FINOS AIGF AIR-DET-021, Agent Decision Audit and Explainability: the laws that bear on it

Data subject rights

99 laws, 87 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée	Through its data subject rights duty. What it requires
Andorra	LQPD, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Angola	Law on the Protection of Personal Data, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Antigua and Barbuda	Data Protection Act, 2013, notice and rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Argentina	Ley 25.326, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Barbados	Data Protection Act, 2019, automated decisions	Through its data subject rights duty. What it requires
Barbados	Data Protection Act, 2019, rights of a data subject	Through its data subject rights, disclosure duties. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject	Through its data subject rights, disclosure duties. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées	Through its data subject rights, disclosure duties. What it requires

Show the other 89 laws

Bolivia	Constitución Política del Estado, Acción de Protección de Privacidad	Through its data subject rights duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Botswana	Data Protection Act, 2024, rights of data subjects	Through its data subject rights duty. What it requires
Brazil	LGPD, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Burkina Faso	Personal Data Protection Law, automated decisions	Through its disclosure duty. What it requires
Burkina Faso	Personal Data Protection Law, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
California	CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-Out	Through its data subject rights duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, rights of data subjects proposed	Through its data subject rights, disclosure duties. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement	Through its data subject rights duty. What it requires
Chad	Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)	Through its data subject rights, disclosure duties. What it requires
Colombia	Ley 1581 de 2012, Data Subject Rights and Procedures	Through its data subject rights, disclosure duties. What it requires
Colombia	SIC Circular on AI, Data Subject Rights	Through its data subject rights duty. What it requires
Comoros	Law on the Protection of Personal Data, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Democratic Republic of the Congo	Digital Code, Title III, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas data	Through its data subject rights duty. What it requires
Ecuador	LOPDP, derechos del titular	Through its data subject rights duty. What it requires
Ecuador	SPDP Norma General guaranteeing personal-data protection in the use of AI systems from a date not yet set	Through its data subject rights, disclosure, governance duties. What it requires
Egypt	Egypt Personal Data Protection Law, rights of the Data Subject	Through its data subject rights duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Eswatini	Data Protection Act, 2022, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Ethiopia	Personal Data Protection Proclamation, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
European Union	GDPR Article 22, Automated Individual Decision-Making	Through its data subject rights duty. What it requires
Gabon	Law No. 025/2023, automated decisions and profiling	Through its data subject rights duty. What it requires
Gabon	Law No. 025/2023, rights of the data subject and transparency obligations	Through its data subject rights, disclosure duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, rights of the data subject from a date not yet set	Through its data subject rights, disclosure duties. What it requires
Ghana	Data Protection Act, 2012, automated decision-taking	Through its data subject rights duty. What it requires
Ghana	Data Protection Act, rights of data subjects	Through its data subject rights duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, rights of data subjects from a date not yet set	Through its data subject rights, disclosure duties. What it requires
Guatemala	Constitución Política de la República de Guatemala, Art. 31 (habeas data)	Through its data subject rights duty. What it requires
Ireland	GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland	Through its data subject rights duty. What it requires
Ireland	GDPR Articles 12-21 and Data Protection Act 2018 Sections 60-61, Data Subject Rights in Ireland	Through its data subject rights duty. What it requires
Jamaica	Data Protection Act, 2020, automated decision-taking	Through its data subject rights duty. What it requires
Jamaica	Data Protection Act, 2020, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Kiribati	Data Protection Act 2025, rights of a data subject from a date not yet set	Through its data subject rights, disclosure duties. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Lebanon	Law No. 81/2018, Part V, notice, objection, access and correction	Through its data subject rights, disclosure duties. What it requires
Lesotho	Data Protection Act, 2011, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Libya	Law No. 6 of 2022, notice, access and objection rights over personal data	Through its data subject rights, disclosure duties. What it requires
Madagascar	Law No. 2014-038, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, rights of a data subject and information notice (Part VII)	Through its data subject rights, disclosure duties. What it requires
Maldives	Maldives Personal Data Protection Bill, rights of data subjects proposed	Through its data subject rights, disclosure duties. What it requires
Mali	Loi n° 2013-015, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Mauritania	Loi n° 2017-020, droits de la personne concernée	Through its data subject rights, disclosure duties. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rights	Through its data subject rights duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, automated decisions	Through its data subject rights duty. What it requires
Moldova	Moldova Law No. 195/2024, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Monaco	Loi sur la Protection des Données Personnelles, droits de la personne concernée	Through its data subject rights, disclosure duties. What it requires
Montenegro	Law on Personal Data Protection, rights of the data subject from a date not yet set	Through its data subject rights, disclosure duties. What it requires
Morocco	Law No. 09-08, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Mozambique	Electronic Transactions Law, data subject rights and information notice	Through its data subject rights, disclosure duties. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Niger	Loi n° 2022-59, droits des personnes concernées	Through its data subject rights, disclosure duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023, rights of a data subject	Through its data subject rights, disclosure duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), rights of the data subject	Through its data subject rights duty. What it requires
Panama	Ley 81 de 2019, rights of data subjects	Through its data subject rights duty. What it requires
Paraguay	Ley N° 7593/2025, automated or semi-automated individual decisions from 27 Nov 2027, in 14 months	Through its data subject rights duty. What it requires
Paraguay	Ley N° 7593/2025, derechos del titular de datos from 27 Nov 2027, in 14 months	Through its data subject rights, disclosure duties. What it requires
Peru	Ley 29733, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Republic of the Congo	Law No. 29-2019, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Russia	Federal Law No. 152-FZ, Article 16, Decisions Based Solely on Automated Processing	Through its data subject rights duty. What it requires
Russia	Federal Law No. 152-FZ, Articles 14 and 17, Data Subject Rights	Through its data subject rights duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, rights of data subjects from a date not yet set	Through its data subject rights duty. What it requires
Saint Lucia	Data Protection Act, rights of data subjects and others from a date not yet set	Through its data subject rights duty. What it requires
Samoa	National Digital Identification Act 2024, registered persons' data-subject rights	Through its data subject rights, disclosure duties. What it requires
San Marino	San Marino Law No. 171, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Sao Tome and Principe	Lei n.º 03/2016, rights of the data holder	Through its data subject rights, disclosure duties. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernée	Through its data subject rights, disclosure duties. What it requires
Serbia	Law on Personal Data Protection, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Somalia	Data Protection Act, 2023, information to the data subject and rights of the data subject	Through its data subject rights, disclosure duties. What it requires
South Africa	Protection of Personal Information Act, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, rights of the data subject proposed	Through its data subject rights, disclosure duties. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketing	Through its data subject rights duty. What it requires
Timor-Leste	Constitution of Timor-Leste, Section 38(1) (Access to personal data)	Through its data subject rights duty. What it requires
Togo	Loi n° 2019-014, droits de la personne concernée	Through its data subject rights, disclosure duties. What it requires
Tonga	Privacy Act 2025, notification to data subjects and rights of data subjects from a date not yet set	Through its data subject rights, disclosure duties. What it requires
Trinidad and Tobago	Data Protection Act, 2011, rights of access and correction from a date not yet set	Through its data subject rights duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Uganda	Data Protection and Privacy Act, 2019, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Ukraine	Draft Law No. 8153, automated decision making proposed	Through its disclosure duty. What it requires
Ukraine	Draft Law No. 8153, data subject rights proposed	Through its data subject rights duty. What it requires
Uruguay	Ley N° 18.331, rights of data subjects	Through its data subject rights, disclosure duties. What it requires
Vanuatu	Data Protection and Privacy Act 2024, rights of the data subject	Through its data subject rights duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data, data subject rights	Through its data subject rights duty. What it requires
Venezuela	Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)	Through its data subject rights duty. What it requires
Zambia	Data Protection Act, 2021, rights of the data subject	Through its data subject rights, disclosure duties. What it requires
Zimbabwe	Cyber and Data Protection Act, rights of the data subject	Through its data subject rights, disclosure duties. What it requires

