Regulationsby GlyphData privacy laws
Regulations worldwide that deal with privacy, with every phased deadline and the official source for each.
Regulations
Add to calendar
Egypt PDPLEgypt's data protection law covers personal data processed electronically. It sets consent and lawful processing rules, strict rules for sensitive data and cross-border transfers, and a licensing and permit system run by the Personal Data Protection Center. The Executive Regulations were only issued in November 2025, which starts a one-year window to comply.Next: Nov 2 One-year compliance window ends · in 6 days
India DPDP ActIndia's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.Next: Nov 13 Consent Manager registration rule in force (12 months) · in 17 daysEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 daysPeru PDPL and 2024 RegulationPeru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.Next: Nov 30 DPO required: medium companies · in 34 daysChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysEU Platform Work DirectiveFirst EU law on algorithmic management at work. Digital labour platforms may not use automated systems to process emotional, psychological or certain other personal data of platform workers, must be transparent about automated monitoring and decision systems, and must ensure human oversight and human review of significant decisions. It also creates a rebuttable presumption of employment.Next: Dec 2 Transposition deadline · in 36 days
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 dayseIDAS 2 / EU Digital Identity WalletRequires every Member State to offer at least one European Digital Identity Wallet so people can identify themselves and share verified attributes with selective disclosure. It adds new qualified trust services such as electronic attestations of attributes and electronic ledgers. Private relying parties that must use strong authentication, and very large online platforms, have to accept the wallet when the user asks.Next: Dec 24 Member States must provide EU Digital Identity Wallets · in 58 days
Utah App Store Accountability ActApp stores must verify each user's age category, obtain parental consent for minor accounts and share age and consent status with developers. Developers must check age and consent through the app store and cannot enforce contracts against minors without consent. Parents of harmed minors can sue.Next: Dec 31 Private right of action begins · in 2 months
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 monthsCCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
Delaware Personal Data Privacy Act (DPDPA)Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.Next: Jan 1, 2027 Amended thresholds and third-party duties take effect · in 2 monthsLouisiana Data Privacy ActLouisiana's comprehensive privacy law, signed May 29, 2026, gives consumers access, deletion, correction, portability and opt-out rights and requires conspicuous notice when sensitive or biometric data is sold. It uses CCPA-style applicability thresholds, including a $25M revenue trigger.Next: Jan 1, 2027 Louisiana Data Privacy Act takes effect · in 2 monthsNew Hampshire Privacy ActComprehensive consumer privacy law giving New Hampshire residents access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, universal opt-out signal support and data protection assessments. A 2026 amendment (HB 1460) bans selling the personal data of children under 13 starting in 2027.Next: Jan 1, 2027 Ban on selling personal data of children under 13 (HB 1460) · in 2 monthsOklahoma OKCDPANew Virginia-style comprehensive privacy law: consumers get access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, privacy notices and data protection assessments. It treats pseudonymous data as personal data and lets controllers authenticate opt-out requests.Next: Jan 1, 2027 Oklahoma Consumer Data Privacy Act takes effect · in 2 months
UAE Child Digital Safety LawSets child safety duties for internet service providers and digital platforms that operate in or target the UAE, from social media and games to e-commerce. Platforms may not process personal data of children under 13 without verifiable parental consent and must use age verification and risk-based controls. A 2026 Cabinet Resolution bars social media accounts for children under 15 and restricts accounts for 15 year olds.Next: Jan 1, 2027 Compliance deadline under the Decree by Law · in 2 monthsUtah UCPABusiness-friendly comprehensive privacy law with access, deletion, portability and opt-out rights (targeted advertising, sale); sensitive data needs notice and a chance to opt out rather than opt-in consent, and data protection assessments are not required. A right to correct was added from July 1, 2026, and from Jan 1, 2027 the law covers motor vehicle manufacturers regardless of thresholds.Next: Jan 1, 2027 UCPA extends to motor vehicle manufacturers · in 2 months
Vermont Kids CodeCovered online businesses owe minors a minimum duty of care, must set high-privacy defaults and offer tools, and must avoid prohibited data and design practices. Age assurance data has privacy limits.Next: Jan 1, 2027 Takes effect · in 2 monthsEU Data ActGives users of connected products and related services the right to access and share the data those products generate, and sets rules for business-to-business data sharing. It bans unfair data-sharing contract terms imposed on businesses and lets public bodies obtain data in cases of exceptional need. Cloud and other data processing service providers must make switching easy, and switching charges are phased out.Next: Jan 12, 2027 Cloud switching charges abolished · in 3 months
