# Rulebook: full list (110 regulations, generated 2026-09-24) Format: regulation | jurisdiction | status | effective date | source, then one indented line per deadline: date | what | source. Alabama Personal Data Protection Act (APDPA) | Alabama | Enacted | effective 2027-05-01 | https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf | https://rulebook.fru.dev/regulations/us-al-apdpa 2027-05-01 | APDPA takes effect | https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf Australia Cyber Security Act (ransomware reporting) | Australia | In force | effective 2024-11-30 | https://www.legislation.gov.au/C2024A00098/asmade | https://rulebook.fru.dev/regulations/au-cyber-security-act 2025-05-30 | Ransomware payment reporting starts | https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf 2026-01-01 | Ransomware reporting moves to compliance phase | https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf Australia Privacy Act | Australia | Amended | effective 2024-12-11 | https://www.legislation.gov.au/C2024A00128/asmade | https://rulebook.fru.dev/regulations/au-privacy-act 2024-12-11 | Most POLA Act 2024 amendments commence | https://www.legislation.gov.au/C2024A00128/asmade 2025-06-10 | Statutory tort for serious invasions of privacy commences | https://www.legislation.gov.au/C2024A00128/asmade 2026-12-10 | Children's Online Privacy Code must be registered | https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code 2026-12-10 | Automated decision-making transparency applies | https://www.legislation.gov.au/C2024A00128/asmade Australia Social Media Minimum Age | Australia | In force | effective 2025-12-10 | https://www.legislation.gov.au/C2024A00127/asmade | https://rulebook.fru.dev/regulations/au-social-media-min-age 2025-12-10 | Social media minimum age obligation applies | https://www.legislation.gov.au/C2024A00127/asmade Brazil AI Bill (PL 2338/2023) | Brazil | Proposed | effective not set | https://www25.senado.leg.br/web/atividade/materias/-/materia/157233 | https://rulebook.fru.dev/regulations/br-ai-bill 2024-12-10 | Approved by the Federal Senate | https://www25.senado.leg.br/web/atividade/materias/-/materia/157233 Brazil ECA Digital | Brazil | In force | effective 2026-03-17 | https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm | https://rulebook.fru.dev/regulations/br-eca-digital 2026-03-17 | ECA Digital in force | https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2025/lei/L15211.htm Brazil LGPD | Brazil | In force | effective 2020-09-18 | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm | https://rulebook.fru.dev/regulations/br-lgpd 2020-09-18 | LGPD in force | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm 2021-08-01 | ANPD sanctions enforceable | https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm 2024-08-23 | International transfer regulation published | https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396 2025-08-23 | Deadline to adopt ANPD standard contractual clauses | https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-19-de-23-de-agosto-de-2024-580095396 California AB 2013 (AI training data transparency) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 | https://rulebook.fru.dev/regulations/us-ca-ab2013 2024-09-28 | AB 2013 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 2026-01-01 | Training-data documentation due | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240AB2013 California AI Transparency Act (SB 942) | California | Amended | effective 2026-08-02 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 | https://rulebook.fru.dev/regulations/us-ca-sb942 2024-09-19 | SB 942 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942 2025-10-13 | AB 853 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2026-01-01 | Original operative date (superseded) | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202320240SB942 2026-08-02 | Covered provider duties apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2027-01-01 | Large online platform and hosting platform duties | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 2028-01-01 | Capture device manufacturer duties | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB853 California Delete Act / DROP | California | In force | effective 2024-01-01 | https://www.cppa.ca.gov/data_brokers/ | https://rulebook.fru.dev/regulations/us-ca-delete-act 2026-01-01 | DROP opens to consumers | https://www.cppa.ca.gov/data_brokers/ 2026-01-31 | Annual data broker registration deadline | https://www.cppa.ca.gov/data_brokers/ 2026-08-01 | Data brokers must begin processing DROP deletion requests | https://www.cppa.ca.gov/data_brokers/ 2027-01-31 | Annual data broker registration deadline | https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.99.82 2028-01-01 | Independent third-party audits begin | https://www.cppa.ca.gov/data_brokers/ California SB 243 (companion chatbots) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 | https://rulebook.fru.dev/regulations/us-ca-sb243 2025-10-13 | SB 243 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 2026-01-01 | Chatbot safeguards apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 2027-07-01 | First annual report to Office of Suicide Prevention | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243 California SB 53 (TFAIA) | California | In force | effective 2026-01-01 | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 | https://rulebook.fru.dev/regulations/us-ca-sb53 2025-09-29 | SB 53 signed | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 2026-01-01 | Frontier developer obligations apply | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 2027-01-01 | First OES anonymized incident report and CDT definition review | https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB53 CCPA / CPRA | California | Amended | effective 2020-01-01 | https://cppa.ca.gov/regulations/ccpa_updates.html | https://rulebook.fru.dev/regulations/us-ca-ccpa 2020-01-01 | CCPA takes effect | https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf 2023-01-01 | CPRA amendments operative | https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf 2025-01-01 | CPI adjustment of thresholds and fines | https://cppa.ca.gov/regulations/cpi_adjustment.html 2025-09-22 | ADMT, risk assessment and cybersecurity audit regulations approved | https://cppa.ca.gov/regulations/ccpa_updates.html 2026-01-01 | New CCPA regulations take effect | https://cppa.ca.gov/regulations/ccpa_updates.html 2027-01-01 | ADMT requirements compliance date | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2027-01-01 | Browsers must support opt-out preference signal (AB 566) | https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB566 2027-12-31 | Risk assessments for pre-existing processing due | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2028-04-01 | First risk assessment submission to CPPA | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2028-04-01 | Cybersecurity audit due: revenue over $100M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2029-04-01 | Cybersecurity audit due: revenue $50M-$100M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf 2030-04-01 | Cybersecurity audit due: revenue under $50M | https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf Canada Bill C-36 (PPCDA) | Canada | Proposed | effective not set | https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading | https://rulebook.fru.dev/regulations/ca-c36-ppcda 2026-06-15 | Bill C-36 tabled (first reading) | https://www.parl.ca/DocumentViewer/en/45-1/bill/C-36/first-reading Canada Bill C-8 / CCSPA | Canada | Enacted | effective not set | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 | https://rulebook.fru.dev/regulations/ca-ccspa 2025-06-18 | Bill C-8 introduced | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 2026-06-15 | Royal Assent | https://www.parl.ca/legisinfo/en/bill/45-1/c-8 PIPEDA | Canada | In force | effective 2001-01-01 | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ | https://rulebook.fru.dev/regulations/ca-pipeda 2001-01-01 | PIPEDA Part 1 in force (phase 1) | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ 2004-01-01 | PIPEDA applies to all commercial activity | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ 2018-11-01 | Mandatory breach reporting | https://laws-lois.justice.gc.ca/eng/acts/p-8.6/ Chile Personal Data Protection Law (Ley 21.719) | Chile | Enacted | effective 2026-12-01 | https://www.bcn.cl/leychile/navegar?idNorma=1209272 | https://rulebook.fru.dev/regulations/cl-pdpl 2024-12-13 | Published in Diario Oficial | https://www.bcn.cl/leychile/navegar?idNorma=1209272 2026-12-01 | Law in force | https://www.bcn.cl/leychile/navegar?idNorma=1209272 2027-12-01 | Proposed postponement of entry into force (tentative) | https://tramitacion.senado.cl/appsenado/templates/tramitacion/index.php?boletin_ini=18623-07 China AI Content Labeling Measures | China | In force | effective 2025-09-01 | https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm | https://rulebook.fru.dev/regulations/cn-ai-labeling 2025-09-01 | AI content labeling measures and GB 45438-2025 take effect | https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm China Cross-Border Data Flow Provisions | China | In force | effective 2024-03-22 | https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm | https://rulebook.fru.dev/regulations/cn-cross-border 2024-03-22 | Cross-border data flow provisions take effect | https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm China Cybersecurity Law | China | Amended | effective 2017-06-01 | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm | https://rulebook.fru.dev/regulations/cn-csl 2017-06-01 | Cybersecurity Law takes effect | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm 2026-01-01 | 2025 amendments take effect | https://www.gov.cn/yaowen/liebiao/202510/content_7046194.htm China Data Security Law | China | In force | effective 2021-09-01 | http://www.cac.gov.cn/2021-06/11/c_1624994566919140.htm | https://rulebook.fru.dev/regulations/cn-dsl 2021-09-01 | Data Security Law takes effect | http://www.cac.gov.cn/2021-06/11/c_1624994566919140.htm China Network Data Security Regulations | China | In force | effective 2025-01-01 | https://www.gov.cn/zhengce/content/202409/content_6977766.htm | https://rulebook.fru.dev/regulations/cn-network-data-regs 2025-01-01 | Network Data Regulations take effect | https://www.gov.cn/zhengce/content/202409/content_6977766.htm China PI Compliance Audit Measures | China | In force | effective 2025-05-01 | https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm | https://rulebook.fru.dev/regulations/cn-pi-compliance-audit 2025-05-01 | PI compliance audit measures take effect | https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm China PIPL | China | In force | effective 2021-11-01 | http://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm | https://rulebook.fru.dev/regulations/cn-pipl 2021-11-01 | PIPL takes effect | http://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm Colorado AI Act | Colorado | Enacted | effective 2027-01-01 | https://leg.colorado.gov/bills/sb26-189 | https://rulebook.fru.dev/regulations/us-co-ai-act 2024-05-17 | SB 24-205 signed | https://leg.colorado.gov/bills/sb24-205 2025-08-28 | SB 25B-004 delays the act | https://leg.colorado.gov/bills/sb25b-004 2026-02-01 | Original effective date (superseded) | https://leg.colorado.gov/bills/sb24-205 2026-05-14 | SB 26-189 signed (repeal and reenact) | https://leg.colorado.gov/bills/sb26-189 2026-06-30 | Delayed effective date (superseded) | https://leg.colorado.gov/bills/sb25b-004 2027-01-01 | ADMT obligations apply | https://leg.colorado.gov/bills/sb26-189 2027-01-01 | AG rules due | https://leg.colorado.gov/bills/sb26-189 2030-01-01 | Mandatory cure period ends | https://leg.colorado.gov/bills/sb26-189 Colorado Privacy Act (CPA) | Colorado | Amended | effective 2023-07-01 | https://leg.colorado.gov/bills/sb21-190 | https://rulebook.fru.dev/regulations/us-co-cpa 2023-07-01 | CPA takes effect | https://leg.colorado.gov/bills/sb21-190 2024-07-01 | Universal opt-out mechanism recognition required | https://leg.colorado.gov/bills/sb21-190 2025-01-01 | 60-day cure period expires | https://leg.colorado.gov/bills/sb21-190 2025-05-23 | SB 25-276 geolocation and sensitive-data sale amendment effective | https://leg.colorado.gov/bills/sb25-276 2025-07-01 | Biometric identifier amendment (HB 24-1130) effective | https://leg.colorado.gov/bills/hb24-1130 2025-10-01 | Minors' data amendment (SB 24-041) effective | https://leg.colorado.gov/bills/sb24-041 Connecticut Data Privacy Act (CTDPA) | Connecticut | Amended | effective 2023-07-01 | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF | https://rulebook.fru.dev/regulations/us-ct-ctdpa 2023-07-01 | CTDPA takes effect | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2024-12-31 | Mandatory 60-day cure period expires | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2025-01-01 | Universal opt-out preference signals required | https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2022&bill_num=6 2026-07-01 | PA 25-113 (SB 1295) amendments take effect | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF 2026-08-01 | Profiling impact assessments apply | https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF 2026-10-01 | PA 26-64 (SB 4) amendments take effect | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF 2027-01-01 | Data broker registration required | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF 2028-10-01 | Data brokers must process state deletion mechanism requests | https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF Delaware Personal Data Privacy Act (DPDPA) | Delaware | Amended | effective 2025-01-01 | https://delcode.delaware.gov/title6/c012d/index.html | https://rulebook.fru.dev/regulations/us-de-dpdpa 2025-01-01 | DPDPA takes effect | https://delcode.delaware.gov/title6/c012d/index.html 2025-12-31 | Mandatory 60-day cure period expires | https://delcode.delaware.gov/title6/c012d/index.html 2026-01-01 | Opt-out preference signals must be honored | https://delcode.delaware.gov/title6/c012d/index.html 2027-01-01 | Amended thresholds and third-party duties take effect | https://delcode.delaware.gov/title6/c012d/index.html Cyber Resilience Act | European Union | Enacted | effective 2024-12-10 | https://eur-lex.europa.eu/eli/reg/2024/2847/oj | https://rulebook.fru.dev/regulations/eu-cra 2024-12-10 | CRA enters into force | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2026-06-11 | Conformity assessment body provisions apply | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2026-09-11 | Vulnerability and incident reporting obligations apply | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2027-12-11 | CRA fully applies | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2028-06-11 | Legacy type-examination certificates expire | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2028-09-11 | Report on single reporting platform | https://eur-lex.europa.eu/eli/reg/2024/2847/oj 2030-12-11 | First CRA evaluation | https://eur-lex.europa.eu/eli/reg/2024/2847/oj Data Governance Act | European Union | Amended | effective 2022-06-23 | https://eur-lex.europa.eu/eli/reg/2022/868/oj | https://rulebook.fru.dev/regulations/eu-dga 2022-06-23 | DGA enters into force | https://eur-lex.europa.eu/eli/reg/2022/868/oj 2023-09-24 | DGA applies | https://eur-lex.europa.eu/eli/reg/2022/868/oj 2025-09-24 | Legacy data intermediaries must comply | https://eur-lex.europa.eu/eli/reg/2022/868/oj Digital Markets Act | European Union | In force | effective 2022-11-01 | https://eur-lex.europa.eu/eli/reg/2022/1925/oj | https://rulebook.fru.dev/regulations/eu-dma 2022-11-01 | DMA enters into force | https://eur-lex.europa.eu/eli/reg/2022/1925/oj 2023-05-02 | DMA applies | https://eur-lex.europa.eu/eli/reg/2022/1925/oj 2023-09-06 | First six gatekeepers designated | https://digital-markets-act.ec.europa.eu/gatekeepers_en 2024-03-07 | Gatekeeper compliance deadline (first designations) | https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328 Digital Omnibus (data/GDPR) | European Union | Proposed | effective not set | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837 | https://rulebook.fru.dev/regulations/eu-digital-omnibus Digital Services Act | European Union | In force | effective 2022-11-16 | https://eur-lex.europa.eu/eli/reg/2022/2065/oj | https://rulebook.fru.dev/regulations/eu-dsa 2022-11-16 | DSA enters into force | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2023-02-17 | Platforms publish EU user numbers | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2023-04-25 | First VLOP/VLOSE designations | https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses 2024-02-17 | DSA applies to all intermediary services | https://eur-lex.europa.eu/eli/reg/2022/2065/oj 2026-08-31 | ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs | https://digital-strategy.ec.europa.eu/en/news/commission-designates-chatgpt-reddit-roblox-under-digital-services-act DORA | European Union | In force | effective 2023-01-16 | https://eur-lex.europa.eu/eli/reg/2022/2554/oj | https://rulebook.fru.dev/regulations/eu-dora 2023-01-16 | DORA enters into force | https://eur-lex.europa.eu/eli/reg/2022/2554/oj 2025-01-17 | DORA applies | https://eur-lex.europa.eu/eli/reg/2022/2554/oj 2025-04-30 | First registers of information submitted to the ESAs | https://www.eba.europa.eu/publications-and-media/press-releases/esas-announce-timeline-collect-information-designation-critical-ict-third-party-service-providers 2025-07-08 | TLPT regulatory technical standards enter into force | https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj 2025-11-18 | First critical ICT third-party providers designated | https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital eIDAS 2 / EU Digital Identity Wallet | European Union | Enacted | effective 2024-05-20 | https://eur-lex.europa.eu/eli/reg/2024/1183/oj | https://rulebook.fru.dev/regulations/eu-eidas2 2024-05-20 | eIDAS 2 enters into force | https://eur-lex.europa.eu/eli/reg/2024/1183/oj 2024-12-24 | First wallet implementing acts enter into force | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj 2026-05-21 | Legacy qualified trust service providers conformity report | https://eur-lex.europa.eu/eli/reg/2024/1183/oj 2026-12-24 | Member States must provide EU Digital Identity Wallets | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj 2027-12-24 | Private relying parties must accept wallets | https://eur-lex.europa.eu/eli/reg_impl/2024/2977/oj ePrivacy Directive (cookie law) | European Union | Amended | effective 2002-07-31 | https://eur-lex.europa.eu/eli/dir/2002/58/oj | https://rulebook.fru.dev/regulations/eu-eprivacy 2002-07-31 | ePrivacy Directive enters into force | https://eur-lex.europa.eu/eli/dir/2002/58/oj 2003-10-31 | Original transposition deadline | https://eur-lex.europa.eu/eli/dir/2002/58/oj 2011-05-25 | Cookie consent amendment transposition deadline | https://eur-lex.europa.eu/eli/dir/2009/136/oj EU AI Act | European Union | Amended | effective 2024-08-01 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj | https://rulebook.fru.dev/regulations/eu-ai-act 2024-08-01 | AI Act enters into force | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2025-02-02 | Prohibited practices and AI literacy apply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2025-08-02 | GPAI, governance, notified bodies and penalties apply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2026-07-27 | Digital Omnibus on AI enters into force | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2026-08-02 | General application: transparency obligations, GPAI fines, most other rules | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2026-12-02 | New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2027-08-02 | Legacy GPAI models must comply; national AI sandboxes operational | https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2027-12-02 | High-risk obligations apply to Annex III systems | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2028-08-02 | High-risk obligations apply to Annex I product-embedded systems | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2030-08-02 | Public-authority high-risk systems must comply | https://eur-lex.europa.eu/eli/reg/2026/1744/oj 2030-12-31 | Large-scale EU IT systems must comply | https://eur-lex.europa.eu/eli/reg/2024/1689/oj EU Data Act | European Union | In force | effective 2024-01-11 | https://eur-lex.europa.eu/eli/reg/2023/2854/oj | https://rulebook.fru.dev/regulations/eu-data-act 2024-01-11 | Data Act enters into force | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2024-01-11 | Reduced switching charges period begins | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2025-09-12 | Data Act applies | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2025-09-12 | Member States notify penalty rules | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2026-09-12 | Access-by-design for new connected products | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2027-01-12 | Cloud switching charges abolished | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2027-09-12 | Unfair-terms rules extend to older long-term contracts | https://eur-lex.europa.eu/eli/reg/2023/2854/oj 2028-09-12 | Commission evaluation | https://eur-lex.europa.eu/eli/reg/2023/2854/oj eu-kids-act | European Union | Proposed | effective not set | https://digital-strategy.ec.europa.eu/en/news/eu-kids-act-restrict-social-media-platforms-access-children-eu | https://rulebook.fru.dev/regulations/eu-eu-kids-act | UNVERIFIED EU-US Data Privacy Framework | European Union | In force | effective 2023-07-10 | https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj | https://rulebook.fru.dev/regulations/eu-us-dpf 2023-07-10 | DPF adequacy decision adopted and effective | https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj 2025-09-03 | General Court upholds DPF (Latombe v Commission) | https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-09/cp250106en.pdf 2025-10-31 | Latombe appeal lodged at the Court of Justice | https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework European Health Data Space (EHDS) | European Union | Enacted | effective 2025-03-25 | https://eur-lex.europa.eu/eli/reg/2025/327/oj | https://rulebook.fru.dev/regulations/eu-ehds 2025-03-25 | EHDS enters into force | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2027-03-26 | EHDS general application date | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2029-03-26 | Primary use for first data categories; secondary use framework applies | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2031-03-26 | Primary use for second data categories; EHR systems in service; extra secondary-use categories | https://eur-lex.europa.eu/eli/reg/2025/327/oj 2035-03-26 | Third-country participation in secondary use | https://eur-lex.europa.eu/eli/reg/2025/327/oj GDPR | European Union | Amended | effective 2016-05-24 | https://eur-lex.europa.eu/eli/reg/2016/679/oj | https://rulebook.fru.dev/regulations/eu-gdpr 2016-05-24 | GDPR enters into force | https://eur-lex.europa.eu/eli/reg/2016/679/oj 2018-05-25 | GDPR applies | https://eur-lex.europa.eu/eli/reg/2016/679/oj 2025-11-26 | GDPR Procedural Regulation adopted | https://eur-lex.europa.eu/eli/reg/2025/2518/oj 2026-01-01 | GDPR Procedural Regulation enters into force | https://eur-lex.europa.eu/eli/reg/2025/2518/oj 2027-04-02 | GDPR Procedural Regulation applies | https://eur-lex.europa.eu/eli/reg/2025/2518/oj NIS2 | European Union | Amended | effective 2023-01-16 | https://eur-lex.europa.eu/eli/dir/2022/2555/oj | https://rulebook.fru.dev/regulations/eu-nis2 2023-01-16 | NIS2 enters into force | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-10-17 | Transposition deadline | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-10-18 | National NIS2 measures apply; NIS1 repealed | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2024-11-07 | Implementing Regulation 2024/2690 enters into force | https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj 2025-01-17 | Digital infrastructure entities submit registration data | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2025-04-17 | Member States establish entity lists | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2027-04-17 | Next biennial entity notification | https://eur-lex.europa.eu/eli/dir/2022/2555/oj 2027-10-17 | Commission review of NIS2 | https://eur-lex.europa.eu/eli/dir/2022/2555/oj Product Liability Directive | European Union | Enacted | effective 2024-12-08 | https://eur-lex.europa.eu/eli/dir/2024/2853/oj | https://rulebook.fru.dev/regulations/eu-pld 2024-12-08 | New PLD enters into force | https://eur-lex.europa.eu/eli/dir/2024/2853/oj 2026-12-09 | Transposition deadline; old PLD repealed | https://eur-lex.europa.eu/eli/dir/2024/2853/oj Florida Digital Bill of Rights | Florida | In force | effective 2024-07-01 | https://www.flsenate.gov/Session/Bill/2023/262 | https://rulebook.fru.dev/regulations/us-fl-fdbr 2024-07-01 | Florida Digital Bill of Rights takes effect | https://www.flsenate.gov/Session/Bill/2023/262 Hong Kong Critical Infrastructure Cyber Ordinance | Hong Kong | In force | effective 2026-01-01 | https://www.elegislation.gov.hk/hk/cap653 | https://rulebook.fru.dev/regulations/hk-pcico 2026-01-01 | PCICSO comes into operation | https://www.info.gov.hk/gia/general/202506/27/P2025062700238.htm Illinois AI in Employment Law (HB 3773) | Illinois | In force | effective 2026-01-01 | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html | https://rulebook.fru.dev/regulations/us-il-hb3773 2024-08-09 | HB 3773 signed | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html 2026-01-01 | AI anti-discrimination and notice duties apply | https://www.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300HB3773.html 2026-05-15 | IDHR proposed notice rules published | https://ogletree.com/insights-resources/blog-posts/illinois-postpones-proposed-regulations-on-ai-in-employment/ 2026-06-02 | IDHR withdraws and postpones proposed rules | https://ogletree.com/insights-resources/blog-posts/illinois-postpones-proposed-regulations-on-ai-in-employment/ Illinois BIPA | Illinois | Amended | effective 2008-10-03 | https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 | https://rulebook.fru.dev/regulations/us-il-bipa 2008-10-03 | BIPA effective | https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57 2024-08-02 | SB 2979 amendment effective | https://www.ilga.gov/Legislation/publicacts/view/103-0769 2026-04-01 | Seventh Circuit: amendment applies retroactively | https://law.justia.com/cases/federal/appellate-courts/ca7/25-2185/25-2185-2026-04-01.html India DPDP Act | India | Enacted | effective 2025-11-13 | https://egazette.gov.in/WriteReadData/2025/267650.pdf | https://rulebook.fru.dev/regulations/in-dpdp 2025-11-13 | DPDP Rules published; Board and procedural rules in force | https://egazette.gov.in/WriteReadData/2025/267650.pdf 2026-11-13 | Consent Manager registration rule in force (12 months) | https://egazette.gov.in/WriteReadData/2025/267650.pdf 2027-05-13 | Main data fiduciary obligations apply (18 months) | https://egazette.gov.in/WriteReadData/2025/267650.pdf Indiana Consumer Data Protection Act (ICDPA) | Indiana | In force | effective 2026-01-01 | https://iga.in.gov/legislative/2023/bills/senate/5/details | https://rulebook.fru.dev/regulations/us-in-icdpa 2026-01-01 | ICDPA takes effect | https://iga.in.gov/legislative/2023/bills/senate/5/details