{ "name": "Identity Compliance Calendar 2026-2028", "publisher": "Start with Identity", "url": "https://startwithidentity.com/regulations/calendar/", "ics": "https://startwithidentity.com/regulations/calendar.ics", "license": "CC BY 4.0", "updated": "2026-10-31", "count": 76, "events": [ { "id": "2026-01-01-ccpa-admt-risk-audit-regulations-effective", "date": "2026-01-01", "precision": "day", "title": "CCPA: regulations on ADMT, risk assessments and cybersecurity audits take effect", "regulation": "CCPA/CPRA regulations (11 CCR 7000 et seq.)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": "ccpa-cpra", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Businesses subject to the California Consumer Privacy Act.", "what": "The CPPA regulations approved by the Office of Administrative Law on 22 September 2025 take effect, starting the clocks for risk assessments, ADMT duties and cybersecurity audits.", "status": "past", "source": { "title": "California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments and ADMT rulemaking", "url": "https://cppa.ca.gov/regulations/ccpa_updates.html" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-delete-act-drop-launch", "date": "2026-01-01", "precision": "day", "title": "California Delete Act: DROP opens to consumers", "regulation": "California Delete Act (SB 362)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)" ], "who": "Registered data brokers and California residents.", "what": "California residents can submit one deletion request to all registered data brokers through the Delete Request and Opt-out Platform (DROP).", "status": "past", "source": { "title": "CalPrivacy: Delete Request and Opt-out Platform (DROP) timeline", "url": "https://privacy.ca.gov/drop/" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-italy-nis-incident-reporting-starts", "date": "2026-01-01", "precision": "month", "title": "Italy NIS: significant-incident reporting obligation starts", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "applies", "identity_impact": [ "Breach notification" ], "who": "Entities registered as NIS entities with Italy's National Cybersecurity Agency (ACN).", "what": "ACN states that from January 2026 NIS entities must report significant incidents, including identity-driven compromises, under the national NIS framework.", "status": "past", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-kentucky-consumer-data-protection-act", "date": "2026-01-01", "precision": "day", "title": "Kentucky Consumer Data Protection Act takes effect", "regulation": "Kentucky Consumer Data Protection Act (2024 HB 15)", "jurisdiction": "United States (Kentucky)", "country_slug": "united-states", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Controllers and processors doing business in Kentucky that meet the Act's consumer thresholds.", "what": "Consent is required for sensitive data, including biometric data used to identify a person; data protection assessments and consumer rights apply, with a 30-day notice-and-cure before Attorney General action.", "status": "past", "source": { "title": "Kentucky General Assembly: 2024 Acts Chapter 72 (HB 15), Kentucky Consumer Data Protection Act", "url": "https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-oregon-cure-period-ends", "date": "2026-01-01", "precision": "day", "title": "Oregon Consumer Privacy Act: cure period ends for most controllers", "regulation": "Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589)", "jurisdiction": "United States (Oregon)", "country_slug": "united-states", "regulation_slug": "ocpa", "type": "enforcement", "identity_impact": [ "Customer identity & consent (CIAM)" ], "who": "Controllers subject to the Oregon Consumer Privacy Act (other than noncommercial educational broadcast stations).", "what": "From 1 January 2026 the Attorney General's 30-day notice-and-cure step applies only to noncommercial educational broadcast stations, and HB 2008 amendments banning the sale of precise geolocation data and data of consumers known to be under 16 take effect.", "status": "past", "source": { "title": "Oregon Legislature: ORS Chapter 646A", "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-rhode-island-data-privacy-act", "date": "2026-01-01", "precision": "day", "title": "Rhode Island Data Transparency and Privacy Protection Act takes effect", "regulation": "Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws 6-48.1)", "jurisdiction": "United States (Rhode Island)", "country_slug": "united-states", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Businesses that control or process personal data of Rhode Island customers above the Act's thresholds.", "what": "Consumer rights, sensitive data consent (including biometric data) and data protection assessments apply from 1 January 2026.", "status": "past", "source": { "title": "Rhode Island General Laws: Chapter 6-48.1, Data Transparency and Privacy Protection Act", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" }, "verified_on": "2026-10-31" }, { "id": "2026-01-01-vietnam-pdpl-effective", "date": "2026-01-01", "precision": "day", "title": "Vietnam Personal Data Protection Law takes effect", "regulation": "Law on Personal Data Protection No. 91/2025/QH15", "jurisdiction": "Vietnam", "country_slug": "vietnam", "regulation_slug": "vietnam-pdpl", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Data residency & cross-border transfer", "Breach notification" ], "who": "Organisations and individuals processing personal data of people in Vietnam, with a five-year option for small businesses and start-ups to defer certain obligations.", "what": "The law takes effect on 1 January 2026, setting consent, sensitive data (including biometric data), cross-border transfer and breach notification rules.", "status": "past", "source": { "title": "Official Gazette of Vietnam (Cong bao): Law on Personal Data Protection No. 91/2025/QH15", "url": "https://congbaocdn.chinhphu.vn/CongBaoCP/VanBan/2025/6/45578/57730-1-2025971-97291-2025-qh15.pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-01-09-japan-appi-reform-policy", "date": "2026-01-09", "precision": "day", "title": "Japan: PPC adopts APPI reform policy, including facial feature data rules", "regulation": "Act on the Protection of Personal Information (APPI)", "jurisdiction": "Japan", "country_slug": "japan", "regulation_slug": "appi", "type": "review", "identity_impact": [ "Identity verification (KYC/proofing)", "Customer identity & consent (CIAM)", "Breach notification" ], "who": "Businesses handling personal information in Japan, especially those using facial recognition.", "what": "The Personal Information Protection Commission decided its triennial review policy: disclosures and opt-out prohibitions for facial feature data, parental consent under 16, administrative monetary penalties and relaxed low-risk breach notices; it expects a bill as early as spring 2026, effective about two years after passage.", "status": "past", "source": { "title": "Personal Information Protection Commission, Japan: System Reform Policy under the Triennial Review of the APPI", "url": "https://www.ppc.go.jp/en/topix/triennial_review_2026_02/" }, "verified_on": "2026-10-31" }, { "id": "2026-01-20-nis2-targeted-amendments-proposed", "date": "2026-01-20", "precision": "day", "title": "NIS2: Commission proposes targeted amendments in new cybersecurity package", "regulation": "NIS2 Directive (Directive (EU) 2022/2555)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "nis2", "type": "consultation", "identity_impact": [ "Audit, logging & accountability" ], "who": "Essential and important entities under NIS2 and the national authorities that supervise them.", "what": "The Commission proposed targeted amendments to NIS2 to increase legal clarity as part of a new cybersecurity package; the proposal goes through the ordinary legislative procedure before any change applies.", "status": "past", "source": { "title": "European Commission: NIS2 Directive policy page", "url": "https://digital-strategy.ec.europa.eu/en/policies/nis2-directive" }, "verified_on": "2026-10-31" }, { "id": "2026-01-31-minnesota-cure-period-ends", "date": "2026-01-31", "precision": "day", "title": "Minnesota Consumer Data Privacy Act: cure period expires", "regulation": "Minnesota Consumer Data Privacy Act (Minn. Stat. 325M)", "jurisdiction": "United States (Minnesota)", "country_slug": "united-states", "regulation_slug": "mcdpa-minnesota", "type": "enforcement", "identity_impact": [ "Customer identity & consent (CIAM)" ], "who": "Controllers and processors subject to the Minnesota Consumer Data Privacy Act.", "what": "The 30-day warning-letter cure