2026 compliance deadlines

20252027

January 202639

EnforcementJan 1 · 10 months ago

Australia Cyber Security Act (ransomware reporting)Ransomware reporting moves to compliance phaseThe education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.Australia

ComplianceJan 1 · 10 months ago

California AB 2013 (AI training data transparency)Training-data documentation dueDocumentation must be posted for GenAI systems released since January 1, 2022, and before each later release or substantial modification.California

Takes effectJan 1 · 10 months ago

California AI autonomous-harm defense banTakes effectDefault effective date for 2025 regular-session statutes.California

Transition endsJan 1 · 10 months ago

California AI Transparency Act (SB 942)Original operative date (superseded)Original SB 942 date; delayed to August 2, 2026 by AB 853.California

Takes effectJan 1 · 10 months ago

California Delete Act / DROPDROP opens to consumersConsumers can submit a single deletion request to all registered data brokers through DROP.California

Takes effectJan 1 · 10 months ago

California SB 243 (companion chatbots)Chatbot safeguards applyAI disclosure, suicide and self-harm protocols, and minor protections apply.California

Takes effectJan 1 · 10 months ago

California SB 53 (TFAIA)Frontier developer obligations applyFrontier AI frameworks, transparency reports, critical safety incident reporting (15 days, or 24 hours for imminent risk of death or serious injury) and whistleblower protections apply.California

Takes effectJan 1 · 10 months ago

California social media account deletionTakes effectDefault effective date for 2025 regular-session statutes.California

Takes effectJan 1 · 10 months ago

CCPA / CPRANew CCPA regulations take effectADMT, risk assessment, cybersecurity audit and updated CCPA regulations become effective; risk assessments required for new high-risk processing.California

Takes effectJan 1 · 10 months ago

CNChina Cybersecurity Law2025 amendments take effectHigher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.China

Takes effectJan 1 · 10 months ago

CNChina PI Export Certification MeasuresPI export certification measures take effectThe certification route for personal information exports applies.China

ComplianceJan 1 · 10 months ago

Delaware Personal Data Privacy Act (DPDPA)Opt-out preference signals must be honoredControllers must allow opt-out of targeted advertising and sale via opt-out preference signals (12D-106).Delaware

ReportingJan 1 · 10 months ago

EUDigital Services ActDSA first harmonised transparency reporting cycleFirst full annual reporting period (to 2026-12-31) under the harmonised templates for all intermediary services.European Union

Transition endsJan 1 · 10 months ago

EUGDPRGDPR Procedural Regulation enters into forceRegulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.European Union

Takes effectJan 1 · 10 months ago

Hong Kong Critical Infrastructure Cyber OrdinancePCICSO comes into operationCommissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.Hong Kong

Takes effectJan 1 · 10 months ago

Illinois AI in Employment Law (HB 3773)AI anti-discrimination and notice duties applyProhibition on discriminatory AI use and the employee notice requirement take effect.Illinois

Takes effectJan 1 · 10 months ago

INIndiana Consumer Data Protection Act (ICDPA)ICDPA takes effectConsumer rights and controller/processor obligations apply; assessments required for processing activities created on or after this date.Indiana

Takes effectJan 1 · 10 months ago

Kentucky Consumer Data Protection Act (KCDPA)KCDPA takes effectConsumer rights and controller/processor obligations apply (HB 15 section 12).Kentucky

Takes effectJan 1 · 10 months ago

Malaysia Online Safety ActOnline Safety Act and first regulations in forceThe Act and the Period, Fees, Form of Undertaking and Appeal Tribunal regulations take effect.Malaysia

Takes effectJan 1 · 10 months ago

Nebraska Kids CodeOperative dateAct becomes operative.Nebraska

EnforcementJan 1 · 10 months ago

NHNew Hampshire Privacy ActMandatory 60-day cure period expiresThe AG's obligation to issue a cure notice ended Dec 31, 2025; from Jan 1, 2026 cure opportunities are discretionary (RSA 507-H:11 II-III).New Hampshire

