FINOS AIGF AIR-PREV-006, Data Quality & Classification/Sensitivity: the laws that bear on it

Data subject rights

97 laws, 87 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, rights of the data subject	Through its data subject rights duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée	Through its data subject rights duty. What it requires
Andorra	LQPD, rights of the data subject	Through its data subject rights duty. What it requires
Angola	Law on the Protection of Personal Data, rights of data subjects	Through its data subject rights duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013, notice and rights of data subjects	Through its data subject rights duty. What it requires
Argentina	Ley 25.326, rights of data subjects	Through its data subject rights duty. What it requires
Barbados	Data Protection Act, 2019, automated decisions	Through its data subject rights duty. What it requires
Barbados	Data Protection Act, 2019, rights of a data subject	Through its data subject rights duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subject	Through its data subject rights duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernées	Through its data subject rights duty. What it requires

Show the other 87 laws

Bolivia	Constitución Política del Estado, Acción de Protección de Privacidad	Through its data subject rights duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjects	Through its data subject rights duty. What it requires
Botswana	Data Protection Act, 2024, rights of data subjects	Through its data subject rights duty. What it requires
Brazil	LGPD, rights of the data subject	Through its data subject rights duty. What it requires
Burkina Faso	Personal Data Protection Law, rights of the data subject	Through its data subject rights duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjects	Through its data subject rights duty. What it requires
California	CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-Out	Through its data subject rights duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, rights of data subjects proposed	Through its data subject rights duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitement	Through its data subject rights duty. What it requires
Chad	Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)	Through its data subject rights duty. What it requires
Colombia	Ley 1581 de 2012, Data Subject Rights and Procedures	Through its data subject rights duty. What it requires
Colombia	SIC Circular on AI, Data Subject Rights	Through its data subject rights duty. What it requires
Comoros	Law on the Protection of Personal Data, rights of data subjects	Through its data subject rights duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, rights of the data subject	Through its data subject rights duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III, rights of the data subject	Through its data subject rights duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas data	Through its data subject rights duty. What it requires
Ecuador	LOPDP, derechos del titular	Through its data subject rights duty. What it requires
Ecuador	SPDP Norma General guaranteeing personal-data protection in the use of AI systems from a date not yet set	Through its data subject rights, governance duties. What it requires
Egypt	Egypt Personal Data Protection Law, rights of the Data Subject	Through its data subject rights duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, rights of data subjects	Through its data subject rights duty. What it requires
Eswatini	Data Protection Act, 2022, rights of data subjects	Through its data subject rights duty. What it requires
Ethiopia	Personal Data Protection Proclamation, rights of data subjects	Through its data subject rights duty. What it requires
European Union	GDPR Article 22, Automated Individual Decision-Making	Through its data subject rights duty. What it requires
Gabon	Law No. 025/2023, automated decisions and profiling	Through its data subject rights duty. What it requires
Gabon	Law No. 025/2023, rights of the data subject and transparency obligations	Through its data subject rights duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, rights of the data subject from a date not yet set	Through its data subject rights duty. What it requires
Ghana	Data Protection Act, 2012, automated decision-taking	Through its data subject rights duty. What it requires
Ghana	Data Protection Act, rights of data subjects	Through its data subject rights duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, rights of data subjects from a date not yet set	Through its data subject rights duty. What it requires
Guatemala	Constitución Política de la República de Guatemala, Art. 31 (habeas data)	Through its data subject rights duty. What it requires
Ireland	GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in Ireland	Through its data subject rights duty. What it requires
Ireland	GDPR Articles 12-21 and Data Protection Act 2018 Sections 60-61, Data Subject Rights in Ireland	Through its data subject rights duty. What it requires
Jamaica	Data Protection Act, 2020, automated decision-taking	Through its data subject rights duty. What it requires
Jamaica	Data Protection Act, 2020, rights of data subjects	Through its data subject rights duty. What it requires
Kiribati	Data Protection Act 2025, rights of a data subject from a date not yet set	Through its data subject rights duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, rights of the data subject	Through its data subject rights duty. What it requires
Lebanon	Law No. 81/2018, Part V, notice, objection, access and correction	Through its data subject rights duty. What it requires
Lesotho	Data Protection Act, 2011, rights of data subjects	Through its data subject rights duty. What it requires
Libya	Law No. 6 of 2022, notice, access and objection rights over personal data	Through its data subject rights duty. What it requires
Madagascar	Law No. 2014-038, rights of data subjects	Through its data subject rights duty. What it requires
Malawi	Electronic Transactions and Cyber Security Act, 2016, rights of a data subject and information notice (Part VII)	Through its data subject rights duty. What it requires
Maldives	Maldives Personal Data Protection Bill, rights of data subjects proposed	Through its data subject rights duty. What it requires
