The dates that changed the rules and the ones about to. Marks flip automatically as deadlines pass.
Mar 21, 2025
Done
Mexico. New LFPDPPP in force; SABG replaces INAI as authority.
Mar 30, 2025
Done
Peru. Rewritten data protection regulation takes effect: cookies, biometrics, digital services.
Jun 1, 2025
Done
Malaysia. Breach notification and DPO appointment duties commence under the 2024 amendments.
Jun 19, 2025
Done
United Kingdom. Data (Use and Access) Act 2025 receives Royal Assent.
Jul 1, 2025
Done
Vietnam. Data Law (core and important data) enters into force.
Aug 14, 2025
Done
Israel. Amendment 13 in force: PPA fining powers, modern definitions, DPO duties.
Aug 23, 2025
Done
Brazil. ANPD deadline to adapt existing contracts to Brazilian SCCs passes.
Sep 14, 2025
Done
Nigeria. GAID 2025 general compliance date under the NDPA.
Nov 13, 2025
Done
India. DPDP Rules notified; the provisions establishing the Data Protection Board take effect and the phase clock starts.
Dec 31, 2025
Done
United States. Delaware cure period expires.
Jan 1, 2026
Done
Brunei. Substantive duties under the Personal Data Protection Order 2025 take effect.
Jan 1, 2026
Done
United States. Indiana, Kentucky and Rhode Island laws effective; California's ADMT, risk-assessment and cyber-audit regulations take effect with staged compliance; CA broker-deletion mechanics phase in.
Jan 1, 2026
Done
Vietnam. PDPL (Law 91/2025) and Decree 356/2025 in force.
Feb 5, 2026
Done
United Kingdom. Main DUAA data protection and PECR amendments commence (SI 2026/82).
Mar 17, 2026
Done
Brazil. ECA Digital in force: age assurance, parental tools and a ban on profiling-based advertising to minors.
Apr 1, 2026
Done
United States. Montana cure period sunsets.
Jun 19, 2026
Done
United Kingdom. Further DUAA provisions commence.
Jun 23, 2026
Done
Cameroon. Law No. 2024/017 takes full effect as its 18-month transition ends; the supervisory authority has not yet been created.
Jul 1, 2026
Done
United States. Connecticut, Utah and Arkansas changes effective: CTDPA scope expansion, Arkansas ACTOPPA for children and teens, Virginia ban on selling precise geolocation.
Jul 1, 2026
Done
Vietnam. New Cybersecurity Law in force.
Aug 1, 2026
Done
Turkey. Advertising regulation amendments in force: targeted ads must disclose their criteria, and profiling-based targeting of children is banned.
Aug 1, 2026
Done
United States. California Delete Act: data brokers must process DROP deletion requests; expanded broker registration applies.
Sep 11, 2026
Done
South Korea. PIPA amendment in force: fines up to 10% of total revenue for repeat, large-scale or order-defying violations.
Sep 27, 2026
Done
United States. California: the governor vetoed AB 1542 (sensitive-data sale and share ban) and signed SB 923 (deletion of data obtained from third parties) and AB 883 (data broker deletion mechanism), both effective January 1, 2027.
Sep 30, 2026
Ahead
United States. California signing deadline for the remaining privacy bills: SB 690 (CIPA pen-register reform) and AB 2561 (privacy settings).
Sep 30, 2026
Ahead
United Kingdom. The ICO becomes the Information Commission, a board-led body under the Data (Use and Access) Act 2025; its functions and the ICO name in daily use are unchanged.
Oct 1, 2026
Ahead
United States. Connecticut SB 4 takes effect: ban on selling precise geolocation data and facial recognition transparency duties, with a surveillance pricing ban the same day.
Nov 2, 2026
Ahead
Egypt. The one-year grace period under the PDPL Executive Regulation runs out around this date; licences, including for direct electronic marketing and cross-border transfers, become enforceable.
Nov 13, 2026
Ahead
India. DPDP phase two: consent-manager provisions take effect, and managers can register with the Data Protection Board.
Nov 30, 2026
Ahead
Peru. Medium-sized companies must have appointed a data protection officer under the 2025 regulation; small and micro companies follow in 2027 and 2028.
Dec 1, 2026
Ahead
Chile. Law 21.719's legal start date for new rights, duties, the agency and turnover-linked fines, unless the pending bill moving it to December 1, 2027 passes first.
Dec 10, 2026
Ahead
Australia. Deadline to register the Children's Online Privacy Code; privacy policies must start disclosing automated decisions that significantly affect individuals.
Dec 31, 2026
Ahead
European Union. Earliest realistic window for Digital Omnibus data-package adoption; watch trilogue outcomes.
Jan 1, 2027
Ahead
United States. Louisiana and Oklahoma comprehensive laws take effect; Connecticut data broker registration begins; California's signed 2026 privacy bills and the CCPA automated decision-making rights become operative.
Jan 17, 2027
Ahead
Japan. Stronger criminal penalties and a new improper-acquisition offense from the 2026 APPI amendment take effect.
May 1, 2027
Ahead
United States. Alabama's comprehensive law takes effect.
May 13, 2027
Ahead
India. DPDP phase three: notice, consent, rights, security, breach reporting and children's rules apply, along with the Board's enforcement powers and penalties up to INR 250 crore.
Jan 1, 2028
Ahead
United States. Vermont's comprehensive law takes effect.
Jul 17, 2028
Ahead
Japan. Latest date for the rest of the 2026 APPI amendment (exact date by Cabinet Order): administrative surcharges, AI and statistics consent exceptions, and biometric and under-16 rules.
Two dates carry the most weight for advertisers. January 1, 2027 brings Louisiana and Oklahoma online, activates California's automated decision-making rights, and starts the bills Sacramento signed in September, SB 923's third-party deletion duty among them. May 13, 2027 is when India's DPDP duties and penalties finally apply to the world's second-largest online population. Chile's December 1, 2026 start is the date most likely to move, with a bill pending to push it to December 2027.
Cite this page: "The Global Privacy Compliance Calendar." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/calendar.html. Accessed [date].