Indonesia PDP Law | Indonesia | Amended | effective 2022-10-17 | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 | https://rulebook.fru.dev/regulations/id-pdp 2022-10-17 | PDP Law enacted and in force | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 2024-10-17 | PDP Law transition ends | https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 2027-01-16 | Implementing regulation GR 33/2026 takes effect | https://www.kk-advocates.com/news/read/indonesia-gr-pdp-personal-data-protection-compliance-regime-new-phase Iowa Consumer Data Protection Act (ICDPA) | Iowa | In force | effective 2025-01-01 | https://www.legis.iowa.gov/docs/code/715D.pdf | https://rulebook.fru.dev/regulations/us-ia-icdpa 2025-01-01 | ICDPA takes effect | https://www.legis.iowa.gov/docs/code/715D.pdf Israel Privacy Protection Law Amendment 13 | Israel | Amended | effective 2025-08-14 | https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page | https://rulebook.fru.dev/regulations/il-ppl-amendment-13 2025-08-14 | Amendment 13 in force | https://www.gov.il/en/departments/the_privacy_protection_authority/govil-landing-page Japan AI Promotion Act | Japan | In force | effective 2025-06-04 | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html | https://rulebook.fru.dev/regulations/jp-ai-act 2025-06-04 | AI Promotion Act promulgated and partly in force | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html 2025-09-01 | AI Promotion Act fully in force | https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html Japan APPI | Japan | Amended | effective 2005-04-01 | https://www.ppc.go.jp/files/pdf/260731_shiryou-1.pdf | https://rulebook.fru.dev/regulations/jp-appi 2022-04-01 | 2020 amendments in force | https://www.ppc.go.jp/en/legal/ 2026-07-17 | 2026 APPI amendment act promulgated | https://www.ppc.go.jp/files/pdf/260731_shiryou-1.pdf Kentucky Consumer Data Protection Act (KCDPA) | Kentucky | In force | effective 2026-01-01 | https://apps.legislature.ky.gov/record/24rs/hb15.html | https://rulebook.fru.dev/regulations/us-ky-kcdpa 2026-01-01 | KCDPA takes effect | https://apps.legislature.ky.gov/recorddocuments/bill/24RS/hb15/bill.pdf Kenya Data Protection Act | Kenya | In force | effective 2019-11-25 | https://www.odpc.go.ke/ | https://rulebook.fru.dev/regulations/ke-dpa 2019-11-25 | Data Protection Act in force | https://www.odpc.go.ke/ Louisiana Data Privacy Act | Louisiana | Enacted | effective 2027-01-01 | https://legis.la.gov/legis/BillInfo.aspx?s=26RS&b=SB386&sbi=y | https://rulebook.fru.dev/regulations/us-la-ldpa 2027-01-01 | Louisiana Data Privacy Act takes effect | https://legis.la.gov/legis/ViewDocument.aspx?d=1480202 2027-07-31 | 30-day cure period expires | https://legis.la.gov/legis/ViewDocument.aspx?d=1480202 Malaysia PDPA | Malaysia | Amended | effective 2013-11-15 | https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdf | https://rulebook.fru.dev/regulations/my-pdpa 2025-01-01 | PDPA amendments phase 1 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ 2025-04-01 | PDPA amendments phase 2 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ 2025-06-01 | PDPA amendments phase 3 | https://www.pdp.gov.my/ppdpv1/en/personal-data-protection-amendment-act-2024-commencement-date-determination/ Maryland Online Data Privacy Act (MODPA) | Maryland | Amended | effective 2025-10-01 | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf | https://rulebook.fru.dev/regulations/us-md-modpa 2025-10-01 | MODPA takes effect | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf 2026-04-01 | MODPA applies to personal data processing | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf 2027-04-01 | Discretionary 60-day cure period ends | https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf Mexico LFPDPPP 2025 | Mexico | In force | effective 2025-03-21 | https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf | https://rulebook.fru.dev/regulations/mx-lfpdppp 2025-03-21 | New LFPDPPP in force | https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf Minnesota Consumer Data Privacy Act (MCDPA) | Minnesota | In force | effective 2025-07-31 | https://www.revisor.mn.gov/statutes/cite/325M.20 | https://rulebook.fru.dev/regulations/us-mn-mcdpa 2025-07-31 | MCDPA takes effect | https://www.revisor.mn.gov/statutes/cite/325M.20 2026-01-31 | 30-day cure period expires | https://www.revisor.mn.gov/statutes/cite/325M.20 2029-07-31 | Postsecondary institutions must comply | https://www.revisor.mn.gov/statutes/cite/325M.20 Montana Consumer Data Privacy Act (MCDPA) | Montana | Amended | effective 2024-10-01 | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html | https://rulebook.fru.dev/regulations/us-mt-mcdpa 2024-10-01 | MCDPA takes effect | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html 2025-10-01 | SB 297 amendments take effect; cure period eliminated | https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html Nebraska NDPA | Nebraska | In force | effective 2025-01-01 | https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103 | https://rulebook.fru.dev/regulations/us-ne-ndpa 2025-01-01 | Nebraska Data Privacy Act takes effect | https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=54904 New Hampshire Privacy Act | New Hampshire | Amended | effective 2025-01-01 | https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm | https://rulebook.fru.dev/regulations/us-nh-privacy 2025-01-01 | New Hampshire Privacy Act takes effect | https://gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm 2026-01-01 | Mandatory 60-day cure period expires | https://gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm 2027-01-01 | Ban on selling personal data of children under 13 (HB 1460) | https://gc.nh.gov/bill_status/billinfo.aspx?id=2443&inflect=2 New Jersey NJDPA | New Jersey | Amended | effective 2025-01-15 | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF | https://rulebook.fru.dev/regulations/us-nj-njdpa 2025-01-15 | NJDPA takes effect | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF 2025-06-02 | Division of Consumer Affairs proposes NJDPA rules (N.J.A.C. 13:45L) | https://www.njoag.gov/murphy-administration-announces-proposed-rules-establishing-comprehensive-consumer-data-privacy-protections/ 2025-07-15 | Universal opt-out mechanism must be honored | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF 2026-06-30 | A5328 sensitive data sale ban takes effect | https://www.njleg.state.nj.us/bill-search/2026/A5328 2026-07-01 | Mandatory 30-day cure period expires | https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF NY RAISE Act | New York | Enacted | effective 2027-01-01 | https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models | https://rulebook.fru.dev/regulations/us-ny-raise 2025-12-19 | RAISE Act signed | https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-require-ai-frameworks-ai-frontier-models 2026-03-27 | Chapter