AI and data laws

Moving311Enacted704

311 moving · 704 enacted

Data

202 on file · 147 became law · 33 still moving · 5 moved in 30 days

New Mexico
New MexicoSB 40

Driver Privacy and Safety Act

Enacts the Driver Privacy and Safety Act, limiting the sharing of automated license plate reader information and requiring reporting, with enforcement and penalties.

In force
Brazil
BrazilLei 15.352/2026 (conversion of Medida Provisoria 1.317/2025)

Law restructuring the ANPD as the National Data Protection Agency

Amends the LGPD to establish the Agencia Nacional de Protecao de Dados (ANPD) as a special autonomous federal agency, creates a data protection regulation and enforcement career, and sets the ECA Digital's entry into force for 2026-03-17.

In force
United Kingdom
United Kingdom2025 c. 18

Data (Use and Access) Act 2025

Reforms UK data protection law, creates frameworks for digital verification services and smart data, restructures the Information Commissioner's Office, adds an offence of creating or requesting intimate images of adults without consent, and requires government reports on copyright and AI.

In force
China
ChinaPresidential Order No. 61

Decision Amending the Cybersecurity Law

Amends the Cybersecurity Law to add a provision supporting AI research, infrastructure, ethics and risk monitoring, raise fines for network security violations, and align liability with the Data Security Law and Personal Information Protection Law.

In force
Vietnam
VietnamLaw No. 91/2025/QH15

Law on Personal Data Protection

Sets a statutory framework for collecting, processing and transferring personal data in Viet Nam, replacing Decree 13/2023/ND-CP as the main personal data protection rule.

In force
European Union
European UnionCouncil Directive (EU) 2023/2226

DAC8 (crypto-asset tax reporting)

Amends the Directive on administrative cooperation in taxation to require crypto-asset service providers to report their users' crypto-asset transactions to tax authorities, with automatic exchange of that information between member states.

In force
New York
New YorkS 929 / A 2141

New York Health Information Privacy Act

Would have required consent before processing health information, given individuals access and deletion rights, and restricted sales of health data.

Vetoed
United Nations
United NationsA/RES/79/1 (annex I)

Global Digital Compact (Pact for the Future)

The Global Digital Compact, annexed to the Pact for the Future, sets shared objectives on closing digital divides, an inclusive and safe digital space, data governance and international AI governance, including the decision to create a scientific panel and global dialogue on AI.

Adopted
United Nations
United NationsA/RES/80/173

WSIS+20 review outcome document

Outcome of the General Assembly's 20-year review of the World Summit on the Information Society, which makes the Internet Governance Forum a permanent UN forum and schedules the next overall review for 2035.

Adopted
Denmark
DenmarkLov nr. 1618 af 16. december 2025 (L 16, 2025-26)

Danish Data Sharing Act (datadelingsloven)

Danish law supplementing the EU Data Act by designating the Agency for Digital Government as competent authority, giving it powers to request information and issue orders, and allowing fines for violations.

Enacted
Uruguay
UruguayLey 20.212 (arts. 74 and 75)

Uruguay AI provisions in the 2022 Budget Accountability Law

Tasks the digital government agency AGESIC with designing a national data and artificial intelligence strategy, reporting to Parliament with recommendations for AI regulation, and promoting controlled testing environments for innovative projects.

In force
United States (federal)
United States (federal)Executive Order 14363

Launching the Genesis Mission

Launches the Genesis Mission, a Department of Energy led effort to build an AI platform using federal scientific datasets to accelerate research.

In force
European Union
European UnionRegulation (EU) 2022/868

Data Governance Act

Creates a framework for reusing certain protected public sector data, regulates data intermediation services, and sets rules for data altruism organisations.

In force
India
IndiaAct No. 22 of 2023

Digital Personal Data Protection Act, 2023

Sets rules for processing digital personal data, including consent, duties of data fiduciaries, rights of data principals and a Data Protection Board with power to impose penalties.

In force
India
IndiaG.S.R. 846(E)

Digital Personal Data Protection Rules, 2025

Implements the DPDP Act 2023 with rules on notice, consent managers, security safeguards, breach intimation, children's data and the Data Protection Board, phased in over 18 months.