Comprehensive regime

95 laws, 91 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its governance duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its governance duty. What it requires
Angola	Law on the Protection of Personal Data	Through its disclosure duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013	Through its retention duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its disclosure, governance, retention duties. What it requires
Barbados	Data Protection Act, 2019	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its governance duty. What it requires
Belize	Data Protection Act 2021, comprehensive regime from a date not yet set	Through its data subject rights duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its governance, retention duties. What it requires

Show the other 85 laws

Bolivia	Anteproyecto de Ley de Protección de Datos Personales (AGETIC) proposed	Through its data subject rights duty. What it requires
Bolivia	Reglamento para el Desarrollo de TIC, Tratamiento de los Datos Personales	Through its disclosure duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its governance duty. What it requires
Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its governance duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its governance, retention duties. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its governance, retention duties. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data	Through its disclosure duty. What it requires
California	California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)	Through its data subject rights, disclosure, retention duties. What it requires
California	CCPA Cybersecurity Audit Regulations	Through its reporting duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its governance duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its governance duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, application, principles and data subject rights	Through its data subject rights duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its governance, retention duties. What it requires
Chad	Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)	Through its disclosure, retention duties. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its governance, retention duties. What it requires
Cuba	Ley 149/2022, De Protección de Datos Personales, general regime	Through its data subject rights duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data	Through its governance, retention duties. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its governance, retention duties. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its governance duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its governance duty. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its governance duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its governance, retention duties. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its disclosure, governance, retention duties. What it requires
Equatorial Guinea	Ley de Protección de Datos Personales	Through its data subject rights, disclosure duties. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its governance, retention duties. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its governance, retention duties. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its governance duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its governance, retention duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025 from a date not yet set	Through its governance duty. What it requires
Ghana	Data Protection Act	Through its disclosure duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its governance, retention duties. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its disclosure, governance, retention duties. What it requires
Kiribati	Data Protection Act 2025 from a date not yet set	Through its retention duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its governance duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its governance, retention duties. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its governance, retention duties. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its governance, retention duties. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)	Through its retention duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its governance, retention duties. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its governance, reporting duties. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its governance, retention duties. What it requires
Mauritania	Loi n° 2017-020, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its disclosure, governance, retention duties. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its governance, retention duties. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its governance, retention duties. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its disclosure, governance duties. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its data subject rights, retention duties. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its governance, retention duties. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023 (NDPA), general data protection duties	Through its governance, reporting duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP)	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), video surveillance	Through its retention duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its disclosure, governance, retention duties. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its governance duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its governance, retention duties. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its governance, retention duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018 from a date not yet set	Through its disclosure, retention duties. What it requires
Saint Lucia	Data Protection Act	Through its disclosure, retention duties. What it requires
Samoa	Telecommunications Act 2005, confidentiality and protection of customer personal information	Through its disclosure duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its governance duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its governance, retention duties. What it requires
Serbia	Law on Personal Data Protection	Through its governance duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its data subject rights, disclosure, retention duties. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its governance, retention duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its governance, retention duties. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its governance, retention duties. What it requires
Taiwan	Personal Data Protection Act (個人資料保護法)	Through its reporting duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its governance, retention duties. What it requires
Tonga	Privacy Act 2025, comprehensive personal information protection regime from a date not yet set	Through its retention duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011	Through its disclosure, governance, retention duties. What it requires
Tunisia	Organic Act on the Protection of Personal Data	Through its disclosure, governance, retention duties. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its governance, retention duties. What it requires
Ukraine	Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform) proposed	Through its governance duty. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its governance, reporting duties. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its disclosure, governance, retention duties. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its governance duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its disclosure, governance, retention duties. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its disclosure, governance duties. What it requires