Mali	Loi n° 2013-015, rights of data subjects	Through its data subject rights duty. What it requires
Mauritania	Loi n° 2017-020, droits de la personne concernée	Through its data subject rights duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rights	Through its data subject rights duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares, automated decisions	Through its data subject rights duty. What it requires
Moldova	Moldova Law No. 195/2024, rights of the data subject	Through its data subject rights duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, droits de la personne concernée	Through its data subject rights duty. What it requires
Montenegro	Law on Personal Data Protection, rights of the data subject from a date not yet set	Through its data subject rights duty. What it requires
Morocco	Law No. 09-08, rights of the data subject	Through its data subject rights duty. What it requires
Mozambique	Electronic Transactions Law, data subject rights and information notice	Through its data subject rights duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, rights of data subjects	Through its data subject rights duty. What it requires
Niger	Loi n° 2022-59, droits des personnes concernées	Through its data subject rights duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, rights of a data subject	Through its data subject rights duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), rights of the data subject	Through its data subject rights duty. What it requires
Panama	Ley 81 de 2019, rights of data subjects	Through its data subject rights duty. What it requires
Paraguay	Ley N° 7593/2025, automated or semi-automated individual decisions from 27 Nov 2027, in 14 months	Through its data subject rights duty. What it requires
Paraguay	Ley N° 7593/2025, derechos del titular de datos from 27 Nov 2027, in 14 months	Through its data subject rights duty. What it requires
Peru	Ley 29733, rights of the data subject	Through its data subject rights duty. What it requires
Republic of the Congo	Law No. 29-2019, rights of the data subject	Through its data subject rights duty. What it requires
Russia	Federal Law No. 152-FZ, Article 16, Decisions Based Solely on Automated Processing	Through its data subject rights duty. What it requires
Russia	Federal Law No. 152-FZ, Articles 14 and 17, Data Subject Rights	Through its data subject rights duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, rights of the data subject	Through its data subject rights duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, rights of data subjects from a date not yet set	Through its data subject rights duty. What it requires
Saint Lucia	Data Protection Act, rights of data subjects and others from a date not yet set	Through its data subject rights duty. What it requires
Samoa	National Digital Identification Act 2024, registered persons' data-subject rights	Through its data subject rights duty. What it requires
San Marino	San Marino Law No. 171, rights of the data subject	Through its data subject rights duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, rights of the data holder	Through its data subject rights duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernée	Through its data subject rights duty. What it requires
Serbia	Law on Personal Data Protection, rights of the data subject	Through its data subject rights duty. What it requires
Somalia	Data Protection Act, 2023, information to the data subject and rights of the data subject	Through its data subject rights duty. What it requires
South Africa	Protection of Personal Information Act, rights of data subjects	Through its data subject rights duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, rights of the data subject proposed	Through its data subject rights duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketing	Through its data subject rights duty. What it requires
Timor-Leste	Constitution of Timor-Leste, Section 38(1) (Access to personal data)	Through its data subject rights duty. What it requires
Togo	Loi n° 2019-014, droits de la personne concernée	Through its data subject rights duty. What it requires
Tonga	Privacy Act 2025, notification to data subjects and rights of data subjects from a date not yet set	Through its data subject rights duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, rights of access and correction from a date not yet set	Through its data subject rights duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, rights of the data subject	Through its data subject rights duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, rights of data subjects	Through its data subject rights duty. What it requires
Ukraine	Draft Law No. 8153, data subject rights proposed	Through its data subject rights duty. What it requires
Uruguay	Ley N° 18.331, rights of data subjects	Through its data subject rights duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, rights of the data subject	Through its data subject rights duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data, data subject rights	Through its data subject rights duty. What it requires
Venezuela	Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)	Through its data subject rights duty. What it requires
Zambia	Data Protection Act, 2021, rights of the data subject	Through its data subject rights duty. What it requires
Zimbabwe	Cyber and Data Protection Act, rights of the data subject	Through its data subject rights duty. What it requires

Comprehensive regime

80 laws, 79 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024 On the Protection of Personal Data	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11	Through its governance duty. What it requires
Andorra	LQPD, Llei 29/2021 del 28 d'octubre	Through its governance duty. What it requires
Argentina	Ley 25.326, Ley de Protección de los Datos Personales	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection	Through its governance duty. What it requires
Belize	Data Protection Act 2021, comprehensive regime from a date not yet set	Through its biometric, data subject rights duties. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)	Through its governance duty. What it requires
Bolivia	Anteproyecto de Ley de Protección de Datos Personales (AGETIC) proposed	Through its data subject rights duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina	Through its governance duty. What it requires

