Skip to content
Regulations.

Data privacy laws

130 regulations worldwide that deal with privacy, with every phased deadline and the official source for each.

130 regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

130 of 130 regulations

Upcoming deadlines

DateRegulation
in 4 daysUK DUAA

ICO abolished; Information Commission takes over

in 5 daysCTDPA

PA 26-64 (SB 4) amendments take effect

in 5 weeksEgypt PDPL

One-year compliance window endstentative

in 6 weeksIndia DPDP

Consent Manager registration rule in force (12 months)

in 7 weeksCCD2

National rules apply

in 2 monthsPeru PDPL and 2024 Regulation

DPO required: medium companies

in 2 monthsChile PDPL

Law in force

in 2 monthsEU Platform Work Directive

Transposition deadline

in 2 monthsAU Privacy Act

Children's Online Privacy Code must be registered

in 2 monthsAU Privacy Act

Automated decision-making transparency applies

in 2 monthseIDAS 2

Member States must provide EU Digital Identity Wallets

in 3 monthsUtah App Store Accountability Act

Private right of action begins

in 3 monthsCalifornia Digital Age Assurance Act

Age signal duties begin

in 3 monthsCCPA / CPRA

ADMT requirements compliance date

in 3 monthsCCPA / CPRA

Browsers must support opt-out preference signal (AB 566)

in 3 monthsColorado AI Act

ADMT obligations apply

in 3 monthsColorado AI Act

AG rules due

in 3 monthsCTDPA

Data broker registration required

in 3 monthsDelaware DPDPA

Amended thresholds and third-party duties take effect

in 3 monthsLouisiana LDPA

Louisiana Data Privacy Act takes effect

in 3 monthsNH Privacy Act

Ban on selling personal data of children under 13 (HB 1460)

in 3 monthsOKCDPA

Oklahoma Consumer Data Privacy Act takes effect

in 3 monthsUAE Child Digital Safety Law

Compliance deadline under the Decree by Law

in 3 monthsUtah UCPA

UCPA extends to motor vehicle manufacturers

in 3 monthsVermont Kids Code

Takes effect

in 3 monthsEU Data Act

Cloud switching charges abolished

in 3 monthsIndonesia PDP

Implementing regulation GR 33/2026 takes effect

in 4 monthsCA Delete Act

Annual data broker registration deadline

in 4 monthsEU DSA

DSA SME impact report

in 6 monthsEU EHDS

EHDS general application date

in 6 monthsSection 1033

Tier 2 compliance date (original)tentative

in 6 monthsMaryland MODPA

Discretionary 60-day cure period ends

in 6 monthsGDPR

GDPR Procedural Regulation applies

in 7 monthsAlabama APDPA

APDPA takes effect

in 7 monthsIndia DPDP

Main data fiduciary obligations apply (18 months)

