DecipherU
Sign in

Cybersecurity laws and regulations

100

Summaries of the laws and regulations that show up in security, compliance, and sales work, with a link to the primary text. Educational only, not legal advice.

Working in Applied AI? The AI Governance and Risk track in Applied AI courses covers the EU AI Act, NIST AI RMF, and AI policy.

Want to see how these laws actually arrived, one after another, over time? Browse the chronological timeline.

Educational information only. This page provides general educational information about cybersecurity laws and regulations. It does not constitute legal advice, legal interpretation, or a substitute for professional legal counsel. Laws change frequently. Always consult a qualified attorney and verify current requirements directly from official government sources before making compliance decisions. DecipherU is not a law firm and does not provide legal services.

100 laws

  • Act on the Protection of Personal Information (Japan)Japan's APPI is the primary cybersecurity and data protection law governing personal information in Japan. Amended significantly in 2020 (effective April 2022),Asia-Pacific2003Privacy
  • Algorithmic Accountability ActThe Algorithmic Accountability Act is a proposed federal bill requiring large companies to assess the impacts of automated decision systems they use or sell. FiUS Federal2022General Cybersecurity
  • American Data Privacy and Protection ActADPPA is a proposed broad federal privacy law for the United States that would create nationwide data protection standards. It passed the House Energy and CommeUS Federal2022Privacy
  • APEC Cross-Border Privacy Rules SystemThe APEC CBPR is an international cybersecurity and privacy framework enabling cross-border data flows among participating APEC economies. Organizations are cerInternational2011Privacy
  • Argentine Personal Data Protection Act (Ley 25.326)Argentina's PDPA is one of Latin America's oldest cybersecurity and data protection laws, influenced by EU data protection standards. Argentina holds an EU adeqLatin America2000Privacy
  • Australian Privacy Act 1988The Australian Privacy Act governs cybersecurity and privacy for personal information handled by Australian government agencies and private sector organizationsInternational1988Privacy
  • Budapest Convention on CybercrimeThe Budapest Convention is the first international treaty addressing cybersecurity crimes and electronic evidence. Opened for signature by the Council of EuropeInternational2001General Cybersecurity
  • California Consumer Privacy Act / California Privacy Rights ActThe CCPA/CPRA is the most influential US state cybersecurity and privacy law, granting California residents rights to know, delete, correct, and opt out of the US State2023Privacy
  • Children's Online Privacy Protection ActCOPPA imposes cybersecurity and privacy requirements on operators of websites and online services directed at children under 13. The FTC rule (16 CFR Part 312) US Federal1998Privacy
  • Chilean Data Protection Law (Ley 21.719 / Ley 19.628 as amended)Chile enacted a major cybersecurity and data protection reform in December 2024 (Ley 21.719), replacing its outdated 1999 framework. The new law creates an autoLatin America2024Privacy
  • CIS Critical Security ControlsThe CIS Controls are a prioritized set of cybersecurity actions organized into 18 control families and three Implementation Groups (IGs) based on organizationalIndustry Standard2021General Cybersecurity
  • Clarifying Lawful Overseas Use of Data ActThe CLOUD Act is a cybersecurity and data governance law that allows US law enforcement to compel technology companies to provide data stored on servers regardlUS Federal2018Trade & Export
  • Cloud Security Alliance Security Trust Assurance and RiskCSA STAR is a cybersecurity assurance program for cloud service providers, built on the Cloud Controls Matrix (CCM). It offers three levels of assurance: Level Industry Standard2011General Cybersecurity
  • COBIT (Control Objectives for Information and Related Technologies)COBIT is ISACA's IT governance and management framework that includes cybersecurity governance objectives. COBIT 2019 provides a governance system for enterprisIndustry Standard2019General Cybersecurity
