{"name":"LexVibe compliance dataset","description":"Open reference data behind LexVibe's document generation: 55 privacy and AI frameworks across 46 jurisdictions with links to their official texts, the EU AI Act timeline with post-Omnibus dates, obligations by risk level, and the regulatory changes we watch.","version":"1.0.0","license":{"id":"CC-BY-4.0","name":"Creative Commons Attribution 4.0 International","url":"https://creativecommons.org/licenses/by/4.0/","attribution":"LexVibe — https://golexvibe.com"},"homepage":"https://golexvibe.com/law","disclaimer":"A structured index of publicly available regulatory facts, intended for engineering, research and educational use. Not legal advice. Every framework record links to its official text — check the primary source and a qualified lawyer for decisions about your own compliance posture.","counts":{"frameworks":55,"jurisdictions":46,"verticals":14,"watchedChanges":17},"parts":["frameworks","jurisdictions","verticals","ai_act","watched_changes"],"frameworks":[{"id":"gdpr","market":"eu","jurisdiction":{"id":"eu","label":"European Union","iso":"EU","level":"supranational"},"shortName":"GDPR","fullName":"General Data Protection Regulation (Regulation (EU) 2016/679)","promptLabel":"GDPR (Reglamento UE 2016/679)","officialUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj","effectiveDate":"2018-05-25","documents":["privacy","cookies","dpa"],"rights":["access","rectification","erasure","portability","object","restrict","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Any organisation processing personal data of people in the EU, regardless of where it is established.","keyArticles":[{"ref":"Art. 6","note":"Lawful bases for processing"},{"ref":"Art. 13","note":"Information to provide when collecting data"},{"ref":"Art. 15–22","note":"Data subject rights"},{"ref":"Art. 28","note":"Processor contracts (DPA)"},{"ref":"Art. 44–49","note":"International transfers"}]},{"id":"eprivacy","market":"eu","jurisdiction":{"id":"eu","label":"European Union","iso":"EU","level":"supranational"},"shortName":"ePrivacy","fullName":"ePrivacy Directive (Directive 2002/58/EC, as amended by 2009/136/EC)","promptLabel":"Directiva ePrivacy","officialUrl":"https://eur-lex.europa.eu/eli/dir/2002/58/oj","effectiveDate":"2002-07-31","documents":["cookies","privacy"],"rights":["withdraw-consent"],"cookieRegime":"opt-in","applicability":"Anyone storing or reading information on a user's device — cookies, localStorage, SDK identifiers.","keyArticles":[{"ref":"Art. 5(3)","note":"Prior consent for storing or accessing data on a device"}]},{"id":"eu-ai-act","market":"eu","jurisdiction":{"id":"eu","label":"European Union","iso":"EU","level":"supranational"},"shortName":"EU AI Act","fullName":"Artificial Intelligence Act (Regulation (EU) 2024/1689)","promptLabel":"EU AI Act","officialUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","effectiveDate":"2026-08-02","documents":["ai","privacy","terms"],"rights":["human-review"],"cookieRegime":"unregulated","applicability":"Providers and deployers of AI systems offered in the EU. Transparency duties (Art. 50) apply from 2 August 2026.","keyArticles":[{"ref":"Art. 50(1)","note":"Tell people they are interacting with an AI system"},{"ref":"Art. 50(2)","note":"Machine-readable marking of AI-generated content"},{"ref":"Art. 50(4)","note":"Disclose deep fakes and AI-generated text of public interest"}]},{"id":"eu-data-act","market":"eu","jurisdiction":{"id":"eu","label":"European Union","iso":"EU","level":"supranational"},"shortName":"Data Act","fullName":"Data Act (Regulation (EU) 2023/2854)","promptLabel":"Data Act (Reglamento UE 2023/2854)","officialUrl":"https://eur-lex.europa.eu/eli/reg/2023/2854/oj","effectiveDate":"2025-09-12","documents":["terms","privacy"],"rights":["access","portability"],"cookieRegime":"unregulated","applicability":"Products and related services that generate connected-device data.","keyArticles":[{"ref":"Art. 3","note":"Connected products must make their data accessible by design"},{"ref":"Art. 4","note":"User right of access to product and related service data"},{"ref":"Art. 5","note":"Right to share data with a third party"}]},{"id":"uk-gdpr","market":"uk","jurisdiction":{"id":"uk","label":"United Kingdom","iso":"GB","level":"country"},"shortName":"UK GDPR","fullName":"UK General Data Protection Regulation","promptLabel":"UK GDPR","officialUrl":"https://www.legislation.gov.uk/eur/2016/679/contents","authority":{"name":"Information Commissioner's Office (ICO)","url":"https://ico.org.uk/"},"effectiveDate":"2021-01-01","documents":["privacy","cookies","dpa"],"rights":["access","rectification","erasure","portability","object","restrict","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Organisations processing personal data of people in the UK.","keyArticles":[{"ref":"Art. 13","note":"Information to provide when collecting data"},{"ref":"Art. 15–22","note":"Data subject rights"},{"ref":"Art. 28","note":"Processor contracts (DPA)"}]},{"id":"uk-dpa-2018","market":"uk","jurisdiction":{"id":"uk","label":"United Kingdom","iso":"GB","level":"country"},"shortName":"DPA 2018","fullName":"Data Protection Act 2018","promptLabel":"Data Protection Act 2018","officialUrl":"https://www.legislation.gov.uk/ukpga/2018/12","authority":{"name":"Information Commissioner's Office (ICO)","url":"https://ico.org.uk/"},"effectiveDate":"2018-05-25","documents":["privacy"],"rights":["access","rectification","erasure","portability","object","restrict","withdraw-consent","human-review"],"cookieRegime":"opt-in"},{"id":"pecr","market":"uk","jurisdiction":{"id":"uk","label":"United Kingdom","iso":"GB","level":"country"},"shortName":"PECR","fullName":"Privacy and Electronic Communications Regulations 2003","promptLabel":"PECR","officialUrl":"https://www.legislation.gov.uk/uksi/2003/2426","authority":{"name":"Information Commissioner's Office (ICO)","url":"https://ico.org.uk/"},"effectiveDate":"2003-12-11","documents":["cookies"],"rights":["withdraw-consent"],"cookieRegime":"opt-in","applicability":"Cookies, similar technologies and electronic marketing to UK users.","keyArticles":[{"ref":"Reg. 6","note":"Consent before storing or accessing information on a device"},{"ref":"Reg. 22","note":"Consent for electronic mail marketing"}]},{"id":"uk-dua-act","market":"uk","jurisdiction":{"id":"uk","label":"United Kingdom","iso":"GB","level":"country"},"shortName":"DUAA 2025","fullName":"Data (Use and Access) Act 2025","promptLabel":"Data (Use and Access) Act 2025","authority":{"name":"Information Commissioner's Office (ICO)","url":"https://ico.org.uk/"},"effectiveDate":"2026-06-01","documents":["privacy","terms","cookies"],"rights":["access","rectification","erasure","portability","object","restrict","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Reform of the UK data regime: UK GDPR adjustments, cookies and automated decisions."