BEGIN:VCALENDAR VERSION:2.0 PRODID:-//fru.dev//Rulebook//EN CALSCALE:GREGORIAN METHOD:PUBLISH X-WR-CALNAME:Regulation deadlines (Rulebook) X-WR-CALDESC:Compliance deadlines tracked at rulebook.fru.dev REFRESH-INTERVAL;VALUE=DURATION:P1D X-PUBLISHED-TTL:P1D BEGIN:VEVENT UID:deadline-18@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20010101 DTEND;VALUE=DATE:20010102 SUMMARY:PIPEDA: PIPEDA Part 1 in force (phase 1) DESCRIPTION:Applies to federally regulated organisations.\n\nPersonal Infor mation Protection and Electronic Documents Act (Canada)\n\nSource: https:/ /laws-lois.justice.gc.ca/eng/acts/p-8.6/\n\nhttps://rulebook.fru.dev/regul ations/ca-pipeda URL:https://rulebook.fru.dev/regulations/ca-pipeda CATEGORIES:Canada,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-90@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20020731 DTEND;VALUE=DATE:20020801 SUMMARY:ePrivacy Directive (cookie law): ePrivacy Directive enters into for ce DESCRIPTION:Entered into force on the day of publication in the OJ (Art 20) .\n\nDirective 2002/58/EC concerning the processing of personal data and t he protection of privacy in the electronic communications sector (ePrivacy Directive)\, as amended by Directive 2009/136/EC (European Union)\n\nSour ce: https://eur-lex.europa.eu/eli/dir/2002/58/oj\n\nhttps://rulebook.fru.d ev/regulations/eu-eprivacy URL:https://rulebook.fru.dev/regulations/eu-eprivacy CATEGORIES:European Union,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-91@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20031031 DTEND;VALUE=DATE:20031101 SUMMARY:ePrivacy Directive (cookie law): Original transposition deadline DESCRIPTION:Member States had to bring national laws into force before 31 O ct 2003 (Art 17).\n\nDirective 2002/58/EC concerning the processing of per sonal data and the protection of privacy in the electronic communications sector (ePrivacy Directive)\, as amended by Directive 2009/136/EC (Europea n Union)\n\nSource: https://eur-lex.europa.eu/eli/dir/2002/58/oj\n\nhttps: //rulebook.fru.dev/regulations/eu-eprivacy URL:https://rulebook.fru.dev/regulations/eu-eprivacy CATEGORIES:European Union,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-19@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20040101 DTEND;VALUE=DATE:20040102 SUMMARY:PIPEDA: PIPEDA applies to all commercial activity DESCRIPTION:Extended to commercial activity in provinces without substantia lly similar legislation.\n\nPersonal Information Protection and Electronic Documents Act (Canada)\n\nSource: https://laws-lois.justice.gc.ca/eng/act s/p-8.6/\n\nhttps://rulebook.fru.dev/regulations/ca-pipeda URL:https://rulebook.fru.dev/regulations/ca-pipeda CATEGORIES:Canada,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-241@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20081003 DTEND;VALUE=DATE:20081004 SUMMARY:Illinois BIPA: BIPA effective DESCRIPTION:The Biometric Information Privacy Act takes effect.\n\nIllinois Biometric Information Privacy Act (740 ILCS 14)\, as amended by SB 2979 ( Public Act 103-0769) (Illinois)\n\nSource: https://www.ilga.gov/legislatio n/ilcs/ilcs3.asp?ActID=3004&ChapterID=57\n\nhttps://rulebook.fru.dev/regul ations/us-il-bipa URL:https://rulebook.fru.dev/regulations/us-il-bipa CATEGORIES:Illinois,biometrics,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-231@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20100222 DTEND;VALUE=DATE:20100223 SUMMARY:FTC Health Breach Notification Rule: Full compliance with original Rule DESCRIPTION:Full compliance with the 2009 Health Breach Notification Rule w as required.\n\nFTC Health Breach Notification Rule (16 CFR Part 318)\, as amended 2024 (United States (Federal))\n\nSource: https://www.federalregi ster.gov/citation/74-FR-42962\n\nhttps://rulebook.fru.dev/regulations/us-f tc-hbnr URL:https://rulebook.fru.dev/regulations/us-ftc-hbnr CATEGORIES:United States (Federal),health,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-92@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20110525 DTEND;VALUE=DATE:20110526 SUMMARY:ePrivacy Directive (cookie law): Cookie consent amendment transposi tion deadline DESCRIPTION:Directive 2009/136/EC\, which changed Art 5(3) to require conse nt for cookies\, had to be transposed by 25 May 2011.\n\nDirective 2002/58 /EC concerning the processing of personal data and the protection of priva cy in the electronic communications sector (ePrivacy Directive)\, as amend ed by Directive 2009/136/EC (European Union)\n\nSource: https://eur-lex.eu ropa.eu/eli/dir/2009/136/oj\n\nhttps://rulebook.fru.dev/regulations/eu-epr ivacy URL:https://rulebook.fru.dev/regulations/eu-eprivacy CATEGORIES:European Union,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-139@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20140702 DTEND;VALUE=DATE:20140703 SUMMARY:Singapore PDPA: PDPA data protection obligations take effect DESCRIPTION:Main data protection provisions come into force.\n\nPersonal Da ta Protection Act 2012 (Singapore) (Singapore)\n\nSource: https://sso.agc. gov.sg/Act/PDPA2012\n\nhttps://rulebook.fru.dev/regulations/sg-pdpa URL:https://rulebook.fru.dev/regulations/sg-pdpa CATEGORIES:Singapore,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-93@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20160524 DTEND;VALUE=DATE:20160525 SUMMARY:GDPR: GDPR enters into force DESCRIPTION:Regulation entered into force on the twentieth day after public ation in OJ L 119 of 4 May 2016 (Art 99(1)).\n\nRegulation (EU) 2016/679 ( General Data Protection Regulation) (European Union)\n\nSource: https://eu r-lex.europa.eu/eli/reg/2016/679/oj\n\nhttps://rulebook.fru.dev/regulation s/eu-gdpr URL:https://rulebook.fru.dev/regulations/eu-gdpr CATEGORIES:European Union,privacy,breach-notification,data-access,children, biometrics,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-31@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20170601 DTEND;VALUE=DATE:20170602 SUMMARY:China Cybersecurity Law: Cybersecurity Law takes effect DESCRIPTION:Original CSL obligations for network operators and CII operator s apply.\n\nCybersecurity Law of the People's Republic of China (as amende d by the NPC Standing Committee Decision of 28 October 2025) (China)\n\nSo urce: https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm\n\nhttp s://rulebook.fru.dev/regulations/cn-csl URL:https://rulebook.fru.dev/regulations/cn-csl CATEGORIES:China,cybersecurity,data-residency,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-94@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20180525 DTEND;VALUE=DATE:20180526 SUMMARY:GDPR: GDPR applies DESCRIPTION:All GDPR obligations apply from 25 May 2018 (Art 99(2))\, repla cing Directive 95/46/EC.\n\nRegulation (EU) 2016/679 (General Data Protect ion Regulation) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/ reg/2016/679/oj\n\nhttps://rulebook.fru.dev/regulations/eu-gdpr URL:https://rulebook.fru.dev/regulations/eu-gdpr CATEGORIES:European Union,privacy,breach-notification,data-access,children, biometrics,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-153@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20180525 DTEND;VALUE=DATE:20180526 SUMMARY:UK GDPR: Data Protection Act 2018 and GDPR apply DESCRIPTION:DPA 2018 and EU GDPR began applying in the UK.\n\nUK General Da ta Protection Regulation and Data Protection Act 2018 (United Kingdom)\n\n Source: https://www.legislation.gov.uk/ukpga/2018/12/contents\n\nhttps://r ulebook.fru.dev/regulations/uk-gdpr URL:https://rulebook.fru.dev/regulations/uk-gdpr CATEGORIES:United Kingdom,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-20@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20181101 DTEND;VALUE=DATE:20181102 SUMMARY:PIPEDA: Mandatory breach reporting DESCRIPTION:Breach of security safeguards reporting\, notification and reco rd-keeping obligations take effect.\n\nPersonal Information Protection and Electronic Documents Act (Canada)\n\nSource: https://laws-lois.justice.gc .ca/eng/acts/p-8.6/\n\nhttps://rulebook.fru.dev/regulations/ca-pipeda URL:https://rulebook.fru.dev/regulations/ca-pipeda CATEGORIES:Canada,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-123@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20191125 DTEND;VALUE=DATE:20191126 SUMMARY:Kenya Data Protection Act: Data Protection Act in force DESCRIPTION:Act commences.\n\nData Protection Act\, 2019 (No. 24 of 2019) ( Kenya)\n\nSource: https://www.odpc.go.ke/\n\nhttps://rulebook.fru.dev/regu lations/ke-dpa URL:https://rulebook.fru.dev/regulations/ke-dpa CATEGORIES:Kenya,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-164@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20200101 DTEND;VALUE=DATE:20200102 SUMMARY:CCPA / CPRA: CCPA takes effect DESCRIPTION:Original CCPA consumer rights and business obligations take eff ect.\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the Califo rnia Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\n\nSour ce: https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf\n\nh ttps://rulebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-325@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20200701 DTEND;VALUE=DATE:20200702 SUMMARY:South Africa POPIA: Main POPIA provisions commence DESCRIPTION:Most sections commence with a 12-month grace period.\n\nProtect ion of Personal Information Act\, 2013 (Act No. 4 of 2013) (South Africa)\ n\nSource: https://www.gov.za/documents/protection-personal-information-ac t\n\nhttps://rulebook.fru.dev/regulations/za-popia URL:https://rulebook.fru.dev/regulations/za-popia CATEGORIES:South Africa,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-11@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20200918 DTEND;VALUE=DATE:20200919 SUMMARY:Brazil LGPD: LGPD in force DESCRIPTION:Main LGPD provisions take effect.\n\nLei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018) (Brazil)\n\nSource: https://www.plan alto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm\n\nhttps://ruleboo k.fru.dev/regulations/br-lgpd URL:https://rulebook.fru.dev/regulations/br-lgpd CATEGORIES:Brazil,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-134@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20201201 DTEND;VALUE=DATE:20201202 SUMMARY:New Zealand Privacy Act: Privacy Act 2020 in force DESCRIPTION:IPPs\, mandatory breach notification and compliance notices app ly.\n\nPrivacy Act 2020 (New Zealand)\, as amended by the Privacy Amendmen t Act 2025 (New Zealand)\n\nSource: https://www.justice.govt.nz/justice-se ctor-policy/key-initiatives/enhancing-the-privacy-act/\n\nhttps://rulebook .fru.dev/regulations/nz-privacy-act URL:https://rulebook.fru.dev/regulations/nz-privacy-act CATEGORIES:New Zealand,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-154@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20210101 DTEND;VALUE=DATE:20210102 SUMMARY:UK GDPR: UK GDPR takes effect after Brexit transition DESCRIPTION:Retained EU GDPR becomes the UK GDPR at the end of the Brexit i mplementation period.\n\nUK General Data Protection Regulation and Data Pr otection Act 2018 (United Kingdom)\n\nSource: https://www.legislation.gov. uk/eur/2016/679/contents\n\nhttps://rulebook.fru.dev/regulations/uk-gdpr URL:https://rulebook.fru.dev/regulations/uk-gdpr CATEGORIES:United Kingdom,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-140@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20210201 DTEND;VALUE=DATE:20210202 SUMMARY:Singapore PDPA: 2020 amendments largely in force DESCRIPTION:Mandatory data breach notification and revised consent framewor k apply.\n\nPersonal Data Protection Act 2012 (Singapore) (Singapore)\n\nS ource: https://sso.agc.gov.sg/Act/PDPA2012\n\nhttps://rulebook.fru.dev/reg ulations/sg-pdpa URL:https://rulebook.fru.dev/regulations/sg-pdpa CATEGORIES:Singapore,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-326@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20210701 DTEND;VALUE=DATE:20210702 SUMMARY:South Africa POPIA: Compliance grace period ends DESCRIPTION:Responsible parties must comply\; Regulator enforcement begins (grace period ended 30 June 2021).\n\nProtection of Personal Information A ct\, 2013 (Act No. 4 of 2013) (South Africa)\n\nSource: https://www.gov.za /documents/protection-personal-information-act\n\nhttps://rulebook.fru.dev /regulations/za-popia URL:https://rulebook.fru.dev/regulations/za-popia CATEGORIES:South Africa,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-12@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20210801 DTEND;VALUE=DATE:20210802 SUMMARY:Brazil LGPD: ANPD sanctions enforceable DESCRIPTION:Administrative sanctions (Arts. 52-54) become applicable per La w 14.010/2020.\n\nLei Geral de Proteção de Dados Pessoais (Law No. 13.70 9/2018) (Brazil)\n\nSource: https://www.planalto.gov.br/ccivil_03/_ato2015 -2018/2018/lei/l13709.htm\n\nhttps://rulebook.fru.dev/regulations/br-lgpd URL:https://rulebook.fru.dev/regulations/br-lgpd CATEGORIES:Brazil,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-21@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20210922 DTEND;VALUE=DATE:20210923 SUMMARY:Quebec Law 25: Assent DESCRIPTION:Bill 64 assented to as S.Q. 2021\, c. 25.\n\nAct to modernize l egislative provisions as regards the protection of personal information (L aw 25\, formerly Bill 64) (Quebec\, Canada)\n\nSource: https://www.legisqu ebec.gouv.qc.ca/en/document/cs/P-39.1\n\nhttps://rulebook.fru.dev/regulati ons/ca-qc-law25 URL:https://rulebook.fru.dev/regulations/ca-qc-law25 CATEGORIES:Quebec\, Canada,privacy,breach-notification,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-36@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20211101 DTEND;VALUE=DATE:20211102 SUMMARY:China PIPL: PIPL takes effect DESCRIPTION:All PIPL obligations (legal bases\, consent\, cross-border rule s\, data subject rights) apply (Art. 74).\n\nPersonal Information Protecti on Law of the People's Republic of China (China)\n\nSource: http://www.cac .gov.cn/2021-08/20/c_1631050028355286.htm\n\nhttps://rulebook.fru.dev/regu lations/cn-pipl URL:https://rulebook.fru.dev/regulations/cn-pipl CATEGORIES:China,privacy,data-residency,biometrics,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-1@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220102 DTEND;VALUE=DATE:20220103 SUMMARY:UAE PDPL: PDPL enters into force DESCRIPTION:Decree-law takes effect\; compliance obligations tied to Execut ive Regulations.\n\nFederal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates)\n\nSource: https://uaelegislation.go v.ae/en/legislations/1972\n\nhttps://rulebook.fru.dev/regulations/ae-pdpl URL:https://rulebook.fru.dev/regulations/ae-pdpl CATEGORIES:United Arab Emirates,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-233@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220110 DTEND;VALUE=DATE:20220111 SUMMARY:GLBA Safeguards Rule: 2021 Safeguards Rule amendments effective DESCRIPTION:The amended Safeguards Rule published December 9\, 2021 took ef fect\, with the more detailed program elements in 314.5 deferred.\n\nFTC S tandards for Safeguarding Customer Information (Safeguards Rule)\, 16 CFR Part 314\, under the Gramm-Leach-Bliley Act (United States (Federal))\n\nS ource: https://www.federalregister.gov/documents/2021/12/09/2021-25736/sta ndards-for-safeguarding-customer-information\n\nhttps://rulebook.fru.dev/r egulations/us-glba-safeguards URL:https://rulebook.fru.dev/regulations/us-glba-safeguards CATEGORIES:United States (Federal),financial,cybersecurity,breach-notificat ion,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-121@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220401 DTEND;VALUE=DATE:20220402 SUMMARY:Japan APPI: 2020 amendments in force DESCRIPTION:Mandatory breach reporting\, pseudonymized information and stri cter cross-border rules apply.\n\nAct on the Protection of Personal Inform ation (Act No. 57 of 2003)\, as amended including the 2026 amendment act ( Japan)\n\nSource: https://www.ppc.go.jp/en/legal/\n\nhttps://rulebook.fru. dev/regulations/jp-appi URL:https://rulebook.fru.dev/regulations/jp-appi CATEGORIES:Japan,privacy,children,biometrics,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-142@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220601 DTEND;VALUE=DATE:20220602 SUMMARY:Thailand PDPA: PDPA main obligations take effect DESCRIPTION:Core data protection obligations and penalties apply after post ponement Royal Decrees.\n\nPersonal Data Protection Act B.E. 2562 (2019) ( Thailand)\n\nSource: https://www.ratchakitcha.soc.go.th/DATA/PDF/2562/A/06 9/T_0052.PDF\n\nhttps://rulebook.fru.dev/regulations/th-pdpa URL:https://rulebook.fru.dev/regulations/th-pdpa CATEGORIES:Thailand,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-63@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220623 DTEND;VALUE=DATE:20220624 SUMMARY:Data Governance Act: DGA enters into force DESCRIPTION:Entered into force on the twentieth day after publication in OJ L 152 of 3 June 2022 (Art 38).\n\nRegulation (EU) 2022/868 on European da ta governance (Data Governance Act) (European Union)\n\nSource: https://eu r-lex.europa.eu/eli/reg/2022/868/oj\n\nhttps://rulebook.fru.dev/regulation s/eu-dga URL:https://rulebook.fru.dev/regulations/eu-dga CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-22@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20220922 DTEND;VALUE=DATE:20220923 SUMMARY:Quebec Law 25: Phase 1: privacy officer and incident reporting DESCRIPTION:Person in charge of personal information protection\, confident iality incident notification and register apply.