Resource Center / Tools and Trackers / IAPP Key Dates 2025
IAPP Key Dates 2025
This calendar includes key dates for significant legislative requirements, regulatory consultation periods, major anniversaries and IAPP events.
Published: July 2025
Contributors:
The work of privacy, AI governance and digital responsibility is well punctuated by a drum-beat of key dates and events. This calendar for 2025 includes key dates for the entry into force of some of the more significant legislative requirements, regulatory consultation periods, major anniversaries and IAPP events.
The calendar will be updated with valuable input from the global community of privacy, AI governance and digital responsibility professionals, and we continue to welcome feedback and insights from this community. If you are aware of relevant information absent from the calendar, please share it with us at research@iapp.org.
Directory
IAPP Key Dates 2025
This section provides a directory of this resource, sorted by category. This resource is also available as an infographic in PDF format here.
-
expand_more
★ Events and Anniversaries
13-18 January
★ EVENTS AND ANNIVERSARIES
Congreso Futuro in Santiago, Chile.
28 January
★ EVENTS AND ANNIVERSARIES
International Data Protection Day.
12-13 March
★ EVENTS AND ANNIVERSARIES
IAPP Data Protection Intensive: UK 2025 in London.
23-24 April
★ EVENTS AND ANNIVERSARIES
IAPP Global Privacy Summit 2025 in Washington, D.C.
23 April
★ EVENTS AND ANNIVERSARIES
Eleventh anniversary of the Brazilian Civil Rights Framework for the Internet.
12-13 May
★ EVENTS AND ANNIVERSARIES
IAPP Canada Privacy Symposium 2025 in Toronto.
14-15 May
★ EVENTS AND ANNIVERSARIES
IAPP AI Governance Global Europe 2025 in Dublin.
25 May
★ EVENTS AND ANNIVERSARIES
Seventh anniversary of the EU General Data Protection Regulation.
16-22 June
★ EVENTS AND ANNIVERSARIES
Privacy Awareness Week in Australia.
25-26 June
★ EVENTS AND ANNIVERSARIES
IAPP Navigate: A Digital Policy Leadership Retreat 2025 in Portsmouth, New Hampshire, U.S.
7-10 July
★ EVENTS AND ANNIVERSARIES
Personal Data Protection Week 2025 in Singapore.
9-10 July
★ EVENTS AND ANNIVERSARIES
IAPP Asia Privacy Forum 2025 in Singapore.
14 August
★ EVENTS AND ANNIVERSARIES
Seventh anniversary of Brazil’s General Personal Data Protection Law.
9 September
★ EVENTS AND ANNIVERSARIES
IAPP call for volunteers opens.
15-19 September
★ EVENTS AND ANNIVERSARIES
47th Global Privacy Assembly, Seoul, South Korea.
18-19 September
★ EVENTS AND ANNIVERSARIES
IAPP AI Governance Global North America 2025 in Boston.
28 September
★ EVENTS AND ANNIVERSARIES
International Day for Universal Access to Information.
3 October
★ EVENTS AND ANNIVERSARIES
IAPP call for volunteers closes.
30-31 October
★ EVENTS AND ANNIVERSARIES
IAPP Privacy. Security. Risk. 2025 in San Diego.
19-20 November
★ EVENTS AND ANNIVERSARIES
IAPP Europe Data Protection Congress 2025 in Brussels.
7 December
★ EVENTS AND ANNIVERSARIES
Twenty-fifth anniversary of the signing of the Charter of Fundamental Rights of the EU.
27 December
★ EVENTS AND ANNIVERSARIES
EU adequacy decisions for the U.K. from 2021 expire.
-
expand_more
■ Legislative
1 January
■ LEGISLATIVE
California Consumer Privacy Act amendments on sensitive personal information, opt outs and AI go into effect.
■ LEGISLATIVE
Chile's Cybersecurity Framework law partially goes into effect.
■ LEGISLATIVE
Right to cure expires under U.S. state privacy laws in Colorado and Connecticut.