Show the other 70 laws

Botswana	Data Protection Act, 2024 (Act No. 18 of 2024)	Through its governance duty. What it requires
Brazil	Lei Geral de Proteção de Dados Pessoais (LGPD)	Through its governance duty. What it requires
Burkina Faso	Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel	Through its governance duty. What it requires
California	California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)	Through its data subject rights duty. What it requires
Cambodia	Draft Law on Personal Data Protection, final draft proposed	Through its governance duty. What it requires
Cameroon	Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun from a date not yet set	Through its biometric, governance duties. What it requires
Cayman Islands	Data Protection Act 2021 Revision, application, principles and data subject rights	Through its data subject rights duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel	Through its governance duty. What it requires
Colombia	Ley 1581 de 2012, General Personal Data Protection	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data	Through its governance duty. What it requires
Cuba	Ley 149/2022, De Protección de Datos Personales, general regime	Through its data subject rights duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Title III: Personal Data Protection	Through its governance duty. What it requires
Djibouti	Digital Code, Book I: Personal Data Protection and CNDP	Through its governance duty. What it requires
Dominican Republic	Ley No. 172-13 sobre Protección Integral de los Datos Personales	Through its biometric, governance duties. What it requires
Ecuador	LOPDP, comprehensive personal-data protection regime	Through its governance duty. What it requires
Egypt	Law No. 151 of 2020 Promulgating the Personal Data Protection Law	Through its governance duty. What it requires
El Salvador	Ley para la Protección de Datos Personales	Through its governance duty. What it requires
Equatorial Guinea	Ley de Protección de Datos Personales	Through its data subject rights duty. What it requires
Eswatini	Data Protection Act, 2022 (Act No. 5 of 2022)	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation	Through its governance duty. What it requires
European Union	General Data Protection Regulation (GDPR), Comprehensive Regime	Through its governance duty. What it requires
Gabon	Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025 from a date not yet set	Through its governance duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023 from a date not yet set	Through its governance duty. What it requires
Jamaica	Data Protection Act, 2020, registration, lawful basis and standards for processing	Through its governance duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data	Through its governance duty. What it requires
Lebanon	Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011 (Act No. 5 of 2012)	Through its governance duty. What it requires
Liberia	Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, protection of personal data	Through its governance duty. What it requires
Maldives	Personal Data Protection Bill, pending before the People's Majlis proposed	Through its governance duty. What it requires
Mali	Loi n° 2013-015, protection des données à caractère personnel	Through its governance duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, government personal-data protection principles	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, protection des données à caractère personnel	Through its governance duty. What it requires
Mexico	Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)	Through its governance duty. What it requires
Moldova	Law No. 195/2024 on Personal Data Protection	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles	Through its governance duty. What it requires
Montenegro	Law on Personal Data Protection from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	Through its governance duty. What it requires
Mozambique	Electronic Transactions Law, Protection of Personal Electronic Data	Through its governance duty. What it requires
Nauru	Communications and Broadcasting Act 2018, confidentiality of subscriber information and communications	Through its data subject rights duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Niger	Loi n° 2022-59, protection des données à caractère personnel	Through its governance duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023 (NDPA), general data protection duties	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP)	Through its governance duty. What it requires
Panama	Ley 81 de 2019, Sobre Protección de Datos Personales	Through its governance duty. What it requires
Paraguay	Ley N° 7593/2025, de Protección de Datos Personales en la República del Paraguay from 27 Nov 2027, in 14 months	Through its governance duty. What it requires
Peru	Ley 29733, Ley de Protección de Datos Personales	Through its governance duty. What it requires
Republic of the Congo	Law No. 29-2019 on the Protection of Personal Data	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy	Through its governance duty. What it requires
San Marino	San Marino Law No. 171 on the Protection of Natural Persons	Through its governance duty. What it requires
Sao Tome and Principe	Lei n.º 03/2016, Protecção de Dados Pessoais	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)	Through its governance duty. What it requires
Serbia	Law on Personal Data Protection	Through its governance duty. What it requires
Solomon Islands	Telecommunications Act 2009, Confidentiality and Consent Duties	Through its data subject rights duty. What it requires
Somalia	Data Protection Act No. 005 of 2023	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA)	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens) proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data	Through its governance duty. What it requires
Togo	Loi n° 2019-014, protection des données à caractère personnel	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data	Through its governance duty. What it requires
Uganda	Data Protection and Privacy Act, 2019, comprehensive personal-data regime	Through its governance duty. What it requires
Ukraine	Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform) proposed	Through its governance duty. What it requires
Ukraine	Law of Ukraine On the Protection of Personal Data	Through its governance duty. What it requires
Uruguay	Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amended	Through its governance duty. What it requires
Vatican City	General Regulation on the Protection of Personal Data for Vatican City State	Through its governance duty. What it requires
Zambia	Data Protection Act, 2021, personal data processing framework	Through its governance duty. What it requires
Zimbabwe	Cyber and Data Protection Act [Chapter 12:07]	Through its governance duty. What it requires