\n\nAct to modernize legis lative provisions as regards the protection of personal information (Law 2 5\, formerly Bill 64) (Quebec\, Canada)\n\nSource: https://www.legisquebec .gouv.qc.ca/en/document/cs/P-39.1\n\nhttps://rulebook.fru.dev/regulations/ ca-qc-law25 URL:https://rulebook.fru.dev/regulations/ca-qc-law25 CATEGORIES:Quebec\, Canada,privacy,breach-notification,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-141@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20221001 DTEND;VALUE=DATE:20221002 SUMMARY:Singapore PDPA: Higher financial penalty cap applies DESCRIPTION:Maximum penalty rises to 10% of Singapore turnover for organiza tions with turnover above SGD 10 million.\n\nPersonal Data Protection Act 2012 (Singapore) (Singapore)\n\nSource: https://sso.agc.gov.sg/Act/PDPA201 2\n\nhttps://rulebook.fru.dev/regulations/sg-pdpa URL:https://rulebook.fru.dev/regulations/sg-pdpa CATEGORIES:Singapore,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-112@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20221017 DTEND;VALUE=DATE:20221018 SUMMARY:Indonesia PDP Law: PDP Law enacted and in force DESCRIPTION:Law takes effect on enactment\, starting a 2-year transition.\n \nLaw No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindunga n Data Pribadi) (Indonesia)\n\nSource: https://peraturan.bpk.go.id/Details /229798/uu-no-27-tahun-2022\n\nhttps://rulebook.fru.dev/regulations/id-pdp URL:https://rulebook.fru.dev/regulations/id-pdp CATEGORIES:Indonesia,privacy,breach-notification,data-residency,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-66@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20221101 DTEND;VALUE=DATE:20221102 SUMMARY:Digital Markets Act: DMA enters into force DESCRIPTION:Entered into force twenty days after publication\; certain proc edural articles apply from this date (Art 54).\n\nRegulation (EU) 2022/192 5 on contestable and fair markets in the digital sector (Digital Markets A ct) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2022/192 5/oj\n\nhttps://rulebook.fru.dev/regulations/eu-dma URL:https://rulebook.fru.dev/regulations/eu-dma CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-75@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20221116 DTEND;VALUE=DATE:20221117 SUMMARY:Digital Services Act: DSA enters into force DESCRIPTION:Entered into force twenty days after publication\; VLOP designa tion provisions (Art 33(3)-(6)) and Commission enforcement sections apply from this date (Art 93).\n\nRegulation (EU) 2022/2065 on a Single Market f or Digital Services (Digital Services Act) (European Union)\n\nSource: htt ps://eur-lex.europa.eu/eli/reg/2022/2065/oj\n\nhttps://rulebook.fru.dev/re gulations/eu-dsa URL:https://rulebook.fru.dev/regulations/eu-dsa CATEGORIES:European Union,online-safety,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-165@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230101 DTEND;VALUE=DATE:20230102 SUMMARY:CCPA / CPRA: CPRA amendments operative DESCRIPTION:CPRA amendments (correction right\, sensitive PI limits\, shari ng opt-out\, employee/B2B data coverage) become operative.\n\nCalifornia C onsumer Privacy Act of 2018\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. C ode Regs. tit. 11\, 7000 et seq.) (California)\n\nSource: https://cppa.ca. gov/regulations/pdf/ccpa_statute_eff_20260101.pdf\n\nhttps://rulebook.fru. dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-311@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230101 DTEND;VALUE=DATE:20230102 SUMMARY:Virginia VCDPA: VCDPA takes effect DESCRIPTION:VCDPA obligations and consumer rights apply.\n\nVirginia Consum er Data Protection Act (SB 1392 / HB 2307\, 2021) (Virginia)\n\nSource: ht tps://law.lis.virginia.gov/vacode/title59.1/chapter53/\n\nhttps://rulebook .fru.dev/regulations/us-va-vcdpa URL:https://rulebook.fru.dev/regulations/us-va-vcdpa CATEGORIES:Virginia,privacy,children,online-safety TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-76@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230217 DTEND;VALUE=DATE:20230218 SUMMARY:Digital Services Act: Platforms publish EU user numbers DESCRIPTION:Online platforms and search engines had to publish average mont hly active EU recipients\, and must update them at least every six months (Art 24(2)).\n\nRegulation (EU) 2022/2065 on a Single Market for Digital S ervices (Digital Services Act) (European Union)\n\nSource: https://eur-lex .europa.eu/eli/reg/2022/2065/oj\n\nhttps://rulebook.fru.dev/regulations/eu -dsa URL:https://rulebook.fru.dev/regulations/eu-dsa CATEGORIES:European Union,online-safety,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-77@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230425 DTEND;VALUE=DATE:20230426 SUMMARY:Digital Services Act: First VLOP/VLOSE designations DESCRIPTION:Commission designated the first 19 very large online platforms and search engines (e.g. Amazon Store\, Facebook\, Google Search\, TikTok\ , X). Obligations apply four months after notification.\n\nRegulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act) (European Union)\n\nSource: https://digital-strategy.ec.europa.eu/en/polic ies/list-designated-vlops-and-vloses\n\nhttps://rulebook.fru.dev/regulatio ns/eu-dsa URL:https://rulebook.fru.dev/regulations/eu-dsa CATEGORIES:European Union,online-safety,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-317@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230427 DTEND;VALUE=DATE:20230428 SUMMARY:Washington My Health My Data Act: HB 1155 signed DESCRIPTION:Governor signs My Health My Data Act.\n\nWashington My Health M y Data Act (HB 1155\, Laws of 2023\, ch. 191\; RCW 19.373) (Washington)\n\ nSource: https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023\n\nh ttps://rulebook.fru.dev/regulations/us-wa-mhmda URL:https://rulebook.fru.dev/regulations/us-wa-mhmda CATEGORIES:Washington,health,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-67@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230502 DTEND;VALUE=DATE:20230503 SUMMARY:Digital Markets Act: DMA applies DESCRIPTION:DMA becomes applicable\; undertakings meeting thresholds must n otify the Commission within two months (Arts 3(3)\, 54).\n\nRegulation (EU ) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/re g/2022/1925/oj\n\nhttps://rulebook.fru.dev/regulations/eu-dma URL:https://rulebook.fru.dev/regulations/eu-dma CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-234@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230609 DTEND;VALUE=DATE:20230610 SUMMARY:GLBA Safeguards Rule: Compliance with expanded security program ele ments DESCRIPTION:Applicability of the 314.5 provisions (qualified individual\, w ritten risk assessment\, encryption\, MFA\, pen testing\, incident respons e plan\, board reporting) was delayed from December 9\, 2022 to this date. \n\nFTC Standards for Safeguarding Customer Information (Safeguards Rule)\ , 16 CFR Part 314\, under the Gramm-Leach-Bliley Act (United States (Feder al))\n\nSource: https://www.federalregister.gov/documents/2022/11/23/2022- 25201/standards-for-safeguarding-customer-information\n\nhttps://rulebook. fru.dev/regulations/us-glba-safeguards URL:https://rulebook.fru.dev/regulations/us-glba-safeguards CATEGORIES:United States (Federal),financial,cybersecurity,breach-notificat ion,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-132@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230612 DTEND;VALUE=DATE:20230613 SUMMARY:Nigeria NDPA: NDPA signed into law DESCRIPTION:President signs the Nigeria Data Protection Act\, 2023.\n\nNige ria Data Protection Act\, 2023 and NDPA General Application and Implementa tion Directive (GAID) 2025 (Nigeria)\n\nSource: https://ndpc.gov.ng/resour ces/\n\nhttps://rulebook.fru.dev/regulations/ng-ndpa URL:https://rulebook.fru.dev/regulations/ng-ndpa CATEGORIES:Nigeria,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-207@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230701 DTEND;VALUE=DATE:20230702 SUMMARY:Colorado Privacy Act (CPA): CPA takes effect DESCRIPTION:Core consumer rights and controller duties apply.\n\nColorado P rivacy Act (SB 21-190)\, C.R.S. 6-1-1301 et seq.\, as amended by HB 24-113 0\, SB 24-041 and SB 25-276 (Colorado)\n\nSource: https://leg.colorado.gov /bills/sb21-190\n\nhttps://rulebook.fru.dev/regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-215@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230701 DTEND;VALUE=DATE:20230702 SUMMARY:Connecticut Data Privacy Act (CTDPA): CTDPA takes effect DESCRIPTION:Core consumer rights and controller obligations apply.\n\nConne cticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et se q.\, as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Connecticut)\n\nSource: https://www.cga.ct.gov/asp/cgabillstatus/cgabill status.asp?selBillType=Bill&which_year=2022&bill_num=6\n\nhttps://rulebook .fru.dev/regulations/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-108@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230710 DTEND;VALUE=DATE:20230711 SUMMARY:EU-US Data Privacy Framework: DPF adequacy decision adopted and eff ective DESCRIPTION:Commission adopted Implementing Decision (EU) 2023/1795\, effec tive on notification to Member States\; EU-US transfers to DPF-certified o rganisations may proceed without additional safeguards.\n\nCommission Impl ementing Decision (EU) 2023/1795 on the adequate level of protection of pe rsonal data under the EU-US Data Privacy Framework (European Union)\n\nSou rce: https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj\n\nhttps://rulebo ok.fru.dev/regulations/eu-us-dpf URL:https://rulebook.fru.dev/regulations/eu-us-dpf CATEGORIES:European Union,privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-318@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230723 DTEND;VALUE=DATE:20230724 SUMMARY:Washington My Health My Data Act: Geofencing ban (Section 10) effec tive DESCRIPTION:Ban on geofencing around health care facilities applies to all persons.\n\nWashington My Health My Data Act (HB 1155\, Laws of 2023\, ch. 191\; RCW 19.373) (Washington)\n\nSource: https://www.atg.wa.gov/protecti ng-washingtonians-personal-health-data-and-privacy\n\nhttps://rulebook.fru .dev/regulations/us-wa-mhmda URL:https://rulebook.fru.dev/regulations/us-wa-mhmda CATEGORIES:Washington,health,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-25@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230901 DTEND;VALUE=DATE:20230902 SUMMARY:Swiss revised FADP (nFADP): Revised FADP enters into force DESCRIPTION:Revised FADP and Data Protection Ordinance apply with no transi tion period.\n\nFederal Act on Data Protection (revised FADP) of 25 Septem ber 2020 (Switzerland)\n\nSource: https://www.fedlex.admin.ch/eli/cc/2022/ 491/en\n\nhttps://rulebook.fru.dev/regulations/ch-fadp URL:https://rulebook.fru.dev/regulations/ch-fadp CATEGORIES:Switzerland,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-68@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230906 DTEND;VALUE=DATE:20230907 SUMMARY:Digital Markets Act: First six gatekeepers designated DESCRIPTION:Commission designated Alphabet\, Amazon\, Apple\, ByteDance\, M eta and Microsoft (22 core platform services). They had six months to full y comply.\n\nRegulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act) (European Union)\n\nSource: https ://digital-markets-act.ec.europa.eu/gatekeepers_en\n\nhttps://rulebook.fru .dev/regulations/eu-dma URL:https://rulebook.fru.dev/regulations/eu-dma CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-137@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230914 DTEND;VALUE=DATE:20230915 SUMMARY:Saudi PDPL: PDPL in force DESCRIPTION:PDPL and its implementing regulations take effect.\n\nPersonal Data Protection Law (Royal Decree M/19 of 9/2/1443H\, as amended by Royal Decree M/148 of 5/9/1444H) (Saudi Arabia)\n\nSource: https://sdaia.gov.sa/ en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Rev iewed-.pdf\n\nhttps://rulebook.fru.dev/regulations/sa-pdpl URL:https://rulebook.fru.dev/regulations/sa-pdpl CATEGORIES:Saudi Arabia,privacy,data-residency,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-23@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230922 DTEND;VALUE=DATE:20230923 SUMMARY:Quebec Law 25: Phase 2: main obligations and penalties DESCRIPTION:Governance policies\, PIAs\, consent\, transparency\, privacy b y default\, ADM notices\, cross-border PIAs and AMP/penal regime apply.\n\ nAct to modernize legislative provisions as regards the protection of pers onal information (Law 25\, formerly Bill 64) (Quebec\, Canada)\n\nSource: https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1\n\nhttps://rulebo ok.fru.dev/regulations/ca-qc-law25 URL:https://rulebook.fru.dev/regulations/ca-qc-law25 CATEGORIES:Quebec\, Canada,privacy,breach-notification,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-64@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20230924 DTEND;VALUE=DATE:20230925 SUMMARY:Data Governance Act: DGA applies DESCRIPTION:All DGA rules apply (Art 38).\n\nRegulation (EU) 2022/868 on Eu ropean data governance (Data Governance Act) (European Union)\n\nSource: h ttps://eur-lex.europa.eu/eli/reg/2022/868/oj\n\nhttps://rulebook.fru.dev/r egulations/eu-dga URL:https://rulebook.fru.dev/regulations/eu-dga CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-308@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20231231 DTEND;VALUE=DATE:20240101 SUMMARY:Utah UCPA: UCPA takes effect DESCRIPTION:Utah Consumer Privacy Act obligations and consumer rights apply .\n\nUtah Consumer Privacy Act (SB 227\, 2022) (Utah)\n\nSource: https://l e.utah.gov/xcode/Title13/Chapter61/13-61-S402.html\n\nhttps://rulebook.fru .dev/regulations/us-ut-ucpa URL:https://rulebook.fru.dev/regulations/us-ut-ucpa CATEGORIES:Utah,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-55@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240111 DTEND;VALUE=DATE:20240112 SUMMARY:EU Data Act: Data Act enters into force DESCRIPTION:Entered into force on the twentieth day after publication in th e OJ on 22 Dec 2023 (Art 50).\n\nRegulation (EU) 2023/2854 on harmonised r ules on fair access to and use of data (Data Act) (European Union)\n\nSour ce: https://eur-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps://rulebook.fru .dev/regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-56@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240111 DTEND;VALUE=DATE:20240112 SUMMARY:EU Data Act: Reduced switching charges period begins DESCRIPTION:From 11 Jan 2024 to 12 Jan 2027\, data processing providers may charge only reduced switching fees\, capped at costs directly linked to s witching (Art 29(2)-(3)).\n\nRegulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps://rulebook.fru.dev /regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-78@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240217 DTEND;VALUE=DATE:20240218 SUMMARY:Digital Services Act: DSA applies to all intermediary services DESCRIPTION:Full application to all providers of intermediary services (Art 93(2)).\n\nRegulation (EU) 2022/2065 on a Single Market for Digital Servi ces (Digital Services Act) (European Union)\n\nSource: https://eur-lex.eur opa.eu/eli/reg/2022/2065/oj\n\nhttps://rulebook.fru.dev/regulations/eu-dsa URL:https://rulebook.fru.dev/regulations/eu-dsa CATEGORIES:European Union,online-safety,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-69@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240307 DTEND;VALUE=DATE:20240308 SUMMARY:Digital Markets Act: Gatekeeper compliance deadline (first designat ions) DESCRIPTION:First-wave gatekeepers had to comply with Arts 5-7 obligations and submit compliance reports six months after the 6 Sep 2023 designation. \n\nRegulation (EU) 2022/1925 on contestable and fair markets in the digit al sector (Digital Markets Act) (European Union)\n\nSource: https://ec.eur opa.eu/commission/presscorner/detail/en/ip_23_4328\n\nhttps://rulebook.fru .dev/regulations/eu-dma URL:https://rulebook.fru.dev/regulations/eu-dma CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-229@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240313 DTEND;VALUE=DATE:20240314 SUMMARY:FCC CPNI Breach Rule: Order effective except revised notification r ules DESCRIPTION:Definitions and other parts of the order took effect\; the revi sed 64.2011 and 64.5111 notification requirements were delayed pending OMB approval.\n\nFCC Data Breach Reporting Requirements for telecommunication s carriers\, interconnected VoIP and TRS providers (47 CFR 64.2011\, 64.51 11) (United States (Federal))\n\nSource: https://www.federalregister.gov/d ocuments/2024/02/12/2024-01667/data-breach-reporting-requirements\n\nhttps ://rulebook.fru.dev/regulations/us-fcc-cpni-breach URL:https://rulebook.fru.dev/regulations/us-fcc-cpni-breach CATEGORIES:United States (Federal),privacy,breach-notification,cybersecurit y TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-30@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240322 DTEND;VALUE=DATE:20240323 SUMMARY:China Cross-Border Data Flow Provisions: Cross-border data flow pro visions take effect DESCRIPTION:Exemptions and volume thresholds apply from publication (Art. 1 4)\; security assessment results are valid for 3 years (Art. 9).\n\nProvis ions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16 ) (China)\n\nSource: https://www.cac.gov.cn/2024-03/22/c_1712776611775634. htm\n\nhttps://rulebook.fru.dev/regulations/cn-cross-border URL:https://rulebook.fru.dev/regulations/cn-cross-border CATEGORIES:China,data-residency,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-319@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240331 DTEND;VALUE=DATE:20240401 SUMMARY:Washington My Health My Data Act: Regulated entities must comply DESCRIPTION:Sections 4-9 (privacy policy\, consent\, consumer rights\, sale authorization) apply to regulated entities.