2022 compliance deadlines

20212023

January 20223

Takes effectJan 2, 2022 · 4.8 years ago

UAE PDPLPDPL enters into forceDecree-law takes effect; compliance obligations tied to Executive Regulations.United Arab Emirates

Takes effectJan 10, 2022 · 4.8 years ago

GLBA Safeguards Rule2021 Safeguards Rule amendments effectiveThe amended Safeguards Rule published December 9, 2021 took effect, with the more detailed program elements in 314.5 deferred.United States (Federal)

Takes effectJan 23, 2022 · 4.8 years ago

Australia Online Safety ActOnline Safety Act commencesThe whole Act commences by Proclamation.Australia

March 20221

Takes effectMar 1, 2022 · 4.7 years ago

CNChina Algorithmic Recommendation ProvisionsAlgorithmic recommendation provisions take effectUser opt-out, transparency and algorithm filing duties apply.China

April 20222

Takes effectApr 1, 2022 · 4.6 years ago

Japan APPI2020 amendments in forceMandatory breach reporting, pseudonymized information and stricter cross-border rules apply.Japan

Takes effectApr 11, 2022 · 4.5 years ago

SGSingapore Cybersecurity ActCybersecurity service provider licensing commencesPart 5 and the Second Schedule take effect. Penetration testing and managed SOC providers need a licence.Singapore

June 20223

Takes effectJun 1, 2022 · 4.4 years ago

THThailand PDPAPDPA main obligations take effectCore data protection obligations and penalties apply after postponement Royal Decrees.Thailand

Takes effectJun 23, 2022 · 4.3 years ago

EUData Governance ActDGA enters into forceEntered into force on the twentieth day after publication in OJ L 152 of 3 June 2022 (Art 38).European Union

Takes effectTentativeJun 27, 2022 · 4.3 years ago

India CERT-In Cyber Security DirectionsCERT-In Directions take effectThe Directions apply 60 days after issue on 28 Apr 2022. The exact day (27 or 28 June 2022) depends on how the 60 days are counted.India

July 20221

ComplianceTentativeJul 8, 2022 · 4.3 years ago

Australia SOCI ActMandatory cyber incident reporting starts for most assetsThe Application Rules registered on 7 April 2022 gave most asset classes a 3-month grace period before Part 2B incident reporting applied. The date is worked out from that grace period.Australia

September 20223

Takes effectSep 1, 2022 · 4.2 years ago

CNChina Data Export Security Assessment MeasuresSecurity assessment measures take effectCovered data exports require a CAC security assessment.China

ComplianceSep 22, 2022 · 4.1 years ago

Quebec Law 25Phase 1: privacy officer and incident reportingPerson in charge of personal information protection, confidentiality incident notification and register apply.Quebec, Canada

ComplianceSep 25, 2022 · 4.1 years ago

India CERT-In Cyber Security DirectionsExtended date for MSMEs and subscriber validationThe Directions apply to micro, small and medium enterprises, and subscriber validation duties apply to data centres, VPS, cloud and VPN providers, from this date.India

October 20223

EnforcementOct 1, 2022 · 4.1 years ago

SGSingapore PDPAHigher financial penalty cap appliesMaximum penalty rises to 10% of Singapore turnover for organizations with turnover above SGD 10 million.Singapore

ComplianceOct 1, 2022 · 4.1 years ago

UK Telecommunications Security ActSecurity measures regulations in forceElectronic Communications (Security Measures) Regulations 2022 come into force.United Kingdom

Takes effectOct 17, 2022 · 4 years ago

Indonesia PDP LawPDP Law enacted and in forceLaw takes effect on enactment, starting a 2-year transition.Indonesia

November 20222

Takes effectNov 1, 2022 · 4 years ago

EUDigital Markets ActDMA enters into forceEntered into force twenty days after publication; certain procedural articles apply from this date (Art 54).European Union

Takes effectNov 16, 2022 · 3.9 years ago

EUDigital Services ActDSA enters into forceEntered into force twenty days after publication; VLOP designation provisions (Art 33(3)-(6)) and Commission enforcement sections apply from this date (Art 93).European Union

December 20221

MilestoneDec 6, 2022 · 3.9 years ago

UK PSTI Act (product security)Royal AssentPSTI Act receives Royal Assent.United Kingdom