2025 compliance deadlines

20242026

January 202519

Takes effectJan 1, 2025 · 22 months ago

California SB 976 addictive feedsTakes effectActual-knowledge feed and notification limits apply, subject to litigation.California

Transition endsJan 1, 2025 · 22 months ago

CCPA / CPRACPI adjustment of thresholds and finesRevenue threshold rises to $26,625,000 and fines to $2,663 / $7,988 per violation.California

Takes effectJan 1, 2025 · 22 months ago

CNChina Network Data Security RegulationsNetwork Data Regulations take effectAll provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.China

EnforcementJan 1, 2025 · 22 months ago

Colorado Privacy Act (CPA)60-day cure period expiresMandatory 60-day notice-and-cure before AG enforcement ends; enforcement may proceed without cure.Colorado

ComplianceJan 1, 2025 · 22 months ago

Connecticut Data Privacy Act (CTDPA)Universal opt-out preference signals requiredControllers must honor opt-out preference signals for targeted advertising and sale (effective Jan 1, 2025).Connecticut

Takes effectJan 1, 2025 · 22 months ago

Delaware Personal Data Privacy Act (DPDPA)DPDPA takes effectConsumer rights and controller duties apply; 60-day mandatory cure period begins.Delaware

Takes effectJan 1, 2025 · 22 months ago

Iowa Consumer Data Protection Act (ICDPA)ICDPA takes effectConsumer rights and controller/processor obligations apply.Iowa

Takes effectJan 1, 2025 · 22 months ago

Malaysia PDPAPDPA amendments phase 1Miscellaneous provisions commence (e.g. electronic service of notices).Malaysia

Takes effectJan 1, 2025 · 22 months ago

Nebraska NDPANebraska Data Privacy Act takes effectController and processor obligations and consumer rights under Neb. Rev. Stat. 87-1101 et seq. apply.Nebraska

Takes effectJan 1, 2025 · 22 months ago

NHNew Hampshire Privacy ActNew Hampshire Privacy Act takes effectRSA 507-H obligations and consumer rights apply (Laws 2024, 5:1, eff. Jan. 1, 2025).New Hampshire

ComplianceJan 1, 2025 · 22 months ago

Texas TDPSAUniversal opt-out mechanism requirement appliesControllers must honor global privacy control / universal opt-out signals (Bus. & Com. Code 541.055(e)).Texas

MilestoneJan 6, 2025 · 22 months ago

HIPAA Security Rule update (NPRM)NPRM publishedProposed Security Rule changes published in the Federal Register.United States

ComplianceJan 12, 2025 · 21 months ago

EUInteroperable Europe ActInteroperability assessments mandatoryArticle 3(1) to (4) (interoperability assessments) and Article 17 apply.European Union

Takes effectJan 15, 2025 · 21 months ago

New Jersey NJDPANJDPA takes effectThe act takes effect on the 365th day after enactment on Jan 16, 2024 (sec. 17).New Jersey

Takes effectJan 17, 2025 · 21 months ago

CFPB Open Banking Rule (Section 1033)Final rule effectiveRule published 2024-11-18 takes effect.United States

Takes effectJan 17, 2025 · 21 months ago

EUDORADORA appliesAll DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).European Union

ReportingJan 17, 2025 · 21 months ago

EUNIS2Digital infrastructure entities submit registration dataDNS providers, TLD registries, domain registration services, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks had to submit registration details to competent authorities (Art 27(2)).European Union

Takes effectJan 29, 2025 · 21 months ago

CAOntario Bill 194Enhancing Digital Security and Trust Act in forceSchedule 1 (cyber security, AI and minors' data framework) and some FIPPA amendments come into force by OIC 361/2025.Ontario, Canada

Takes effectJan 29, 2025 · 21 months ago

PKPakistan PECAPECA amendment takes effectAct No. II of 2025 got presidential assent and took effect on 29 Jan 2025, per the Gazette of Pakistan.Pakistan

February 20252

Takes effectFeb 2, 2025 · 21 months ago

EUEU AI ActProhibited practices and AI literacy applyChapters I and II apply, including the Article 5 bans on prohibited AI practices and the Article 4 AI literacy duty (Art 113(a)).European Union

