regulation
Regulatory Deadlines for Customer Data Platforms, 2026-2028 (Tracker)
By Art Kukharenko · Published · Updated
Independent legal reviewer not yet supplied. General information; confirm current obligations with qualified counsel.
Browse regulation resourcesThis tracker records dated obligations, expected review windows and proposals affecting customer-data platforms from October 2026 onward. Status, source-review notes and the applicable jurisdiction matter more than the calendar date alone. The India commencement dates require confirmation against Gazette publication; DORA submission windows depend on the relevant authority. Use the linked sources and qualified counsel before treating a planning date as an obligation.
Built for compliance and platform leads who keep a regulatory calendar for a customer-data stack. Part of the regulation hub; the same rows ship as the deadline tracker dataset.
How to use this tracker
Start with the status column. Confirmed rows rest on an enacted instrument or an official notice. Expected rows follow a published schedule, an agenda target or a recurring cycle and can move. Proposal rows are bills, consultations or drafts: watch them, never build a launch around them. Dates use ISO 8601; a month alone (2027-03) is a window and TBD means no date has been published.
Each row says what to do in a customer-data stack: identity resolution, consent and suppression, activation, analytics, AI agents and vendor contracts. Filter by your jurisdictions, then by status, then sort by date. Sources are primary where found (EUR-Lex, regulators, legislatures); rows with unresolved source checks state that limitation in their source-review field. The actions are engineering and operations suggestions.
For the reasoning behind individual rows, see EU AI Act for marketing and customer decisioning, DORA and your marketing stack, India's DPDP timeline, EU Data Act and cloud switching, US state privacy laws and the HIPAA Security Rule tracker.
Dated obligations, October 2026 to December 2028
Undated and window-based items
Dates that moved or are disputed
Checked and left out
Quarterly review checklist
- Re-open each confirmed row and check the instrument for amendments.
- Check every expected row against its regulator's calendar: national DORA notices, the regulatory agenda, the Gazette.
- Promote, drop or add proposals.
- Assign an owner and due date in your GRC tool.
- Record each change in the update log with date and source.
- Re-run the residency table for any jurisdiction whose rules moved.
Update log
Next scheduled review: quarterly, and on any change to a dated row.
Turning these dates into a plan? Start with the compliance guide. More in the regulation hub.
Complete reference table
The interactive table below retains every source record, with source links, check dates and explicit research limitations. Use its filters and download the complete CSV.
Customer Data Regulation Deadline Tracker
Research snapshot checked on . Sort any column and retain source dates when reusing records. iAge dataset reuse terms cover the original compilation; third-party source rights remain separate.
Confirmed identifies a sourced date in the research snapshot; expected identifies a forecast or a detail awaiting primary confirmation; proposal identifies a draft. Check the event and source-review fields before relying on any deadline.
40 of 40 records match.
