What the law makes you able to show
About this documentUpdated ShowHide
Sean McDermott, Co-Founder and CEO, UnGovr
Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.
Every law named here links to its summary page on lexlint.io, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.
© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same license. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.
Law library as of .
Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice in the footer says what that means.
Nine things an operator can be made to produce after an agent has acted: the traces, who acted, what it could reach, where a person was, what it made, what was done about it, when, what was fixed, and how long all of it has to last. The last is the one the law states in periods, and the LexLint law library carries them.
1What this document is
What the law makes you constrain is about the run: the eight places a duty can land on an AGENT while it is working. This document is about afterwards, when somebody asks what happened. The somebody is usually one of four: a regulator with a statutory power to ask, a customer whose systems or data were involved, a person whose data was in it, or a court. What each of them can require is set by law, and it is much narrower and much more specific than the record an engineer would want to have kept.
Nine classes follow. Eight are the kinds of evidence an incident makes relevant. The ninth is how long any of it has to last, which is the one the law answers in numbers rather than in kinds, and the LexLint law library carries those numbers.
Two neighbors carry what this document deliberately leaves out. When a report is due, and to whom, is Incident reporting clocks, and the clocks page draws every reporting deadline in the law library on one time axis. What it has cost the organizations that could not answer is Does legal action really happen?.
2How to read a class
Reading the classes
- Ours first
- The nine classes are this section's own vocabulary, named for what somebody can make you produce. The document reads the same with every alignment note removed.
- The count
- A requirement line joins a class when its own wording speaks to that class. The test is words, not judgment, and it is applied to the line rather than to the instrument around it, so a count is a floor rather than a ceiling.
- Small numbers
- Several of these classes are thin, and the thinness is the finding rather than a failure of the reading. Binding law asks for an outcome and for a record of a decision; it very rarely asks for the run-time detail an incident responder needs.
- A record, not a log
- Where a statute does ask for a record, it usually asks for a record of processing, which is a register of what an organization does with data, and not a trace of what a system did in a particular minute. The two words are worth keeping apart while reading.
- The periods
- The retention section lists every period in force in the law library, read out of the sentence that states it, with that sentence beside it. A period is shown as a minimum or a maximum where the sentence says which, because a bare number does not.
- A compact, not a law
- The note under each class quotes SAFE v1.0, dated , the compact of the OSAA's SAFE working group, read from its text. It is not law. It is voluntary to join, and it states that “Participation in SAFE is a commitment to this compact. Open Secure AI Alliance membership alone does not impose it.”
3The nine classes
In order. Each section names the law first and shows what the law library holds second.
1 · Prompts, traces and tool calls
The record of what ran and what it did.
This is the class an incident responder cares about most and the one binding law says least about. What privacy law asks for is a record of processing: the purposes, the categories of people and data, the recipients, the transfers. That is an organizational register, and it can be complete while telling you nothing about what happened at eleven o'clock on Tuesday.
The first law the law library holds that asks for the other thing is the
EU AI Act, and it is not in force yet.
Its Article 12 (record-keeping)
requires automatic event logging to be
built into a high-risk system so that it can record events over the
system's lifetime, designed to support identifying an emerging risk, a
substantial modification, and monitoring by the provider and the
deployer; Article 19 and
Article 26(6) put the keeping duty
on the provider and the deployer respectively; and
Article 21(2) lets a competent
authority ask for those logs on a reasoned request. All four bind
from , in 13 months.
In force today, the nearest thing is sectoral:
India's CERT-In Cyber Security Directions require an
organization's system logs to be enabled, retained securely within
Indian jurisdiction on a rolling basis, and provided with an incident
report or on the authority's direction.
What each jurisdiction's law requires of a log, category by category and at length, is the research at What the law requires of logs. This class states what an operator can be made to produce; that section states which law asks for it, where, and in what form.
235 requirement lines in force · 228 provisions · 117 jurisdictions · from: cybersecurity 125 · privacy 92 · AI 55 · scraping 6
The law behind the class Show 7 of the 235 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589
Source
as of
|
|
Confidentiality of Medical Information Act (CMIA): disclosure, deemed providers, record security and remedies, Cal. Civ. Code sections 56 to 56.37
Source
as of
|
|
|
|
Personal Information Protection Act, pseudonymized information, Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties)
Source
as of
|
|
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance)
Source
as of
|
|
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, )
Source
as of
|
|
Decree implementing the AI Law, serious incident reporting and handling, Decree No. 142/2026/ND-CP, art. 19
Source
as of
|
California
Colorado
Brazil
VietnamAgent execution traces and model reasoning traces (e.g., general failure analysis, chain-of-thought traces), retaining the observed versions, identifiers and configurations.
Prompts (including system prompts and tool definitions), tool calls and their results as delivered to the agent (noting any truncation), logs, and third-party dependencies, including the safeguards, external tools, APIs, harnesses and serving artifacts observed.
SAFE v1.0 Evidence Preservation, read .
2 · Agent and workload identity
Which system acted, and on whose authority.