Takes effectFeb 4, 2025 · 21 months ago

EUEU Cyber Solidarity ActCyber Solidarity Act enters into forcePublished in the OJ on 2025-01-15; enters into force on the 20th day.European Union

March 20257

Transition endsMar 7, 2025 · 20 months ago

HIPAASecurity Rule NPRM comment period closedComments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.United States (Federal)

ReportingMar 7, 2025 · 20 months ago

HIPAA Security Rule update (NPRM)Comment period closesPublic comments on the NPRM due.United States

Takes effectMar 17, 2025 · 19 months ago

UK Online Safety ActIllegal harms duties enforceableIllegal content safety duties apply; illegal content risk assessments had to be completed by 16 March 2025.United Kingdom

Takes effectMar 21, 2025 · 19 months ago

MXMexico LFPDPPP 2025New LFPDPPP in forceLaw published 20 March 2025 enters into force the following day, repealing the 2010 law.Mexico

Takes effectMar 25, 2025 · 19 months ago

EUEuropean Health Data Space (EHDS)EHDS enters into forceRegulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.European Union

Takes effectMar 27, 2025 · 19 months ago

Indonesia PP 17/2025 (Child Protection Online)PP 17/2025 in forceThe regulation was signed, promulgated and took effect on the same day.Indonesia

Takes effectMar 30, 2025 · 19 months ago

PEPeru PDPL and 2024 RegulationNew regulation in forceRegulation enters into force 120 calendar days after publication.Peru

April 20256

Takes effectApr 1, 2025 · 19 months ago

Malaysia PDPAPDPA amendments phase 2'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.Malaysia

Takes effectApr 8, 2025 · 19 months ago

DOJ Bulk Data RuleProhibitions and restrictions take effectCore prohibitions on covered data transactions and security requirements for restricted transactions apply.United States (Federal)

ComplianceApr 16, 2025 · 18 months ago

UK Online Safety ActChildren's access assessments dueServices had to complete children's access assessments to determine whether children are likely to access them.United Kingdom

ReportingApr 17, 2025 · 18 months ago

EUNIS2Member States establish entity listsMember States had to establish lists of essential and important entities and notify the Commission of entity numbers (Art 3(3) and (5)). Repeated every two years.European Union

MilestoneApr 21, 2025 · 18 months ago

ARArkansas COPPA 2.0Approved by GovernorBecame Act 952.Arkansas

ReportingApr 30, 2025 · 18 months ago

EUDORAFirst registers of information submitted to the ESAsCompetent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.European Union

May 202511

Takes effectMay 1, 2025 · 18 months ago

CNChina PI Compliance Audit MeasuresPI compliance audit measures take effectSelf-audit and regulator-ordered audit regime applies; 10M+ processors must audit at least every two years.China

ComplianceMay 1, 2025 · 18 months ago

NYDFS Cybersecurity Regulation (Part 500)Vulnerability scans, access privileges, malware controls, Class A monitoring500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.New York

Takes effectMay 7, 2025 · 18 months ago

Utah AI Policy ActSB 226 amendments effectiveDisclosure duties narrowed (on clear request or high-risk interactions), safe harbor added, provisions recodified in Title 13, Ch. 75.Utah

Takes effectMay 7, 2025 · 18 months ago

Utah App Store Accountability ActAct takes effectDefinitions and general provisions effective.Utah

MilestoneMay 9, 2025 · 18 months ago

NY Algorithmic Pricing Disclosure ActSigned as part of FY2026 budgetS3008C Part X signed as Chapter 58 of 2025.New York

Takes effectMay 19, 2025 · 17 months ago

TAKE IT DOWN ActCriminal provisions effective on enactmentPublishing or threatening to publish non-consensual intimate images, including digital forgeries, became a federal crime upon signature.United States (Federal)

Takes effectMay 23, 2025 · 17 months ago

Colorado Privacy Act (CPA)SB 25-276 geolocation and sensitive-data sale amendment effectiveAdds precise geolocation data definitions and prohibits selling sensitive data without consent (effective on signature).Colorado

MilestoneMay 23, 2025 · 17 months ago

Japan Active Cyber Defense ActAct promulgatedAct No. 42 of 2025 promulgated; preparatory supplementary provisions apply from this day.Japan