■ LEGISLATIVE
New comprehensive U.S. state privacy laws go into effect in Delaware, Iowa, Nebraska and New Hampshire.
■ LEGISLATIVE
Consumer opt-out requirements in U.S. state privacy laws go into effect in Connecticut, Montana, New Hampshire and Texas.
■ LEGISLATIVE
Minnesota's data protection assessment requirements go into effect.
15 January
■ LEGISLATIVE
New Jersey Data Privacy Act goes into effect.
17 January
■ LEGISLATIVE
EU Digital Operational Resilience Act and its requirement for member states to notify of applicable implementation rules go into effect.
2 February
■ LEGISLATIVE
EU AI Act requirements regarding prohibited AI and mandatory AI literacy go into effect.
1 March
■ LEGISLATIVE
Remaining provisions in Chile's Cybersecurity Framework Law go into effect.
30 March
■ LEGISLATIVE
Peru's regulations on personal data protection go into effect.
1 April
■ LEGISLATIVE
Amendments to Malaysia's Personal Data Protection Act 2024 go into effect.
30 May
■ LEGISLATIVE
Deadline for parts 3 and 5 of Australia’s Cyber Security Act 2024 to come into effect, unless otherwise proclaimed.
1 June
■ LEGISLATIVE
Amendments to Malaysia's Personal Data Protection Act 2024 go into effect.
11 June
■ LEGISLATIVE
Deadline for Schedule 2 of Australia's Privacy and Other Legislation Amendment Act 2024 to come into effect.
19 June
■ LEGISLATIVE
U.K. Data (Use and Access) Act becomes law.
■ LEGISLATIVE
Ontario’s Digital Platform Workers’ Rights Act, 2022 goes into effect.
20 June
■ LEGISLATIVE
New York's Child Data Protection Act goes into effect.
1 July
■ LEGISLATIVE
Colorado's obligations regarding biometric data go into effect.
■ LEGISLATIVE
Oregon Consumer Privacy Act exemption for 501(c)(3) tax exempt organization expires.
■ LEGISLATIVE
Vietnam's Data Law goes into effect.
31 July
■ LEGISLATIVE
Minnesota Consumer Data Privacy Act goes into effect.
2 August
■ LEGISLATIVE
EU AI Act provisions on notified bodies and governance structure and obligations for providers of general-purpose AI go into effect.
■ LEGISLATIVE
Deadline for EU member states to designate authorities for EU AI Act oversight.
18 August
■ LEGISLATIVE
EU DSA codes of conduct go into effect.
■ LEGISLATIVE
European Commission adopts EU e-evidence implementing acts and member states designate competent authorities.
12 September
■ LEGISLATIVE
EU Data Act goes into effect.
24 September
■ LEGISLATIVE
EU data governance requirements for entities providing data intermediation services go into effect.
25 September
■ LEGISLATIVE
EU Data Governance Act evaluation and review.
1 October
■ LEGISLATIVE
Maryland Online Data Privacy Act goes into effect.
■ LEGISLATIVE
Colorado Privacy Act amendments related to minors go into effect.
30 November
■ LEGISLATIVE
Deadline for part 2 of Australia's Cyber Security Act 2024 to go into effect.
11 December
■ LEGISLATIVE
European Commission adopts implementing and delegated acts under the Cyber Resilience Act.
■ LEGISLATIVE
Deadline for the minister for communications to specify the date of effect for civil penalties under Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024.
31 December
■ LEGISLATIVE
Mandatory right to cure period expires in Delaware and New Hampshire.
■ LEGISLATIVE
Indiana Data Privacy Law data protection assessment requirements go into effect.
-
expand_more
◆ Regulatory
1 January
◆ REGULATORY
China's Network Data Security Management Regulation goes into effect.
2 January
◆ REGULATORY
Chile's National Cybersecurity Agency begins operations.
3 January
◆ REGULATORY
India's Ministry of Electronics and Information Technology releases draft Digital Personal Data Protection rules for public consultation.