An AGENT acting on behalf of a person raises a question the instruments in the law library barely ask: which system acted, and whose authority was it using? The identity duties in force are about people and organizations. Privacy law asks who the controller is and whether a unique identifier may be assigned to a person at all, which is the opposite question. Where an identity duty does reach a machine, it is usually the duty to say that a machine is what you are dealing with, which sits with the disclosure rules in Global AI law: 8 common threads rather than here.
This is the widest gap on the page between what a responder needs and what a statute requires, and it is worth stating plainly: if your record cannot say which agent or subagent, which version, and which delegation chain back to the principal produced an action, almost nothing in force today will have told you so. Jurisdiction in logs takes one part of the same problem, the jurisdiction a request was served under, and argues it as a field the record has to carry.
41 requirement lines in force · 42 provisions · 32 jurisdictions · from: privacy 22 · cybersecurity 17 · AI 6 · scraping 3
The law behind the class Show 8 of the 41 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
Payment Services Technical Standards on Strong Customer Authentication, Personalized Security Credentials and Common and Secure Open Standards of Communication, Commission Delegated Regulation (EU) 2018/389, Arts. 2-9 and 22-36
Source
as of
|
|
California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), Cal. Bus. and Prof. Code Sections 22757 to 22757.6
Source
as of
|
|
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated )
Source
as of
|
|
Protection of Personal Information Act 4 of 2013 (POPIA), Protection of Personal Information Act 4 of 2013 (POPIA), ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation)
Source
as of
|
|
CBN Guidelines for the Operations of Agent Banking, October 2025, Security, Authentication and Geo-Fencing Controls, Guidelines for the Operations of Agent Banking in Nigeria, October 2025, ss. 9.3, 9.4 and 10.5 to 11
Source
as of
|
|
Executive Order 13960, Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government, Exec. Order No. 13960, 85 Fed. Reg. 78939 ()
Source
as of
|
|
Ontario Do not use, or attempt to use, de-identified information to identify an individual, alone or combined with other information, unless the Act or another Act permits it. Custodians, prescribed entities, prescribed registry holders and other prescribed persons may re-identify information they de-identified themselves.
Personal Health Information Protection Act, 2004, limits on use of de-identified information, S.O. 2004, c. 3, Sched. A, s. 11.2
Source
as of
|
|
Cybersecurity Law: Network and Information System Security Duty, Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre III, Sections I et II (art. 16, 19, 20, 21, 23)
Source
as of
|
South Africa
Nigeria
United States
Central African RepublicHuman approvals, automated monitor approvals and other intervention events while preserving the originating principal, authorization source, delegation chain and approved action scope.
SAFE v1.0 Evidence Preservation, read .
3 · Permissions and credentials at run time
What the run could reach while it ran.
What the run could reach while it ran is the difference between an incident and a catastrophe, and it is nearly absent from binding law as a record-keeping duty. Where it appears, it appears inside security regulations as a monitoring duty with a period attached rather than as evidence to be produced: an automatic mechanism that monitors access to a database's systems, with the record kept, is the shape.
The related duty that is everywhere is the control itself rather than the record of it, which is why this class is thin here and its counterpart is not: see the tools layer of What you must constrain.
25 requirement lines in force · 24 provisions · 20 jurisdictions · from: privacy 11 · cybersecurity 11 · scraping 5
The law behind the class Show 8 of the 25 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
Personal Information Protection Act, safety measures and access records, Act No. 10465 (as amended by Act No. 21445, 2026), Art. 29; Enforcement Decree (Presidential Decree No. 36671, 2026), Art. 30(1); Personal Information Protection Commission Notice No. 2025-9 (Standards for Personal Information Safety Measures), Art. 8
Source
as of
|
|
Marco Civil da Internet, Protection of Records and Personal Data, Lei nº 12.965/2014 (Marco Civil da Internet), arts. 7º, 10, e 12
Source
as of
|
|
|
|
Decreto Legislativo 1700, illicit trafficking of computer data (art. 12-A of Ley 30096), Decreto Legislativo 1700 (), incorporating art. 12-A into Ley 30096, as amended by Decreto Legislativo 1741 ()
Source
as of
|
|
Republika Srpska Law on Information Security, Security Measures for Republic Bodies and Those Handling Their Data, Republika Srpska Law on Information Security, arts. 2, 4-9 and 12-13
Source
as of
|
|
Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, Loi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel
Source
as of
|
|
Ontario As a health information network provider, keep, to the extent reasonably practical, an electronic record of all accesses to and transfers of custodians' information in equipment you control, identifying who accessed or transferred it and when, and make it available to a custodian on request.
Personal Health Information Protection Act, 2004, electronic service providers and health information network providers, S.O. 2004, c. 3, Sched. A, s. 10 (4); O. Reg. 329/04, s. 6
Source
as of
|
|
Krimināllikums Sections 241, 243, 244, Automated Data Processing System Offences, Krimināllikums, 241., 243. un 244. pants
Source
as of
|
New York
Peru
Bosnia and Herzegovina
Burundi
LatviaPermissions and credential identifiers, types, scopes and revocation status available during the run; secret values should remain protected in restricted forensic custody where preservation is necessary. Do not include reusable passwords, tokens or private keys in incident reports, alerts or advisories; use protected references and scope instead.