EnforcementJan 1 · 10 months ago

Oregon OCPACure period sunsetsThe AG's 30-day notice-and-cure requirement expires; enforcement can proceed without a cure opportunity.Oregon

ComplianceJan 1 · 10 months ago

Oregon OCPAUniversal opt-out signals must be honoredControllers must honor opt-out preference signals such as Global Privacy Control.Oregon

Takes effectJan 1 · 10 months ago

Oregon OCPASale ban on precise geolocation and under-16 data (HB 2008)Selling precise geolocation (1,750-ft radius) and the personal data of consumers the controller knows or willfully disregards are under 16 is prohibited.Oregon

Takes effectJan 1 · 10 months ago

Rhode Island RIDTPPARIDTPPA takes effectAll provisions of R.I. Gen. Laws ch. 6-48.1 apply (P.L. 2024, ch. 430/453, effective Jan 1, 2026).Rhode Island

Takes effectJan 1 · 10 months ago

Texas App Store Accountability ActScheduled effective date (enjoined)Statutory effective date; not enforceable while the injunction stands.Texas

Takes effectJan 1 · 10 months ago

TRAIGATRAIGA takes effectProhibited-practice rules, AG enforcement, sandbox program and government AI disclosure duties apply.Texas

Takes effectJan 1 · 10 months ago

UAE Child Digital Safety LawChild Digital Safety Law takes effectEffective date shown on the official legislation portal. Published in Official Gazette No. 809 (supplement 1) on 14 October 2025.United Arab Emirates

Takes effectJan 1 · 10 months ago

Vietnam PDPLPDPL and Decree 356/2025 take effectPersonal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.Vietnam

Takes effectJan 1 · 10 months ago

Virginia VCDPAUnder-16 social media time limit (SB 854) takes effectSocial media platforms must use commercially reasonable age determination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27, 2026 bars enforcement.Virginia

ComplianceJan 10 · 10 months ago

AI state-law preemption EOAI Litigation Task Force dueAttorney General to set up a task force to challenge state AI laws within 30 days of the order (date computed from signing).United States

ReportingJan 10 · 10 months ago

EUEU Political Advertising Regulation (TTPA)Member States notify sanction rulesDeadline for Member States to notify the Commission of their sanction rules under Article 25(3).European Union

Takes effectJan 14 · 9 months ago

TWTaiwan AI Basic ActAI Basic Act in forcePromulgated and in force on the same day (art. 20).Taiwan

Takes effectTentativeJan 18 · 9 months ago

KZKazakhstan AI LawAI Law takes effectThe Law takes effect after 60 calendar days from first official publication on 18 Nov 2025 (art. 31). The day is computed, not stated.Kazakhstan

MilestoneJan 20 · 9 months ago

EUEU Cybersecurity ActCybersecurity Act 2 proposedCommission proposal COM(2026) 11 to repeal and replace the Act, adding ICT supply chain security rules. Now in the ordinary legislative procedure (2026/0011(COD)).European Union

Takes effectTentativeJan 20 · 9 months ago

PEPeru AI Law and RegulationRegulation in forceRegulation enters into force 90 business days after publication. Date computed with national holidays, so tentative.Peru

Takes effectJan 22 · 9 months ago

South Korea AI Basic ActAI Basic Act and Enforcement Decree take effectTransparency, labeling, high-impact AI, and domestic representative obligations apply (fines deferred during the grace period).South Korea

ReportingJan 31 · 9 months ago

California Delete Act / DROPAnnual data broker registration deadlineData brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.California

EnforcementJan 31 · 9 months ago

MNMinnesota Consumer Data Privacy Act (MCDPA)30-day cure period expiresThe requirement that the AG send a warning letter and allow 30 days to cure before suing expires Jan 31, 2026 (325M.20(a)).Minnesota

February 20267

Transition endsFeb 1 · 9 months ago

Colorado AI ActOriginal effective date (superseded)Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.Colorado