2026 Q4
Scroll horizontally to compare all columns ↔
| 2026-11-05 | Saudi Arabia | SDAIA draft amendments to the PDPL Implementing Regulation | Public consultation closes (opened 6 Oct 2026). The draft would require controllers to store personal data within the Kingdom while still permitting transfers under the PDPL, make controller registration mandatory where data goes abroad, and require 72-hour breach notice to SDAIA. If adopted, in force 60 days after Official Gazette publication. (Source check pending: draft text on the Istitlaa platform) | Controllers and processors handling personal data of people in Saudi Arabia | List Saudi-resident personal data and where it sits; cost an in-Kingdom region or tenant; review sub-processor locations; file a comment if material | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| 2026-11-13 | India | DPDP Rules 2025 (Rule 4) | Consent-manager provisions apply, 12 months after the Rules were notified on 13 Nov 2025. (Source check pending: link the Gazette notification) | Consent managers and the data fiduciaries that integrate them | Decide whether to accept consent artefacts from registered consent managers; plan the consent-ingest path and identity mapping | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-11-13 | India | DPDP Rules 2025 (proposed amendment) | MeitY floated cutting the 18-month phase to 12 months (comments closed 4 Feb 2026), which would pull the main obligations, including Significant Data Fiduciary duties, forward to this date. No notification found in sources dated up to 18 Mar 2026. (Source check pending: Gazette status) | Data fiduciaries, especially Significant Data Fiduciaries | Plan against 13 May 2027 but build Significant Data Fiduciary-grade controls (impact assessment, audit, data protection officer) early as a hedge | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| 2026-12-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Art. 50(2); Art. 111(4)) | End of the grace period for machine-readable marking of synthetic content by generative AI systems already on the market before 2 Aug 2026 (four months, recital 38). New prohibitions on generating non-consensual intimate imagery and child sexual abuse material (Art. 5(1)(ba) and (bb)) are reported to apply from the same date. (Source check pending: operative text, including Art. 111(4) and the Art. 5 additions) | Providers of generative AI systems; deployers that publish generated content | Check marking of generated content in campaigns; confirm image-generation tools block the newly prohibited uses; get vendor roadmaps in writing | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-12-10 | Australia | Privacy and Other Legislation Amendment Act 2024 (automated decisions) | Transparency duties for automated decision-making start 24 months after Royal Assent: privacy policies must describe automated decisions that significantly affect individuals' rights or interests. OAIC guidance was reported on 30 Sep 2026. | APP entities using automated decision-making | Inventory automated segmentation, eligibility and scoring rules; update the privacy policy | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2026-12-10 | Australia | Privacy Act Children's Online Privacy Code | Statutory deadline for the OAIC to register the code (24 months after Royal Assent); registration by end 2026 is expected. (Source check pending: statutory wording) | Online services likely to be accessed by children | Map age signals and parental-consent flows in the identity and consent layer | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-12-31 | EU | DORA (Reg. (EU) 2022/2554) Art. 28(3); Implementing Reg. (EU) 2024/2956 | Reference date for the 2027 register-of-information cycle (contractual arrangements in force at this date), following the 31 Dec 2025 reference date used in 2026. (Source check pending: each national authority's 2027 notice) | Financial entities in DORA scope and their ICT providers, including martech and customer-data vendors | Freeze a vendor and sub-contractor snapshot; confirm legal entity identifiers and function mapping with vendors | Open source | expected | Specific details await primary confirmation; see the linked source. |
2027 Q1
Scroll horizontally to compare all columns ↔
| 2027-01-01 | United States (Louisiana, Oklahoma) | Louisiana Data Privacy Act; Oklahoma Consumer Data Privacy Act | New comprehensive state privacy laws take effect. (Source check pending: bill numbers against the legislatures) | Businesses meeting the thresholds with residents of those states | Add both states to the consent and opt-out matrix; update processor contracts and assessment triggers | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-01-01 | United States (California) | CCPA regulations on automated decisionmaking technology (ADMT) | ADMT compliance starts: pre-use notice and at least two opt-out mechanisms for significant decisions. Regulations took effect 1 Jan 2026; this date applies to ADMT. | Businesses using ADMT for significant decisions about California consumers | Inventory ADMT in credit, eligibility, pricing and segmentation; build the notice and opt-out path | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-01 | United States (California) | AB 566 (California Opt Me Out Act) | Browsers operating in California must offer an opt-out preference signal setting, which websites then receive. Signed 8 Oct 2025. | Browser makers; businesses whose sites receive the signal | Honour browser opt-out signals in the identity and consent layer and in activation suppression | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-01 | United States (Colorado) | SB 26-189 (automated decision-making technology; replaces SB 24-205) | Developer technical-documentation duties start and the Attorney General's deadline for rules on post-adverse-outcome disclosures falls; 60-day cure notice applies until 1 Jan 2030. Signed 14 May 2026. (Source check pending: remaining effective dates in the session law) | Developers and deployers of ADMT used in consequential decisions | Identify scoring and eligibility models that touch Colorado residents; keep documentation current | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-01-12 | EU | Data Act (Reg. (EU) 2023/2854) Chapter VI | Switching charges for data-processing services (cloud and SaaS), capped at cost since 12 Sep 2025, are abolished. Scope for ongoing multi-cloud egress is disputed and the Digital Omnibus proposal would carve out custom services; do not read this as free egress. | Customers and providers of cloud and SaaS data-processing services | Review exit, egress and switching terms; model exit cost; check notice periods | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-16 | Indonesia | Government Regulation 33/2026 (PDP Law implementation) | Takes effect six months after its 16 Jul 2026 enactment; sets operational rules including cross-border transfers. The data protection authority and adequacy list do not yet exist. (Source check pending: regulation number, one page also cites GR 36/2026) | Controllers and processors handling personal data of people in Indonesia | Map Indonesian data flows; prepare binding safeguards and notices; watch for the authority and adequacy list | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-03 | EU | DORA register of information (2027 cycle) | Annual submission via national competent authorities, with the ESAs deadline of 31 March. 2026 precedent: CSSF 31 Mar, BaFin 9-30 Mar; one consultancy expects Ireland's portal to run 1-31 Mar 2027. (Source check pending: national windows) | Financial entities in DORA scope | Have the register data validated in xBRL-CSV format and reconciled to contracts before the window opens | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-03-26 | EU | European Health Data Space Regulation (EU) 2025/327 | General date of application; later stages apply from 26 Mar 2029 (secondary use) and 26 Mar 2031 (certain data categories). | Health data holders, electronic health record system makers, health data users | Map where health and patient-engagement data sit; watch national implementing laws | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q2
Scroll horizontally to compare all columns ↔
| 2027-04-02 | EU | GDPR Procedural Regulation (EU) 2025/2518 | Applies to cross-border GDPR complaints and investigations: harmonised admissibility, right to be heard, 15-month target for investigations (12 months for simpler cases). | Controllers and processors in cross-border cases | Keep records of processing, transfer assessments and decision logs retrievable within days | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-05-01 | United States (Alabama) | Alabama Personal Data Protection Act | New comprehensive state privacy law takes effect. (Source check pending: bill number) | Businesses meeting the thresholds with Alabama residents | Add Alabama to the consent and opt-out matrix; update processor contracts | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-05-13 | India | DPDP Rules 2025 (main obligations) | Substantive obligations apply 18 months after notification: notices, consent, security safeguards, breach notification, children's data, data principal rights and Significant Data Fiduciary duties. | Data fiduciaries and processors handling digital personal data in India | Stand up notice and consent ledgers, erasure and breach workflows; confirm processor contracts | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q3
Scroll horizontally to compare all columns ↔
| 2027-07 | United States | HIPAA Security Rule NPRM (45 CFR Part 164) | Regulatory-agenda target, not a final-rule deadline. The NPRM proposes compliance 180 days after the effective date, itself 60 days after final publication (about 240 days in total). Current rules remain operative until changed. | Covered entities and business associates | Do not wait: map ePHI assets, encryption, MFA, segmentation, restore targets and business associate agreements | Open source | expected | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-08-02 | EU | AI Act (Reg. (EU) 2024/1689) Art. 111(3) | General-purpose AI models placed on the market before 2 Aug 2025 must comply by this date. | Providers of general-purpose AI models; buyers choosing models for agents | Ask model suppliers for documentation and copyright policy; pin model versions in agent workflows | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-09-12 | EU | Data Act (Reg. (EU) 2023/2854) Chapter IV | Unfair-terms rules extend to contracts concluded on or before 12 Sep 2025 if they are open-ended or run at least 10 years from 11 Jan 2024. | Parties to business-to-business data-sharing and data-processing contracts | Review long-running contracts for one-sided data-access, liability and lock-in terms | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q4