  • Colombian Data Protection Law (Ley 1581 de 2012)Colombia's data protection law establishes cybersecurity and privacy requirements for processing personal data of Colombian residents. It follows a consent-baseLatin America2012Privacy
  • Colorado Artificial Intelligence ActThe Colorado AI Act (SB 24-205), signed into law in May 2024, is the first broad AI regulation enacted by a U.S. state. Effective February 1, 2026, it requires US State2024General Cybersecurity
  • Colorado Privacy ActThe Colorado Privacy Act protects consumers' cybersecurity and privacy rights, including opt-out of targeted advertising and profiling. Effective July 2023, it US State2023Privacy
  • Computer Fraud and Abuse ActThe CFAA is the primary US federal cybersecurity criminal statute. It criminalizes unauthorized access to computer systems and exceeding authorized access. The US Federal1986General Cybersecurity
  • Computer Misuse Act 1990The Computer Misuse Act is the UK's primary cybersecurity criminal law. It criminalizes unauthorized access to computer material, unauthorized access with intenUnited Kingdom1990General Cybersecurity
  • Connecticut Data Privacy ActThe Connecticut Data Privacy Act is a cybersecurity privacy law effective July 2023 that closely mirrors the Virginia CDPA with some additions. It requires honoUS State2023Privacy
  • Controlling the Assault of Non-Solicited Pornography and Marketing ActCAN-SPAM establishes cybersecurity and messaging rules for commercial email. It prohibits deceptive headers, misleading subject lines, and requires opt-out mechUS Federal2003Telecommunications
  • Costa Rican Data Protection Law (Ley 8968)Costa Rica's data protection law (Ley 8968) establishes cybersecurity and privacy protections for personal data processing. The law created PRODHAB (Agencia de Latin America2011Privacy
  • Critical Entities Resilience DirectiveThe CER Directive addresses the physical and cybersecurity resilience of critical entities across the EU. While NIS2 focuses on cybersecurity, CER covers physicEuropean Union2023Critical Infrastructure
  • Cyber Incident Reporting for Critical Infrastructure Act of 2022CIRCIA mandates that critical infrastructure entities report cybersecurity incidents to CISA within 72 hours and ransomware payments within 24 hours. This cyberUS Federal2022Breach Notification
  • Cybersecurity and Infrastructure Security Agency Act of 2018The CISA Act established the Cybersecurity and Infrastructure Security Agency within DHS. This cybersecurity law promoted the former National Protection and ProUS Federal2018Critical Infrastructure
  • Cybersecurity Information Sharing Act of 2015CISA 2015 encourages cybersecurity threat intelligence sharing between the private sector and government by providing liability protections. Companies that sharUS Federal2015General Cybersecurity
  • Cybersecurity Law of the People's Republic of ChinaThe Cybersecurity Law of the People's Republic of China was adopted by the Standing Committee of the National People's Congress on November 7, 2016 and took effAsia-Pacific2017General Cybersecurity
  • Data Privacy Act of 2012 (Philippines)The Philippines Data Privacy Act (Republic Act No. 10173) is one of the earliest broad data protection laws in Southeast Asia. It established the National PrivaAsia-Pacific2012Privacy
  • Data Protection Act 2018The Data Protection Act 2018 supplements the UK GDPR and provides the full cybersecurity and data protection legal framework for the UK. It covers processing noUnited Kingdom2018Privacy
  • Data Protection Act, 2019 (Kenya)The Kenya Data Protection Act, 2019 (Act No. 24 of 2019) was assented to on November 8, 2019 and commenced on November 25, 2019. The Act is published on Kenya LAfrica2019Privacy
  • Defense Federal Acquisition Regulation Supplement (Cybersecurity Requirements)DFARS clause 252.204-7012 requires defense contractors to implement cybersecurity controls from NIST SP 800-171 and report cyber incidents to DoD within 72 hourUS Federal2016Government & Public Sector
  • Digital Operational Resilience ActDORA is the EU's cybersecurity regulation for financial services, effective January 17, 2025. It requires financial entities to implement ICT risk management frEuropean Union2025Financial Services