Indonesia PDP LawIndonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.Next: Jan 16, 2027 Implementing regulation GR 33/2026 takes effect · in 3 monthsCalifornia Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 monthsDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEuropean Health Data Space (EHDS)Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.Next: Mar 26, 2027 EHDS general application date · in 5 months
CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months
Maryland Online Data Privacy Act (MODPA)The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.Next: Apr 1, 2027 Discretionary 60-day cure period ends · in 5 monthsGDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 months
Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months
South Korea PIPAKorea's comprehensive privacy law, with consent-centric processing, breach notification, cross-border transfer rules, automated decision rights (since 2024), and revenue-based penalty surcharges. The 2026 amendment, effective 11 September 2026, raises the maximum fine to 10% of total revenue for aggravated cases, makes the CEO the ultimate responsible person, requires notice when a breach is merely possible, and makes ISMS-P certification mandatory for certain entities from 1 July 2027.Next: Jul 1, 2027 Mandatory ISMS-P certification · in 8 monthsVermont VDPOSANew comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.Next: Jan 1, 2028 Vermont Data Privacy and Online Surveillance Act takes effect · in 14 monthsEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsMinnesota Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with distinctive rights to question the result of profiling decisions and to obtain a list of specific third parties that received the consumer's data. Requires data inventories, documented privacy policies and procedures, and data protection assessments.Next: Jul 31, 2029 Postsecondary institutions must comply · in 2.8 yearsAlberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date setArkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026Bahrain PDPLBahrain's general data protection law. It sets lawful bases for processing, stricter rules for sensitive data, individual rights, transfer limits and registration duties, and creates the Personal Data Protection Authority. It carries both administrative and criminal penalties.In effect since Aug 1, 2019
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026California social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setChina Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026China Facial Recognition MeasuresSets rules for using facial recognition to process face data in China. Handlers need a specific purpose and necessity, separate consent (guardian consent under 14), a prior impact assessment, local storage on the device unless consent or law allows otherwise, and a non-face alternative. Handlers storing face data of 100,000 people or more must file with the provincial CAC within 30 working days.In effect since Jun 1, 2025China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024China Network Data Security RegulationsImplementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.In effect since Jan 1, 2025China PI Compliance Audit MeasuresImplements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.In effect since May 1, 2025China PI Export Certification MeasuresSets the third route for exporting personal information from China: certification by an accredited certification body. Available to non-CII handlers exporting personal information of 100,000 to under 1 million people (non-sensitive) or under 10,000 people's sensitive data in a year. Certificates last three years; overseas handlers apply through a local entity or representative.In effect since Jan 1, 2026China PI Export Standard Contract MeasuresLets personal information handlers export personal information by signing China's standard contract with the overseas recipient instead of a security assessment, if volume limits are met. Handlers must do a personal information protection impact assessment and file the signed contract with the provincial CAC. Transfers already under way had six months to comply.In effect since Jun 1, 2023China PIPLChina's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.In effect since Nov 1, 2021China Small PI Handler Simplified MeasuresEases PIPL compliance for handlers processing personal information of fewer than 100,000 people. They can use short notices, rely on platform privacy rules, run simplified compliance audits at least every five years using a self-check form, and use simplified impact assessments. It also exempts common cross-border transfers from the assessment, contract and certification routes and limits penalties for minor first violations.In effect since Sep 1, 2026Colorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025ePrivacy Directive (cookie law)Requires prior consent to store or access information on a user's device (cookies, SDKs, fingerprinting), except where strictly necessary. Also covers confidentiality of communications, traffic and location data, and unsolicited direct marketing (opt-in for email/SMS to individuals). Telecom providers must notify personal data breaches. Enforced through national laws.In effect since Jul 31, 2002EU e-Evidence PackageLets judicial authorities in one Member State order service providers in another to produce or preserve electronic evidence, such as subscriber, traffic and content data, directly and within tight deadlines. Non-EU providers offering services in the EU must appoint a designated establishment or legal representative to receive orders.In effect since Aug 18, 2026EU Financial Data Access (FIDA) proposalWould create a right for customers to have their financial data beyond payment accounts, such as