2024 compliance deadlines

20232025

January 20244

Takes effectJan 1, 2024 · 2.8 years ago

CNChina Minors Online Protection RegulationsMinors online protection regulations take effectPlatform, content, personal information and anti-addiction duties apply.China

Transition endsJan 1, 2024 · 2.8 years ago

TWTaiwan PDPAPDPC Preparatory Office takes overThe PDPC Preparatory Office takes over PDPA duties from the National Development Council.Taiwan

Takes effectJan 11, 2024 · 2.8 years ago

EUEU Data ActData Act enters into forceEntered into force on the twentieth day after publication in the OJ on 22 Dec 2023 (Art 50).European Union

Transition endsJan 11, 2024 · 2.8 years ago

EUEU Data ActReduced switching charges period beginsFrom 11 Jan 2024 to 12 Jan 2027, data processing providers may charge only reduced switching fees, capped at costs directly linked to switching (Art 29(2)-(3)).European Union

February 20241

Takes effectFeb 17, 2024 · 2.7 years ago

EUDigital Services ActDSA applies to all intermediary servicesFull application to all providers of intermediary services (Art 93(2)).European Union

March 20246

ComplianceMar 7, 2024 · 2.6 years ago

EUDigital Markets ActGatekeeper compliance deadline (first designations)First-wave gatekeepers had to comply with Arts 5-7 obligations and submit compliance reports six months after the 6 Sep 2023 designation.European Union

Takes effectMar 13, 2024 · 2.6 years ago

FCC CPNI Breach RuleOrder effective except revised notification rulesDefinitions and other parts of the order took effect; the revised 64.2011 and 64.5111 notification requirements were delayed pending OMB approval.United States (Federal)

Takes effectMar 22, 2024 · 2.6 years ago

CNChina Cross-Border Data Flow ProvisionsCross-border data flow provisions take effectExemptions and volume thresholds apply from publication (Art. 14); security assessment results are valid for 3 years (Art. 9).China

MilestoneMar 26, 2024 · 2.6 years ago

Tennessee ELVIS ActSigned by GovernorBecame Public Chapter 588.Tennessee

Takes effectMar 31, 2024 · 2.6 years ago

NVNevada consumer health data lawTakes effectSection 36: act effective March 31, 2024.Nevada

ComplianceMar 31, 2024 · 2.6 years ago

WAWashington My Health My Data ActRegulated entities must complySections 4-9 (privacy policy, consent, consumer rights, sale authorization) apply to regulated entities.Washington

April 20246

Takes effectApr 9, 2024 · 2.5 years ago

EUEU Political Advertising Regulation (TTPA)TTPA enters into forcePublished in the OJ on 2024-03-20; enters into force on the 20th day. Articles 3 and 5(1) apply from this date.European Union

Takes effectApr 11, 2024 · 2.5 years ago

EUInteroperable Europe ActAct enters into forcePublished in the OJ on 2024-03-22; enters into force on the 20th day.European Union

ReportingApr 15, 2024 · 2.5 years ago

NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationCertification of compliance or acknowledgment of non-compliance due (recurs every April 15).New York

MilestoneApr 25, 2024 · 2.5 years ago

UK Investigatory Powers (Amendment) Act 2024Royal AssentInvestigatory Powers (Amendment) Act 2024 receives Royal Assent.United Kingdom

ComplianceApr 29, 2024 · 2.5 years ago

NYDFS Cybersecurity Regulation (Part 500)General 180-day transition endsMost new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.New York

ComplianceApr 29, 2024 · 2.5 years ago

UK PSTI Act (product security)Product security requirements applySecurity requirements regulations (SI 2023/1007) come into force.United Kingdom

May 20245

Takes effectMay 1, 2024 · 2.5 years ago

Utah AI Policy ActAI Policy Act effectiveGenerative AI disclosure duties and the Office of AI Policy take effect.Utah

MilestoneMay 9, 2024 · 2.5 years ago

Maryland Kids CodeApproved by GovernorChapter 461 of 2024.Maryland

Takes effectMay 13, 2024 · 2.5 years ago

GLBA Safeguards RuleFTC breach notification requirement effectiveSection 314.4(j) requires notice to the FTC within 30 days of discovering a notification event involving at least 500 consumers.United States (Federal)

MilestoneMay 17, 2024 · 2.4 years ago

Colorado AI ActSB 24-205 signedGovernor Polis signs the original Colorado AI Act with a February 1, 2026 effective date.Colorado

Takes effectMay 20, 2024 · 2.4 years ago

EUeIDAS 2 / EU Digital Identity WalleteIDAS 2 enters into forceRegulation (EU) 2024/1183 entered into force on the twentieth day after publication on 30 Apr 2024 (Art 2).European Union

