Authorities
Regulations
Final rules, one rule under OMB review, and EU implementing decisions. CIRCIA incident reporting: the final rule is under OMB review and its reporting requirements are not operative; it is labeled as such, not as a proposed rule and not as final.
| Record | Jurisdiction | Status | Subject |
|---|---|---|---|
| COPPA statute and amended rule Federal · Final rule |
Federal | Amended Rule effective June 23, 2025; general compliance date April 22, 2026, following publication April 22, 2025. | Children; Cross-border |
| FTC Health Breach Notification Rule amendments Federal · Final rule |
Federal | In effect (Amendments adopted April 26, 2024, effective July 29, 2024; 2021 policy statement withdrawn September 9, 2026) | Security; Cross-border; Sensitive data |
| GLBA Safeguards Rule, including notification duty Federal · Final rule |
Federal | In effect (Notification amendment published November 13, 2023, effective May 13, 2024) | Security; Sensitive data; Cross-border |
| SEC Regulation S-P amendments Federal · Final rule |
Federal | In effect; both compliance dates passed (Effective August 2, 2024; compliance December 3, 2025 (larger entities) and June 3, 2026 (smaller)) | Security; Cross-border |
| HIPAA privacy, security, and breach requirements Federal · Final rule |
Federal | In effect (2024 reproductive-health amendments largely vacated June 18, 2025 (Purl); vacatur final after the September 10, 2025 dismissal of the intervenors' appeal) | Sensitive data; Cross-border |
| 42 CFR Part 2: substance-use confidentiality amendments Federal · Final rule |
Federal | In effect (Final rule published February 16, 2024; compliance February 16, 2026) | Sensitive data; Cross-border |
| DOJ Data Security Program (28 CFR Part 202) Federal · Final rule |
Federal | In effect (Effective April 8, 2025; due-diligence, audit, and reporting duties October 6, 2025; civil penalty under 28 CFR 202.1301: greater of $368,136 or twice the transaction amount, subject to applicable inflation adjustments) | Cross-border |
| SEC cybersecurity disclosure rules Federal · Final rule |
Federal | In effect (Adopted July 26, 2023; 8-K compliance December 18, 2023 (smaller reporting companies June 15, 2024); Item 106 for fiscal years ending on or after December 15, 2023) | Security; Cross-border |
| CIRCIA incident reporting rule Federal · Proposed rule |
Federal | Final rule under OMB review; reporting requirements not operative in the cited record. | Security; Cross-border |
| California privacy assessment, audit, and ADMT regulations California · Final rule |
California | In effect; staged compliance dates (Regulations effective January 1, 2026. Risk assessments: required before beginning high-risk processing; completion due by December 31, 2027 for processing already underway; first submission of assessment summaries and attestations to the CPPA due April 1, 2028. Cybersecurity audits: under 11 C.C.R. 7121, the first audit report must be completed by April 1, 2028 (annual gross revenue over $100 million), April 1, 2029 ($50-100 million), or April 1, 2030 (under $50 million). Under 11 C.C.R. 7124, the business must separately submit a written certification of audit completion to the CPPA no later than April 1 following any year it is required to complete an audit. ADMT: under 11 C.C.R. 7200, a business using covered ADMT for a significant decision before January 1, 2027 must comply by January 1, 2027; a business using covered ADMT for a significant decision on or after January 1, 2027 must comply whenever it uses the technology.) | Cross-border |
| EU Data Act and operative implementation EU · Final rule |
EU | In effect; staged (In force January 11, 2024; applies from September 12, 2025; connected-product design duties (Article 3(1)) for products placed on the market after September 12, 2026; unfair-terms rules (Chapter IV) apply to contracts concluded after September 12, 2025, and from September 12, 2027 only to contracts concluded on or before that date that are of indefinite duration or due to expire at least 10 years from January 11, 2024) | Cross-border |
| EU standard contractual clauses EU · Commission implementing decision |
EU | In effect (Adopted June 4, 2021; applicable from June 27, 2021; new-contract transition September 27, 2021; migration deadline for earlier clause sets December 27, 2022) | Cross-border |
| EU-U.S. Data Privacy Framework and current litigation EU/U.S. · Commission implementing decision |
EU/U.S. | Adequacy decision operative; appeal pending. Adopted July 10, 2023; upheld in T-553/23 September 3, 2025; appeal filed October 31, 2025. | Cross-border |
| FCC TCPA consent-revocation order (FCC 26-67) Federal · Final rule |
Federal | Adopted; published October 26, 2026; effective November 25, 2026 | Cross-border |
| No records match. Clear the filters to see all records. | |||