Enforcement supervision

67 laws, 67 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, Commissioner, remedies, liability and penalties	Through its governance, reporting duties. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours	Through its governance, reporting duties. What it requires
Andorra	LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions	Through its governance, reporting duties. What it requires
Angola	Law on the Protection of Personal Data, enforcement and supervision	Through its governance, reporting duties. What it requires
Antigua and Barbuda	Data Protection Act, 2013, information commissioner and enforcement	Through its governance, reporting duties. What it requires
Argentina	Ley 25.326, enforcement, sanctions, and the habeas data action	Through its governance, reporting duties. What it requires
Bahamas	Data Protection Act 2003, Commissioner, enforcement and penalties	Through its governance, reporting duties. What it requires
Barbados	Data Protection Act, 2019, the Commissioner, enforcement and penalties	Through its governance, reporting duties. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability	Through its governance, reporting duties. What it requires
Belize	Data Protection Act 2021, Commissioner, Tribunal, and enforcement from a date not yet set	Through its governance, reporting duties. What it requires

Show the other 57 laws

Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénales	Through its governance, reporting duties. What it requires
Bermuda	Personal Information Protection Act 2016, Commissioner, enforcement and offences	Through its governance, reporting duties. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties	Through its governance, reporting duties. What it requires
Brazil	LGPD, civil liability, administrative sanctions and the ANPD	Through its governance, reporting duties. What it requires
Burkina Faso	Personal Data Protection Law, supervisory authority and sanctions	Through its governance, reporting duties. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision	Through its governance, reporting duties. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)	Through its retention duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences	Through its governance, reporting duties. What it requires
Chad	Loi n°007/PR/2015, sanctions administratives et pénales et recours	Through its governance duty. What it requires
China	Personal Information Protection Law, Supervision and Legal Liability	Through its governance duty. What it requires
Colombia	SIC Circular on AI, Demonstrated Accountability	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data, the Commission and sanctions	Through its governance, reporting duties. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body	Through its governance, reporting duties. What it requires
Democratic Republic of the Congo	Digital Code, Data Protection Authority and sanctions	Through its disclosure, governance, reporting duties. What it requires
Djibouti	Digital Code, Book I: the Commission, administrative sanctions and criminal offences	Through its governance, reporting duties. What it requires
Egypt	Egypt Personal Data Protection Law, the Center, judicial control and penalties	Through its governance, reporting duties. What it requires
Eswatini	Data Protection Act, 2022, enforcement and offences	Through its governance, reporting duties. What it requires
Ethiopia	Personal Data Protection Proclamation, enforcement, sanctions and offences	Through its governance, reporting duties. What it requires
Gabon	Law No. 025/2023, recourse, oversight and sanctions	Through its governance, reporting duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties from a date not yet set	Through its governance duty. What it requires
Ghana	Data Protection Act, enforcement, offences and penalties	Through its governance, reporting duties. What it requires
Grenada	Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences from a date not yet set	Through its governance, reporting duties. What it requires
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its data subject rights, governance, retention duties. What it requires
Jamaica	Data Protection Act, 2020, the Information Commissioner, penalties and compensation	Through its reporting duty. What it requires
Kiribati	Data Protection Act 2025, enforcement, offences and civil remedies from a date not yet set	Through its governance, reporting duties. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties	Through its governance, reporting duties. What it requires
Lesotho	Data Protection Act, 2011, enforcement and offences	Through its governance, reporting duties. What it requires
Libya	Law No. 6 of 2022, supervisory authority, licensing and penalties	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, CMIL, sanctions and offences	Through its governance, reporting duties. What it requires
Mali	Loi n° 2013-015, the Autorité, supervision, and sanctions	Through its governance, reporting duties. What it requires
Marshall Islands	Personal Data Protection Act 2025, competent authority, remedies, and complaints	Through its governance, reporting duties. What it requires
Mauritania	Loi n° 2017-020, Autorité de Protection des Données et sanctions	Through its governance, reporting duties. What it requires
Moldova	Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions	Through its governance, reporting duties. What it requires
Monaco	Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctions	Through its governance, reporting duties. What it requires
Montenegro	Law on Personal Data Protection, agency, supervision and penal provisions from a date not yet set	Through its governance, reporting duties. What it requires
Morocco	Law No. 09-08, the CNDP and sanctions	Through its governance, reporting duties. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints	Through its governance, reporting duties. What it requires
Niger	Loi n° 2022-59, contrôle, sanctions et recours	Through its governance, reporting duties. What it requires
Nigeria	Nigeria Data Protection Act, 2023, complaints, enforcement and redress	Through its governance, reporting duties. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions	Through its governance, reporting duties. What it requires
Panama	Ley 81 de 2019, enforcement and sanctions	Through its governance, reporting duties. What it requires
Peru	Ley 29733, enforcement, supervisory authority and sanctions	Through its governance, reporting duties. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences	Through its governance, reporting duties. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, Information Commissioner, enforcement and offences from a date not yet set	Through its governance, reporting duties. What it requires
San Marino	San Marino Law No. 171, the Data Protection Authority, remedies and fines	Through its governance, reporting duties. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions	Through its governance, reporting duties. What it requires
Somalia	Data Protection Act, 2023, complaints, orders of the Authority and civil remedies	Through its governance, reporting duties. What it requires
South Africa	Protection of Personal Information Act, the Information Regulator, enforcement and penalties	Through its governance, reporting duties. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties	Through its governance, reporting duties. What it requires
Togo	Loi n° 2019-014, cadre institutionnel et dispositions pénales	Through its governance, reporting duties. What it requires
Tonga	Privacy Act 2025, penalties, enforcement and third party actions from a date not yet set	Through its governance, reporting duties. What it requires
Trinidad and Tobago	Data Protection Act, 2011, Commissioner, contravention and enforcement	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, enforcement and sanctions	Through its governance, reporting duties. What it requires
United States	FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)	Through its disclosure duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, enforcement powers and offences	Through its governance, reporting duties. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its governance, reporting duties. What it requires