},{"id":"nfadp","market":"ch","jurisdiction":{"id":"ch","label":"Switzerland","iso":"CH","level":"country"},"shortName":"nFADP","fullName":"Swiss Federal Act on Data Protection (revised, SR 235.1)","promptLabel":"nFADP (Ley Federal de Protección de Datos)","officialUrl":"https://www.fedlex.admin.ch/eli/cc/2022/491/en","authority":{"name":"Federal Data Protection and Information Commissioner (FDPIC)","url":"https://www.edoeb.admin.ch/en"},"effectiveDate":"2023-09-01","documents":["privacy","dpa"],"rights":["access","rectification","erasure","portability","object","human-review"],"cookieRegime":"opt-out","applicability":"Processing that affects people in Switzerland, including from abroad."},{"id":"ccpa","market":"us","jurisdiction":{"id":"us-ca","label":"California","iso":"US-CA","level":"state"},"shortName":"CCPA/CPRA","fullName":"California Consumer Privacy Act, as amended by the CPRA","promptLabel":"CCPA/CPRA (California)","officialUrl":"https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5","authority":{"name":"California Privacy Protection Agency (CPPA)","url":"https://cppa.ca.gov/"},"effectiveDate":"2020-01-01","documents":["privacy","cookies"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"For-profit businesses with over $25M revenue, or handling personal data of 100,000+ California consumers, or deriving 50%+ of revenue from selling data.","keyArticles":[{"ref":"§1798.100","note":"Right to know what is collected"},{"ref":"§1798.120","note":"Right to opt out of sale or sharing"},{"ref":"§1798.135","note":"Do Not Sell or Share link and opt-out signals"}]},{"id":"coppa","market":"us","jurisdiction":{"id":"us","label":"United States (federal)","iso":"US","level":"country"},"shortName":"COPPA","fullName":"Children's Online Privacy Protection Rule","promptLabel":"COPPA (menores)","officialUrl":"https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312","authority":{"name":"Federal Trade Commission (FTC)","url":"https://www.ftc.gov/"},"effectiveDate":"2000-04-21","documents":["privacy","terms"],"rights":["access","erasure","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Services directed to children under 13, or knowingly collecting their data.","keyArticles":[{"ref":"§312.4","note":"Notice to parents"},{"ref":"§312.5","note":"Verifiable parental consent before collection"},{"ref":"§312.8","note":"Confidentiality and security of children's data"}]},{"id":"vcdpa","market":"us","jurisdiction":{"id":"us-va","label":"Virginia","iso":"US-VA","level":"state"},"shortName":"VCDPA","fullName":"Virginia Consumer Data Protection Act","promptLabel":"VCDPA (Virginia)","officialUrl":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","effectiveDate":"2023-01-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","applicability":"100,000+ Virginia consumers, or 25,000+ if half of revenue comes from selling data.","keyArticles":[{"ref":"§59.1-577","note":"Consumer rights and how to exercise them"},{"ref":"§59.1-578","note":"Controller duties, including the privacy notice"}]},{"id":"cpa","market":"us","jurisdiction":{"id":"us-co","label":"Colorado","iso":"US-CO","level":"state"},"shortName":"CPA","fullName":"Colorado Privacy Act","promptLabel":"CPA (Colorado)","officialUrl":"https://leg.colorado.gov/bills/sb21-190","authority":{"name":"Colorado Attorney General","url":"https://coag.gov/"},"effectiveDate":"2023-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"100,000+ Colorado consumers, or 25,000+ with revenue from selling data."},{"id":"ctdpa","market":"us","jurisdiction":{"id":"us-ct","label":"Connecticut","iso":"US-CT","level":"state"},"shortName":"CTDPA","fullName":"Connecticut Data Privacy Act","promptLabel":"CTDPA (Connecticut)","officialUrl":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","effectiveDate":"2023-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"100,000+ Connecticut consumers, or 25,000+ with revenue from selling data."},{"id":"ucpa","market":"us","jurisdiction":{"id":"us-ut","label":"Utah","iso":"US-UT","level":"state"},"shortName":"UCPA","fullName":"Utah Consumer Privacy Act","promptLabel":"UCPA (Utah)","officialUrl":"https://le.utah.gov/xcode/Title13/Chapter61/13-61.html","effectiveDate":"2023-12-31","documents":["privacy"],"rights":["access","erasure","portability","opt-out-sale","non-discrimination"],"cookieRegime":"opt-out","applicability":"$25M+ revenue and 100,000+ Utah consumers (or 25,000+ with data-sale revenue)."},{"id":"tdpsa","market":"us","jurisdiction":{"id":"us-tx","label":"Texas","iso":"US-TX","level":"state"},"shortName":"TDPSA","fullName":"Texas Data Privacy and Security Act","promptLabel":"TDPSA (Texas)","officialUrl":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm","authority":{"name":"Texas Attorney General","url":"https://www.texasattorneygeneral.gov/"},"effectiveDate":"2024-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"Any business selling personal data or processing it, unless it is a small business under SBA criteria — no revenue threshold.","keyArticles":[{"ref":"§541.051","note":"Required privacy notice contents"},{"ref":"§541.055","note":"Recognising universal opt-out mechanisms"},{"ref":"§541.101","note":"Consumer rights and how to exercise them"}]},{"id":"ocpa","market":"us","jurisdiction":{"id":"us-or","label":"Oregon","iso":"US-OR","level":"state"},"shortName":"OCPA","fullName":"Oregon Consumer Privacy Act","promptLabel":"OCPA (Oregon)","officialUrl":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","effectiveDate":"2024-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"100,000+ Oregon consumers, or 25,000+ with revenue from selling data."},{"id":"mtcdpa","market":"us","jurisdiction":{"id":"us-mt","label":"Montana","iso":"US-MT","level":"state"},"shortName":"MTCDPA","fullName":"Montana Consumer Data Privacy Act","promptLabel":"MTCDPA (Montana)","officialUrl":"https://archive.legmt.gov/bills/2023/billhtml/SB0384.htm","effectiveDate":"2024-10-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"50,000+ Montana consumers, or 25,000+ with revenue from selling data."