Scroll horizontally to compare all columns ↔
| 2027-10-17 | EU | NIS2 Directive (EU) 2022/2555 Art. 40 | Commission's first review of the Directive's functioning, then every 36 months. | Essential and important entities; their suppliers | Expect supplier-security clauses to tighten; track review outcomes | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-12-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Annex III) | Stand-alone high-risk obligations apply, including credit scoring, life and health insurance pricing, employment and emotion recognition. Marketing segmentation and personalisation are not high-risk per se. | Providers and deployers of Annex III systems | Classify every model and rule-based decisioning use case; build logs, human oversight and documentation for any that qualify | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-12-11 | EU | Cyber Resilience Act (Reg. (EU) 2024/2847) | Main obligations apply to products with digital elements placed on the EU market (vulnerability and incident reporting applied from 11 Sep 2026). Installed software is in scope; pure SaaS generally is not. (Source check pending: treatment of remote data processing solutions) | Manufacturers, importers and distributors of software and hardware products | If you ship installable software, SDKs or agents: plan vulnerability handling, software bills of materials and conformity assessment | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-12-31 | United States (California) | CCPA risk-assessment regulations | Deadline to complete documented risk assessments for processing that began before 1 Jan 2026 and is still ongoing. | Businesses whose processing presents significant risk to consumers | Schedule assessments for profiling, sensitive data, selling or sharing and ADMT | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 — date unconfirmed
Scroll horizontally to compare all columns ↔
| 2027 | EU | EU-US Data Privacy Framework: Latombe appeal C-703/25 P | Court of Justice decision expected in 2027; General Court dismissed the challenge on 3 Sep 2025; Microsoft admitted as intervener 4 Jun 2026. No hearing date found. | Anyone relying on the DPF for US transfers | Keep SCCs and a transfer assessment as fallback; avoid single-mechanism dependence | Open source | expected | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027 | Canada (Nova Scotia) | PIIDPA repeal (Bill 150) and replacement regulations | Repeal reported for 2027; replacement regulations on disclosure and storage outside Canada not published as of Aug 2026. (Source check pending: commencement date) | Nova Scotia public bodies and their suppliers | Do not assume either continued localisation or free hosting; ask the public-body customer for its position | Open source | expected | Specific details await primary confirmation; see the linked source. |
2028 Q1
Scroll horizontally to compare all columns ↔
| 2028-01-01 | United States (Vermont) | Vermont Data Privacy and Online Surveillance Act | New comprehensive state privacy law takes effect. (Source check pending: act number) | Businesses meeting the thresholds with Vermont residents | Add Vermont to the consent and opt-out matrix; review the stricter surveillance provisions | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2028-03 | EU | DORA register of information (2028 cycle) | Annual cycle repeats with reference date 31 Dec 2027. (Source check pending: national windows when published) | Financial entities in DORA scope | Keep the register as a living artefact tied to procurement | Open source | expected | Specific details await primary confirmation; see the linked source. |
2028 Q2
Scroll horizontally to compare all columns ↔
| 2028-04-01 | United States (California) | CCPA risk-assessment submissions and cybersecurity audits | First risk-assessment submissions due to the CPPA; first cybersecurity audit reports due for businesses above $100 million revenue (audit period 2027). Businesses at $50-100 million follow in Apr 2029 and below $50 million in Apr 2030. | Businesses meeting the thresholds | Choose an independent auditor; scope customer-data systems and vendors | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2028 Q3
Scroll horizontally to compare all columns ↔
| 2028-08-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Annex I) | High-risk obligations apply to AI systems embedded in regulated products. | Manufacturers of products under EU harmonisation legislation | Mostly outside marketing and customer-data stacks; confirm no regulated-product embedding | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2028 — date unconfirmed
Scroll horizontally to compare all columns ↔
