tools
Customer Data Regulation Deadline Tracker
By Art Kukharenko · Published · Updated
Browse tools resourcesUse this worksheet to record your own requirements, assumptions and evidence. The supplied rows are research or illustrative examples, not a regulatory filing, vendor quote or completed assessment.
How to use this worksheet
- Download the CSV and preserve the source and assumption columns.
- Replace example values with your own documented information.
- Review the result with the accountable technical, procurement or legal owner.
Read the supporting guide for context and return to the tools library.
Customer Data Regulation Deadline Tracker
Research snapshot checked on . Sort any column and retain source dates when reusing records. iAge dataset reuse terms cover the original compilation; third-party source rights remain separate.
Confirmed identifies a sourced date in the research snapshot; expected identifies a forecast or a detail awaiting primary confirmation; proposal identifies a draft. Check the event and source-review fields before relying on any deadline.
40 of 40 records match.
2026 Q4
Scroll horizontally to compare all columns ↔
| 2026-11-05 | Saudi Arabia | SDAIA draft amendments to the PDPL Implementing Regulation | Public consultation closes (opened 6 Oct 2026). The draft would require controllers to store personal data within the Kingdom while still permitting transfers under the PDPL, make controller registration mandatory where data goes abroad, and require 72-hour breach notice to SDAIA. If adopted, in force 60 days after Official Gazette publication. (Source check pending: draft text on the Istitlaa platform) | Controllers and processors handling personal data of people in Saudi Arabia | List Saudi-resident personal data and where it sits; cost an in-Kingdom region or tenant; review sub-processor locations; file a comment if material | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| 2026-11-13 | India | DPDP Rules 2025 (Rule 4) | Consent-manager provisions apply, 12 months after the Rules were notified on 13 Nov 2025. (Source check pending: link the Gazette notification) | Consent managers and the data fiduciaries that integrate them | Decide whether to accept consent artefacts from registered consent managers; plan the consent-ingest path and identity mapping | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-11-13 | India | DPDP Rules 2025 (proposed amendment) | MeitY floated cutting the 18-month phase to 12 months (comments closed 4 Feb 2026), which would pull the main obligations, including Significant Data Fiduciary duties, forward to this date. No notification found in sources dated up to 18 Mar 2026. (Source check pending: Gazette status) | Data fiduciaries, especially Significant Data Fiduciaries | Plan against 13 May 2027 but build Significant Data Fiduciary-grade controls (impact assessment, audit, data protection officer) early as a hedge | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| 2026-12-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Art. 50(2); Art. 111(4)) | End of the grace period for machine-readable marking of synthetic content by generative AI systems already on the market before 2 Aug 2026 (four months, recital 38). New prohibitions on generating non-consensual intimate imagery and child sexual abuse material (Art. 5(1)(ba) and (bb)) are reported to apply from the same date. (Source check pending: operative text, including Art. 111(4) and the Art. 5 additions) | Providers of generative AI systems; deployers that publish generated content | Check marking of generated content in campaigns; confirm image-generation tools block the newly prohibited uses; get vendor roadmaps in writing | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-12-10 | Australia | Privacy and Other Legislation Amendment Act 2024 (automated decisions) | Transparency duties for automated decision-making start 24 months after Royal Assent: privacy policies must describe automated decisions that significantly affect individuals' rights or interests. OAIC guidance was reported on 30 Sep 2026. | APP entities using automated decision-making | Inventory automated segmentation, eligibility and scoring rules; update the privacy policy | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2026-12-10 | Australia | Privacy Act Children's Online Privacy Code | Statutory deadline for the OAIC to register the code (24 months after Royal Assent); registration by end 2026 is expected. (Source check pending: statutory wording) | Online services likely to be accessed by children | Map age signals and parental-consent flows in the identity and consent layer | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2026-12-31 | EU | DORA (Reg. (EU) 2022/2554) Art. 28(3); Implementing Reg. (EU) 2024/2956 | Reference date for the 2027 register-of-information cycle (contractual arrangements in force at this date), following the 31 Dec 2025 reference date used in 2026. (Source check pending: each national authority's 2027 notice) | Financial entities in DORA scope and their ICT providers, including martech and customer-data vendors | Freeze a vendor and sub-contractor snapshot; confirm legal entity identifiers and function mapping with vendors | Open source | expected | Specific details await primary confirmation; see the linked source. |
