Data, privacy and AI rules

12 due in 60 days · 190 regulations

2023 compliance deadlines

20222024

January 20235
Takes effectJan 1, 2023 · 3.8 years ago
CCPA / CPRACPRA amendments operativeCPRA amendments (correction right, sensitive PI limits, sharing opt-out, employee/B2B data coverage) become operative.California
Takes effectJan 1, 2023 · 3.8 years ago
Virginia VCDPAVCDPA takes effectVCDPA obligations and consumer rights apply.Virginia
Takes effectJan 10, 2023 · 3.8 years ago
China Deep Synthesis ProvisionsDeep synthesis provisions take effectLabeling, identity verification and filing duties apply to deep synthesis services.China
Takes effectJan 16, 2023 · 3.8 years ago
DORADORA enters into forceEntered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022 (Art 64).European Union
Takes effectJan 16, 2023 · 3.8 years ago
NIS2NIS2 enters into forceDirective entered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022.European Union
February 20231
ReportingFeb 17, 2023 · 3.7 years ago
Digital Services ActPlatforms publish EU user numbersOnline platforms and search engines had to publish average monthly active EU recipients, and must update them at least every six months (Art 24(2)).European Union
March 20231
Transition endsTentativeMar 1, 2023 · 3.7 years ago
China Data Export Security Assessment MeasuresRemediation window for existing transfers endsExisting exports had to be remediated within six months of 2022-09-01. The exact end date is computed, not stated.China
April 20232
EnforcementApr 25, 2023 · 3.5 years ago
Digital Services ActFirst VLOP/VLOSE designationsCommission designated the first 19 very large online platforms and search engines (e.g. Amazon Store, Facebook, Google Search, TikTok, X). Obligations apply four months after notification.European Union
MilestoneApr 27, 2023 · 3.5 years ago
Washington My Health My Data ActHB 1155 signedGovernor signs My Health My Data Act.Washington
May 20232
Takes effectMay 2, 2023 · 3.5 years ago
Digital Markets ActDMA appliesDMA becomes applicable; undertakings meeting thresholds must notify the Commission within two months (Arts 3(3), 54).European Union
Takes effectMay 31, 2023 · 3.4 years ago
Taiwan PDPAHigher fines take effectAmended article 48 with higher fines for security failures takes effect on promulgation.Taiwan
June 20235
Takes effectJun 1, 2023 · 3.4 years ago
China PI Export Standard Contract MeasuresStandard contract measures take effectThe standard contract route and filing duty apply.China
ComplianceJun 9, 2023 · 3.4 years ago
GLBA Safeguards RuleCompliance with expanded security program elementsApplicability of the 314.5 provisions (qualified individual, written risk assessment, encryption, MFA, pen testing, incident response plan, board reporting) was delayed from December 9, 2022 to this date.United States (Federal)
MilestoneJun 12, 2023 · 3.4 years ago
Nigeria NDPANDPA signed into lawPresident signs the Nigeria Data Protection Act, 2023.Nigeria
MilestoneJun 16, 2023 · 3.4 years ago
Nevada consumer health data lawApproved by GovernorChapter 525, Statutes of Nevada 2023.Nevada
MilestoneJun 28, 2023 · 3.3 years ago
EU Financial Data Access (FIDA) proposalFIDA proposedCommission adopts the proposal together with the payment services package.European Union
July 20236
Takes effectJul 1, 2023 · 3.3 years ago
Colorado Privacy Act (CPA)CPA takes effectCore consumer rights and controller duties apply.Colorado
Takes effectJul 1, 2023 · 3.3 years ago
Connecticut Data Privacy Act (CTDPA)CTDPA takes effectCore consumer rights and controller obligations apply.Connecticut
EnforcementJul 5, 2023 · 3.3 years ago
NYC Local Law 144 (AEDT)DCWP enforcement beginsBias audit, results publication and candidate notice requirements are enforced.New York City, New York
MilestoneJul 5, 2023 · 3.3 years ago
Peru AI Law and RegulationLaw 31814 publishedAI promotion law published.Peru
Takes effectJul 10, 2023 · 3.3 years ago
EU-US Data Privacy FrameworkDPF adequacy decision adopted and effectiveCommission adopted Implementing Decision (EU) 2023/1795, effective on notification to Member States; EU-US transfers to DPF-certified organisations may proceed without additional safeguards.European Union
Takes effectJul 23, 2023 · 3.3 years ago
Washington My Health My Data ActGeofencing ban (Section 10) effectiveBan on geofencing around health care facilities applies to all persons.Washington
August 20232
Takes effectAug 15, 2023 · 3.2 years ago
China Generative AI MeasuresGenerative AI measures take effectTraining data, labeling, content and user protection duties apply to public generative AI services.China
Takes effectAug 17, 2023 · 3.2 years ago
EU e-Evidence PackagePackage enters into forcePublished in the OJ on 2023-07-28; enters into force on the 20th day.European Union
September 20235
Takes effectSep 1, 2023 · 3.2 years ago
Swiss revised FADP (nFADP)Revised FADP enters into forceRevised FADP and Data Protection Ordinance apply with no transition period.Switzerland
EnforcementSep 6, 2023 · 3.1 years ago
Digital Markets ActFirst six gatekeepers designatedCommission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft (22 core platform services). They had six months to fully comply.European Union
Takes effectSep 14, 2023 · 3.1 years ago
Saudi PDPLPDPL in forcePDPL and its implementing regulations take effect.Saudi Arabia
ComplianceSep 22, 2023 · 3.1 years ago
Quebec Law 25Phase 2: main obligations and penaltiesGovernance policies, PIAs, consent, transparency, privacy by default, ADM notices, cross-border PIAs and AMP/penal regime apply.Quebec, Canada
Takes effectSep 24, 2023 · 3.1 years ago
Data Governance ActDGA appliesAll DGA rules apply (Art 38).European Union
October 20232
Transition endsOct 15, 2023 · 3 years ago
Rwanda DPP LawTwo-year transition endsArticle 67 gave controllers and processors already operating two years from publication to comply.Rwanda
MilestoneOct 26, 2023 · 3 years ago
UK Online Safety ActRoyal AssentThe Online Safety Act receives Royal Assent.United Kingdom
November 20231
Takes effectNov 1, 2023 · 3 years ago
NYDFS Cybersecurity Regulation (Part 500)Second Amendment effectiveSecond Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.New York
December 20235
Transition endsTentativeDec 1, 2023 · 2.9 years ago
China PI Export Standard Contract MeasuresRemediation window for existing transfers endsExisting exports had to comply within six months of 2023-06-01. The exact end date is computed, not stated.China
ComplianceDec 1, 2023 · 2.9 years ago
NYDFS Cybersecurity Regulation (Part 500)Amended notification requirements (500.17)New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).New York
ComplianceDec 15, 2023 · 2.9 years ago
SEC Cyber Disclosure RulesAnnual cybersecurity disclosures begin (Item 106 / 16K)Required in annual reports for fiscal years ending on or after this date.United States (Federal)
ComplianceDec 18, 2023 · 2.9 years ago
SEC Cyber Disclosure RulesForm 8-K Item 1.05 incident disclosure beginsAll registrants other than smaller reporting companies must file material incident disclosures from this date.United States (Federal)
Takes effectDec 31, 2023 · 2.8 years ago
Utah UCPAUCPA takes effectUtah Consumer Privacy Act obligations and consumer rights apply.Utah