2023 compliance deadlines

CCPA / CPRACalifornia

CPRA amendments operative

CPRA amendments (correction right, sensitive PI limits, sharing opt-out, employee/B2B data coverage) become operative.

Virginia VCDPAVirginia

VCDPA takes effect

VCDPA obligations and consumer rights apply.

DORA enters into force

Entered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022 (Art 64).

NIS2 enters into force

Directive entered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022.

Platforms publish EU user numbers

Online platforms and search engines had to publish average monthly active EU recipients, and must update them at least every six months (Art 24(2)).

First VLOP/VLOSE designations

Commission designated the first 19 very large online platforms and search engines (e.g. Amazon Store, Facebook, Google Search, TikTok, X). Obligations apply four months after notification.

HB 1155 signed

Governor signs My Health My Data Act.

DMA applies

DMA becomes applicable; undertakings meeting thresholds must notify the Commission within two months (Arts 3(3), 54).

GLBA Safeguards RuleUnited States (Federal)

Compliance with expanded security program elements

Applicability of the 314.5 provisions (qualified individual, written risk assessment, encryption, MFA, pen testing, incident response plan, board reporting) was delayed from December 9, 2022 to this date.

Nigeria NDPANigeria

NDPA signed into law

President signs the Nigeria Data Protection Act, 2023.

Colorado Privacy Act (CPA)Colorado

CPA takes effect

Core consumer rights and controller duties apply.

Connecticut Data Privacy Act (CTDPA)Connecticut

CTDPA takes effect

Core consumer rights and controller obligations apply.

NYC Local Law 144 (AEDT)New York City, New York

DCWP enforcement begins

Bias audit, results publication and candidate notice requirements are enforced.

DPF adequacy decision adopted and effective

Commission adopted Implementing Decision (EU) 2023/1795, effective on notification to Member States; EU-US transfers to DPF-certified organisations may proceed without additional safeguards.

Geofencing ban (Section 10) effective

Ban on geofencing around health care facilities applies to all persons.

Swiss revised FADP (nFADP)Switzerland

Revised FADP enters into force

Revised FADP and Data Protection Ordinance apply with no transition period.

First six gatekeepers designated

Commission designated Alphabet, Amazon, Apple, ByteDance, Meta and Microsoft (22 core platform services). They had six months to fully comply.

Saudi PDPLSaudi Arabia

PDPL in force

PDPL and its implementing regulations take effect.

Quebec Law 25Quebec, Canada

Phase 2: main obligations and penalties

Governance policies, PIAs, consent, transparency, privacy by default, ADM notices, cross-border PIAs and AMP/penal regime apply.

DGA applies

All DGA rules apply (Art 38).

UK Online Safety ActUnited Kingdom

Royal Assent

The Online Safety Act receives Royal Assent.

NYDFS Cybersecurity Regulation (Part 500)New York

Second Amendment effective

Second Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.

NYDFS Cybersecurity Regulation (Part 500)New York

Amended notification requirements (500.17)

New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).

SEC Cyber Disclosure RulesUnited States (Federal)

Annual cybersecurity disclosures begin (Item 106 / 16K)

Required in annual reports for fiscal years ending on or after this date.

SEC Cyber Disclosure RulesUnited States (Federal)

Form 8-K Item 1.05 incident disclosure begins

All registrants other than smaller reporting companies must file material incident disclosures from this date.

Utah UCPAUtah

UCPA takes effect

Utah Consumer Privacy Act obligations and consumer rights apply.