SAFE v1.0 Evidence Preservation, read .
4 · Human approval and intervention
Where a person was, and what they could do.
Where a person was, and what they could do about the outcome, is the
evidence question privacy law answers best. The right not to be subject
to a solely automated decision produces a duty of meaningful human
review before such a decision is finalized, and that review is a fact
somebody can later be asked to show. The law library holds it
jurisdiction by jurisdiction, as a national reading of
the EU GDPR's data-subject rights chapter in Europe and as its
own provision elsewhere.
AI law is about to ask for the same ground in its own right.
The EU AI Act's Article 14 (human oversight)
(from , in 13 months; that date
is for a system classified as high-risk under Annex III, and a system
classified under Annex I follows on the later date the instrument's
page states) makes the provider design the system so the people
assigned to oversee it can understand its capacities and limits,
interpret its output, decide not to use it, override or reverse it, and
stop it, and makes the deployer assign that oversight to people with
the competence, training and authority to exercise it. Read as
evidence, that is two things to produce rather than one: what the
system was built to let a person do, and who held the authority to do
it on the day.
For an AGENT the practical trap is that the review has to be real and has to be recorded as what it was. A person who clicked approve on a queue of four hundred items has not reviewed them, and a record that cannot distinguish that from a considered decision is evidence of the wrong thing.
77 requirement lines in force · 90 provisions · 65 jurisdictions · from: privacy 61 · AI 43
The law behind the class Show 8 of the 77 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589
Source
as of
|
|
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222
Source
as of
|
|
|
|
Personal Information Protection Act, rights regarding automated decisions, Act No. 10465 (as amended by Act No. 19234, 2023), Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Arts. 44-2 to 44-4
Source
as of
|
|
Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D), Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR
Source
as of
|
|
National Artificial Intelligence Ethics Framework (Circular No. 05/2026/TT-BKHCN), Circular No. 05/2026/TT-BKHCN
Source
as of
|
|
GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in Germany, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Bundesdatenschutzgesetz (BDSG) §§31, 37
Source
as of
|
|
GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland, Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57
Source
as of
|
United Kingdom
Germany
IrelandHuman approvals, automated monitor approvals and other intervention events while preserving the originating principal, authorization source, delegation chain and approved action scope.
SAFE v1.0 Evidence Preservation, read .
5 · Artifacts created or changed
What the run made, marked or moved.
What the run made, and what it changed. Two duties meet here. The
first is marking: the EU AI Act's Article 50 (transparency)
(since ) requires synthetic content to be marked
in a machine-readable way, and 
South Korea's AI Framework Act, Article 31
requires the same of AI outputs there, so the artifact itself carries
part of the evidence. The second is integrity: a record that can be altered
without trace is not evidence, and several security regimes say so in
their own words.
An AGENT that writes files, posts content or edits records produces artifacts in other people's systems, which is where the COUNTERPARTY sits. Those artifacts are somebody else's evidence as much as yours.
72 requirement lines in force · 82 provisions · 63 jurisdictions · from: AI 36 · privacy 31 · cybersecurity 15 · scraping 9
The law behind the class Show 7 of the 72 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
AI Act, Article 50 (transparency obligations for AI systems and synthetic content), Regulation (EU) 2024/1689, Article 50
Source
as of
|
|
California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), Cal. Bus. and Prof. Code Sections 22757 to 22757.6
Source
as of
|
|
Identity Theft Enforcement and Protection Act, breach notification, Tex. Bus. & Com. Code sec. 521.053, as amended by Tex. SB 768, 88th Legislature (2023)
Source
as of
|
|
UK GDPR Articles 12-21 and Data Protection Act 2018 Section 164A, Data Subject Rights in the United Kingdom, UK GDPR, Arts. 12-21; Data Protection Act 2018, s. 164A
Source
as of
|
|
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024)
Source
as of
|
|
Synthetically Generated Information Labelling Duty for Intermediaries, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(3), as inserted by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), dated )
Source
as of
|
|
Decree implementing the AI Law, transparency, technical marking and labeling of AI-generated content, Decree No. 142/2026/ND-CP, arts. 16-18
Source
as of
|
TexasFiles and external artifacts created, modified or deleted, with location, time of change and, if available, the previous state before any changes occurred.
SAFE v1.0 Evidence Preservation, read .
6 · Detection, containment and recovery
What was noticed, stopped and put back.
What was noticed, what was stopped, and what was put back.
The EU NIS2 Directive's Article 21 names incident handling, business
continuity including backup management, and crisis management among its
minimum measures, so the existence of the capability is itself a duty.
The evidence duty arrives through the notification rules: most breach
and incident regimes in the law library require the notification to
describe the measures taken or proposed, which means the response has to
be recorded as it happens rather than reconstructed afterwards.