Vulnerability and incident reporting

67 laws, 61 places

Place	Law	How it reaches this control
Andorra	Llei 22/2022, Incident Handling and Notification Obligation	Through its reporting duty. What it requires
Angola	Lei de Protecção das Redes e Sistemas Informáticos, Incident-Management Planning, Alert Dissemination and CERT Coordination Duties	Through its reporting duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Bangladesh	Cyber Security Act, Computer Emergency Response Team, Duty to Report a Cyber Incident	Through its reporting duty. What it requires
Belgium	Loi du 26 avril 2024, Significant-Incident Notification Obligations	Through its reporting duty. What it requires
Bulgaria	Cybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)	Through its reporting duty. What it requires
China	Data Security Law, Risk Monitoring and Incident Reporting Duty	Through its reporting duty. What it requires
China	National Cybersecurity Incident Reporting Measures	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations	Through its reporting duty. What it requires
Cuba	Resolución 105/2021, Reglamento sobre el Modelo de Actuación Nacional para la Respuesta a Incidentes de Ciberseguridad	Through its reporting duty. What it requires

Show the other 57 laws

Cyprus	Security of Networks and Information Systems Law, Incident Notification Obligations	Through its reporting duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Incident Notification	Through its reporting duty. What it requires
Côte d'Ivoire	Mandatory Reporting of Attacks and Intrusions to ARTCI	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre II: Trust Service Provider Security-Incident Notification	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: General Cyberattack Cooperation and Incident-Reporting Duty	Through its reporting duty. What it requires
Denmark	NIS 2-loven, Significant-Incident Reporting and Recipient-Notice Duties	Through its reporting duty. What it requires
Djibouti	Digital Code, Book VII: National Health Data System Security Incident Reporting	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), Duty to Notify of a Cyber Incident	Through its reporting duty. What it requires
Ethiopia	Computer Crime Proclamation, Duty to Report Computer Crime and Illegal Content	Through its reporting duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Cyber Incident Reporting to National CERT from 21 Jul 2027, in 9 months	Through its reporting duty. What it requires
European Union	Cyber Resilience Act, Manufacturer Reporting Obligations	Through its reporting duty. What it requires
European Union	DORA, Article 19 (reporting of major ICT-related incidents), with the time limits of Delegated Regulation (EU) 2025/301	Through its reporting duty. What it requires
European Union	NIS2 Directive, Reporting Obligations	Through its reporting duty. What it requires
Finland	Kyberturvallisuuslaki, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
France	Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification	Through its reporting duty. What it requires
Germany	BSI-Gesetz (BSIG), Incident Notification	Through its reporting duty. What it requires
Ghana	Cybersecurity Act, Duty to Report Cybersecurity Incident	Through its reporting duty. What it requires
Greece	Law 5160/2024, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Hungary	Cybersecurity Act, Incident Notification and Cybersecurity Fine	Through its reporting duty. What it requires
Iceland	Notification of Serious Incidents and Risk to the National Cybersecurity Incident-Response Team	Through its reporting duty. What it requires
India	CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation	Through its reporting duty. What it requires
Indonesia	Government Regulation on the Operation of Electronic Systems and Transactions, security-incident reporting duty	Through its reporting duty. What it requires
Ireland	European Union (NIS) Regulations 2018, Incident Notification	Through its reporting duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification	Through its reporting duty. What it requires
Jordan	Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty	Through its reporting duty. What it requires
Kenya	Computer Misuse and Cybercrimes Act, Reporting of Cyber Threat	Through its reporting duty. What it requires
Kiribati	Cybersecurity Act 2026, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Kyrgyzstan	Digital Code, digital resilience incident notification	Through its reporting duty. What it requires
Latvia	Nacionālās kiberdrošības likums, Incident Notification	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Incident Notification	Through its reporting duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Incident Notification	Through its reporting duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Incident Notification	Through its reporting duty. What it requires
Malta	Gaming Authorisations and Compliance Directive, Notification of Information Security Breaches	Through its reporting duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Significant-Incident Reporting to the National CSIRT	Through its reporting duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity Incident Reporting Obligations	Through its reporting duty. What it requires
Mongolia	Law on Cyber Security, Cyber-Attack Notification Duty for Other Legal Persons	Through its reporting duty. What it requires
Montenegro	Law on Information Security, Cyber Threat and Incident Reporting	Through its reporting duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties	Through its disclosure, reporting duties. What it requires
Mozambique	Cybersecurity Law, Incident Notification and Responsible Vulnerability Disclosure	Through its disclosure, reporting duties. What it requires
Netherlands	Cyberbeveiligingswet, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
New York	New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent	Through its reporting duty. What it requires
Nigeria	Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, Reporting of Cyber Threats to the National CERT	Through its reporting duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Significant-Incident Reporting Obligations	Through its reporting duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Incident Notification	Through its reporting duty. What it requires
Serbia	Law on Information Security, Incident Reporting Obligations	Through its reporting duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents	Through its reporting duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Incident and Vulnerability Notification	Through its reporting duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Significant-Incident Notification Obligations	Through its reporting duty. What it requires
South Korea	Information and Communications Network Act, Report on Computer Security Incidents	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Incident Notification Obligation	Through its reporting duty. What it requires
Sweden	Cybersäkerhetslag, Incident Notification	Through its reporting duty. What it requires
Taiwan	Cyber Security Management Act, Cyber Security Incident Reporting	Through its reporting duty. What it requires
Tonga	Cybersecurity Act 2025, Duty to Report a Cybersecurity Incident from a date not yet set	Through its reporting duty. What it requires
Tunisia	Cybersecurity Incident Reporting and Emergency Response	Through its reporting duty. What it requires
Turkey	Cybersecurity Law, Reporting and Cooperation Duties	Through its reporting duty. What it requires
Ukraine	Law on the Basic Principles of Ensuring Cybersecurity, CERT-UA Incident Notification Duty	Through its reporting duty. What it requires
Vietnam	Cybersecurity Law, Incident Response and Reporting Duties	Through its reporting duty. What it requires