Enforcement supervision

65 laws, 65 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, Commissioner, remedies, liability and penalties	Through its governance duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours	Through its governance duty. What it requires
Andorra	LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctions	Through its governance duty. What it requires
Angola	Law on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Antigua and Barbuda	Data Protection Act, 2013, information commissioner and enforcement	Through its governance duty. What it requires
Argentina	Ley 25.326, enforcement, sanctions, and the habeas data action	Through its governance duty. What it requires
Bahamas	Data Protection Act 2003, Commissioner, enforcement and penalties	Through its governance duty. What it requires
Barbados	Data Protection Act, 2019, the Commissioner, enforcement and penalties	Through its governance duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, authorized agency and liability	Through its governance duty. What it requires
Belize	Data Protection Act 2021, Commissioner, Tribunal, and enforcement from a date not yet set	Through its governance duty. What it requires

Show the other 55 laws

Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénales	Through its governance duty. What it requires
Bermuda	Personal Information Protection Act 2016, Commissioner, enforcement and offences	Through its governance duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penalties	Through its governance duty. What it requires
Brazil	LGPD, civil liability, administrative sanctions and the ANPD	Through its governance duty. What it requires
Burkina Faso	Personal Data Protection Law, supervisory authority and sanctions	Through its governance duty. What it requires
Cabo Verde	Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision	Through its governance duty. What it requires
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)	Through its biometric duty. What it requires
Cayman Islands	Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences	Through its governance duty. What it requires
Chad	Loi n°007/PR/2015, sanctions administratives et pénales et recours	Through its governance duty. What it requires
China	Personal Information Protection Law, Supervision and Legal Liability	Through its governance duty. What it requires
Colombia	SIC Circular on AI, Demonstrated Accountability	Through its governance duty. What it requires
Comoros	Law on the Protection of Personal Data, the Commission and sanctions	Through its governance duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection Body	Through its governance duty. What it requires
Democratic Republic of the Congo	Digital Code, Data Protection Authority and sanctions	Through its governance duty. What it requires
Djibouti	Digital Code, Book I: the Commission, administrative sanctions and criminal offences	Through its governance duty. What it requires
Egypt	Egypt Personal Data Protection Law, the Center, judicial control and penalties	Through its governance duty. What it requires
Eswatini	Data Protection Act, 2022, enforcement and offences	Through its governance duty. What it requires
Ethiopia	Personal Data Protection Proclamation, enforcement, sanctions and offences	Through its governance duty. What it requires
Gabon	Law No. 025/2023, recourse, oversight and sanctions	Through its governance duty. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties from a date not yet set	Through its governance duty. What it requires
Ghana	Data Protection Act, enforcement, offences and penalties	Through its governance duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offences from a date not yet set	Through its governance duty. What it requires
Idaho	Student Data Accessibility, Transparency and Accountability Act (SDATAA) from a date not yet set	Through its data subject rights, governance duties. What it requires
Kiribati	Data Protection Act 2025, enforcement, offences and civil remedies from a date not yet set	Through its governance duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties	Through its governance duty. What it requires
Lesotho	Data Protection Act, 2011, enforcement and offences	Through its governance duty. What it requires
Libya	Law No. 6 of 2022, supervisory authority, licensing and penalties	Through its governance duty. What it requires
Madagascar	Law No. 2014-038, CMIL, sanctions and offences	Through its governance duty. What it requires
Mali	Loi n° 2013-015, the Autorité, supervision, and sanctions	Through its governance duty. What it requires
Marshall Islands	Personal Data Protection Act 2025, competent authority, remedies, and complaints	Through its governance duty. What it requires
Mauritania	Loi n° 2017-020, Autorité de Protection des Données et sanctions	Through its governance duty. What it requires
Moldova	Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctions	Through its governance duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctions	Through its governance duty. What it requires
Montenegro	Law on Personal Data Protection, agency, supervision and penal provisions from a date not yet set	Through its governance duty. What it requires
Morocco	Law No. 09-08, the CNDP and sanctions	Through its governance duty. What it requires
Nicaragua	Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaints	Through its governance duty. What it requires
Niger	Loi n° 2022-59, contrôle, sanctions et recours	Through its governance duty. What it requires
Nigeria	Nigeria Data Protection Act, 2023, complaints, enforcement and redress	Through its governance duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisions	Through its governance duty. What it requires
Panama	Ley 81 de 2019, enforcement and sanctions	Through its governance duty. What it requires
Peru	Ley 29733, enforcement, supervisory authority and sanctions	Through its governance duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offences	Through its governance duty. What it requires
Saint Kitts and Nevis	Data Protection Act, 2018, Information Commissioner, enforcement and offences from a date not yet set	Through its governance duty. What it requires
San Marino	San Marino Law No. 171, the Data Protection Authority, remedies and fines	Through its governance duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions	Through its governance duty. What it requires
Somalia	Data Protection Act, 2023, complaints, orders of the Authority and civil remedies	Through its governance duty. What it requires
South Africa	Protection of Personal Information Act, the Information Regulator, enforcement and penalties	Through its governance duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and fines proposed	Through its governance duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties	Through its governance duty. What it requires
Togo	Loi n° 2019-014, cadre institutionnel et dispositions pénales	Through its governance duty. What it requires
Tonga	Privacy Act 2025, penalties, enforcement and third party actions from a date not yet set	Through its governance duty. What it requires
Trinidad and Tobago	Data Protection Act, 2011, Commissioner, contravention and enforcement	Through its governance duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, enforcement and sanctions	Through its governance duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, enforcement powers and offences	Through its governance duty. What it requires
Zimbabwe	Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024	Through its governance duty. What it requires