286 requirement lines in force · 244 provisions · 143 jurisdictions · from: cybersecurity 228 · privacy 60 · AI 10 · scraping 4
The law behind the class Show 7 of the 286 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589
Source
as of
|
|
CCPA Regulations: handling consumer requests, opt-out preference signals and verification (articles 3 and 5), Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063
Source
as of
|
|
Texas Cyber Command, cybersecurity incident notification by a state agency or local government, Tex. Gov't Code sec. 2063.302
Source
as of
|
|
Personal Information Protection Act, breach notification duties, Act No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40
Source
as of
|
|
|
|
SUSEP Circular 638 of 2021, Cybersecurity Requirements for Insurers, Circular SUSEP nº 638, de 27 de julho de 2021, arts. 3º, 4º, 5º e 9º
Source
as of
|
|
Telecom Cyber Security Rules, Reporting of Security Incidents, Telecommunications (Telecom Cyber Security) Rules, 2024 (G.S.R. 720(E)), r. 7
Source
as of
|
Detection, containment and recovery events, including any methods for reproduction testing based on remediation evidence. Separate original incident observations and preserved state from later replay, reproduction and remediation tests. Never silently substitute a new run or configuration for missing original evidence.
SAFE v1.0 Evidence Preservation, read .
7 · The incident timeline
When each of those things happened.
When each of those things happened is the most heavily regulated class on this page, because almost every reporting duty in the law library is stated as a period running from a moment. That makes two facts legally significant that an engineer might not log at all: the moment the organization became aware, and the moment the incident began.
The EU Cyber Resilience Act's Article 14, which puts the duty on
the manufacturer, is the clearest example of a staged
timeline: an early warning within 24 hours of becoming aware, a
notification within 72, and a final report no later than fourteen days
after a corrective measure becomes available. Every such deadline in the
law library, with the sentence it was read from, is drawn on one axis
in the clocks page.
846 requirement lines in force · 587 provisions · 199 jurisdictions · from: privacy 512 · cybersecurity 374 · AI 84 · scraping 2
The law behind the class Show 7 of the 846 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6), Directive 2014/65/EU, Article 17, supplemented by Commission Delegated Regulation (EU) 2017/589
Source
as of
|
|
Transparency in Frontier Artificial Intelligence Act (SB 53), Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16
Source
as of
|
|
|
|
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses, Tex. Bus. & Com. Code §§ 552.101-552.106
Source
as of
|
|
Personal Information Protection Act, breach notification duties, Act No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40
Source
as of
|
|
UK GDPR Articles 12-21 and Data Protection Act 2018 Section 164A, Data Subject Rights in the United Kingdom, UK GDPR, Arts. 12-21; Data Protection Act 2018, s. 164A
Source
as of
|
|
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject)
Source
as of
|
No item. The minimum reporting record asks for an awareness and response timeline, which is a report's field and not an item to preserve.
8 · Reproduction and remediation
What was fixed, and how that was shown.
What was fixed, and how that was shown. The final-report duties are
where this becomes evidence rather than engineering:
the EU NIS2 Directive's Article 23 and
the EU Cyber Resilience Act's Article 14 both end
their staged sequence with a report, and
the EU AI Act's Article 55 requires a provider of a model with
systemic risk to document and report corrective measures taken or
planned. Elsewhere the same idea appears as a corrective-action duty
attached to a regulator's finding.
Reproduction is the half the law does not ask for and an incident needs most. Nothing in the law library requires an OPERATOR to be able to run the failing case again, which for a non-deterministic system is the difference between a fix and a hope.
207 requirement lines in force · 201 provisions · 120 jurisdictions · from: cybersecurity 181 · privacy 35 · AI 25
The law behind the class Show 7 of the 207 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
AI Act, Article 55 (obligations for providers of general-purpose AI models with systemic risk), Regulation (EU) 2024/1689, Article 55
Source
as of
|
|
CCPA Regulations: contracts with service providers, contractors and third parties (article 4), Cal. Code Regs. tit. 11, sections 7050 to 7053
Source
as of
|
|
|
|
Texas data broker information security program, Tex. Bus. & Com. Code secs. 510.007, 510.009
Source
as of
|
|
The Consumer Duty: Principle 12 and the cross-cutting rules and outcome rules for retail customers, FCA Handbook, PRIN 2A and Principle 12
Source
as of
|
|
ANPD Regulation on Reporting Security Incidents (Resolution CD/ANPD No. 15/2024), Resolução CD/ANPD nº 15, de 24 de abril de 2024 (Regulamento de Comunicação de Incidente de Segurança), Anexo, arts. 4º-6º, 9º and 10
Source
as of
|
|
RBI Commercial Banks Cybersecurity Directions, Cyber Incident Reporting, Reserve Bank of India (Commercial Banks - Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, paras. 181 to 183
Source
as of
|
Detection, containment and recovery events, including any methods for reproduction testing based on remediation evidence. Separate original incident observations and preserved state from later replay, reproduction and remediation tests. Never silently substitute a new run or configuration for missing original evidence.
SAFE v1.0 Evidence Preservation, read .
9 · How long the record has to last
The one class the law states in periods.
How long any of it has to last is the one question the law answers in numbers. The law library records the period as prose inside the obligation sentence, so the periods below are read out of those sentences when this page is built, by the rule in section 2, and each is shown with the sentence it came from.
