates and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them. Entities must sync clocks to Indian NTP servers, keep ICT logs for a rolling 180 days within India, and name a point of contact. Data centre, VPS, cloud and VPN providers must keep validated subscriber details for 5 years.In effect since Jun 27, 2022

AmendedKenya

Kenya Computer Misuse and Cybercrimes ActKenya's main cybercrime law. It creates offences such as unauthorised access, interference, cyber harassment and false publication, sets up a National Computer and Cybercrimes Co-ordination Committee, and requires critical infrastructure owners to report threatening incidents. The 2025 amendment adds identity theft rules and lets the Committee order websites or apps that promote unlawful activity, child sexual content, terrorism or extremism to be blocked.In effect since May 30, 2018

In forceMalaysia

Malaysia Cyber Security ActMalaysia's first standalone cybersecurity law. It sets up the National Cyber Security Committee, gives powers to the Chief Executive of NACSA, and places duties on national critical information infrastructure (NCII) sector leads and entities. NCII entities must follow codes of practice, run a risk assessment at least once a year and an audit at least once every two years, and notify cybersecurity incidents within 6 hours. Cybersecurity service providers must be licensed.In effect since Aug 26, 2024

AmendedNew York

NYDFS Cybersecurity Regulation (Part 500)DFS-licensed financial companies must keep a risk-based cybersecurity program, CISO, policies, access controls, MFA, encryption, an asset inventory, and incident response and business continuity plans. They must notify DFS within 72 hours of a cybersecurity event and within 24 hours of any extortion payment, and certify compliance or acknowledge non-compliance each April 15. The 2023 Second Amendment added governance duties, Class A company requirements and phased controls through November 1, 2025.In effect since Mar 1, 2017

In forceOntario, Canada

Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025

AmendedPakistan

Pakistan PECAPakistan's main cybercrime law, covering unauthorised access, data interference, cyber stalking and related offences, plus investigation powers. The 2025 amendment creates a Social Media Protection and Regulatory Authority that enlists social media platforms, orders removal or blocking of unlawful content, and can block non-compliant platforms. It also adds a Social Media Protection Tribunal, a new National Cyber Crime Investigation Agency, and an offence of spreading false information.No date set

In forceUnited States (Federal)

SEC Cyber Disclosure RulesPublic companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of determining it is material (foreign private issuers use Form 6-K), and describe cybersecurity risk management, strategy and governance annually in Form 10-K (Item 106) or Form 20-F (Item 16K).In effect since Sep 5, 2023

AmendedUnited States (Federal)

SEC Regulation S-PRequires broker-dealers, investment companies, registered investment advisers and transfer agents to adopt a written incident response program and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Service providers must be overseen and must notify the covered institution within 72 hours of a breach; recordkeeping and annual privacy notice changes also apply.In effect since Aug 2, 2024

AmendedSingapore

Singapore Cybersecurity ActSingapore's framework for protecting critical information infrastructure (CII). CII owners must meet codes of practice, run audits and risk assessments, and report prescribed cybersecurity incidents to the Commissioner of Cybersecurity. Providers of licensable services (penetration testing and managed SOC) need a licence. The 2024 amendments extend oversight to foundational digital infrastructure providers, entities of special cybersecurity interest, systems of temporary cybersecurity concern, and CII located overseas, and add civil penalties.In effect since Aug 31, 2018

In forceSouth Africa

South Africa Cybercrimes ActCreates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.In effect since Dec 1, 2021

In forceThailand

Thailand Cybersecurity ActThailand's cybersecurity framework for government agencies and critical information infrastructure (CII) operators. It creates the National Cyber Security Committee and the National Cyber Security Agency (NCSA). It also sets codes of practice and standards, incident reporting and response duties, and escalating powers for serious and critical cyber threats. The Committee issues binding standards under the Act, such as the Website Security Standard B.E. 2568.In effect since May 28, 2019

