United States (Federal): data, AI and cyber laws

SEC Regulation S-PUnited States (Federal)

Smaller entities must comply

Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.

TAKE IT DOWN ActUnited States (Federal)

Platform notice-and-removal process required

Covered platforms must have a clear notice-and-removal process and remove valid reported content within 48 hours (Sec. 3, one year after enactment).

COPPA RuleUnited States (Federal)

Full compliance with amended COPPA Rule

Operators must comply with all amended provisions (separate third-party disclosure consent, written retention policy, written security program, updated notices); excludes Safe Harbor provisions 312.11(d)(1), (d)(4) and (g), which had earlier dates.

HIPAAUnited States (Federal)

Notice of Privacy Practices updates (Part 2 alignment)

Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.

SEC Regulation S-PUnited States (Federal)

Larger entities must comply

Larger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.

CMMC 2.0United States (Federal)

DFARS rule effective; Phase 1 begins

CMMC Level 1 and Level 2 self-assessment requirements begin appearing in applicable DoD solicitations and contracts (32 CFR 170.3(e)(1)).

DOJ Bulk Data RuleUnited States (Federal)

Due diligence, audit and reporting obligations apply

Subpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.

COPPA RuleUnited States (Federal)

Amended COPPA Rule takes effect

The April 2025 amendments to 16 CFR Part 312 became effective; during the transition operators could comply with either the pre-2025 or the amended Rule.

TAKE IT DOWN ActUnited States (Federal)

Criminal provisions effective on enactment

Publishing or threatening to publish non-consensual intimate images, including digital forgeries, became a federal crime upon signature.

DOJ Bulk Data RuleUnited States (Federal)

Prohibitions and restrictions take effect

Core prohibitions on covered data transactions and security requirements for restricted transactions apply.

HIPAAUnited States (Federal)

Security Rule NPRM comment period closed

Comments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.

HIPAAUnited States (Federal)

Reproductive health privacy compliance date (vacated)

Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of Item 1.05 disclosures

Form 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.

CMMC 2.0United States (Federal)

CMMC Program rule (32 CFR Part 170) effective

The program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of annual cybersecurity disclosures

Item 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.

SEC Regulation S-PUnited States (Federal)

Amendments effective

The Regulation S-P amendments became effective; compliance tiered by entity size.

FTC Health Breach Notification RuleUnited States (Federal)

2024 amendments effective

Amendments clarifying health app coverage, unauthorized disclosure as breach, email notice and FTC notice timing took effect.

CIRCIAUnited States (Federal)

NPRM comment period closed

Extended comment period on the CIRCIA proposed rule closed.

HIPAAUnited States (Federal)

Reproductive health care privacy rule effective (later vacated)

The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).

PADFAUnited States (Federal)

PADFA takes effect

The prohibition takes effect 60 days after enactment (April 24, 2024).

SEC Cyber Disclosure RulesUnited States (Federal)

Smaller reporting companies: Item 1.05 compliance

Smaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.

GLBA Safeguards RuleUnited States (Federal)

FTC breach notification requirement effective

Section 314.4(j) requires notice to the FTC within 30 days of discovering a notification event involving at least 500 consumers.

FCC CPNI Breach RuleUnited States (Federal)

Order effective except revised notification rules

Definitions and other parts of the order took effect; the revised 64.2011 and 64.5111 notification requirements were delayed pending OMB approval.

SEC Cyber Disclosure RulesUnited States (Federal)

Form 8-K Item 1.05 incident disclosure begins

All registrants other than smaller reporting companies must file material incident disclosures from this date.

SEC Cyber Disclosure RulesUnited States (Federal)

Annual cybersecurity disclosures begin (Item 106 / 16K)

Required in annual reports for fiscal years ending on or after this date.

GLBA Safeguards RuleUnited States (Federal)

Compliance with expanded security program elements

Applicability of the 314.5 provisions (qualified individual, written risk assessment, encryption, MFA, pen testing, incident response plan, board reporting) was delayed from December 9, 2022 to this date.

GLBA Safeguards RuleUnited States (Federal)

2021 Safeguards Rule amendments effective

The amended Safeguards Rule published December 9, 2021 took effect, with the more detailed program elements in 314.5 deferred.

FTC Health Breach Notification RuleUnited States (Federal)

Full compliance with original Rule

Full compliance with the 2009 Health Breach Notification Rule was required.