  • Digital Operational Resilience Act (EU)DORA (Regulation (EU) 2022/2554) is an EU regulation establishing uniform cybersecurity and operational resilience requirements for the financial sector. EffectEuropean Union2022Financial Services
  • Digital Personal Data Protection Act, 2023 (India)India's DPDP Act is the country's first dedicated cybersecurity and data protection law, covering digital personal data processing. It establishes the Data ProtAsia-Pacific2023Privacy
  • E-Government Act of 2002The E-Government Act requires federal agencies to conduct cybersecurity Privacy Impact Assessments (PIAs) before deploying IT systems that collect personal infoUS Federal2002Government & Public Sector
  • Electronic Communications Privacy ActECPA governs government access to electronic communications and sets cybersecurity privacy standards for wiretapping and surveillance. It includes three titles:US Federal1986Privacy
  • ePrivacy DirectiveThe ePrivacy Directive governs cybersecurity and privacy in electronic communications within the EU. It covers confidentiality of communications, cookies and trEuropean Union2002Privacy
  • EU Artificial Intelligence Act (Cybersecurity Provisions)The EU AI Act includes cybersecurity requirements for high-risk AI systems. Providers must implement security measures ensuring resilience against unauthorized European Union2024General Cybersecurity
  • EU Cyber Resilience ActThe Cyber Resilience Act mandates cybersecurity requirements for all products with digital elements sold in the EU. Manufacturers must design products with secuEuropean Union2024General Cybersecurity
  • EU Cybersecurity ActThe EU Cybersecurity Act established a permanent mandate for ENISA (the EU Agency for Cybersecurity) and created the EU cybersecurity certification framework. TEuropean Union2019General Cybersecurity
  • EU Data ActThe EU Data Act governs cybersecurity and data sharing for IoT devices and cloud services, effective September 12, 2025. It requires IoT product manufacturers tEuropean Union2024Trade & Export
  • EU-US Data Privacy FrameworkThe EU-US Data Privacy Framework enables lawful cybersecurity data transfers from the EU to certified US organizations. Adopted via EU adequacy decision in JulyEuropean Union2023Trade & Export
  • Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical InfrastructureEO 13800 directed federal agencies to use the NIST Cybersecurity Framework (CSF) for managing cybersecurity risk. This cybersecurity executive order held agencyUS Federal2017Government & Public Sector
  • Executive Order 14028: Improving the Nation's CybersecurityEO 14028 is a landmark cybersecurity executive order requiring federal agencies to adopt zero trust architecture, improve software supply chain security, and stUS Federal2021Government & Public Sector
  • Family Educational Rights and Privacy ActFERPA protects the privacy of student education records, including those stored in digital systems that require cybersecurity protections. Schools receiving fedUS Federal1974Privacy
  • FDA Cybersecurity Requirements for Medical DevicesSection 524B of the FD&C Act (added by the PATCH Act provision of the Consolidated Appropriations Act of 2023) gives FDA authority to require cybersecurity docuUS Federal2023Healthcare
  • Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE)Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, often called the UAE PDPL, is the first federal data protection statute in the United ArabMiddle East2021Privacy
  • Federal Information Security Modernization ActFISMA is the primary cybersecurity law governing US federal agencies and their contractors. It requires each agency to develop, document, and implement an inforUS Federal2014Government & Public Sector
  • Federal Risk and Authorization Management ProgramFedRAMP is the US government's cybersecurity authorization program for cloud service providers (CSPs). Codified into law by the FedRAMP Authorization Act (part US Federal2022Government & Public Sector
  • Federal Trade Commission Act Section 5 (Unfair or Deceptive Acts or Practices)Section 5 of the Federal Trade Commission Act of 1914 (15 U.S.C. Section 45) declares 'unfair or deceptive acts or practices in or affecting commerce' unlawful US Federal1914General Cybersecurity
  • General Data Protection RegulationThe GDPR is the world's most influential cybersecurity and data protection regulation, governing the processing of personal data of EU/EEA residents. It requireEuropean Union2018Privacy