Breach notification

45 laws, 44 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, notification of a personal data breach	Through its reporting duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de données	Through its reporting duty. What it requires
Andorra	LQPD, personal data breach notification	Through its reporting duty. What it requires
Barbados	Data Protection Act, 2019, personal data breach notification	Through its reporting duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violations	Through its reporting duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité	Through its reporting duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification	Through its reporting duty. What it requires
Brazil	LGPD, security incident notification	Through its reporting duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, personal data breach notification proposed	Through its reporting duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, personal data breach notification	Through its reporting duty. What it requires

Show the other 35 laws

Colombia	Ley 1581 de 2012, Security Breach Notification to the Authority	Through its reporting duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, personal data breach notification	Through its reporting duty. What it requires
Djibouti	Digital Code, Book I: personal-data breach notification	Through its reporting duty. What it requires
Ecuador	LOPDP, notificación de vulneración de seguridad	Through its reporting duty. What it requires
Egypt	Egypt Personal Data Protection Law, Personal Data Infringement notification	Through its reporting duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, personal data breach notification	Through its reporting duty. What it requires
Ethiopia	Personal Data Protection Proclamation, personal data breach notification	Through its reporting duty. What it requires
Gabon	Law No. 025/2023, personal-data breach notification	Through its reporting duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, personal data breach notification from a date not yet set	Through its reporting duty. What it requires
Jamaica	Data Protection Act, 2020, reporting a contravention or security breach	Through its reporting duty. What it requires
Kiribati	Data Protection Act 2025, personal data breaches from a date not yet set	Through its reporting duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, personal data breach notification	Through its reporting duty. What it requires
Maldives	Maldives Personal Data Protection Bill, personal data breach notification proposed	Through its reporting duty. What it requires
Moldova	Moldova Law No. 195/2024, personal data breach notification	Through its reporting duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, notification des violations de données	Through its reporting duty. What it requires
Niger	Loi n° 2022-59, notification des violations de données	Through its reporting duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, data breach notification	Through its reporting duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), personal data breach notification	Through its reporting duty. What it requires
Paraguay	Ley N° 7593/2025, notificación de un incidente de seguridad from 27 Nov 2027, in 14 months	Through its reporting duty. What it requires
Puerto Rico	Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)	Through its reporting duty. What it requires
Republic of the Congo	Law No. 29-2019, personal-data breach notification	Through its reporting duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, personal data breach notification	Through its reporting duty. What it requires
San Marino	San Marino Law No. 171, personal data breach notification	Through its reporting duty. What it requires
Serbia	Law on Personal Data Protection, personal data breach notification	Through its reporting duty. What it requires
Somalia	Data Protection Act, 2023, personal data breach notification	Through its reporting duty. What it requires
South Africa	Protection of Personal Information Act, notification of security compromises	Through its reporting duty. What it requires
South Carolina	Business data breach of security, notification statute	Through its reporting duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notification	Through its reporting duty. What it requires
Tonga	Privacy Act 2025, personal information breaches from a date not yet set	Through its reporting duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, breach notification	Through its reporting duty. What it requires
Ukraine	Draft Law No. 8153, personal data breach notification proposed	Through its reporting duty. What it requires
Uruguay	Ley N° 19.670, personal data breach notification	Through its reporting duty. What it requires
Zambia	Data Protection Act, 2021, notification of a security breach	Through its reporting duty. What it requires
Zimbabwe	Cyber and Data Protection Act, security breach notification	Through its reporting duty. What it requires
Zimbabwe	Cyber and Data Protection Regulations 2024, security breach notification	Through its reporting duty. What it requires

Sector security regimes

45 laws, 43 places

Place	Law	How it reaches this control
Albania	Law No. 25/2024, On Cybersecurity	Through its governance, reporting duties. What it requires
Andorra	Llei 22/2022, Cybersecurity Risk-Management Obligations	Through its governance duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Belgium	Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Bulgaria	Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)	Through its governance duty. What it requires
Central African Republic	Cybersecurity Law: Mandatory Security Audit Regime	Through its reporting duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance	Through its governance duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures	Through its governance duty. What it requires
Denmark	NIS 2-loven, Cybersecurity Risk-Management Measures and Registration	Through its governance duty. What it requires