savings, investments, insurance and credit data, shared with authorised third parties. Data holders would join financial data sharing schemes and customers would manage permissions through dashboards.No date setEU KIDS ActA legislative initiative designed to restrict social media platforms' access to children within the European Union.No date setEU Political Advertising Regulation (TTPA)Sets EU-wide transparency rules for paid political advertising, including labels, transparency notices and a public ad repository. Online targeting and ad delivery using personal data is only allowed with explicit consent, on data collected from the person, and never using special category data or profiling.In effect since Oct 10, 2025EU-US Data Privacy FrameworkGDPR Art 45 adequacy decision letting personal data flow from the EEA to US organisations self-certified under the Data Privacy Framework with the US Department of Commerce, with no further transfer mechanism needed. It relies on US Executive Order 14086 safeguards and the Data Protection Review Court for redress. The EU General Court upheld it in Latombe v Commission (T-553/23) on 3 Sep 2025, and an appeal is pending before the Court of Justice.In effect since Jul 10, 2023FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024
Florida Digital Bill of RightsPrivacy law aimed at very large tech companies: access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data, voice/face recognition limits, data retention schedules and protections for known children. Separately, any for-profit business that sells sensitive data must post a notice, and the sale-of-sensitive-data consent rule applies beyond the big-tech controllers.In effect since Jul 1, 2024FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009GLBA Safeguards RuleRequires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, access controls, encryption, MFA, monitoring and board reporting. Since May 13, 2024, institutions must notify the FTC within 30 days of discovering a 'notification event' (unauthorized acquisition of unencrypted customer information) affecting at least 500 consumers.In effect since May 23, 2003HIPAASets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.In effect since Apr 14, 2003HIPAA Security Rule update (NPRM)Proposed overhaul of the HIPAA Security Rule. It would remove the addressable versus required distinction, and require a technology asset inventory and network map, encryption, multi-factor authentication, vulnerability scanning, penetration testing and 72-hour restoration planning. No final rule has been issued.No date set
Hong Kong PDPOHong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.In effect since Dec 20, 1996
Illinois BIPAPrivate entities must publish a biometric retention and destruction policy, give written notice, and obtain a written release before collecting biometric identifiers such as fingerprints, face geometry or voiceprints. They may not sell or profit from biometric data and need consent to disclose it. The 2024 SB 2979 amendment treats repeated collection or disclosure from the same person by the same method as a single violation and allows electronic signatures for consent. The Seventh Circuit held on April 1, 2026 that the amendment applies retroactively to pending cases.In effect since Oct 3, 2008Indiana Consumer Data Protection Act (ICDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires consent for sensitive data processing and data protection impact assessments for high-risk processing.In effect since Jan 1, 2026Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025
Iowa Consumer Data Protection Act (ICDPA)Business-friendly comprehensive privacy law giving rights to confirm, access, delete, obtain a copy of, and opt out of sale and targeted advertising (no correction right, no profiling opt-out). Sensitive data requires notice and an opt-out opportunity rather than opt-in consent.In effect since Jan 1, 2025
Israel Privacy Protection Law Amendment 13Major overhaul of Israel's privacy law: broadens definitions (personal and highly sensitive information), narrows database registration, requires privacy protection officers for certain entities, and gives the Privacy Protection Authority powers to impose large administrative fines and orders, plus statutory damages.In effect since Aug 14, 2025
Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005Kazakhstan AI LawKazakhstan's first AI statute. Owners sort their AI systems into minimal, medium or high risk and must run yearly risk management, keep documentation and inform users when AI is used. Some AI functions are banned outright, including manipulation, exploiting vulnerable people, social scoring, biometric categorisation for discrimination and emotion recognition without consent. AI-generated synthetic content must carry machine-readable marking and a visible warning.In effect since Jan 18, 2026
Kentucky Consumer Data Protection Act (KCDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires opt-in consent for sensitive data and data protection assessments for high-risk processing.In effect since Jan 1, 2026
Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019Louisiana app store age verification lawApp stores must use age verification methods, affiliate minor accounts with a parent account and give parents consent disclosures before minors use apps. Developers have matching duties to use age and consent data and protect it.In effect since Jul 1, 2026