MilestoneMay 27, 2025 · 17 months ago

Texas App Store Accountability ActSigned by GovernorSB 2420 signed.Texas

Takes effectMay 30, 2025 · 17 months ago

Australia Cyber Security Act (ransomware reporting)Ransomware payment reporting startsReporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.Australia

MilestoneMay 30, 2025 · 17 months ago

Nebraska Kids CodeApproved by GovernorLB 504 signed.Nebraska

June 202514

Takes effectJun 1, 2025 · 17 months ago

CNChina Facial Recognition MeasuresFacial recognition measures take effectConsent, impact assessment, storage and filing duties apply.China

ComplianceJun 1, 2025 · 17 months ago

Malaysia PDPAPDPA amendments phase 3Mandatory DPO appointment, data breach notification, and data portability take effect.Malaysia

Transition endsJun 2, 2025 · 17 months ago

New Jersey NJDPADivision of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L)Proposed rules published at 57 N.J.R. 1101(a); comments were due Aug 1, 2025.New Jersey

Takes effectJun 4, 2025 · 17 months ago

Japan AI Promotion ActAI Promotion Act promulgated and partly in forceMost provisions, including basic principles and stakeholder duties, take effect on promulgation.Japan

Takes effectJun 10, 2025 · 17 months ago

Australia Privacy ActStatutory tort for serious invasions of privacy commencesIndividuals can sue for serious invasions of privacy (Schedule 2), 6 months after Royal Assent.Australia

Takes effectJun 11, 2025 · 17 months ago

CAAlberta POPAPOPA in forceAct comes into force with the Access to Information Act, proclaimed in force June 11, 2025.Alberta, Canada

MilestoneJun 12, 2025 · 17 months ago

Vermont Kids CodeSigned by GovernorBecame Act 63.Vermont

MilestoneJun 18, 2025 · 16 months ago

Canada Bill C-8 / CCSPABill C-8 introducedFirst reading in the House of Commons.Canada

MilestoneJun 19, 2025 · 16 months ago

Data (Use and Access) ActRoyal AssentThe Act receives Royal Assent; commencement staged by regulations.United Kingdom

Takes effectJun 20, 2025 · 16 months ago

NY Child Data Protection ActTakes effectEffective one year after becoming law.New York

MilestoneJun 22, 2025 · 16 months ago

TRAIGAHB 149 signedGovernor Abbott signs TRAIGA.Texas

Takes effectJun 23, 2025 · 16 months ago

COPPA RuleAmended COPPA Rule takes effectThe April 2025 amendments to 16 CFR Part 312 became effective; during the transition operators could comply with either the pre-2025 or the amended Rule.United States (Federal)

Transition endsJun 27, 2025 · 16 months ago

California ADS employment regulationsOAL approves regulationsOffice of Administrative Law approves the Civil Rights Council's ADS rules.California

MilestoneJun 30, 2025 · 16 months ago

LALouisiana app store age verification lawSigned by GovernorBecame Act 481 of the 2025 Regular Session.Louisiana

July 202511

Takes effectJul 1, 2025 · 16 months ago

Colorado Privacy Act (CPA)Biometric identifier amendment (HB 24-1130) effectiveAny controller processing biometric identifiers must adopt a written biometric policy, give notice, obtain consent and follow retention/deletion rules.Colorado

ComplianceJul 1, 2025 · 16 months ago

EUDigital Services ActDSA transparency report templates mandatoryImplementing Regulation (EU) 2024/2835 requires all intermediary services to use harmonised templates for content moderation data collected from this date.European Union

ComplianceJul 1, 2025 · 16 months ago

CAOntario Bill 194FIPPA privacy amendments in forceRemaining FIPPA amendments, including privacy impact assessments, safeguards and breach notification to the IPC, come into force.Ontario, Canada

Takes effectJul 1, 2025 · 16 months ago

Oregon OCPAOCPA applies to nonprofitsNonprofit organizations meeting the thresholds become subject to OCPA.Oregon

Takes effectJul 1, 2025 · 16 months ago

Tennessee TIPATIPA takes effectController and processor obligations and consumer rights under Tenn. Code Ann. 47-18-3301 et seq. apply.Tennessee

Takes effectJul 1, 2025 · 16 months ago

Vietnam Law on DataLaw on Data takes effectThe Law on Data enters into force.Vietnam