92 of the 355 requirement lines in force in this class state a period a record has to last. They run from 10 days to ten years, and they are not the same kind of number: some are the shortest you may keep something, others the longest.
|
Loi n° 1/10, Articles 3, 4(3) and 14: security-of-service duty and diligence penalty for network operators and service providers, Loi n° 1/10 du 16 mars 2022 portant prevention et repression de la cybercriminalite au Burundi, Arts. 3, 4(3), 14
Source
as of
|
|
Prince Edward Island 10 years at least If you disclose personal health information without the consent of the individual to whom it relates for health related purposes, record the name of the person to whom you disclose it, the date and purpose of the disclosure and a description of the information disclosed, and keep the record for at least 10 years following the disclosure unless the Act or the regulations provide otherwise (s. 34 (1)).
Health Information Act, records respecting disclosure without consent, R.S.P.E.I. 1988, c. H-1.41, s. 34
Source
as of
|
|
Sécurité des systèmes d'information (dispositions communes), Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre III, Section 2, arts. 28-35
Source
as of
|
|
Political Advertising Regulation, Targeting and Ad-Delivery Techniques (Articles 18 and 19), Regulation (EU) 2024/900, Arts. 18-19
Source
as of
|
|
Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications, Communications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70-71
Source
as of
|
|
Sarbanes-Oxley Act section 802: retention of audit and review workpapers and records by an accountant who audits an issuer, 18 U.S.C. 1520; 17 CFR 210.2-06
Source
as of
|
|
|
|
|
|
Healthcare information and records: patient access to records, charges and civil penalty, La. R.S. 40:1165.1
Source
as of
|
|
|
|
Hospital Cybersecurity Requirements, notice of a cybersecurity incident to the Department of Health, 10 NYCRR 405.46(n)
Source
as of
|
|
Security Standards for Smart Devices, Cyber Security Act 2024 (Cth), No. 98, 2024, Part 2, ss. 13-24; Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), Schedule 1
Source
as of
|
|
Bermuda Monetary Authority Insurance Sector Operational Cyber Risk Management Code of Conduct, Notification of Cyber Reporting Events, Insurance Sector Operational Cyber Risk Management Code of Conduct (October 2020), para. 6.5
Source
as of
|
|
Bermuda Monetary Authority Operational Cyber Risk Management Code of Conduct, Notification of Cyber Reporting Events, Operational Cyber Risk Management Code of Conduct (Revised September 2022), paras. 41-44
Source
as of
|
|
Goiás five years at least Keep the information in that database for at least five years, under the stadium owner's responsibility, and make it available to the state security bodies, the Judiciary and the Public Prosecutor's Office on request (art. 2, § 1).
Law No. 20.396 of 2019, biometric identification and image monitoring at football stadiums, Lei nº 20.396, de 3 de janeiro de 2019
Source
as of
|
|
Quebec five years at least Keep the register up to date and keep its information for at least five years after the date or period in which you became aware of the incident.
Confidentiality incident notices and register: required content, Regulation respecting confidentiality incidents, CQLR c A-2.1, r. 3.1
Source
as of
|
|
Ley 41/2002, Confidentiality of Patients' Health Data and Security of Clinical Records in Spain, Ley 41/2002, arts. 7, 16 and 17
Source
as of
|
|
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, )
Source
as of
|
|
Money Laundering (Prevention and Prohibition) Act 2022, customer due diligence, record retention and risk assessment of new technologies, Money Laundering (Prevention and Prohibition) Act, 2022, ss. 4, 8 and 13
Source
as of
|
|
Ley No. 787, Ley de Protección de Datos Personales, Ley No. 787, 29-Mar-2012, Gaceta Oficial No. 61, arts. 1-6, 9, 11-13, 19, 22-24, 27
Source
as of
|
|
Ley N° 6534/2020, de Protección de Datos Personales Crediticios, Ley N° 6534, del año 2020, de Protección de Datos Personales Crediticios
Source
as of
|
|
|
|
Electronic Communications Network and Information Security Regulation, Operator Security Management Duties, Elektronik Haberleşme Sektöründe Şebeke ve Bilgi Güvenliği Yönetmeliği (Resmî Gazete No. 29059, 13 Temmuz 2014), arts. 5, 6, 13 and 37
Source
as of
|
|
|
|
Alaska Personal Information Protection Act, breach notification duty, Alaska Stat. Secs. 45.48.010-45.48.070
Source
as of
|
|
Insurance Data Security, investigation and notification of a cybersecurity event, Alaska Stat. secs. 21.23.270 and 21.23.280 (Insurance Data Security)
Source
as of
|
|
Insurance Data Security Law: records of cybersecurity events kept five years and produced to the Commissioner, Insurance Data Security Law, Ala. Code sec. 27-62-5
Source
as of
|
|
|
|
Insurance Data Security Law: records of each cybersecurity event kept five years and produced on demand, Conn. Gen. Stat. § 38a-38(d)(4)
Source
as of
|
|
Insurance Data Security Act: records of a cybersecurity event kept five years and produced to the Commissioner, Del. Code Ann. tit. 18, § 8605
Source
as of
|
|
Insurance Data Security Act, information security program and investigation of a cybersecurity event, Del. Code Ann. tit. 18, §§ 8604, 8605
Source
as of
|
|
Insurance Data Security Law, cybersecurity event investigation and notice to the commissioner, Insurance Cybersecurity Event Notice, Haw. Rev. Stat. Secs. 431:3B-301 to 431:3B-306