amendment S8828 signed | https://www.nysenate.gov/legislation/bills/2025/S8828 2027-01-01 | RAISE Act takes effect | https://www.nysenate.gov/legislation/bills/2025/S8828 NYDFS Cybersecurity Regulation (Part 500) | New York | Amended | effective 2017-03-01 | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 | https://rulebook.fru.dev/regulations/us-ny-dfs-500 2017-03-01 | Part 500 effective | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2023-11-01 | Second Amendment effective | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2023-12-01 | Amended notification requirements (500.17) | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-04-15 | Annual compliance notification | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-04-29 | General 180-day transition ends | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2024-11-01 | Governance, encryption, IR/BCDR, exemptions | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2025-05-01 | Vulnerability scans, access privileges, malware controls, Class A monitoring | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2025-11-01 | Universal MFA and asset inventory | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 2026-04-15 | Annual compliance notification | https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500 NYC Local Law 144 (AEDT) | New York City, New York | In force | effective 2023-07-05 | https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page | https://rulebook.fru.dev/regulations/us-nyc-ll144 2023-07-05 | DCWP enforcement begins | https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page New Zealand Privacy Act | New Zealand | Amended | effective 2020-12-01 | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ | https://rulebook.fru.dev/regulations/nz-privacy-act 2020-12-01 | Privacy Act 2020 in force | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ 2025-09-24 | Privacy Amendment Act 2025 technical changes commence | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ 2026-05-01 | IPP 3A indirect-collection notification applies | https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/ Nigeria NDPA | Nigeria | Amended | effective 2023-06-12 | https://ndpc.gov.ng/resources/ | https://rulebook.fru.dev/regulations/ng-ndpa 2023-06-12 | NDPA signed into law | https://ndpc.gov.ng/resources/ 2025-09-19 | GAID 2025 takes effect | https://ndpc.gov.ng/resources/ Oklahoma OKCDPA | Oklahoma | Enacted | effective 2027-01-01 | http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600 | https://rulebook.fru.dev/regulations/us-ok-okcdpa 2027-01-01 | Oklahoma Consumer Data Privacy Act takes effect | https://www.okhouse.gov/posts/news-20260323_2 Oregon OCPA | Oregon | Amended | effective 2024-07-01 | https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html | https://rulebook.fru.dev/regulations/us-or-ocpa 2024-07-01 | OCPA takes effect for most controllers | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ 2025-07-01 | OCPA applies to nonprofits | https://www.doj.state.or.us/consumer-protection/for-businesses/privacy-law-faqs-for-nonprofits/ 2026-01-01 | Cure period sunsets | https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html 2026-01-01 | Universal opt-out signals must be honored | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ 2026-01-01 | Sale ban on precise geolocation and under-16 data (HB 2008) | https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/ Quebec Law 25 | Quebec, Canada | In force | effective 2022-09-22 | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 | https://rulebook.fru.dev/regulations/ca-qc-law25 2021-09-22 | Assent | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2022-09-22 | Phase 1: privacy officer and incident reporting | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2023-09-22 | Phase 2: main obligations and penalties | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 2024-09-22 | Phase 3: data portability | https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 Rhode Island RIDTPPA | Rhode Island | In force | effective 2026-01-01 | https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm | https://rulebook.fru.dev/regulations/us-ri-dtppa 2026-01-01 | RIDTPPA takes effect | https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm Saudi PDPL | Saudi Arabia | In force | effective 2023-09-14 | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf | https://rulebook.fru.dev/regulations/sa-pdpl 2023-09-14 | PDPL in force | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf 2024-09-14 | One-year grace period ends | https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf Singapore PDPA | Singapore | In force | effective 2014-07-02 | https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act | https://rulebook.fru.dev/regulations/sg-pdpa 2014-07-02 | PDPA data protection obligations take effect | https://sso.agc.gov.sg/Act/PDPA2012 2021-02-01 | 2020 amendments largely in force | https://sso.agc.gov.sg/Act/PDPA2012 2022-10-01 | Higher financial penalty cap applies | https://sso.agc.gov.sg/Act/PDPA2012 South Africa POPIA | South Africa | In force | effective 2020-07-01 | https://www.gov.za/documents/protection-personal-information-act | https://rulebook.fru.dev/regulations/za-popia 2020-07-01 | Main POPIA provisions commence | https://www.gov.za/documents/protection-personal-information-act 2021-07-01 | Compliance grace period ends | https://www.gov.za/documents/protection-personal-information-act South Korea AI Basic Act | South Korea | In force | effective 2026-01-22 | https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법 | https://rulebook.fru.dev/regulations/kr-ai-basic-act 2026-01-22 | AI Basic Act and Enforcement Decree take effect | https://www.law.go.kr/법령/인공지능발전과신뢰기반조성등에관한기본법 South Korea PIPA | South Korea | Amended | effective 2011-09-30 | https://www.law.go.kr/법령/개인정보보호법 | https://rulebook.fru.dev/regulations/kr-pipa 2026-03-10 | 2026 PIPA amendment promulgated (Act No. 21445) | https://www.law.go.kr/법령/개인정보보호법 2026-09-11 | 2026 PIPA amendments take effect | https://www.law.go.kr/법령/개인정보보호법 2027-07-01 | Mandatory ISMS-P certification | https://www.law.go.kr/법령/개인정보보호법 Swiss revised FADP (nFADP) | Switzerland | In force | effective 2023-09-01 | https://www.fedlex.admin.ch/eli/cc/2022/491/en | https://rulebook.fru.dev/regulations/ch-fadp 2023-09-01 | Revised FADP enters into force | https://www.fedlex.admin.ch/eli/cc/2022/491/en Tennessee TIPA | Tennessee | In force | effective 2025-07-01 | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1181&GA=113 | https://rulebook.fru.dev/regulations/us-tn-tipa 2025-07-01 | TIPA takes effect | https://wapp.capitol.tn.gov/apps/BillInfo/Default.aspx?BillNumber=HB1181&GA=113 Texas TDPSA | Texas | In force | effective 2024-07-01 | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 | https://rulebook.fru.dev/regulations/us-tx-tdpsa 2024-07-01 | TDPSA takes