},{"id":"fdbr","market":"us","jurisdiction":{"id":"us-fl","label":"Florida","iso":"US-FL","level":"state"},"shortName":"FDBR","fullName":"Florida Digital Bill of Rights","promptLabel":"FDBR (Florida)","officialUrl":"https://www.flsenate.gov/Session/Bill/2023/262","effectiveDate":"2024-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","applicability":"Businesses with over $1B in global revenue meeting additional Florida-specific criteria."},{"id":"icdpa","market":"us","jurisdiction":{"id":"us-ia","label":"Iowa","iso":"US-IA","level":"state"},"shortName":"ICDPA","fullName":"Iowa Consumer Data Protection Act","promptLabel":"ICDPA (Iowa)","officialUrl":"https://www.legis.iowa.gov/legislation/BillBook?ga=90&ba=SF262","effectiveDate":"2025-01-01","documents":["privacy"],"rights":["access","erasure","portability","opt-out-sale","non-discrimination"],"cookieRegime":"opt-out","applicability":"100,000+ Iowa consumers, or 25,000+ with revenue from selling data."},{"id":"tipa","market":"us","jurisdiction":{"id":"us-tn","label":"Tennessee","iso":"US-TN","level":"state"},"shortName":"TIPA","fullName":"Tennessee Information Protection Act","promptLabel":"TIPA (Tennessee)","officialUrl":"https://www.capitol.tn.gov/Bills/113/Bill/HB1181.pdf","effectiveDate":"2025-07-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","applicability":"$25M+ revenue and 175,000+ Tennessee consumers."},{"id":"de-dpdpa","market":"us","jurisdiction":{"id":"us-de","label":"Delaware","iso":"US-DE","level":"state"},"shortName":"DPDPA","fullName":"Delaware Personal Data Privacy Act","promptLabel":"DPDPA (Delaware)","officialUrl":"https://legis.delaware.gov/BillDetail?LegislationId=140388","effectiveDate":"2025-01-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"35,000+ Delaware consumers, or 10,000+ with revenue from selling data."},{"id":"ndpa","market":"us","jurisdiction":{"id":"us-ne","label":"Nebraska","iso":"US-NE","level":"state"},"shortName":"NDPA","fullName":"Nebraska Data Privacy Act","promptLabel":"NDPA (Nebraska)","officialUrl":"https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=51050","effectiveDate":"2025-01-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"Any business processing personal data that is not a small business under SBA criteria."},{"id":"nhcdpa","market":"us","jurisdiction":{"id":"us-nh","label":"New Hampshire","iso":"US-NH","level":"state"},"shortName":"NHCDPA","fullName":"New Hampshire Consumer Data Privacy Act","promptLabel":"NHCDPA (New Hampshire)","officialUrl":"https://www.gencourt.state.nh.us/bill_status/billinfo.aspx?id=1662&inflect=2","effectiveDate":"2025-01-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"35,000+ New Hampshire consumers, or 10,000+ with revenue from selling data."},{"id":"njdpa","market":"us","jurisdiction":{"id":"us-nj","label":"New Jersey","iso":"US-NJ","level":"state"},"shortName":"NJDPA","fullName":"New Jersey Data Privacy Act","promptLabel":"NJDPA (New Jersey)","officialUrl":"https://pub.njleg.state.nj.us/Bills/2022/S0500/332_R4.PDF","effectiveDate":"2025-01-15","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"100,000+ New Jersey consumers, or 25,000+ with revenue from selling data."},{"id":"mcdpa","market":"us","jurisdiction":{"id":"us-mn","label":"Minnesota","iso":"US-MN","level":"state"},"shortName":"MCDPA","fullName":"Minnesota Consumer Data Privacy Act","promptLabel":"MCDPA (Minnesota)","officialUrl":"https://www.revisor.mn.gov/statutes/cite/325M","effectiveDate":"2025-07-31","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"100,000+ Minnesota consumers, or 25,000+ with revenue from selling data."},{"id":"modpa","market":"us","jurisdiction":{"id":"us-md","label":"Maryland","iso":"US-MD","level":"state"},"shortName":"MODPA","fullName":"Maryland Online Data Privacy Act","promptLabel":"MODPA (Maryland)","officialUrl":"https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541","effectiveDate":"2025-10-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","opt-out-sale","opt-out-profiling","non-discrimination"],"cookieRegime":"opt-out","honorsGlobalOptOut":true,"applicability":"35,000+ Maryland consumers, or 10,000+ with revenue from selling data. Bans the sale of sensitive data outright."},{"id":"pipeda","market":"ca","jurisdiction":{"id":"ca","label":"Canada","iso":"CA","level":"country"},"shortName":"PIPEDA","fullName":"Personal Information Protection and Electronic Documents Act","promptLabel":"PIPEDA","officialUrl":"https://laws-lois.justice.gc.ca/eng/acts/P-8.6/","authority":{"name":"Office of the Privacy Commissioner of Canada","url":"https://www.priv.gc.ca/en/"},"effectiveDate":"2001-01-01","documents":["privacy"],"rights":["access","rectification","withdraw-consent"],"cookieRegime":"opt-out","applicability":"Private-sector organisations handling personal information in commercial activity.","keyArticles":[{"ref":"Sch. 1, Principle 4.3","note":"Knowledge and consent of the individual"},{"ref":"Sch. 1, Principle 4.7","note":"Safeguards proportionate to sensitivity"},{"ref":"Sch. 1, Principle 4.9","note":"Individual access to their information"}]},{"id":"quebec-law-25","market":"ca","jurisdiction":{"id":"ca-qc","label":"Quebec","iso":"CA-QC","level":"state"},"shortName":"Law 25","fullName":"Act respecting the protection of personal information in the private sector (Quebec)","promptLabel":"Ley 25 (Quebec)","officialUrl":"https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1","authority":{"name":"Commission d'accès à l'information","url":"https://www.cai.gouv.qc.ca/"},"effectiveDate":"2024-09-22","documents":["privacy","cookies"],"rights":["access","rectification","erasure","portability","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Anyone collecting personal information of people in Quebec.","keyArticles":[{"ref":"s. 8","note":"Information to give when collecting personal information"},{"ref":"s. 27","note":"Right of access"},{"ref":"s. 28","note":"Right to rectification"}]},{"id":"casl","market":"ca","jurisdiction":{"id":"ca","label":"Canada","iso":"CA","level":"country"},"shortName":"CASL","fullName":"Canada's Anti-Spam Legislation","promptLabel":"CASL (comunicaciones comerciales, Canadá)","officialUrl":"https://laws-lois.justice.gc.ca/eng/acts/E-1.6/","effectiveDate":"2014-07-01","documents":["terms","privacy"],"rights":["withdraw-consent"],"cookieRegime":"opt-in","applicability":"Commercial