\n\nWashington My Health My Da ta Act (HB 1155\, Laws of 2023\, ch. 191\; RCW 19.373) (Washington)\n\nSou rce: https://www.atg.wa.gov/protecting-washingtonians-personal-health-data -and-privacy\n\nhttps://rulebook.fru.dev/regulations/us-wa-mhmda URL:https://rulebook.fru.dev/regulations/us-wa-mhmda CATEGORIES:Washington,health,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-235@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240513 DTEND;VALUE=DATE:20240514 SUMMARY:GLBA Safeguards Rule: FTC breach notification requirement effective DESCRIPTION:Section 314.4(j) requires notice to the FTC within 30 days of d iscovering a notification event involving at least 500 consumers.\n\nFTC S tandards for Safeguarding Customer Information (Safeguards Rule)\, 16 CFR Part 314\, under the Gramm-Leach-Bliley Act (United States (Federal))\n\nS ource: https://www.federalregister.gov/documents/2023/11/13/2023-24412/sta ndards-for-safeguarding-customer-information\n\nhttps://rulebook.fru.dev/r egulations/us-glba-safeguards URL:https://rulebook.fru.dev/regulations/us-glba-safeguards CATEGORIES:United States (Federal),financial,cybersecurity,breach-notificat ion,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-199@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240517 DTEND;VALUE=DATE:20240518 SUMMARY:Colorado AI Act: SB 24-205 signed DESCRIPTION:Governor Polis signs the original Colorado AI Act with a Februa ry 1\, 2026 effective date.\n\nColorado SB 24-205 (Consumer Protections fo r Artificial Intelligence)\, as delayed by SB 25B-004 and repealed and ree nacted by SB 26-189 (Automated Decision-Making Technology) (Colorado)\n\nS ource: https://leg.colorado.gov/bills/sb24-205\n\nhttps://rulebook.fru.dev /regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-85@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240520 DTEND;VALUE=DATE:20240521 SUMMARY:eIDAS 2 / EU Digital Identity Wallet: eIDAS 2 enters into force DESCRIPTION:Regulation (EU) 2024/1183 entered into force on the twentieth d ay after publication on 30 Apr 2024 (Art 2).\n\nRegulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2) (European Union)\n\nSource: https://e ur-lex.europa.eu/eli/reg/2024/1183/oj\n\nhttps://rulebook.fru.dev/regulati ons/eu-eidas2 URL:https://rulebook.fru.dev/regulations/eu-eidas2 CATEGORIES:European Union,privacy,data-access,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-143@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240601 DTEND;VALUE=DATE:20240602 SUMMARY:Turkey KVKK: Law 7499 amendments take effect DESCRIPTION:New sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.\n\nLaw No. 6698 on the Protection of Personal Data (KVKK)\, as amended by Law No. 7499 (Turkey)\n\nSource: https://www.resmigazete.gov.tr /eskiler/2024/03/20240312-1.htm\n\nhttps://rulebook.fru.dev/regulations/tr -kvkk URL:https://rulebook.fru.dev/regulations/tr-kvkk CATEGORIES:Turkey,privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-288@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240623 DTEND;VALUE=DATE:20240624 SUMMARY:PADFA: PADFA takes effect DESCRIPTION:The prohibition takes effect 60 days after enactment (April 24\ , 2024).\n\nProtecting Americans' Data from Foreign Adversaries Act of 202 4 (United States (Federal))\n\nSource: https://www.govinfo.gov/content/pkg /PLAW-118publ50/html/PLAW-118publ50.htm\n\nhttps://rulebook.fru.dev/regula tions/us-padfa URL:https://rulebook.fru.dev/regulations/us-padfa CATEGORIES:United States (Federal),privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-236@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240625 DTEND;VALUE=DATE:20240626 SUMMARY:HIPAA: Reproductive health care privacy rule effective (later vacat ed) DESCRIPTION:The HIPAA Privacy Rule to Support Reproductive Health Care Priv acy (89 FR 32976) took effect\; it was vacated nationwide on June 18\, 202 5 in Purl v. HHS (N.D. Tex.).\n\nHIPAA Privacy\, Security and Breach Notif ication Rules (45 CFR Parts 160 and 164) (United States (Federal))\n\nSour ce: https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa- privacy-rule-to-support-reproductive-health-care-privacy\n\nhttps://rulebo ok.fru.dev/regulations/us-hipaa URL:https://rulebook.fru.dev/regulations/us-hipaa CATEGORIES:United States (Federal),privacy,health,cybersecurity,breach-noti fication TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-320@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240630 DTEND;VALUE=DATE:20240701 SUMMARY:Washington My Health My Data Act: Small businesses must comply DESCRIPTION:Sections 4-9 apply to small businesses.\n\nWashington My Health My Data Act (HB 1155\, Laws of 2023\, ch. 191\; RCW 19.373) (Washington)\ n\nSource: https://www.atg.wa.gov/protecting-washingtonians-personal-healt h-data-and-privacy\n\nhttps://rulebook.fru.dev/regulations/us-wa-mhmda URL:https://rulebook.fru.dev/regulations/us-wa-mhmda CATEGORIES:Washington,health,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-208@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240701 DTEND;VALUE=DATE:20240702 SUMMARY:Colorado Privacy Act (CPA): Universal opt-out mechanism recognition required DESCRIPTION:Controllers must honor AG-recognized universal opt-out mechanis ms (e.g. Global Privacy Control).\n\nColorado Privacy Act (SB 21-190)\, C. R.S. 6-1-1301 et seq.\, as amended by HB 24-1130\, SB 24-041 and SB 25-276 (Colorado)\n\nSource: https://leg.colorado.gov/bills/sb21-190\n\nhttps:// rulebook.fru.dev/regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-230@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240701 DTEND;VALUE=DATE:20240702 SUMMARY:Florida Digital Bill of Rights: Florida Digital Bill of Rights take s effect DESCRIPTION:SB 262 obligations under Fla. Stat. 501.701-501.722 apply.\n\nF lorida Digital Bill of Rights (CS/CS/SB 262\, 2023) (Florida)\n\nSource: h ttps://www.flsenate.gov/Session/Bill/2023/262\n\nhttps://rulebook.fru.dev/ regulations/us-fl-fdbr URL:https://rulebook.fru.dev/regulations/us-fl-fdbr CATEGORIES:Florida,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-283@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240701 DTEND;VALUE=DATE:20240702 SUMMARY:Oregon OCPA: OCPA takes effect for most controllers DESCRIPTION:OCPA obligations apply to for-profit controllers meeting the th resholds.\n\nOregon Consumer Privacy Act (SB 619\, 2023) (Oregon)\n\nSourc e: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/ privacy/\n\nhttps://rulebook.fru.dev/regulations/us-or-ocpa URL:https://rulebook.fru.dev/regulations/us-or-ocpa CATEGORIES:Oregon,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-301@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240701 DTEND;VALUE=DATE:20240702 SUMMARY:Texas TDPSA: TDPSA takes effect DESCRIPTION:Most TDPSA obligations and consumer rights apply.\n\nTexas Data Privacy and Security Act (HB 4\, 2023) (Texas)\n\nSource: https://capitol .texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4\n\nhttps://ruleboo k.fru.dev/regulations/us-tx-tdpsa URL:https://rulebook.fru.dev/regulations/us-tx-tdpsa CATEGORIES:Texas,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-232@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240729 DTEND;VALUE=DATE:20240730 SUMMARY:FTC Health Breach Notification Rule: 2024 amendments effective DESCRIPTION:Amendments clarifying health app coverage\, unauthorized disclo sure as breach\, email notice and FTC notice timing took effect.\n\nFTC He alth Breach Notification Rule (16 CFR Part 318)\, as amended 2024 (United States (Federal))\n\nSource: https://www.federalregister.gov/documents/202 4/05/30/2024-10855/health-breach-notification-rule\n\nhttps://rulebook.fru .dev/regulations/us-ftc-hbnr URL:https://rulebook.fru.dev/regulations/us-ftc-hbnr CATEGORIES:United States (Federal),health,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-242@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240802 DTEND;VALUE=DATE:20240803 SUMMARY:Illinois BIPA: SB 2979 amendment effective DESCRIPTION:Public Act 103-0769 signed and effective immediately: single re covery per person and electronic signatures allowed for consent.\n\nIllino is Biometric Information Privacy Act (740 ILCS 14)\, as amended by SB 2979 (Public Act 103-0769) (Illinois)\n\nSource: https://www.ilga.gov/Legislat ion/publicacts/view/103-0769\n\nhttps://rulebook.fru.dev/regulations/us-il -bipa URL:https://rulebook.fru.dev/regulations/us-il-bipa CATEGORIES:Illinois,biometrics,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-295@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240802 DTEND;VALUE=DATE:20240803 SUMMARY:SEC Regulation S-P: Amendments effective DESCRIPTION:The Regulation S-P amendments became effective\; compliance tie red by entity size.\n\nRegulation S-P: Privacy of Consumer Financial Infor mation and Safeguarding Customer Information (2024 amendments) (United Sta tes (Federal))\n\nSource: https://www.federalregister.gov/documents/2024/0 6/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-a nd-safeguarding-customer-information\n\nhttps://rulebook.fru.dev/regulatio ns/us-sec-reg-sp URL:https://rulebook.fru.dev/regulations/us-sec-reg-sp CATEGORIES:United States (Federal),financial,privacy,cybersecurity,breach-n otification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-13@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240823 DTEND;VALUE=DATE:20240824 SUMMARY:Brazil LGPD: International transfer regulation published DESCRIPTION:Resolution CD/ANPD 19/2024 on international transfers and stand ard contractual clauses published and in force.\n\nLei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018) (Brazil)\n\nSource: https://www.i n.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-58009 5396\n\nhttps://rulebook.fru.dev/regulations/br-lgpd URL:https://rulebook.fru.dev/regulations/br-lgpd CATEGORIES:Brazil,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-144@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240901 DTEND;VALUE=DATE:20240902 SUMMARY:Turkey KVKK: Old transfer regime ends DESCRIPTION:Transitional period ends in which the former Article 9 explicit -consent transfer basis could still be relied on.\n\nLaw No. 6698 on the P rotection of Personal Data (KVKK)\, as amended by Law No. 7499 (Turkey)\n\ nSource: https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm\n\n https://rulebook.fru.dev/regulations/tr-kvkk URL:https://rulebook.fru.dev/regulations/tr-kvkk CATEGORIES:Turkey,privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-138@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240914 DTEND;VALUE=DATE:20240915 SUMMARY:Saudi PDPL: One-year grace period ends DESCRIPTION:Grace period for controllers to comply ends\; PDPL fully enforc eable.\n\nPersonal Data Protection Law (Royal Decree M/19 of 9/2/1443H\, a s amended by Royal Decree M/148 of 5/9/1444H) (Saudi Arabia)\n\nSource: ht tps://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2 -23April2023-%20Reviewed-.pdf\n\nhttps://rulebook.fru.dev/regulations/sa-p dpl URL:https://rulebook.fru.dev/regulations/sa-pdpl CATEGORIES:Saudi Arabia,privacy,data-residency,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-24@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240922 DTEND;VALUE=DATE:20240923 SUMMARY:Quebec Law 25: Phase 3: data portability DESCRIPTION:Right to data portability in a structured\, commonly used techn ological format applies.\n\nAct to modernize legislative provisions as reg ards the protection of personal information (Law 25\, formerly Bill 64) (Q uebec\, Canada)\n\nSource: https://www.legisquebec.gouv.qc.ca/en/document/ cs/P-39.1\n\nhttps://rulebook.fru.dev/regulations/ca-qc-law25 URL:https://rulebook.fru.dev/regulations/ca-qc-law25 CATEGORIES:Quebec\, Canada,privacy,breach-notification,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-162@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20240928 DTEND;VALUE=DATE:20240929 SUMMARY:California AB 2013 (AI training data transparency): AB 2013 signed DESCRIPTION:AB 2013 chaptered (ch. 817).\n\nCalifornia AB 2013\, Generative Artificial Intelligence: Training Data Transparency (Stats. 2024\, ch. 81 7) (California)\n\nSource: https://leginfo.legislature.ca.gov/faces/billNa vClient.xhtml?bill_id=202320240AB2013\n\nhttps://rulebook.fru.dev/regulati ons/us-ca-ab2013 URL:https://rulebook.fru.dev/regulations/us-ca-ab2013 CATEGORIES:California,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-258@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241001 DTEND;VALUE=DATE:20241002 SUMMARY:Montana Consumer Data Privacy Act (MCDPA): MCDPA takes effect DESCRIPTION:Consumer rights\, controller duties and opt-out preference sign al support apply.\n\nMontana Consumer Data Privacy Act (SB 384\, 2023)\, M ont. Code Ann. 30-14-2801 et seq.\, as amended by SB 297 (2025) (Montana)\ n\nSource: https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/par t_0280/section_0030/0300-0140-0280-0030.html\n\nhttps://rulebook.fru.dev/r egulations/us-mt-mcdpa URL:https://rulebook.fru.dev/regulations/us-mt-mcdpa CATEGORIES:Montana,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-113@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241017 DTEND;VALUE=DATE:20241018 SUMMARY:Indonesia PDP Law: PDP Law transition ends DESCRIPTION:Controllers and processors must fully comply (Art. 74 two-year transition).\n\nLaw No. 27 of 2022 on Personal Data Protection (Undang-Und ang Pelindungan Data Pribadi) (Indonesia)\n\nSource: https://peraturan.bpk .go.id/Details/229798/uu-no-27-tahun-2022\n\nhttps://rulebook.fru.dev/regu lations/id-pdp URL:https://rulebook.fru.dev/regulations/id-pdp CATEGORIES:Indonesia,privacy,breach-notification,data-residency,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-4@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241211 DTEND;VALUE=DATE:20241212 SUMMARY:Australia Privacy Act: Most POLA Act 2024 amendments commence DESCRIPTION:Tiered penalties\, infringement notices\, OAIC powers\, securit y and overseas-transfer clarifications and doxxing offences commence the d ay after Royal Assent.\n\nPrivacy Act 1988 (Cth)\, as amended by the Priva cy and Other Legislation Amendment Act 2024 (Australia)\n\nSource: https:/ /www.legislation.gov.au/C2024A00128/asmade\n\nhttps://rulebook.fru.dev/reg ulations/au-privacy-act URL:https://rulebook.fru.dev/regulations/au-privacy-act CATEGORIES:Australia,privacy,children,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-26@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241213 DTEND;VALUE=DATE:20241214 SUMMARY:Chile Personal Data Protection Law (Ley 21.719): Published in Diari o Oficial DESCRIPTION:Law 21.719 published\; 24-month vacatio legis begins.\n\nLey N º 21.719 que regula la protección y el tratamiento de los datos personal es y crea la Agencia de Protección de Datos Personales (Chile)\n\nSource: https://www.bcn.cl/leychile/navegar?idNorma=1209272\n\nhttps://rulebook.f ru.dev/regulations/cl-pdpl URL:https://rulebook.fru.dev/regulations/cl-pdpl CATEGORIES:Chile,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-237@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241223 DTEND;VALUE=DATE:20241224 SUMMARY:HIPAA: Reproductive health privacy compliance date (vacated) DESCRIPTION:Original compliance date for the reproductive health care priva cy provisions\, including the attestation requirement\; these provisions n o longer apply after the June 2025 vacatur.\n\nHIPAA Privacy\, Security an d Breach Notification Rules (45 CFR Parts 160 and 164) (United States (Fed eral))\n\nSource: https://www.federalregister.gov/documents/2024/04/26/202 4-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy\n\n https://rulebook.fru.dev/regulations/us-hipaa URL:https://rulebook.fru.dev/regulations/us-hipaa CATEGORIES:United States (Federal),privacy,health,cybersecurity,breach-noti fication TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-86@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241224 DTEND;VALUE=DATE:20241225 SUMMARY:eIDAS 2 / EU Digital Identity Wallet: First wallet implementing act s enter into force DESCRIPTION:Commission Implementing Regulations (EU) 2024/2977\, 2024/2979\ , 2024/2980\, 2024/2981 and 2024/2982 (adopted 28 Nov 2024\, published 4 D ec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.\n\nRegulation (EU) 2024/1183 amending Regulation (EU) No 910/20 14 as regards establishing the European Digital Identity Framework (eIDAS 2) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg_impl/2024 /2977/oj\n\nhttps://rulebook.fru.dev/regulations/eu-eidas2 URL:https://rulebook.fru.dev/regulations/eu-eidas2 CATEGORIES:European Union,privacy,data-access,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-216@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20241231 DTEND;VALUE=DATE:20250101 SUMMARY:Connecticut Data Privacy Act (CTDPA): Mandatory 60-day cure period expires DESCRIPTION:After Dec 31\, 2024\, the AG is no longer required to offer a 6 0-day cure before enforcement\; cure becomes discretionary.\n\nConnecticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et seq.\, a s amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Conn ecticut)\n\nSource: https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus .asp?selBillType=Bill&which_year=2022&bill_num=6\n\nhttps://rulebook.fru.d ev/regulations/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-166@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:CCPA / CPRA: CPI adjustment of thresholds and fines DESCRIPTION:Revenue threshold rises to $26\,625\,000 and fines to $2\,663 / $7\,988 per violation.\n\nCalifornia Consumer Privacy Act of 2018\, as am ended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.10 0 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) ( California)\n\nSource: https://cppa.ca.gov/regulations/cpi_adjustment.html \n\nhttps://rulebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-34@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:China Network Data Security Regulations: Network Data Regulations t ake effect DESCRIPTION:All provisions\, including the 10-million-person threshold duti es and annual important-data risk assessments\, apply.