Skip to content

2026 compliance deadlines

136 data, privacy, AI and cybersecurity deadlines in 2026, across 95 regulations.20252027

136 of 136 deadlines

DateRegulation
Earlier
January 202639
8 months agoAU Cyber Security Act

Ransomware reporting moves to compliance phase

8 months agoCA AB 2013

Training-data documentation due

8 months agoCalifornia AI autonomous-harm defense ban

Takes effect

8 months agoCA SB 942

Original operative date (superseded)

8 months agoCA Delete Act

DROP opens to consumers

8 months agoCA SB 243

Chatbot safeguards apply

8 months agoCA SB 53

Frontier developer obligations apply

8 months agoCalifornia social media account deletion

Takes effect

8 months agoCCPA / CPRA

New CCPA regulations take effect

8 months agoChina CSL

2025 amendments take effect

8 months agoChina PI Export Certification Measures

PI export certification measures take effect

8 months agoDelaware DPDPA

Opt-out preference signals must be honored

8 months agoEU DSA

DSA first harmonised transparency reporting cycle

8 months agoGDPR

GDPR Procedural Regulation enters into force

8 months agoHK PCICO

PCICSO comes into operation

8 months agoIllinois HB 3773

AI anti-discrimination and notice duties apply

8 months agoIndiana ICDPA

ICDPA takes effect

8 months agoKentucky KCDPA

KCDPA takes effect

8 months agoMalaysia Online Safety Act

Online Safety Act and first regulations in force

8 months agoNebraska Kids Code

Operative date

8 months agoNH Privacy Act

Mandatory 60-day cure period expires

8 months agoOregon OCPA

Cure period sunsets

8 months agoOregon OCPA

Universal opt-out signals must be honored

8 months agoOregon OCPA

Sale ban on precise geolocation and under-16 data (HB 2008)

8 months agoRIDTPPA

RIDTPPA takes effect

8 months agoTexas App Store Accountability Act

Scheduled effective date (enjoined)

8 months agoTRAIGA

TRAIGA takes effect

8 months agoUAE Child Digital Safety Law

Child Digital Safety Law takes effect

8 months agoVietnam PDPL

PDPL and Decree 356/2025 take effect

8 months agoVirginia VCDPA

Under-16 social media time limit (SB 854) takes effect

8 months agoAI state-law preemption EO

AI Litigation Task Force due

8 months agoTTPA

Member States notify sanction rules

8 months agoTaiwan AI Basic Act

AI Basic Act in force

8 months agoKazakhstan AI Law

AI Law takes effecttentative

8 months agoEU Cybersecurity Act

Cybersecurity Act 2 proposed

8 months agoPeru AI Law and Regulation

Regulation in forcetentative

8 months agoKorea AI Act

AI Basic Act and Enforcement Decree take effect

7 months agoCA Delete Act

Annual data broker registration deadline

7 months agoMinnesota MCDPA

30-day cure period expires

February 20267
7 months agoColorado AI Act

Original effective date (superseded)

7 months agoUK DUAA

Stage 3: main data protection changes commence

7 months agoUK GDPR

DUAA amendments to UK GDPR commence

7 months agoHIPAA

Notice of Privacy Practices updates (Part 2 alignment)

7 months agoEU e-Evidence Package

Legal representatives Directive transposition

7 months agoIndia IT Rules amendment on synthetic content

Synthetic content rules take effect

7 months agoVirginia VCDPA

SB 854 preliminarily enjoined (NetChoice v. Jones)

March 20267
6 months agoChina Minors Online Protection Regulations

Classification measures for content harmful to minors take effect

6 months agoVietnam AI Law

AI Law takes effect

6 months agoAU Cyber Security Act

Smart device security standard applies

6 months agoKorea PIPA

2026 PIPA amendment promulgated (Act No. 21445)

6 months agoAI state-law preemption EO

Commerce state-law evaluation, BEAD notice and FTC statement due

6 months agoECA Digital

ECA Digital in force

6 months agoNY RAISE Act

Chapter amendment S8828 signed

April 202610
5 months agoChina Minors Online Protection Regulations

Measures identifying large or influential platforms for minors take effect

5 months agoIllinois BIPA

Seventh Circuit: amendment applies retroactively

5 months agoJapan Active Cyber Defense Act

Supervisory Commission provisions in force

5 months agoMaryland Kids Code

Data protection impact assessments due

5 months agoMaryland MODPA

MODPA applies to personal data processing

5 months agoEU CSAM Interim Regulation

Previous interim regulation expires

5 months agoUK OSA

Fee notification window closes (2026/27)

5 months agoNYDFS Part 500

Annual compliance notification

5 months agoCoE AI Framework Convention

EU concludes the Convention

5 months agoCOPPA Rule

Full compliance with amended COPPA Rule

May 20269
4 months agoNew Zealand Biometric Processing Privacy Code

Amendment No. 1 applies (IPP 3A)

4 months agoNZ Privacy Act

IPP 3A indirect-collection notification applies

4 months agoEU DMA

DMA first review

4 months agoTexas App Store Accountability Act

Stay pending appeal denied

4 months agoUtah App Store Accountability Act

App store and developer duties apply

4 months agoColorado AI Act

SB 26-189 signed (repeal and reenact)