2027 Q1
Scroll horizontally to compare all columns ↔
| 2027-01-01 | United States (Louisiana, Oklahoma) | Louisiana Data Privacy Act; Oklahoma Consumer Data Privacy Act | New comprehensive state privacy laws take effect. (Source check pending: bill numbers against the legislatures) | Businesses meeting the thresholds with residents of those states | Add both states to the consent and opt-out matrix; update processor contracts and assessment triggers | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-01-01 | United States (California) | CCPA regulations on automated decisionmaking technology (ADMT) | ADMT compliance starts: pre-use notice and at least two opt-out mechanisms for significant decisions. Regulations took effect 1 Jan 2026; this date applies to ADMT. | Businesses using ADMT for significant decisions about California consumers | Inventory ADMT in credit, eligibility, pricing and segmentation; build the notice and opt-out path | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-01 | United States (California) | AB 566 (California Opt Me Out Act) | Browsers operating in California must offer an opt-out preference signal setting, which websites then receive. Signed 8 Oct 2025. | Browser makers; businesses whose sites receive the signal | Honour browser opt-out signals in the identity and consent layer and in activation suppression | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-01 | United States (Colorado) | SB 26-189 (automated decision-making technology; replaces SB 24-205) | Developer technical-documentation duties start and the Attorney General's deadline for rules on post-adverse-outcome disclosures falls; 60-day cure notice applies until 1 Jan 2030. Signed 14 May 2026. (Source check pending: remaining effective dates in the session law) | Developers and deployers of ADMT used in consequential decisions | Identify scoring and eligibility models that touch Colorado residents; keep documentation current | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-01-12 | EU | Data Act (Reg. (EU) 2023/2854) Chapter VI | Switching charges for data-processing services (cloud and SaaS), capped at cost since 12 Sep 2025, are abolished. Scope for ongoing multi-cloud egress is disputed and the Digital Omnibus proposal would carve out custom services; do not read this as free egress. | Customers and providers of cloud and SaaS data-processing services | Review exit, egress and switching terms; model exit cost; check notice periods | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-01-16 | Indonesia | Government Regulation 33/2026 (PDP Law implementation) | Takes effect six months after its 16 Jul 2026 enactment; sets operational rules including cross-border transfers. The data protection authority and adequacy list do not yet exist. (Source check pending: regulation number, one page also cites GR 36/2026) | Controllers and processors handling personal data of people in Indonesia | Map Indonesian data flows; prepare binding safeguards and notices; watch for the authority and adequacy list | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-03 | EU | DORA register of information (2027 cycle) | Annual submission via national competent authorities, with the ESAs deadline of 31 March. 2026 precedent: CSSF 31 Mar, BaFin 9-30 Mar; one consultancy expects Ireland's portal to run 1-31 Mar 2027. (Source check pending: national windows) | Financial entities in DORA scope | Have the register data validated in xBRL-CSV format and reconciled to contracts before the window opens | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-03-26 | EU | European Health Data Space Regulation (EU) 2025/327 | General date of application; later stages apply from 26 Mar 2029 (secondary use) and 26 Mar 2031 (certain data categories). | Health data holders, electronic health record system makers, health data users | Map where health and patient-engagement data sit; watch national implementing laws | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q2
Scroll horizontally to compare all columns ↔
| 2027-04-02 | EU | GDPR Procedural Regulation (EU) 2025/2518 | Applies to cross-border GDPR complaints and investigations: harmonised admissibility, right to be heard, 15-month target for investigations (12 months for simpler cases). | Controllers and processors in cross-border cases | Keep records of processing, transfer assessments and decision logs retrievable within days | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-05-01 | United States (Alabama) | Alabama Personal Data Protection Act | New comprehensive state privacy law takes effect. (Source check pending: bill number) | Businesses meeting the thresholds with Alabama residents | Add Alabama to the consent and opt-out matrix; update processor contracts | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-05-13 | India | DPDP Rules 2025 (main obligations) | Substantive obligations apply 18 months after notification: notices, consent, security safeguards, breach notification, children's data, data principal rights and Significant Data Fiduciary duties. | Data fiduciaries and processors handling digital personal data in India | Stand up notice and consent ledgers, erasure and breach workflows; confirm processor contracts | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q3