Show the other 35 laws

Djibouti	Digital Code, Book II: Electronic Communications Network and Service Security	Through its reporting duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Through its governance duty. What it requires
Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its governance duty. What it requires
European Union	NIS2 Directive, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Finland	Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Germany	BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Greece	Law 5160/2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its governance duty. What it requires
Hungary	Cybersecurity Act, Risk-Management Measures	Through its governance duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its governance duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures	Through its governance duty. What it requires
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires
Lebanon	Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)	Through its reporting duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures	Through its governance duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure	Through its governance duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its governance duty. What it requires
Morocco	Loi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Security Duties	Through its retention duty. What it requires
Mozambique	Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers	Through its governance duty. What it requires
Netherlands	Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its governance duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Critical National Information Infrastructure	Through its governance duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures	Through its governance duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance from 19 Dec 2026, in 2 months	Through its governance duty. What it requires
Somalia	National Cybersecurity Law (2025)	Through its reporting duty. What it requires
Spain	Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers	Through its governance duty. What it requires
Sweden	Cybersäkerhetslag, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its governance, reporting duties. What it requires
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Through its governance duty. What it requires
Taiwan	Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans	Through its governance duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance, reporting duties. What it requires

AI transparency

31 laws, 28 places

Place	Law	How it reaches this control
Alabama	Distribution of Materially Deceptive Media to Influence an Upcoming Election	Through its disclosure duty. What it requires
Belize	Practice Direction No. 18 of 2025, ethical use of generative AI in court proceedings	Through its disclosure duty. What it requires
California	California AI Transparency Act (SB 942, as amended by AB 853)	Through its disclosure duty. What it requires
California	Companion Chatbot Safety and Accountability Act (SB 243)	Through its disclosure, reporting duties. What it requires
Colorado	HB 26-1263 (2026), Conversational AI Service Operator Requirements from 1 Jan 2027, in 3 months	Through its reporting duty. What it requires
Delaware	House Bill 306 (pending), Computer Communication Act proposed	Through its disclosure duty. What it requires
European Union	AI Act, Article 50 (transparency obligations for AI systems and synthetic content)	Through its disclosure duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, marquage des contenus générés par intelligence artificielle	Through its reporting duty. What it requires
Idaho	Generative Artificial Intelligence in Education Act, vendor disclosure duty	Through its disclosure duty. What it requires
Illinois	Artificial Intelligence Video Interview Act	Through its disclosure, reporting duties. What it requires

Show the other 21 laws

Indiana	Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024)	Through its disclosure duty. What it requires
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its disclosure, governance duties. What it requires
Kentucky	Synthetic Media Disclosure in Electioneering Communications	Through its disclosure duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI interaction and deepfake disclosure duties	Through its disclosure duty. What it requires
Louisiana	Act 250 (HB 178), attorney duty to verify and disclose AI-generated evidence	Through its disclosure duty. What it requires
Michigan	AI-Generated Political Advertisement and Robocall Disclosure (Public Act 263 of 2023)	Through its disclosure duty. What it requires
Nebraska	Conversational Artificial Intelligence Safety Act (LB 525, §§ 12-18) from 1 Jul 2027, in 9 months	Through its disclosure duty. What it requires
Nevada	AB 73 (2025), AI-manipulated media disclosure in paid political communications	Through its disclosure duty. What it requires
New Mexico	HB 182 (2024), AI-generated and manipulated media disclosure and disclaimer requirements in campaign advertising	Through its disclosure duty. What it requires
North Dakota	House Bill 1167 (2025), AI-generated political content disclosure	Through its disclosure duty. What it requires
Ohio	S.B. 163, AI-Generated Content Watermark and Provenance Mandate proposed	Through its disclosure duty. What it requires
Oregon	AI Companion Chatbot Safety Act (SB 1546) from a date not yet set	Through its disclosure, reporting duties. What it requires
Oregon	Campaign communication disclosure of synthetic media (SB 1571)	Through its disclosure duty. What it requires
Pennsylvania	S.B. 1090, SAFECHAT Act proposed	Through its disclosure duty. What it requires
Puerto Rico	AI disclosure in political advertising and electoral communications	Through its disclosure duty. What it requires
Texas	TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty	Through its disclosure duty. What it requires
Turkey	Commercial Advertising Regulation, AI Disclosure Duty	Through its disclosure duty. What it requires
United States	AI Labeling Act of 2026 proposed	Through its disclosure duty. What it requires
United States	FCC AI Political Ad Disclosure Rulemaking, Docket 24-211 proposed	Through its disclosure duty. What it requires
Utah	Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c from 1 Jan 2027, in 3 months	Through its disclosure duty. What it requires
Vermont	Vermont Synthetic Media in Elections Act	Through its disclosure duty. What it requires

Telephone contact

30 laws, 22 places

Place	Law	How it reaches this control
Australia	Telecommunications (Telemarketing and Research Calls) Industry Standard 2017	Through its disclosure duty. What it requires
California	Automatic Dialing-Announcing Devices Act	Through its disclosure duty. What it requires
California	Consumers Legal Remedies Act, Unsolicited Prerecorded Telephone Messages	Through its disclosure duty. What it requires
California	Unsolicited Advertisements by Facsimile Machine	Through its disclosure duty. What it requires
Canada	Telecommunications Act, Unsolicited Telecommunications and the National Do Not Call List	Through its disclosure duty. What it requires
Connecticut	Connecticut Telemarketing Act (Conn. Gen. Stat. 42-284 to 42-289, as substantially rewritten by Public Act 23-98)	Through its disclosure duty. What it requires
Delaware	Delaware Telemarketing Fraud Act	Through its disclosure duty. What it requires
Florida	Florida Telemarketing Act	Through its disclosure duty. What it requires
Florida	Florida Telephone Solicitation Act (section 501.059 as rewritten in 2021)	Through its disclosure duty. What it requires
Germany	Gesetz gegen den unlauteren Wettbewerb, Documentation of Consent to Telephone Advertising	Through its reporting, retention duties. What it requires