\n\nRegulations on N etwork Data Security Management (State Council Order No. 790) (China)\n\nS ource: https://www.gov.cn/zhengce/content/202409/content_6977766.htm\n\nht tps://rulebook.fru.dev/regulations/cn-network-data-regs URL:https://rulebook.fru.dev/regulations/cn-network-data-regs CATEGORIES:China,privacy,cybersecurity,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-209@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Colorado Privacy Act (CPA): 60-day cure period expires DESCRIPTION:Mandatory 60-day notice-and-cure before AG enforcement ends\; e nforcement may proceed without cure.\n\nColorado Privacy Act (SB 21-190)\, C.R.S. 6-1-1301 et seq.\, as amended by HB 24-1130\, SB 24-041 and SB 25- 276 (Colorado)\n\nSource: https://leg.colorado.gov/bills/sb21-190\n\nhttps ://rulebook.fru.dev/regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-217@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Connecticut Data Privacy Act (CTDPA): Universal opt-out preference signals required DESCRIPTION:Controllers must honor opt-out preference signals for targeted advertising and sale (effective Jan 1\, 2025).\n\nConnecticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et seq.\, as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Connecticut)\n\nS ource: https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillT ype=Bill&which_year=2022&bill_num=6\n\nhttps://rulebook.fru.dev/regulation s/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-223@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Delaware Personal Data Privacy Act (DPDPA): DPDPA takes effect DESCRIPTION:Consumer rights and controller duties apply\; 60-day mandatory cure period begins.\n\nDelaware Personal Data Privacy Act (HB 154)\, 6 Del . C. ch. 12D (Delaware)\n\nSource: https://delcode.delaware.gov/title6/c01 2d/index.html\n\nhttps://rulebook.fru.dev/regulations/us-de-dpdpa URL:https://rulebook.fru.dev/regulations/us-de-dpdpa CATEGORIES:Delaware,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-240@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Iowa Consumer Data Protection Act (ICDPA): ICDPA takes effect DESCRIPTION:Consumer rights and controller/processor obligations apply.\n\n Iowa Consumer Data Protection Act (SF 262\, 2023)\, Iowa Code ch. 715D (Io wa)\n\nSource: https://www.legis.iowa.gov/docs/code/715D.pdf\n\nhttps://ru lebook.fru.dev/regulations/us-ia-icdpa URL:https://rulebook.fru.dev/regulations/us-ia-icdpa CATEGORIES:Iowa,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-129@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Malaysia PDPA: PDPA amendments phase 1 DESCRIPTION:Miscellaneous provisions commence (e.g. electronic service of n otices).\n\nPersonal Data Protection Act 2010 (Act 709)\, as amended by th e Personal Data Protection (Amendment) Act 2024 (Act A1727) (Malaysia)\n\n Source: https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendmen t-act-2024-commencement-date-determination/\n\nhttps://rulebook.fru.dev/re gulations/my-pdpa URL:https://rulebook.fru.dev/regulations/my-pdpa CATEGORIES:Malaysia,privacy,breach-notification,biometrics,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-260@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Nebraska NDPA: Nebraska Data Privacy Act takes effect DESCRIPTION:Controller and processor obligations and consumer rights under Neb. Rev. Stat. 87-1101 et seq. apply.\n\nNebraska Data Privacy Act (LB 10 74\, 2024) (Nebraska)\n\nSource: https://nebraskalegislature.gov/bills/vie w_bill.php?DocumentID=54904\n\nhttps://rulebook.fru.dev/regulations/us-ne- ndpa URL:https://rulebook.fru.dev/regulations/us-ne-ndpa CATEGORIES:Nebraska,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-261@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:New Hampshire Privacy Act: New Hampshire Privacy Act takes effect DESCRIPTION:RSA 507-H obligations and consumer rights apply (Laws 2024\, 5: 1\, eff. Jan. 1\, 2025).\n\nNew Hampshire Privacy Act (SB 255\, 2024)\, RS A chapter 507-H (New Hampshire)\n\nSource: https://gc.nh.gov/rsa/html/LII/ 507-H/507-H-2.htm\n\nhttps://rulebook.fru.dev/regulations/us-nh-privacy URL:https://rulebook.fru.dev/regulations/us-nh-privacy CATEGORIES:New Hampshire,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-302@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250101 DTEND;VALUE=DATE:20250102 SUMMARY:Texas TDPSA: Universal opt-out mechanism requirement applies DESCRIPTION:Controllers must honor global privacy control / universal opt-o ut signals (Bus. & Com. Code 541.055(e)).\n\nTexas Data Privacy and Securi ty Act (HB 4\, 2023) (Texas)\n\nSource: https://capitol.texas.gov/BillLook up/History.aspx?LegSess=88R&Bill=HB4\n\nhttps://rulebook.fru.dev/regulatio ns/us-tx-tdpsa URL:https://rulebook.fru.dev/regulations/us-tx-tdpsa CATEGORIES:Texas,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-264@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250115 DTEND;VALUE=DATE:20250116 SUMMARY:New Jersey NJDPA: NJDPA takes effect DESCRIPTION:The act takes effect on the 365th day after enactment on Jan 16 \, 2024 (sec. 17).\n\nNew Jersey Data Privacy Act (P.L.2023\, c.266\; S332 ) (New Jersey)\n\nSource: https://pub.njleg.state.nj.us/Bills/2022/PL23/26 6_.PDF\n\nhttps://rulebook.fru.dev/regulations/us-nj-njdpa URL:https://rulebook.fru.dev/regulations/us-nj-njdpa CATEGORIES:New Jersey,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-238@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250307 DTEND;VALUE=DATE:20250308 SUMMARY:HIPAA: Security Rule NPRM comment period closed DESCRIPTION:Comments closed on the proposed HIPAA Security Rule update (90 FR 898)\; OCR has not issued a final rule.\n\nHIPAA Privacy\, Security and Breach Notification Rules (45 CFR Parts 160 and 164) (United States (Fede ral))\n\nSource: https://www.federalregister.gov/documents/2025/01/06/2024 -30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-p rotected-health-information\n\nhttps://rulebook.fru.dev/regulations/us-hip aa URL:https://rulebook.fru.dev/regulations/us-hipaa CATEGORIES:United States (Federal),privacy,health,cybersecurity,breach-noti fication TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-128@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250321 DTEND;VALUE=DATE:20250322 SUMMARY:Mexico LFPDPPP 2025: New LFPDPPP in force DESCRIPTION:Law published 20 March 2025 enters into force the following day \, repealing the 2010 law.\n\nLey Federal de Protección de Datos Personal es en Posesión de los Particulares (2025) (Mexico)\n\nSource: https://www .diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf\n\nhttps://rulebook.fru.dev/ regulations/mx-lfpdppp URL:https://rulebook.fru.dev/regulations/mx-lfpdppp CATEGORIES:Mexico,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-80@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250325 DTEND;VALUE=DATE:20250326 SUMMARY:European Health Data Space (EHDS): EHDS enters into force DESCRIPTION:Regulation (EU) 2025/327\, published 5 Mar 2025\, enters into f orce on the twentieth day following publication.\n\nRegulation (EU) 2025/3 27 on the European Health Data Space (European Union)\n\nSource: https://e ur-lex.europa.eu/eli/reg/2025/327/oj\n\nhttps://rulebook.fru.dev/regulatio ns/eu-ehds URL:https://rulebook.fru.dev/regulations/eu-ehds CATEGORIES:European Union,health,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-130@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250401 DTEND;VALUE=DATE:20250402 SUMMARY:Malaysia PDPA: PDPA amendments phase 2 DESCRIPTION:'Data controller' terminology\, biometric data as sensitive dat a\, higher penalties\, Security Principle for processors\, and removal of the cross-border whitelist take effect.\n\nPersonal Data Protection Act 20 10 (Act 709)\, as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727) (Malaysia)\n\nSource: https://www.pdp.gov.my/ppdpv1/en/pe rsonal-data-protection-amendment-act-2024-commencement-date-determination/ \n\nhttps://rulebook.fru.dev/regulations/my-pdpa URL:https://rulebook.fru.dev/regulations/my-pdpa CATEGORIES:Malaysia,privacy,breach-notification,biometrics,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-227@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250408 DTEND;VALUE=DATE:20250409 SUMMARY:DOJ Bulk Data Rule: Prohibitions and restrictions take effect DESCRIPTION:Core prohibitions on covered data transactions and security req uirements for restricted transactions apply.\n\nPreventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concer n or Covered Persons (28 CFR Part 202) - DOJ Data Security Program (United States (Federal))\n\nSource: https://www.federalregister.gov/documents/20 25/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-go vernment-related-data-by-countries-of-concern\n\nhttps://rulebook.fru.dev/ regulations/us-doj-bulk-data URL:https://rulebook.fru.dev/regulations/us-doj-bulk-data CATEGORIES:United States (Federal),privacy,data-residency,cybersecurity,bio metrics,health,financial TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-35@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250501 DTEND;VALUE=DATE:20250502 SUMMARY:China PI Compliance Audit Measures: PI compliance audit measures ta ke effect DESCRIPTION:Self-audit and regulator-ordered audit regime applies\; 10M+ pr ocessors must audit at least every two years.\n\nAdministrative Measures f or Personal Information Protection Compliance Audits (CAC Order No. 18) (C hina)\n\nSource: https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm\ n\nhttps://rulebook.fru.dev/regulations/cn-pi-compliance-audit URL:https://rulebook.fru.dev/regulations/cn-pi-compliance-audit CATEGORIES:China,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-298@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250519 DTEND;VALUE=DATE:20250520 SUMMARY:TAKE IT DOWN Act: Criminal provisions effective on enactment DESCRIPTION:Publishing or threatening to publish non-consensual intimate im ages\, including digital forgeries\, became a federal crime upon signature .\n\nTools to Address Known Exploitation by Immobilizing Technological Dee pfakes on Websites and Networks Act (TAKE IT DOWN Act) (United States (Fed eral))\n\nSource: https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/ PLAW-119publ12.htm\n\nhttps://rulebook.fru.dev/regulations/us-take-it-down URL:https://rulebook.fru.dev/regulations/us-take-it-down CATEGORIES:United States (Federal),online-safety,ai,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-210@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250523 DTEND;VALUE=DATE:20250524 SUMMARY:Colorado Privacy Act (CPA): SB 25-276 geolocation and sensitive-dat a sale amendment effective DESCRIPTION:Adds precise geolocation data definitions and prohibits selling sensitive data without consent (effective on signature).\n\nColorado Priv acy Act (SB 21-190)\, C.R.S. 6-1-1301 et seq.\, as amended by HB 24-1130\, SB 24-041 and SB 25-276 (Colorado)\n\nSource: https://leg.colorado.gov/bi lls/sb25-276\n\nhttps://rulebook.fru.dev/regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-131@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250601 DTEND;VALUE=DATE:20250602 SUMMARY:Malaysia PDPA: PDPA amendments phase 3 DESCRIPTION:Mandatory DPO appointment\, data breach notification\, and data portability take effect.\n\nPersonal Data Protection Act 2010 (Act 709)\, as amended by the Personal Data Protection (Amendment) Act 2024 (Act A172 7) (Malaysia)\n\nSource: https://www.pdp.gov.my/ppdpv1/en/personal-data-pr otection-amendment-act-2024-commencement-date-determination/\n\nhttps://ru lebook.fru.dev/regulations/my-pdpa URL:https://rulebook.fru.dev/regulations/my-pdpa CATEGORIES:Malaysia,privacy,breach-notification,biometrics,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-265@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250602 DTEND;VALUE=DATE:20250603 SUMMARY:New Jersey NJDPA: Division of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L) DESCRIPTION:Proposed rules published at 57 N.J.R. 1101(a)\; comments were d ue Aug 1\, 2025.\n\nNew Jersey Data Privacy Act (P.L.2023\, c.266\; S332) (New Jersey)\n\nSource: https://www.njoag.gov/murphy-administration-announ ces-proposed-rules-establishing-comprehensive-consumer-data-privacy-protec tions/\n\nhttps://rulebook.fru.dev/regulations/us-nj-njdpa URL:https://rulebook.fru.dev/regulations/us-nj-njdpa CATEGORIES:New Jersey,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-5@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250610 DTEND;VALUE=DATE:20250611 SUMMARY:Australia Privacy Act: Statutory tort for serious invasions of priv acy commences DESCRIPTION:Individuals can sue for serious invasions of privacy (Schedule 2)\, 6 months after Royal Assent.\n\nPrivacy Act 1988 (Cth)\, as amended b y the Privacy and Other Legislation Amendment Act 2024 (Australia)\n\nSour ce: https://www.legislation.gov.au/C2024A00128/asmade\n\nhttps://rulebook. fru.dev/regulations/au-privacy-act URL:https://rulebook.fru.dev/regulations/au-privacy-act CATEGORIES:Australia,privacy,children,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-148@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250619 DTEND;VALUE=DATE:20250620 SUMMARY:Data (Use and Access) Act: Royal Assent DESCRIPTION:The Act receives Royal Assent\; commencement staged by regulati ons.\n\nData (Use and Access) Act 2025 (United Kingdom)\n\nSource: https:/ /www.legislation.gov.uk/ukpga/2025/18/contents\n\nhttps://rulebook.fru.dev /regulations/uk-duaa URL:https://rulebook.fru.dev/regulations/uk-duaa CATEGORIES:United Kingdom,privacy,data-access,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-213@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250623 DTEND;VALUE=DATE:20250624 SUMMARY:COPPA Rule: Amended COPPA Rule takes effect DESCRIPTION:The April 2025 amendments to 16 CFR Part 312 became effective\; during the transition operators could comply with either the pre-2025 or the amended Rule.\n\nChildren's Online Privacy Protection Rule (16 CFR Par t 312)\, as amended April 2025 (United States (Federal))\n\nSource: https: //www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online -privacy-protection-rule\n\nhttps://rulebook.fru.dev/regulations/us-coppa URL:https://rulebook.fru.dev/regulations/us-coppa CATEGORIES:United States (Federal),privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-211@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250701 DTEND;VALUE=DATE:20250702 SUMMARY:Colorado Privacy Act (CPA): Biometric identifier amendment (HB 24-1 130) effective DESCRIPTION:Any controller processing biometric identifiers must adopt a wr itten biometric policy\, give notice\, obtain consent and follow retention /deletion rules.\n\nColorado Privacy Act (SB 21-190)\, C.R.S. 6-1-1301 et seq.\, as amended by HB 24-1130\, SB 24-041 and SB 25-276 (Colorado)\n\nSo urce: https://leg.colorado.gov/bills/hb24-1130\n\nhttps://rulebook.fru.dev /regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-284@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250701 DTEND;VALUE=DATE:20250702 SUMMARY:Oregon OCPA: OCPA applies to nonprofits DESCRIPTION:Nonprofit organizations meeting the thresholds become subject t o OCPA.\n\nOregon Consumer Privacy Act (SB 619\, 2023) (Oregon)\n\nSource: https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-la w-faqs-for-nonprofits/\n\nhttps://rulebook.fru.dev/regulations/us-or-ocpa URL:https://rulebook.fru.dev/regulations/us-or-ocpa CATEGORIES:Oregon,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-300@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250701 DTEND;VALUE=DATE:20250702 SUMMARY:Tennessee TIPA: TIPA takes effect DESCRIPTION:Controller and processor obligations and consumer rights under Tenn. Code Ann. 47-18-3301 et seq. apply.\n\nTennessee Information Protect ion Act (HB 1181 / SB 73\, 2023) (Tennessee)\n\nSource: https://wapp.capit ol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1181&GA=113\n\nhttps://r ulebook.fru.dev/regulations/us-tn-tipa URL:https://rulebook.fru.dev/regulations/us-tn-tipa CATEGORIES:Tennessee,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-266@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250715 DTEND;VALUE=DATE:20250716 SUMMARY:New Jersey NJDPA: Universal opt-out mechanism must be honored DESCRIPTION:Controllers that sell personal data or process it for targeted advertising must honor user-selected universal opt-out signals within six months of the effective date (N.J.S.A. 56:8-166.11).\n\nNew Jersey Data Pr ivacy Act (P.L.2023\, c.266\; S332) (New Jersey)\n\nSource: https://pub.nj leg.state.nj.us/Bills/2022/PL23/266_.PDF\n\nhttps://rulebook.fru.dev/regul ations/us-nj-njdpa URL:https://rulebook.fru.dev/regulations/us-nj-njdpa CATEGORIES:New Jersey,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-255@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250731 DTEND;VALUE=DATE:20250801 SUMMARY:Minnesota Consumer Data Privacy Act (MCDPA): MCDPA takes effect DESCRIPTION:Consumer rights and controller/processor obligations apply (pos tsecondary institutions excepted).\n\nMinnesota Consumer Data Privacy Act (HF 4757\, 2024 Minn. Laws ch. 121\, art. 5)\, Minn. Stat. 325M.10-325M.21 (Minnesota)\n\nSource: https://www.revisor.mn.gov/statutes/cite/325M.20\n \nhttps://rulebook.fru.dev/regulations/us-mn-mcdpa URL:https://rulebook.fru.dev/regulations/us-mn-mcdpa CATEGORIES:Minnesota,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-115@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250814 DTEND;VALUE=DATE:20250815 SUMMARY:Israel Privacy Protection Law Amendment 13: Amendment 13 in force DESCRIPTION:Amended Privacy Protection Law\, PPA enforcement powers and sta tutory damages take effect.