Regulationsby GlyphData access and data sharing rules
Regulations worldwide that deal with data access and sharing, with every phased deadline and the official source for each.
Regulations
Add to calendar
eIDAS 2 / EU Digital Identity WalletRequires every Member State to offer at least one European Digital Identity Wallet so people can identify themselves and share verified attributes with selective disclosure. It adds new qualified trust services such as electronic attestations of attributes and electronic ledgers. Private relying parties that must use strong authentication, and very large online platforms, have to accept the wallet when the user asks.Next: Dec 24 Member States must provide EU Digital Identity Wallets · in 58 daysEU Data ActGives users of connected products and related services the right to access and share the data those products generate, and sets rules for business-to-business data sharing. It bans unfair data-sharing contract terms imposed on businesses and lets public bodies obtain data in cases of exceptional need. Cloud and other data processing service providers must make switching easy, and switching charges are phased out.Next: Jan 12, 2027 Cloud switching charges abolished · in 3 months
California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 monthsEuropean Health Data Space (EHDS)Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.Next: Mar 26, 2027 EHDS general application date · in 5 months
CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 monthsGDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 monthsChina Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setEU e-Evidence PackageLets judicial authorities in one Member State order service providers in another to produce or preserve electronic evidence, such as subscriber, traffic and content data, directly and within tight deadlines. Non-EU providers offering services in the EU must appoint a designated establishment or legal representative to receive orders.In effect since Aug 18, 2026EU Financial Data Access (FIDA) proposalWould create a right for customers to have their financial data beyond payment accounts, such as savings, investments, insurance and credit data, shared with authorised third parties. Data holders would join financial data sharing schemes and customers would manage permissions through dashboards.No date setInteroperable Europe ActCreates a cooperation framework for cross-border interoperability of public sector digital services and data exchange. Public bodies must carry out interoperability assessments before changing binding requirements for trans-European digital public services, and an Interoperable Europe Board steers common solutions.In effect since Jul 12, 2024UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set
Vietnam Law on DataVietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.In effect since Jul 1, 2025
Upcoming deadlines
eIDAS 2 / EU Digital Identity WalletMember States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).European UnionEU Data ActCloud switching charges abolishedProviders of data processing services may no longer impose any switching charges on customers (Art 29(1)).European UnionCalifornia Delete Act / DROPAnnual data broker registration deadlineData brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.CaliforniaEuropean Health Data Space (EHDS)EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).European UnionCFPB Open Banking Rule (Section 1033)Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.United StatesGDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European UnionEU Data ActUnfair-terms rules extend to older long-term contractsChapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).European UnioneIDAS 2 / EU Digital Identity WalletPrivate relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).European UnionCalifornia Delete Act / DROPIndependent third-party audits beginBeginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.CaliforniaCFPB Open Banking Rule (Section 1033)Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.United StatesEU Data ActCommission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).European UnionEuropean Health Data Space (EHDS)Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.European UnionCFPB Open Banking Rule (Section 1033)Tier 4 compliance date (original)Banks with $1.5B to $3B in assets. Original date; subject to stay, extension and injunction.United StatesCFPB Open Banking Rule (Section 1033)Tier 5 compliance date (original)Banks with $850M to $1.5B in assets. Original date; subject to stay, extension and injunction.United StatesEuropean Health Data Space (EHDS)Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.European UnionEuropean Health Data Space (EHDS)Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.European Union