electronic messages sent to recipients in Canada.","keyArticles":[{"ref":"s. 6","note":"Consent required before sending a commercial electronic message"},{"ref":"s. 11","note":"Every message must carry a working unsubscribe mechanism"}]},{"id":"lgpd","market":"latam","jurisdiction":{"id":"br","label":"Brazil","iso":"BR","level":"country"},"shortName":"LGPD","fullName":"Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018)","promptLabel":"LGPD (Brasil)","officialUrl":"https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm","authority":{"name":"Autoridade Nacional de Proteção de Dados (ANPD)","url":"https://www.gov.br/anpd/pt-br"},"effectiveDate":"2020-09-18","documents":["privacy","terms","dpa"],"rights":["access","rectification","erasure","portability","object","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Processing carried out in Brazil or aimed at offering goods or services in Brazil.","keyArticles":[{"ref":"Art. 7","note":"Legal bases for processing"},{"ref":"Art. 18","note":"Rights of the data subject"}]},{"id":"lfpdppp","market":"latam","jurisdiction":{"id":"mx","label":"Mexico","iso":"MX","level":"country"},"shortName":"LFPDPPP","fullName":"Ley Federal de Protección de Datos Personales en Posesión de los Particulares","promptLabel":"LFPDPPP (México)","officialUrl":"https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf","effectiveDate":"2010-07-06","documents":["privacy"],"rights":["access","rectification","erasure","object","withdraw-consent"],"cookieRegime":"opt-out","applicability":"Private parties processing personal data in Mexico. Requires an 'aviso de privacidad'."},{"id":"ar-25326","market":"latam","jurisdiction":{"id":"ar","label":"Argentina","iso":"AR","level":"country"},"shortName":"Ley 25.326","fullName":"Ley de Protección de los Datos Personales (Argentina)","promptLabel":"Ley 25.326 (Argentina)","officialUrl":"https://servicios.infoleg.gob.ar/infolegInternet/anexos/60000-64999/64790/norma.htm","effectiveDate":"2000-11-02","documents":["privacy"],"rights":["access","rectification","erasure","withdraw-consent"],"cookieRegime":"opt-out","applicability":"Data files and processing of personal data in Argentina."},{"id":"co-1581","market":"latam","jurisdiction":{"id":"co","label":"Colombia","iso":"CO","level":"country"},"shortName":"Ley 1581","fullName":"Ley 1581 de 2012, Régimen General de Protección de Datos Personales (Colombia)","promptLabel":"Ley 1581 (Colombia)","officialUrl":"https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981","effectiveDate":"2012-10-17","documents":["privacy"],"rights":["access","rectification","erasure","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing of personal data in Colombian territory."},{"id":"cl-21719","market":"latam","jurisdiction":{"id":"cl","label":"Chile","iso":"CL","level":"country"},"shortName":"Ley 21.719","fullName":"Ley 21.719 de protección de datos personales (Chile)","promptLabel":"Ley 21.719 (Chile)","officialUrl":"https://www.bcn.cl/leychile/navegar?idNorma=1208180","effectiveDate":"2026-12-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"New Chilean data-protection regime, replacing Ley 19.628 and creating a supervisory agency."},{"id":"pe-29733","market":"latam","jurisdiction":{"id":"pe","label":"Peru","iso":"PE","level":"country"},"shortName":"Ley 29733","fullName":"Ley de Protección de Datos Personales (Perú)","promptLabel":"Ley 29733 (Perú)","officialUrl":"https://www.gob.pe/institucion/minjus/normas-legales/243470-29733","effectiveDate":"2013-05-08","documents":["privacy"],"rights":["access","rectification","erasure","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Personal-data banks and processing in Peru."},{"id":"au-privacy-act","market":"apac","jurisdiction":{"id":"au","label":"Australia","iso":"AU","level":"country"},"shortName":"Privacy Act 1988","fullName":"Privacy Act 1988 (Cth) and the Australian Privacy Principles","promptLabel":"Privacy Act 1988 (Australia)","officialUrl":"https://www.legislation.gov.au/C2004A03712/latest/text","authority":{"name":"Office of the Australian Information Commissioner (OAIC)","url":"https://www.oaic.gov.au/"},"effectiveDate":"1988-12-21","documents":["privacy"],"rights":["access","rectification","object"],"cookieRegime":"opt-out","applicability":"Businesses with A$3M+ turnover, plus certain small businesses handling sensitive data.","keyArticles":[{"ref":"APP 1","note":"Open and transparent management: you must have a privacy policy"},{"ref":"APP 5","note":"Notify the individual when you collect their data"},{"ref":"APP 6","note":"Limits on use and disclosure"},{"ref":"APP 12","note":"Give the individual access to their data"}]},{"id":"appi","market":"apac","jurisdiction":{"id":"jp","label":"Japan","iso":"JP","level":"country"},"shortName":"APPI","fullName":"Act on the Protection of Personal Information (Japan)","promptLabel":"APPI (Japón)","officialUrl":"https://www.ppc.go.jp/en/legal/","authority":{"name":"Personal Information Protection Commission (PPC)","url":"https://www.ppc.go.jp/en/"},"effectiveDate":"2022-04-01","documents":["privacy"],"rights":["access","rectification","erasure","object","portability"],"cookieRegime":"opt-out","applicability":"Businesses handling personal information of people in Japan."},{"id":"pipa-kr","market":"apac","jurisdiction":{"id":"kr","label":"South Korea","iso":"KR","level":"country"},"shortName":"PIPA","fullName":"Personal Information Protection Act (South Korea)","promptLabel":"PIPA (Corea del Sur)","officialUrl":"https://www.pipc.go.kr/eng/user/lgp/law/lawsRegulations.do","authority":{"name":"Personal Information Protection Commission","url":"https://www.pipc.go.kr/eng/"},"effectiveDate":"2011-09-30","documents":["privacy"],"rights":["access","rectification","erasure","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Any handler of personal information of people in South Korea.","keyArticles":[{"ref":"Art. 15","note":"Conditions for collecting and using personal information"},{"ref":"Art. 17","note":"Providing personal information to third parties"},{"ref":"Art. 30","note":"Duty to publish a privacy policy"},{"ref":"Art. 35","note":"Right to access personal information"}]},{"id":"pdpa-sg","market":"apac","jurisdiction":{"id":"sg","label":"Singapore","iso":"SG","level":"country"},"shortName":"PDPA","fullName":"Personal Data Protection Act 2012 (Singapore)","promptLabel":"PDPA (Singapur)","officialUrl":"https://sso.agc.gov.sg/Act/PDPA2012","authority":{"name":"Personal Data Protection Commission","url":"https://www.pdpc.gov.sg/"},"effectiveDate":"2014-07-02","documents":["privacy"],"rights":["access","rectification","withdraw-consent","portability"],"cookieRegime":"opt-out","applicability":"Organisations collecting personal data in Singapore.","keyArticles":[{"ref":"s. 13","note":"Consent required before collecting, using or disclosing data"},{"ref":"s. 20","note":"Notify the individual of the purpose"},{"ref":"s. 21","note":"Right of access"},{"ref":"s. 26D","note":"Notify the Commission and affected individuals of a breach"}]},{"id":"nz-privacy-act","market":"apac","jurisdiction":{"id":"nz","label":"New Zealand","iso":"NZ","level":"country"},"shortName":"Privacy Act 2020","fullName":"Privacy Act 2020 (New Zealand)","promptLabel":"Privacy Act 2020 (Nueva Zelanda)","officialUrl":"https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html","authority":{"name":"Office of the Privacy Commissioner","url":"https://www.privacy.org.nz/"},"effectiveDate":"2020-12-01","documents":["privacy"],"rights":["access","rectification"],"cookieRegime":"opt-out","applicability":"Agencies handling personal information in New Zealand.","keyArticles":[{"ref":"IPP 3","note":"Tell people why you are collecting their data"},{"ref":"IPP 6","note":"Right of access"},{"ref":"IPP 11","note":"Limits on disclosure"},{"ref":"IPP 12","note":"Conditions for sending data overseas"}]},{"id":"pdpa-th","market":"apac","jurisdiction":{"id":"th","label":"Thailand","iso":"TH","level":"country"},"shortName":"PDPA","fullName":"Personal Data Protection Act B.E. 2562 (Thailand)","promptLabel":"PDPA (Tailandia)","authority":{"name":"PDPC Thailand","url":"https://www.pdpc.or.th/"},"effectiveDate":"2022-06-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing of personal data of people in Thailand, including from abroad."},{"id":"dpdp","market":"india","jurisdiction":{"id":"in","label":"India","iso":"IN","level":"country"},"shortName":"DPDP Act","fullName":"Digital Personal Data Protection Act, 2023 (India)","promptLabel":"DPDP Act 2023","officialUrl":"https://www.indiacode.nic.in/handle/123456789/22037","authority":{"name":"Ministry of Electronics and Information Technology","url":"https://www.meity.gov.in/"},"effectiveDate":"2026-11-01","documents":["privacy","terms"],"rights":["access","rectification","erasure","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing digital personal data in India, or outside India when offering goods or services in India.","keyArticles":[{"ref":"s. 5","note":"Notice to be given with or before a request for consent"},{"ref":"s. 6","note":"Consent must be free, specific, informed and unconditional"},{"ref":"s. 11","note":"Right to access information about processing"},{"ref":"s. 12","note":"Right to correction and erasure"},{"ref":"s. 13","note":"Right to grievance redressal"}]},{"id":"pipl","market":"china","jurisdiction":{"id":"cn","label":"China","iso":"CN","level":"country"},"shortName":"PIPL","fullName":"Personal Information Protection Law of the People's Republic of China","promptLabel":"PIPL","officialUrl":"http://www.npc.gov.cn/englishnpc/c23934/202112/1abd8829788946ecab270e469b13c39c.shtml","effectiveDate":"2021-11-01","documents":["privacy"],"rights":["access","rectification","erasure","portability","withdraw-consent","human-review"],"cookieRegime":"opt-in","applicability":"Processing personal information in China, or outside China to offer products or services to people in China. Separate consent is required per purpose.","keyArticles":[{"ref":"Art. 13","note":"Lawful bases for handling personal information"},{"ref":"Art. 14","note":"Consent must be voluntary, explicit and fully informed"},{"ref":"Art. 17","note":"Information to give before handling data"},{"ref":"Art. 38–39","note":"Conditions for transfers outside China"},{"ref":"Art. 44–50","note":"Rights of the individual"}]},{"id":"cn-csl","market":"china","jurisdiction":{"id":"cn","label":"China","iso":"CN","level":"country"},"shortName":"Cybersecurity Law","fullName":"Cybersecurity Law of the People's Republic of China","promptLabel":"Cybersecurity Law","effectiveDate":"2017-06-01","documents":["privacy","terms"],"rights":[],"cookieRegime":"opt-in","applicability":"Network operators in China: data localisation and security obligations."},{"id":"cn-dsl","market":"china","jurisdiction":{"id":"cn","label":"China","iso":"CN","level":"country"},"shortName":"Data Security Law","fullName":"Data Security Law of the People's Republic of China","promptLabel":"Data Security Law","effectiveDate":"2021-09-01","documents":["privacy","terms"],"rights":[],"cookieRegime":"unregulated","applicability":"Data-processing activities in China, with classification and cross-border rules."},{"id":"sa-pdpl","market":"mena","jurisdiction":{"id":"sa","label":"Saudi Arabia","iso":"SA","level":"country"},"shortName":"PDPL","fullName":"Personal Data Protection Law (Saudi Arabia)","promptLabel":"PDPL (Arabia Saudí)","authority":{"name":"SDAIA","url":"https://sdaia.gov.sa/en"},"effectiveDate":"2024-09-14","documents":["privacy"],"rights":["access","rectification","erasure","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing personal data of people in Saudi Arabia, including by entities outside the Kingdom."},{"id":"ae-pdpl","market":"mena","jurisdiction":{"id":"ae","label":"United Arab Emirates","iso":"AE","level":"country"},"shortName":"UAE PDPL","fullName":"Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data","promptLabel":"Ley de Protección de Datos (UAE)","officialUrl":"https://uaelegislation.gov.ae/en/legislations/1972","effectiveDate":"2022-01-02","documents":["privacy"],"rights":["access","rectification","erasure","portability","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing personal data of data subjects in the UAE (outside free-zone regimes)."