Takes effectJul 8, 2025 · 16 months ago

EUDORATLPT regulatory technical standards enter into forceCommission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.European Union

ComplianceJul 15, 2025 · 15 months ago

New Jersey NJDPAUniversal opt-out mechanism must be honoredControllers that sell personal data or process it for targeted advertising must honor user-selected universal opt-out signals within six months of the effective date (N.J.S.A. 56:8-166.11).New Jersey

Takes effectJul 25, 2025 · 15 months ago

UK Online Safety ActProtection of children duties applyChildren's safety duties and Protection of Children Codes take effect, including highly effective age assurance; children's risk assessments due by 24 July 2025.United Kingdom

Transition endsJul 29, 2025 · 15 months ago

CFPB Open Banking Rule (Section 1033)Court stays Forcht Bank litigationE.D. Ky. stays the industry challenge after the CFPB says it will reconsider the rule; compliance dates stayed by 90 days.United States

Takes effectJul 31, 2025 · 15 months ago

MNMinnesota Consumer Data Privacy Act (MCDPA)MCDPA takes effectConsumer rights and controller/processor obligations apply (postsecondary institutions excepted).Minnesota

August 20256

Takes effectAug 2, 2025 · 15 months ago

EUEU AI ActGPAI, governance, notified bodies and penalties applyChapter III Section 4 (notifying authorities), Chapter V (general-purpose AI model obligations), Chapter VII (governance), Chapter XII (penalties, except Art 101) and Art 78 apply (Art 113(b)).European Union

Takes effectAug 14, 2025 · 14 months ago

Israel Privacy Protection Law Amendment 13Amendment 13 in forceAmended Privacy Protection Law, PPA enforcement powers and statutory damages take effect.Israel

Takes effectAug 20, 2025 · 14 months ago

Data (Use and Access) ActStage 1 commencementTechnical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).United Kingdom

MilestoneAug 22, 2025 · 14 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration ANPR publishedCFPB seeks comment on representatives, fees, data security and privacy, and on extending compliance dates.United States

ComplianceAug 23, 2025 · 14 months ago

Brazil LGPDDeadline to adopt ANPD standard contractual clausesAgents relying on contractual clauses for international transfers must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.Brazil

Transition endsAug 28, 2025 · 14 months ago

Colorado AI ActSB 25B-004 delays the actSpecial-session bill pushes the SB 24-205 effective date from February 1, 2026 to June 30, 2026.Colorado

September 202512

Takes effectSep 1, 2025 · 14 months ago

CNChina AI Content Labeling MeasuresAI content labeling measures and GB 45438-2025 take effectExplicit and implicit labeling duties for AI-generated content and platform detection duties apply.China

Takes effectSep 1, 2025 · 14 months ago

Japan AI Promotion ActAI Promotion Act fully in forceProvisions establishing the AI Strategy Headquarters and AI Basic Plan take effect.Japan

EnforcementSep 3, 2025 · 14 months ago

EUEU-US Data Privacy FrameworkGeneral Court upholds DPF (Latombe v Commission)General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.European Union

MilestoneSep 9, 2025 · 14 months ago

PEPeru AI Law and RegulationRegulation publishedDS 115-2025-PCM approving the AI regulation published in El Peruano.Peru

Takes effectSep 12, 2025 · 13 months ago

EUEU Data ActData Act appliesMost obligations apply, including user data access and sharing (Chapters II-III), cloud switching (Chapter VI) and interoperability; Chapter IV unfair terms apply to contracts concluded after this date (Art 50).European Union

ReportingSep 12, 2025 · 13 months ago

EUEU Data ActMember States notify penalty rulesMember States had to notify the Commission of their penalty rules (Art 40(2)).European Union

Takes effectSep 19, 2025 · 13 months ago

Nigeria NDPAGAID 2025 takes effectGeneral Application and Implementation Directive becomes effective, replacing the NDPR 2019 and NDPR Implementation Framework.Nigeria

Transition endsSep 22, 2025 · 13 months ago

CCPA / CPRAADMT, risk assessment and cybersecurity audit regulations approvedOAL approves the CCPA Updates, Cybersecurity Audit, Risk Assessment, ADMT and Insurance regulations and files them with the Secretary of State.California