  • Gramm-Leach-Bliley ActGLBA requires financial institutions to protect the cybersecurity and privacy of customer financial information. The Safeguards Rule (updated 2023) mandates a wUS Federal1999Financial Services
  • Health Information Technology for Economic and Clinical Health ActThe HITECH Act strengthened cybersecurity and privacy protections for health data by expanding HIPAA enforcement. It introduced mandatory breach notification foUS Federal2009Healthcare
  • Health Insurance Portability and Accountability ActHIPAA is the primary US cybersecurity and privacy law for the healthcare industry. The Security Rule (45 CFR Part 164 Subpart C) requires covered entities and bUS Federal1996Healthcare
  • HITRUST Common Security FrameworkThe HITRUST CSF is a certifiable cybersecurity framework that maps controls from multiple standards (HIPAA, NIST, ISO 27001, PCI DSS, and others) into a single Industry Standard2007Healthcare
  • Illinois Biometric Information Privacy ActIllinois BIPA is the most litigated cybersecurity privacy law in the US, requiring written consent before collecting biometric identifiers (fingerprints, facialUS State2008Privacy
  • International Traffic in Arms Regulations / Export Administration Regulations (Cybersecurity Controls)ITAR and EAR control the export of cybersecurity tools, encryption technology, and intrusion software. The Wassenaar Arrangement Category 4 (computers) and CateUS Federal2015Trade & Export
  • ISO/IEC 27001:2022 Information Security Management SystemsISO 27001 is the international cybersecurity standard for information security management systems (ISMS). The 2022 revision updated the Annex A controls (now 93Industry Standard2022General Cybersecurity
  • ISO/IEC 27701:2019 Privacy Information ManagementISO 27701 is an international cybersecurity and privacy management standard that extends ISO 27001 to include privacy information management. It provides a framInternational2019Privacy
  • Kids Online Safety ActKOSA passed the U.S. Senate in July 2024 with strong bipartisan support (91-3 vote). It requires covered platforms to provide minors with options to protect theUS Federal2024Privacy
  • Law on Cybersecurity (Vietnam)Vietnam's Cybersecurity Law (No. 24/2018/QH14) took effect on January 1, 2019. It requires domestic and foreign service providers operating in Vietnam to store Asia-Pacific2018General Cybersecurity
  • Lei Geral de Proteção de Dados PessoaisThe LGPD is Brazil's cybersecurity and data protection law, closely modeled on the GDPR. It applies to any processing of personal data collected in Brazil, procInternational2020Privacy
  • Ley Federal de Protección de Datos Personales en Posesión de los ParticularesMexico's LFPDPPP is the primary cybersecurity and data protection law for the private sector. It follows the ARCO rights framework (Access, Rectification, CanceLatin America2010Privacy
  • National Defense Authorization Act Section 889NDAA Section 889 prohibits US government agencies from procuring cybersecurity and telecommunications equipment from specified Chinese manufacturers (Huawei, ZTUS Federal2019Government & Public Sector
  • NERC Critical Infrastructure Protection Standards Version 7NERC CIP Version 7 strengthens cybersecurity requirements for the North American bulk electric system. The updated standards expand the scope of protected assetUS Federal2023Critical Infrastructure
  • Network and Information Security Directive 2NIS2 is the EU's primary cybersecurity directive for critical and important entities, replacing the original NIS Directive. It significantly expands the scope oEuropean Union2023Critical Infrastructure
  • Network and Information Systems Regulations 2018The UK NIS Regulations implement cybersecurity requirements for operators of essential services (OES) and relevant digital service providers (RDSPs). The regulaUnited Kingdom2018Critical Infrastructure
  • New York SHIELD ActThe NY SHIELD Act expanded New York's cybersecurity breach notification requirements and mandated 'reasonable' data security safeguards for any business holdingUS State2019Breach Notification