},{"id":"tr-kvkk","market":"mena","jurisdiction":{"id":"tr","label":"Türkiye","iso":"TR","level":"country"},"shortName":"KVKK","fullName":"Kişisel Verilerin Korunması Kanunu (Law No. 6698, Türkiye)","promptLabel":"KVKK (Turquía)","officialUrl":"https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf","authority":{"name":"KVKK","url":"https://www.kvkk.gov.tr/"},"effectiveDate":"2016-04-07","documents":["privacy"],"rights":["access","rectification","erasure","object","human-review"],"cookieRegime":"opt-in","applicability":"Processing personal data of people in Türkiye.","keyArticles":[{"ref":"Art. 5","note":"Conditions for processing personal data"},{"ref":"Art. 10","note":"Duty to inform the data subject"},{"ref":"Art. 11","note":"Rights of the data subject"}]},{"id":"il-privacy-law","market":"mena","jurisdiction":{"id":"il","label":"Israel","iso":"IL","level":"country"},"shortName":"Privacy Protection Law","fullName":"Protection of Privacy Law, 5741-1981 (Israel)","promptLabel":"Protection of Privacy Law (Israel)","authority":{"name":"Privacy Protection Authority","url":"https://www.gov.il/en/departments/the_privacy_protection_authority"},"effectiveDate":"1981-01-01","documents":["privacy"],"rights":["access","rectification","erasure"],"cookieRegime":"opt-out","applicability":"Databases holding personal information about people in Israel."},{"id":"popia","market":"africa","jurisdiction":{"id":"za","label":"South Africa","iso":"ZA","level":"country"},"shortName":"POPIA","fullName":"Protection of Personal Information Act, 2013 (South Africa)","promptLabel":"POPIA (Sudáfrica)","officialUrl":"https://www.gov.za/documents/protection-personal-information-act","authority":{"name":"Information Regulator","url":"https://inforegulator.org.za/"},"effectiveDate":"2021-07-01","documents":["privacy"],"rights":["access","rectification","erasure","object","human-review"],"cookieRegime":"opt-in","applicability":"Processing personal information of people in South Africa.","keyArticles":[{"ref":"s. 11","note":"Conditions for lawful processing"},{"ref":"s. 18","note":"Notification when collecting personal information"},{"ref":"s. 22","note":"Notify the Regulator and the data subject of a breach"},{"ref":"s. 23","note":"Right of access to personal information"}]},{"id":"ng-ndpa","market":"africa","jurisdiction":{"id":"ng","label":"Nigeria","iso":"NG","level":"country"},"shortName":"NDPA","fullName":"Nigeria Data Protection Act, 2023","promptLabel":"NDPA (Nigeria)","authority":{"name":"Nigeria Data Protection Commission","url":"https://ndpc.gov.ng/"},"effectiveDate":"2023-06-14","documents":["privacy"],"rights":["access","rectification","erasure","portability","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing personal data of data subjects in Nigeria."},{"id":"ke-dpa","market":"africa","jurisdiction":{"id":"ke","label":"Kenya","iso":"KE","level":"country"},"shortName":"Kenya DPA","fullName":"Data Protection Act, 2019 (Kenya)","promptLabel":"Data Protection Act 2019 (Kenia)","authority":{"name":"Office of the Data Protection Commissioner","url":"https://www.odpc.go.ke/"},"effectiveDate":"2019-11-25","documents":["privacy"],"rights":["access","rectification","erasure","object","portability"],"cookieRegime":"opt-in","applicability":"Processing personal data of data subjects in Kenya."},{"id":"eg-pdpl","market":"africa","jurisdiction":{"id":"eg","label":"Egypt","iso":"EG","level":"country"},"shortName":"Egypt PDPL","fullName":"Personal Data Protection Law No. 151 of 2020 (Egypt)","promptLabel":"Ley de Protección de Datos 151/2020 (Egipto)","effectiveDate":"2020-10-15","documents":["privacy"],"rights":["access","rectification","erasure","object","withdraw-consent"],"cookieRegime":"opt-in","applicability":"Processing electronic personal data of data subjects in Egypt."},{"id":"oecd-privacy","market":"global","jurisdiction":{"id":"global","label":"International","level":"supranational"},"shortName":"OECD Privacy Guidelines","fullName":"OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data","promptLabel":"Mejores prácticas internacionales de privacidad (estándar OCDE)","officialUrl":"https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0188","effectiveDate":"1980-09-23","documents":["privacy","terms"],"rights":["access","rectification"],"cookieRegime":"opt-out","applicability":"Not binding law: the baseline of internationally accepted privacy practice, used where no local statute applies.","keyArticles":[{"ref":"Collection Limitation","note":"Collect lawfully, with knowledge or consent where appropriate"},{"ref":"Purpose Specification","note":"Say why you collect, before you collect"},{"ref":"Security Safeguards","note":"Protect data with reasonable safeguards"},{"ref":"Individual Participation","note":"Let people see and correct their data"},{"ref":"Accountability","note":"The controller answers for compliance"}]}],"jurisdictions":[{"id":"eu","label":"European Union","iso":"EU","level":"supranational"},{"id":"uk","label":"United Kingdom","iso":"GB","level":"country"},{"id":"ch","label":"Switzerland","iso":"CH","level":"country"},{"id":"us-ca","label":"California","iso":"US-CA","level":"state"},{"id":"us","label":"United States (federal)","iso":"US","level":"country"},{"id":"us-va","label":"Virginia","iso":"US-VA","level":"state"},{"id":"us-co","label":"Colorado","iso":"US-CO","level":"state"},{"id":"us-ct","label":"Connecticut","iso":"US-CT","level":"state"},{"id":"us-ut","label":"Utah","iso":"US-UT","level":"state"},{"id":"us-tx","label":"Texas","iso":"US-TX","level":"state"},{"id":"us-or","label":"Oregon","iso":"US-OR","level":"state"},{"id":"us-mt","label":"Montana","iso":"US-MT","level":"state"},{"id":"us-fl","label":"Florida","iso":"US-FL","level":"state"},{"id":"us-ia","label":"Iowa","iso":"US-IA","level":"state"},{"id":"us-tn","label":"Tennessee","iso":"US-TN","level":"state"},{"id":"us-de","label":"Delaware","iso":"US-DE","level":"state"},{"id":"us-ne","label":"Nebraska","iso":"US-NE","level":"state"},{"id":"us-nh","label":"New Hampshire","iso":"US-NH","level":"state"},{"id":"us-nj","label":"New Jersey","iso":"US-NJ","level":"state"},{"id":"us-mn","label":"Minnesota","iso":"US-MN","level":"state"},{"id":"us-md","label":"Maryland","iso":"US-MD","level":"state"},{"id":"ca","label":"Canada","iso":"CA","level":"country"},{"id":"ca-qc","label":"Quebec","iso":"CA-QC","level":"state"},{"id":"br","label":"Brazil","iso":"BR","level":"country"},{"id":"mx","label":"Mexico","iso":"MX","level":"country"},{"id":"ar","label":"Argentina","iso":"AR","level":"country"},{"id":"co","label":"Colombia","iso":"CO","level":"country"},{"id":"cl","label":"Chile","iso":"CL","level":"country"},{"id":"pe","label":"Peru","iso":"PE","level":"country"},{"id":"au","label":"Australia","iso":"AU","level":"country"},{"id":"jp","label":"Japan","iso":"JP","level":"country"},{"id":"kr","label":"South Korea","iso":"KR","level":"country"},{"id":"sg","label":"Singapore","iso":"SG","level":"country"},{"id":"nz","label":"New