UK and non-EU European data laws
UK GDPR, the Data (Use and Access) Act, the Online Safety Act, Switzerland and more.
3 jurisdictions with tracked laws. Tap one to open it.
6 regulations
Add to calendar
- Data (Use and Access) Act
United Kingdom
In forcePrivacyData access and sharingNext: Sep 30, 2026 ICO abolished; Information Commission takes over
- UK Cyber Security and Resilience Bill
United Kingdom
ProposedCybersecurityBreach notificationNext: Oct 26, 2026 Lords report stage scheduled
- Swiss revised FADP (nFADP)
Switzerland
In forcePrivacyBreach notificationEffective Sep 1, 2023
- Turkey KVKK
Turkey
AmendedPrivacyData residencyEffective Apr 7, 2016
- UK GDPR
United Kingdom
AmendedPrivacyBreach notificationEffective May 25, 2018
- UK Online Safety Act
United Kingdom
In forceOnline safetyChildrenEffective Mar 17, 2025
Upcoming deadlines
September 20261 deadline
ICO abolished; Information Commission takes over
Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).
October 20261 deadline
Lords report stage scheduled
House of Lords report stage scheduled (committee stage sat 1, 3 and 7 Sept 2026).
Past deadlines
June 20262 deadlines
Mandatory data protection complaints procedure
Controllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.
Passes House of Commons
Report stage and third reading completed in the Commons after carry-over into the new session.
April 20261 deadline
Fee notification window closes (2026/27)
Fee-liable providers must notify Ofcom before the notification window for the first charging year closes.
February 20262 deadlines
Stage 3: main data protection changes commence
Recognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).
November 20251 deadline
Introduced (Commons first reading)
Bill introduced in the House of Commons.
August 20251 deadline
Stage 1 commencement
Technical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).
July 20251 deadline
Protection of children duties apply
Children's safety duties and Protection of Children Codes take effect, including highly effective age assurance; children's risk assessments due by 24 July 2025.
June 20251 deadline
Royal Assent
The Act receives Royal Assent; commencement staged by regulations.
April 20251 deadline
Children's access assessments due
Services had to complete children's access assessments to determine whether children are likely to access them.
March 20251 deadline
Illegal harms duties enforceable
Illegal content safety duties apply; illegal content risk assessments had to be completed by 16 March 2025.
September 20241 deadline
Old transfer regime ends
Transitional period ends in which the former Article 9 explicit-consent transfer basis could still be relied on.
June 20241 deadline
Law 7499 amendments take effect
New sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.
October 20231 deadline
Royal Assent
The Online Safety Act receives Royal Assent.
September 20231 deadline
Revised FADP enters into force
Revised FADP and Data Protection Ordinance apply with no transition period.