\n\nPrivacy Protection Law\, 5741-1981 (Amendme nt No. 13) (Israel)\n\nSource: https://www.gov.il/en/departments/the_priva cy_protection_authority/govil-landing-page\n\nhttps://rulebook.fru.dev/reg ulations/il-ppl-amendment-13 URL:https://rulebook.fru.dev/regulations/il-ppl-amendment-13 CATEGORIES:Israel,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-149@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250820 DTEND;VALUE=DATE:20250821 SUMMARY:Data (Use and Access) Act: Stage 1 commencement DESCRIPTION:Technical data protection provisions\, ICO statutory objects\, Smart Data framework (Part 1) and AI/copyright reporting duties commence ( Commencement No. 1 Regulations 2025).\n\nData (Use and Access) Act 2025 (U nited Kingdom)\n\nSource: https://www.legislation.gov.uk/ukpga/2025/18/con tents\n\nhttps://rulebook.fru.dev/regulations/uk-duaa URL:https://rulebook.fru.dev/regulations/uk-duaa CATEGORIES:United Kingdom,privacy,data-access,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-14@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250823 DTEND;VALUE=DATE:20250824 SUMMARY:Brazil LGPD: Deadline to adopt ANPD standard contractual clauses DESCRIPTION:Agents relying on contractual clauses for international transfe rs must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.\n\nLei Geral de Proteção de Dados Pessoais (Law N o. 13.709/2018) (Brazil)\n\nSource: https://www.in.gov.br/en/web/dou/-/res olucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396\n\nhttps://rulebook. fru.dev/regulations/br-lgpd URL:https://rulebook.fru.dev/regulations/br-lgpd CATEGORIES:Brazil,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-200@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250828 DTEND;VALUE=DATE:20250829 SUMMARY:Colorado AI Act: SB 25B-004 delays the act DESCRIPTION:Special-session bill pushes the SB 24-205 effective date from F ebruary 1\, 2026 to June 30\, 2026.\n\nColorado SB 24-205 (Consumer Protec tions for Artificial Intelligence)\, as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology) (Colora do)\n\nSource: https://leg.colorado.gov/bills/sb25b-004\n\nhttps://ruleboo k.fru.dev/regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-109@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250903 DTEND;VALUE=DATE:20250904 SUMMARY:EU-US Data Privacy Framework: General Court upholds DPF (Latombe v Commission) DESCRIPTION:General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.\n\nCommission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework (European Union)\n\nSource: https://curia.europa.eu/jcms /upload/docs/application/pdf/2025-09/cp250106en.pdf\n\nhttps://rulebook.fr u.dev/regulations/eu-us-dpf URL:https://rulebook.fru.dev/regulations/eu-us-dpf CATEGORIES:European Union,privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-57@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250912 DTEND;VALUE=DATE:20250913 SUMMARY:EU Data Act: Data Act applies DESCRIPTION:Most obligations apply\, including user data access and sharing (Chapters II-III)\, cloud switching (Chapter VI) and interoperability\; C hapter IV unfair terms apply to contracts concluded after this date (Art 5 0).\n\nRegulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa .eu/eli/reg/2023/2854/oj\n\nhttps://rulebook.fru.dev/regulations/eu-data-a ct URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-58@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250912 DTEND;VALUE=DATE:20250913 SUMMARY:EU Data Act: Member States notify penalty rules DESCRIPTION:Member States had to notify the Commission of their penalty rul es (Art 40(2)).\n\nRegulation (EU) 2023/2854 on harmonised rules on fair a ccess to and use of data (Data Act) (European Union)\n\nSource: https://eu r-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps://rulebook.fru.dev/regulatio ns/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-133@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250919 DTEND;VALUE=DATE:20250920 SUMMARY:Nigeria NDPA: GAID 2025 takes effect DESCRIPTION:General Application and Implementation Directive becomes effect ive\, replacing the NDPR 2019 and NDPR Implementation Framework.\n\nNigeri a Data Protection Act\, 2023 and NDPA General Application and Implementati on Directive (GAID) 2025 (Nigeria)\n\nSource: https://ndpc.gov.ng/resource s/\n\nhttps://rulebook.fru.dev/regulations/ng-ndpa URL:https://rulebook.fru.dev/regulations/ng-ndpa CATEGORIES:Nigeria,privacy,breach-notification,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-167@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250922 DTEND;VALUE=DATE:20250923 SUMMARY:CCPA / CPRA: ADMT\, risk assessment and cybersecurity audit regulat ions approved DESCRIPTION:OAL approves the CCPA Updates\, Cybersecurity Audit\, Risk Asse ssment\, ADMT and Insurance regulations and files them with the Secretary of State.\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the C alifornia Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\n\ nSource: https://cppa.ca.gov/regulations/ccpa_updates.html\n\nhttps://rule book.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-65@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250924 DTEND;VALUE=DATE:20250925 SUMMARY:Data Governance Act: Legacy data intermediaries must comply DESCRIPTION:Entities that were already providing data intermediation servic es on 23 June 2022 had to comply with Chapter III by 24 Sep 2025 (Art 37). \n\nRegulation (EU) 2022/868 on European data governance (Data Governance Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2022/86 8/oj\n\nhttps://rulebook.fru.dev/regulations/eu-dga URL:https://rulebook.fru.dev/regulations/eu-dga CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-135@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20250924 DTEND;VALUE=DATE:20250925 SUMMARY:New Zealand Privacy Act: Privacy Amendment Act 2025 technical chang es commence DESCRIPTION:Technical amendments commence the day after Royal Assent (23 Se p 2025).\n\nPrivacy Act 2020 (New Zealand)\, as amended by the Privacy Ame ndment Act 2025 (New Zealand)\n\nSource: https://www.justice.govt.nz/justi ce-sector-policy/key-initiatives/enhancing-the-privacy-act/\n\nhttps://rul ebook.fru.dev/regulations/nz-privacy-act URL:https://rulebook.fru.dev/regulations/nz-privacy-act CATEGORIES:New Zealand,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-212@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251001 DTEND;VALUE=DATE:20251002 SUMMARY:Colorado Privacy Act (CPA): Minors' data amendment (SB 24-041) effe ctive DESCRIPTION:Controllers offering online services to minors must use reasona ble care\, conduct assessments\, and obtain consent for targeted ads\, sal e and certain profiling of minors.\n\nColorado Privacy Act (SB 21-190)\, C .R.S. 6-1-1301 et seq.\, as amended by HB 24-1130\, SB 24-041 and SB 25-27 6 (Colorado)\n\nSource: https://leg.colorado.gov/bills/sb24-041\n\nhttps:/ /rulebook.fru.dev/regulations/us-co-cpa URL:https://rulebook.fru.dev/regulations/us-co-cpa CATEGORIES:Colorado,privacy,children,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-252@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251001 DTEND;VALUE=DATE:20251002 SUMMARY:Maryland Online Data Privacy Act (MODPA): MODPA takes effect DESCRIPTION:Act takes effect\; data protection assessments apply to process ing activities on or after Oct 1\, 2025.\n\nMaryland Online Data Privacy A ct of 2024 (SB 541 / HB 567)\, Md. Code\, Com. Law 14-4601 et seq. (Maryla nd)\n\nSource: https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0 541e.pdf\n\nhttps://rulebook.fru.dev/regulations/us-md-modpa URL:https://rulebook.fru.dev/regulations/us-md-modpa CATEGORIES:Maryland,privacy,children,health,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-259@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251001 DTEND;VALUE=DATE:20251002 SUMMARY:Montana Consumer Data Privacy Act (MCDPA): SB 297 amendments take e ffect\; cure period eliminated DESCRIPTION:Lower thresholds (25\,000 / 15\,000 + 25%)\, minors' data prote ctions\, AG assessment demands\; the 60-day cure period is removed.\n\nMon tana Consumer Data Privacy Act (SB 384\, 2023)\, Mont. Code Ann. 30-14-280 1 et seq.\, as amended by SB 297 (2025) (Montana)\n\nSource: https://archi ve.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300 -0140-0280-0170.html\n\nhttps://rulebook.fru.dev/regulations/us-mt-mcdpa URL:https://rulebook.fru.dev/regulations/us-mt-mcdpa CATEGORIES:Montana,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-228@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251006 DTEND;VALUE=DATE:20251007 SUMMARY:DOJ Bulk Data Rule: Due diligence\, audit and reporting obligations apply DESCRIPTION:Subpart J (data compliance program\, due diligence and audits f or restricted transactions) and reporting requirements in 202.1103 and 202 .1104 apply.\n\nPreventing Access to U.S. Sensitive Personal Data and Gove rnment-Related Data by Countries of Concern or Covered Persons (28 CFR Par t 202) - DOJ Data Security Program (United States (Federal))\n\nSource: ht tps://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-a ccess-to-us-sensitive-personal-data-and-government-related-data-by-countri es-of-concern\n\nhttps://rulebook.fru.dev/regulations/us-doj-bulk-data URL:https://rulebook.fru.dev/regulations/us-doj-bulk-data CATEGORIES:United States (Federal),privacy,data-residency,cybersecurity,bio metrics,health,financial TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-110@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251031 DTEND;VALUE=DATE:20251101 SUMMARY:EU-US Data Privacy Framework: Latombe appeal lodged at the Court of Justice DESCRIPTION:Latombe appealed the General Court judgment to the Court of Jus tice on points of law (reported as Case C-703/25 P)\; the DPF stays valid while it is pending.\n\nCommission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Pr ivacy Framework (European Union)\n\nSource: https://www.wilmerhale.com/en/ insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european- court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework\n\nht tps://rulebook.fru.dev/regulations/eu-us-dpf URL:https://rulebook.fru.dev/regulations/eu-us-dpf CATEGORIES:European Union,privacy,data-residency TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-116@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251113 DTEND;VALUE=DATE:20251114 SUMMARY:India DPDP Act: DPDP Rules published\; Board and procedural rules i n force DESCRIPTION:Rules 1\, 2 and 17-21 (Data Protection Board constitution and f unctioning) take effect on publication in the Official Gazette.\n\nDigital Personal Data Protection Act\, 2023 and Digital Personal Data Protection Rules\, 2025 (India)\n\nSource: https://egazette.gov.in/WriteReadData/2025 /267650.pdf\n\nhttps://rulebook.fru.dev/regulations/in-dpdp URL:https://rulebook.fru.dev/regulations/in-dpdp CATEGORIES:India,privacy,children,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-95@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251126 DTEND;VALUE=DATE:20251127 SUMMARY:GDPR: GDPR Procedural Regulation adopted DESCRIPTION:Regulation (EU) 2025/2518 laying down additional procedural rul es for cross-border GDPR enforcement signed by Parliament and Council.\n\n Regulation (EU) 2016/679 (General Data Protection Regulation) (European Un ion)\n\nSource: https://eur-lex.europa.eu/eli/reg/2025/2518/oj\n\nhttps:// rulebook.fru.dev/regulations/eu-gdpr URL:https://rulebook.fru.dev/regulations/eu-gdpr CATEGORIES:European Union,privacy,breach-notification,data-access,children, biometrics,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-296@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251203 DTEND;VALUE=DATE:20251204 SUMMARY:SEC Regulation S-P: Larger entities must comply DESCRIPTION:Larger covered institutions (18 months after Federal Register p ublication) must have incident response programs\, 30-day customer notific ation\, and service-provider oversight in place.\n\nRegulation S-P: Privac y of Consumer Financial Information and Safeguarding Customer Information (2024 amendments) (United States (Federal))\n\nSource: https://www.federal register.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-con sumer-financial-information-and-safeguarding-customer-information\n\nhttps ://rulebook.fru.dev/regulations/us-sec-reg-sp URL:https://rulebook.fru.dev/regulations/us-sec-reg-sp CATEGORIES:United States (Federal),financial,privacy,cybersecurity,breach-n otification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-224@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20251231 DTEND;VALUE=DATE:20260101 SUMMARY:Delaware Personal Data Privacy Act (DPDPA): Mandatory 60-day cure p eriod expires DESCRIPTION:Mandatory notice-and-cure ends Dec 31\, 2025\; from Jan 1\, 202 6 DOJ decides whether to offer a cure using statutory factors.\n\nDelaware Personal Data Privacy Act (HB 154)\, 6 Del. C. ch. 12D (Delaware)\n\nSour ce: https://delcode.delaware.gov/title6/c012d/index.html\n\nhttps://rulebo ok.fru.dev/regulations/us-de-dpdpa URL:https://rulebook.fru.dev/regulations/us-de-dpdpa CATEGORIES:Delaware,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-163@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:California AB 2013 (AI training data transparency): Training-data d ocumentation due DESCRIPTION:Documentation must be posted for GenAI systems released since J anuary 1\, 2022\, and before each later release or substantial modificatio n.\n\nCalifornia AB 2013\, Generative Artificial Intelligence: Training Da ta Transparency (Stats. 2024\, ch. 817) (California)\n\nSource: https://le ginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 \n\nhttps://rulebook.fru.dev/regulations/us-ca-ab2013 URL:https://rulebook.fru.dev/regulations/us-ca-ab2013 CATEGORIES:California,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-176@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:California Delete Act / DROP: DROP opens to consumers DESCRIPTION:Consumers can submit a single deletion request to all registere d data brokers through DROP.\n\nCalifornia Delete Act (SB 362\, 2023)\, Ca l. Civ. Code 1798.99.80 et seq.\, and DROP regulations (California)\n\nSou rce: https://www.cppa.ca.gov/data_brokers/\n\nhttps://rulebook.fru.dev/reg ulations/us-ca-delete-act URL:https://rulebook.fru.dev/regulations/us-ca-delete-act CATEGORIES:California,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-168@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:CCPA / CPRA: New CCPA regulations take effect DESCRIPTION:ADMT\, risk assessment\, cybersecurity audit and updated CCPA r egulations become effective\; risk assessments required for new high-risk processing.\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) a nd CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\ n\nSource: https://cppa.ca.gov/regulations/ccpa_updates.html\n\nhttps://ru lebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-32@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:China Cybersecurity Law: 2025 amendments take effect DESCRIPTION:Higher fines\, first-violation fines\, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.\n\n Cybersecurity Law of the People's Republic of China (as amended by the NPC Standing Committee Decision of 28 October 2025) (China)\n\nSource: https: //www.gov.cn/yaowen/liebiao/202510/content_7046194.htm\n\nhttps://rulebook .fru.dev/regulations/cn-csl URL:https://rulebook.fru.dev/regulations/cn-csl CATEGORIES:China,cybersecurity,data-residency,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-225@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Delaware Personal Data Privacy Act (DPDPA): Opt-out preference sign als must be honored DESCRIPTION:Controllers must allow opt-out of targeted advertising and sale via opt-out preference signals (12D-106).\n\nDelaware Personal Data Priva cy Act (HB 154)\, 6 Del. C. ch. 12D (Delaware)\n\nSource: https://delcode. delaware.gov/title6/c012d/index.html\n\nhttps://rulebook.fru.dev/regulatio ns/us-de-dpdpa URL:https://rulebook.fru.dev/regulations/us-de-dpdpa CATEGORIES:Delaware,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-96@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:GDPR: GDPR Procedural Regulation enters into force DESCRIPTION:Regulation (EU) 2025/2518\, published in the OJ on 12 December 2025\, enters into force on the twentieth day after publication.\n\nRegula tion (EU) 2016/679 (General Data Protection Regulation) (European Union)\n \nSource: https://eur-lex.europa.eu/eli/reg/2025/2518/oj\n\nhttps://rulebo ok.fru.dev/regulations/eu-gdpr URL:https://rulebook.fru.dev/regulations/eu-gdpr CATEGORIES:European Union,privacy,breach-notification,data-access,children, biometrics,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-248@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Indiana Consumer Data Protection Act (ICDPA): ICDPA takes effect DESCRIPTION:Consumer rights and controller/processor obligations apply\; as sessments required for processing activities created on or after this date .\n\nIndiana Consumer Data Protection Act (SEA 5\, 2023)\, Ind. Code 24-15 (Indiana)\n\nSource: https://iga.in.gov/legislative/2023/bills/senate/5/d etails\n\nhttps://rulebook.fru.dev/regulations/us-in-icdpa URL:https://rulebook.fru.dev/regulations/us-in-icdpa CATEGORIES:Indiana,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-249@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Kentucky Consumer Data Protection Act (KCDPA): KCDPA takes effect DESCRIPTION:Consumer rights and controller/processor obligations apply (HB 15 section 12).\n\nKentucky Consumer Data Protection Act (HB 15\, 2024)\, KRS 367.3611-367.3629 (Kentucky)\n\nSource: https://apps.legislature.ky.go v/recorddocuments/bill/24RS/hb15/bill.pdf\n\nhttps://rulebook.fru.dev/regu lations/us-ky-kcdpa URL:https://rulebook.fru.dev/regulations/us-ky-kcdpa CATEGORIES:Kentucky,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-262@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:New Hampshire Privacy Act: Mandatory 60-day cure period expires DESCRIPTION:The AG's obligation to issue a cure notice ended Dec 31\, 2025\ ; from Jan 1\, 2026 cure opportunities are discretionary (RSA 507-H:11 II- III).