Takes effectFeb 5 · 9 months ago

Data (Use and Access) ActStage 3: main data protection changes commenceRecognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).United Kingdom

Takes effectFeb 5 · 9 months ago

UK GDPRDUAA amendments to UK GDPR commenceMain Data (Use and Access) Act 2025 Part 5 amendments (recognised legitimate interests, ADM, DSAR, transfers, cookies, PECR fines) apply.United Kingdom

ComplianceFeb 16 · 8 months ago

HIPAANotice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.United States (Federal)

ComplianceFeb 18 · 8 months ago

EUEU e-Evidence PackageLegal representatives Directive transpositionMember States must transpose Directive (EU) 2023/1544 on designated establishments and legal representatives.European Union

Takes effectFeb 20 · 8 months ago

India IT Rules amendment on synthetic contentSynthetic content rules take effectSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.India

MilestoneFeb 27 · 8 months ago

Virginia VCDPASB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed.Virginia

March 20267

Takes effectMar 1 · 8 months ago

CNChina Minors Online Protection RegulationsClassification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.China

Takes effectMar 1 · 8 months ago

Vietnam AI LawAI Law takes effectRisk classification, transparency and labeling obligations apply to new AI systems.Vietnam

ComplianceMar 4 · 8 months ago

Australia Cyber Security Act (ransomware reporting)Smart device security standard appliesPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable products must meet the security standard.Australia

MilestoneMar 10 · 8 months ago

South Korea PIPA2026 PIPA amendment promulgated (Act No. 21445)Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.South Korea

ComplianceMar 11 · 8 months ago

AI state-law preemption EOCommerce state-law evaluation, BEAD notice and FTC statement dueWithin 90 days of the order: Commerce publishes its list of onerous state AI laws, NTIA issues the BEAD policy notice, and the FTC issues a policy statement (date computed from signing).United States

Takes effectMar 17 · 7 months ago

Brazil ECA DigitalECA Digital in forceArt. 41-A (as set by Law 15.352/2026, following MP 1.319/2025) fixes entry into force on 17 March 2026.Brazil

MilestoneMar 27 · 7 months ago

NY RAISE ActChapter amendment S8828 signedChapter amendment (ch. 96) finalizes the RAISE Act text.New York

April 202610

Takes effectApr 1 · 7 months ago

CNChina Minors Online Protection RegulationsMeasures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.China

Transition endsApr 1 · 7 months ago

Illinois BIPASeventh Circuit: amendment applies retroactivelyClay v. Union Pacific (No. 25-2185) holds the damages amendment is remedial and applies to pending cases.Illinois

Takes effectApr 1 · 7 months ago

Japan Active Cyber Defense ActSupervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.Japan

ComplianceApr 1 · 7 months ago

Maryland Kids CodeData protection impact assessments dueCovered entities must complete DPIAs by this date.Maryland

ComplianceApr 1 · 7 months ago

Maryland Online Data Privacy Act (MODPA)MODPA applies to personal data processingThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).Maryland

SunsetApr 3 · 7 months ago

EUEU CSAM Interim RegulationPrevious interim regulation expiresRegulation (EU) 2021/1232, as extended by Regulation (EU) 2024/1307, applied until this date.European Union

ReportingApr 11 · 7 months ago

UK Online Safety ActFee notification window closes (2026/27)Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.United Kingdom

ReportingApr 15 · 6 months ago

NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.New York

Transition endsApr 21 · 6 months ago

COCoE AI Framework ConventionEU concludes the ConventionCouncil Decision (EU) 2026/1080 approves conclusion on behalf of the EU (published 2026-05-13).Council of Europe

ComplianceApr 22 · 6 months ago

COPPA RuleFull compliance with amended COPPA RuleOperators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated notices); excludes Safe Harbor provisions 312.11(d)(1), (d)(4) and (g), which had earlier dates.United States (Federal)