Source
as of
|
|
Insurance Data Security Law, investigation and notification of a cybersecurity event, Insurance Data Security Law, 215 ILCS 215/15 and 215/20
Source
as of
|
|
|
|
|
|
Insurance Data Security Act: investigation of a cybersecurity event and notice to the Insurance Commissioner, Md. Code Ann., Ins. §§ 33-104, 33-105 (Title 33)
Source
as of
|
|
Maine Insurance Data Security Act, licensee information security program, Maine Insurance Data Security Act information security program, 24-A M.R.S. § 2264
Source
as of
|
|
|
|
Michigan Insurance Data Security Act, cybersecurity event investigation and notice to the director, Insurance Cybersecurity Event Notice, MCL 500.557 and 500.559
Source
as of
|
|
Insurance data security law: records of cybersecurity events, kept five years and produced on the commissioner's demand, Minn. Stat. § 60A.9852, subd. 4
Source
as of
|
|
Insurance data security law: retention of documents disclosed to the commissioner about a cybersecurity event, Minn. Stat. § 60A.9855, subd. 4
Source
as of
|
|
Minnesota Insurance Data Security Act, information security program and investigation of a cybersecurity event, Minn. Stat. sections 60A.985, 60A.9851, 60A.9852 (Minnesota Insurance Data Security Act)
Source
as of
|
|
Insurance Data Security Law: audit trails, supporting records and cybersecurity event records, Miss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 §§ 4, 5
Source
as of
|
|
Insurance Data Security Law, investigation and notification of a cybersecurity event, Insurance Data Security Law, sections 5 and 6, Senate Bill 2831 (2019)
Source
as of
|
|
Insurance Data Security Law, investigation and notification of a cybersecurity event, N.D. Cent. Code §§ 26.1-02.2-04, 26.1-02.2-05
Source
as of
|
|
|
|
Insurance Data Security Law, licensee information security program, Insurance Data Security Law information security program, RSA 420-P:4
Source
as of
|
|
Ohio Insurance Data Security Law, cybersecurity event investigation and notice to the superintendent, Insurer Cybersecurity Event Notice, Ohio Rev. Code ss. 3965.03 and 3965.04
Source
as of
|
|
Insurance Data Security Act, investigation of a cybersecurity event and records of every event, Okla. Stat. tit. 36, Sec. 674
Source
as of
|
|
|
|
Insurance Data Security: records of cybersecurity events and of the annual certification, kept five years, 40 Pa.C.S. §§ 4516(b), 4517(d)
Source
as of
|
|
Insurance Data Security chapter, risk assessment, information security program and investigation of a cybersecurity event, Insurance Data Security chapter, 40 Pa.C.S. §§ 4512 to 4517
Source
as of
|
|
Cybersecurity Standards for the Insurance Industry, investigation of a cybersecurity incident and notice to the Commissioner within 72 hours, Rule No. 108 of the Insurance Code Regulations, Sections 9 and 10, Cybersecurity Standards for the Insurance Industry
Source
as of
|
|
Insurance Data Security: investigation of a cybersecurity event and records kept by a domestic insurer, R.I. Gen. Laws sec. 27-1-46(h)(3), (i)
Source
as of
|
|
Insurance Data Security: investigation of a cybersecurity event and records kept by a foreign insurer, R.I. Gen. Laws sec. 27-2-29(h)(3)
Source
as of
|
|
|
|
|
|
Insurance Data Security Act, investigation and notice of a cybersecurity event to the director, Insurance Data Security Act cybersecurity event notice, S.C. Code Ann. secs. 38-99-30 and 38-99-40
Source
as of
|
|
Insurance Data Security Law: investigation records of cybersecurity events and determinations kept five years, Tenn. Code Ann. sec. 56-2-1005(d), (e)
Source
as of
|
|
Insurance Data Security Law: investigation records of cybersecurity events and determinations kept five years, Tenn. Code Ann. sec. 56-2-1005(d), (e)
Source
as of
|
|
Insurance Data Security Law: licensee information security program and investigation of a cybersecurity event, Insurance Data Security Law, Public Chapter 345 (2021), Tenn. Code Ann. secs. 56-2-1004 and 56-2-1005
Source
as of
|
|
Government Data Privacy Act, duties of governmental entities, Utah Code 63A-19-401 to 63A-19-401.3 and 63A-19-404
Source
as of
|
|
Insurance Data Security Act: investigation of a cybersecurity event and records of every event, Va. Code Ann. § 38.2-624
Source
as of
|
|
Insurance Data Security Act: information security program and investigation of a cybersecurity event, Va. Code Ann. §§ 38.2-623 and 38.2-624
Source
as of
|
|
Vermont Insurance Data Security Law, licensee information security program, Vermont Insurance Data Security Law, 8 V.S.A. § 4728
Source
as of
|
|
Insurance Data Security Law, investigation and notice of a cybersecurity event to the commissioner, Insurance Data Security Law cybersecurity event notice, Wis. Stat. secs. 601.953 and 601.954(1)
Source
as of
|
|
Insurance Data Security Law, information security program, Insurance Data Security Law information security program, Wis. Stat. sec. 601.952
Source
as of
|
|
Decree on the Security Measures of a Provider of a Regulated Service in the Lower-Obligations Regime (Vyhláška č. 410/2025 Sb.), Decree No. 410/2025 Coll., on Security Measures of a Lower-Obligations Provider, Sections 3 to 14
Source
as of
|
|
Manitoba three years at least For each electronic information system that holds the information, create and keep a record of user activity for at least three years and audit it to detect security breaches (M.R. 245/97, s. 4).