Sensitive categories

60 laws, 60 places

Place	Law	How it reaches this control
Albania	Law No. 124/2024, special categories of personal data, criminal records and children's data	Through its biometric duty. What it requires
Algeria	Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriques	Through its biometric duty. What it requires
Andorra	LQPD, special categories, children and criminal-offence data	Through its biometric duty. What it requires
Barbados	Data Protection Act, 2019, a child's consent and sensitive personal data	Through its biometric duty. What it requires
Belarus	Law of the Republic of Belarus On Personal Data Protection, special personal data	Through its biometric duty. What it requires
Benin	Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs	Through its biometric duty. What it requires
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent	Through its biometric duty. What it requires
Botswana	Data Protection Act, 2024, sensitive personal data and children's data	Through its biometric duty. What it requires
Brazil	LGPD, sensitive personal data and children's data	Through its biometric duty. What it requires
Burkina Faso	Personal Data Protection Law, sensitive personal data categories	Through its biometric duty. What it requires

Show the other 50 laws

California	CCPA/CPRA Sensitive Personal Information and Biometric Data	Through its data subject rights duty. What it requires
Cambodia	Cambodia's Draft Law on Personal Data Protection, sensitive personal data proposed	Through its biometric duty. What it requires
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineurs	Through its biometric duty. What it requires
Chad	Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)	Through its biometric duty. What it requires
Colombia	Ley 1581 de 2012, Sensitive Categories and Children's Data	Through its biometric duty. What it requires
Comoros	Law on the Protection of Personal Data, sensitive personal data	Through its biometric duty. What it requires
Côte d'Ivoire	Law No. 2013-450 on the Protection of Personal Data, sensitive categories of personal data	Through its biometric duty. What it requires
Djibouti	Digital Code, Book I: sensitive categories of personal data and the minor's consent	Through its biometric duty. What it requires
Ecuador	LOPDP, categorías especiales de datos personales	Through its biometric duty. What it requires
Egypt	Egypt Personal Data Protection Law, Sensitive Personal Data and a child's data	Through its biometric duty. What it requires
El Salvador	Ley para la Protección de Datos Personales, sensitive personal data and children	Through its biometric duty. What it requires
Eswatini	Data Protection Act, 2022, sensitive personal information	Through its biometric duty. What it requires
Ethiopia	Personal Data Protection Proclamation, sensitive personal data and minors	Through its biometric duty. What it requires
European Union	GDPR Article 9, Special Categories of Personal Data Including Biometric Data	Through its biometric duty. What it requires
Gabon	Law No. 025/2023, sensitive categories of personal data and children's data	Through its biometric, governance duties. What it requires
Gambia	Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data from a date not yet set	Through its biometric duty. What it requires
Ghana	Data Protection Act, special personal data	Through its biometric duty. What it requires
Grenada	Data Protection Act, No. 1 of 2023, sensitive personal data from a date not yet set	Through its biometric duty. What it requires
Ireland	GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in Ireland	Through its biometric duty. What it requires
Jamaica	Data Protection Act, 2020, conditions for processing sensitive personal data	Through its biometric duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence data	Through its biometric duty. What it requires
Madagascar	Law No. 2014-038, sensitive personal data	Through its biometric duty. What it requires
Maldives	Maldives Personal Data Protection Bill, special categories of personal data proposed	Through its biometric duty. What it requires
Mauritania	Loi n° 2017-020, catégories sensibles de données	Through its biometric duty. What it requires
Moldova	Moldova Law No. 195/2024, special categories, a child's consent and conviction data	Through its biometric duty. What it requires
