Law / Privacy
Privacy law, instrument by instrument
Law on collecting and using information about identifiable people: the legal basis to process it, stricter rules for sensitive and biometric data, people's rights to see, correct and delete it, limits on sending it abroad, and the duty to report a breach. In practice, it applies to almost any product with user accounts, analytics or customer records.
Every privacy law instrument LexLint holds, grouped by the jurisdiction that made it. Choose which stages of law to show: the map, the counts and the tables all answer to that choice. To see every area of law, follow Law in the breadcrumb above.
- 1
- 5
- 10
- 20+
- instruments shown
- law on file, none at these stages
- tracked, no law on file
- not tracked
Unions37 in 2 jurisdictions
Law made above the state, binding its members.
Countries1,243 in 182 jurisdictions
Grouped by region, the European Union heading its member states as a block; alphabetical within each group.
| Instrument | When |
|---|---|
| Europe | |
| European Union · 27 member states | |
 Austria
at
7 instruments
| |
| Datenschutzgesetz (DSG), Data Protection ActDatenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 50/2025 | since |
| GDPR Article 22, Automated Decision-Making in AustriaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 82 and Datenschutzbehörde Enforcement in AustriaRegulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4 | since |
| GDPR Article 9, Special Categories of Personal Data, as Applied in AustriaRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21 and DSG Section 4, Data Subject Rights in AustriaRegulation (EU) 2016/679, Arts. 12-21; Datenschutzgesetz (DSG) § 4 | since |
| GDPR Articles 33-34, Breach Notification in AustriaRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from AustriaRegulation (EU) 2016/679, Arts. 44-49 | since |
 Belgium
be
10 instruments
| |
| Act of 30 July 2018 Article 10/1, Recorded Commercial CommunicationsLoi du 30 juillet 2018, Art. 10/1, as inserted by the Act of , article 255 | since |
| Act of 30 July 2018 Articles 8-10, Special-Category Processing GroundsLoi du 30 juillet 2018, Arts. 8-10 | since |
| Act of 30 July 2018 Title 6 Chapter II, Criminal SanctionsLoi du 30 juillet 2018, Arts. 222-230 | since |
| Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal DataLoi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581) | since |
| Act of 3 December 2017, GBA/APD and Litigation ChamberLoi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916) | since |
| Code de Droit Économique Article XVII.37, 10 degrees/1, Collective Redress for GDPR ClaimsCode de droit economique, Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43 | since |
| GDPR Article 22, Automated Decision-Making in BelgiumRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21 and Act of 30 July 2018 Title 5, Data Subject Rights and Action en Cessation in BelgiumRegulation (EU) 2016/679, Arts. 12-21; Loi du 30 juillet 2018, Arts. 209-211, 220 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49; Loi du 30 juillet 2018, Art. 222, 4 | since |
 Bulgaria
bg
8 instruments
| |
| Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)Закон за защита на личните данни (ЗЗЛД), Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of , as amended) | since |
| GDPR Article 22, Automated Decisions in BulgariaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Zakon za zashtita na lichnite danni, Art. 37a | since |
| GDPR Article 9 and PDPA Employment and National-ID-Number RulesRegulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions | since |
| GDPR Articles 12-21 and Personal Data Protection Act Articles 37a-37v, Data Subject Rights in BulgariaRegulation (EU) 2016/679, Arts. 12-21; Zakon za zashtita na lichnite danni, Arts. 37a-37v | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| KZLD Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | since |
| Electronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications ServicesZakon za elektronnite saobshtenia (Закон за електронните съобщения), чл. 261в-261д | since |
 Croatia
hr
8 instruments
| |
| Rulebook on Processing Health and Other Personal Data in National Health Information Systems, Security Measures and Access RulesPravilnik o načinu obrade zdravstvenih i drugih osobnih podataka u zdravstvenim nacionalnim i institucionalnim informacijskim sustavima u zdravstvu (Narodne novine 150/2024), čl. 6-10 | since |