May 20269

Takes effectMay 1 · 6 months ago

New Zealand Biometric Processing Privacy CodeAmendment No. 1 applies (IPP 3A)The amended code, which reflects IPP 3A, is in force from 1 May 2026.New Zealand

ComplianceMay 1 · 6 months ago

New Zealand Privacy ActIPP 3A indirect-collection notification appliesAgencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.New Zealand

ReportingMay 3 · 6 months ago

EUDigital Markets ActDMA first reviewCommission evaluation of the DMA under Article 53, then every 3 years.European Union

EnforcementMay 6 · 6 months ago

Texas App Store Accountability ActStay pending appeal deniedDistrict court keeps the injunction in place during the state's appeal.Texas

ComplianceMay 6 · 6 months ago

Utah App Store Accountability ActApp store and developer duties applySections 13-75-201 and 13-75-202 take effect.Utah

MilestoneMay 14 · 5 months ago

Colorado AI ActSB 26-189 signed (repeal and reenact)SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.Colorado

MilestoneMay 15 · 5 months ago

Illinois AI in Employment Law (HB 3773)IDHR proposed notice rules publishedIDHR publishes proposed Subpart J rules on AI notice in the Illinois Register.Illinois

ComplianceMay 19 · 5 months ago

TAKE IT DOWN ActPlatform notice-and-removal process requiredCovered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment).United States (Federal)

ComplianceMay 21 · 5 months ago

EUeIDAS 2 / EU Digital Identity WalletLegacy qualified trust service providers conformity reportQTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026.European Union

June 202613

MilestoneJun 2 · 5 months ago

Illinois AI in Employment Law (HB 3773)IDHR withdraws and postpones proposed rulesIDHR withdraws the Subpart J proposal and postpones the June 10, 2026 hearing; no new date announced.Illinois

ComplianceJun 3 · 5 months ago

SEC Regulation S-PSmaller entities must complySmaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.United States (Federal)

ComplianceJun 11 · 5 months ago

CAAlberta POPAPrivacy management programs requiredPublic bodies must establish and implement a privacy management program one year after the section comes into force (s. 25(5)).Alberta, Canada

Takes effectJun 11 · 5 months ago

EUCyber Resilience ActConformity assessment body provisions applyChapter IV (Arts 35-51, notification of conformity assessment bodies) applies (Art 71(2)).European Union

MilestoneJun 15 · 4 months ago

Canada Bill C-36 (PPCDA)Bill C-36 tabled (first reading)Government introduces the PPCDA in the House of Commons.Canada

MilestoneJun 15 · 4 months ago

Canada Bill C-8 / CCSPARoyal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.Canada

MilestoneJun 16 · 4 months ago

UK Cyber Security and Resilience BillPasses House of CommonsReport stage and third reading completed in the Commons after carry-over into the new session.United Kingdom

ComplianceJun 19 · 4 months ago

Data (Use and Access) ActMandatory data protection complaints procedureControllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.United Kingdom

Takes effectJun 29 · 4 months ago

SGSingapore Online Safety (Relief and Accountability) ActOSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.Singapore

MilestoneTentativeJun 30 · 4 months ago

CFPB Open Banking Rule (Section 1033)First compliance date (stayed, enjoined)Largest data providers (banks with $250B or more in assets; nondepositories with $10B or more in receipts). Originally 2026-04-01, moved 90 days by court stay. Not enforceable while the injunction stands.United States

Transition endsJun 30 · 4 months ago

Colorado AI ActDelayed effective date (superseded)SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.Colorado

Takes effectJun 30 · 4 months ago

New Jersey NJDPAA5328 sensitive data sale ban takes effectA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.New Jersey

Takes effectJun 30 · 4 months ago

UAE Child Digital Safety LawSocial media minimum age resolution takes effectCabinet Resolution No. 106 of 2026 applies from the day after publication in Official Gazette No. 826 on 29 June 2026.United Arab Emirates