  • NHTSA Cybersecurity Best Practices for the Safety of Modern VehiclesThe National Highway Traffic Safety Administration (NHTSA), the auto-safety regulator inside the United States Department of Transportation, published CybersecuUS Federal2022General Cybersecurity
  • Nigeria Data Protection Regulation / Nigeria Data Protection Act 2023Nigeria's data protection framework evolved from the NDPR (2019 regulation) to the Nigeria Data Protection Act (NDPA) signed into law in June 2023. The NDPA estAfrica2023Privacy
  • NIST Cybersecurity FrameworkThe NIST Cybersecurity Framework is the most widely adopted cybersecurity risk management framework in the US. Version 2.0 (February 2024) added a sixth functioIndustry Standard2024General Cybersecurity
  • NIST Special Publication 800-171 / Cybersecurity Maturity Model CertificationNIST SP 800-171 defines cybersecurity requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems. CMMC 2.0, codified in 32 CFR US Federal2024Government & Public Sector
  • North American Electric Reliability Corporation Critical Infrastructure Protection StandardsNERC CIP is a set of mandatory cybersecurity standards for the North American bulk electric system. These standards protect critical cyber assets in power generIndustry Standard2008Critical Infrastructure
  • NYDFS Cybersecurity Regulation, 23 NYCRR Part 50023 NYCRR Part 500 is the New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies. The regulation took effect MarchUS State2017Financial Services
  • OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal DataThe OECD Privacy Guidelines are the foundational cybersecurity and privacy principles that influenced GDPR, APEC, and most national data protection laws. First International1980Privacy
  • Oregon Consumer Privacy ActThe Oregon Consumer Privacy Act is a cybersecurity privacy law effective July 2024 that applies to both for-profit and nonprofit organizations. Oregon is the fiUS State2024Privacy
  • Payment Card Industry Data Security StandardPCI DSS is the global cybersecurity standard for organizations that store, process, or transmit cardholder data. Version 4.0 (effective March 2024, with full enIndustry Standard2004Financial Services
  • Personal Data Protection Act 2012 (Singapore)Singapore's PDPA is the primary cybersecurity and data protection law, requiring organizations to protect personal data and implement reasonable security arrangAsia-Pacific2012Privacy
  • Personal Data Protection Act B.E. 2562 (Thailand)Thailand's PDPA is the country's first broad data protection law, enacted in 2019 and fully effective since June 1, 2022. Modeled after GDPR, it establishes conAsia-Pacific2019Privacy
  • Personal Data Protection Law (Indonesia)Indonesia's PDP Law (UU No. 27/2022) is the country's first broad personal data protection law, enacted October 17, 2022 with a 2-year transition period ending Asia-Pacific2022Privacy
  • Personal Data Protection Law (Saudi Arabia)Saudi Arabia's PDPL is the kingdom's first broad data protection law, issued by Royal Decree in September 2021 and amended in March 2023. Enforcement is managedMiddle East2021Privacy
  • Personal Data Protection Law No. 151 of 2020 (Egypt)Egypt's Personal Data Protection Law (Law No. 151 of 2020) is North Africa's first broad data protection legislation. It establishes the Center for Personal DatAfrica2020Privacy
  • Personal Information Protection Act (South Korea)The Personal Information Protection Act (Act No. 10465) of the Republic of Korea was enacted on March 29, 2011 and took effect on September 30, 2011. PIPA is thAsia-Pacific2011Privacy
  • Personal Information Protection and Electronic Documents ActPIPEDA is Canada's federal cybersecurity and privacy law governing the collection, use, and disclosure of personal information by private-sector organizations. International2000Privacy
  • Privacy Act of 1974The Privacy Act governs how US federal agencies collect, maintain, and disclose cybersecurity-relevant personal records. It requires agencies to maintain recordUS Federal1974Privacy
  • Privacy and Electronic Communications RegulationsUK PECR governs cybersecurity and privacy in electronic communications, covering cookies, direct marketing, and communications security. It is the UK equivalentUnited Kingdom2003Telecommunications
  • Protection of Personal Information ActPOPIA is South Africa's cybersecurity and data protection law, effective July 1, 2021. It is modeled on the EU Data Protection Directive and requires organizatiInternational2021Privacy
