2024 compliance deadlines

Data Act enters into force

Entered into force on the twentieth day after publication in the OJ on 22 Dec 2023 (Art 50).

Reduced switching charges period begins

From 11 Jan 2024 to 12 Jan 2027, data processing providers may charge only reduced switching fees, capped at costs directly linked to switching (Art 29(2)-(3)).

DSA applies to all intermediary services

Full application to all providers of intermediary services (Art 93(2)).

Gatekeeper compliance deadline (first designations)

First-wave gatekeepers had to comply with Arts 5-7 obligations and submit compliance reports six months after the 6 Sep 2023 designation.

FCC CPNI Breach RuleUnited States (Federal)

Order effective except revised notification rules

Definitions and other parts of the order took effect; the revised 64.2011 and 64.5111 notification requirements were delayed pending OMB approval.

Cross-border data flow provisions take effect

Exemptions and volume thresholds apply from publication (Art. 14); security assessment results are valid for 3 years (Art. 9).

Regulated entities must comply

Sections 4-9 (privacy policy, consent, consumer rights, sale authorization) apply to regulated entities.

NYDFS Cybersecurity Regulation (Part 500)New York

Annual compliance notification

Certification of compliance or acknowledgment of non-compliance due (recurs every April 15).

NYDFS Cybersecurity Regulation (Part 500)New York

General 180-day transition ends

Most new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.

Utah AI Policy ActUtah

AI Policy Act effective

Generative AI disclosure duties and the Office of AI Policy take effect.

GLBA Safeguards RuleUnited States (Federal)

FTC breach notification requirement effective

Section 314.4(j) requires notice to the FTC within 30 days of discovering a notification event involving at least 500 consumers.

Colorado AI ActColorado

SB 24-205 signed

Governor Polis signs the original Colorado AI Act with a February 1, 2026 effective date.

eIDAS 2 enters into force

Regulation (EU) 2024/1183 entered into force on the twentieth day after publication on 30 Apr 2024 (Art 2).

Turkey KVKKTurkey

Law 7499 amendments take effect

New sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.

SEC Cyber Disclosure RulesUnited States (Federal)

Smaller reporting companies: Item 1.05 compliance

Smaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.

PADFAUnited States (Federal)

PADFA takes effect

The prohibition takes effect 60 days after enactment (April 24, 2024).

HIPAAUnited States (Federal)

Reproductive health care privacy rule effective (later vacated)

The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).

Small businesses must comply

Sections 4-9 apply to small businesses.

Colorado Privacy Act (CPA)Colorado

Universal opt-out mechanism recognition required

Controllers must honor AG-recognized universal opt-out mechanisms (e.g. Global Privacy Control).

Florida Digital Bill of RightsFlorida

Florida Digital Bill of Rights takes effect

SB 262 obligations under Fla. Stat. 501.701-501.722 apply.

Oregon OCPAOregon

OCPA takes effect for most controllers

OCPA obligations apply to for-profit controllers meeting the thresholds.

Texas TDPSATexas

TDPSA takes effect

Most TDPSA obligations and consumer rights apply.

CIRCIAUnited States (Federal)

NPRM comment period closed

Extended comment period on the CIRCIA proposed rule closed.

FTC Health Breach Notification RuleUnited States (Federal)

2024 amendments effective

Amendments clarifying health app coverage, unauthorized disclosure as breach, email notice and FTC notice timing took effect.

AI Act enters into force

Regulation (EU) 2024/1689 enters into force twenty days after publication on 12 July 2024 (Art 113).

Illinois BIPAIllinois

SB 2979 amendment effective

Public Act 103-0769 signed and effective immediately: single recovery per person and electronic signatures allowed for consent.

SEC Regulation S-PUnited States (Federal)

Amendments effective

The Regulation S-P amendments became effective; compliance tiered by entity size.

Illinois AI in Employment Law (HB 3773)Illinois

HB 3773 signed

Governor Pritzker signs Public Act 103-0804.

Brazil LGPDBrazil

International transfer regulation published

Resolution CD/ANPD 19/2024 on international transfers and standard contractual clauses published and in force.

Turkey KVKKTurkey

Old transfer regime ends

Transitional period ends in which the former Article 9 explicit-consent transfer basis could still be relied on.

Saudi PDPLSaudi Arabia

One-year grace period ends

Grace period for controllers to comply ends; PDPL fully enforceable.

California AI Transparency Act (SB 942)California

SB 942 signed

SB 942 chaptered (ch. 291) with an original operative date of January 1, 2026.

Quebec Law 25Quebec, Canada

Phase 3: data portability

Right to data portability in a structured, commonly used technological format applies.

California AB 2013 (AI training data transparency)California

AB 2013 signed

AB 2013 chaptered (ch. 817).

Montana Consumer Data Privacy Act (MCDPA)Montana

MCDPA takes effect

Consumer rights, controller duties and opt-out preference signal support apply.

Indonesia PDP LawIndonesia

PDP Law transition ends

Controllers and processors must fully comply (Art. 74 two-year transition).

Transposition deadline

Member States had to adopt and publish national transposing measures by 17 Oct 2024 (Art 41(1)).

National NIS2 measures apply; NIS1 repealed

Member States apply their NIS2 measures from 18 Oct 2024 and Directive (EU) 2016/1148 (NIS1) is repealed (Arts 41(1), 44).

NYDFS Cybersecurity Regulation (Part 500)New York

Governance, encryption, IR/BCDR, exemptions

500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.

Implementing Regulation 2024/2690 enters into force

Commission Implementing Regulation (EU) 2024/2690 (published 18 Oct 2024) sets technical risk-management measures and significant-incident thresholds for DNS, TLD, cloud, data centre, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.

New PLD enters into force

Directive entered into force on the twentieth day after publication in the OJ on 18 Nov 2024 (Art 23).

Brazil AI Bill (PL 2338/2023)Brazil

Approved by the Federal Senate

Senate approves the consolidated text and sends it to the Chamber of Deputies.

CRA enters into force

Entered into force on the twentieth day after publication in the OJ on 20 Nov 2024 (Art 71(1)).

Australia Privacy ActAustralia

Most POLA Act 2024 amendments commence

Tiered penalties, infringement notices, OAIC powers, security and overseas-transfer clarifications and doxxing offences commence the day after Royal Assent.

Published in Diario Oficial

Law 21.719 published; 24-month vacatio legis begins.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of annual cybersecurity disclosures

Item 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.

CMMC 2.0United States (Federal)

CMMC Program rule (32 CFR Part 170) effective

The program rule establishing CMMC levels and assessment processes took effect; contract enforcement awaited the DFARS rule.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of Item 1.05 disclosures

Form 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.

HIPAAUnited States (Federal)

Reproductive health privacy compliance date (vacated)

Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.

First wallet implementing acts enter into force

Commission Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982 (adopted 28 Nov 2024, published 4 Dec 2024) enter into force. This starts the wallet deadline clocks in Arts 5a and 5f.

Connecticut Data Privacy Act (CTDPA)Connecticut

Mandatory 60-day cure period expires

After Dec 31, 2024, the AG is no longer required to offer a 60-day cure before enforcement; cure becomes discretionary.