14 January
◆ REGULATORY
California Privacy Protection Agency public comment hearing.
15 January
◆ REGULATORY
Deadline to apply for the Data Governance Working Group.
16 January
◆ REGULATORY
European Data Protection Board plenary meeting.
17 January
◆ REGULATORY
Deadline for EU member states to notify the European Commission of promulgated rules under the Network and Information Security Directive.
24 January
◆ REGULATORY
Deadline to submit feedback to Brazil's National Data Protection Agency about proposed regulations on AI and automated decision-making.
27 January
◆ REGULATORY
Public consultation closes on India's AI governance guidelines development report.
29 January
◆ REGULATORY
Public consultation closes on U.K. AI Management Essentials tool.
TBA January
◆ REGULATORY
U.K. Office of Communications launches consultation on children's access assessment guidelines.
18 February
◆ REGULATORY
Deadline to develop EU Digital Services Act codes of conduct.
◆ REGULATORY
Deadline to submit feedback for India's proposed Digital Data Protection Act rules.
19 February
◆ REGULATORY
Deadline to submit comments on proposed CCPA regulations.
21 February
◆ REGULATORY
Deadline for data controllers to report data subject complaints from July-Dec. 2024 to Colombia's National Database Registry.
28 February
◆ REGULATORY
Deadline for industry bodies to submit Phase 2 industry codes to the eSafety Commissioner of Australia.
TBA February
◆ REGULATORY
Ofcom launches consultation on Online Safety Act guidance for protecting women and girls.
6 March
◆ REGULATORY
Deadline for registration of special representatives with Ecuador's Data Protection Authority.
13 March
◆ REGULATORY
EDPB plenary meeting.
17 March
◆ REGULATORY
Ofcom disclosure requirements for specific services and Illegal Harms Codes of Practice go into effect.
31 March
◆ REGULATORY
Deadline for data controllers in Colombia to update personal databases.
17 April
◆ REGULATORY
NIS2 Directive compliance reporting requirement goes into effect.
24 April
◆ REGULATORY
Ofcom publishes children's risk assessment guidance and first version of the Protection of Children Codes of Practice.
30 April
◆ REGULATORY
Deadline for Ecuador's DPA to submit secondary regulations proposals.
2 May
◆ REGULATORY
Deadline for EU AI Act codes of practice publication.
6 May
◆ REGULATORY
EPDB plenary meeting.
3 June
◆ REGULATORY
EPDB plenary meeting.
13 June
◆ REGULATORY
Deadline to publish regulations under Chile's Law on the Protection of Private Life.
30 June
◆ REGULATORY
Deadline to submit consultation feedback to Canada's Innovation Science and Economic Development department on implementing the Global Cross-Border Privacy Rules.
8 July
◆ REGULATORY
EPDB plenary meeting.
24 July
◆ REGULATORY
Deadline for U.K. children's risk assessments under the Online Safety Act.
31 July
◆ REGULATORY
Ofcom's children's risk assessment disclosure requirements go into effect.
5 August
◆ REGULATORY
Deadline to submit comments to Office of the Privacy Commissioner of Canada on the exploratory consultation on the children’s privacy code.
12 August
◆ REGULATORY
Deadline for regulations under Peru's Cyber Defense Law.
23 August
◆ REGULATORY
Deadline for Brazilian data controllers to incorporate new standard contractual clauses into data transfer agreements.
25 August
◆ REGULATORY
Deadline for data controllers in Colombia to report data subject complaints from January-June 2025.
1 September
◆ REGULATORY
The Cyberspace Administration of China’s new AI Labeling Measures go into effect.
30 September
◆ REGULATORY
Right to data portability in Peru goes into effect.
1 October
◆ REGULATORY
New standards from China’s National Information Security Standardization Technical Committee (TC260) go into effect.
7 October
◆ REGULATORY
EPDB plenary meeting.
4 November
◆ REGULATORY
EPDB plenary meeting.