provision in section 325M.20 expires on 31 January 2026, so the Attorney General can bring enforcement actions without first offering a cure.", "status": "past", "source": { "title": "Minnesota Revisor of Statutes: section 325M.20", "url": "https://www.revisor.mn.gov/statutes/cite/325M.20" }, "verified_on": "2026-10-31" }, { "id": "2026-02-05-duaa-main-data-protection-commencement", "date": "2026-02-05", "precision": "day", "title": "UK Data (Use and Access) Act: main data protection changes commence", "regulation": "Data (Use and Access) Act 2025", "jurisdiction": "United Kingdom", "country_slug": "united-kingdom", "regulation_slug": "duaa-2025", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Controllers and processors subject to the UK GDPR, the Data Protection Act 2018 and PECR.", "what": "Commencement No. 6 Regulations bring most Part 5 changes into force, including recognised legitimate interests, revised automated decision-making rules with safeguards, subject access changes and new cookie exemptions.", "status": "past", "source": { "title": "GOV.UK: Data (Use and Access) Act 2025, plans for commencement", "url": "https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement" }, "verified_on": "2026-10-31" }, { "id": "2026-02-16-42-cfr-part-2-compliance", "date": "2026-02-16", "precision": "day", "title": "42 CFR Part 2 final rule: compliance date", "regulation": "Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Breach notification", "Customer identity & consent (CIAM)" ], "who": "Federally assisted substance use disorder programs and lawful holders of Part 2 records.", "what": "Part 2 programs must comply with the 2024 final rule, which aligns consent, breach notification and penalties with HIPAA.", "status": "past", "source": { "title": "Federal Register: Confidentiality of Substance Use Disorder Patient Records final rule (16 February 2024)", "url": "https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records" }, "verified_on": "2026-10-31" }, { "id": "2026-02-28-italy-nis-registration-2026", "date": "2026-02-28", "precision": "day", "title": "Italy NIS: annual registration window closes", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "deadline", "identity_impact": [ "Audit, logging & accountability" ], "who": "Entities in scope of Italy's NIS regime.", "what": "ACN runs the registration and renewal window for NIS entities each year from 1 January to 28 February.", "status": "past", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2026-03-31-australia-aml-ctf-reforms-commence", "date": "2026-03-31", "precision": "day", "title": "Australia AML/CTF reforms commence, including new customer due diligence rules", "regulation": "Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Existing AUSTRAC reporting entities such as banks, remitters and digital currency exchanges.", "what": "Schedules 1 to 3 commence on 31 March 2026, replacing the customer due diligence framework (initial and ongoing CDD, including identity verification) and expanding regulation to additional high-risk services.", "status": "past", "source": { "title": "Federal Register of Legislation: Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (as made)", "url": "https://www.legislation.gov.au/C2024A00110/asmade/2024-12-10/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-03-31-dora-register-of-information-2026", "date": "2026-03-31", "precision": "day", "title": "DORA: registers of information reported to the ESAs (2026 cycle)", "regulation": "DORA (Regulation (EU) 2022/2554)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "dora", "type": "reporting", "identity_impact": [ "Audit, logging & accountability", "Identity governance (IGA)" ], "who": "EU financial entities, through their national competent authorities, and the ICT third-party providers (including identity and access providers) listed in their registers.", "what": "Under the ESAs Decision, competent authorities submit the registers of information on ICT third-party arrangements to the ESAs by 31 March each year, with a reference date of 31 December of the prior year; financial entities must deliver their registers to their competent authority earlier, on national timelines.", "status": "past", "source": { "title": "ESAs Decision on reporting by competent authorities of information for CTPP designation (EIOPA)", "url": "https://www.eiopa.europa.eu/publications/esas-decision-reporting-competent-authorities-esas-information-necessary-designation-critical-ict_en" }, "verified_on": "2026-10-31" }, { "id": "2026-04-01-maryland-modpa-processing-applies", "date": "2026-04-01", "precision": "day", "title": "Maryland Online Data Privacy Act applies to processing activities", "regulation": "Maryland Online Data Privacy Act (2024 SB 541)", "jurisdiction": "United States (Maryland)", "country_slug": "united-states", "regulation_slug": "modpa", "type": "applies", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Controllers and processors subject to the Maryland Online Data Privacy Act.", "what": "The Act, in force since 1 October 2025, applies to personal data processing activities from 1 April 2026, including its strict necessity limits on collecting and processing sensitive data such as biometric data.", "status": "past", "source": { "title": "Maryland General Assembly: 2024 Laws of Maryland Chapter 455 (SB 541)", "url": "https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-04-15-nydfs-part-500-annual-notice-of-compliance-2026", "date": "2026-04-15", "precision": "day", "title": "NYDFS Part 500: annual certification of compliance or acknowledgment of noncompliance due (2026)", "regulation": "NYDFS 23 NYCRR Part 500", "jurisdiction": "United States (New York)", "country_slug": "united-states", "regulation_slug": "nydfs-part-500", "type": "reporting", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Banks, insurers and other entities licensed by the New York Department of Financial Services.", "what": "Section 500.17(b) requires each covered entity to submit electronically by April 15 a certification of material compliance for the prior calendar year, or an acknowledgment of noncompliance with a remediation timeline; universal MFA under section 500.12 has applied since 1 November 2025.", "status": "past", "source": { "title": "NYDFS: 23 NYCRR Part 500 (Cybersecurity Requirements for Financial Services Companies)", "url": "https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500" }, "verified_on": "2026-10-31" }, { "id": "2026-04-22-coppa-rule-amendments-compliance", "date": "2026-04-22", "precision": "day", "title": "FTC COPPA Rule amendments: compliance date", "regulation": "COPPA Rule (16 CFR Part 312)", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": "coppa", "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)", "Customer identity & consent (CIAM)" ], "who": "Operators of websites and online services directed to children under 13, or with actual knowledge they collect children's personal information.", "what": "Regulated entities must comply with the amended Rule, which updates verifiable parental consent methods (including knowledge-based and government ID with facial match methods), adds biometric identifiers to personal information, and requires a written information security program.", "status": "past", "source": { "title": "Federal Register: Children's Online Privacy Protection Rule final rule (22 April 2025)", "url": "https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule" }, "verified_on": "2026-10-31" }, { "id": "2026-05-21-eidas-commission-review-report", "date": "2026-05-21", "precision": "day", "title": "eIDAS 2: Commission review report due", "regulation": "eIDAS 2 (Regulation (EU) 2024/1183)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eidas-2", "type": "review", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "The European Commission.", "what": "Article 49 requires the Commission to review the application of the Regulation and report to Parliament and Council, including whether to modify its scope. The same date is set for assessing reference standards for advanced electronic signatures and seals.", "status": "past", "source": { "title": "Regulation (EU) 2024/1183 (European Digital Identity Framework), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1183" }, "verified_on": "2026-10-31" }, { "id": "2026-05-21-eidas-qtsp-conformity-reports", "date": "2026-05-21", "precision": "day", "title": "eIDAS 2: legacy qualified trust service providers file conformity assessment reports", "regulation": "eIDAS 2 (Regulation (EU) 2024/1183)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eidas-2", "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "Qualified