India · 13 Nov 2026
Consent manager framework operational
DPDP Rules 2025
R/
Regulatory radar
The deadlines behind your roadmap.
AI and data protection milestones across the EU, the UK, the US, India and Asia-Pacific, with what each one means for a product team.
Jurisdiction
Topic
- 02 Feb 2025In force
EU · AI · EU AI Act
Prohibited practices and AI literacy apply
The first AI Act provisions applied: bans on specified AI practices and the AI literacy duty for providers and deployers. The Omnibus later reframed literacy as a duty to take supporting measures.
Founder moveScreen use cases against Article 5 and keep a record of AI literacy measures for staff.
European Commission · EU AI Act - 02 Aug 2025In force
EU · AI · EU AI Act
General-purpose AI model obligations begin
Obligations for providers of general-purpose AI models began to apply, alongside the AI Act’s governance structure.
Founder moveIf you fine-tune or distribute models, check whether you become a GPAI provider. If you integrate one, collect the documentation downstream providers need.
European Commission · EU AI Act - 13 Nov 2025In force
India · Privacy · DPDP Act & Rules 2025
DPDP Rules notified, phased roll-out starts
The Digital Personal Data Protection Rules, 2025 were notified and provisions on the Data Protection Board took effect, starting an 18-month implementation runway.
Founder moveStart the data inventory now. Notice, consent and rights workflows take longer than the policy text.
Briefing · Hogan Lovells on the DPDP Act coming into force - 01 Jan 2026In force
US · Privacy · California CCPA regulations
Updated CCPA regulations take effect
California’s updated regulations took effect, including requirements to conduct risk assessments for in-scope processing that starts from this date.
Founder moveAdd a risk-assessment step to product intake for new processing that touches California residents.
Briefing · Thompson Coburn on the 2026 CCPA regulations - 22 Jan 2026In force
APAC · AI · South Korea AI Basic Act
South Korea’s AI Basic Act takes effect
South Korea became one of the first countries after the EU with a comprehensive AI law, covering high-impact AI, generative AI transparency and, for some foreign providers, a local representative.
Founder moveIf you serve Korean users with generative or high-impact AI, check labelling duties and whether you need a domestic representative.
Briefing · Cooley on South Korea’s AI Basic Act - 05 Feb 2026In force
UK · Privacy · Data (Use and Access) Act 2025
Main UK GDPR reforms commence
Most data protection reforms in the Data (Use and Access) Act commenced, including recognised legitimate interests, a revised automated decision-making framework, updated transfer rules and cookie changes.
Sources cite 5 or 6 February 2026. Check the commencement regulations.
Founder moveRevisit lawful bases, automated decision-making (ADM) safeguards and cookie banners for UK users.
Briefing · Kennedys on UK Data (Use and Access) Act commencement - 20 Feb 2026In force
India · Content · IT Rules amendment
Synthetic content labelling rules in force
Amendments to India’s IT Rules on ‘synthetically generated information’ took effect, bringing labelling, provenance and faster takedown expectations for intermediaries.
Founder moveIf users can generate or share AI media on your platform, design visible labels, metadata and takedown escalation.
Briefing · Hogan Lovells on India’s AI labelling rules - 19 Jun 2026In force
UK · Privacy · Data (Use and Access) Act 2025
Data protection complaints procedure required
Controllers must have a process for handling data protection complaints from individuals.
Founder movePublish a complaints route and make sure support teams know how to escalate it.
Briefing · Kennedys on UK Data (Use and Access) Act commencement - 27 Jul 2026In force
EU · AI · AI Act Digital Omnibus
AI Omnibus amendments enter into force
Amendments simplifying the AI Act entered into force. They defer high-risk deadlines, add small mid-cap relief, add new prohibitions and centralise some supervision in the AI Office.
Reported dates range from 27 to 29 July 2026. Check the Official Journal.
Founder moveRe-plan your high-risk roadmap. The deferral moves the deadline but does not remove the obligations.
Briefing · Orrick on the AI Act Digital Omnibus (July 2026) - 02 Aug 2026In force
EU · AI · EU AI Act
Transparency duties and GPAI enforcement go live
Article 50 transparency obligations apply on the original schedule, and the Commission’s enforcement powers over general-purpose AI model providers begin.
Founder moveTell users when they interact with AI, and label deepfakes and AI-generated text published on matters of public interest.