Show the other 20 laws

Illinois	Illinois Automatic Telephone Dialers Act	Through its disclosure duty. What it requires
Illinois	Illinois Telephone Solicitations Act	Through its disclosure duty. What it requires
Maryland	Maryland Stop the Spam Calls Act of 2023	Through its disclosure duty. What it requires
Massachusetts	Automatic Telephone Dialing Systems and Telephone Solicitation Disclosures	Through its disclosure duty. What it requires
Massachusetts	Telemarketing Solicitation Act	Through its disclosure duty. What it requires
Michigan	Home Solicitation Sales Act, Telephone Solicitation Rules (as amended effective 2003)	Through its disclosure duty. What it requires
Montana	Montana Telemarketing Registration and Fraud Prevention Act	Through its disclosure duty. What it requires
Montana	Telephone Solicitation No-Call List Act	Through its disclosure duty. What it requires
Nevada	Nevada Device for Automatic Dialing and Announcing Statute	Through its disclosure duty. What it requires
New Hampshire	New Hampshire Automatic Telephone Dialing Systems and Caller Identification Services Act	Through its disclosure duty. What it requires
Oklahoma	Commercial telephone seller registration and unlawful telemarketing practices	Through its disclosure duty. What it requires
Oklahoma	Telephone Solicitation Act of 2022	Through its disclosure duty. What it requires
Oregon	Oregon Registration of Telephonic Sellers	Through its disclosure duty. What it requires
Pennsylvania	Telemarketer Registration Act	Through its disclosure duty. What it requires
Texas	Automatic Dial Announcing Devices	Through its disclosure duty. What it requires
Texas	Texas No-Call List, Facsimile Solicitation Notice, and Caller Identification Rules	Through its disclosure duty. What it requires
United Kingdom	PECR, Automated Calls, Facsimile and Live Telephone Calls for Direct Marketing	Through its disclosure duty. What it requires
United States	Telemarketing Sales Rule	Through its retention duty. What it requires
Virginia	Virginia Telephone Privacy Protection Act	Through its disclosure duty. What it requires
Washington	Telephone Solicitation Act	Through its disclosure duty. What it requires

AI risk obligations

21 laws, 12 places

Place	Law	How it reaches this control
California	CCPA Automated Decisionmaking Technology Regulations	Through its data subject rights, disclosure duties. What it requires
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance, reporting duties. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its governance, reporting duties. What it requires
European Union	AI Act, Article 26(11) (informing individuals subject to an Annex III decision) from 2 Dec 2027, in 14 months	Through its disclosure duty. What it requires
European Union	AI Act, Article 26(7) (informing workers before workplace use) from 2 Dec 2027, in 14 months	Through its disclosure duty. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires

Show the other 11 laws

European Union	AI Act, Article 86 (right to explanation of individual decision-making) from 2 Dec 2027, in 14 months	Through its data subject rights duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Georgia	Council of Europe Framework Convention on AI, Georgia's signature proposed	Through its disclosure duty. What it requires
Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its disclosure, governance duties. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
Nebraska	Ensuring Transparency in Prior Authorization Act, artificial-intelligence utilization review restriction	Through its disclosure duty. What it requires
Peru	Reglamento de la Ley 31814, high-risk AI system duties	Through its disclosure duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its disclosure, governance duties. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance, reporting duties. What it requires

Security baseline statutes

17 laws, 17 places

Place	Law	How it reaches this control
Alabama	Data Breach Notification Act, reasonable security measures and disposal of records	Through its retention duty. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)	Through its disclosure, governance duties. What it requires
Central African Republic	Cybersecurity Law: Network and Information System Security Duty	Through its disclosure duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its governance duty. What it requires
Florida	Florida Information Protection Act, data security and disposal duty	Through its retention duty. What it requires
Gabon	Sécurité des systèmes d'information (dispositions communes)	Through its disclosure, governance duties. What it requires
Hawaii	Destruction of Personal Information Records	Through its retention duty. What it requires
Kansas	Kansas Consumer Protection Act, reasonable security and records-destruction duty for holders of personal information	Through its retention duty. What it requires
Kuwait	Data Classification Policy	Through its governance, retention duties. What it requires
Kyrgyzstan	Digital Code, digital resilience baseline security measures	Through its governance duty. What it requires

Show the other 7 laws

Michigan	Identity Theft Protection Act, destruction of data no longer needed	Through its retention duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector	Through its governance duty. What it requires
North Carolina	Identity Theft Protection Act, destruction of personal information records	Through its retention duty. What it requires
Peru	Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed	Through its governance duty. What it requires
Vermont	Document Safe Destruction Act, safe destruction of records containing personal information	Through its retention duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its governance duty. What it requires

AI governance

15 laws, 11 places

Place	Law	How it reaches this control
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its disclosure duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its disclosure duty. What it requires
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its disclosure, governance, reporting duties. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)	Through its reporting duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance, reporting duties. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its disclosure, governance, reporting duties. What it requires

Show the other 5 laws

Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its disclosure duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems)	Through its reporting duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance duty. What it requires

AI sector rules

11 laws, 11 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its disclosure, governance, reporting duties. What it requires
California	Healthcare AI Patient-Communication Disclosure Act (AB 3030)	Through its disclosure duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance, reporting duties. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Illinois	Illinois Human Rights Act, use of artificial intelligence in employment decisions	Through its disclosure duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Ontario	Employment Standards Act, 2000, use of artificial intelligence in job postings	Through its disclosure duty. What it requires
Texas	S.B. 1188 (2025), AI diagnostic disclosure duty in electronic health records	Through its disclosure duty. What it requires

Show the other 1 law

Utah

Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months

Through its disclosure, governance duties. What it requires

Adult content age verification (AV)

10 laws, 8 places

Place	Law	How it reaches this control
Arizona	HB2112, internet pornography, minors, age verification	Through its retention duty. What it requires
Georgia	SB 351 (2024), commercial entity age verification for material harmful to minors	Through its retention duty. What it requires
Indiana	SB 17 (2024), age verification for adult oriented websites	Through its retention duty. What it requires
Montana	SB 544, Revise Internet Laws Related to Material Harmful to Minors	Through its retention duty. What it requires
North Carolina	HB 8, Pornography Age Verification Enforcement (PAVE) Act	Through its retention duty. What it requires
North Carolina	HB 805, Prevent Sexual Exploitation of Women and Minors Act	Through its disclosure duty. What it requires
North Dakota	HB 1561, age verification for sexual material harmful to minors	Through its retention duty. What it requires
North Dakota	SB 2380, age verification for sexual material harmful to minors (companion to HB 1561)	Through its retention duty. What it requires
Oklahoma	SB 1959, age verification for material harmful to minors	Through its retention duty. What it requires
Tennessee	Protect Tennessee Minors Act (SB 1792/HB 1614, 2024 Tenn. Pub. Acts ch. 1021)	Through its retention duty. What it requires

Commercial messages

8 laws, 8 places

Place	Law	How it reaches this control
Australia	Spam Act 2003, Unsolicited Commercial Electronic Messages	Through its disclosure duty. What it requires
Canada	Canada's Anti-Spam Legislation	Through its disclosure duty. What it requires
Germany	Gesetz gegen den unlauteren Wettbewerb, Commercial Electronic Messages	Through its disclosure duty. What it requires
Ireland	Irish ePrivacy Regulations	Through its disclosure duty. What it requires
Michigan	Unsolicited Commercial E-mail Protection Act	Through its disclosure duty. What it requires
Nevada	Nevada Unsolicited Commercial Electronic Mail Liability Act	Through its disclosure duty. What it requires
United Kingdom	PECR, Electronic Mail for Direct Marketing Purposes	Through its disclosure duty. What it requires
United States	CAN-SPAM Act	Through its disclosure duty. What it requires

Sensitive categories

8 laws, 8 places

Place	Law	How it reaches this control
Angola	Law on the Protection of Personal Data, sensitive data categories	Through its disclosure duty. What it requires
California	CCPA/CPRA Sensitive Personal Information and Biometric Data	Through its data subject rights duty. What it requires
Gabon	Law No. 025/2023, sensitive categories of personal data and children's data	Through its governance duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal data	Through its retention duty. What it requires
Paraguay	Ley N° 6534/2020, de Protección de Datos Personales Crediticios	Through its reporting duty. What it requires
Puerto Rico	Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)	Through its data subject rights, retention duties. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its retention duty. What it requires
Washington	HB 1155, My Health My Data Act	Through its data subject rights duty. What it requires

Product security requirements

6 laws, 6 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its governance duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre VI (cybersécurité), sécurité des réseaux et essai de vulnérabilité des produits	Through its disclosure duty. What it requires
Brazil	Anatel Cybersecurity Requirements for CPE (Customer Premises Equipment)	Through its disclosure duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its governance, reporting duties. What it requires
Democratic Republic of the Congo	Digital Code, Livre IV: ICT Product and Service Vendor Security Certification	Through its disclosure duty. What it requires
Finland	Kyberkestävyyslaki, National Enforcement and Market Surveillance for the Cyber Resilience Act	Through its reporting duty. What it requires

3 laws, 3 places

Place	Law	How it reaches this control
Florida	HB 3 (2024), social media use for minors	Through its retention duty. What it requires
Gabon	Ordonnance n°0011/PR/2026, protection des mineurs sur les réseaux sociaux	Through its reporting duty. What it requires
Greece	Law 4779/2021 Article 32, Video-Sharing Platform and Social Network Minor Protection Duties	Through its reporting duty. What it requires

AI prohibited practices

2 laws, 2 places

Place	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires
Monaco	Code Pénal Arts. 294-3 to 294-4, Child Sexual Abuse Material Including Realistic and AI-Generated Depictions	Through its reporting duty. What it requires

Cross border transfer

2 laws, 2 places

Place	Law	How it reaches this control
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its data subject rights, disclosure duties. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal data	Through its disclosure duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

Biometric privacy

1 law, 1 place

Place	Law	How it reaches this control
Illinois	Biometric Information Privacy Act (BIPA)	Through its disclosure, retention duties. What it requires

Computer misuse

1 law, 1 place

Place	Law	How it reaches this control
Algeria	Loi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication	Through its reporting duty. What it requires

1 law, 1 place

Place	Law	How it reaches this control
Canada	Canada's Anti-Spam Legislation	Through its disclosure duty. What it requires

FINOS AIGF AIR-DET-021Agent Decision Audit and Explainability

The same ground elsewhere linked through the kinds of duty both controls are mapped from

Data subject rights

Comprehensive regime

Enforcement supervision

Vulnerability and incident reporting

Breach notification

Sector security regimes

AI transparency

Telephone contact

AI risk obligations

Security baseline statutes

AI governance

AI sector rules

Adult content age verification (AV)

Commercial messages

Sensitive categories

Product security requirements

AI prohibited practices

Cross border transfer

AI training data

Biometric privacy

Computer misuse

FINOS AIGF AIR-DET-021Agent Decision Audit and Explainability

The same ground elsewhere linked through the kinds of duty both controls are mapped from

Data subject rights

Comprehensive regime

Enforcement supervision

Vulnerability and incident reporting

Breach notification

Sector security regimes

AI transparency

Telephone contact

AI risk obligations

Security baseline statutes

AI governance

AI sector rules

Adult content age verification (AV)

Commercial messages

Sensitive categories

Product security requirements

Social media and minors

AI prohibited practices

Cross border transfer

AI training data

Biometric privacy

Computer misuse

Device storage and tracking consent