Activity Tracker
The DPA Activity Tracker provides our latest information on developments in legislatures, judiciaries and the executive branches of G20, EU member states and Switzerland.
118 events advancing 108 policy or regulatory changes:
Graph
Table
EU Regulation laying down additional procedural rules relating to the enforcement of GDPR in cross-border cases
Regulation laying down additional procedural rules relating to the enforcement of GDPR enters into force
On 2 April 2027, the Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 enters into force. The regulation aims to harmonise the criteria for assess…
Bill amending Network Act including incident response obligations and enforcement measures (Bill No. 2214896/Law No. 21500)
Information Security Level Evaluation obligations in Act on Promotion of Information and Communications Network Utilization and Information Protection (Law No. 21500) enter into force
On 1 April 2027, the Information Security Level Evaluation obligations in the Act on Promotion of Information and Communications Network Utilization and Information Protection (Law No. 21500) enter into force. The Korea Ministry of Science and ICT m…
Consumer Financial Protection Bureau Personal Financial Data Rights Rule
Implemented obligations for depository institutions that hold at least USD 10 billion in total assets outlined in Rule on Personal Financial Data Rights
On 1 April 2027, the final rule on personal financial data rights came into force for depository institutions that hold at least USD 10 billion in total assets but less than USD 250 billion or non-depository institutions that did not generate USD 10…
Data protection regulation in Government Regulation Number 17 of 2025 concerning Governance of Electronic System Implementation in Child Protection
Government Regulation Number 17 of 2025 concerning Governance of Electronic System Implementation in Child Protection including data protection regulation enters into force
On 27 March 2027, Regulation Number 17 of 2025 concerning Governance of Electronic System Implementation in Child Protection enters into force following the conclusion of the two-year transition period that began on 27 March 2025. Under this regulat…
Regulation (EU) 2025/327 establishing a European Health Data Space (EHDS) including rules for portability and sharing of health data
European Health Data Space Regulation (2025/327) enters into force
On 26 March 2027, specific provisions of the European Health Data Space (EHDS) Regulation (2025/327) come into force. These include the adoption of common specifications for EHR systems, which will set requirements for interoperability, security and…
Guidance on operational incident reporting (FG26/3)
Guidance on operational incident reporting enters into force
On 18 March 2027, the guidance on operational incident reporting for firms with Part 4A permission, payment service providers (PSPs), credit rating agencies, and other financial firms enters into force. The guidelines establish a standardised proces…
Guidance on material third party arrangements (FG26/4)
Guidance on material third party arrangements enters into force
On 18 March 2027, the guidance on material third-party arrangements (FG26/4) comes into force. It applies to designated investment firms, authorised electronic money or payment institutions, and other financial institutions. The guidance requires fi…
Privacy Protection Act (A6309)
Section 6 of the Privacy Protection Act (A6309) enters into force
On 1 February 2027, Section 6 of the Privacy Protection Act (A6309) enters into force, regulating the collection and sharing of personal information by health care facilities. The provisions prohibit health care facilities from requesting or collect…
Data localisation requirement in circular introducing systemic oversight measures in Nigeria payments system (circular PSS/DIR/PUB/CIR/001/004)
Circular introducing systemic oversight measures in payments system including data localisation obligations enters into force
On 1 January 2027, the Central Bank of Nigeria’s circular introducing systemic oversight measures in Nigeria's payment system, establishing data localisation obligations, enters into force. The requirement applies to deposit money banks, microfinanc…
Data protection authority governance in Louisiana Data Privacy Act (Senate Bill No. 386)
Louisiana Data Privacy Act (Act No. 502) including data protection authority governance enters into force
On 1 January 2027, the Louisiana Data Privacy Act (Act No. 502) enters into force as Chapter 20-B of Title 51 of the Louisiana Revised Statutes (R.S. 51:1780.1 to 1780.5). The attorney general has exclusive authority to enforce the Act, with any vio…