Malaysia PDPAMalaysia's commercial-sector data protection law. The 2024 amendments, phased in during 2025, rename 'data users' as 'data controllers', add biometric data to sensitive data, apply the Security Principle directly to processors, replace the transfer whitelist with adequacy and safeguards tests, raise fines, and add mandatory DPOs, data breach notification and data portability.In effect since Nov 15, 2013Maryland Kids CodeOnline products reasonably likely to be accessed by children must be designed in the best interests of children, use high-privacy defaults and avoid certain data collection and profiling. Covered entities must complete data protection impact assessments.In effect since Oct 1, 2024Mexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025
Montana Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.In effect since Oct 1, 2024
Nebraska Kids CodeCovered online services must use reasonable care to avoid harms to minors from design features, provide default privacy and safety tools, and designate a compliance officer.In effect since Jan 1, 2026Nebraska NDPAComprehensive consumer privacy law modeled on the Texas TDPSA: consumers get access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling). Controllers must post privacy notices, obtain opt-in consent for sensitive data, honor universal opt-out signals and run data protection assessments.In effect since Jan 1, 2025Nevada consumer health data lawWashington-style consumer health data law. Regulated entities need consent to collect and share consumer health data, must publish a health data privacy policy, honor access and deletion rights, and cannot geofence health care facilities. Selling consumer health data needs written authorization.In effect since Mar 31, 2024
New Jersey NJDPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, consent for targeted advertising/sale/profiling of known 13-17 year olds, universal opt-out signal support and data protection assessments. It has no revenue-share floor for the smaller threshold, and the Division of Consumer Affairs has rulemaking authority. A June 2026 law (A5328) bans selling sensitive data and creates a data broker registry.In effect since Jan 15, 2025
New Zealand Biometric Processing Privacy CodeA binding code of practice under the Privacy Act 2020. It sets the privacy rules for organisations that collect and use biometric information, such as face, fingerprints, voice, keystroke patterns or gait, in automated biometric processing like facial recognition. Agencies already using biometrics had a nine-month grace period, which ended on 3 August 2026. Amendment No. 1 aligns the code with the new indirect collection principle (IPP 3A) from 1 May 2026.In effect since Nov 3, 2025New Zealand Privacy ActNew Zealand's privacy law, built on 13 Information Privacy Principles plus mandatory notification of serious privacy breaches. The Privacy Amendment Act 2025 adds IPP 3A from 1 May 2026: agencies that collect personal information indirectly (from third parties) must take reasonable steps to tell the individual about the collection, its purpose, recipients and their rights.In effect since Dec 1, 2020
Nigeria NDPANigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.In effect since Jun 12, 2023
NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025Ontario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025
Oregon OCPAComprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.In effect since Jul 1, 2024PADFAMakes it unlawful for a data broker to sell, license, transfer, disclose or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (China, Iran, North Korea, Russia) or to an entity controlled by one. Covered data is broad, including health, financial, biometric, genetic, precise geolocation, private communications and data about minors.In effect since Jun 23, 2024Philippines Data Privacy ActThe Philippines' general data privacy law. It sets consent and lawful processing rules, protects sensitive personal information, gives data subjects access, correction, erasure and portability rights, and creates the National Privacy Commission. Its 2016 Implementing Rules require breach notice to the NPC and affected people within 72 hours, plus registration of data processing systems.In effect since Sep 8, 2012PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001
Quebec Law 25Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.In effect since Sep 22, 2022
Rhode Island RIDTPPAComprehensive consumer privacy law giving access, correction, deletion, portability and opt-out rights, requiring opt-in consent for sensitive data and data protection assessments. A notable extra: any commercial website or ISP that sells personally identifiable information must disclose the categories collected and every third party it has sold or may sell data to, whatever its size.In effect since Jan 1, 2026Rwanda DPP LawRwanda's data protection law, modelled on the GDPR. Controllers and processors must register with the supervisory authority, report breaches within 72 hours, and store personal data in Rwanda unless they hold a certificate allowing storage abroad. Cross-border transfers need authorisation or another listed ground.In effect since Oct 15, 2021
Saudi PDPLSaudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.In effect since Sep 14, 2023SEC Regulation S-PRequires broker-dealers, investment companies, registered investment advisers and transfer agents to adopt a written incident response program and notify affected individuals as soon as practicable, and no later than 30 days, after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Service providers must be overseen and must notify the covered institution within 72 hours of a breach; recordkeeping and annual privacy notice changes also apply.In effect since Aug 2, 2024Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026Singapore PDPASingapore's baseline private-sector data protection law covering consent, purpose limitation, notification, access and correction, protection, retention, transfer limitation, and the Do Not Call registry. The 2020 amendments added mandatory breach notification, expanded deemed consent and legitimate-interests exceptions, and raised fines.In effect since Jul 2, 2014
