> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Company: Acme Inc

Last updated: 2026-03-19

Project: nextjs-saas-example

## Related Documents

- Compliance Notes (`COMPLIANCE_NOTES.md`)
- Annual Review Checklist (`ANNUALREVIEWCHECKLIST.md`)
- Regulatory Updates (`REGULATORY_UPDATES.md`)

This document outlines key compliance deadlines, ongoing obligations, and recommended action items based on the services detected in your codebase.

> Disclaimer: This is not legal advice. Consult qualified legal counsel to confirm applicable deadlines and obligations for your specific situation.

## 1. Key Regulatory Deadlines

Date | Deadline | Regulation
--- | --- | ---
Jan 1, 2023 | Virginia CDPA — Effective date | Virginia state privacy law
Jul 1, 2023 | Colorado Privacy Act (CPA) — Effective date | Colorado state privacy law
Jul 1, 2023 | Connecticut Data Privacy Act (CTDPA) — Effective date | Connecticut state privacy law
Dec 31, 2023 | Utah Consumer Privacy Act (UCPA) — Effective date | Utah state privacy law
Jul 1, 2024 | Oregon Consumer Privacy Act — Effective date | Oregon state privacy law
Jul 1, 2024 | Texas Data Privacy and Security Act (TDPSA) — Effective date | Texas state privacy law
Oct 1, 2024 | Montana Consumer Data Privacy Act — Effective date | Montana state privacy law
Jan 1, 2025 | Iowa Consumer Data Protection Act — Effective date | Iowa state privacy law
Jan 1, 2025 | Delaware Personal Data Privacy Act — Effective date | Delaware state privacy law
Jan 1, 2025 | New Hampshire Privacy Act — Effective date | New Hampshire state privacy law
Jan 1, 2025 | Nebraska Data Privacy Act — Effective date | Nebraska state privacy law
Jan 15, 2025 | New Jersey Data Privacy Act — Effective date | New Jersey state privacy law
Jul 1, 2025 | Tennessee Information Protection Act — Effective date | Tennessee state privacy law
Jul 31, 2025 | Minnesota Consumer Data Privacy Act — Effective date | Minnesota state privacy law
Oct 1, 2025 | Maryland Online Data Privacy Act — Effective date | Maryland state privacy law
Jan 1, 2026 | Indiana Consumer Data Protection Act — Effective date | Indiana state privacy law
Jan 1, 2026 | Kentucky Consumer Data Protection Act — Effective date | Kentucky state privacy law
Jan 1, 2026 | Rhode Island Data Transparency and Privacy Protection Act — Effective date | Rhode Island state privacy law
Aug 2, 2026 | EU AI Act — Full transparency obligations take effect | EU AI Act (Regulation 2024/1689), Article 50
Annually (Jan 1) | CCPA/CPRA — Annual privacy policy review and update | California Consumer Privacy Act / California Privacy Rights Act
Ongoing | PCI DSS — Annual self-assessment and ongoing compliance | Payment Card Industry Data Security Standard v4.0.1

## 2. Project-Specific Obligations

Based on the 8 service(s) detected in nextjs-saas-example, the following obligations apply:

### AI Services (openai)

- Aug 2, 2026 — AI Disclosure must be in place per EU AI Act Article 50
- Ongoing — Maintain human oversight documentation
- Ongoing — Mark AI-generated content in machine-readable format
- Ongoing — Log AI system inputs/outputs for transparency audits

### Payment Services (stripe, stripe-ios)

- Ongoing — PCI DSS annual self-assessment required
- Ongoing — Quarterly vulnerability scans (ASV) if applicable
- Ongoing — Ensure no raw card data is stored post-authorization

### Analytics / Advertising Services (posthog)

- Ongoing — Cookie consent mechanism must be maintained (ePrivacy Directive)
- Ongoing — Honor "Do Not Sell or Share" requests (CCPA/CPRA)
- Ongoing — Respect Global Privacy Control (GPC) signals
- Annually — Review analytics data sharing for CCPA "sale" classification

### Authentication Services (@supabase/supabase-js)

- Ongoing — Maintain data subject access request (DSAR) procedures
- Ongoing — Review session data retention periods
- Ongoing — Ensure authentication data processing agreements are current

### Email Services (resend)

- Ongoing — Maintain CAN-SPAM / GDPR consent records for marketing emails
- Ongoing — Provide working unsubscribe mechanisms
- Ongoing — Review email service DPAs annually

### Storage / Database Services (prisma)

- Ongoing — Enforce data retention schedules
- Ongoing — Ensure encryption at rest for personal data
- Ongoing — Verify backup and disaster recovery procedures

## 3. Action Items

### Immediate (verify now)

- Verify CCPA disclosures are included in privacy policy
- Confirm "Do Not Sell or Share" link is functional
- Verify PCI DSS Self-Assessment Questionnaire is current
- Verify cookie consent mechanism is operational

### Upcoming Deadlines

- By Aug 2, 2026 — Finalize and publish AI Disclosure document
- By Aug 2, 2026 — Complete AI system risk classification
- By Aug 2, 2026 — Implement AI-generated content marking

### Ongoing

- Re-run Codepliant after adding or removing services
- Review and update all compliance documents at least annually
- Respond to consumer requests within 45 days (CCPA)
- Maintain PCI DSS compliance and complete annual assessment

## 4. Recommended Review Schedule

Frequency | Activity
--- | ---
Monthly | Review data breach and incident logs
Monthly | Verify consent mechanisms are operational
Quarterly | Re-run Codepliant to detect new services or dependencies
Quarterly | Review and update data processing agreements
Semi-annually | Conduct internal compliance audit
Annually | Full privacy policy review and update
Annually | Staff data protection training refresh
Annually | Review regulatory landscape for new obligations
Annually | PCI DSS Self-Assessment Questionnaire
Annually | AI system risk re-assessment
Annually | AI Disclosure document review and update

> Tip: Set calendar reminders for each review activity. Compliance drift is the most common cause of regulatory exposure.

This compliance timeline was generated by Codepliant based on automated code analysis. It is for informational purposes only and does not constitute legal advice.