ProposedUnited Kingdom

UK Cyber Security and Resilience BillUpdates the NIS Regulations 2018: brings managed service providers and data centres into scope, lets regulators designate critical suppliers, tightens incident reporting (initial notice within 24 hours, full report within 72 hours) and strengthens regulator powers. Substantive duties will follow via secondary legislation after Royal Assent.No date set

EnactedUnited Kingdom

UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set

In forceUnited Kingdom

UK PSTI Act (product security)Sets baseline security requirements for consumer connectable products sold in the UK. Manufacturers must ban universal default passwords, publish a way to report vulnerabilities, and state the minimum security update support period. Importers and distributors share compliance duties.In effect since Apr 29, 2024

In forceUnited Kingdom

UK Telecommunications Security ActImposes strengthened security duties on UK public telecoms providers, backed by detailed security measures regulations and a code of practice. It also gives the government powers to restrict the use of high-risk vendors' equipment through designated vendor directions.In effect since Oct 1, 2022

In forceVietnam

Vietnam Law on DataVietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.In effect since Jul 1, 2025

Upcoming deadlines

ComplianceNov 10 · in 14 days

CMMC 2.0Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).United States (Federal)

Transition endsDec 9 · in 43 days

Product Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European Union

ComplianceJan 1, 2027 · in 2 months

CCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).California

ComplianceJan 1, 2027 · in 2 months

CCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).California

ReportingFeb 5, 2027 · in 3 months

EU Cyber Solidarity ActFirst Commission evaluationCommission evaluates the Regulation and reports to Parliament and Council, then every 4 years (Article 25).European Union

ComplianceTentativeApr 1, 2027 · in 5 months

CFPB Open Banking Rule (Section 1033)Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.United States

ReportingApr 17, 2027 · in 6 months

NIS2Next biennial entity notificationCompetent authorities notify the Commission and Cooperation Group of the number of essential and important entities, repeated every two years after 17 Apr 2025 (Art 3(5)).European Union

Transition endsJul 1, 2027 · in 8 months

Vietnam Cybersecurity Law 2025Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.Vietnam

ReportingOct 17, 2027 · in 12 months

NIS2Commission review of NIS2Commission must review the functioning of NIS2 and report to Parliament and Council, then every 36 months (Art 40).European Union

ComplianceNov 10, 2027 · in 12 months

CMMC 2.0Phase 3: Level 3 certificationPhase 3 begins one year after Phase 2; Level 3 (DIBCAC) requirements added to applicable solicitations (32 CFR 170.3(e)(3)).United States (Federal)

Takes effectTentativeNov 22, 2027 · in 13 months

Japan Active Cyber Defense ActCommunications data measures in force (latest date)Chapters 3 to 7 on agreements with operators and collection of communications data take effect by Cabinet Order within 2 years and 6 months of promulgation. e-Gov lists 22 Nov 2027 as the outer limit, not a fixed date.Japan

ComplianceDec 11, 2027 · in 13 months

Cyber Resilience ActCRA fully appliesAll remaining obligations, including essential cybersecurity requirements, conformity assessment and CE marking, apply (Art 71(2)). Products placed on the market earlier are covered only if substantially modified (Art 69(2)).European Union

ComplianceDec 31, 2027 · in 14 months

CCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).California

ReportingApr 1, 2028 · in 17 months

CCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.California

ReportingApr 1, 2028 · in 17 months

CCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).California

ComplianceTentativeApr 1, 2028 · in 17 months

CFPB Open Banking Rule (Section 1033)Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.United States

SunsetJun 11, 2028 · in 20 months

Cyber Resilience ActLegacy type-examination certificates expireEU type-examination certificates and approval decisions on cybersecurity requirements under other harmonisation legislation remain valid until this date unless they expire earlier (Art 69(1)).European Union

ReportingSep 11, 2028 · in 23 months

Cyber Resilience ActReport on single reporting platformCommission report assessing the single reporting platform's effectiveness (Art 70(2)).European Union