South Africa POPIASouth Africa's comprehensive data protection law built on eight conditions for lawful processing, with Information Officer registration, security compromise notification to the Regulator and data subjects, and restrictions on direct marketing and cross-border transfers. Protects juristic persons as well as individuals.In effect since Jul 1, 2020
Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023Taiwan PDPATaiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.In effect since Oct 1, 2012TAKE IT DOWN ActCriminalizes knowingly publishing non-consensual intimate images, including AI-generated 'digital forgeries', and threats to do so. Covered platforms must set up a notice-and-removal process and remove reported content, plus known identical copies, within 48 hours of a valid request.In effect since May 19, 2025
Tennessee ELVIS ActReplaces the Personal Rights Protection Act of 1984 and adds voice to the protected property right in name, photograph and likeness. It targets unauthorized AI voice clones and deepfakes, including liability for distributing tools whose primary purpose is producing unauthorized voice or likeness.In effect since Jul 1, 2024Tennessee TIPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data and data protection assessments. Controllers must keep a written privacy program that reasonably conforms to the NIST Privacy Framework, which also serves as an affirmative defense.In effect since Jul 1, 2025
Texas App Store Accountability ActApp stores must verify user ages, link minor accounts to a parent and obtain parental consent before minors download or buy apps. Developers must use the app store's age and consent signals. A federal court has preliminarily enjoined enforcement.In effect since Jan 1, 2026Texas TDPSAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, data protection assessments and a universal opt-out signal requirement. Scope turns on the SBA small-business definition instead of consumer-count thresholds, so it reaches most non-small businesses.In effect since Jul 1, 2024Thailand PDPAThailand's GDPR-style data protection law: lawful bases including explicit consent for sensitive data, data subject rights, DPOs for large-scale or sensitive processing, breach notification to the PDPC within 72 hours, and cross-border transfer restrictions. Main obligations applied from 1 June 2022 after two postponements.In effect since Jun 1, 2022
Turkey KVKKTurkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).In effect since Apr 7, 2016UAE PDPLFederal GDPR-style data protection law for the onshore UAE covering consent and other bases, data subject rights, breach notification, DPOs and cross-border transfers. Key details (including fines and some thresholds) depend on Executive Regulations that have not been issued.In effect since Jan 2, 2022UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date setUruguay Law 18.331Uruguay's data protection law, which treats data protection as a human right and covers consent, purpose limits, security, sensitive data, data subject rights and international transfers. Law 19.670 of 2018 added accountability duties, regulated by Decree 64/020. Uruguay holds EU adequacy status.In effect since Aug 18, 2008
Vietnam PDPLVietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.In effect since Jan 1, 2026
Virginia VCDPAThe second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.In effect since Jan 1, 2023Washington My Health My Data ActRegulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.In effect since Mar 31, 2024
Upcoming deadlines
Egypt PDPLOne-year compliance window endsArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so this date is counted from publication and is an estimate.EgyptIndia DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.IndiaEU Consumer Credit Directive 2 (CCD2)National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European UnionPeru PDPL and 2024 RegulationDPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.PeruChile Personal Data Protection Law (Ley 21.719)Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.ChileEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European UnionAustralia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.AustraliaAustralia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).AustraliaeIDAS 2 / EU Digital Identity WalletMember States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).European UnionUtah App Store Accountability ActPrivate right of action beginsSection 13-75-401 takes effect.UtahCalifornia Digital Age Assurance ActAge signal duties beginOS providers must offer the age interface at account setup and developers must request signals.CaliforniaCCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).CaliforniaCCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).CaliforniaColorado AI ActADMT obligations applyDeveloper documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.ColoradoColorado AI ActAG rules dueAttorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.ColoradoConnecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).ConnecticutDelaware Personal Data Privacy Act (DPDPA)Amended thresholds and third-party duties take effectApplicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.DelawareLouisiana Data Privacy ActLouisiana Data Privacy Act takes effectConsumer rights and controller duties apply (Act 502, Section 2); data protection assessment requirements apply to processing from this date.LouisianaNew Hampshire Privacy