July 202617

Takes effectJul 1 · 4 months ago

ARArkansas COPPA 2.0Takes effectSection 3: effective on and after July 1, 2026.Arkansas

Takes effectJul 1 · 4 months ago

Connecticut Data Privacy Act (CTDPA)PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure in privacy notices.Connecticut

Takes effectJul 1 · 4 months ago

LALouisiana app store age verification lawTakes effectSection 5: act effective July 1, 2026.Louisiana

Takes effectJul 1 · 4 months ago

Malaysia Online Safety ActOnline Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia

EnforcementJul 1 · 4 months ago

Nebraska Kids CodeCivil penalties availableAG may begin actions to recover civil penalties.Nebraska

EnforcementJul 1 · 4 months ago

New Jersey NJDPAMandatory 30-day cure period expiresThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b)).New Jersey

Takes effectJul 1 · 4 months ago

Utah UCPARight to correct takes effectConsumers may ask controllers to correct inaccurate personal data (13-61-201(4), as amended by Laws 2025, ch. 468).Utah

Takes effectJul 1 · 4 months ago

Vietnam Cybersecurity Law 2025Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam

Takes effectJul 1 · 4 months ago

Virginia VCDPABan on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.Virginia

Transition endsJul 7 · 4 months ago

AI state-law preemption EOFTC proposes AI accuracy policy statementFTC publishes a proposed policy statement on deceptive suppression of accuracy in AI systems (91 FR 41638), linked to Section 7 of the EO.United States

Takes effectJul 15 · 3 months ago

CNChina Anthropomorphic AI MeasuresAnthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.China

MilestoneJul 17 · 3 months ago

Japan APPI2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.Japan

Transition endsJul 27 · 3 months ago

EUEU AI ActDigital Omnibus on AI enters into forceRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply from this date (new Art 113(d)).European Union

Transition endsJul 28 · 3 months ago

NY SAFE for Kids ActFinal SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York

MilestoneJul 29 · 3 months ago

NY SAFE for Kids ActRules published in State RegisterStarts the 180-day clock.New York

ReportingJul 31 · 3 months ago

AI state-law preemption EOFTC policy statement comments closeComment deadline on the proposed FTC AI policy statement.United States

Takes effectJul 31 · 3 months ago

EUEU CSAM Interim RegulationNew interim regulation enters into forcePublished in the OJ on 2026-07-28; enters into force on the third day.European Union

August 20268

ComplianceAug 1 · 3 months ago

California Delete Act / DROPData brokers must begin processing DROP deletion requestsBrokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of sale/sharing.California

ComplianceAug 1 · 3 months ago

Connecticut Data Privacy Act (CTDPA)Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended).Connecticut

Takes effectAug 2 · 3 months ago

California AI Transparency Act (SB 942)Covered provider duties applyDetection tool, manifest and latent disclosures, and license-revocation duties become operative.California

Takes effectAug 2 · 3 months ago

EUEU AI ActGeneral application: transparency obligations, GPAI fines, most other rulesThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and Commission fines on GPAI providers (Art 101) apply. Not deferred by the Omnibus.European Union

Transition endsAug 3 · 3 months ago

New Zealand Biometric Processing Privacy CodeGrace period ends for existing biometric processingAgencies already using biometrics before the code started must comply by this date.New Zealand

Takes effectAug 18 · 2 months ago

EUEU e-Evidence Packagee-Evidence Regulation appliesEuropean Production and Preservation Orders become available.European Union

Takes effectAug 20 · 2 months ago

CNChina Data Security Risk Assessment MeasuresRisk assessment measures take effectAnnual risk assessment and reporting duties for important data handlers apply.China

EnforcementAug 31 · 57 days ago

EUDigital Services ActChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.European Union

September 202610

Takes effectSep 1 · 56 days ago

CNChina Small PI Handler Simplified MeasuresSimplified measures for small handlers take effectSmall handlers may use simplified notice, audit and assessment methods.China