ComplianceNov 10, 2028 · in 2 years

CMMC 2.0Phase 4: full implementationCMMC requirements included in all applicable DoD solicitations and contracts, including option periods (32 CFR 170.3(e)(4)).United States (Federal)

ReportingApr 1, 2029 · in 2.4 years

CCPA / CPRACybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).California

ComplianceTentativeApr 1, 2029 · in 2.4 years

CFPB Open Banking Rule (Section 1033)Tier 4 compliance date (original)Banks with $1.5B to $3B in assets. Original date; subject to stay, extension and injunction.United States

ReportingApr 1, 2030 · in 3.4 years

CCPA / CPRACybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.California

ComplianceTentativeApr 1, 2030 · in 3.4 years

CFPB Open Banking Rule (Section 1033)Tier 5 compliance date (original)Banks with $850M to $1.5B in assets. Original date; subject to stay, extension and injunction.United States

ReportingDec 11, 2030 · in 4.1 years

Cyber Resilience ActFirst CRA evaluationCommission evaluation and review report, then every four years (Art 70(1)).European Union

Past deadlines

MilestoneTentativeOct 26 · yesterday

UK Cyber Security and Resilience BillLords report stage scheduledHouse of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).United Kingdom

ComplianceOct 1 · 26 days ago

Japan Active Cyber Defense ActRegistration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified intrusion incidents.Japan

ComplianceSep 16 · 41 days ago

Thailand Cybersecurity ActWebsite Security Standard B.E. 2568 enforcedThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.Thailand

ReportingSep 11 · 46 days ago

Cyber Resilience ActVulnerability and incident reporting obligations applyArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).European Union

Takes effectAug 20 · 2 months ago

China Data Security Risk Assessment MeasuresRisk assessment measures take effectAnnual risk assessment and reporting duties for important data handlers apply.China

Takes effectJul 1 · 4 months ago

Vietnam Cybersecurity Law 2025Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam

MilestoneTentativeJun 30 · 4 months ago

CFPB Open Banking Rule (Section 1033)First compliance date (stayed, enjoined)Largest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally 2026-04-01, moved 90 days by court stay. Not enforceable while the injunction stands.United States

MilestoneJun 16 · 4 months ago

UK Cyber Security and Resilience BillPasses House of CommonsReport stage and third reading completed in the Commons after carry-over into the new session.United Kingdom

MilestoneJun 15 · 4 months ago

Canada Bill C-8 / CCSPARoyal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.Canada

Takes effectJun 11 · 5 months ago

Cyber Resilience ActConformity assessment body provisions applyChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).European Union

ComplianceJun 3 · 5 months ago

SEC Regulation S-PSmaller entities must complySmaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.United States (Federal)

ReportingApr 15 · 6 months ago

NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.New York

Takes effectApr 1 · 7 months ago

Japan Active Cyber Defense ActSupervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.Japan

ComplianceMar 4 · 8 months ago

Australia Cyber Security Act (ransomware reporting)Smart device security standard appliesPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable products must meet the security standard.Australia

ComplianceFeb 16 · 8 months ago

HIPAANotice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.United States (Federal)

MilestoneJan 20 · 9 months ago

EU Cybersecurity ActCybersecurity Act 2 proposedCommission proposal COM(2026) 11 to repeal and replace the Act, adding ICT supply chain security rules. Now in the ordinary legislative procedure (2026/0011(COD)).European Union

Takes effectJan 1 · 10 months ago

Hong Kong Critical Infrastructure Cyber OrdinancePCICSO comes into operationCommissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.Hong Kong

Takes effectJan 1 · 10 months ago

China Cybersecurity Law2025 amendments take effectHigher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.China

Takes effectJan 1 · 10 months ago

CCPA / CPRANew CCPA regulations take effectADMT, risk assessment, cybersecurity audit and updated CCPA regulations become effective; risk assessments required for new high-risk processing.California

