The laws, and what they mean in practice

GDPR

European Union

The global reference point for privacy law: lawful bases, principles, rights, accountability, breach notice within 72 hours, transfer rules and fines up to 4 percent of worldwide turnover.

EU AI Act

European Union

Risk-based AI regulation with obligations assigned by role: prohibited practices, high-risk requirements, transparency duties and rules for general-purpose models.

ePrivacy Directive

European Union

The source of EU cookie consent and electronic marketing rules, alongside the GDPR.

NIS2

European Union

Cybersecurity risk management, management accountability and staged incident reporting starting with an early warning within 24 hours.

DORA

European Union

ICT risk management, incident reporting, resilience testing and a register of ICT third-party arrangements for the financial sector.

Data Act

European Union

Rights for users to access and share data from connected products, and rules making it easier to switch cloud providers.

DSA

European Union

Content moderation, transparency, a ban on ads targeted using sensitive data or at minors based on profiling, and risk assessments for very large platforms.

DMA

European Union

Limits on how gatekeepers combine personal data across services without consent, among other conduct rules.

CRA

European Union

Security requirements across the life of hardware and software products, with vulnerability handling and reporting duties.

DGA

European Union

Rules for neutral data intermediaries and for re-using protected public sector data.

EHDS

European Union

Patients' access to and control of electronic health data across the EU, and a framework for secondary use of health data.

EU-US DPF

European Union

An adequacy decision letting personal data flow to self-certified US companies without standard contractual clauses.