trust service providers granted qualified status before 20 May 2024.", "what": "Must submit a conformity assessment report to their supervisory body proving compliance with the revised Article 24 rules, which govern how identity is verified before a qualified certificate or attestation is issued.", "status": "past", "source": { "title": "Regulation (EU) 2024/1183 (European Digital Identity Framework), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1183" }, "verified_on": "2026-10-31" }, { "id": "2026-05-31-italy-nis-annual-update-2026", "date": "2026-05-31", "precision": "day", "title": "Italy NIS: annual information update due", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "reporting", "identity_impact": [ "Audit, logging & accountability" ], "who": "Registered NIS entities in Italy.", "what": "NIS entities must update their information on the ACN platform by 31 May each year.", "status": "past", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2026-06-03-regulation-s-p-smaller-entities", "date": "2026-06-03", "precision": "day", "title": "SEC Regulation S-P amendments: compliance date for smaller entities", "regulation": "SEC Regulation S-P", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Breach notification", "Audit, logging & accountability" ], "who": "Smaller broker-dealers, investment companies, registered investment advisers and transfer agents (larger entities had to comply six months earlier).", "what": "Covered institutions must have an incident response program and notify affected individuals within 30 days when sensitive customer information is, or is reasonably likely to have been, accessed or used without authorization; the compliance period is 24 months after Federal Register publication on 3 June 2024.", "status": "past", "source": { "title": "Federal Register: Regulation S-P final rule (89 FR 47688, 3 June 2024)", "url": "https://www.federalregister.gov/documents/2024/06/03/2024-11116/regulation-s-p-privacy-of-consumer-financial-information-and-safeguarding-customer-information" }, "verified_on": "2026-10-31" }, { "id": "2026-06-09-uk-dvs-trust-framework-1-0", "date": "2026-06-09", "precision": "day", "title": "UK digital verification services trust framework 1.0 published as the current certifiable version", "regulation": "Data (Use and Access) Act 2025, Part 2", "jurisdiction": "United Kingdom", "country_slug": "united-kingdom", "regulation_slug": "duaa-2025", "type": "applies", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Identity service providers and attribute service providers certifying against the UK digital verification services trust framework, and the conformity assessment bodies that certify them.", "what": "The Office for Digital Identities and Attributes published trust framework 1.0 and updated which versions are current and which have expired; providers should read section 0 of the latest version to see which versions they can certify against.", "status": "past", "source": { "title": "GOV.UK: UK digital verification services trust framework collection (OfDIA)", "url": "https://www.gov.uk/government/collections/uk-digital-identity-and-attributes-trust-framework" }, "verified_on": "2026-10-31" }, { "id": "2026-06-11-cra-conformity-assessment-bodies", "date": "2026-06-11", "precision": "day", "title": "Cyber Resilience Act: rules on conformity assessment bodies apply", "regulation": "Cyber Resilience Act (Regulation (EU) 2024/2847)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "cyber-resilience-act", "type": "phase-in", "identity_impact": [ "Audit, logging & accountability" ], "who": "Notifying authorities and conformity assessment bodies that will certify important and critical products, including identity management and privileged access products.", "what": "Chapter IV (Articles 35 to 51) on notification of conformity assessment bodies applies, so third-party assessors can be in place before the main obligations start.", "status": "past", "source": { "title": "Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R2847" }, "verified_on": "2026-10-31" }, { "id": "2026-06-19-duaa-complaints-process", "date": "2026-06-19", "precision": "day", "title": "UK Data (Use and Access) Act: controllers must run a data protection complaints process", "regulation": "Data (Use and Access) Act 2025", "jurisdiction": "United Kingdom", "country_slug": "united-kingdom", "regulation_slug": "duaa-2025", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Controllers subject to the UK GDPR and the Data Protection Act 2018.", "what": "Section 103 is in force from 19 June 2026 (S.I. 2026/82): data subjects can complain to the controller, which must facilitate complaints, acknowledge them within 30 days and respond without undue delay.", "status": "past", "source": { "title": "legislation.gov.uk: Data (Use and Access) Act 2025, section 103", "url": "https://www.legislation.gov.uk/ukpga/2025/18/section/103" }, "verified_on": "2026-10-31" }, { "id": "2026-07-01-australia-aml-ctf-tranche-2", "date": "2026-07-01", "precision": "day", "title": "Australia AML/CTF: obligations apply to tranche 2 professions", "regulation": "Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": null, "type": "applies", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Providers of the newly regulated designated services (item 2 of table 2 and tables 5 and 6 in section 6 of the AML/CTF Act), which the reforms extend to sectors such as real estate, dealers in precious metals and stones, and professional services.", "what": "The transitional provisions delay AML/CTF program, customer due diligence and reporting obligations for these services until 1 July 2026, from which they must identify and verify customers.", "status": "past", "source": { "title": "Federal Register of Legislation: Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (as made)", "url": "https://www.legislation.gov.au/C2024A00110/asmade/2024-12-10/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-07-01-connecticut-ctdpa-amendments", "date": "2026-07-01", "precision": "day", "title": "Connecticut Data Privacy Act amendments take effect", "regulation": "Connecticut Data Privacy Act as amended by Public Act 25-113", "jurisdiction": "United States (Connecticut)", "country_slug": "united-states", "regulation_slug": "ctdpa", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Persons doing business in Connecticut, now including any controller that processes sensitive data, regardless of volume.", "what": "Public Act 25-113 expands applicability, widens the definition of sensitive data, revises minors' protections and requires impact assessments for certain profiling, all effective 1 July 2026.", "status": "past", "source": { "title": "Connecticut General Assembly OLR: Public Act 25-113 summary (SB 1295)", "url": "https://www.cga.ct.gov/2025/SUM/PDF/2025SUM00113-R02SB-01295-SUM.PDF" }, "verified_on": "2026-10-31" }, { "id": "2026-07-10-amld6-beneficial-ownership-access", "date": "2026-07-10", "precision": "day", "title": "AMLD6: transposition deadline for beneficial ownership register access rules", "regulation": "Sixth AML Directive (Directive (EU) 2024/1640)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "EU Member States and the obliged entities and authorities that query central beneficial ownership registers.", "what": "Member States must bring into force Articles 11, 12, 13 and 15 (access to beneficial ownership information, including legitimate-interest access) by 10 July 2026, and notify the Commission of the authorities entitled to consult the registers.", "status": "past", "source": { "title": "Directive (EU) 2024/1640 (sixth AML Directive), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024L1640" }, "verified_on": "2026-10-31" }, { "id": "2026-07-27-ai-act-digital-omnibus-in-force", "date": "2026-07-27", "precision": "day", "title": "AI Act: Digital Omnibus on AI in force, high-risk dates deferred", "regulation": "EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eu-ai-act", "type": "in-force", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "Providers and deployers of AI systems, including biometric identification and categorisation systems.", "what": "Regulation (EU) 2026/1744 amends the AI Act: high-risk obligations for Annex III systems (including biometrics) move to 2 December 2027 and for Annex I systems to 2 August 2028, and the penalty provisions in Articles 102 to 110 apply from 27 July 2026.", "status": "past", "source": { "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32026R1744" }, "verified_on": "2026-10-31" }, { "id": "2026-08-01-delete-act-drop-processing", "date": "2026-08-01", "precision": "day", "title": "California