  • Sarbanes-Oxley Act of 2002SOX mandates cybersecurity controls around financial reporting for publicly traded companies. Section 404 requires management and external auditors to assess inUS Federal2002Financial Services
  • SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure RulesThe SEC's 2023 cybersecurity disclosure rules require public companies to report material cybersecurity incidents within four business days on Form 8-K. CompaniUS Federal2023Financial Services
  • SEC Regulation S-P Amendments (Customer Data Protection)The SEC adopted amendments to Regulation S-P in May 2024, significantly updating customer data protection requirements for broker-dealers, investment companies,US Federal2024Financial Services
  • SOC 2 (System and Organization Controls 2)SOC 2 is a cybersecurity audit framework developed by the AICPA based on the Trust Services Criteria (TSC). It evaluates an organization's controls relevant to Industry Standard2010General Cybersecurity
  • SWIFT Customer Security Controls FrameworkThe SWIFT Customer Security Controls Framework (CSCF) establishes mandatory and advisory cybersecurity controls for organizations connected to the SWIFT networkIndustry Standard2017Financial Services
  • Tallinn Manual on the International Law Applicable to Cyber OperationsThe Tallinn Manual is an academic (non-binding) study analyzing how existing international law applies to cybersecurity operations and cyber warfare. Published International2017General Cybersecurity
  • Texas Data Privacy and Security ActThe Texas Data Privacy and Security Act (TDPSA) was enacted as House Bill 4 in the 88th Regular Session of the Texas Legislature and took effect on July 1, 2024US State2024Privacy
  • TSA Pipeline Cybersecurity DirectivesTSA issued emergency cybersecurity directives for pipeline operators following the Colonial Pipeline ransomware attack in May 2021. Security Directive Pipeline-US Federal2021Critical Infrastructure
  • UN Group of Governmental Experts Norms of Responsible State Behaviour in CyberspaceThe UN GGE established 11 voluntary, non-binding cybersecurity norms for responsible state behavior in cyberspace. These norms address protection of critical inInternational2015General Cybersecurity
  • United Kingdom General Data Protection RegulationThe UK GDPR is the retained version of the EU GDPR, forming the core cybersecurity and data protection law in the UK after Brexit. It operates alongside the DatUnited Kingdom2021Privacy
  • USA PATRIOT Act (Cybersecurity Provisions)The USA PATRIOT Act expanded cybersecurity surveillance authorities after 9/11. Title II enhanced electronic surveillance capabilities, and Section 217 authorizUS Federal2001Government & Public Sector
  • Utah Consumer Privacy ActThe Utah Consumer Privacy Act is a business-friendly cybersecurity and privacy law effective December 2023. It provides consumers with rights to access, delete,US State2023Privacy
  • Virginia Consumer Data Protection ActThe Virginia CDPA grants consumers cybersecurity privacy rights including access, deletion, correction, and opt-out of targeted advertising and data sales. EffeUS State2023Privacy

Next step

What is free and what costs money · All exams

A weekly cybersecurity career email

Threats, the job market, salary data and career strategy. It stops with one click.

By subscribing you agree to our privacy policy. Unsubscribe anytime.

Educational information only. This page provides general educational information about cybersecurity laws and regulations. It does not constitute legal advice, legal interpretation, or a substitute for professional legal counsel. Laws change frequently. Always consult a qualified attorney and verify current requirements directly from official government sources before making compliance decisions. DecipherU is not a law firm and does not provide legal services.

Last verified: April 2026?Report an inaccuracy

Cybersecurity law and regulation summaries are educational plain-language descriptions, not legal advice. Statutes, regulations, and enforcement guidance change frequently. Consult qualified legal counsel and verify against the official published text before relying on any summary for compliance or career decisions.