Data privacy laws

Data (Use and Access) ActUnited Kingdom

ICO abolished; Information Commission takes over

Sections 118-119 commence: office of Information Commissioner abolished and functions transferred to the Information Commission (Commencement No. 9 Regulations 2026).

Connecticut Data Privacy Act (CTDPA)Connecticut

PA 26-64 (SB 4) amendments take effect

Prohibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.

India DPDP ActIndia

Consent Manager registration rule in force (12 months)

Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.

Law in force

Main obligations apply and the Personal Data Protection Agency begins supervision.

Australia Privacy ActAustralia

Children's Online Privacy Code must be registered

OAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.

Australia Privacy ActAustralia

Automated decision-making transparency applies

Privacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).

Member States must provide EU Digital Identity Wallets

Each Member State must provide at least one wallet within 24 months of the entry into force of the implementing acts under Arts 5a(23) and 5c(6) (Art 5a(1)).

CCPA / CPRACalifornia

ADMT requirements compliance date

Businesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).

CCPA / CPRACalifornia

Browsers must support opt-out preference signal (AB 566)

Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).

Colorado AI ActColorado

ADMT obligations apply

Developer documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.

Colorado AI ActColorado

AG rules due

Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.

Connecticut Data Privacy Act (CTDPA)Connecticut

Data broker registration required

Data brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).

Delaware Personal Data Privacy Act (DPDPA)Delaware

Amended thresholds and third-party duties take effect

Applicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.

Louisiana Data Privacy Act takes effect

Consumer rights and controller duties apply (Act 502, Section 2); data protection assessment requirements apply to processing from this date.

Ban on selling personal data of children under 13 (HB 1460)

HB 1460 (2026, ch. 168) prohibits controllers from selling the personal data of a child under 13.

Oklahoma Consumer Data Privacy Act takes effect

All OKCDPA obligations and consumer rights apply.

Utah UCPAUtah

UCPA extends to motor vehicle manufacturers

Motor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect personal data through vehicle data systems are covered regardless of the revenue and consumer thresholds (13-61-102, as amended by Laws 2026, ch. 193).

Cloud switching charges abolished

Providers of data processing services may no longer impose any switching charges on customers (Art 29(1)).

Indonesia PDP LawIndonesia

Implementing regulation GR 33/2026 takes effect

Detailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.

California Delete Act / DROPCalifornia

Annual data broker registration deadline

Data brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.

EHDS general application date

The regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).

Maryland Online Data Privacy Act (MODPA)Maryland

Discretionary 60-day cure period ends

The Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).

GDPR Procedural Regulation applies

Harmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).

Alabama Personal Data Protection Act (APDPA)Alabama

APDPA takes effect

Consumer rights and controller/processor obligations apply (HB 351 section 12).

India DPDP ActIndia

Main data fiduciary obligations apply (18 months)

Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.

South Korea PIPASouth Korea

Mandatory ISMS-P certification

ISMS-P certification becomes mandatory for private entities meeting the statutory criteria.

30-day cure period expires

AG's obligation to give 30-day notice and allow cure before investigating applies only from Jan 1 through July 31, 2027 (R.S. 51:1780.5(D)).

Unfair-terms rules extend to older long-term contracts

Chapter IV (unfair contractual terms) applies to contracts concluded on or before 12 Sep 2025 that are of indefinite duration or expire at least 10 years from 11 Jan 2024 (Art 50).

Proposed postponement of entry into force

Government bill Boletin 18623-07 (filed 1 Sep 2026, 'suma' urgency) would replace the 24-month vacatio legis in transitional Art 1 with a fixed date of 1 Dec 2027; in first committee stage in the Senate, not law.

Private relying parties must accept wallets

Private relying parties required by law or contract to use strong user authentication must accept wallets on user request within 36 months of the implementing acts' entry into force (Art 5f(2)).

CCPA / CPRACalifornia

Risk assessments for pre-existing processing due

Risk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).

California Delete Act / DROPCalifornia

Independent third-party audits begin

Beginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.

Vermont VDPOSAVermont

Vermont Data Privacy and Online Surveillance Act takes effect

All obligations under Act 145 apply (sec. 4).

CCPA / CPRACalifornia

First risk assessment submission to CPPA

Businesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue over $100M

First cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).

Commission evaluation

Commission evaluation report due, including the impact of cloud switching rules (Arts 23-31) (Art 49(2)).

Connecticut Data Privacy Act (CTDPA)Connecticut

Data brokers must process state deletion mechanism requests

Registered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.

Primary use for first data categories; secondary use framework applies

Patient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue $50M-$100M

First cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).

Vermont VDPOSAVermont

Mandatory 60-day cure period expires

The AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).

Postsecondary institutions must comply

Postsecondary institutions regulated by the Office of Higher Education must comply by July 31, 2029.

Colorado AI ActColorado

Mandatory cure period ends

The AG's obligation to offer a 60-day notice-and-cure period expires.

CCPA / CPRACalifornia

Cybersecurity audit due: revenue under $50M

First cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.

Primary use for second data categories; EHR systems in service; extra secondary-use categories

Primary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.

Third-country participation in secondary use

Art 75(5) applies from 26 Mar 2035.