European Commission · EU AI Act - 13 Nov 2026Upcoming
India · Privacy · DPDP Rules 2025
Consent manager framework operational
The registration framework and obligations for consent managers are scheduled to apply around twelve months after notification.
Some early briefings assigned more duties to this phase. Check the Gazette text.
Founder moveDecide whether your consent flows will integrate with registered consent managers.
Briefing · Hogan Lovells on the DPDP Act coming into force - 02 Dec 2026Upcoming
EU · Content · AI Act Digital Omnibus
Synthetic-content marking for legacy systems and new bans
Machine-readable marking duties apply to generative systems placed on the market before August 2026. New prohibitions on non-consensual intimate imagery and CSAM generation take effect.
Founder moveMake sure generative outputs carry machine-readable marks, and block prohibited generation at the policy and model layer.
Briefing · Orrick on the AI Act Digital Omnibus (July 2026) - 01 Jan 2027Upcoming
US · AI · California CCPA regulations
Automated decision-making (ADMT) rules apply
Businesses using automated decision-making technology for significant decisions must provide pre-use notices, opt-out and access rights.
Founder moveInventory every automated ‘significant decision’ in hiring, lending, housing, education or healthcare flows.
Briefing · Thompson Coburn on the 2026 CCPA regulations - 01 Jan 2027Upcoming
US · AI · Colorado SB 26-189
Colorado’s rewritten AI law takes effect
The replacement law focuses on automated decision-making in consequential decisions, with notice, adverse-outcome disclosure, human review and recordkeeping duties.
Depends on Attorney General rulemaking. Enforcement has been reported as stayed pending litigation.
Founder moveMap adverse-outcome notices and human-review routes for Colorado consumers.
Briefing · Skadden on Colorado’s replacement AI Act - 13 May 2027Upcoming
India · Privacy · DPDP Act & Rules 2025
Core DPDP obligations become enforceable
Notice, consent, security safeguards, breach intimation, data principal rights, retention, children’s data and Significant Data Fiduciary duties are scheduled to apply.
Founder moveRebuild notices and consent, test breach intimation and set up verifiable parental consent where children use the product.
Briefing · Hogan Lovells on the DPDP Act coming into force - 02 Dec 2027Upcoming
EU · AI · EU AI Act (as amended)
Stand-alone high-risk (Annex III) obligations
High-risk obligations for Annex III use cases such as employment, education, credit and essential services now apply from this date, deferred from August 2026.
Founder moveIf you build HR tech, edtech, credit or insurance AI, start risk management, data governance and technical documentation now.
Briefing · Orrick on the AI Act Digital Omnibus (July 2026) - 31 Dec 2027Upcoming
US · Privacy · California CCPA regulations
Risk assessments for pre-2026 processing
In-scope processing that began before 2026 and continues must have a documented risk assessment by this date.
Founder moveBackfill assessments for legacy processing, starting with the highest-risk activities.
Briefing · Thompson Coburn on the 2026 CCPA regulations - 01 Apr 2028Upcoming
US · Privacy · California CCPA regulations
Risk-assessment submissions and first audit certifications
Risk-assessment attestations and summaries are due, and the largest businesses submit their first cybersecurity audit certifications. Smaller revenue bands follow later.
Phased by revenue. Briefings differ on the mid-size band.
Founder moveAssign an executive owner for attestations and line up audit evidence early.
Briefing · Thompson Coburn on the 2026 CCPA regulations - 02 Aug 2028Upcoming
EU · AI · EU AI Act (as amended)
Product-embedded high-risk AI (Annex I)
High-risk obligations for AI that is a safety component of products covered by EU harmonisation law, such as medical devices and machinery, apply from this date.
Founder moveCoordinate AI Act documentation with your existing product conformity process.
Briefing · Orrick on the AI Act Digital Omnibus (July 2026) - TBCIn negotiation
EU · Data · GDPR Digital Omnibus
GDPR and cookie reforms under negotiation
Proposed GDPR changes, including the definition of personal data, pseudonymisation and AI training, remain in the legislative process. Commentators do not expect application before late 2027 at the earliest.
Founder moveDon’t design around proposed changes. Build to the current GDPR and track the trilogue.
Briefing · White & Case on the GDPR Digital Omnibus proposal
Reviewed 11 October 2026. Dates are compiled from official sources and law-firm briefings, and some depend on further rulemaking, litigation or official notification. This is general information, not legal advice. Check the current text before you rely on a date, and get advice on whether a rule applies to you.
See which of these affect you: take the risk scan