Zealand","iso":"NZ","level":"country"},{"id":"th","label":"Thailand","iso":"TH","level":"country"},{"id":"in","label":"India","iso":"IN","level":"country"},{"id":"cn","label":"China","iso":"CN","level":"country"},{"id":"sa","label":"Saudi Arabia","iso":"SA","level":"country"},{"id":"ae","label":"United Arab Emirates","iso":"AE","level":"country"},{"id":"tr","label":"Türkiye","iso":"TR","level":"country"},{"id":"il","label":"Israel","iso":"IL","level":"country"},{"id":"za","label":"South Africa","iso":"ZA","level":"country"},{"id":"ng","label":"Nigeria","iso":"NG","level":"country"},{"id":"ke","label":"Kenya","iso":"KE","level":"country"},{"id":"eg","label":"Egypt","iso":"EG","level":"country"},{"id":"global","label":"International","level":"supranational"}],"verticals":[{"id":"saas","label":"SaaS","processing":["account creation and authentication","subscription billing through a payment processor","product analytics and session tracking","transactional and marketing email"],"documents":["privacy","terms","cookies","dpa"]},{"id":"marketplace","label":"marketplace","processing":["personal data shared with third-party sellers or providers","payments and payouts, often through a split-payment processor","reviews and reputation data","advertising and retargeting pixels"],"documents":["privacy","terms","cookies","dpa"]},{"id":"ecommerce","label":"online store","processing":["orders, shipping addresses and delivery tracking","card payments through a processor","cart abandonment and marketing email","advertising pixels and conversion tracking"],"documents":["privacy","terms","cookies"]},{"id":"mobile-app","label":"mobile app","processing":["device identifiers and advertising IDs","device permissions such as camera, location or contacts","crash reporting and mobile analytics SDKs","in-app purchases through the store"],"documents":["privacy","terms"],"mobile":true},{"id":"ai-chatbot","label":"AI chatbot","processing":["conversation content sent to a model provider","prompts and outputs retained for quality or safety review","account data linked to conversation history"],"documents":["privacy","terms","ai"],"usesAI":true},{"id":"ai-image-generator","label":"AI image generator","processing":["uploaded images and prompts sent to a model provider","generated output stored and served publicly","content moderation of inputs and outputs"],"documents":["privacy","terms","ai"],"usesAI":true},{"id":"ai-writing-tool","label":"AI writing tool","processing":["user text sent to a model provider for completion","drafts and history stored per account","usage metering for billing"],"documents":["privacy","terms","ai"],"usesAI":true},{"id":"fintech","label":"fintech app","processing":["identity verification and KYC documents","bank account or card data through a regulated provider","transaction history and fraud signals"],"documents":["privacy","terms","dpa"]},{"id":"healthtech","label":"health app","processing":["health and wellbeing data, which is sensitive in most jurisdictions","explicit consent as the usual lawful basis","data shared with practitioners or providers"],"documents":["privacy","terms","dpa"]},{"id":"edtech","label":"education platform","processing":["learner records and progress data","data about minors, which triggers extra duties","school or institution as a separate controller"],"documents":["privacy","terms","dpa"]},{"id":"community","label":"community platform","processing":["user-generated content and public profiles","moderation records and reports","notification email and push"],"documents":["privacy","terms","cookies"]},{"id":"newsletter","label":"newsletter","processing":["email addresses collected through a signup form","open and click tracking","list data held by an email service provider"],"documents":["privacy","terms","cookies"]},{"id":"booking","label":"booking site","processing":["reservation details and contact data","deposits or payments through a processor","reminders by email or SMS"],"documents":["privacy","terms","cookies"]},{"id":"portfolio","label":"portfolio site","processing":["contact form submissions","basic web analytics","embedded third-party content such as fonts, maps or video"],"documents":["privacy","cookies"]}],"ai_act":{"timeline":{"regulation":{"shortName":"EU AI Act","fullName":"Artificial Intelligence Act (Regulation (EU) 2024/1689)","officialUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj"},"note":"Dates reflect the digital Omnibus adopted in June 2026, which postponed the Annex III and Annex I high-risk obligations. Transparency duties under Article 50 were NOT postponed.","milestones":[{"id":"prohibited","date":"2025-02-02","applies":"Prohibited practices (Article 5) — already in force."},{"id":"gpai","date":"2025-08-02","applies":"Obligations for providers of general-purpose AI models."},{"id":"transparency","date":"2026-08-02","applies":"Article 50 transparency duties: tell people they are interacting with an AI system, and mark AI-generated content."},{"id":"marking-grace-end","date":"2026-12-02","applies":"End of the Omnibus grace period: generative systems already on the market must carry machine-readable marking of generated content (Art. 50(2))."},{"id":"high-risk-annex-iii","date":"2027-12-02","applies":"High-risk obligations for standalone Annex III systems."},{"id":"high-risk-annex-i","date":"2028-08-02","applies":"High-risk obligations for systems embedded in regulated products (Annex I)."}]},"obligations":{"limited":[{"key":"discloseAi","title":"Disclose that it is AI","description":"Clearly inform people when they are interacting with an AI system.","deadline":"2026-08-02"},{"key":"labelAiContent","title":"Label AI-generated content","description":"Mark synthetic content (text, image, audio) as AI-generated. Systems already placed on the market before 2 Aug 2026 have until 2 Dec 2026 for machine-readable marking (digital Omnibus).","deadline":"2026-08-02"}],"high":[{"key":"riskManagement","title":"Risk management system","description":"Identify and mitigate the AI system's risks across its whole lifecycle.","deadline":"2027-12-02"},{"key":"dataGovernance","title":"Data governance","description":"Ensure the training and operational data are of adequate quality and representative.","deadline":"2027-12-02"},{"key":"technicalDocs","title":"Technical documentation","description":"Keep documentation that demonstrates conformity (this report is a starting