Delete Act: data brokers must process DROP deletion requests", "regulation": "California Delete Act (SB 362)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Data brokers registered in California.", "what": "Beginning 1 August 2026, data brokers must access DROP at least once every 45 days and process consumer deletion requests, subject to limited exceptions.", "status": "past", "source": { "title": "California Privacy Protection Agency: data brokers and DROP", "url": "https://cppa.ca.gov/data_brokers/" }, "verified_on": "2026-10-31" }, { "id": "2026-08-02-ai-act-general-application", "date": "2026-08-02", "precision": "day", "title": "AI Act: general application, including transparency for biometric categorisation and emotion recognition", "regulation": "EU AI Act (Regulation (EU) 2024/1689)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eu-ai-act", "type": "applies", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Deployers of emotion recognition or biometric categorisation systems and providers of AI systems that interact with people or generate synthetic content.", "what": "The AI Act applies generally, including Article 50: deployers of biometric categorisation or emotion recognition systems must inform the people exposed to them, and chatbots and synthetic content must be disclosed.", "status": "past", "source": { "title": "Regulation (EU) 2024/1689 (AI Act), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1689" }, "verified_on": "2026-10-31" }, { "id": "2026-09-11-cra-vulnerability-incident-reporting", "date": "2026-09-11", "precision": "day", "title": "Cyber Resilience Act: manufacturers must report exploited vulnerabilities and severe incidents", "regulation": "Cyber Resilience Act (Regulation (EU) 2024/2847)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "cyber-resilience-act", "type": "reporting", "identity_impact": [ "Breach notification", "Authentication & MFA", "Privileged access (PAM)" ], "who": "Manufacturers of products with digital elements sold in the EU, including identity management systems, privileged access management software and hardware, and biometric readers (Annex III, Class I).", "what": "Article 14 applies: actively exploited vulnerabilities and severe incidents must be notified through the single reporting platform with an early warning within 24 hours of the manufacturer becoming aware.", "status": "past", "source": { "title": "Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R2847" }, "verified_on": "2026-10-31" }, { "id": "2026-09-30-uk-information-commission", "date": "2026-09-30", "precision": "day", "title": "UK: Information Commission replaces the Information Commissioner", "regulation": "Data (Use and Access) Act 2025", "jurisdiction": "United Kingdom", "country_slug": "united-kingdom", "regulation_slug": "duaa-2025", "type": "in-force", "identity_impact": [ "Audit, logging & accountability" ], "who": "All organisations regulated by the UK data protection regulator.", "what": "Commencement No. 9 Regulations abolish the office of the Information Commissioner and transfer its functions to the board-led Information Commission from 30 September 2026; enforcement powers carry over.", "status": "past", "source": { "title": "GOV.UK: Data (Use and Access) Act 2025, plans for commencement", "url": "https://www.gov.uk/guidance/data-use-and-access-act-2025-plans-for-commencement" }, "verified_on": "2026-10-31" }, { "id": "2026-10-01-italy-nis-security-measures", "date": "2026-10-01", "precision": "month", "title": "Italy NIS: basic security measures must be in place", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "deadline", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Identity governance (IGA)" ], "who": "Registered NIS entities in Italy.", "what": "ACN states that NIS entities must have implemented the required basic security measures by October 2026, covering risk management, supply chain security and business continuity among other areas.", "status": "past", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2026-11-01-india-dpdp-consent-managers", "date": "2026-11-01", "precision": "month", "title": "India DPDP Rules: Consent Manager provisions commence", "regulation": "Digital Personal Data Protection Act 2023 and DPDP Rules 2025", "jurisdiction": "India", "country_slug": "india", "regulation_slug": "dpdp-act", "type": "phase-in", "identity_impact": [ "Customer identity & consent (CIAM)" ], "who": "Companies seeking registration as Consent Managers with the Data Protection Board, and Data Fiduciaries that will integrate with them.", "what": "Rule 4 (registration and obligations of Consent Managers) comes into force one year after the Rules were published in the Gazette on 13 November 2025, in November 2026.", "status": "confirmed", "source": { "title": "Gazette of India: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025)", "url": "https://egazette.gov.in/WriteReadData/2025/267650.pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-11-10-cmmc-phase-2", "date": "2026-11-10", "precision": "day", "title": "CMMC Phase 2: Level 2 third-party (C3PAO) certification in DoD contracts", "regulation": "Cybersecurity Maturity Model Certification (32 CFR Part 170)", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": null, "type": "phase-in", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Defense contractors and subcontractors that handle Federal Contract Information or Controlled Unclassified Information.", "what": "Phase 2 begins one calendar year after Phase 1 (which started when the DFARS CMMC rule took effect on 10 November 2025): DoD intends to require CMMC Level 2 (C3PAO) status, which covers NIST SP 800-171 controls including multifactor authentication and least privilege, for applicable contracts.", "status": "confirmed", "source": { "title": "eCFR: 32 CFR 170.3, CMMC applicability and phased implementation", "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.3" }, "verified_on": "2026-10-31" }, { "id": "2026-11-30-australia-digital-id-act-review", "date": "2026-11-30", "precision": "day", "title": "Australia Digital ID Act: statutory review of the Act due", "regulation": "Digital ID Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": null, "type": "review", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "The responsible Minister, with impacts on accredited digital ID providers and relying parties.", "what": "Section 162 requires a review of the Act's operation no later than 2 years after its commencement on 30 November 2024.", "status": "confirmed", "source": { "title": "Federal Register of Legislation: Digital ID Act 2024 (Compilation No. 1)", "url": "https://www.legislation.gov.au/C2024A00025/2024-12-11/2024-12-11/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-12-01-australia-agdis-private-sector-participation", "date": "2026-12-01", "precision": "day", "title": "Australian Government Digital ID System: private sector entities can apply to participate", "regulation": "Digital ID Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": null, "type": "phase-in", "identity_impact": [ "Identity verification (KYC/proofing)", "Authentication & MFA" ], "who": "Accredited digital ID providers and private sector relying parties (Australian entities and registered foreign companies).", "what": "Section 62 allows these entities to apply to participate in the Australian Government Digital ID System when the application is made more than 2 years after the Act commenced on 30 November 2024; participation still requires approval by the Digital ID Regulator.", "status": "confirmed", "source": { "title": "Federal Register of Legislation: Digital ID Act 2024 (Compilation No. 1)", "url": "https://www.legislation.gov.au/C2024A00025/2024-12-11/2024-12-11/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-12-01-australia-childrens-online-privacy-code", "date": "2026-12-01", "precision": "month", "title": "Australia: Children's Online Privacy Code must be registered", "regulation": "Privacy Act 1988 as amended by the Privacy and Other Legislation Amendment Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": "privacy-act-1988", "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)", "Customer identity & consent (CIAM)" ], "who": "Social media, online services and apps likely to be accessed by children, and the OAIC.", "what": "The Information Commissioner must develop and register the Children's Online Privacy Code within 24 months of Royal Assent on 10 December 2024, so by December 2026; the code will set how covered services handle children's personal