Data access and data sharing rules
10 regulations worldwide that deal with data access and sharing, with every phased deadline and the official source for each.
10 regulations
Add to calendar
- Data (Use and Access) Act
United Kingdom
In forcePrivacyData access and sharingNext: Sep 30, 2026 ICO abolished; Information Commission takes over
- eIDAS 2 / EU Digital Identity Wallet
European Union
EnactedPrivacyData access and sharingNext: Dec 24, 2026 Member States must provide EU Digital Identity Wallets
- EU Data Act
European Union
In forceData access and sharingPrivacyNext: Jan 12, 2027 Cloud switching charges abolished
- California Delete Act / DROP
California
In forcePrivacyData access and sharingNext: Jan 31, 2027 Annual data broker registration deadline
- European Health Data Space (EHDS)
European Union
EnactedHealth dataPrivacyNext: Mar 26, 2027 EHDS general application date
- GDPR
European Union
AmendedPrivacyBreach notificationNext: Apr 2, 2027 GDPR Procedural Regulation applies
- In forceCybersecurityData residency
Effective Sep 1, 2021
- Data Governance Act
European Union
AmendedData access and sharingPrivacyEffective Jun 23, 2022
- Digital Markets Act
European Union
In forceData access and sharingPrivacyEffective Nov 1, 2022
- Digital Omnibus (data/GDPR)
European Union
ProposedPrivacyData access and sharing
Upcoming deadlines
September 20261 deadline
ICO abolished; Information Commission takes over
Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).
December 20261 deadline
- eIDAS 2 / EU Digital Identity WalletEuropean Union
Member States must provide EU Digital Identity Wallets
Each Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).
January 20272 deadlines
- EU Data ActEuropean Union
Cloud switching charges abolished
Providers of data processing services may no longer impose any switching charges on customers (Art 29(1)).
Annual data broker registration deadline
Data brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.
March 20271 deadline
- European Health Data Space (EHDS)European Union
EHDS general application date
The regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).
April 20271 deadline
September 20271 deadline
- EU Data ActEuropean Union
Unfair-terms rules extend to older long-term contracts
Chapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).
December 20271 deadline
- eIDAS 2 / EU Digital Identity WalletEuropean Union
Private relying parties must accept wallets
Private relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).
January 20281 deadline
Independent third-party audits begin
Beginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.
September 20281 deadline
- EU Data ActEuropean Union
Commission evaluation
Commission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).
March 20291 deadline
- European Health Data Space (EHDS)European Union
Primary use for first data categories; secondary use framework applies
Patient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.
March 20311 deadline
- European Health Data Space (EHDS)European Union
Primary use for second data categories; EHR systems in service; extra secondary-use categories
Primary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.
March 20351 deadline
- European Health Data Space (EHDS)European Union
Third-country participation in secondary use
Art 75(5) applies from 26 Mar 2035.
Past deadlines
September 20261 deadline
- EU Data ActEuropean Union
Access-by-design for new connected products
Art 3(1) design obligation (product data and related service data accessible to the user by default) applies to connected products and related services placed on the market after 12 Sep 2026.
August 20261 deadline
Data brokers must begin processing DROP deletion requests
Brokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of sale/sharing.
June 20261 deadline
Mandatory data protection complaints procedure
Controllers must have a process for data subject complaints (s.103 and Sch. 10), per Commencement No. 6 Regulations 2026, reg. 3.
May 20261 deadline
- eIDAS 2 / EU Digital Identity WalletEuropean Union
Legacy qualified trust service providers conformity report
QTSPs qualified before 20 May 2024 had to submit a conformity assessment report proving compliance with Art 24(1), (1a) and (1b) by 21 May 2026.
February 20261 deadline
Stage 3: main data protection changes commence
Recognised legitimate interests, ADM reforms, DSAR changes, international transfer test, cookie exemptions and PECR fines at UK GDPR levels apply (Commencement No. 6 Regulations 2026, reg. 2).
January 20263 deadlines
Annual data broker registration deadline
Data brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.
DROP opens to consumers
Consumers can submit a single deletion request to all registered data brokers through DROP.
November 20251 deadline
September 20253 deadlines
- Data Governance ActEuropean Union
Legacy data intermediaries must comply
Entities that were already providing data intermediation services on 23 June 2022 had to comply with Chapter III by 24 Sep 2025 (Art 37).
- EU Data ActEuropean Union
Member States notify penalty rules
Member States had to notify the Commission of their penalty rules (Art 40(2)).
- EU Data ActEuropean Union
Data Act applies
Most obligations apply, including user data access and sharing (Chapters II-III), cloud switching (Chapter VI) and interoperability; Chapter IV unfair terms apply to contracts concluded after this date (Art 50).
August 20251 deadline
Stage 1 commencement
Technical data protection provisions, ICO statutory objects, Smart Data framework (Part 1) and AI/copyright reporting duties commence (Commencement No. 1 Regulations 2025).
June 20251 deadline
Royal Assent
The Act receives Royal Assent; commencement staged by regulations.
March 20251 deadline
- European Health Data Space (EHDS)European Union
EHDS enters into force
Regulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.
December 20241 deadline
- eIDAS 2 / EU Digital Identity WalletEuropean Union
First wallet implementing acts enter into force
Commission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.
May 20241 deadline
- eIDAS 2 / EU Digital Identity WalletEuropean Union
eIDAS 2 enters into force
Regulation (EU) 2024/1183 entered into force on the twentieth day after publication on 30 Apr 2024 (Art 2).
March 20241 deadline
- Digital Markets ActEuropean Union
Gatekeeper compliance deadline (first designations)
First-wave gatekeepers had to comply with Arts 5-7 obligations and submit compliance reports six months after the 6 Sep 2023 designation.
January 20242 deadlines
- EU Data ActEuropean Union
Reduced switching charges period begins
From 11 Jan 2024 to 12 Jan 2027, data processing providers may charge only reduced switching fees, capped at costs directly linked to switching (Art 29(2)-(3)).
- EU Data ActEuropean Union
Data Act enters into force
Entered into force on the twentieth day after publication in the OJ on 22 Dec 2023 (Art 50).
September 20232 deadlines
- Digital Markets ActEuropean Union
First six gatekeepers designated
Commission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft (22 core platform services). They had six months to fully comply.
May 20231 deadline
- Digital Markets ActEuropean Union
DMA applies
DMA becomes applicable; undertakings meeting thresholds must notify the Commission within two months (Arts 3(3), 54).
November 20221 deadline
- Digital Markets ActEuropean Union
DMA enters into force
Entered into force twenty days after publication; certain procedural articles apply from this date (Art 54).
June 20221 deadline
- Data Governance ActEuropean Union
DGA enters into force
Entered into force on the twentieth day after publication in OJ L 152 of 3 June 2022 (Art 38).
September 20211 deadline
Data Security Law takes effect
Data classification, important-data protection and data export restrictions apply (Art. 55).