17 November
◆ REGULATORY
Deadline for the European Commission to evaluate the DSA.
30 November
◆ REGULATORY
Deadline for certain entities to appoint a personal data officer in Peru.
IAPP Key Dates 2025
This section provides a timeline of this resource, sorted by month. This resource is also available as an infographic in PDF format here.
-
expand_more
January
1 January
◆ REGULATORY
China's Network Data Security Management Regulation goes into effect.
■ LEGISLATIVE
Chile's Cybersecurity Framework law partially goes into effect.
■ LEGISLATIVE
California Consumer Privacy Act amendments on sensitive personal information, opt outs and AI go into effect.
■ LEGISLATIVE
Right to cure expires under U.S. state privacy laws in Colorado and Connecticut.
■ LEGISLATIVE
New comprehensive U.S. state privacy laws go into effect in Delaware, Iowa, Nebraska and New Hampshire.
■ LEGISLATIVE
Consumer opt-out requirements in U.S. state privacy laws go into effect in Connecticut, Montana, New Hampshire and Texas.
■ LEGISLATIVE
Minnesota's data protection assessment requirements go into effect.
2 January
◆ REGULATORY
Chile's National Cybersecurity Agency begins operations.
3 January
◆ REGULATORY
India's Ministry of Electronics and Information Technology releases draft Digital Personal Data Protection rules for public consultation.
13-18 January
★ EVENTS AND ANNIVERSARIES
Congreso Futuro in Santiago, Chile.
14 January
◆ REGULATORY
California Privacy Protection Agency public comment hearing.
15 January
■ LEGISLATIVE
New Jersey Data Privacy Act goes into effect.
◆ REGULATORY
Deadline to apply for the Data Governance Working Group.
16 January
◆ REGULATORY
European Data Protection Board plenary meeting.
17 January
■ LEGISLATIVE
EU Digital Operational Resilience Act and its requirement for member states to notify of applicable implementation rules go into effect.
◆ REGULATORY
Deadline for EU member states to notify the European Commission of promulgated rules under the Network and Information Security Directive.
24 January
◆ REGULATORY
Deadline to submit feedback to Brazil's National Data Protection Agency about proposed regulations on AI and automated decision-making.
27 January
◆ REGULATORY
Public consultation closes on India's AI governance guidelines development report.
28 January
★ EVENTS AND ANNIVERSARIES
International Data Protection Day.
29 January
◆ REGULATORY
Public consultation closes on U.K. AI Management Essentials tool.
TBA
◆ REGULATORY
U.K. Office of Communications launches consultation on children's access assessment guidelines.
-
expand_more
February
2 February
■ LEGISLATIVE
EU AI Act requirements regarding prohibited AI and mandatory AI literacy go into effect.
18 February
◆ REGULATORY
Deadline to develop EU Digital Services Act codes of conduct.
10-11 February
★ EVENTS AND ANNIVERSARIES
AI Action Summit in Paris.
18 February
◆ REGULATORY
Deadline to develop EU Digital Services Act codes of conduct.
◆ REGULATORY
Deadline to submit feedback for India's proposed Digital Data Protection Act rules.
19 February
◆ REGULATORY
Deadline to submit comments on proposed CCPA regulations.
21 February
◆ REGULATORY
Deadline for data controllers to report data subject complaints from July-Dec. 2024 to Colombia's National Database Registry.
28 February
◆ REGULATORY
Deadline for industry bodies to submit Phase 2 industry codes to the eSafety Commissioner of Australia.
TBA
◆ REGULATORY
Ofcom launches consultation on Online Safety Act guidance for protecting women and girls.
-
expand_more
March
1 March
■ LEGISLATIVE
Remaining provisions in Chile's Cybersecurity Framework Law go into effect.
6 March
◆ REGULATORY
Deadline for registration of special representatives with Ecuador's Data Protection Authority.
12-13 March
★ EVENTS AND ANNIVERSARIES
IAPP Data Protection Intensive: UK 2025 in London.