information.", "status": "confirmed", "source": { "title": "Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024 (as made)", "url": "https://www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-12-02-ai-act-new-prohibitions-and-legacy-marking", "date": "2026-12-02", "precision": "day", "title": "AI Act: new prohibitions on non-consensual intimate deepfakes and marking deadline for legacy generators", "regulation": "EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eu-ai-act", "type": "applies", "identity_impact": [ "Identity verification (KYC/proofing)", "Customer identity & consent (CIAM)" ], "who": "Providers and deployers of generative AI systems, and identity verification teams that rely on detecting synthetic media.", "what": "New Article 5(1)(ba) and (bb) prohibitions on AI that generates intimate imagery of an identifiable person without consent apply, and generators placed on the market before 2 August 2026 must comply with the Article 50(2) machine-readable marking duty.", "status": "confirmed", "source": { "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32026R1744" }, "verified_on": "2026-10-31" }, { "id": "2026-12-10-australia-automated-decisions-transparency", "date": "2026-12-10", "precision": "day", "title": "Australia Privacy Act: privacy policies must disclose automated decisions", "regulation": "Privacy Act 1988 as amended by the Privacy and Other Legislation Amendment Act 2024", "jurisdiction": "Australia", "country_slug": "australia", "regulation_slug": "privacy-act-1988", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "APP entities that use computer programs to make, or substantially make, decisions using personal information that could significantly affect individuals.", "what": "Schedule 1, Part 15 commences on 10 December 2026: privacy policies must describe the kinds of personal information used and the kinds of decisions made by such programs, which can include automated identity verification or fraud decisions that deny a service.", "status": "confirmed", "source": { "title": "Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024 (as made)", "url": "https://www.legislation.gov.au/C2024A00128/asmade/2024-12-10/text/original/pdf" }, "verified_on": "2026-10-31" }, { "id": "2026-12-24-eidas-authentic-source-attribute-verification", "date": "2026-12-24", "precision": "day", "title": "eIDAS 2: attributes from public authentic sources must be verifiable by trust service providers", "regulation": "eIDAS 2 (Regulation (EU) 2024/1183)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eidas-2", "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "EU Member States and the public bodies that hold authentic sources for the attributes listed in Annex VI (such as address, age, qualifications and licences).", "what": "Article 45e requires Member States to ensure, within the same 24-month window as the wallet, that qualified trust service providers can verify Annex VI attributes electronically against authentic sources, enabling qualified electronic attestations of attributes.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/1183 (European Digital Identity Framework), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1183" }, "verified_on": "2026-10-31" }, { "id": "2026-12-24-eudi-wallet-availability", "date": "2026-12-24", "precision": "day", "title": "EU Digital Identity Wallet: every Member State must offer at least one wallet", "regulation": "eIDAS 2 (Regulation (EU) 2024/1183)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eidas-2", "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)", "Authentication & MFA", "Customer identity & consent (CIAM)" ], "who": "All 27 EU Member States, and the relying parties and identity teams preparing to accept the wallets.", "what": "Article 5a(1) requires each Member State to provide at least one European Digital Identity Wallet within 24 months of the wallet implementing acts entering into force; those acts (including Implementing Regulation (EU) 2024/2977) were published on 4 December 2024 and entered into force 20 days later, which sets the deadline at 24 December 2026.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/1183 (European Digital Identity Framework), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1183" }, "verified_on": "2026-10-31" }, { "id": "2027-01-01-ccpa-admt-compliance", "date": "2027-01-01", "precision": "day", "title": "CCPA: automated decisionmaking technology rules apply", "regulation": "CCPA/CPRA regulations (11 CCR 7000 et seq.)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": "ccpa-cpra", "type": "phase-in", "identity_impact": [ "Customer identity & consent (CIAM)", "Identity verification (KYC/proofing)" ], "who": "Businesses that use automated decisionmaking technology to make significant decisions about consumers, for example in financial services, housing, employment or access to essential goods and services.", "what": "Businesses already using ADMT for significant decisions must comply by 1 January 2027: pre-use notice, opt-out (or an exception) and access rights covering how the ADMT, including identity or fraud scoring used in such decisions, affects the consumer.", "status": "confirmed", "source": { "title": "California Privacy Protection Agency: approved text of CCPA updates, cybersecurity audit, risk assessment and ADMT regulations", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf" }, "verified_on": "2026-10-31" }, { "id": "2027-01-01-colorado-admt-act", "date": "2027-01-01", "precision": "day", "title": "Colorado automated decision-making technology law takes effect", "regulation": "Colorado SB 26-189 (Automated Decision-Making Technology law)", "jurisdiction": "United States (Colorado)", "country_slug": "united-states", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Developers and deployers of automated decision-making technology used in consequential decisions about Colorado consumers.", "what": "SB 26-189 repeals and reenacts the Colorado AI Act provisions with new ADMT requirements, including a consumer right to request and correct inaccurate personal data used by ADMT; the Attorney General is to adopt implementing rules before this date.", "status": "confirmed", "source": { "title": "Colorado Attorney General: Automated Decision-Making Technology and AI laws", "url": "https://coag.gov/ai/" }, "verified_on": "2026-10-31" }, { "id": "2027-01-01-delaware-dpdpa-amendments", "date": "2027-01-01", "precision": "day", "title": "Delaware Personal Data Privacy Act amendments take effect (lower thresholds, broader sensitive data)", "regulation": "Delaware Personal Data Privacy Act as amended by 85 Del. Laws c. 463", "jurisdiction": "United States (Delaware)", "country_slug": "united-states", "regulation_slug": "dpdpa-delaware", "type": "in-force", "identity_impact": [ "Customer identity & consent (CIAM)", "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "Persons conducting business in Delaware or targeting Delaware residents.", "what": "Amended applicability thresholds and definitions take effect, expanding sensitive data (which requires consent) and assessment duties.", "status": "confirmed", "source": { "title": "Delaware Code: Title 6, Chapter 12D, Delaware Personal Data Privacy Act", "url": "https://delcode.delaware.gov/title6/c012d/index.html" }, "verified_on": "2026-10-31" }, { "id": "2027-01-01-switzerland-trust-infrastructure-operational", "date": "2027-01-01", "precision": "year", "title": "Switzerland: e-ID trust infrastructure expected to become operational (first half of 2027)", "regulation": "Federal Act on Electronic Identity and Other Electronic Credentials (E-ID Act)", "jurisdiction": "Switzerland", "country_slug": "switzerland", "regulation_slug": null, "type": "in-force", "identity_impact": [ "Identity verification (KYC/proofing)", "Authentication & MFA" ], "who": "Swiss authorities and private relying parties planning to issue or verify credentials in the swiyu ecosystem.", "what": "The Federal Office of Justice expects the trust infrastructure to become operational in the first half of 2027, with the E-ID Act enacted at least in part from that date; the state e-ID itself has no fixed launch date as security work takes priority.", "status": "expected", "source": { "title": "Swiss Federal Office of Justice: New timeline for the introduction of the e-ID and the trust infrastructure", "url": "https://www.eid.admin.ch/en/20260625-neuer-zeitplan-fuer-die-einfuehrung-der-e-id-und-der-vertrauensinfrastruktur-en" }, "verified_on": "2026-10-31" }, { "id": "2027-01-09-instant-payments-non-euro-receive", "date": "2027-01-09", "precision": "day", "title": "Instant Payments Regulation: non-euro-area PSPs must receive instant euro transfers", "regulation": "Instant Payments Regulation (Regulation (EU) 2024/886)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Payment service providers located in EU Member States whose currency is not the euro.", "what": "These PSPs must offer receipt of instant euro credit transfers and apply the pricing rules by 9 January 2027, with the sending service and payee verification following on 9 July 2027.