Monaco	Loi sur la Protection des Données Personnelles, données sensibles et mineurs	Through its biometric duty. What it requires
Montenegro	Law on Personal Data Protection, special categories of data from a date not yet set	Through its biometric duty. What it requires
Niger	Loi n° 2022-59, données sensibles, de santé et biométriques	Through its biometric duty. What it requires
North Macedonia	Law on Personal Data Protection (LPDP), special categories, a child's consent and biometric, health and genetic data	Through its biometric duty. What it requires
Panama	Ley 81 de 2019, sensitive personal data	Through its biometric duty. What it requires
Paraguay	Ley N° 7593/2025, tratamiento de datos sensibles y categorías especiales from 27 Nov 2027, in 14 months	Through its biometric duty. What it requires
Peru	Ley 29733, sensitive personal data and minors	Through its biometric duty. What it requires
Puerto Rico	Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)	Through its data subject rights duty. What it requires
Republic of the Congo	Law No. 29-2019, special categories of personal data	Through its biometric duty. What it requires
Rwanda	Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's data	Through its biometric duty. What it requires
San Marino	San Marino Law No. 171, special categories of personal data	Through its biometric duty. What it requires
Senegal	Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, catégories sensibles de données	Through its biometric duty. What it requires
Serbia	Law on Personal Data Protection, special categories of personal data and minors	Through its biometric duty. What it requires
Somalia	Data Protection Act, 2023, sensitive personal data and children's consent	Through its biometric duty. What it requires
South Africa	Protection of Personal Information Act, special personal information and children	Through its biometric duty. What it requires
Suriname	Draft Law on the Protection of Privacy and Personal Data, special categories, children and criminal data proposed	Through its biometric duty. What it requires
Syria	Law No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal data	Through its biometric duty. What it requires
Togo	Loi n° 2019-014, données sensibles	Through its biometric duty. What it requires
Tonga	Privacy Act 2025, sensitive personal information and children from a date not yet set	Through its biometric duty. What it requires
Tunisia	Organic Act on the Protection of Personal Data, sensitive categories and minors	Through its biometric duty. What it requires
United Kingdom	UK GDPR Article 9, Special Categories of Personal Data Including Biometric Data	Through its biometric duty. What it requires
Vanuatu	Data Protection and Privacy Act 2024, special categories and children's personal data	Through its biometric duty. What it requires
Washington	HB 1155, My Health My Data Act	Through its biometric, data subject rights duties. What it requires
Zambia	Data Protection Act, 2021, sensitive personal data, children and vulnerable persons	Through its biometric duty. What it requires
Zimbabwe	Cyber and Data Protection Act, sensitive, genetic, biometric and health data	Through its biometric duty. What it requires

Sector security regimes

40 laws, 38 places

Place	Law	How it reaches this control
Albania	Law No. 25/2024, On Cybersecurity	Through its governance duty. What it requires
Andorra	Llei 22/2022, Cybersecurity Risk-Management Obligations	Through its governance duty. What it requires
Austria	Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026), Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Belgium	Loi du 26 avril 2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Bulgaria	Cybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)	Through its governance duty. What it requires
Croatia	Zakon o kibernetičkoj sigurnosti, Risk-Management Measures and Governance	Through its governance duty. What it requires
Cyprus	Security of Networks and Information Systems Law, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Czech Republic	Cybersecurity Act (Zákon o kybernetické bezpečnosti), Risk-Management Security Measures	Through its governance duty. What it requires
Denmark	NIS 2-loven, Cybersecurity Risk-Management Measures and Registration	Through its governance duty. What it requires
Estonia	Küberturvalisuse seadus (KüTS), System Security Measures and Management-Body Duties	Through its governance duty. What it requires