ActBan on selling personal data of children under 13 (HB 1460)HB 1460 (2026, ch. 168) prohibits controllers from selling the personal data of a child under 13.New HampshireOklahoma OKCDPAOklahoma Consumer Data Privacy Act takes effectAll OKCDPA obligations and consumer rights apply.OklahomaUAE Child Digital Safety LawCompliance deadline under the Decree by LawArticle 18: those covered must comply within one year from entry into force. The Cabinet may extend this.United Arab EmiratesUtah UCPAUCPA extends to motor vehicle manufacturersMotor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect personal data through vehicle data systems are covered regardless of the revenue and consumer thresholds (13-61-102, as amended by Laws 2026, ch. 193).UtahVermont Kids CodeTakes effect9 V.S.A. sections 2449a to 2449j effective.VermontEU Data ActCloud switching charges abolishedProviders of data processing services may no longer impose any switching charges on customers (Art 29(1)).European UnionIndonesia PDP LawImplementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.IndonesiaCalifornia Delete Act / DROPAnnual data broker registration deadlineData brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.CaliforniaDigital Services ActDSA SME impact reportCommission report under Article 91 on effects on SMEs.European UnionEuropean Health Data Space (EHDS)EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).European UnionCFPB Open Banking Rule (Section 1033)Tier 2 compliance date (original)Banks with $10B to $250B in assets and smaller nondepositories. Original date in 12 CFR 1033.121; subject to the 90-day stay, planned extension and injunction.United StatesMaryland Online Data Privacy Act (MODPA)Discretionary 60-day cure period endsThe Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).MarylandGDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European UnionAlabama Personal Data Protection Act (APDPA)APDPA takes effectConsumer rights and controller/processor obligations apply (HB 351 section 12).AlabamaIndia DPDP ActMain data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.IndiaUAE Child Digital Safety LawSocial media platforms' transition endsArticle 8 of Cabinet Resolution No. 106 of 2026 gives platforms 12 months from entry into force to comply.United Arab EmiratesCalifornia Digital Age Assurance ActDeadline for existing devices and appsOS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.CaliforniaSouth Korea PIPAMandatory ISMS-P certificationISMS-P certification becomes mandatory for private entities meeting the statutory criteria.South KoreaLouisiana Data Privacy Act30-day cure period expiresAG's obligation to give 30-day notice and allow cure before investigating applies only from Jan 1 through July 31, 2027 (R.S. 51:1780.5(D)).LouisianaEU Data ActUnfair-terms rules extend to older long-term contractsChapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).European UnionPeru PDPL and 2024 RegulationDPO required: small companiesCompanies with annual sales above 150 UIT up to 1,700 UIT.PeruChile Personal Data Protection Law (Ley 21.719)Proposed postponement of entry into forceGovernment bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.ChileeIDAS 2 / EU Digital Identity WalletPrivate relying parties must accept walletsPrivate relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).European UnionCCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).CaliforniaCalifornia Delete Act / DROPIndependent third-party audits beginBeginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.CaliforniaVermont VDPOSAVermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).VermontEU CSAM Interim RegulationCommission implementation reportCommission report on implementation, including proportionality and error rates (Article 9).European UnionCCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.CaliforniaCCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).CaliforniaCFPB Open Banking Rule (Section 1033)Tier 3 compliance date (original)Banks with $3B to $10B in assets. Original date; subject to stay, extension and injunction.United StatesEU CSAM Interim RegulationInterim derogation expiresThe Regulation applies until this date.European UnionEU Data ActCommission evaluationCommission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).European UnionConnecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.ConnecticutPeru PDPL and 2024 RegulationDPO required: micro companiesMicro companies with annual sales up to 150 UIT.PeruEuropean Health Data Space (EHDS)Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.European UnionCCPA / CPRACybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).CaliforniaCFPB Open Banking Rule (Section 1033)Tier 4 compliance date (original)Banks with $1.5B to $3B in assets. Original date; subject to stay, extension and injunction.United StatesVermont VDPOSAMandatory 60-day cure period expiresThe AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).VermontMinnesota Consumer Data Privacy Act (MCDPA)Postsecondary institutions must complyPostsecondary institutions regulated by the Office of Higher Education must comply by July 31, 2029.MinnesotaColorado AI ActMandatory cure period endsThe AG's obligation to offer a 60-day notice-and-cure period expires.ColoradoCCPA / CPRACybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.CaliforniaCFPB Open Banking Rule (Section 1033)Tier 5 compliance date (original)Banks with $850M to $1.5B in assets. Original date; subject to stay, extension and injunction.United StatesEuropean Health Data Space (EHDS)Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.European UnionEuropean Health Data Space (EHDS)Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.European Union