Skip to content

2022 compliance deadlines

10 data, privacy, AI and cybersecurity deadlines fall in 2022, across 10 regulations.

January 20222 deadlines

  1. UAE PDPL

    PDPL enters into force

    Decree-law takes effect; compliance obligations tied to Executive Regulations.

    Takes effect4.7 years agoSource
  2. GLBA Safeguards Rule

    2021 Safeguards Rule amendments effective

    The amended Safeguards Rule published December 9, 2021 took effect, with the more detailed program elements in 314.5 deferred.

    Takes effect4.7 years agoSource

April 20221 deadline

  1. 2020 amendments in force

    Mandatory breach reporting, pseudonymized information and stricter cross-border rules apply.

    Takes effect4.5 years agoSource

June 20222 deadlines

  1. Thailand PDPA

    PDPA main obligations take effect

    Core data protection obligations and penalties apply after postponement Royal Decrees.

    Takes effect4.3 years agoSource
  2. Data Governance Act

    DGA enters into force

    Entered into force on the twentieth day after publication in OJ L 152 of 3 June 2022 (Art 38).

    Takes effect4.3 years agoSource

September 20221 deadline

  1. Quebec Law 25

    Phase 1: privacy officer and incident reporting

    Person in charge of personal information protection, confidentiality incident notification and register apply.

    Compliance deadline4 years agoSource

October 20222 deadlines

  1. Singapore PDPA

    Higher financial penalty cap applies

    Maximum penalty rises to 10% of Singapore turnover for organizations with turnover above SGD 10 million.

    Enforcement4 years agoSource
  2. PDP Law enacted and in force

    Law takes effect on enactment, starting a 2-year transition.

    Takes effect3.9 years agoSource

November 20222 deadlines

  1. Digital Markets Act

    DMA enters into force

    Entered into force twenty days after publication; certain procedural articles apply from this date (Art 54).

    Takes effect3.9 years agoSource
  2. Digital Services Act

    DSA enters into force

    Entered into force twenty days after publication; VLOP designation provisions (Art 33(3)-(6)) and Commission enforcement sections apply from this date (Art 93).

    Takes effect3.9 years agoSource

When the rules change: new data, privacy and AI laws and deadlines, the next morning.