Show the other 30 laws

Ethiopia	Critical Infrastructure Cybersecurity Proclamation, Critical Infrastructure Owner Obligations from 21 Jul 2027, in 9 months	Through its governance duty. What it requires
European Union	NIS2 Directive, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Finland	Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Germany	BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Greece	Law 5160/2024, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Haiti	BRH Circulaire 126, Information Security Rules for Financial Institutions	Through its governance duty. What it requires
Hungary	Cybersecurity Act, Risk-Management Measures	Through its governance duty. What it requires
Iceland	Minimum Risk-Management and Preparedness Requirements for Critical Infrastructure	Through its governance duty. What it requires
Italy	Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Risk-Management Measures	Through its governance duty. What it requires
Kiribati	Cybersecurity Act 2026, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires
Liechtenstein	Cyber-Sicherheitsgesetz (CSG), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Lithuania	Kibernetinio saugumo įstatymas (Law on Cyber Security), Risk-Management Measures	Through its governance duty. What it requires
Luxembourg	Loi du 5 mai 2026 relative à la cybersécurité (NIS2), Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Malta	Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, Risk-Management Measures for Essential and Important Entities	Through its governance duty. What it requires
Marshall Islands	Cybersecurity Act 2025, Cybersecurity of Critical Information Infrastructure	Through its governance duty. What it requires
Montenegro	Law on Information Security, Essential and Important Entities	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers	Through its governance duty. What it requires
Netherlands	Cyberbeveiligingswet, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Portugal	Regime Jurídico da Cibersegurança, Cybersecurity Risk-Management Measures and Governance	Through its governance duty. What it requires
Romania	Ordonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Serbia	Law on Information Security, ICT Systems of Special Importance and Security Measures	Through its governance duty. What it requires
Sierra Leone	Cyber Security and Crime Act, 2021, Critical National Information Infrastructure	Through its governance duty. What it requires
Slovakia	Zákon o kybernetickej bezpečnosti (Cybersecurity Act), Risk-Management Measures	Through its governance duty. What it requires
Slovenia	Zakon o informacijski varnosti (ZInfV-1), Cybersecurity Risk-Management Measures and Governance from 19 Dec 2026, in 2 months	Through its governance duty. What it requires
Spain	Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers	Through its governance duty. What it requires
Sweden	Cybersäkerhetslag, Cybersecurity Risk-Management Measures	Through its governance duty. What it requires
Taiwan	Bank and Financial Holding Company Internal Control Rules, Dedicated Information Security Unit	Through its governance duty. What it requires
Taiwan	Cyber Security Management Act, Specific Non-Government Agency Cyber Security Management	Through its governance duty. What it requires
Taiwan	Telecommunications Management Act, Cyber Security and Critical Infrastructure Protection Plans	Through its governance duty. What it requires
Tonga	Cybersecurity Act 2025, Critical Infrastructure Operator Obligations from a date not yet set	Through its governance duty. What it requires

AI risk obligations

16 laws, 9 places

Place	Law	How it reaches this control
California	CCPA Automated Decisionmaking Technology Regulations	Through its data subject rights duty. What it requires
El Salvador	Resolución ANIA 0001/2025, registro obligatorio para decisiones consecuenciales	Through its governance duty. What it requires
European Union	AI Act, Article 10 (data and data governance) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 111(2) (2030 compliance deadline for public-authority-intended systems) from 2 Aug 2030, in 3.8 years	Through its governance duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 14 months	Through its biometric, governance duties. What it requires
European Union	AI Act, Article 26(1) to (5) (deployer use, human oversight, input data and monitoring) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 14 months	Through its biometric, governance duties. What it requires
European Union	AI Act, Article 6(3) and (4) (narrow-task derogation from Annex III high-risk classification) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 86 (right to explanation of individual decision-making) from 2 Dec 2027, in 14 months	Through its data subject rights duty. What it requires
European Union	AI Act, Article 9 (risk management system) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires

Show the other 6 laws

Indiana	Downcoding of Health Benefits Claims, automated and AI decision-making (House Enrolled Act 1271, 2026)	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its governance duty. What it requires
Malta	Artificial Intelligence (Designation of the Information and Data Protection Commissioner for the purposes of Regulation (EU) 2024/1689) Regulations, 2025 (L.N. 227 of 2025)	Through its governance duty. What it requires
Montana	Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty	Through its governance duty. What it requires
South Korea	AI Framework Act, Article 34 (business-operator duties for high-impact AI)	Through its governance duty. What it requires
Vietnam	Law on Artificial Intelligence, risk classification and conformity assessment	Through its governance duty. What it requires