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/886 (Instant Payments Regulation), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R0886" }, "verified_on": "2026-10-31" }, { "id": "2027-02-28-italy-nis-registration-2027", "date": "2027-02-28", "precision": "day", "title": "Italy NIS: annual registration window closes", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "deadline", "identity_impact": [ "Audit, logging & accountability" ], "who": "Entities in scope of Italy's NIS regime.", "what": "The yearly registration and renewal window on the ACN platform runs from 1 January to 28 February.", "status": "confirmed", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2027-03-31-dora-register-of-information-2027", "date": "2027-03-31", "precision": "day", "title": "DORA: registers of information reported to the ESAs (2027 cycle)", "regulation": "DORA (Regulation (EU) 2022/2554)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "dora", "type": "reporting", "identity_impact": [ "Audit, logging & accountability", "Identity governance (IGA)" ], "who": "EU financial entities, through their national competent authorities, and the ICT third-party providers (including identity and access providers) listed in their registers.", "what": "Under the ESAs Decision, competent authorities submit the registers of information on ICT third-party arrangements to the ESAs by 31 March each year, with a reference date of 31 December of the prior year; financial entities must deliver their registers to their competent authority earlier, on national timelines.", "status": "confirmed", "source": { "title": "ESAs Decision on reporting by competent authorities of information for CTPP designation (EIOPA)", "url": "https://www.eiopa.europa.eu/publications/esas-decision-reporting-competent-authorities-esas-information-necessary-designation-critical-ict_en" }, "verified_on": "2026-10-31" }, { "id": "2027-04-01-maryland-modpa-cure-period-ends", "date": "2027-04-01", "precision": "day", "title": "Maryland Online Data Privacy Act: discretionary cure period ends", "regulation": "Maryland Online Data Privacy Act (2024 SB 541)", "jurisdiction": "United States (Maryland)", "country_slug": "united-states", "regulation_slug": "modpa", "type": "enforcement", "identity_impact": [ "Customer identity & consent (CIAM)" ], "who": "Controllers and processors subject to the Maryland Online Data Privacy Act.", "what": "Section 14-4714 lets the Consumer Protection Division offer at least 60 days to cure only for violations occurring on or before 1 April 2027; later violations can go straight to enforcement.", "status": "confirmed", "source": { "title": "Maryland General Assembly: Commercial Law section 14-4714", "url": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4714&enactments=false" }, "verified_on": "2026-10-31" }, { "id": "2027-04-15-nydfs-part-500-annual-notice-of-compliance-2027", "date": "2027-04-15", "precision": "day", "title": "NYDFS Part 500: annual certification of compliance or acknowledgment of noncompliance due (2027)", "regulation": "NYDFS 23 NYCRR Part 500", "jurisdiction": "United States (New York)", "country_slug": "united-states", "regulation_slug": "nydfs-part-500", "type": "reporting", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Banks, insurers and other entities licensed by the New York Department of Financial Services.", "what": "Section 500.17(b) requires each covered entity to submit electronically by April 15 a certification of material compliance for the prior calendar year, or an acknowledgment of noncompliance with a remediation timeline; universal MFA under section 500.12 has applied since 1 November 2025.", "status": "confirmed", "source": { "title": "NYDFS: 23 NYCRR Part 500 (Cybersecurity Requirements for Financial Services Companies)", "url": "https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500" }, "verified_on": "2026-10-31" }, { "id": "2027-04-17-nis2-entity-list-review", "date": "2027-04-17", "precision": "day", "title": "NIS2: Member States review entity lists and notify the Commission", "regulation": "NIS2 Directive (Directive (EU) 2022/2555)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "nis2", "type": "reporting", "identity_impact": [ "Audit, logging & accountability" ], "who": "EU Member States and their NIS2 competent authorities; in-scope entities may be asked to refresh their registration data.", "what": "Article 3 requires the list of essential and important entities to be reviewed at least every two years after 17 April 2025, and competent authorities to notify the Commission of entity numbers by 17 April 2025 and every two years thereafter.", "status": "confirmed", "source": { "title": "Directive (EU) 2022/2555 (NIS2), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32022L2555" }, "verified_on": "2026-10-31" }, { "id": "2027-05-01-india-dpdp-full-obligations", "date": "2027-05-01", "precision": "month", "title": "India DPDP Rules: core Data Fiduciary obligations apply", "regulation": "Digital Personal Data Protection Act 2023 and DPDP Rules 2025", "jurisdiction": "India", "country_slug": "india", "regulation_slug": "dpdp-act", "type": "applies", "identity_impact": [ "Customer identity & consent (CIAM)", "Breach notification", "Authentication & MFA", "Audit, logging & accountability" ], "who": "All Data Fiduciaries processing digital personal data in India, with added duties for Significant Data Fiduciaries.", "what": "Rules 3 and 5 to 16, 22 and 23 come into force eighteen months after the 13 November 2025 publication, in May 2027: notice, verifiable consent (including for children), reasonable security safeguards such as access control and logging, one-year log retention and personal data breach notification.", "status": "confirmed", "source": { "title": "Gazette of India: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025)", "url": "https://egazette.gov.in/WriteReadData/2025/267650.pdf" }, "verified_on": "2026-10-31" }, { "id": "2027-05-31-italy-nis-annual-update-2027", "date": "2027-05-31", "precision": "day", "title": "Italy NIS: annual information update due", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "reporting", "identity_impact": [ "Audit, logging & accountability" ], "who": "Registered NIS entities in Italy.", "what": "NIS entities must update their information on the ACN platform by 31 May each year.", "status": "confirmed", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2027-07-01-amla-first-direct-supervision-selection", "date": "2027-07-01", "precision": "day", "title": "AMLA: first selection of directly supervised entities must start", "regulation": "AMLA Regulation (Regulation (EU) 2024/1620)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "phase-in", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Cross-border credit and financial institutions with high ML/TF risk profiles that may be selected for direct supervision by the EU Anti-Money Laundering Authority.", "what": "Article 13 requires AMLA to commence the first selection process by 1 July 2027 and conclude it within six months.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/1620 (AMLA Regulation), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1620" }, "verified_on": "2026-10-31" }, { "id": "2027-07-09-instant-payments-non-euro-verification-of-payee", "date": "2027-07-09", "precision": "day", "title": "Instant Payments Regulation: verification of payee required for non-euro-area PSPs", "regulation": "Instant Payments Regulation (Regulation (EU) 2024/886)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "Payment service providers located in EU Member States whose currency is not the euro.", "what": "Article 5c requires a payer's PSP to check the payee's name against the account identifier before a euro credit transfer is authorised, and PSPs must offer sending of instant euro transfers by this date.