ComplianceSep 24, 2025 · 13 months ago

EUData Governance ActLegacy data intermediaries must complyEntities that were already providing data intermediation services on 23 June 2022 had to comply with Chapter III by 24 Sep 2025 (Art 37).European Union

Takes effectSep 24, 2025 · 13 months ago

New Zealand Privacy ActPrivacy Amendment Act 2025 technical changes commenceTechnical amendments commence the day after Royal Assent (23 Sep 2025).New Zealand

MilestoneSep 29, 2025 · 13 months ago

California SB 53 (TFAIA)SB 53 signedGovernor Newsom signs SB 53 (chapter 138).California

ComplianceTentativeSep 30, 2025 · 13 months ago

PEPeru PDPL and 2024 RegulationData portability appliesArticle 76 on portability takes effect six months after the regulation enters into force.Peru

October 202516

Takes effectOct 1, 2025 · 13 months ago

California ADS employment regulationsADS regulations take effectRules apply to employment decisions using automated-decision systems.California

Takes effectOct 1, 2025 · 13 months ago

Colorado Privacy Act (CPA)Minors' data amendment (SB 24-041) effectiveControllers offering online services to minors must use reasonable care, conduct assessments, and obtain consent for targeted ads, sale and certain profiling of minors.Colorado

Takes effectOct 1, 2025 · 13 months ago

Maryland Online Data Privacy Act (MODPA)MODPA takes effectAct takes effect; data protection assessments apply to processing activities on or after Oct 1, 2025.Maryland

EnforcementOct 1, 2025 · 13 months ago

Montana Consumer Data Privacy Act (MCDPA)SB 297 amendments take effect; cure period eliminatedLower thresholds (25,000 / 15,000 + 25%), minors' data protections, AG assessment demands; the 60-day cure period is removed.Montana

ComplianceOct 6, 2025 · 13 months ago

DOJ Bulk Data RuleDue diligence, audit and reporting obligations applySubpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.United States (Federal)

MilestoneOct 8, 2025 · 13 months ago

California social media account deletionSigned by GovernorChaptered as Chapter 464, Statutes of 2025.California

Takes effectOct 10, 2025 · 13 months ago

EUEU Political Advertising Regulation (TTPA)TTPA appliesMost of the Regulation applies, including labelling, transparency notices and the targeting restrictions.European Union

MilestoneOct 13, 2025 · 12 months ago

California AI autonomous-harm defense banSigned by GovernorChaptered as Chapter 672, Statutes of 2025.California

MilestoneOct 13, 2025 · 12 months ago

California AI Transparency Act (SB 942)AB 853 signedAB 853 (ch. 674) delays the operative date and adds platform and device duties.California

MilestoneOct 13, 2025 · 12 months ago

California Digital Age Assurance ActSigned by GovernorChaptered as Chapter 675, Statutes of 2025.California

MilestoneOct 13, 2025 · 12 months ago

California SB 243 (companion chatbots)SB 243 signedSB 243 chaptered (ch. 677).California

ReportingOct 21, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Reconsideration comment period closesComments on the ANPR due.United States

EnforcementOct 29, 2025 · 12 months ago

CFPB Open Banking Rule (Section 1033)Court enjoins enforcementE.D. Ky. enjoins the CFPB from enforcing the rule until it completes its reconsideration.United States

Takes effectOct 29, 2025 · 12 months ago

EUDigital Services ActDSA delegated act on researcher data access in forceDelegated Regulation (EU) 2025/2050 sets the procedure for vetted researchers to access VLOP and VLOSE data under Article 40(4). Published in the OJ on 2025-10-09; in force on the 20th day.European Union

EnforcementOct 31, 2025 · 12 months ago

EUEU-US Data Privacy FrameworkLatombe appeal lodged at the Court of JusticeLatombe appealed the General Court judgment to the Court of Justice on points of law (reported as Case C-703/25 P); the DPF stays valid while it is pending.European Union

Takes effectOct 31, 2025 · 12 months ago

SGSingapore Cybersecurity Act2024 amendments commenceMost of the Cybersecurity (Amendment) Act 2024 takes effect, covering foundational digital infrastructure, entities of special cybersecurity interest and systems of temporary cybersecurity concern.Singapore