effect | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 2025-01-01 | Universal opt-out mechanism requirement applies | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=88R&Bill=HB4 TRAIGA | Texas | In force | effective 2026-01-01 | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 | https://rulebook.fru.dev/regulations/us-tx-traiga 2025-06-22 | HB 149 signed | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 2026-01-01 | TRAIGA takes effect | https://capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149 Thailand PDPA | Thailand | In force | effective 2022-06-01 | https://www.ratchakitcha.soc.go.th/DATA/PDF/2562/A/069/T_0052.PDF | https://rulebook.fru.dev/regulations/th-pdpa 2022-06-01 | PDPA main obligations take effect | https://www.ratchakitcha.soc.go.th/DATA/PDF/2562/A/069/T_0052.PDF Turkey KVKK | Turkey | Amended | effective 2016-04-07 | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm | https://rulebook.fru.dev/regulations/tr-kvkk 2024-06-01 | Law 7499 amendments take effect | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm 2024-09-01 | Old transfer regime ends | https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm UAE PDPL | United Arab Emirates | In force | effective 2022-01-02 | https://uaelegislation.gov.ae/en/legislations/1972 | https://rulebook.fru.dev/regulations/ae-pdpl 2022-01-02 | PDPL enters into force | https://uaelegislation.gov.ae/en/legislations/1972 Data (Use and Access) Act | United Kingdom | In force | effective 2025-08-20 | https://www.legislation.gov.uk/ukpga/2025/18/contents | https://rulebook.fru.dev/regulations/uk-duaa 2025-06-19 | Royal Assent | https://www.legislation.gov.uk/ukpga/2025/18/contents 2025-08-20 | Stage 1 commencement | https://www.legislation.gov.uk/ukpga/2025/18/contents 2026-02-05 | Stage 3: main data protection changes commence | https://www.legislation.gov.uk/uksi/2026/82/contents/made 2026-06-19 | Mandatory data protection complaints procedure | https://www.legislation.gov.uk/uksi/2026/82/contents/made 2026-09-30 | ICO abolished; Information Commission takes over | https://www.legislation.gov.uk/uksi/2026/1015/regulation/2/made UK Cyber Security and Resilience Bill | United Kingdom | Proposed | effective not set | https://bills.parliament.uk/bills/4035 | https://rulebook.fru.dev/regulations/uk-csr-bill 2025-11-12 | Introduced (Commons first reading) | https://bills.parliament.uk/bills/4035 2026-06-16 | Passes House of Commons | https://bills.parliament.uk/bills/4035 2026-10-26 | Lords report stage scheduled (tentative) | https://bills.parliament.uk/bills/4035 UK GDPR | United Kingdom | Amended | effective 2018-05-25 | https://www.legislation.gov.uk/ukpga/2018/12/contents | https://rulebook.fru.dev/regulations/uk-gdpr 2018-05-25 | Data Protection Act 2018 and GDPR apply | https://www.legislation.gov.uk/ukpga/2018/12/contents 2021-01-01 | UK GDPR takes effect after Brexit transition | https://www.legislation.gov.uk/eur/2016/679/contents 2026-02-05 | DUAA amendments to UK GDPR commence | https://www.legislation.gov.uk/uksi/2026/82/contents/made UK Online Safety Act | United Kingdom | In force | effective 2025-03-17 | https://www.legislation.gov.uk/ukpga/2023/50/contents | https://rulebook.fru.dev/regulations/uk-osa 2023-10-26 | Royal Assent | https://www.legislation.gov.uk/ukpga/2023/50/contents 2025-03-17 | Illegal harms duties enforceable | https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content 2025-04-16 | Children's access assessments due | https://www.ofcom.org.uk/online-safety/protecting-children/protection-of-children-duties-under-the-online-safety-act 2025-07-25 | Protection of children duties apply | https://www.ofcom.org.uk/online-safety/protecting-children/protection-of-children-duties-under-the-online-safety-act 2026-04-11 | Fee notification window closes (2026/27) | https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/online-safety-fees-and-penalties CIRCIA | United States (Federal) | Enacted | effective not set | https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements | https://rulebook.fru.dev/regulations/us-circia 2024-07-03 | NPRM comment period closed | https://www.federalregister.gov/documents/2024/04/04/2024-06526/cyber-incident-reporting-for-critical-infrastructure-act-circia-reporting-requirements CMMC 2.0 | United States (Federal) | In force | effective 2024-12-16 | https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of | https://rulebook.fru.dev/regulations/us-cmmc 2024-12-16 | CMMC Program rule (32 CFR Part 170) effective | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2025-11-10 | DFARS rule effective; Phase 1 begins | https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of 2026-11-10 | Phase 2: Level 2 C3PAO certification | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2027-11-10 | Phase 3: Level 3 certification | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2028-11-10 | Phase 4: full implementation | https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program COPPA Rule | United States (Federal) | Amended | effective 2000-04-21 | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule | https://rulebook.fru.dev/regulations/us-coppa 2025-06-23 | Amended COPPA Rule takes effect | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule 2026-04-22 | Full compliance with amended COPPA Rule | https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule DOJ Bulk Data Rule | United States (Federal) | In force | effective 2025-04-08 | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern | https://rulebook.fru.dev/regulations/us-doj-bulk-data 2025-04-08 | Prohibitions and restrictions take effect | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern 2025-10-06 | Due diligence, audit and reporting obligations apply | https://www.federalregister.gov/documents/2025/01/08/2024-31486/preventing-access-to-us-sensitive-personal-data-and-government-related-data-by-countries-of-concern FCC CPNI Breach Rule | United States (Federal) | Amended | effective 2024-03-13 | https://www.federalregister.gov/documents/2024/02/12/2024-01667/data-breach-reporting-requirements | https://rulebook.fru.dev/regulations/us-fcc-cpni-breach 2024-03-13 | Order effective except revised notification rules | https://www.federalregister.gov/documents/2024/02/12/2024-01667/data-breach-reporting-requirements FTC Health Breach Notification Rule | United States (Federal) | Amended | effective 2009-09-24 | https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule | https://rulebook.fru.dev/regulations/us-ftc-hbnr 2010-02-22 | Full compliance with original Rule | https://www.federalregister.gov/citation/74-FR-42962 2024-07-29 | 2024 amendments effective | https://www.federalregister.gov/documents/2024/05/30/2024-10855/health-breach-notification-rule GLBA Safeguards Rule | United States (Federal) | Amended | effective 2003-05-23 | https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314 | https://rulebook.fru.dev/regulations/us-glba-safeguards 2022-01-10 | 2021 Safeguards Rule amendments effective | https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-information 2023-06-09 | Compliance with expanded security program elements | https://www.federalregister.gov/documents/2022/11/23/2022-25201/standards-for-safeguarding-customer-information 2024-05-13 | FTC breach notification requirement effective | https://www.federalregister.gov/documents/2023/11/13/2023-24412/standards-for-safeguarding-customer-information HIPAA | United States (Federal) | Amended | effective 2003-04-14 | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 | https://rulebook.fru.dev/regulations/us-hipaa 2024-06-25 | Reproductive health care privacy rule effective (later vacated) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy 2024-12-23 | Reproductive health privacy compliance date (vacated) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy 2025-03-07 | Security Rule NPRM comment period closed | https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information 2026-02-16 | Notice of Privacy Practices updates (Part 2 alignment) | https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy PADFA | United States (Federal) | In force | effective 2024-06-23 | https://www.govinfo.gov/content/pkg/PLAW-118publ50/html/PLAW-118publ50.htm | https://rulebook.fru.dev/regulations/us-padfa 2024-06-23 | PADFA takes effect | https://www.govinfo.gov/content/pkg/PLAW-118publ50/html/PLAW-118publ50.htm SEC Cyber Disclosure Rules | United States (Federal) | In force | effective 2023-09-05 | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure | https://rulebook.fru.dev/regulations/us-sec-cyber 2023-12-15 | Annual cybersecurity disclosures begin (Item 106 / 16K) | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2023-12-18 | Form 8-K Item 1.05 incident disclosure begins | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-06-15 | Smaller reporting companies: Item 1.05 compliance | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-12-15 | Inline XBRL tagging of annual cybersecurity disclosures | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure 2024-12-18 | Inline XBRL tagging of Item 1.05 disclosures | https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure SEC Regulation S-P | United States (Federal) | Amended | effective 2024-08-02 | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information | https://rulebook.fru.dev/regulations/us-sec-reg-sp 2024-08-02 | Amendments effective | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information 2025-12-03 | Larger entities must comply | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information 2026-06-03 | Smaller entities must comply | https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information TAKE IT DOWN Act | United States (Federal) | In force | effective 2025-05-19 | https://www.congress.gov/bill/119th-congress/senate-bill/146 | https://rulebook.fru.dev/regulations/us-take-it-down 2025-05-19 | Criminal provisions effective on enactment | https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm 2026-05-19 | Platform notice-and-removal process required | https://www.govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm Utah AI Policy Act | Utah | Amended | effective 2024-05-01 | https://le.utah.gov/~2025/bills/static/SB0332.html | https://rulebook.fru.dev/regulations/us-ut-aipa 2024-05-01 | AI Policy Act effective | https://le.utah.gov/~2024/bills/static/SB0149.html 2025-05-07 | SB 226 amendments effective | https://le.utah.gov/~2025/bills/static/SB0226.html 2027-07-01 | Scheduled repeal of Title 13, Ch. 72 | https://le.utah.gov/~2025/bills/static/SB0332.html Utah UCPA | Utah | Amended | effective 2023-12-31 | https://le.utah.gov/xcode/Title13/Chapter61/13-61.html | https://rulebook.fru.dev/regulations/us-ut-ucpa 2023-12-31 | UCPA takes effect | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S402.html 2026-07-01 | Right to correct takes effect | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S201.html 2027-01-01 | UCPA extends to motor vehicle manufacturers | https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html Vermont VDPOSA | Vermont | Enacted | effective 2028-01-01 | https://legislature.vermont.gov/bill/status/2026/S.71 | https://rulebook.fru.dev/regulations/us-vt-vdposa 2028-01-01 | Vermont Data Privacy and Online Surveillance Act takes effect | https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf 2029-06-30 | Mandatory 60-day cure period expires | https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf Vietnam AI Law | Vietnam | In force | effective 2026-03-01 | https://beta-en.mic.gov.vn/first-ever-law-on-artificial-intelligence-approved-197251215231241888.htm | https://rulebook.fru.dev/regulations/vn-ai-law 2026-03-01 | AI Law takes effect | https://beta-en.mic.gov.vn/first-ever-law-on-artificial-intelligence-approved-197251215231241888.htm 2027-03-01 | Transition ends for existing AI systems (general) | https://www.vilaf.com.vn/blog/vietnam-enacts-its-first-law-on-artificial-intelligence-key-regulatory-obligations-from-1-march-2026/ 2027-09-01 | Transition ends for existing AI systems in health, education and finance | https://www.vilaf.com.vn/blog/vietnam-enacts-its-first-law-on-artificial-intelligence-key-regulatory-obligations-from-1-march-2026/ Vietnam PDPL | Vietnam | In force | effective 2026-01-01 | https://vanban.chinhphu.vn/?pageid=27160&docid=214590 | https://rulebook.fru.dev/regulations/vn-pdpl 2026-01-01 | PDPL and Decree 356/2025 take effect | https://vanban.chinhphu.vn/?pageid=27160&docid=214590 Virginia VCDPA | Virginia | Amended | effective 2023-01-01 | https://law.lis.virginia.gov/vacode/title59.1/chapter53/ | https://rulebook.fru.dev/regulations/us-va-vcdpa 2023-01-01 | VCDPA takes effect | https://law.lis.virginia.gov/vacode/title59.1/chapter53/ 2026-01-01 | Under-16 social media time limit (SB 854) takes effect | https://netchoice.org/wp-content/uploads/2026/02/Virginia-PI-Opinion_Granted.pdf 2026-02-27 | SB 854 preliminarily enjoined (NetChoice v. Jones) | https://netchoice.org/wp-content/uploads/2026/02/Virginia-PI-Opinion_Granted.pdf 2026-07-01 | Ban on selling precise geolocation data (SB 338) | https://lis.virginia.gov/bill-details/20261/SB338 Washington My Health My Data Act | Washington | In force | effective 2024-03-31 | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy | https://rulebook.fru.dev/regulations/us-wa-mhmda 2023-04-27 | HB 1155 signed | https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023 2023-07-23 | Geofencing ban (Section 10) effective | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy 2024-03-31 | Regulated entities must comply | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy 2024-06-30 | Small businesses must comply | https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy