Data, privacy and AI regulations, deadline by deadline.

Data (Use and Access) ActUnited Kingdom

ICO abolished; Information Commission takes over

Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).

Connecticut Data Privacy Act (CTDPA)Connecticut

PA 26-64 (SB 4) amendments take effect

Prohibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.

UK Cyber Security and Resilience BillUnited Kingdom

Lords report stage scheduled

House of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).

CMMC 2.0United States (Federal)

Phase 2: Level 2 C3PAO certification

Phase 2 begins one calendar year after Phase 1; applicable solicitations require CMMC Level 2 third-party (C3PAO) certification (32 CFR 170.3(e)(2)).

India DPDP ActIndia

Consent Manager registration rule in force (12 months)

Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.

Law in force

Main obligations apply and the Personal Data Protection Agency begins supervision.

New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends

New Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).

Transposition deadline; old PLD repealed

Member States must transpose by 9 Dec 2026 (Art 22). Directive 85/374/EEC is repealed from that date but still applies to products placed on the market before it (Art 21).

Australia Privacy ActAustralia

Children's Online Privacy Code must be registered

OAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.

Australia Privacy ActAustralia

Automated decision-making transparency applies

Privacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).

Member States must provide EU Digital Identity Wallets

Each Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).

California AI Transparency Act (SB 942)California

Large online platform and hosting platform duties

Large online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.