in 9 monthsUAE Child Digital Safety Law

Social media platforms' transition ends

in 9 monthsCalifornia Digital Age Assurance Act

Deadline for existing devices and apps

in 9 monthsKorea PIPA

Mandatory ISMS-P certification

in 10 monthsLouisiana LDPA

30-day cure period expires

in 11 monthsEU Data Act

Unfair-terms rules extend to older long-term contracts

in 1 yearPeru PDPL and 2024 Regulation

DPO required: small companies

in 1 yearChile PDPL

Proposed postponement of entry into forcetentative

in 1 yeareIDAS 2

Private relying parties must accept wallets

in 1 yearCCPA / CPRA

Risk assessments for pre-existing processing due

in 1 yearCA Delete Act

Independent third-party audits begin

in 1 yearVermont VDPOSA

Vermont Data Privacy and Online Surveillance Act takes effect

in 1 yearEU CSAM Interim Regulation

Commission implementation report

in 1 yearCCPA / CPRA

First risk assessment submission to CPPA

in 1 yearCCPA / CPRA

Cybersecurity audit due: revenue over $100M

in 1 yearSection 1033

Tier 3 compliance date (original)tentative

in 1 yearEU CSAM Interim Regulation

Interim derogation expires

in 1 yearEU Data Act

Commission evaluation

in 2 yearsCTDPA

Data brokers must process state deletion mechanism requests

in 2 yearsPeru PDPL and 2024 Regulation

DPO required: micro companies

in 2 yearsEU EHDS

Primary use for first data categories; secondary use framework applies

in 2 yearsCCPA / CPRA

Cybersecurity audit due: revenue $50M-$100M

in 2 yearsSection 1033

Tier 4 compliance date (original)tentative

in 2 yearsVermont VDPOSA

Mandatory 60-day cure period expires

in 2 yearsMinnesota MCDPA

Postsecondary institutions must comply

in 3 yearsColorado AI Act

Mandatory cure period ends

in 3 yearsCCPA / CPRA

Cybersecurity audit due: revenue under $50M

in 3 yearsSection 1033

Tier 5 compliance date (original)tentative

in 4 yearsEU EHDS

Primary use for second data categories; EHR systems in service; extra secondary-use categories

in 8 yearsEU EHDS

Third-country participation in secondary use

Past deadlines

DateRegulation
2 weeks agoEU Data Act

Access-by-design for new connected products

2 weeks agoKorea PIPA

2026 PIPA amendments take effect

3 weeks agoChina Small PI Handler Simplified Measures

Simplified measures for small handlers take effect

3 weeks agoEU DSA

ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs

5 weeks agoChina Data Security Risk Assessment Measures

Risk assessment measures take effect

5 weeks agoEU e-Evidence Package

e-Evidence Regulation applies

7 weeks agoNew Zealand Biometric Processing Privacy Code

Grace period ends for existing biometric processing

8 weeks agoCTDPA

Profiling impact assessments apply

8 weeks agoCA Delete Act

Data brokers must begin processing DROP deletion requests

8 weeks agoEU CSAM Interim Regulation

New interim regulation enters into force

2 months agoJapan APPI

2026 APPI amendment act promulgated

2 months agoChina Anthropomorphic AI Measures

Anthropomorphic AI measures take effect

2 months agoVirginia VCDPA

Ban on selling precise geolocation data (SB 338)

2 months agoUtah UCPA

Right to correct takes effect

2 months agoNJDPA

Mandatory 30-day cure period expires

2 months agoNebraska Kids Code

Civil penalties available

2 months agoLouisiana app store age verification law

Takes effect

2 months agoCTDPA

PA 25-113 (SB 1295) amendments take effect

2 months agoArkansas COPPA 2.0

Takes effect

2 months agoUAE Child Digital Safety Law

Social media minimum age resolution takes effect

2 months agoNJDPA

A5328 sensitive data sale ban takes effect

2 months agoColorado AI Act

Delayed effective date (superseded)

2 months agoSection 1033

First compliance date (stayed, enjoined)tentative

2 months agoSingapore Online Safety (Relief and Accountability) Act

OSC begins operations and first provisions commence

3 months agoUK DUAA

Mandatory data protection complaints procedure

3 months agoCanada C-36

Bill C-36 tabled (first reading)

3 months agoAlberta POPA

Privacy management programs required

3 months agoSEC Reg S-P

Smaller entities must comply

4 months agoeIDAS 2

Legacy qualified trust service providers conformity report

4 months agoTAKE IT DOWN Act

Platform notice-and-removal process required

4 months agoColorado AI Act

SB 26-189 signed (repeal and reenact)

4 months agoUtah App Store Accountability Act

App store and developer duties apply

4 months agoTexas App Store Accountability Act

Stay pending appeal denied

4 months agoEU DMA

DMA first review

4 months agoNZ Privacy Act

IPP 3A indirect-collection notification applies

4 months agoNew Zealand Biometric Processing Privacy Code

Amendment No. 1 applies (IPP 3A)

5 months agoCOPPA Rule

Full compliance with amended COPPA Rule

5 months agoEU CSAM Interim Regulation

Previous interim regulation expires

5 months agoMaryland MODPA

MODPA applies to personal data processing

5 months agoMaryland Kids Code

Data protection impact assessments due

Rule changes by email

The morning after a new data, privacy or AI law, or a deadline change; nothing in quiet weeks.

Double opt-in. Unsubscribe any time.