June 20247

Takes effectJun 1, 2024 · 2.4 years ago

Turkey KVKKLaw 7499 amendments take effectNew sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.Turkey

ComplianceJun 15, 2024 · 2.4 years ago

SEC Cyber Disclosure RulesSmaller reporting companies: Item 1.05 complianceSmaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.United States (Federal)

MilestoneJun 20, 2024 · 2.4 years ago

NY Child Data Protection ActSigned by GovernorChapter 121 of 2024.New York

MilestoneJun 20, 2024 · 2.4 years ago

NY SAFE for Kids ActSigned by GovernorChapter 120 of 2024.New York

Takes effectJun 23, 2024 · 2.3 years ago

PADFAPADFA takes effectThe prohibition takes effect 60 days after enactment (April 24, 2024).United States (Federal)

Takes effectJun 25, 2024 · 2.3 years ago

HIPAAReproductive health care privacy rule effective (later vacated)The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).United States (Federal)

ComplianceJun 30, 2024 · 2.3 years ago

WAWashington My Health My Data ActSmall businesses must complySections 4-9 apply to small businesses.Washington

July 20248

ComplianceJul 1, 2024 · 2.3 years ago

Colorado Privacy Act (CPA)Universal opt-out mechanism recognition requiredControllers must honor AG-recognized universal opt-out mechanisms (e.g. Global Privacy Control).Colorado

Takes effectJul 1, 2024 · 2.3 years ago

Florida Digital Bill of RightsFlorida Digital Bill of Rights takes effectSB 262 obligations under Fla. Stat. 501.701-501.722 apply.Florida

Takes effectJul 1, 2024 · 2.3 years ago

Oregon OCPAOCPA takes effect for most controllersOCPA obligations apply to for-profit controllers meeting the thresholds.Oregon

Takes effectJul 1, 2024 · 2.3 years ago

Tennessee ELVIS ActTakes effectELVIS Act provisions effective.Tennessee

Takes effectJul 1, 2024 · 2.3 years ago

Texas TDPSATDPSA takes effectMost TDPSA obligations and consumer rights apply.Texas

Transition endsJul 3, 2024 · 2.3 years ago

CIRCIANPRM comment period closedExtended comment period on the CIRCIA proposed rule closed.United States (Federal)

Takes effectJul 12, 2024 · 2.3 years ago

EUInteroperable Europe ActAct appliesGeneral application date.European Union

Takes effectJul 29, 2024 · 2.2 years ago

FTC Health Breach Notification Rule2024 amendments effectiveAmendments clarifying health app coverage, unauthorized disclosure as breach, email notice and FTC notice timing took effect.United States (Federal)

August 20246

Takes effectAug 1, 2024 · 2.2 years ago

EUEU AI ActAI Act enters into forceRegulation (EU) 2024/1689 enters into force twenty days after publication on 12 July 2024 (Art 113).European Union

Takes effectAug 2, 2024 · 2.2 years ago

Illinois BIPASB 2979 amendment effectivePublic Act 103-0769 signed and effective immediately: single recovery per person and electronic signatures allowed for consent.Illinois

Takes effectAug 2, 2024 · 2.2 years ago

SEC Regulation S-PAmendments effectiveThe Regulation S-P amendments became effective; compliance tiered by entity size.United States (Federal)

MilestoneAug 9, 2024 · 2.2 years ago

Illinois AI in Employment Law (HB 3773)HB 3773 signedGovernor Pritzker signs Public Act 103-0804.Illinois

MilestoneAug 23, 2024 · 2.2 years ago

Brazil LGPDInternational transfer regulation publishedResolution CD/ANPD 19/2024 on international transfers and standard contractual clauses published and in force.Brazil

Takes effectAug 26, 2024 · 2.2 years ago

Malaysia Cyber Security ActAct 854 and first regulations in forceThe Act and its incident notification, risk assessment and audit, and licensing regulations take effect.Malaysia

September 20247

Transition endsSep 1, 2024 · 2.2 years ago

Turkey KVKKOld transfer regime endsTransitional period ends in which the former Article 9 explicit-consent transfer basis could still be relied on.Turkey

Transition endsSep 5, 2024 · 2.1 years ago

COCoE AI Framework ConventionOpened for signatureConvention opened for signature; the EU signed under Council Decision (EU) 2024/2218.Council of Europe

EnforcementSep 14, 2024 · 2.1 years ago

Saudi PDPLOne-year grace period endsGrace period for controllers to comply ends; PDPL fully enforceable.Saudi Arabia

MilestoneSep 19, 2024 · 2.1 years ago

California AI Transparency Act (SB 942)SB 942 signedSB 942 chaptered (ch. 291) with an original operative date of January 1, 2026.California

