Timeline of Privacy and Digital Cybersecurity in the EU: Obligations in 2026

European digital regulation does not advance as a single privacy timeline. The GDPR protects personal data; the Digital Markets Act (DMA) imposes specific obligations on platforms designated as gatekeepers, and the Cyber Resilience Act (CRA) sets cybersecurity requirements for products with digital elements. These are distinct frameworks with different obligated entities and calendars.

The difference matters for deciding what to do now. A company processing identifiable information must review the legal basis, transparency, security, and rights required by the GDPR. A manufacturer of connected devices must also attend to the CRA calendar. And a company using a large platform is not automatically subject to the DMA obligations that correspond to designated gatekeepers.

In this article, 'in force' does not mean that all duties of a regulation apply immediately. The CRA, for example, is in force as a norm, but has staggered application dates: reporting certain incidents is already mandatory, while most product requirements apply in 2027. Legislative proposals, for their part, should not be treated as applicable law until adopted and in effect.

The General Data Protection Regulation, Regulation (EU) 2016/679, was adopted on April 27, 2016, and began applying on May 25, 2018. It establishes rules for processing personal data and seeks to protect individuals' rights, while allowing the circulation of such data within the Union. Its core remains the reference for evaluating processing, even when new technologies are used.

The GDPR does not prohibit collecting data by default nor does it make consent the only possible legal basis. It requires that each processing has a valid basis, a defined purpose, and adequate safeguards; it also recognizes rights such as access, rectification, and erasure, subject to the regulation's conditions. For organizations, the practical starting point is documenting what data is used, for what, with whom it is shared, and for how long.

The decade since its adoption should not be confused with a new entry into force in 2026. Commemorative publications from that year recall the regulation's trajectory, but they do not replace its text nor alter its obligations on their own. Nor can it be inferred that a technology complies with the GDPR simply because it is used in regulated sectors: compliance depends on data, purposes, legal basis, and concrete execution.

The DMA, Regulation (EU) 2022/1925, entered into force on November 1, 2022, and obligations for designated gatekeepers began applying in March 2024. Its central objective is to make certain digital markets more contestable and fair. It is not a second general privacy law: it regulates practices of platforms meeting designation criteria and does not replace the GDPR.

For user companies and consumers, the DMA can change access conditions to certain services and practices of designated platforms. But it is incorrect to directly transfer its duties to any application, online store, or digital service provider. The operational question is whether the organization is subject to a specific obligation of the regulation or interacts with a platform that is.

The timeline thus has two clear milestones: entry into force in 2022 and the start of compliance by designated gatekeepers in 2024. The number of designated companies may change with new Commission decisions, so it is advisable to consult updated official sources before stating a number. For a privacy assessment, the DMA also does not eliminate the need to separately determine if there is personal data processing subject to the GDPR.

The Cyber Resilience Act, Regulation (EU) 2024/2847, establishes cybersecurity requirements for products with digital elements and assigns obligations to manufacturers, importers, and distributors, according to their role. The Commission describes it as a framework covering design, development, maintenance, and vulnerability management. It affects the product and its lifecycle, not any data processing operation merely for using software.

The first operational milestone has arrived: from September 11, 2026, Article 14 obligations on reporting actively exploited vulnerabilities and serious incidents affecting product security apply. According to the consulted synthesis, notices have differentiated deadlines—24 hours for an initial alert on an exploited vulnerability and 72 hours for reporting a serious incident—and must be channeled through provided mechanisms, including the single point of notification. It is not a general obligation to report any data breach to ENISA: the case must fit the CRA and its criteria.

Most other requirements of the regulation, including essential cybersecurity requirements for products, will apply from December 11, 2027. Therefore, in October 2026, it is advisable to separate mandatory compliance preparation: review product and function inventory, assign responsibilities for vulnerabilities and incidents, and define support and update processes, without presenting all future duties as fully applicable.

The table summarizes general dates, not a scope analysis. The product, the company's role in the supply chain, applicable exclusions, and the type of incident determine which specific duty applies. In particular, CRA obligations should not be confused with GDPR obligations on personal data breaches: an incident may trigger one, both, or neither, depending on its circumstances and respective criteria.

The European Data Protection Board (EDPB) published a statement on October 13, 2026, regarding data protection challenges associated with smart glasses. The publication available on its website confirms the statement's existence, but research material does not allow precise reconstruction of each recommendation in its text. Therefore, it is not appropriate to describe it as an exhaustive guide nor attribute specific requirements without consulting the full document.

An EDPB statement or guidance does not equate to a new autonomous law. Its utility lies in helping interpret existing data protection rules in specific situations; the GDPR remains the legal basis. In glasses with a camera, microphone, or analysis functions, an organization should evaluate what information can be captured, who may be recorded, the purpose, and what information, minimization, security, and retention measures are adequate.

For a company considering these devices in the workplace, the decision should not be limited to asking if the equipment has an indicator light or recording function. It is necessary to determine the context, necessity, and proportionality of use, as well as responsibilities between the organization and the provider. The assessment must focus on actual processing, including potential sending to cloud services, and not just the commercial label of 'smart device'.

In October 2026, the date alone does not determine which norm obliges an organization. The practical criterion is to identify the role played and the regulated object: personal data processing under the GDPR, service provision by a designated platform under the DMA, or placing and maintaining digital products on the market under the CRA.

An initial review can be organized in these steps:

1. Map personal data processing and check purposes, legal bases, information provided, retention periods, and procedures for handling rights under the GDPR.
2. Check the role regarding the DMA: distinguish between being a designated gatekeeper, a provider interacting with one, or a user company of its services.
3. Inventory products with digital elements and determine if the organization is a manufacturer, importer, or distributor for CRA purposes.
4. Activate the Article 14 process, if the product and incident fall within its scope, including detection, escalation, and notification within applicable deadlines from September 2026.
5. Prepare for the general application in 2027: review design, vulnerability management, updates, and relevant documentation for affected products.
6. Separately evaluate capture devices—such as smart glasses—with attention to the use context and third-party data that may be collected.

This list is a starting point, not a legal conclusion for all sectors. A single provider may have obligations under multiple frameworks, but each depends on concrete facts. For example, a device manufacturer may have CRA duties and, if it also determines the purposes and means of personal data processing, responsibilities under the GDPR. The coexistence of norms requires analysis by activity, not a global 'digital compliance' label.

The most solid timeline for 2026 is that of dates fixed in the regulations themselves: the GDPR applies since 2018; DMA obligations for designated gatekeepers since 2024; and CRA Article 14 notifications from September 11, 2026, with general application of most obligations scheduled for December 11, 2027. Those dates are not interchangeable and must be linked to the scope of each norm.

In contrast, a proposed reform of the Artificial Intelligence Regulation cannot be presented as an already existing obligation. The legal coverage provided describes modification proposals in 2026, but does not prove they have been approved or entered into force. Moreover, the AI Act is not a privacy norm: it may interact with the GDPR when an AI system processes personal data, but each regulation retains its own object and requirements.

The EDPB statement on smart glasses does appear as an October 2026 publication, although the primary source included in the research only allows confirming its announcement and date, not detailing its full content. This is a scope limitation, not a reason to invent recommendations. For compliance decisions, the safe rule is to verify the current official text and competent authorities' decisions before setting specific obligations.