Calendar
Upcoming deadlines
November 2026
13
In 14 days
DPDPDPDP Rules: consent manager registration and obligations take effect
Rule 4 of India's DPDP Rules, 2025 commences: consent managers must be registered with the Data Protection Board and meet the First Schedule conditions (an Indian company with a net worth of at least ₹2 crore, among others).
Source (opens in a new tab)
December 2026
19
In 50 days
HIPAAVendor Incident Affects 341,000 Blueberry Pediatrics Patients (breach notification deadline)
Healthcare providers handling large volumes of pediatric data must verify that their security controls meet HIPAA standards and be prepared to report breaches promptly to avoid enforcement actions.
Source (opens in a new tab)26
In 57 days
HIPAAData Breach Announced by NorthShore Health Centers (notification deadline)
Healthcare providers handling similar patient data must verify their security controls and be prepared to meet HIPAA breach notification timelines.
Source (opens in a new tab)
January 2027
21
In 83 days
GDPRItalian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data (Compliance deadline)
Conduct a GDPR gap analysis for all health‑related data processing activities. Implement a documented Data Protection Impact Assessment for any processing of special category data. Ensure a lawful basis is documented and transparent information is provided to data subjects before processing begins.
Source (opens in a new tab)
March 2027
21
In 142 days
GDPRThe Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data (Compliance deadline)
Compliance teams must review and document the lawfulness of all location‑data processing activities. Update privacy notices to clearly explain how location data is collected, used, and retained. Implement robust data retention schedules and ensure data is deleted when no longer needed. Conduct a gap analysis against GDPR accountability and transparency obligations and remediate any deficiencies before the compliance deadline.
Source (opens in a new tab)
May 2027
13
In 195 days
DPDPDPDP Act: core obligations for data fiduciaries apply
Rules 3, 5–16, 22 and 23 commence: notice and consent, reasonable security safeguards, personal data breach intimation, retention limits, verifiable parental consent for children's data, data principal rights, Significant Data Fiduciary duties and cross-border transfer conditions.
Source (opens in a new tab)
Know of a deadline that’s missing? Submit the source.