The laws, and what they mean in practice

Privacy, AI and cybersecurity laws that shape digital trust work, from the GDPR to every US state privacy law. Each entry says who it applies to, who enforces it and when, in plain words, with the sources. Free for everyone.

Regulatory Watch follows new rules, enforcement and court decisions as they happen.

All 75 European Union 12 United Kingdom 1 US federal 12 US states 40 Rest of world 10

Privacy AI Health Children Biometrics Cybersecurity Breach notification Data brokers Marketing Financial International transfers

In force Coming into force Challenged or stayed

European Union 1

In force

DORA

ICT risk management, incident reporting, resilience testing and a register of ICT third-party arrangements for the financial sector.

Since 17 Jan 2025

US federal 2

In force

GLBA

Privacy notices and opt-outs for sharing customer financial information, and an information security program with specific safeguards under the Safeguards Rule.

Since 12 Nov 1999 · Guide in progress In force

FCRA

Accuracy, permissible purpose and dispute rights for consumer reports, including background checks for employment.

Since 25 Apr 1971

US states 1

In force · New York

NYDFS Part 500

A detailed cybersecurity program regulation with annual certification, CISO reporting, incident notice within 72 hours and personal liability exposure for certifying executives.

Since 1 Mar 2017 · Guide in progress

This library explains laws for practitioners. It is not legal advice, and laws change: check the sources on each page and take advice from counsel before acting.