EnforcementJan 1 · 10 months ago

Australia Cyber Security Act (ransomware reporting)Ransomware reporting moves to compliance phaseThe education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.Australia

ComplianceDec 3, 2025 · 11 months ago

SEC Regulation S-PLarger entities must complyLarger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.United States (Federal)

EnforcementNov 18, 2025 · 11 months ago

DORAFirst critical ICT third-party providers designatedThe ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.European Union

MilestoneNov 12, 2025 · 11 months ago

UK Cyber Security and Resilience BillIntroduced (Commons first reading)Bill introduced in the House of Commons.United Kingdom

Takes effectNov 10, 2025 · 12 months ago

CMMC 2.0DFARS rule effective; Phase 1 beginsCMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).United States (Federal)

Takes effectNov 4, 2025 · 12 months ago

Kenya Computer Misuse and Cybercrimes Act2025 amendments commenceComputer Misuse and Cybercrimes (Amendment) Act No. 17 of 2025: assented 15 October 2025, published 21 October 2025, commenced 4 November 2025.Kenya

ComplianceNov 1, 2025 · 12 months ago

NYDFS Cybersecurity Regulation (Part 500)Universal MFA and asset inventory500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.New York

Takes effectNov 1, 2025 · 12 months ago

China Cyber Incident Reporting MeasuresIncident reporting measures take effect1, 2 and 4 hour reporting windows apply to relatively major and higher incidents.China

Takes effectOct 31, 2025 · 12 months ago

Singapore Cybersecurity Act2024 amendments commenceMost of the Cybersecurity (Amendment) Act 2024 takes effect, covering foundational digital infrastructure, entities of special cybersecurity interest and systems of temporary cybersecurity concern.Singapore

EnforcementOct 29, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Court enjoins enforcementE.D. Ky. enjoins the CFPB from enforcing the rule until it completes its reconsideration.United States

ReportingOct 21, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration comment period closesComments on the ANPR due.United States

ComplianceOct 6, 2025 · 13 months ago

DOJ Bulk Data RuleDue diligence, audit and reporting obligations applySubpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.United States (Federal)

Transition endsSep 22, 2025 · 13 months ago

CCPA / CPRAADMT, risk assessment and cybersecurity audit regulations approvedOAL approves the CCPA Updates, Cybersecurity Audit, Risk Assessment, ADMT and Insurance regulations and files them with the Secretary of State.California

MilestoneAug 22, 2025 · 14 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration ANPR publishedCFPB seeks comment on representatives, fees, data security and privacy, and on extending compliance dates.United States

Transition endsJul 29, 2025 · 15 months ago

CFPB Open Banking Rule (Section 1033)Court stays Forcht Bank litigationE.D. Ky. stays the industry challenge after the CFPB says it will reconsider the rule; compliance dates stayed by 90 days.United States

Takes effectJul 8, 2025 · 16 months ago

DORATLPT regulatory technical standards enter into forceCommission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.European Union

Takes effectJul 1, 2025 · 16 months ago

Vietnam Law on DataLaw on Data takes effectThe Law on Data enters into force.Vietnam

ComplianceJul 1, 2025 · 16 months ago

Ontario Bill 194FIPPA privacy amendments in forceRemaining FIPPA amendments, including privacy impact assessments, safeguards and breach notification to the IPC, come into force.Ontario, Canada

MilestoneJun 18, 2025 · 16 months ago

Canada Bill C-8 / CCSPABill C-8 introducedFirst reading in the House of Commons.Canada

Takes effectMay 30, 2025 · 17 months ago

Australia Cyber Security Act (ransomware reporting)Ransomware payment reporting startsReporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.Australia

MilestoneMay 23, 2025 · 17 months ago

Japan Active Cyber Defense ActAct promulgatedAct No. 42 of 2025 promulgated; preparatory supplementary provisions apply from this day.Japan