13 March
◆ REGULATORY
EDPB plenary meeting.
17 March
◆ REGULATORY
Ofcom disclosure requirements for specific services and Illegal Harms Codes of Practice go into effect.
30 March
■ LEGISLATIVE
Peru's regulations on personal data protection go into effect.
31 March
◆ REGULATORY
Deadline for data controllers in Colombia to update personal databases.
-
expand_more
April
1 April
■ LEGISLATIVE
Amendments to Malaysia's Personal Data Protection Act 2024 go into effect.
17 April
◆ REGULATORY
NIS2 Directive compliance reporting requirement goes into effect.
23-24 April
★ EVENTS AND ANNIVERSARIES
IAPP Global Privacy Summit 2025 in Washington, D.C.
23 April
★ EVENTS AND ANNIVERSARIES
Eleventh anniversary of the Brazilian Civil Rights Framework for the Internet.
24 April
◆ REGULATORY
Ofcom publishes children's risk assessment guidance and first version of the Protection of Children Codes of Practice.
30 April
◆ REGULATORY
Deadline for Ecuador's DPA to submit secondary regulations proposals.
-
expand_more
May
2 May
◆ REGULATORY
Deadline for EU AI Act codes of practice publication.
6 May
◆ REGULATORY
EPDB plenary meeting.
12-13 May
★ EVENTS AND ANNIVERSARIES
IAPP Canada Privacy Symposium 2025 in Toronto.
14-15 May
★ EVENTS AND ANNIVERSARIES
IAPP AI Governance Global Europe 2025 in Dublin.
25 May
★ EVENTS AND ANNIVERSARIES
Seventh anniversary of the EU General Data Protection Regulation.
30 May
■ LEGISLATIVE
Deadline for parts 3 and 5 of Australia’s Cyber Security Act 2024 to come into effect, unless otherwise proclaimed.
-
expand_more
June
1 June
■ LEGISLATIVE
Amendments to Malaysia's Personal Data Protection Act 2024 go into effect.
3 June
◆ REGULATORY
EPDB plenary meeting.
11 June
■ LEGISLATIVE
Deadline for Schedule 2 of Australia's Privacy and Other Legislation Amendment Act 2024 to come into effect.
13 June
◆ REGULATORY
Deadline to publish regulations under Chile's Law on the Protection of Private Life.
16-22 June
★ EVENTS AND ANNIVERSARIES
Privacy Awareness Week in Australia.
19 June
■ LEGISLATIVE
U.K. Data (Use and Access) Act becomes law.
20 June
■ LEGISLATIVE
New York's Child Data Protection Act goes into effect.
25-26 June
★ EVENTS AND ANNIVERSARIES
IAPP Navigate: A Digital Policy Leadership Retreat 2025 in Portsmouth, New Hampshire, U.S.
30 June
◆ REGULATORY
Deadline to submit consultation feedback to Canada's Innovation Science and Economic Development department on implementing the Global Cross-Border Privacy Rules.
-
expand_more
July
1 July
■ LEGISLATIVE
Colorado's obligations regarding biometric data go into effect.
■ LEGISLATIVE
Ontario’s Digital Platform Workers’ Rights Act, 2022 goes into effect.
■ LEGISLATIVE
Oregon Consumer Privacy Act exemption for 501(c)(3) tax exempt organization expires.
■ LEGISLATIVE
Vietnam's Data Law goes into effect.
7-10 July
★ EVENTS AND ANNIVERSARIES
Personal Data Protection Week 2025 in Singapore.
9-10 July
★ EVENTS AND ANNIVERSARIES
IAPP Asia Privacy Forum 2025 in Singapore.
8 July
◆ REGULATORY
EPDB plenary meeting.
24 July
◆ REGULATORY
Deadline for U.K. children's risk assessments under the Online Safety Act.
31 July
■ LEGISLATIVE
Minnesota Consumer Data Privacy Act goes into effect.
