DecipherU
Sign inStart practicing

Cybersecurity and Privacy Law Timeline

100 laws and regulations DecipherU tracks, ordered by enactment year. Regulatory pressure on cybersecurity roles has compounded over time, not arrived all at once; this page is meant to show that shape, not just list individual laws.

1910s (1)

  1. 1914FTC Act Section 5US Federal

1970s (2)

  1. 1974FERPAUS Federal
  2. 1974Privacy ActUS Federal

1980s (4)

  1. 1980OECD Privacy GuidelinesInternational
  2. 1986CFAAUS Federal
  3. 1986ECPAUS Federal
  4. 1988AU Privacy ActInternational

1990s (4)

  1. 1990CMA 1990United Kingdom
  2. 1996HIPAAUS Federal
  3. 1998COPPAUS Federal
  4. 1999GLBAUS Federal

2000s (15)

  1. 2000Argentina PDPALatin America
  2. 2000PIPEDAInternational
  3. 2001Budapest ConventionInternational
  4. 2001PATRIOT Act (Cyber)US Federal
  5. 2002E-Government ActUS Federal
  6. 2002ePrivacy DirectiveEuropean Union
  7. 2002SOXUS Federal
  8. 2003Japan APPIAsia-Pacific
  9. 2003CAN-SPAM ActUS Federal
  10. 2003UK PECRUnited Kingdom
  11. 2004PCI DSSIndustry Standard
  12. 2007HITRUST CSFIndustry Standard
  13. 2008Illinois BIPAUS State
  14. 2008NERC CIPIndustry Standard
  15. 2009HITECH ActUS Federal

2010s (32)

  1. 2010Mexico LFPDPPPLatin America
  2. 2010SOC 2Industry Standard
  3. 2011APEC CBPRInternational
  4. 2011CSA STARIndustry Standard
  5. 2011Costa Rica Ley 8968Latin America
  6. 2011South Korea PIPAAsia-Pacific
  7. 2012Colombia Ley 1581Latin America
  8. 2012Philippines DPAAsia-Pacific
  9. 2012Singapore PDPAAsia-Pacific
  10. 2014FISMAUS Federal
  11. 2015CISA 2015US Federal
  12. 2015ITAR/EAR (Cyber)US Federal
  13. 2015UN GGE Cyber NormsInternational
  14. 2016DFARS CyberUS Federal
  15. 2017China CSLAsia-Pacific
  16. 2017EO 13800US Federal
  17. 201723 NYCRR 500US State
  18. 2017SWIFT CSCFIndustry Standard
  19. 2017Tallinn ManualInternational
  20. 2018CLOUD ActUS Federal
  21. 2018CISA ActUS Federal
  22. 2018UK DPA 2018United Kingdom
  23. 2018GDPREuropean Union
  24. 2018Vietnam Cybersecurity LawAsia-Pacific
  25. 2018UK NIS RegulationsUnited Kingdom
  26. 2019COBITIndustry Standard
  27. 2019Kenya DPAAfrica
  28. 2019EU Cybersecurity ActEuropean Union
  29. 2019ISO 27701International
  30. 2019NDAA § 889US Federal
  31. 2019NY SHIELD ActUS State
  32. 2019Thailand PDPAAsia-Pacific

2020s (42)

  1. 2020LGPD (Brazil)International
  2. 2020Egypt Data Protection LawAfrica
  3. 2021CIS ControlsIndustry Standard
  4. 2021EO 14028US Federal
  5. 2021UAE PDPLMiddle East
  6. 2021Saudi Arabia PDPLMiddle East
  7. 2021POPIA (South Africa)International
  8. 2021TSA Pipeline DirectivesUS Federal
  9. 2021UK GDPRUnited Kingdom
  10. 2022AAAUS Federal
  11. 2022ADPPAUS Federal
  12. 2022CIRCIAUS Federal
  13. 2022EU DORAEuropean Union
  14. 2022FedRAMPUS Federal
  15. 2022ISO 27001Industry Standard
  16. 2022NHTSA Vehicle Cyber GuidanceUS Federal
  17. 2022Indonesia PDP LawAsia-Pacific
  18. 2023CCPA/CPRAUS State
  19. 2023CPAUS State
  20. 2023CTDPAUS State
  21. 2023CER DirectiveEuropean Union
  22. 2023India DPDP ActAsia-Pacific
  23. 2023EU-US DPFEuropean Union
  24. 2023FDA Cyber GuidanceUS Federal
  25. 2023NERC CIP v7US Federal
  26. 2023NIS2 DirectiveEuropean Union
  27. 2023Nigeria NDPAAfrica
  28. 2023SEC Cyber Disclosure RulesUS Federal
  29. 2023UCPAUS State
  30. 2023Virginia CDPAUS State
  31. 2024Chile Data Protection LawLatin America
  32. 2024Colorado AI ActUS State
  33. 2024EU AI Act (Cyber)European Union
  34. 2024CRAEuropean Union
  35. 2024EU Data ActEuropean Union
  36. 2024KOSAUS Federal
  37. 2024NIST CSFIndustry Standard
  38. 2024NIST 800-171 / CMMCUS Federal
  39. 2024OCPAUS State
  40. 2024SEC Reg S-PUS Federal
  41. 2024TDPSAUS State
  42. 2025DORAEuropean Union
Last verified: September 2026?Report an inaccuracy