| 2028 | Japan | Act No. 56 of 2026 amending the APPI | Promulgated 17 Jul 2026; adds administrative fines; one source expects full effect by 2028. (Source check pending: commencement dates) | Business operators handling personal information of individuals in Japan | Review third-party provision and sensitive-data controls; plan for direct PPC fines | Open source | expected | Specific details await primary confirmation; see the linked source. |
Date not confirmed
Scroll horizontally to compare all columns ↔
| TBD | EU | Cloud and AI Development Act, COM(2026) 502 (2026/0138(COD)) | Proposal, not law. Level 1 would apply to public bodies; higher levels depend on the Article 29 risk assessment, with derogations. No commencement date is established. | Cloud providers and public-sector buyers | Watch; do not design to proposal text | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | EU | Digital Omnibus package amending the GDPR (proposal of 19 Nov 2025) | Still in first reading; never treat as law. (Source check pending: current procedure file) | All GDPR controllers | Watch; no design changes | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| TBD | United States | SECURE Data Act (H.R. 8413) | Federal comprehensive privacy draft, April 2026; hearing June 2026; no markup. | All US businesses | Watch; state laws remain the operative layer | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | Canada | Bill C-36, Protecting Privacy and Consumer Data Act | First reading 15 Jun 2026; third attempt after Bills C-11 and C-27 lapsed; would repeal Part 1 of PIPEDA and add a binding-order regulator with penalties up to the greater of CAD 10 million or 3 % of global revenue (Source check pending: bill text). Not law. | Private-sector organisations in Canada | Watch; keep the Quebec impact-assessment process running | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| TBD | Australia | Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft) | Exposure draft released 31 Aug 2026; consultation closed 18 Sep 2026; legislation expected by end 2026; would add a fair-and-reasonable test and an erasure right. Not law. | APP entities | Watch; plan erasure and purpose-limitation capability | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | United Arab Emirates | Federal PDPL executive regulations | Executive regulations not confirmed as issued; sources conflict. (Source check pending: UAE Data Office and Official Gazette) | Controllers and processors handling UAE personal data | Keep health data in the UAE under Federal Law 2/2019; design transfer controls to be configurable | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| TBD | United Kingdom | Data (Use and Access) Act 2025: remaining commencements | Main data-protection provisions and the transfer regime commenced 5 Feb 2026 (SI 2026/82); remaining provisions, including Information Commission governance changes, have no confirmed dates. (Source check pending: government commencement tracker) | UK controllers and processors | Track commencement regulations; no action beyond the 2026 changes | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| TBD | EU Member States | NIS2 national transposition laws | Transposition deadline was 17 Oct 2024; counts of completed states differ by source (about 19 to 22 of 27 by Oct 2026). The Commission sent reasoned opinions to 19 states in May 2025 and, per secondary reports, referred four to the CJEU in July 2026. (Source check pending: current Commission count and referrals) | Essential and important entities and their suppliers | Check the national law and supervisory authority for each EU entity; expect supplier-security clauses in contracts | Open source | expected | Specific details await primary confirmation; see the linked source. |
General information, not legal advice. Read the supporting analysis.
Frequently asked questions
What regulatory deadlines in 2027 affect data privacy?
Dated 2027 items include: new state laws in Louisiana and Oklahoma (1 January) and Alabama (1 May); California ADMT rules and browser opt-out signals (1 January); the EU Data Act's end of switching charges (12 January); DORA register submissions (March); the European Health Data Space (26 March); the GDPR Procedural Regulation (2 April); India's DPDP main duties (13 May); and EU AI Act Annex III rules (2 December). The HIPAA Security Rule final rule is expected around July.
When do the EU AI Act high-risk deadlines apply?
After Regulation (EU) 2026/1744, stand-alone high-risk obligations under Annex III apply from 2 December 2027, and obligations for AI embedded in regulated products under Annex I from 2 August 2028. Article 50 transparency applied from 2 August 2026, with marking grace to 2 December 2026 for systems already on the market. Marketing segmentation is not high-risk per se; credit scoring, insurance pricing and employment decisions are.
What is the DORA register of information date for 2027?
The register is an annual submission. The reference date is 31 December 2026, and national competent authorities set the windows, with the ESAs deadline at 31 March. In 2026 the CSSF deadline was 31 March and BaFin's window ran 9 to 30 March. Treat March 2027 as expected until your authority publishes its notice, and use the templates in Implementing Regulation (EU) 2024/2956.