In force
Taiwan
TaiwanPresidential Order Hua-Zong-Yi-Jing-Zi No. 11400114521

Personal Data Protection Act Amendment

Amends Taiwan's Personal Data Protection Act to make the new Personal Data Protection Commission the competent authority, require breach notification and reporting, mandate data protection officers in public agencies and create an inspection regime for government bodies.

Enacted
United Nations
United NationsUNESCO Recommendation on the Ethics of Neurotechnology

Recommendation on the Ethics of Neurotechnology

A UNESCO standard-setting recommendation, mandated by the 42nd General Conference in November 2023, that gives Member States shared values, principles and concrete policy actions for the ethical development and use of neurotechnology.

Adopted
Egypt
EgyptMinisterial Decision No. 816 of 2025unverified

Executive Regulations of the Personal Data Protection Law

Implementing rules for Law No. 151 of 2020 that set out licensing and permit procedures, controls and standards for processing personal data, and breach notification to the Personal Data Protection Center within 72 hours.

In force
Egypt
EgyptLaw No. 151 of 2020unverified

Personal Data Protection Law

Egypt's comprehensive data protection law regulating electronic processing of personal data, requiring licences for controllers and processors, and creating the Personal Data Protection Center as regulator.

In force
California
CaliforniaSB 361

Data Brokers: Data Collection and Deletion

Requires data brokers registering with the California Privacy Protection Agency to disclose more of the personal information they collect, such as government ID numbers, login information and citizenship data.

In force
California
CaliforniaAB 325

Cartwright Act: Common Pricing Algorithms

Makes it unlawful under the Cartwright Act to use or distribute a common pricing algorithm as part of a conspiracy to restrain trade or to coerce others into adopting its recommended prices.

In force
Canada
CanadaBill C-2 (45th Parliament, 1st Session)

Strong Borders Act

Omnibus government bill on border security and related security measures, including new search and information access powers, which remains at second reading while related border measures were enacted separately in Bill C-12.

Introduced
European Union
European UnionC-413/23 P (ECLI:EU:C:2025:645)

EDPS v SRB (pseudonymised data)

Court of Justice judgment holding that pseudonymised data are not in all cases and for every person personal data, since pseudonymisation may prevent recipients other than the controller from identifying the data subject, and setting aside the General Court's ruling in T-557/20.

Ruled
Texas
TexasSB 1188

Electronic health records and AI in health care

Sets electronic health record requirements, including storage of records in the United States, and allows practitioners to use AI for diagnostic recommendations only if they review AI-generated records and disclose the use to patients.

In force
Texas
TexasHB 130

Genetic information security

Bars covered facilities and companies from using genome sequencers or software produced by foreign adversaries and from storing Texans' genome sequencing data in foreign adversary countries, with civil penalties and a private right of action.

In force
Texas
TexasSB 1964

Government use of artificial intelligence

Sets rules for state and local government use of AI, including a Department of Information Resources AI code of ethics and minimum standards, inventories of agency AI systems, and reviews of heightened-scrutiny AI systems used in consequential decisions.

In force
Texas
TexasSB 1343

Data broker notice requirements

Updates the notice that data brokers must post on their websites and include with their Texas registration statements.

In force
Texas
TexasSB 2121

Data broker regulation amendments

Broadens the definition of data broker to any business that collects, processes or transfers personal data it did not collect directly from the individual, removing the principal-revenue test from the 2023 law.

In force
Brazil
BrazilResolucao CD/ANPD No. 19/2024

ANPD International Data Transfer Regulation

Sets rules under the LGPD for international transfers of personal data and approves standard contractual clauses that controllers using contractual clauses must adopt.

In force
Israel
IsraelPrivacy Protection Law (Amendment No. 13), 5784-2024

Israel Privacy Protection Law Amendment No. 13

Comprehensively amends Israel's Privacy Protection Law, updating core definitions, narrowing database registration duties, requiring privacy officers for certain bodies and giving the Privacy Protection Authority administrative enforcement powers including financial sanctions.

In force
Minnesota
MinnesotaHF 4757

Minnesota Consumer Data Privacy Act (2024 commerce omnibus)

Omnibus commerce and cannabis bill that enacted the Minnesota Consumer Data Privacy Act (Minn. Stat. chapter 325O), giving consumers rights to access, correct, delete and port their personal data, opt out of targeted advertising, sale and profiling, and question the result of significant profiling decisions, enforced by the attorney general.

In force