Personal Health Information Act, security safeguards and the Personal Health Information Regulation, C.C.S.M. c. P33.5, ss. 18-19; M.R. 245/97, ss. 2-8
Source
as of
|
|
Personal Information Protection Law, automated decisions, PIPL Art. 24, Art. 55(2) and Art. 56 (automated decision-making)
Source
as of
|
|
Security Duties of Providers of Public Electronic Communications Networks and Services, Communications Act 2003, c. 21, ss. 105A to 105C; Electronic Communications (Security Measures) Regulations 2022, SI 2022/933
Source
as of
|
|
Cybersecurity Law, digital platform data retention and disclosure duty, Cybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34
Source
as of
|
|
Insurance Data Security Act: licensee information security program, investigation of a cybersecurity event and incident response plan, Insurance Data Security Act, Mo. Rev. Stat. secs. 375.1405, 375.1407 and 375.1417
Source
as of
|
|
Data Protection Ordinance, retention of the impact assessment and breach documentation, Data Protection Ordinance, SR 235.11, Art. 14, Art. 15 para. 4
Source
as of
|
|
Data Protection Ordinance, retention of the impact assessment and breach documentation, Data Protection Ordinance, SR 235.11, Art. 14, Art. 15 para. 4
Source
as of
|
|
Privacy Protection Regulations (Data Security), access-monitoring records and their retention, Data Security Regulations, 5777-2017 (Privacy Protection), Regs. 10 and 17(a)
Source
as of
|
|
Privacy Protection Regulations (Data Security), information security programme, Privacy Protection Regulations (Data Security), 5777-2017, Regs. 1-10, 11(a)-(c), 12-20, 22; Protection of Privacy Law, 5741-1981, Art. 23KF and Third Schedule (enforcement)
Source
as of
|
|
Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), security incidents and access records, Decreto Supremo No. 016-2024-JUS, Reglamento de la Ley No. 29733, Ley de Protección de Datos Personales, arts. 34-36 and 46 (security-incident notice and documentation; records of interactions with personal data)
Source
as of
|
|
Insurance Information and Privacy Protection Act: notice, access and correction, adverse underwriting decisions and disclosure limits, Cal. Ins. Code sections 791 to 791.28
Source
as of
|
|
CCPA Regulations: training, record-keeping and metrics (article 8), Cal. Code Regs. tit. 11, sections 7100 to 7102
Source
as of
|
|
HB 24-1130, Privacy of Biometric Identifiers and Data, C.R.S. sections 6-1-1303(2.2)-(2.4), 6-1-1314 (2024 Colo. Sess. Laws ch. 313)
Source
as of
|
|
Alberta one year at least Retain that information for at least one year after using it so the individual has a reasonable opportunity to obtain access to it, or for any shorter period agreed in writing by the individual, the public body and, if different, the body that approves your records retention and disposition schedule.
Protection of Privacy Act, automated-system notice and decision accuracy duties of public bodies, Protection of Privacy Act, S.A. 2024, c. P-28.5, ss. 5 (2), 6
Source
as of
|
|
Alberta one year at least Keep the record or log for at least one year following the date of the input or use of the automated system.