What is the DPDP Act deadline?
India notified the DPDP Rules on 13 November 2025. Consent-manager provisions apply from 13 November 2026 and the main obligations from 13 May 2027. MeitY consulted in January 2026 on shortening the 18-month phase to 12 months; sources found show no notification, so plan to May 2027 while building controls early.
What changes under the EU Data Act in January 2027?
From 12 January 2027 switching charges for data-processing services such as cloud and SaaS are abolished; since 12 September 2025 they have been capped at cost. That does not make egress free: the scope for ongoing multi-cloud egress is disputed and the Digital Omnibus proposal would carve out custom services. Review exit and egress terms before the date.
What is the HIPAA Security Rule timeline?
HHS published the proposed rule on 6 January 2025 and comments closed on 7 March 2025. The regulatory agenda now targets a final rule around July 2027, down from an earlier May 2026 target, with compliance about 180 days after publication. More than 100 provider groups asked HHS to withdraw it, so it could change. The current Security Rule remains in force.
Sources
- Clyde & Co, SDAIA draft PDPL amendments (8 Oct 2026) Open source
- ComplianceHub, India DPDP consent manager phase (secondary) Open source
- Mondaq, MeitY proposal to compress the DPDP timeline (Mar 2026) Open source
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) Open source
- Privacy and Other Legislation Amendment Act 2024 (Australia) Open source
- CSSF, DORA register of information collection (Mar 2026) Open source
- Morgan Lewis, new US state consumer privacy laws (Jul 2026) Open source
- California Privacy Protection Agency, regulations Open source
- CPPA announcement on AB 566 (8 Oct 2025) Open source
- Colorado General Assembly, SB26-189 Open source
- Regulation (EU) 2023/2854 (Data Act) Open source
- Hogan Lovells, Indonesia PDP Law implementing regulation Open source
- Regulation (EU) 2025/327 (European Health Data Space) Open source
- Regulation (EU) 2025/2518 (GDPR procedural rules) Open source
- Federal Register, HIPAA Security Rule NPRM (6 Jan 2025) Open source
- Regulation (EU) 2024/1689 (AI Act) Open source
- Directive (EU) 2022/2555 (NIS2) Open source
- Regulation (EU) 2024/2847 (Cyber Resilience Act) Open source
- Case C-703/25 P, Latombe v Commission (OJ notice) Open source
- Cloud and AI Development Act proposal, COM(2026) 502 Open source
- European Commission, data protection Open source
- IAPP, SECURE Data Act draft Open source
- Parliament of Canada, Bill C-36 Open source
- Attorney-General's Department, privacy reform consultation Open source
- UAE government portal, data protection laws Open source
- Data (Use and Access) Act 2025 Open source
- Blakes, Data Governor Winter 2026 Open source
- Personal Information Protection Commission (Japan), legal framework Open source
- European Commission, NIS transposition tracker Open source
- Gibson Dunn, EU AI Act omnibus agreement Open source
- Privacy World, Colorado AI Act (May 2026) Open source
- Paubox, HHS pushes the final HIPAA Security Rule update to 2027 Open source
- PCI SSC blog, PCI DSS v4.0.1 Open source
- Forvis Mazars, DORA register of information (2027 cycle expectation) Open source
- Mondaq, CPPA final rules on ADMT, risk assessments and cybersecurity audits Open source
- Kennedys, European Health Data Space implications (2026) Open source
- McCann FitzGerald, GDPR procedural regulation Open source
- McCann FitzGerald, Cyber Resilience Act reporting from 11 Sep 2026 Open source
- S.S. Rana, MeitY plan to shorten the DPDP timeline (Feb 2026) Open source
Put this evaluation into practice.
Review the compliance guideThis article is general information, not legal advice.
Further reading
- Customer data regulation guides
- Compliance guide
- Data residency by country
- DORA and Your Marketing Stack: Register
- EU AI Act Compliance Checklist
Published: · Updated:
Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.