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/886 (Instant Payments Regulation), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R0886" }, "verified_on": "2026-10-31" }, { "id": "2027-07-10-amld6-transposition", "date": "2027-07-10", "precision": "day", "title": "AMLD6: general transposition deadline", "regulation": "Sixth AML Directive (Directive (EU) 2024/1640)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Identity verification (KYC/proofing)" ], "who": "EU Member States and the supervisors, FIUs and register operators that support customer due diligence.", "what": "Member States must bring into force the laws needed to comply with the Directive, covering beneficial ownership registers, bank account registers and supervision.", "status": "confirmed", "source": { "title": "Directive (EU) 2024/1640 (sixth AML Directive), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024L1640" }, "verified_on": "2026-10-31" }, { "id": "2027-07-10-amlr-applies", "date": "2027-07-10", "precision": "day", "title": "EU AML Regulation applies: single rulebook for customer due diligence", "regulation": "AML Regulation (Regulation (EU) 2024/1624)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "applies", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "Obliged entities across the EU, including banks, payment and e-money institutions, crypto-asset service providers and other financial and non-financial firms (football agents and clubs from 10 July 2029).", "what": "Directly applicable customer due diligence rules replace national AMLD transpositions: identification and verification of customers and beneficial owners, including remote onboarding using eIDAS electronic identification means, plus record-keeping duties.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/1624 (AML Regulation), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1624" }, "verified_on": "2026-10-31" }, { "id": "2027-10-17-nis2-commission-review", "date": "2027-10-17", "precision": "day", "title": "NIS2: first Commission review of the Directive", "regulation": "NIS2 Directive (Directive (EU) 2022/2555)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "nis2", "type": "review", "identity_impact": [ "Authentication & MFA", "Audit, logging & accountability" ], "who": "The European Commission, with knock-on effects for all NIS2 entities.", "what": "Article 40 requires the Commission to review the functioning of NIS2 by 17 October 2027 and every 36 months thereafter, assessing among other things the size-cap and sector scope, and to report to Parliament and Council.", "status": "confirmed", "source": { "title": "Directive (EU) 2022/2555 (NIS2), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32022L2555" }, "verified_on": "2026-10-31" }, { "id": "2027-11-10-cmmc-phase-3", "date": "2027-11-10", "precision": "day", "title": "CMMC Phase 3: Level 2 (C3PAO) for all applicable contracts and Level 3 introduced", "regulation": "Cybersecurity Maturity Model Certification (32 CFR Part 170)", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": null, "type": "phase-in", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Defense contractors and subcontractors handling Controlled Unclassified Information.", "what": "Phase 3 begins one calendar year after Phase 2: DoD intends to require Level 2 (C3PAO) for all applicable solicitations and contracts as a condition of award, and Level 3 (DIBCAC) where applicable.", "status": "confirmed", "source": { "title": "eCFR: 32 CFR 170.3, CMMC applicability and phased implementation", "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.3" }, "verified_on": "2026-10-31" }, { "id": "2027-12-02-ai-act-high-risk-annex-iii-biometrics", "date": "2027-12-02", "precision": "day", "title": "AI Act: high-risk obligations apply to Annex III systems, including remote biometric identification", "regulation": "EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eu-ai-act", "type": "applies", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability", "Identity governance (IGA)" ], "who": "Providers and deployers of high-risk AI systems listed in Annex III, which include remote biometric identification, biometric categorisation and emotion recognition systems.", "what": "Chapter III, Sections 1 to 3 (risk management, data governance, logging, human oversight, accuracy and robustness requirements, and provider and deployer duties) apply to Annex III systems from this date, deferred from 2 August 2026 by the Digital Omnibus.", "status": "confirmed", "source": { "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32026R1744" }, "verified_on": "2026-10-31" }, { "id": "2027-12-11-cra-full-application", "date": "2027-12-11", "precision": "day", "title": "Cyber Resilience Act: main obligations apply", "regulation": "Cyber Resilience Act (Regulation (EU) 2024/2847)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "cyber-resilience-act", "type": "applies", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Manufacturers, importers and distributors of products with digital elements, with identity management systems, PAM products and biometric readers classed as important products.", "what": "The rest of the Regulation applies, including essential cybersecurity requirements (such as protection against unauthorised access through authentication and identity management) and conformity assessment before CE marking.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R2847" }, "verified_on": "2026-10-31" }, { "id": "2027-12-24-eudi-wallet-private-relying-party-acceptance", "date": "2027-12-24", "precision": "day", "title": "EU Digital Identity Wallet: regulated private relying parties and very large online platforms must accept the wallet", "regulation": "eIDAS 2 (Regulation (EU) 2024/1183)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eidas-2", "type": "deadline", "identity_impact": [ "Authentication & MFA", "Identity verification (KYC/proofing)", "Customer identity & consent (CIAM)" ], "who": "Private relying parties legally or contractually required to use strong user authentication (including banking, financial services, transport, energy, health, telecoms and education) and very large online platforms.", "what": "Article 5f(2) requires these relying parties to accept the European Digital Identity Wallet for authentication at the user's request no later than 36 months after the wallet implementing acts entered into force, which falls on 24 December 2027.", "status": "confirmed", "source": { "title": "Regulation (EU) 2024/1183 (European Digital Identity Framework), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1183" }, "verified_on": "2026-10-31" }, { "id": "2027-12-31-ccpa-risk-assessments-existing-processing", "date": "2027-12-31", "precision": "day", "title": "CCPA: risk assessments due for processing that predates the regulations", "regulation": "CCPA/CPRA regulations (11 CCR 7000 et seq.)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": "ccpa-cpra", "type": "deadline", "identity_impact": [ "Customer identity & consent (CIAM)", "Audit, logging & accountability" ], "who": "Businesses whose processing presents significant risk, including processing sensitive personal information such as biometric data and using ADMT for significant decisions.", "what": "For significant-risk processing that began before the regulations took effect and continues after, a documented risk assessment must be completed no later than 31 December 2027.", "status": "confirmed", "source": { "title": "California Privacy Protection Agency: approved text of CCPA updates, cybersecurity audit, risk assessment and ADMT regulations", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf" }, "verified_on": "2026-10-31" }, { "id": "2028-01-01-amla-direct-supervision-begins", "date": "2028-01-01", "precision": "year", "title": "AMLA: direct supervision of selected obliged entities expected to begin", "regulation": "AMLA Regulation (Regulation (EU) 2024/1620)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": null, "type": "enforcement", "identity_impact": [ "Identity verification (KYC/proofing)", "Audit, logging & accountability" ], "who": "The selected high-risk financial institutions.", "what": "The AMLA Regulation states that direct supervision of selected obliged entities should commence as of 2028, after the first selection process concludes; no day is fixed.", "status": "expected", "source": { "title": "Regulation (EU) 2024/1620 (AMLA Regulation), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32024R1620" }, "verified_on": "2026-10-31" }, { "id": "2028-01-01-delete-act-data-broker-audits", "date": "2028-01-01", "precision": "day", "title": "California Delete Act: independent audits of data brokers begin", "regulation": "California Delete Act (SB 362)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": null, "type": "deadline", "identity_impact": [ "Audit, logging & accountability" ], "who": "Data brokers registered in