MilestoneSep 9 · 48 days ago

California AI Auditor RegistrySigned by GovernorChaptered as Chapter 178, Statutes of 2026.California

MilestoneUnverifiedSep 9 · 48 days ago

California Senate Bill 813Signed by GovernorGovernor Gavin Newsom signed Senate Bill 813, establishing a framework for independent verification organizations to assess AI systems and models for compliance with state law.California

ComplianceTentativeSep 10 · 47 days ago

PEPeru AI Law and RegulationPrivate sector: health, education, justice, security, financeHigh-risk and related obligations apply one year after publication for these sectors.Peru

ReportingSep 11 · 46 days ago

EUCyber Resilience ActVulnerability and incident reporting obligations applyArt 14: manufacturers must report actively exploited vulnerabilities and severe incidents (24-hour early warning, 72-hour notification) via the single reporting platform. Also covers products placed on the market before 11 Dec 2027 (Art 69(3)).European Union

Takes effectSep 11 · 46 days ago

South Korea PIPA2026 PIPA amendments take effect10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.South Korea

EnforcementSep 12 · 45 days ago

Australia Social Media Minimum AgeStrengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.Australia

ComplianceSep 12 · 45 days ago

EUEU Data ActAccess-by-design for new connected productsArt 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services placed on the market after 12 Sep 2026.European Union

ComplianceSep 16 · 41 days ago

THThailand Cybersecurity ActWebsite Security Standard B.E. 2568 enforcedThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.Thailand

Takes effectSep 30 · 27 days ago

Data (Use and Access) ActICO abolished; Information Commission takes overSections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).United Kingdom

October 20263

Takes effectOct 1 · 26 days ago

Connecticut Data Privacy Act (CTDPA)PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.Connecticut

ComplianceOct 1 · 26 days ago

Japan Active Cyber Defense ActRegistration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified intrusion incidents.Japan

MilestoneTentativeOct 26 · yesterday

UK Cyber Security and Resilience BillLords report stage scheduledHouse of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).United Kingdom

November 20265

ComplianceTentativeNov 2 · in 6 days

EGEgypt PDPLOne-year compliance window endsArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so this date is counted from publication and is an estimate.Egypt

ComplianceNov 10 · in 14 days

CMMC 2.0Phase 2: Level 2 C3PAO certificationPhase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).United States (Federal)

Transition endsNov 13 · in 17 days

India DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.India

Takes effectNov 20 · in 24 days

EUEU Consumer Credit Directive 2 (CCD2)National rules applyMember States must apply the transposing measures from this date and the 2008 Directive is repealed.European Union

ComplianceNov 30 · in 34 days

PEPeru PDPL and 2024 RegulationDPO required: medium companiesCompanies with annual sales above 1,700 UIT up to 2,300 UIT.Peru

December 20269

Takes effectDec 1 · in 35 days

CLChile Personal Data Protection Law (Ley 21.719)Law in forceMain obligations apply and the Personal Data Protection Agency begins supervision.Chile

ComplianceDec 2 · in 36 days

EUEU AI ActNew bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).European Union

ComplianceDec 2 · in 36 days

EUEU Platform Work DirectiveTransposition deadlineMember States must bring national laws into force to comply with the Directive (Article 29).European Union

Transition endsDec 9 · in 43 days

EUProduct Liability DirectiveTransposition deadline; old PLD repealedMember States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).European Union

ComplianceDec 10 · in 44 days

Australia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.Australia

ComplianceDec 10 · in 44 days

Australia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).Australia

ComplianceDec 24 · in 58 days

EUeIDAS 2 / EU Digital Identity WalletMember States must provide EU Digital Identity WalletsEach Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).European Union

ComplianceDec 28 · in 2 months

Malaysia Online Safety ActOnline Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.Malaysia

EnforcementDec 31 · in 2 months

Utah App Store Accountability ActPrivate right of action beginsSection 13-75-401 takes effect.Utah