◆ REGULATORY
Ofcom's children's risk assessment disclosure requirements go into effect.
-
expand_more
August
2 August
■ LEGISLATIVE
EU AI Act provisions on notified bodies and governance structure and obligations for providers of general-purpose AI go into effect.
■ LEGISLATIVE
Deadline for EU member states to designate authorities for EU AI Act oversight.
5 August
◆ REGULATORY
Deadline to submit comments to Office of the Privacy Commissioner of Canada on the exploratory consultation on the children’s privacy code.
12 August
◆ REGULATORY
Deadline for regulations under Peru's Cyber Defense Law.
14 August
★ EVENTS AND ANNIVERSARIES
Seventh anniversary of Brazil’s General Personal Data Protection Law.
18 August
■ LEGISLATIVE
EU DSA codes of conduct go into effect.
■ LEGISLATIVE
European Commission adopts EU e-evidence implementing acts and member states designate competent authorities.
23 August
◆ REGULATORY
Deadline for Brazilian data controllers to incorporate new standard contractual clauses into data transfer agreements.
25 August
◆ REGULATORY
Deadline for data controllers in Colombia to report data subject complaints from January-June 2025.
-
expand_more
September
1 September
◆ REGULATORY
The Cyberspace Administration of China’s new AI Labeling Measures go into effect.
9 September
★ EVENTS AND ANNIVERSARIES
IAPP call for volunteers opens.
12 September
■ LEGISLATIVE
EU Data Act goes into effect.
15-19 September
★ EVENTS AND ANNIVERSARIES
47th Global Privacy Assembly, Seoul, South Korea.
18-19 September
★ EVENTS AND ANNIVERSARIES
IAPP AI Governance Global North America 2025 in Boston.
24 September
■ LEGISLATIVE
EU data governance requirements for entities providing data intermediation services go into effect.
25 September
■ LEGISLATIVE
EU Data Governance Act evaluation and review.
28 September
★ EVENTS AND ANNIVERSARIES
International Day for Universal Access to Information.
30 September
◆ REGULATORY
Right to data portability in Peru goes into effect.
-
expand_more
October
1 October
◆ REGULATORY
New standards from China’s National Information Security Standardization Technical Committee (TC260) go into effect.
■ LEGISLATIVE
Maryland Online Data Privacy Act goes into effect.
■ LEGISLATIVE
Colorado Privacy Act amendments related to minors go into effect.
3 October
★ EVENTS AND ANNIVERSARIES
IAPP call for volunteers closes.
7 October
◆ REGULATORY
EPDB plenary meeting.
30-31 October
★ EVENTS AND ANNIVERSARIES
IAPP Privacy. Security. Risk. 2025 in San Diego.
-
expand_more
November
4 November
◆ REGULATORY
EPDB plenary meeting.
17 November
◆ REGULATORY
Deadline for the European Commission to evaluate the DSA.
19-20 November
★ EVENTS AND ANNIVERSARIES
IAPP Europe Data Protection Congress 2025 in Brussels.
30 November
◆ REGULATORY
Deadline for certain entities to appoint a personal data officer in Peru.
■ LEGISLATIVE
Deadline for part 2 of Australia's Cyber Security Act 2024 to go into effect.
-
expand_more
December
7 December
★ EVENTS AND ANNIVERSARIES
Twenty-fifth anniversary of the signing of the Charter of Fundamental Rights of the EU.
11 December
■ LEGISLATIVE
European Commission adopts implementing and delegated acts under the Cyber Resilience Act.
■ LEGISLATIVE
Deadline for the minister for communications to specify the date of effect for civil penalties under Australia's Online Safety Amendment (Social Media Minimum Age) Act 2024.
27 December
★ EVENTS AND ANNIVERSARIES
EU adequacy decisions for the U.K. from 2021 expire.
31 December
■ LEGISLATIVE
Mandatory right to cure period expires in Delaware and New Hampshire.
■ LEGISLATIVE
Indiana Data Privacy Law data protection assessment requirements go into effect.