Health Information Act, automated systems, R.S.A. 2000, c. H-5, ss. 22 (3), 27 (1.1), 27.1
Source
as of
|
|
Data Protection Ordinance, logging of automated processing, Data Protection Ordinance (DPO / DSV / OPDo), SR 235.11, Art. 4
Source
as of
|
|
Personal Information Protection Act, safety measures and access records, Act No. 10465 (as amended by Act No. 21445, 2026), Art. 29; Enforcement Decree (Presidential Decree No. 36671, 2026), Art. 30(1); Personal Information Protection Commission Notice No. 2025-9 (Standards for Personal Information Safety Measures), Art. 8
Source
as of
|
|
LTA Cybersecurity Regulations 2026: Cybersecurity Unit, Risk Identification, Protection, Detection and Recovery Duties of Telecommunications Service Providers, LTA Cybersecurity Regulations 2026 (LTA REG 0013 - 2026), regs. 7.1 to 7.5, 7.7, 7.8 and 10
Source
as of
|
|
Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties, Loi n° 05-20 relative à la cybersécurité, Chapitre II, Section 3, Arts. 26, 29, 32 et 34, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe
Source
as of
|
|
Network Product Security Vulnerability Management Provisions, network operator duty to repair, Arts. 8 and 13, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security)
Source
as of
|
|
Network Product Security Vulnerability Management Provisions, product provider duties, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security), Arts. 5, 7 and 12
Source
as of
|
|
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, )
Source
as of
|
|
Cybersecurity Rules for Operators of Essential Services, Arrêté N°2022-040/PMRT du 29 juin 2022 portant adoption des règles de cybersécurité en République togolaise (Règles de Cybersécurité, version 1.0)
Source
as of
|
|
Federal Law No. 572-FZ, Unified Biometric System for Identification and Authentication, Federal Law No. 572-FZ of "On the identification and/or authentication of individuals using biometric personal data"
Source
as of
|
Gabon
Nauru
Louisiana
Nevada
Australia
Bermuda
Spain
Nicaragua
Paraguay
Sweden
Turkey
Alaska
Alabama
Connecticut
Delaware
Hawaii
Illinois
Kentucky
Maryland
Maine
Michigan
Minnesota
Mississippi
North Dakota
New Hampshire
Ohio
Oklahoma
Oregon
Pennsylvania
Puerto Rico
Rhode Island
South Carolina
Tennessee
Utah
Virginia
Vermont
Wisconsin
Czech Republic
China
Myanmar
Missouri
Switzerland
Israel
Liberia
Morocco
Togo
Russia
Two things this table does not show. Periods stated as a test rather
than a number, no longer than is necessary for the purpose being the
commonest of them, bind just as hard and cannot be drawn on a scale.
And the period that will matter most to an agent is not here yet:
the EU AI Act's Article 19 and
Article 26(6)
require the automatically generated logs of a high-risk AI system to be
kept for a period appropriate to the intended purpose and at least six
months, and both bind from , in 13 months.
355 requirement lines in force · 351 provisions · 161 jurisdictions · from: privacy 263 · cybersecurity 84 · AI 41 · scraping 10
The law behind the class Show 7 of the 355 requirement lines in forceHide them
Drawn to span jurisdictions rather than to rank them. Each line is the law library's own statement of the requirement, with the instrument it comes from, the page that carries the citation and the source, and the date it was read.
|
AI Act, Article 4a (processing of special categories of personal data for bias detection and correction), Regulation (EU) 2024/1689, Article 4a
Source
as of
|
|
California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713), Cal. Bus. and Prof. Code Sections 22757 to 22757.6
Source
as of
|
|
|
|
Texas data broker information security program, Tex. Bus. & Com. Code secs. 510.007, 510.009
Source
as of
|
|
Personal Information Protection Act, pseudonymized information, Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties)
Source
as of
|
|
General outsourcing requirements for a common platform firm: relying on a third party to perform operational functions, including critical or important functions, FCA Handbook, SYSC 8.1.1R, 8.1.4AR and 8.1.6-AR to 8.1.11-BR
Source
as of
|
|
ANPD Regulation on Reporting Security Incidents (Resolution CD/ANPD No. 15/2024), Resolução CD/ANPD nº 15, de 24 de abril de 2024 (Regulamento de Comunicação de Incidente de Segurança), Anexo, arts. 4º-6º, 9º and 10
Source
as of
|
No item. The list asks that custody, access, transfers, retention and integrity checks be documented, and sets no period, which is the one question the law library answers in numbers.
Some items in the alliance's list belong to none of the classes above. They are quoted here, in its words, rather than filed under a class they are not about, and the law library is not read against them.
Records of the operating and test environments, including infrastructure, runtime and software versions, images or build definitions retained and identified by content digest, the agent's working directory at the start of the affected session (e.g., a repository with both committed and uncommitted changes), network paths, isolation boundaries, connected systems, relevant configurations, and any differences between the intended environment, the environment as described to the agent, and the environment encountered.
For physical systems, preserve relevant sensor and actuator records, physical state, safety interlocks, operating limits and human interventions.
For human language-dependent controls, record the languages, scripts and code-switching involved, and whether the implicated controls were evaluated for those inputs.
SAFE v1.0 Evidence Preservation, read .
4The shape of the answer
Read across the nine sections and the law's priorities are plain, and they are not an incident responder's. The class with the most binding law behind it is the incident timeline (846 requirement lines in force). The class with the least is permissions and credentials at run time (25). What the law asks you to produce is mostly the what and the when of an event that has already been judged significant. What it almost never asks you to produce is the run-time detail that would let anyone work out why the system did it.
That asymmetry is the practical finding of this document. A record built only to the standard of what is legally demandable will satisfy a regulator and leave your own engineers unable to answer the first question they will be asked. The law is a floor here in a way it is not on What the law makes you constrain, where the duties bite directly.
5What this document does not claim
It does not say what to log. It says what binding law, as the law library held it on the date in the byline, can make an organization produce, and it counts how much of the law library speaks to each class. A thin class is not permission to keep nothing: contract, sectoral regulation, a customer's own requirements and the ordinary duty to be able to defend yourself all reach past it.
It also does not adopt anyone's framework. The alliance's evidence list is quoted because a reader holding it should be able to find the same ground here with the law underneath, and because the points where our list and theirs differ, retention among them, are worth seeing rather than smoothing over. It is the compact as it stood on the date it was read, the alliance may revise it, and the law beside it is dated on every line.