\n\nNew Hampshire Privacy Act (SB 255\, 2024)\, RSA chapter 507-H (Ne w Hampshire)\n\nSource: https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm\ n\nhttps://rulebook.fru.dev/regulations/us-nh-privacy URL:https://rulebook.fru.dev/regulations/us-nh-privacy CATEGORIES:New Hampshire,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-285@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Oregon OCPA: Cure period sunsets DESCRIPTION:The AG's 30-day notice-and-cure requirement expires\; enforceme nt can proceed without a cure opportunity.\n\nOregon Consumer Privacy Act (SB 619\, 2023) (Oregon)\n\nSource: https://www.oregonlegislature.gov/bill s_laws/ors/ors646A.html\n\nhttps://rulebook.fru.dev/regulations/us-or-ocpa URL:https://rulebook.fru.dev/regulations/us-or-ocpa CATEGORIES:Oregon,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-286@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Oregon OCPA: Universal opt-out signals must be honored DESCRIPTION:Controllers must honor opt-out preference signals such as Globa l Privacy Control.\n\nOregon Consumer Privacy Act (SB 619\, 2023) (Oregon) \n\nSource: https://www.doj.state.or.us/consumer-protection/id-theft-data- breaches/privacy/\n\nhttps://rulebook.fru.dev/regulations/us-or-ocpa URL:https://rulebook.fru.dev/regulations/us-or-ocpa CATEGORIES:Oregon,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-287@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Oregon OCPA: Sale ban on precise geolocation and under-16 data (HB 2008) DESCRIPTION:Selling precise geolocation (1\,750-ft radius) and the personal data of consumers the controller knows or willfully disregards are under 16 is prohibited.\n\nOregon Consumer Privacy Act (SB 619\, 2023) (Oregon)\ n\nSource: https://www.doj.state.or.us/consumer-protection/id-theft-data-b reaches/privacy/\n\nhttps://rulebook.fru.dev/regulations/us-or-ocpa URL:https://rulebook.fru.dev/regulations/us-or-ocpa CATEGORIES:Oregon,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-289@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Rhode Island RIDTPPA: RIDTPPA takes effect DESCRIPTION:All provisions of R.I. Gen. Laws ch. 6-48.1 apply (P.L. 2024\, ch. 430/453\, effective Jan 1\, 2026).\n\nRhode Island Data Transparency a nd Privacy Protection Act (Rhode Island)\n\nSource: https://webserver.rile gislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm\n\nhttps://rulebook.fru.dev /regulations/us-ri-dtppa URL:https://rulebook.fru.dev/regulations/us-ri-dtppa CATEGORIES:Rhode Island,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-324@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Vietnam PDPL: PDPL and Decree 356/2025 take effect DESCRIPTION:Personal data protection obligations\, DPIA/TIA filing and pena lty framework apply\; Decree 13/2023 replaced.\n\nLaw on Personal Data Pro tection (Law No. 91/2025/QH15) (Vietnam)\n\nSource: https://vanban.chinhph u.vn/?pageid=27160&docid=214590\n\nhttps://rulebook.fru.dev/regulations/vn -pdpl URL:https://rulebook.fru.dev/regulations/vn-pdpl CATEGORIES:Vietnam,privacy,data-residency,children,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-312@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260101 DTEND;VALUE=DATE:20260102 SUMMARY:Virginia VCDPA: Under-16 social media time limit (SB 854) takes eff ect DESCRIPTION:Social media platforms must use commercially reasonable age det ermination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27\, 2026 bars enforcement.\n\nVirgini a Consumer Data Protection Act (SB 1392 / HB 2307\, 2021) (Virginia)\n\nSo urce: https://netchoice.org/wp-content/uploads/2026/02/Virginia-PI-Opinion _Granted.pdf\n\nhttps://rulebook.fru.dev/regulations/us-va-vcdpa URL:https://rulebook.fru.dev/regulations/us-va-vcdpa CATEGORIES:Virginia,privacy,children,online-safety TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-177@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260131 DTEND;VALUE=DATE:20260201 SUMMARY:California Delete Act / DROP: Annual data broker registration deadl ine DESCRIPTION:Data brokers must register with CalPrivacy and pay the annual f ee ($6\,000 for 2026) by January 31.\n\nCalifornia Delete Act (SB 362\, 20 23)\, Cal. Civ. Code 1798.99.80 et seq.\, and DROP regulations (California )\n\nSource: https://www.cppa.ca.gov/data_brokers/\n\nhttps://rulebook.fru .dev/regulations/us-ca-delete-act URL:https://rulebook.fru.dev/regulations/us-ca-delete-act CATEGORIES:California,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-256@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260131 DTEND;VALUE=DATE:20260201 SUMMARY:Minnesota Consumer Data Privacy Act (MCDPA): 30-day cure period exp ires DESCRIPTION:The requirement that the AG send a warning letter and allow 30 days to cure before suing expires Jan 31\, 2026 (325M.20(a)).\n\nMinnesota Consumer Data Privacy Act (HF 4757\, 2024 Minn. Laws ch. 121\, art. 5)\, Minn. Stat. 325M.10-325M.21 (Minnesota)\n\nSource: https://www.revisor.mn. gov/statutes/cite/325M.20\n\nhttps://rulebook.fru.dev/regulations/us-mn-mc dpa URL:https://rulebook.fru.dev/regulations/us-mn-mcdpa CATEGORIES:Minnesota,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-201@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260201 DTEND;VALUE=DATE:20260202 SUMMARY:Colorado AI Act: Original effective date (superseded) DESCRIPTION:Original SB 24-205 date\; postponed by SB 25B-004\, so no oblig ations applied.\n\nColorado SB 24-205 (Consumer Protections for Artificial Intelligence)\, as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology) (Colorado)\n\nSource: https ://leg.colorado.gov/bills/sb24-205\n\nhttps://rulebook.fru.dev/regulations /us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-150@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260205 DTEND;VALUE=DATE:20260206 SUMMARY:Data (Use and Access) Act: Stage 3: main data protection changes co mmence DESCRIPTION:Recognised legitimate interests\, ADM reforms\, DSAR changes\, international transfer test\, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026\, reg. 2).\n\nData (Use and Access) Act 2025 (United Kingdom)\n\nSource: https://www.legislation.g ov.uk/uksi/2026/82/contents/made\n\nhttps://rulebook.fru.dev/regulations/u k-duaa URL:https://rulebook.fru.dev/regulations/uk-duaa CATEGORIES:United Kingdom,privacy,data-access,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-155@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260205 DTEND;VALUE=DATE:20260206 SUMMARY:UK GDPR: DUAA amendments to UK GDPR commence DESCRIPTION:Main Data (Use and Access) Act 2025 Part 5 amendments (recognis ed legitimate interests\, ADM\, DSAR\, transfers\, cookies\, PECR fines) a pply.\n\nUK General Data Protection Regulation and Data Protection Act 201 8 (United Kingdom)\n\nSource: https://www.legislation.gov.uk/uksi/2026/82/ contents/made\n\nhttps://rulebook.fru.dev/regulations/uk-gdpr URL:https://rulebook.fru.dev/regulations/uk-gdpr CATEGORIES:United Kingdom,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-239@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260216 DTEND;VALUE=DATE:20260217 SUMMARY:HIPAA: Notice of Privacy Practices updates (Part 2 alignment) DESCRIPTION:Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) chang es\; this NPP piece survived the Purl vacatur.\n\nHIPAA Privacy\, Security and Breach Notification Rules (45 CFR Parts 160 and 164) (United States ( Federal))\n\nSource: https://www.federalregister.gov/documents/2024/04/26/ 2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy\ n\nhttps://rulebook.fru.dev/regulations/us-hipaa URL:https://rulebook.fru.dev/regulations/us-hipaa CATEGORIES:United States (Federal),privacy,health,cybersecurity,breach-noti fication TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-313@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260227 DTEND;VALUE=DATE:20260228 SUMMARY:Virginia VCDPA: SB 854 preliminarily enjoined (NetChoice v. Jones) DESCRIPTION:E.D. Va. preliminarily enjoined enforcement of the SB 854 socia l media time-limit provisions on First Amendment grounds\; Virginia has ap pealed.\n\nVirginia Consumer Data Protection Act (SB 1392 / HB 2307\, 2021 ) (Virginia)\n\nSource: https://netchoice.org/wp-content/uploads/2026/02/V irginia-PI-Opinion_Granted.pdf\n\nhttps://rulebook.fru.dev/regulations/us- va-vcdpa URL:https://rulebook.fru.dev/regulations/us-va-vcdpa CATEGORIES:Virginia,privacy,children,online-safety TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-125@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260310 DTEND;VALUE=DATE:20260311 SUMMARY:South Korea PIPA: 2026 PIPA amendment promulgated (Act No. 21445) DESCRIPTION:Amendment raising fines to 10% of revenue and adding CEO accoun tability promulgated.\n\nPersonal Information Protection Act (as amended b y Act No. 21445\, 2026) (South Korea)\n\nSource: https://www.law.go.kr/법 령/개인정보보호법\n\nhttps://rulebook.fru.dev/regulations/kr-pipa URL:https://rulebook.fru.dev/regulations/kr-pipa CATEGORIES:South Korea,privacy,breach-notification,biometrics,data-residenc y TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-10@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260317 DTEND;VALUE=DATE:20260318 SUMMARY:Brazil ECA Digital: ECA Digital in force DESCRIPTION:Art. 41-A (as set by Law 15.352/2026\, following MP 1.319/2025) fixes entry into force on 17 March 2026.\n\nEstatuto Digital da Criança e do Adolescente (Law No. 15.211/2025) (Brazil)\n\nSource: https://www.pla nalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm\n\nhttps://rulebo ok.fru.dev/regulations/br-eca-digital URL:https://rulebook.fru.dev/regulations/br-eca-digital CATEGORIES:Brazil,children,online-safety,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-243@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260401 DTEND;VALUE=DATE:20260402 SUMMARY:Illinois BIPA: Seventh Circuit: amendment applies retroactively DESCRIPTION:Clay v. Union Pacific (No. 25-2185) holds the damages amendment is remedial and applies to pending cases.\n\nIllinois Biometric Informati on Privacy Act (740 ILCS 14)\, as amended by SB 2979 (Public Act 103-0769) (Illinois)\n\nSource: https://law.justia.com/cases/federal/appellate-cour ts/ca7/25-2185/25-2185-2026-04-01.html\n\nhttps://rulebook.fru.dev/regulat ions/us-il-bipa URL:https://rulebook.fru.dev/regulations/us-il-bipa CATEGORIES:Illinois,biometrics,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-253@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260401 DTEND;VALUE=DATE:20260402 SUMMARY:Maryland Online Data Privacy Act (MODPA): MODPA applies to personal data processing DESCRIPTION:The act applies to personal data processing activities from Apr il 1\, 2026 (Section 2 of ch. 455).\n\nMaryland Online Data Privacy Act of 2024 (SB 541 / HB 567)\, Md. Code\, Com. Law 14-4601 et seq. (Maryland)\n \nSource: https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e. pdf\n\nhttps://rulebook.fru.dev/regulations/us-md-modpa URL:https://rulebook.fru.dev/regulations/us-md-modpa CATEGORIES:Maryland,privacy,children,health,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-214@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260422 DTEND;VALUE=DATE:20260423 SUMMARY:COPPA Rule: Full compliance with amended COPPA Rule DESCRIPTION:Operators must comply with all amended provisions (separate thi rd-party disclosure consent\, written retention policy\, written security program\, updated notices)\; excludes Safe Harbor provisions 312.11(d)(1)\ , (d)(4) and (g)\, which had earlier dates.\n\nChildren's Online Privacy P rotection Rule (16 CFR Part 312)\, as amended April 2025 (United States (F ederal))\n\nSource: https://www.federalregister.gov/documents/2025/04/22/2 025-05904/childrens-online-privacy-protection-rule\n\nhttps://rulebook.fru .dev/regulations/us-coppa URL:https://rulebook.fru.dev/regulations/us-coppa CATEGORIES:United States (Federal),privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-136@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260501 DTEND;VALUE=DATE:20260502 SUMMARY:New Zealand Privacy Act: IPP 3A indirect-collection notification ap plies DESCRIPTION:Agencies collecting personal information from third parties mus t take reasonable steps to notify individuals\, subject to exceptions.\n\n Privacy Act 2020 (New Zealand)\, as amended by the Privacy Amendment Act 2 025 (New Zealand)\n\nSource: https://www.justice.govt.nz/justice-sector-po licy/key-initiatives/enhancing-the-privacy-act/\n\nhttps://rulebook.fru.de v/regulations/nz-privacy-act URL:https://rulebook.fru.dev/regulations/nz-privacy-act CATEGORIES:New Zealand,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-202@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260514 DTEND;VALUE=DATE:20260515 SUMMARY:Colorado AI Act: SB 26-189 signed (repeal and reenact) DESCRIPTION:SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure fr amework and moves the effective date to January 1\, 2027.\n\nColorado SB 2 4-205 (Consumer Protections for Artificial Intelligence)\, as delayed by S B 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Maki ng Technology) (Colorado)\n\nSource: https://leg.colorado.gov/bills/sb26-1 89\n\nhttps://rulebook.fru.dev/regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-299@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260519 DTEND;VALUE=DATE:20260520 SUMMARY:TAKE IT DOWN Act: Platform notice-and-removal process required DESCRIPTION:Covered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3\, one year after enactment).\n\nTools to Address Known Exploitation by Immobilizing Techno logical Deepfakes on Websites and Networks Act (TAKE IT DOWN Act) (United States (Federal))\n\nSource: https://www.govinfo.gov/content/pkg/PLAW-119p ubl12/html/PLAW-119publ12.htm\n\nhttps://rulebook.fru.dev/regulations/us-t ake-it-down URL:https://rulebook.fru.dev/regulations/us-take-it-down CATEGORIES:United States (Federal),online-safety,ai,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-87@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260521 DTEND;VALUE=DATE:20260522 SUMMARY:eIDAS 2 / EU Digital Identity Wallet: Legacy qualified trust servic e providers conformity report DESCRIPTION:QTSPs qualified before 20 May 2024 had to submit a conformity a ssessment report proving compliance with Art 24(1)\, (1a) and (1b) by 21 M ay 2026.\n\nRegulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2024/1183/o j\n\nhttps://rulebook.fru.dev/regulations/eu-eidas2 URL:https://rulebook.fru.dev/regulations/eu-eidas2 CATEGORIES:European Union,privacy,data-access,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-297@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260603 DTEND;VALUE=DATE:20260604 SUMMARY:SEC Regulation S-P: Smaller entities must comply DESCRIPTION:Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.\n\nRegulation S- P: Privacy of Consumer Financial Information and Safeguarding Customer Inf ormation (2024 amendments) (United States (Federal))\n\nSource: https://ww w.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-priva cy-of-consumer-financial-information-and-safeguarding-customer-information \n\nhttps://rulebook.fru.dev/regulations/us-sec-reg-sp URL:https://rulebook.fru.dev/regulations/us-sec-reg-sp CATEGORIES:United States (Federal),financial,privacy,cybersecurity,breach-n otification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-15@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260615 DTEND;VALUE=DATE:20260616 SUMMARY:Canada Bill C-36 (PPCDA): Bill C-36 tabled (first reading) DESCRIPTION:Government introduces the PPCDA in the House of Commons.\n\nBil l C-36\, An Act to enact the Protecting Privacy and Consumer Data Act (Can ada)\n\nSource: https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first -reading\n\nhttps://rulebook.fru.dev/regulations/ca-c36-ppcda URL:https://rulebook.fru.dev/regulations/ca-c36-ppcda CATEGORIES:Canada,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-151@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260619 DTEND;VALUE=DATE:20260620 SUMMARY:Data (Use and Access) Act: Mandatory data protection complaints pro cedure DESCRIPTION:Controllers must have a process for data subject complaints (s. 103 and Sch. 10)\, per Commencement No. 6 Regulations 2026\, reg. 3.\n\nDa ta (Use and Access) Act 2025 (United Kingdom)\n\nSource: https://www.legis lation.gov.uk/uksi/2026/82/contents/made\n\nhttps://rulebook.fru.dev/regul ations/uk-duaa URL:https://rulebook.fru.dev/regulations/uk-duaa CATEGORIES:United Kingdom,privacy,data-access,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-203@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260630 DTEND;VALUE=DATE:20260701 SUMMARY:Colorado AI Act: Delayed effective date (superseded) DESCRIPTION:SB 25B-004 date\; superseded by SB 26-189 before it arrived\, s o no obligations applied.\n\nColorado SB 24-205 (Consumer Protections for Artificial Intelligence)\, as delayed by SB 25B-004 and repealed and reena cted by SB 26-189 (Automated Decision-Making Technology) (Colorado)\n\nSou rce: https://leg.colorado.gov/bills/sb25b-004\n\nhttps://rulebook.fru.dev/ regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-267@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260630 DTEND;VALUE=DATE:20260701 SUMMARY:New Jersey NJDPA: A5328 sensitive data sale ban takes effect DESCRIPTION:A5328\, signed June 30\, 2026\, prohibits selling sensitive per sonal data\; the ban took effect on signing.