point).","deadline":"2027-12-02"},{"key":"humanOversight","title":"Human oversight","description":"Guarantee that a person can oversee and, where needed, override decisions.","deadline":"2027-12-02"},{"key":"transparencyLogging","title":"Transparency and logging","description":"Inform users and log the system's relevant events.","deadline":"2027-12-02"},{"key":"accuracyRobustness","title":"Accuracy, robustness and cybersecurity","description":"Design the system for an appropriate level of accuracy, robustness and cybersecurity throughout its lifecycle (art. 15).","deadline":"2027-12-02"},{"key":"conformityCe","title":"Conformity assessment and CE marking","description":"Complete the conformity assessment and affix the CE marking (arts. 43 and 48). For most Annex III systems, self-assessment through internal control is enough — no notified body required.","deadline":"2027-12-02"},{"key":"euDatabase","title":"Registration in the EU database","description":"Register the system in the EU public database of high-risk systems before putting it into service (art. 49).","deadline":"2027-12-02"}],"prohibited":[{"key":"ceaseProhibited","title":"Cease or redesign the prohibited use","description":"These practices are not allowed in the EU except under very narrow exceptions.","deadline":"2025-02-02"}]}},"watched_changes":[{"id":"eu-ai-act-transparency-2026","label":"EU AI Act — obligaciones de transparencia (art. 50)","summary":"Aplican las obligaciones de transparencia del Reglamento de IA: avisar de que se interactúa con IA y etiquetar el contenido generado. El Omnibus digital (adoptado en junio de 2026) mantiene esta fecha.","effectiveDate":"2026-08-02","markets":["eu"],"affects":["privacy","ai_notice"]},{"id":"eu-ai-act-marking-grace-2026","label":"EU AI Act — fin de la gracia para el marcado de contenido (Omnibus digital)","summary":"Termina el periodo de gracia del Omnibus digital: los sistemas de IA generativa ya comercializados antes del 2 de agosto de 2026 deben incorporar el marcado legible por máquina del contenido generado (art. 50.2).","effectiveDate":"2026-12-02","markets":["eu"],"affects":["ai_notice"]},{"id":"eu-ai-act-high-risk-2027","label":"EU AI Act — sistemas de alto riesgo (Anexo III)","summary":"Aplican las obligaciones para sistemas de alto riesgo independientes del Anexo III, aplazadas del 2 de agosto de 2026 al 2 de diciembre de 2027 por el Omnibus digital; los sistemas embebidos en productos regulados (Anexo I) pasan al 2 de agosto de 2028.","effectiveDate":"2027-12-02","markets":["eu"],"affects":["privacy","ai_notice"]},{"id":"eu-ai-act-high-risk-annex1-2028","label":"EU AI Act — sistemas de alto riesgo embebidos (Anexo I)","summary":"Aplican las obligaciones para sistemas de IA de alto riesgo embebidos en productos regulados (Anexo I), aplazadas al 2 de agosto de 2028 por el Omnibus digital.","effectiveDate":"2028-08-02","markets":["eu"],"affects":["privacy","ai_notice"]},{"id":"eu-data-act-2025","label":"EU Data Act","summary":"Nuevas reglas de acceso y portabilidad de datos generados por productos y servicios conectados.","effectiveDate":"2025-09-12","markets":["eu"],"affects":["terms","privacy"]},{"id":"us-cpra-updates-2026","label":"CPRA (California) — actualizaciones","summary":"Actualización de los derechos del consumidor de California y nuevas obligaciones de divulgación.","effectiveDate":"2026-01-01","markets":["us"],"affects":["privacy","cookie_policy"]},{"id":"br-lgpd-2020","label":"LGPD (Brasil)","summary":"Ley General de Protección de Datos de Brasil: base legal del tratamiento, derechos del titular y figura del encargado.","effectiveDate":"2020-09-18","markets":["latam"],"affects":["privacy","terms"]},{"id":"cn-pipl-2021","label":"PIPL (China)","summary":"Ley de Protección de Información Personal de China: consentimiento separado, evaluación de impacto y reglas estrictas para transferencias fuera de China.","effectiveDate":"2021-11-01","markets":["china"],"affects":["privacy"]},{"id":"za-popia-2021","label":"POPIA (Sudáfrica)","summary":"Protection of Personal Information Act: condiciones para el tratamiento lícito y derechos del titular en Sudáfrica.","effectiveDate":"2021-07-01","markets":["africa"],"affects":["privacy"]},{"id":"jp-appi-2022","label":"APPI (Japón) — reforma","summary":"Reforma de la Act on the Protection of Personal Information: notificación de brechas y reglas para transferencias internacionales.","effectiveDate":"2022-04-01","markets":["apac"],"affects":["privacy"]},{"id":"ca-quebec-law25-2024","label":"Ley 25 (Quebec)","summary":"Tercera fase de la Ley 25: derecho a la portabilidad de datos y obligaciones reforzadas de consentimiento en Quebec.","effectiveDate":"2024-09-22","markets":["ca"],"affects":["privacy"]},{"id":"ch-nfadp-2023","label":"nFADP (Suiza)","summary":"Nueva Ley Federal de Protección de Datos suiza: alineación parcial con el RGPD y registro de actividades de tratamiento.","effectiveDate":"2023-09-01","markets":["ch"],"affects":["privacy"]},{"id":"sa-pdpl-2024","label":"PDPL (Arabia Saudí)","summary":"Personal Data Protection Law: consentimiento, registro de tratamientos y reglas de transferencia transfronteriza en Arabia Saudí.","effectiveDate":"2024-09-14","markets":["mena"],"affects":["privacy"]},{"id":"au-privacy-reform-2024","label":"Privacy Act (Australia) — primera reforma","summary":"Primer paquete de reformas de la Privacy Act australiana: mayor poder sancionador y transparencia en decisiones automatizadas.","effectiveDate":"2024-12-10","markets":["apac"],"affects":["privacy"]},{"id":"in-dpdp-rules-2026","label":"DPDP Act (India) — reglas de aplicación","summary":"Entrada en vigor de las reglas que desarrollan el Digital Personal Data Protection Act 2023: consentimiento verificable y obligaciones del fiduciario de datos.","effectiveDate":"2026-11-01","markets":["india"],"affects":["privacy","terms"]},{"id":"uk-dua-act-2026","label":"Data (Use and Access) Act (Reino Unido)","summary":"Reforma del régimen de datos del Reino Unido: ajustes al UK GDPR, cookies y decisiones automatizadas.","effectiveDate":"2026-06-01","markets":["uk"],"affects":["privacy","terms","cookie_policy"]},{"id":"eu-ai-act-gpai-2025","label":"EU AI Act — modelos de propósito general (GPAI)","summary":"Obligaciones para proveedores de modelos de IA de propósito general: documentación técnica y resúmenes de datos de entrenamiento.","effectiveDate":"2025-08-02","markets":["eu"],"affects":["ai_notice"]}]}