Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

Deadlines

Open in Knowledge map

Dates that decide when a law binds someone. Each row is explained, with sources, on its country’s page.

In force

Jurisdiction	Law	Applies since
European Union	GDPR	25 May 2018
China	PIPL	1 November 2021
Switzerland	Federal Act on Data Protection	1 September 2023
South Korea	Penalties up to 10% of total sales	11 September 2026
United Kingdom	Most of the Data (Use and Access) Act 2025’s data protection changes	5 February 2026
European Union	AI Act: bans	2 February 2025
European Union	AI Act: most of the rest	2 August 2026

Scheduled

Jurisdiction	Law	Applies from
Australia	Children’s Online Privacy Code to be registered	By 10 December 2026
India	DPDP Rules: phased compliance	18 months from 14 November 2025
European Union	AI Act: high-risk systems listed in Annex III	2 December 2027
European Union	AI Act: high-risk systems in products under Annex I	2 August 2028

Under negotiation

These are not law yet. Their dates can change, so check the country’s page.

Jurisdiction	Proposal	State on 9 November 2026
European Union	Digital Omnibus	Council position agreed 21 October 2026; Parliament has no position yet
Chile	Postponement of Law 21.719 to 15 October 2027	Approved by the Senate on 28 October 2026 (law firm’s report)
Canada	Bill C-36	At second reading
International	Budapest Convention, Second Additional Protocol	Four ratifications reported of five needed (April 2026)
International	Convention 108+	33 ratifications of 38 needed (October 2025)