4 months agoIllinois HB 3773

IDHR proposed notice rules published

4 months agoTAKE IT DOWN Act

Platform notice-and-removal process required

4 months agoeIDAS 2

Legacy qualified trust service providers conformity report

June 202613
3 months agoIllinois HB 3773

IDHR withdraws and postpones proposed rules

3 months agoSEC Reg S-P

Smaller entities must comply

3 months agoAlberta POPA

Privacy management programs required

3 months agoEU CRA

Conformity assessment body provisions apply

3 months agoCanada C-36

Bill C-36 tabled (first reading)

3 months agoCanada CCSPA

Royal Assent

3 months agoUK CSR Bill

Passes House of Commons

3 months agoUK DUAA

Mandatory data protection complaints procedure

2 months agoSingapore Online Safety (Relief and Accountability) Act

OSC begins operations and first provisions commence

2 months agoSection 1033

First compliance date (stayed, enjoined)tentative

2 months agoColorado AI Act

Delayed effective date (superseded)

2 months agoNJDPA

A5328 sensitive data sale ban takes effect

2 months agoUAE Child Digital Safety Law

Social media minimum age resolution takes effect

July 202617
2 months agoArkansas COPPA 2.0

Takes effect

2 months agoCTDPA

PA 25-113 (SB 1295) amendments take effect

2 months agoLouisiana app store age verification law

Takes effect

2 months agoMalaysia Online Safety Act

Online Safety Plan and compounding regulations in force

2 months agoNebraska Kids Code

Civil penalties available

2 months agoNJDPA

Mandatory 30-day cure period expires

2 months agoUtah UCPA

Right to correct takes effect

2 months agoVietnam Cybersecurity Law 2025

Cybersecurity Law 2025 takes effect

2 months agoVirginia VCDPA

Ban on selling precise geolocation data (SB 338)

2 months agoAI state-law preemption EO

FTC proposes AI accuracy policy statement

2 months agoChina Anthropomorphic AI Measures

Anthropomorphic AI measures take effect

2 months agoJapan APPI

2026 APPI amendment act promulgated

2 months agoEU AI Act

Digital Omnibus on AI enters into force

2 months agoNY SAFE for Kids Act

Final SAFE for Kids rules released

8 weeks agoNY SAFE for Kids Act

Rules published in State Register

8 weeks agoAI state-law preemption EO

FTC policy statement comments close

8 weeks agoEU CSAM Interim Regulation

New interim regulation enters into force

August 20268
8 weeks agoCA Delete Act

Data brokers must begin processing DROP deletion requests

8 weeks agoCTDPA

Profiling impact assessments apply

7 weeks agoCA SB 942

Covered provider duties apply

7 weeks agoEU AI Act

General application: transparency obligations, GPAI fines, most other rules

7 weeks agoNew Zealand Biometric Processing Privacy Code

Grace period ends for existing biometric processing

5 weeks agoEU e-Evidence Package

e-Evidence Regulation applies

5 weeks agoChina Data Security Risk Assessment Measures

Risk assessment measures take effect

3 weeks agoEU DSA

ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs

September 20268
3 weeks agoChina Small PI Handler Simplified Measures

Simplified measures for small handlers take effect

2 weeks agoCalifornia AI Auditor Registry

Signed by Governor

2 weeks agoPeru AI Law and Regulation

Private sector: health, education, justice, security, financetentative

2 weeks agoEU CRA

Vulnerability and incident reporting obligations apply

2 weeks agoKorea PIPA

2026 PIPA amendments take effect

2 weeks agoAU Social Media Age

Strengthened enforcement amendments commence

2 weeks agoEU Data Act

Access-by-design for new connected products

10 days agoThailand Cybersecurity Act

Website Security Standard B.E. 2568 enforced

Coming up
September 20261
in 4 daysUK DUAA

ICO abolished; Information Commission takes over

October 20263
in 5 daysCTDPA

PA 26-64 (SB 4) amendments take effect

in 5 daysJapan Active Cyber Defense Act

Registration and incident reporting duties start

in 4 weeksUK CSR Bill

Lords report stage scheduledtentative

November 20265
in 5 weeksEgypt PDPL

One-year compliance window endstentative

in 6 weeksCMMC 2.0

Phase 2: Level 2 C3PAO certification

in 6 weeksIndia DPDP

Consent Manager registration rule in force (12 months)

in 7 weeksCCD2

National rules apply

in 2 monthsPeru PDPL and 2024 Regulation

DPO required: medium companies

December 20269
in 2 monthsChile PDPL

Law in force

in 2 monthsEU AI Act

New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends

in 2 monthsEU Platform Work Directive

Transposition deadline

in 2 monthsEU PLD

Transposition deadline; old PLD repealed

in 2 monthsAU Privacy Act

Children's Online Privacy Code must be registered

in 2 monthsAU Privacy Act

Automated decision-making transparency applies

in 2 monthseIDAS 2

Member States must provide EU Digital Identity Wallets

in 3 monthsMalaysia Online Safety Act

Online Safety Plan due to MCMC

in 3 monthsUtah App Store Accountability Act

Private right of action begins

Rule changes by email

The morning after a new data, privacy or AI law, or a deadline change; nothing in quiet weeks.

Double opt-in. Unsubscribe any time.