Scroll horizontally to compare all columns ↔
| 2027-07 | United States | HIPAA Security Rule NPRM (45 CFR Part 164) | Regulatory-agenda target, not a final-rule deadline. The NPRM proposes compliance 180 days after the effective date, itself 60 days after final publication (about 240 days in total). Current rules remain operative until changed. | Covered entities and business associates | Do not wait: map ePHI assets, encryption, MFA, segmentation, restore targets and business associate agreements | Open source | expected | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-08-02 | EU | AI Act (Reg. (EU) 2024/1689) Art. 111(3) | General-purpose AI models placed on the market before 2 Aug 2025 must comply by this date. | Providers of general-purpose AI models; buyers choosing models for agents | Ask model suppliers for documentation and copyright policy; pin model versions in agent workflows | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-09-12 | EU | Data Act (Reg. (EU) 2023/2854) Chapter IV | Unfair-terms rules extend to contracts concluded on or before 12 Sep 2025 if they are open-ended or run at least 10 years from 11 Jan 2024. | Parties to business-to-business data-sharing and data-processing contracts | Review long-running contracts for one-sided data-access, liability and lock-in terms | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 Q4
Scroll horizontally to compare all columns ↔
| 2027-10-17 | EU | NIS2 Directive (EU) 2022/2555 Art. 40 | Commission's first review of the Directive's functioning, then every 36 months. | Essential and important entities; their suppliers | Expect supplier-security clauses to tighten; track review outcomes | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-12-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Annex III) | Stand-alone high-risk obligations apply, including credit scoring, life and health insurance pricing, employment and emotion recognition. Marketing segmentation and personalisation are not high-risk per se. | Providers and deployers of Annex III systems | Classify every model and rule-based decisioning use case; build logs, human oversight and documentation for any that qualify | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027-12-11 | EU | Cyber Resilience Act (Reg. (EU) 2024/2847) | Main obligations apply to products with digital elements placed on the EU market (vulnerability and incident reporting applied from 11 Sep 2026). Installed software is in scope; pure SaaS generally is not. (Source check pending: treatment of remote data processing solutions) | Manufacturers, importers and distributors of software and hardware products | If you ship installable software, SDKs or agents: plan vulnerability handling, software bills of materials and conformity assessment | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2027-12-31 | United States (California) | CCPA risk-assessment regulations | Deadline to complete documented risk assessments for processing that began before 1 Jan 2026 and is still ongoing. | Businesses whose processing presents significant risk to consumers | Schedule assessments for profiling, sensitive data, selling or sharing and ADMT | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2027 — date unconfirmed
Scroll horizontally to compare all columns ↔
| 2027 | EU | EU-US Data Privacy Framework: Latombe appeal C-703/25 P | Court of Justice decision expected in 2027; General Court dismissed the challenge on 3 Sep 2025; Microsoft admitted as intervener 4 Jun 2026. No hearing date found. | Anyone relying on the DPF for US transfers | Keep SCCs and a transfer assessment as fallback; avoid single-mechanism dependence | Open source | expected | Dated supplied research; confirm current instrument before relying on this deadline. | |
| 2027 | Canada (Nova Scotia) | PIIDPA repeal (Bill 150) and replacement regulations | Repeal reported for 2027; replacement regulations on disclosure and storage outside Canada not published as of Aug 2026. (Source check pending: commencement date) | Nova Scotia public bodies and their suppliers | Do not assume either continued localisation or free hosting; ask the public-body customer for its position | Open source | expected | Specific details await primary confirmation; see the linked source. |
2028 Q1
Scroll horizontally to compare all columns ↔
| 2028-01-01 | United States (Vermont) | Vermont Data Privacy and Online Surveillance Act | New comprehensive state privacy law takes effect. (Source check pending: act number) | Businesses meeting the thresholds with Vermont residents | Add Vermont to the consent and opt-out matrix; review the stricter surveillance provisions | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| 2028-03 | EU | DORA register of information (2028 cycle) | Annual cycle repeats with reference date 31 Dec 2027. (Source check pending: national windows when published) | Financial entities in DORA scope | Keep the register as a living artefact tied to procurement | Open source | expected | Specific details await primary confirmation; see the linked source. |
2028 Q2
Scroll horizontally to compare all columns ↔