\n\nNew Jersey Data Privacy Ac t (P.L.2023\, c.266\; S332) (New Jersey)\n\nSource: https://www.njleg.stat e.nj.us/bill-search/2026/A5328\n\nhttps://rulebook.fru.dev/regulations/us- nj-njdpa URL:https://rulebook.fru.dev/regulations/us-nj-njdpa CATEGORIES:New Jersey,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-218@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Connecticut Data Privacy Act (CTDPA): PA 25-113 (SB 1295) amendment s take effect DESCRIPTION:Thresholds drop to 35\,000 consumers or any sensitive-data proc essing or data sale\; expanded sensitive data\, minors' protections\, and LLM-training disclosure in privacy notices.\n\nConnecticut Data Privacy Ac t (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et seq.\, as amended by Pub lic Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Connecticut)\n\nSour ce: https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF \n\nhttps://rulebook.fru.dev/regulations/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-268@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:New Jersey NJDPA: Mandatory 30-day cure period expires DESCRIPTION:The Division's duty to issue a cure notice before enforcement e nds on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b)).\n\nNew Jersey Data Privacy Act (P.L.2023\, c.266\; S332) (New Jersey)\n\nSource: https://pub.njleg.state.nj.us/Bills/2022/PL23/266_ .PDF\n\nhttps://rulebook.fru.dev/regulations/us-nj-njdpa URL:https://rulebook.fru.dev/regulations/us-nj-njdpa CATEGORIES:New Jersey,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-309@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Utah UCPA: Right to correct takes effect DESCRIPTION:Consumers may ask controllers to correct inaccurate personal da ta (13-61-201(4)\, as amended by Laws 2025\, ch. 468).\n\nUtah Consumer Pr ivacy Act (SB 227\, 2022) (Utah)\n\nSource: https://le.utah.gov/xcode/Titl e13/Chapter61/13-61-S201.html\n\nhttps://rulebook.fru.dev/regulations/us-u t-ucpa URL:https://rulebook.fru.dev/regulations/us-ut-ucpa CATEGORIES:Utah,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-314@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260701 DTEND;VALUE=DATE:20260702 SUMMARY:Virginia VCDPA: Ban on selling precise geolocation data (SB 338) DESCRIPTION:Controllers may not sell consumers' precise geolocation data (1 \,750-ft radius)\, replacing the prior consent-based treatment.\n\nVirgini a Consumer Data Protection Act (SB 1392 / HB 2307\, 2021) (Virginia)\n\nSo urce: https://lis.virginia.gov/bill-details/20261/SB338\n\nhttps://ruleboo k.fru.dev/regulations/us-va-vcdpa URL:https://rulebook.fru.dev/regulations/us-va-vcdpa CATEGORIES:Virginia,privacy,children,online-safety TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-122@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260717 DTEND;VALUE=DATE:20260718 SUMMARY:Japan APPI: 2026 APPI amendment act promulgated DESCRIPTION:Amendment enacted by the Diet on 10 July 2026 and promulgated\; main provisions take effect by cabinet order within two years of promulga tion.\n\nAct on the Protection of Personal Information (Act No. 57 of 2003 )\, as amended including the 2026 amendment act (Japan)\n\nSource: https:/ /www.ppc.go.jp/files/pdf/260731_shiryou-1.pdf\n\nhttps://rulebook.fru.dev/ regulations/jp-appi URL:https://rulebook.fru.dev/regulations/jp-appi CATEGORIES:Japan,privacy,children,biometrics,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-178@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260801 DTEND;VALUE=DATE:20260802 SUMMARY:California Delete Act / DROP: Data brokers must begin processing DR OP deletion requests DESCRIPTION:Brokers must access DROP at least every 45 days\, process verif ied deletion requests within 45 days\, and treat unverified requests as op t-outs of sale/sharing.\n\nCalifornia Delete Act (SB 362\, 2023)\, Cal. Ci v. Code 1798.99.80 et seq.\, and DROP regulations (California)\n\nSource: https://www.cppa.ca.gov/data_brokers/\n\nhttps://rulebook.fru.dev/regulati ons/us-ca-delete-act URL:https://rulebook.fru.dev/regulations/us-ca-delete-act CATEGORIES:California,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-219@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260801 DTEND;VALUE=DATE:20260802 SUMMARY:Connecticut Data Privacy Act (CTDPA): Profiling impact assessments apply DESCRIPTION:Impact assessment requirements apply to profiling activities cr eated or generated on or after Aug 1\, 2026 (Conn. Gen. Stat. 42-522 as am ended).\n\nConnecticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. St at. 42-515 et seq.\, as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Connecticut)\n\nSource: https://www.cga.ct.gov/2025/ACT/ PA/PDF/2025PA-00113-R00SB-01295-PA.PDF\n\nhttps://rulebook.fru.dev/regulat ions/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-79@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260831 DTEND;VALUE=DATE:20260901 SUMMARY:Digital Services Act: ChatGPT designated as VLOSE\; Reddit and Robl ox as VLOPs DESCRIPTION:Commission designated ChatGPT as a very large online search eng ine and Reddit and Roblox as very large online platforms. They have four m onths (by January 2027) to meet VLOP/VLOSE obligations.\n\nRegulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act) (European Union)\n\nSource: https://digital-strategy.ec.europa.eu/en/news/ commission-designates-chatgpt-reddit-roblox-under-digital-services-act\n\n https://rulebook.fru.dev/regulations/eu-dsa URL:https://rulebook.fru.dev/regulations/eu-dsa CATEGORIES:European Union,online-safety,children,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-126@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260911 DTEND;VALUE=DATE:20260912 SUMMARY:South Korea PIPA: 2026 PIPA amendments take effect DESCRIPTION:10%-of-revenue fines\, CEO accountability\, and notice duties f or possible breaches apply.\n\nPersonal Information Protection Act (as ame nded by Act No. 21445\, 2026) (South Korea)\n\nSource: https://www.law.go. kr/법령/개인정보보호법\n\nhttps://rulebook.fru.dev/regulations/kr -pipa URL:https://rulebook.fru.dev/regulations/kr-pipa CATEGORIES:South Korea,privacy,breach-notification,biometrics,data-residenc y TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-59@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260912 DTEND;VALUE=DATE:20260913 SUMMARY:EU Data Act: Access-by-design for new connected products DESCRIPTION:Art 3(1) design obligation (product data and related service da ta accessible to the user by default) applies to connected products and re lated services placed on the market after 12 Sep 2026.\n\nRegulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2023/2854/o j\n\nhttps://rulebook.fru.dev/regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-152@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20260930 DTEND;VALUE=DATE:20261001 SUMMARY:Data (Use and Access) Act: ICO abolished\; Information Commission t akes over DESCRIPTION:Sections 118-119 commence: office of Information Commissioner a bolished and functions transferred to the Information Commission (Commence ment No. 9 Regulations 2026).\n\nData (Use and Access) Act 2025 (United Ki ngdom)\n\nSource: https://www.legislation.gov.uk/uksi/2026/1015/regulation /2/made\n\nhttps://rulebook.fru.dev/regulations/uk-duaa URL:https://rulebook.fru.dev/regulations/uk-duaa CATEGORIES:United Kingdom,privacy,data-access,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-220@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261001 DTEND;VALUE=DATE:20261002 SUMMARY:Connecticut Data Privacy Act (CTDPA): PA 26-64 (SB 4) amendments ta ke effect DESCRIPTION:Prohibits controllers and third parties from selling precise ge olocation data and enacts data broker and other consumer protection provis ions.\n\nConnecticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat . 42-515 et seq.\, as amended by Public Act 25-113 (SB 1295) and Public Ac t 26-64 (SB 4) (Connecticut)\n\nSource: https://www.cga.ct.gov/2026/ACT/PA /PDF/2026PA-00064-R00SB-00004-PA.PDF\n\nhttps://rulebook.fru.dev/regulatio ns/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-117@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261113 DTEND;VALUE=DATE:20261114 SUMMARY:India DPDP Act: Consent Manager registration rule in force (12 mont hs) DESCRIPTION:Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.\n\nDigital Personal Data Protectio n Act\, 2023 and Digital Personal Data Protection Rules\, 2025 (India)\n\n Source: https://egazette.gov.in/WriteReadData/2025/267650.pdf\n\nhttps://r ulebook.fru.dev/regulations/in-dpdp URL:https://rulebook.fru.dev/regulations/in-dpdp CATEGORIES:India,privacy,children,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-27@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261201 DTEND;VALUE=DATE:20261202 SUMMARY:Chile Personal Data Protection Law (Ley 21.719): Law in force DESCRIPTION:Main obligations apply and the Personal Data Protection Agency begins supervision.\n\nLey Nº 21.719 que regula la protección y el trata miento de los datos personales y crea la Agencia de Protección de Datos P ersonales (Chile)\n\nSource: https://www.bcn.cl/leychile/navegar?idNorma=1 209272\n\nhttps://rulebook.fru.dev/regulations/cl-pdpl URL:https://rulebook.fru.dev/regulations/cl-pdpl CATEGORIES:Chile,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-6@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261210 DTEND;VALUE=DATE:20261211 SUMMARY:Australia Privacy Act: Children's Online Privacy Code must be regis tered DESCRIPTION:OAIC must develop and register the Children's Online Privacy Co de within 24 months of Royal Assent.\n\nPrivacy Act 1988 (Cth)\, as amende d by the Privacy and Other Legislation Amendment Act 2024 (Australia)\n\nS ource: https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/chi ldrens-online-privacy-code\n\nhttps://rulebook.fru.dev/regulations/au-priv acy-act URL:https://rulebook.fru.dev/regulations/au-privacy-act CATEGORIES:Australia,privacy,children,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-7@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261210 DTEND;VALUE=DATE:20261211 SUMMARY:Australia Privacy Act: Automated decision-making transparency appli es DESCRIPTION:Privacy policies must disclose the kinds of personal informatio n used in substantially automated decisions that significantly affect indi viduals (24 months after assent).\n\nPrivacy Act 1988 (Cth)\, as amended b y the Privacy and Other Legislation Amendment Act 2024 (Australia)\n\nSour ce: https://www.legislation.gov.au/C2024A00128/asmade\n\nhttps://rulebook. fru.dev/regulations/au-privacy-act URL:https://rulebook.fru.dev/regulations/au-privacy-act CATEGORIES:Australia,privacy,children,breach-notification,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-88@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20261224 DTEND;VALUE=DATE:20261225 SUMMARY:eIDAS 2 / EU Digital Identity Wallet: Member States must provide EU Digital Identity Wallets DESCRIPTION:Each Member State must provide at least one wallet within 24 mo nths of the entry into force of the implementing acts under Arts 5a(23) an d 5c(6) (Art 5a(1)).\n\nRegulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framewo rk (eIDAS 2) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg _impl/2024/2977/oj\n\nhttps://rulebook.fru.dev/regulations/eu-eidas2 URL:https://rulebook.fru.dev/regulations/eu-eidas2 CATEGORIES:European Union,privacy,data-access,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-169@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:CCPA / CPRA: ADMT requirements compliance date DESCRIPTION:Businesses using ADMT for significant decisions must comply wit h Article 11 (pre-use notice\, opt-out\, access rights) by this date (11 C CR 7200(b)).\n\nCalifornia Consumer Privacy Act of 2018\, as amended by th e California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California) \n\nSource: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_ad mt_appr_text.pdf\n\nhttps://rulebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-170@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:CCPA / CPRA: Browsers must support opt-out preference signal (AB 56 6) DESCRIPTION:Businesses that develop or maintain a browser must include cons umer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136\, operative Jan 1\, 2027).\n\nCalifornia Consumer Privacy A ct of 2018\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11 \, 7000 et seq.) (California)\n\nSource: https://leginfo.legislature.ca.go v/faces/billStatusClient.xhtml?bill_id=202520260AB566\n\nhttps://rulebook. fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-204@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Colorado AI Act: ADMT obligations apply DESCRIPTION:Developer documentation\, consumer notices\, post-adverse-outco me disclosure\, correction and human-review rights take effect.\n\nColorad o SB 24-205 (Consumer Protections for Artificial Intelligence)\, as delaye d by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decisio n-Making Technology) (Colorado)\n\nSource: https://leg.colorado.gov/bills/ sb26-189\n\nhttps://rulebook.fru.dev/regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-205@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Colorado AI Act: AG rules due DESCRIPTION:Attorney General must adopt rules clarifying the post-adverse-o utcome disclosure requirements.\n\nColorado SB 24-205 (Consumer Protection s for Artificial Intelligence)\, as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 (Automated Decision-Making Technology) (Colorado)\ n\nSource: https://leg.colorado.gov/bills/sb26-189\n\nhttps://rulebook.fru .dev/regulations/us-co-ai-act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-221@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Connecticut Data Privacy Act (CTDPA): Data broker registration requ ired DESCRIPTION:Data brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ( $2\,500 initial fee).\n\nConnecticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et seq.\, as amended by Public Act 25-113 (SB 129 5) and Public Act 26-64 (SB 4) (Connecticut)\n\nSource: https://www.cga.ct .gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF\n\nhttps://rulebook.f ru.dev/regulations/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-226@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Delaware Personal Data Privacy Act (DPDPA): Amended thresholds and third-party duties take effect DESCRIPTION:Applicability drops to 10\,000 consumers (or 5\,000 + 20% reven ue from sale) and new third-party duties (12D-107A) apply.\n\nDelaware Per sonal Data Privacy Act (HB 154)\, 6 Del. C. ch. 12D (Delaware)\n\nSource: https://delcode.delaware.gov/title6/c012d/index.html\n\nhttps://rulebook.f ru.dev/regulations/us-de-dpdpa URL:https://rulebook.fru.dev/regulations/us-de-dpdpa CATEGORIES:Delaware,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-250@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Louisiana Data Privacy Act: Louisiana Data Privacy Act takes effect DESCRIPTION:Consumer rights and controller duties apply (Act 502\, Section 2)\; data protection assessment requirements apply to processing from this date.\n\nLouisiana Data Privacy Act (SB 386\, 2026 Regular Session\, Act No. 502)\, La. R.S. 51:1780.1-1780.5 (Louisiana)\n\nSource: https://legis. la.gov/legis/ViewDocument.aspx?d=1480202\n\nhttps://rulebook.fru.dev/regul ations/us-la-ldpa URL:https://rulebook.fru.dev/regulations/us-la-ldpa CATEGORIES:Louisiana,privacy,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-263@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:New Hampshire Privacy Act: Ban on selling personal data of children under 13 (HB 1460) DESCRIPTION:HB 1460 (2026\, ch. 168) prohibits controllers from selling the personal data of a child under 13.\n\nNew Hampshire Privacy Act (SB 255\, 2024)\, RSA chapter 507-H (New Hampshire)\n\nSource: https://gc.nh.gov/bi ll_status/billinfo.aspx?id=2443&inflect=2\n\nhttps://rulebook.fru.dev/regu lations/us-nh-privacy URL:https://rulebook.fru.dev/regulations/us-nh-privacy CATEGORIES:New Hampshire,privacy,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-282@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Oklahoma OKCDPA: Oklahoma Consumer Data Privacy Act takes effect DESCRIPTION:All OKCDPA obligations and consumer rights apply.\n\nOklahoma C onsumer Data Privacy Act (SB 546\, 2026) (Oklahoma)\n\nSource: https://www .okhouse.gov/posts/news-20260323_2\n\nhttps://rulebook.fru.dev/regulations /us-ok-okcdpa URL:https://rulebook.fru.dev/regulations/us-ok-okcdpa CATEGORIES:Oklahoma,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-310@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270101 DTEND;VALUE=DATE:20270102 SUMMARY:Utah UCPA: UCPA extends to motor vehicle manufacturers DESCRIPTION:Motor vehicle manufacturers whose vehicles are sold or leased i n Utah and that collect personal data through vehicle data systems are cov ered regardless of the revenue and consumer thresholds (13-61-102\, as ame nded by Laws 2026\, ch. 193).\n\nUtah Consumer Privacy Act (SB 227\, 2022) (Utah)\n\nSource: https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102. html\n\nhttps://rulebook.fru.dev/regulations/us-ut-ucpa URL:https://rulebook.fru.dev/regulations/us-ut-ucpa CATEGORIES:Utah,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-60@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270112 DTEND;VALUE=DATE:20270113 SUMMARY:EU Data Act: Cloud switching charges abolished DESCRIPTION:Providers of data processing services may no longer impose any switching charges on customers (Art 29(1)).\n\nRegulation (EU) 2023/2854 o n harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps: //rulebook.fru.dev/regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-114@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270116 DTEND;VALUE=DATE:20270117 SUMMARY:Indonesia PDP Law: Implementing regulation GR 33/2026 takes effect DESCRIPTION:Detailed PDP implementing rules (DPIA\, cross-border\, children 's consent) apply\, 6 months after the 16 Jul 2026 enactment.