AI governance

10 laws, 7 places

Place	Law	How it reaches this control
California	Transparency in Frontier Artificial Intelligence Act (SB 53)	Through its governance duty. What it requires
European Union	AI Act, Article 12 (record-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 19 (automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 21(2) (competent authority access to automatically generated logs) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
European Union	AI Act, Article 26(6) (deployer log-keeping) from 2 Dec 2027, in 14 months	Through its governance duty. What it requires
Germany	Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act	Through its governance duty. What it requires
Illinois	Artificial Intelligence Safety Measures Act from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Russia	Federal Law No. 243-FZ, Article 8, Duties of Sovereign and National Foundation Model Developers from 1 Mar 2027, in 5 months	Through its governance duty. What it requires
Vanuatu	Digital Transformation Act 2025, ICT service permit for AI and AI-related data services	Through its governance duty. What it requires
Vatican City	Guidelines on Artificial Intelligence of Vatican City State (Decree No. DCCII)	Through its governance duty. What it requires

Security baseline statutes

9 laws, 9 places

Place	Law	How it reaches this control
Cameroon	Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 6, 7, 13-14, 24, 26-30, 32, 61(3) (mesures de sécurité et audit de sécurité obligatoire par l'ANTIC)	Through its governance duty. What it requires
China	Data Security Law, Data Security Protection Obligations	Through its governance duty. What it requires
Gabon	Sécurité des systèmes d'information (dispositions communes)	Through its governance duty. What it requires
Kuwait	Data Classification Policy	Through its governance duty. What it requires
Kyrgyzstan	Digital Code, digital resilience baseline security measures	Through its governance duty. What it requires
Montenegro	Law on Information Security, General Security Measures	Through its governance duty. What it requires
Mozambique	Cybersecurity Law, General Security Requirements for the Public Administration and the Private Sector	Through its governance duty. What it requires
Peru	Proyecto de Ley 9906/2024-CR, Ley de Seguridad Digital o Ciberseguridad proposed	Through its governance duty. What it requires
Vietnam	Cybersecurity Law, Information System Classification and Protection Measures	Through its governance duty. What it requires

AI sector rules

7 laws, 7 places

Place	Law	How it reaches this control
Alabama	SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization	Through its governance duty. What it requires
Colorado	Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models	Through its governance duty. What it requires
Georgia	Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Maine	Use of artificial intelligence in therapy or psychotherapy services from a date not yet set	Through its governance duty. What it requires
Minnesota	Utilization Review, AI-Only Adverse Determination Prohibition from 1 Jan 2027, in 3 months	Through its governance duty. What it requires
Nevada	AB 406 (2025), licensed provider restriction on direct clinical use of AI	Through its governance duty. What it requires
Utah	Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session) from 1 Jan 2027, in 3 months	Through its governance duty. What it requires

Biometric privacy

5 laws, 5 places

Place	Law	How it reaches this control
Bosnia and Herzegovina	Law on the Protection of Personal Data of Bosnia and Herzegovina, biometric data processing	Through its biometric duty. What it requires
Illinois	Biometric Information Privacy Act (BIPA)	Through its biometric duty. What it requires
Kosovo	Law No. 06/L-082 on Protection of Personal Data, use of biometric characteristics	Through its biometric duty. What it requires
Montenegro	Law on Personal Data Protection, biometric measures from a date not yet set	Through its biometric duty. What it requires
Uruguay	Ley N° 18.331, biometric data	Through its biometric duty. What it requires

Product security requirements

2 laws, 2 places

Place	Law	How it reaches this control
Australia	Security Standards for Smart Devices	Through its governance duty. What it requires
China	Cybersecurity Law, Network Product and Service Security Duties	Through its governance duty. What it requires

AI prohibited practices

1 law, 1 place

Place	Law	How it reaches this control
Denmark	Lov nr. 467 af 14. maj 2025, National Competent Authorities and Article 5 Enforcement	Through its governance duty. What it requires

AI training data

1 law, 1 place

Place	Law	How it reaches this control
European Union	AI Act, Article 53 (obligations for providers of general-purpose AI models)	Through its governance duty. What it requires

AI transparency

1 law, 1 place

Place	Law	How it reaches this control
Jamaica	Practice Direction No. 1 of 2025, Use of Generative Artificial Intelligence in Court Proceedings	Through its governance duty. What it requires

Cross border transfer

1 law, 1 place

Place	Law	How it reaches this control
Cuba	Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form	Through its data subject rights duty. What it requires

Personal data

1 law, 1 place

Place	Law	How it reaches this control
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier	Through its biometric duty. What it requires

FINOS AIGF AIR-PREV-006Data Quality & Classification/Sensitivity

The same ground elsewhere linked through the kinds of duty both controls are mapped from

Data subject rights

Comprehensive regime

Enforcement supervision

Sensitive categories

Sector security regimes

AI risk obligations

AI governance

Security baseline statutes

AI sector rules

Biometric privacy

Product security requirements

AI prohibited practices

AI training data

AI transparency

Cross border transfer

Personal data