| 2028-04-01 | United States (California) | CCPA risk-assessment submissions and cybersecurity audits | First risk-assessment submissions due to the CPPA; first cybersecurity audit reports due for businesses above $100 million revenue (audit period 2027). Businesses at $50-100 million follow in Apr 2029 and below $50 million in Apr 2030. | Businesses meeting the thresholds | Choose an independent auditor; scope customer-data systems and vendors | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2028 Q3
Scroll horizontally to compare all columns ↔
| 2028-08-02 | EU | AI Act as amended by Regulation (EU) 2026/1744 (Annex I) | High-risk obligations apply to AI systems embedded in regulated products. | Manufacturers of products under EU harmonisation legislation | Mostly outside marketing and customer-data stacks; confirm no regulated-product embedding | Open source | confirmed | Dated supplied research; confirm current instrument before relying on this deadline. |
2028 — date unconfirmed
Scroll horizontally to compare all columns ↔
| 2028 | Japan | Act No. 56 of 2026 amending the APPI | Promulgated 17 Jul 2026; adds administrative fines; one source expects full effect by 2028. (Source check pending: commencement dates) | Business operators handling personal information of individuals in Japan | Review third-party provision and sensitive-data controls; plan for direct PPC fines | Open source | expected | Specific details await primary confirmation; see the linked source. |
Date not confirmed
Scroll horizontally to compare all columns ↔
| TBD | EU | Cloud and AI Development Act, COM(2026) 502 (2026/0138(COD)) | Proposal, not law. Level 1 would apply to public bodies; higher levels depend on the Article 29 risk assessment, with derogations. No commencement date is established. | Cloud providers and public-sector buyers | Watch; do not design to proposal text | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | EU | Digital Omnibus package amending the GDPR (proposal of 19 Nov 2025) | Still in first reading; never treat as law. (Source check pending: current procedure file) | All GDPR controllers | Watch; no design changes | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| TBD | United States | SECURE Data Act (H.R. 8413) | Federal comprehensive privacy draft, April 2026; hearing June 2026; no markup. | All US businesses | Watch; state laws remain the operative layer | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | Canada | Bill C-36, Protecting Privacy and Consumer Data Act | First reading 15 Jun 2026; third attempt after Bills C-11 and C-27 lapsed; would repeal Part 1 of PIPEDA and add a binding-order regulator with penalties up to the greater of CAD 10 million or 3 % of global revenue (Source check pending: bill text). Not law. | Private-sector organisations in Canada | Watch; keep the Quebec impact-assessment process running | Open source | proposal | Specific details await primary confirmation; see the linked source. | |
| TBD | Australia | Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft) | Exposure draft released 31 Aug 2026; consultation closed 18 Sep 2026; legislation expected by end 2026; would add a fair-and-reasonable test and an erasure right. Not law. | APP entities | Watch; plan erasure and purpose-limitation capability | Open source | proposal | Dated supplied research; confirm current instrument before relying on this deadline. | |
| TBD | United Arab Emirates | Federal PDPL executive regulations | Executive regulations not confirmed as issued; sources conflict. (Source check pending: UAE Data Office and Official Gazette) | Controllers and processors handling UAE personal data | Keep health data in the UAE under Federal Law 2/2019; design transfer controls to be configurable | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| TBD | United Kingdom | Data (Use and Access) Act 2025: remaining commencements | Main data-protection provisions and the transfer regime commenced 5 Feb 2026 (SI 2026/82); remaining provisions, including Information Commission governance changes, have no confirmed dates. (Source check pending: government commencement tracker) | UK controllers and processors | Track commencement regulations; no action beyond the 2026 changes | Open source | expected | Specific details await primary confirmation; see the linked source. | |
| TBD | EU Member States | NIS2 national transposition laws | Transposition deadline was 17 Oct 2024; counts of completed states differ by source (about 19 to 22 of 27 by Oct 2026). The Commission sent reasoned opinions to 19 states in May 2025 and, per secondary reports, referred four to the CJEU in July 2026. (Source check pending: current Commission count and referrals) | Essential and important entities and their suppliers | Check the national law and supervisory authority for each EU entity; expect supplier-security clauses in contracts | Open source | expected | Specific details await primary confirmation; see the linked source. |
General information, not legal advice. Read the supporting analysis.
Put this evaluation into practice.
Assess your deployment requirementsThis article is general information, not legal advice.
Further reading
- CDP tools and templates
- Customer data regulation guides
- Product architecture
- Deployment
- Security and ownership
Published: · Updated:
Publication date recorded for the approved release. Editorial updates do not establish legal approval or a customer result.