United States of America: Applicability of Cybersecurity Information Sharing Act of 2015 including data protection regulation ends

On 30 January 2026, the Cybersecurity Information Sharing Act of 2015 (CISA) is scheduled to expire unless reauthorised by Congress. Its expiration would also terminate the Law’s data protection provisions, including the requirement for private entities to remove personal information not directly related to cybersecurity threats before sharing, as well as federal obligations for privacy review, oversight, and audit.