California.", "what": "Beginning 1 January 2028, and every three years thereafter, data brokers must undergo an independent third-party audit of their compliance with the Delete Act.", "status": "confirmed", "source": { "title": "California Privacy Protection Agency: data brokers and DROP", "url": "https://cppa.ca.gov/data_brokers/" }, "verified_on": "2026-10-31" }, { "id": "2028-01-17-dora-commission-review", "date": "2028-01-17", "precision": "day", "title": "DORA: Commission review report due", "regulation": "DORA (Regulation (EU) 2022/2554)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "dora", "type": "review", "identity_impact": [ "Audit, logging & accountability", "Identity governance (IGA)" ], "who": "The European Commission, after consulting the ESAs and the ESRB.", "what": "Article 58(1) requires the Commission to review DORA by 17 January 2028 and report to Parliament and Council, with a legislative proposal where appropriate.", "status": "confirmed", "source": { "title": "Regulation (EU) 2022/2554 (DORA), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32022R2554" }, "verified_on": "2026-10-31" }, { "id": "2028-02-28-italy-nis-registration-2028", "date": "2028-02-28", "precision": "day", "title": "Italy NIS: annual registration window closes", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "deadline", "identity_impact": [ "Audit, logging & accountability" ], "who": "Entities in scope of Italy's NIS regime.", "what": "The yearly registration and renewal window on the ACN platform runs from 1 January to 28 February.", "status": "confirmed", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2028-03-31-dora-register-of-information-2028", "date": "2028-03-31", "precision": "day", "title": "DORA: registers of information reported to the ESAs (2028 cycle)", "regulation": "DORA (Regulation (EU) 2022/2554)", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "dora", "type": "reporting", "identity_impact": [ "Audit, logging & accountability", "Identity governance (IGA)" ], "who": "EU financial entities, through their national competent authorities, and the ICT third-party providers (including identity and access providers) listed in their registers.", "what": "Under the ESAs Decision, competent authorities submit the registers of information on ICT third-party arrangements to the ESAs by 31 March each year, with a reference date of 31 December of the prior year; financial entities must deliver their registers to their competent authority earlier, on national timelines.", "status": "confirmed", "source": { "title": "ESAs Decision on reporting by competent authorities of information for CTPP designation (EIOPA)", "url": "https://www.eiopa.europa.eu/publications/esas-decision-reporting-competent-authorities-esas-information-necessary-designation-critical-ict_en" }, "verified_on": "2026-10-31" }, { "id": "2028-04-01-ccpa-first-cybersecurity-audits-large", "date": "2028-04-01", "precision": "day", "title": "CCPA: first cybersecurity audit reports due for businesses over $100 million revenue", "regulation": "CCPA/CPRA regulations (11 CCR 7000 et seq.)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": "ccpa-cpra", "type": "deadline", "identity_impact": [ "Authentication & MFA", "Identity governance (IGA)", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Businesses whose processing presents significant security risk and whose 2026 annual gross revenue exceeded 100 million dollars.", "what": "The first independent cybersecurity audit report, covering 2027, is due; audits assess components including authentication (MFA), access controls and privileged account management. Businesses with 50 to 100 million dollars follow on 1 April 2029 and smaller ones on 1 April 2030.", "status": "confirmed", "source": { "title": "California Privacy Protection Agency: approved text of CCPA updates, cybersecurity audit, risk assessment and ADMT regulations", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf" }, "verified_on": "2026-10-31" }, { "id": "2028-04-01-ccpa-risk-assessment-submission", "date": "2028-04-01", "precision": "day", "title": "CCPA: first risk assessment information submitted to the CPPA", "regulation": "CCPA/CPRA regulations (11 CCR 7000 et seq.)", "jurisdiction": "United States (California)", "country_slug": "united-states", "regulation_slug": "ccpa-cpra", "type": "reporting", "identity_impact": [ "Audit, logging & accountability" ], "who": "Businesses that conducted risk assessments in 2026 and 2027.", "what": "Risk assessment information (contact, assessment counts and a signed attestation by an executive) for 2026 and 2027 is due to the Agency by 1 April 2028, then by 1 April each following year.", "status": "confirmed", "source": { "title": "California Privacy Protection Agency: approved text of CCPA updates, cybersecurity audit, risk assessment and ADMT regulations", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf" }, "verified_on": "2026-10-31" }, { "id": "2028-04-15-nydfs-part-500-annual-notice-of-compliance-2028", "date": "2028-04-15", "precision": "day", "title": "NYDFS Part 500: annual certification of compliance or acknowledgment of noncompliance due (2028)", "regulation": "NYDFS 23 NYCRR Part 500", "jurisdiction": "United States (New York)", "country_slug": "united-states", "regulation_slug": "nydfs-part-500", "type": "reporting", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "Banks, insurers and other entities licensed by the New York Department of Financial Services.", "what": "Section 500.17(b) requires each covered entity to submit electronically by April 15 a certification of material compliance for the prior calendar year, or an acknowledgment of noncompliance with a remediation timeline; universal MFA under section 500.12 has applied since 1 November 2025.", "status": "confirmed", "source": { "title": "NYDFS: 23 NYCRR Part 500 (Cybersecurity Requirements for Financial Services Companies)", "url": "https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500" }, "verified_on": "2026-10-31" }, { "id": "2028-05-31-italy-nis-annual-update-2028", "date": "2028-05-31", "precision": "day", "title": "Italy NIS: annual information update due", "regulation": "NIS2 transposition (Legislative Decree 138/2024)", "jurisdiction": "Italy", "country_slug": null, "regulation_slug": null, "type": "reporting", "identity_impact": [ "Audit, logging & accountability" ], "who": "Registered NIS entities in Italy.", "what": "NIS entities must update their information on the ACN platform by 31 May each year.", "status": "confirmed", "source": { "title": "Agenzia per la Cybersicurezza Nazionale (ACN): NIS", "url": "https://www.acn.gov.it/portale/en/nis" }, "verified_on": "2026-10-31" }, { "id": "2028-08-02-ai-act-high-risk-annex-i", "date": "2028-08-02", "precision": "day", "title": "AI Act: high-risk obligations apply to Annex I product systems", "regulation": "EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744", "jurisdiction": "European Union", "country_slug": "european-union", "regulation_slug": "eu-ai-act", "type": "applies", "identity_impact": [ "Audit, logging & accountability" ], "who": "Providers of AI systems that are safety components of products covered by Annex I Union harmonisation legislation (for example machinery, toys, medical devices and lifts).", "what": "Chapter III, Sections 1 to 3 apply to high-risk systems classified under Article 6(1) and Annex I, including any embedded biometric access or identification functions in those products.", "status": "confirmed", "source": { "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text (Publications Office of the EU)", "url": "https://publications.europa.eu/resource/celex/32026R1744" }, "verified_on": "2026-10-31" }, { "id": "2028-11-10-cmmc-phase-4-full-implementation", "date": "2028-11-10", "precision": "day", "title": "CMMC Phase 4: full implementation", "regulation": "Cybersecurity Maturity Model Certification (32 CFR Part 170)", "jurisdiction": "United States", "country_slug": "united-states", "regulation_slug": null, "type": "phase-in", "identity_impact": [ "Authentication & MFA", "Privileged access (PAM)", "Audit, logging & accountability" ], "who": "All defense contractors and subcontractors in scope of CMMC.", "what": "Phase 4 begins one calendar year after Phase 3: DoD will include CMMC requirements in all applicable solicitations and contracts, including option periods on contracts awarded before Phase 4.", "status": "confirmed", "source": { "title": "eCFR: 32 CFR 170.3, CMMC applicability and phased implementation", "url": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.3" }, "verified_on": "2026-10-31" } ] }