November 202516

Takes effectNov 1, 2025 · 12 months ago

CNChina Cyber Incident Reporting MeasuresIncident reporting measures take effect1, 2 and 4 hour reporting windows apply to relatively major and higher incidents.China

ComplianceNov 1, 2025 · 12 months ago

NYDFS Cybersecurity Regulation (Part 500)Universal MFA and asset inventory500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.New York

Takes effectNov 2, 2025 · 12 months ago

EGEgypt PDPLExecutive Regulations take effectDecree No. 816 of 2025 was published in Al-Waqa'i al-Misriyya No. 244 (supplement A) on 1 November 2025 and applies from the next day.Egypt

Takes effectNov 3, 2025 · 12 months ago

New Zealand Biometric Processing Privacy CodeBiometric code in forceThe Biometric Processing Privacy Code applies to new biometric processing.New Zealand

Takes effectNov 4, 2025 · 12 months ago

Kenya Computer Misuse and Cybercrimes Act2025 amendments commenceComputer Misuse and Cybercrimes (Amendment) Act No. 17 of 2025: assented 15 October 2025, published 21 October 2025, commenced 4 November 2025.Kenya

Takes effectNov 10, 2025 · 12 months ago

CMMC 2.0DFARS rule effective; Phase 1 beginsCMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).United States (Federal)

Takes effectNov 10, 2025 · 12 months ago

NY Algorithmic Pricing Disclosure ActDisclosure duty takes effectAlgorithmic pricing disclosures required.New York

MilestoneTentativeNov 11, 2025 · 12 months ago

TWTaiwan PDPA2025 amendment promulgatedAmendment adds PDPC powers, breach reporting and security duties. Its start date will be set by the Executive Yuan and is not yet known.Taiwan

MilestoneNov 12, 2025 · 11 months ago

UK Cyber Security and Resilience BillIntroduced (Commons first reading)Bill introduced in the House of Commons.United Kingdom

Takes effectNov 13, 2025 · 11 months ago

India DPDP ActDPDP Rules published; Board and procedural rules in forceRules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.India

ReportingNov 17, 2025 · 11 months ago

EUDigital Services ActDSA review report on VLOP scope and interplayCommission report under Article 91 on Article 33 scope and interaction with other laws.European Union

EnforcementNov 18, 2025 · 11 months ago

EUDORAFirst critical ICT third-party providers designatedThe ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.European Union

ComplianceNov 20, 2025 · 11 months ago

EUEU Consumer Credit Directive 2 (CCD2)Transposition deadlineMember States must adopt and publish transposing laws (Article 48).European Union

MilestoneNov 25, 2025 · 11 months ago

SGSingapore Online Safety (Relief and Accountability) ActAct assented toPassed by Parliament on 5 November 2025 and assented to by the President on 25 November 2025.Singapore

Transition endsNov 26, 2025 · 11 months ago

EUGDPRGDPR Procedural Regulation adoptedRegulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.European Union

ComplianceNov 30, 2025 · 11 months ago

PEPeru PDPL and 2024 RegulationDPO required: large companiesCompanies with annual sales above 2,300 UIT must appoint a data protection officer where Art. 37.1(2)-(3) applies.Peru

December 20256

ComplianceDec 3, 2025 · 11 months ago

SEC Regulation S-PLarger entities must complyLarger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.United States (Federal)

Takes effectDec 10, 2025 · 11 months ago

Australia Social Media Minimum AgeSocial media minimum age obligation appliesAge-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.Australia

MilestoneDec 16, 2025 · 10 months ago

AI state-law preemption EOEO published in Federal RegisterSigned 2025-12-11 and published at 90 FR 58499.United States

MilestoneDec 19, 2025 · 10 months ago

NY RAISE ActRAISE Act signedGovernor Hochul signs the RAISE Act with an agreed chapter amendment.New York

EnforcementDec 23, 2025 · 10 months ago

Texas App Store Accountability ActPreliminary injunctionW.D. Tex. (CCIA v. Paxton) enjoins the AG from implementing or enforcing SB 2420 on First Amendment grounds.Texas

EnforcementDec 31, 2025 · 10 months ago

Delaware Personal Data Privacy Act (DPDPA)Mandatory 60-day cure period expiresMandatory notice-and-cure ends Dec 31, 2025; from Jan 1, 2026 DOJ decides whether to offer a cure using statutory factors.Delaware