\n\nLaw No. 2 7 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Prib adi) (Indonesia)\n\nSource: https://www.kk-advocates.com/news/read/indones ia-gr-pdp-personal-data-protection-compliance-regime-new-phase\n\nhttps:// rulebook.fru.dev/regulations/id-pdp URL:https://rulebook.fru.dev/regulations/id-pdp CATEGORIES:Indonesia,privacy,breach-notification,data-residency,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-179@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270131 DTEND;VALUE=DATE:20270201 SUMMARY:California Delete Act / DROP: Annual data broker registration deadl ine DESCRIPTION:Data brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.\n\nCalifornia Delete Act (SB 362\, 2023)\, Cal. Civ. Code 1798.99.80 et seq.\, and DROP regulation s (California)\n\nSource: https://leginfo.legislature.ca.gov/faces/codes_d isplaySection.xhtml?lawCode=CIV§ionNum=1798.99.82\n\nhttps://rulebook. fru.dev/regulations/us-ca-delete-act URL:https://rulebook.fru.dev/regulations/us-ca-delete-act CATEGORIES:California,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-81@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270326 DTEND;VALUE=DATE:20270327 SUMMARY:European Health Data Space (EHDS): EHDS general application date DESCRIPTION:The regulation applies generally from 26 Mar 2027\, subject to the phased exceptions below (final article).\n\nRegulation (EU) 2025/327 o n the European Health Data Space (European Union)\n\nSource: https://eur-l ex.europa.eu/eli/reg/2025/327/oj\n\nhttps://rulebook.fru.dev/regulations/e u-ehds URL:https://rulebook.fru.dev/regulations/eu-ehds CATEGORIES:European Union,health,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-254@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270401 DTEND;VALUE=DATE:20270402 SUMMARY:Maryland Online Data Privacy Act (MODPA): Discretionary 60-day cure period ends DESCRIPTION:The Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1\, 2027 (Com. La w 14-4614).\n\nMaryland Online Data Privacy Act of 2024 (SB 541 / HB 567)\ , Md. Code\, Com. Law 14-4601 et seq. (Maryland)\n\nSource: https://mgaleg .maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf\n\nhttps://rulebook. fru.dev/regulations/us-md-modpa URL:https://rulebook.fru.dev/regulations/us-md-modpa CATEGORIES:Maryland,privacy,children,health,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-97@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270402 DTEND;VALUE=DATE:20270403 SUMMARY:GDPR: GDPR Procedural Regulation applies DESCRIPTION:Harmonised rules for cross-border complaint admissibility\, rig hts to be heard and access to preliminary findings\, and investigation tim elines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518\, final article).\n\nRegulation (EU) 2016/679 (General Data Protection Regulation) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2025/2518/o j\n\nhttps://rulebook.fru.dev/regulations/eu-gdpr URL:https://rulebook.fru.dev/regulations/eu-gdpr CATEGORIES:European Union,privacy,breach-notification,data-access,children, biometrics,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-161@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270501 DTEND;VALUE=DATE:20270502 SUMMARY:Alabama Personal Data Protection Act (APDPA): APDPA takes effect DESCRIPTION:Consumer rights and controller/processor obligations apply (HB 351 section 12).\n\nAlabama Personal Data Protection Act (HB 351\, 2026 Re gular Session) (Alabama)\n\nSource: https://alison.legislature.state.al.us /files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf\n\nhttps://rulebook. fru.dev/regulations/us-al-apdpa URL:https://rulebook.fru.dev/regulations/us-al-apdpa CATEGORIES:Alabama,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-118@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270513 DTEND;VALUE=DATE:20270514 SUMMARY:India DPDP Act: Main data fiduciary obligations apply (18 months) DESCRIPTION:Rules 3\, 5-16\, 22 and 23 (notice\, security safeguards\, brea ch notification\, retention\, children's consent\, SDF duties\, cross-bord er) come into force 18 months after publication.\n\nDigital Personal Data Protection Act\, 2023 and Digital Personal Data Protection Rules\, 2025 (I ndia)\n\nSource: https://egazette.gov.in/WriteReadData/2025/267650.pdf\n\n https://rulebook.fru.dev/regulations/in-dpdp URL:https://rulebook.fru.dev/regulations/in-dpdp CATEGORIES:India,privacy,children,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-127@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270701 DTEND;VALUE=DATE:20270702 SUMMARY:South Korea PIPA: Mandatory ISMS-P certification DESCRIPTION:ISMS-P certification becomes mandatory for private entities mee ting the statutory criteria.\n\nPersonal Information Protection Act (as am ended by Act No. 21445\, 2026) (South Korea)\n\nSource: https://www.law.go .kr/법령/개인정보보호법\n\nhttps://rulebook.fru.dev/regulations/k r-pipa URL:https://rulebook.fru.dev/regulations/kr-pipa CATEGORIES:South Korea,privacy,breach-notification,biometrics,data-residenc y TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-251@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270731 DTEND;VALUE=DATE:20270801 SUMMARY:Louisiana Data Privacy Act: 30-day cure period expires DESCRIPTION:AG's obligation to give 30-day notice and allow cure before inv estigating applies only from Jan 1 through July 31\, 2027 (R.S. 51:1780.5( D)).\n\nLouisiana Data Privacy Act (SB 386\, 2026 Regular Session\, Act No . 502)\, La. R.S. 51:1780.1-1780.5 (Louisiana)\n\nSource: https://legis.la .gov/legis/ViewDocument.aspx?d=1480202\n\nhttps://rulebook.fru.dev/regulat ions/us-la-ldpa URL:https://rulebook.fru.dev/regulations/us-la-ldpa CATEGORIES:Louisiana,privacy,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-61@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20270912 DTEND;VALUE=DATE:20270913 SUMMARY:EU Data Act: Unfair-terms rules extend to older long-term contracts DESCRIPTION:Chapter IV (unfair contractual terms) applies to contracts conc luded on or before 12 Sep 2025 that are of indefinite duration or expire a t least 10 years from 11 Jan 2024 (Art 50).\n\nRegulation (EU) 2023/2854 o n harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps: //rulebook.fru.dev/regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-28@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20271201 DTEND;VALUE=DATE:20271202 SUMMARY:Chile Personal Data Protection Law (Ley 21.719): Proposed postponem ent of entry into force DESCRIPTION:Government bill Boletin 18623-07 (filed 1 Sep 2026\, 'suma' urg ency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027\; in first committee stage in the Senate\, not law.\n\nTentative: depends on a proposal not yet adopted.\n\nLey Nº 21.71 9 que regula la protección y el tratamiento de los datos personales y cre a la Agencia de Protección de Datos Personales (Chile)\n\nSource: https:/ /tramitacion.senado.cl/appsenado/templates/tramitacion/index.php?boletin_i ni=18623-07\n\nhttps://rulebook.fru.dev/regulations/cl-pdpl URL:https://rulebook.fru.dev/regulations/cl-pdpl CATEGORIES:Chile,privacy,breach-notification TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-89@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20271224 DTEND;VALUE=DATE:20271225 SUMMARY:eIDAS 2 / EU Digital Identity Wallet: Private relying parties must accept wallets DESCRIPTION:Private relying parties required by law or contract to use stro ng user authentication must accept wallets on user request within 36 month s of the implementing acts' entry into force (Art 5f(2)).\n\nRegulation (E U) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2) (European Union)\n\nSour ce: https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj\n\nhttps://ruleboo k.fru.dev/regulations/eu-eidas2 URL:https://rulebook.fru.dev/regulations/eu-eidas2 CATEGORIES:European Union,privacy,data-access,biometrics TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-171@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20271231 DTEND;VALUE=DATE:20280101 SUMMARY:CCPA / CPRA: Risk assessments for pre-existing processing due DESCRIPTION:Risk assessments must be completed and documented for high-risk processing that began before Jan 1\, 2026 and continues after (11 CCR 715 5(b)).\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the Cali fornia Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CP PA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\n\nSo urce: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_app r_text.pdf\n\nhttps://rulebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-180@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20280101 DTEND;VALUE=DATE:20280102 SUMMARY:California Delete Act / DROP: Independent third-party audits begin DESCRIPTION:Beginning Jan 1\, 2028 and every 3 years thereafter\, data brok ers must undergo an independent audit of Delete Act compliance.\n\nCalifor nia Delete Act (SB 362\, 2023)\, Cal. Civ. Code 1798.99.80 et seq.\, and D ROP regulations (California)\n\nSource: https://www.cppa.ca.gov/data_broke rs/\n\nhttps://rulebook.fru.dev/regulations/us-ca-delete-act URL:https://rulebook.fru.dev/regulations/us-ca-delete-act CATEGORIES:California,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-315@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20280101 DTEND;VALUE=DATE:20280102 SUMMARY:Vermont VDPOSA: Vermont Data Privacy and Online Surveillance Act ta kes effect DESCRIPTION:All obligations under Act 145 apply (sec. 4).\n\nVermont Data P rivacy and Online Surveillance Act (S.71\, Act 145 of 2026) (Vermont)\n\nS ource: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT 145%20As%20Enacted.pdf\n\nhttps://rulebook.fru.dev/regulations/us-vt-vdpos a URL:https://rulebook.fru.dev/regulations/us-vt-vdposa CATEGORIES:Vermont,privacy,health,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-172@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20280401 DTEND;VALUE=DATE:20280402 SUMMARY:CCPA / CPRA: First risk assessment submission to CPPA DESCRIPTION:Businesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1) )\; annually by April 1 thereafter.\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 700 0 et seq.) (California)\n\nSource: https://cppa.ca.gov/regulations/pdf/ccp a_updates_cyber_risk_admt_appr_text.pdf\n\nhttps://rulebook.fru.dev/regula tions/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-173@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20280401 DTEND;VALUE=DATE:20280402 SUMMARY:CCPA / CPRA: Cybersecurity audit due: revenue over $100M DESCRIPTION:First cybersecurity audit report (covering Jan 1\, 2027 - Jan 1 \, 2028) and certification due for businesses with 2026 annual gross reven ue over $100M (11 CCR 7121(a)(1)).\n\nCalifornia Consumer Privacy Act of 2 018\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. C ode 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\n\nSource: https://cppa.ca.gov/regulations/pdf/ccpa _updates_cyber_risk_admt_appr_text.pdf\n\nhttps://rulebook.fru.dev/regulat ions/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-62@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20280912 DTEND;VALUE=DATE:20280913 SUMMARY:EU Data Act: Commission evaluation DESCRIPTION:Commission evaluation report due\, including the impact of clou d switching rules (Arts 23-31) (Art 49(2)).\n\nRegulation (EU) 2023/2854 o n harmonised rules on fair access to and use of data (Data Act) (European Union)\n\nSource: https://eur-lex.europa.eu/eli/reg/2023/2854/oj\n\nhttps: //rulebook.fru.dev/regulations/eu-data-act URL:https://rulebook.fru.dev/regulations/eu-data-act CATEGORIES:European Union,data-access,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-222@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20281001 DTEND;VALUE=DATE:20281002 SUMMARY:Connecticut Data Privacy Act (CTDPA): Data brokers must process sta te deletion mechanism requests DESCRIPTION:Registered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.\n\nConnec ticut Data Privacy Act (Public Act 22-15)\, Conn. Gen. Stat. 42-515 et seq .\, as amended by Public Act 25-113 (SB 1295) and Public Act 26-64 (SB 4) (Connecticut)\n\nSource: https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-000 64-R00SB-00004-PA.PDF\n\nhttps://rulebook.fru.dev/regulations/us-ct-ctdpa URL:https://rulebook.fru.dev/regulations/us-ct-ctdpa CATEGORIES:Connecticut,privacy,children,ai,health TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-82@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20290326 DTEND;VALUE=DATE:20290327 SUMMARY:European Health Data Space (EHDS): Primary use for first data categ ories\; secondary use framework applies DESCRIPTION:Patient rights and EHR rules apply to patient summaries\, ePres criptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits\, Health Data Access Bodies) apply.\n\nRegulation (EU) 2025/327 on the European Health Data Space (European Union)\n\nSource: ht tps://eur-lex.europa.eu/eli/reg/2025/327/oj\n\nhttps://rulebook.fru.dev/re gulations/eu-ehds URL:https://rulebook.fru.dev/regulations/eu-ehds CATEGORIES:European Union,health,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-174@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20290401 DTEND;VALUE=DATE:20290402 SUMMARY:CCPA / CPRA: Cybersecurity audit due: revenue $50M-$100M DESCRIPTION:First cybersecurity audit report (covering 2028) due for busine sses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a) (2)).\n\nCalifornia Consumer Privacy Act of 2018\, as amended by the Calif ornia Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.) and CPP A regulations (Cal. Code Regs. tit. 11\, 7000 et seq.) (California)\n\nSou rce: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr _text.pdf\n\nhttps://rulebook.fru.dev/regulations/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-316@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20290630 DTEND;VALUE=DATE:20290701 SUMMARY:Vermont VDPOSA: Mandatory 60-day cure period expires DESCRIPTION:The AG's duty to issue a cure notice before enforcement ends Ju ne 30\, 2029 (Act 145 sec. 3).\n\nVermont Data Privacy and Online Surveill ance Act (S.71\, Act 145 of 2026) (Vermont)\n\nSource: https://legislature .vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf\n\n https://rulebook.fru.dev/regulations/us-vt-vdposa URL:https://rulebook.fru.dev/regulations/us-vt-vdposa CATEGORIES:Vermont,privacy,health,ai TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-257@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20290731 DTEND;VALUE=DATE:20290801 SUMMARY:Minnesota Consumer Data Privacy Act (MCDPA): Postsecondary institut ions must comply DESCRIPTION:Postsecondary institutions regulated by the Office of Higher Ed ucation must comply by July 31\, 2029.\n\nMinnesota Consumer Data Privacy Act (HF 4757\, 2024 Minn. Laws ch. 121\, art. 5)\, Minn. Stat. 325M.10-325 M.21 (Minnesota)\n\nSource: https://www.revisor.mn.gov/statutes/cite/325M. 20\n\nhttps://rulebook.fru.dev/regulations/us-mn-mcdpa URL:https://rulebook.fru.dev/regulations/us-mn-mcdpa CATEGORIES:Minnesota,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-206@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20300101 DTEND;VALUE=DATE:20300102 SUMMARY:Colorado AI Act: Mandatory cure period ends DESCRIPTION:The AG's obligation to offer a 60-day notice-and-cure period ex pires.\n\nColorado SB 24-205 (Consumer Protections for Artificial Intellig ence)\, as delayed by SB 25B-004 and repealed and reenacted by SB 26-189 ( Automated Decision-Making Technology) (Colorado)\n\nSource: https://leg.co lorado.gov/bills/sb26-189\n\nhttps://rulebook.fru.dev/regulations/us-co-ai -act URL:https://rulebook.fru.dev/regulations/us-co-ai-act CATEGORIES:Colorado,ai,privacy TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-175@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20300401 DTEND;VALUE=DATE:20300402 SUMMARY:CCPA / CPRA: Cybersecurity audit due: revenue under $50M DESCRIPTION:First cybersecurity audit report (covering 2029) due for covere d businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)) \; annual by April 1 thereafter.\n\nCalifornia Consumer Privacy Act of 201 8\, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Cod e 1798.100 et seq.) and CPPA regulations (Cal. Code Regs. tit. 11\, 7000 e t seq.) (California)\n\nSource: https://cppa.ca.gov/regulations/pdf/ccpa_u pdates_cyber_risk_admt_appr_text.pdf\n\nhttps://rulebook.fru.dev/regulatio ns/us-ca-ccpa URL:https://rulebook.fru.dev/regulations/us-ca-ccpa CATEGORIES:California,privacy,ai,cybersecurity,children TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-83@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20310326 DTEND;VALUE=DATE:20310327 SUMMARY:European Health Data Space (EHDS): Primary use for second data cate gories\; EHR systems in service\; extra secondary-use categories DESCRIPTION:Primary-use rules extend to medical images\, lab results and di scharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b)\,(f)\,(g)\,(m)\,(p) apply.\n\nRegulation (EU) 2025/327 on the Eur opean Health Data Space (European Union)\n\nSource: https://eur-lex.europa .eu/eli/reg/2025/327/oj\n\nhttps://rulebook.fru.dev/regulations/eu-ehds URL:https://rulebook.fru.dev/regulations/eu-ehds CATEGORIES:European Union,health,privacy,data-access TRANSP:TRANSPARENT END:VEVENT BEGIN:VEVENT UID:deadline-84@regulations.fru.dev DTSTAMP:20260924T112050Z DTSTART;VALUE=DATE:20350326 DTEND;VALUE=DATE:20350327 SUMMARY:European Health Data Space (EHDS): Third-country participation in s econdary use DESCRIPTION:Art 75(5) applies from 26 Mar 2035.\n\nRegulation (EU) 2025/327 on the European Health Data Space (European Union)\n\nSource: https://eur -lex.europa.eu/eli/reg/2025/327/oj\n\nhttps://rulebook.fru.dev/regulations /eu-ehds URL:https://rulebook.fru.dev/regulations/eu-ehds CATEGORIES:European Union,health,privacy,data-access TRANSP:TRANSPARENT END:VEVENT END:VCALENDAR