MilestoneSep 20, 2024 · 2.1 years ago

California SB 976 addictive feedsSigned by GovernorChaptered as Chapter 321, Statutes of 2024.California

ComplianceSep 22, 2024 · 2.1 years ago

Quebec Law 25Phase 3: data portabilityRight to data portability in a structured, commonly used technological format applies.Quebec, Canada

MilestoneSep 28, 2024 · 2.1 years ago

California AB 2013 (AI training data transparency)AB 2013 signedAB 2013 chaptered (ch. 817).California

October 20245

Takes effectOct 1, 2024 · 2.1 years ago

Maryland Kids CodeTakes effectAct effective.Maryland

Takes effectOct 1, 2024 · 2.1 years ago

Montana Consumer Data Privacy Act (MCDPA)MCDPA takes effectConsumer rights, controller duties and opt-out preference signal support apply.Montana

ComplianceOct 17, 2024 · 2 years ago

Indonesia PDP LawPDP Law transition endsControllers and processors must fully comply (Art. 74 two-year transition).Indonesia

Transition endsOct 17, 2024 · 2 years ago

EUNIS2Transposition deadlineMember States had to adopt and publish national transposing measures by 17 Oct 2024 (Art 41(1)).European Union

Takes effectOct 18, 2024 · 2 years ago

EUNIS2National NIS2 measures apply; NIS1 repealedMember States apply their NIS2 measures from 18 Oct 2024 and Directive (EU) 2016/1148 (NIS1) is repealed (Arts 41(1), 44).European Union

November 20244

ComplianceNov 1, 2024 · 24 months ago

NYDFS Cybersecurity Regulation (Part 500)Governance, encryption, IR/BCDR, exemptions500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.New York

Takes effectNov 7, 2024 · 24 months ago

EUNIS2Implementing Regulation 2024/2690 enters into forceCommission Implementing Regulation (EU) 2024/2690 (published 18 Oct 2024) sets technical risk-management measures and significant-incident thresholds for DNS, TLD, cloud, data centre, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.European Union

MilestoneNov 25, 2024 · 23 months ago

CAOntario Bill 194Royal AssentBill 194 receives Royal Assent as S.O. 2024, c. 24.Ontario, Canada

MilestoneNov 30, 2024 · 23 months ago

PEPeru PDPL and 2024 RegulationNew regulation publishedDS 016-2024-JUS published in El Peruano.Peru

December 202412

Takes effectDec 1, 2024 · 23 months ago

EUEU Platform Work DirectiveDirective enters into forcePublished in the OJ on 2024-11-11; enters into force on the 20th day.European Union

Takes effectDec 8, 2024 · 23 months ago

EUProduct Liability DirectiveNew PLD enters into forceDirective entered into force on the twentieth day after publication in the OJ on 18 Nov 2024 (Art 23).European Union

MilestoneDec 10, 2024 · 23 months ago

Brazil AI Bill (PL 2338/2023)Approved by the Federal SenateSenate approves the consolidated text and sends it to the Chamber of Deputies.Brazil

Takes effectDec 10, 2024 · 23 months ago

EUCyber Resilience ActCRA enters into forceEntered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).European Union

Takes effectDec 11, 2024 · 23 months ago

Australia Privacy ActMost POLA Act 2024 amendments commenceTiered penalties, infringement notices, OAIC powers, security and overseas-transfer clarifications and doxxing offences commence the day after Royal Assent.Australia

MilestoneDec 13, 2024 · 22 months ago

CLChile Personal Data Protection Law (Ley 21.719)Published in Diario OficialLaw 21.719 published; 24-month vacatio legis begins.Chile

ComplianceDec 15, 2024 · 22 months ago

SEC Cyber Disclosure RulesInline XBRL tagging of annual cybersecurity disclosuresItem 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.United States (Federal)

Takes effectDec 16, 2024 · 22 months ago

CMMC 2.0CMMC Program rule (32 CFR Part 170) effectiveThe program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.United States (Federal)

ComplianceDec 18, 2024 · 22 months ago

SEC Cyber Disclosure RulesInline XBRL tagging of Item 1.05 disclosuresForm 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.United States (Federal)

ComplianceDec 23, 2024 · 22 months ago

HIPAAReproductive health privacy compliance date (vacated)Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.United States (Federal)

Takes effectDec 24, 2024 · 22 months ago

EUeIDAS 2 / EU Digital Identity WalletFirst wallet implementing acts enter into forceCommission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.European Union

EnforcementDec 31, 2024 · 22 months ago

Connecticut Data Privacy Act (CTDPA)Mandatory 60-day cure period expiresAfter Dec 31, 2024, the AG is no longer required to offer a 60-day cure before enforcement; cure becomes discretionary.Connecticut