| AZOP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | since |
| Act on the Implementation of the General Data Protection RegulationZakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18 | since |
| Croatian Act Articles 21-23, Biometric Data by SectorZakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23 | since |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21, Data Subject Rights in CroatiaRegulation (EU) 2016/679, Arts. 12-21; Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/2018) | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
 Cyprus
cy
8 instruments
| |
| GDPR Article 22 and Law 125(I)/2018 Article 31, Decisions About a Person in CyprusRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Law 125(I)/2018, Art. 31 | since |
| GDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in CyprusRegulation (EU) 2016/679, Art. 9; Law 125(I)/2018 | since |
| GDPR Articles 12-21 and Law 125(I)/2018 Article 11, Data Subject Rights in CyprusRegulation (EU) 2016/679, Arts. 12-21; Law 125(I)/2018, Art. 11 | since |
| Law 125(I)/2018, Cyprus GDPR SupplementLaw 125(I)/2018 of 2018 | since |
| GDPR Articles 33-34 and Law 125(I)/2018 Article 12, Breach Notification in CyprusRegulation (EU) 2016/679, Arts. 33-34; Law 125(I)/2018, Art. 12 | since |
| GDPR Articles 82-83 and ODPC Enforcement in CyprusRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V and Law 125(I)/2018 Articles 17-18, Cross-Border Transfer of Personal Data from CyprusRegulation (EU) 2016/679, Arts. 44-49; Law 125(I)/2018, Arts. 17-18 | since |
| e-Health Law Articles 26 to 27 and 32 to 35, Provider Records Banks, Access Logging and Confidentiality of Health DataLaw 59(I)/2019 (Ο περί Ηλεκτρονικής Υγείας Νόμος του 2019), Arts. 26-27, 32-35 | from a date not yet set |
 Czech Republic
cz
7 instruments
| |
| UOOU Enforcement, GDPR Article 82, and the Act on Collective Civil Court ProceedingRegulation (EU) 2016/679, Arts. 82-83; Zakon c. 179/2024 Sb., o hromadnem obcanskem soudnim rizeni; Zakon c. 180/2024 Sb. | since |
| Act on Personal Data ProcessingZakon c. 110/2019 Sb., o zpracovani osobnich udaju | since |
| GDPR Article 22, Automated Decisions in the Czech RepublicRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Zákon č. 110/2019 Sb., § 11 | since |
| GDPR Article 9, Special Categories of Personal DataRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21 and Act No. 110/2019 Sb. Section 11, Data Subject Rights in the Czech RepublicRegulation (EU) 2016/679, Arts. 12-21; Zákon č. 110/2019 Sb., o zpracování osobních údajů, § 11 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
 Denmark
dk
7 instruments
| |
| Danish Data Protection Act (Databeskyttelsesloven)Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of | since |
| GDPR Article 22, Automated Decisions in DenmarkRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Special Categories of Personal Data as Applied in DenmarkRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21, Data Subject Rights as Applied in DenmarkRegulation (EU) 2016/679, Arts. 12-21; Databeskyttelsesloven | since |
| GDPR Articles 33-34, Breach Notification in DenmarkRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and Datatilsynet Enforcement in DenmarkRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from DenmarkRegulation (EU) 2016/679, Arts. 44-49 | since |
 Estonia
ee
7 instruments
| |
| GDPR Articles 82-83 and AKI Enforcement in EstoniaRegulation (EU) 2016/679, Arts. 82-83 | since |
| Personal Data Protection Act (Isikuandmete kaitse seadus)Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted | since |
| GDPR Article 22, Automated Decisions in EstoniaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Special Categories of Personal Data as Applied in EstoniaRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21, Data Subject Rights as Applied in EstoniaRegulation (EU) 2016/679, Arts. 12-21; Isikuandmete kaitse seadus | since |
| GDPR Articles 33-34, Breach Notification in EstoniaRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from EstoniaRegulation (EU) 2016/679, Arts. 44-49 | since |
 Finland
fi
8 instruments
| |
| Data Protection Act (Tietosuojalaki)Tietosuojalaki 1050/2018 (amendments up to 380/2026 included) | since |
| GDPR Article 9 and Data Protection Act Section 6, Special Categories in FinlandRegulation (EU) 2016/679, Art. 9; Tietosuojalaki 1050/2018 sec. 6 (as amended by 380/2026, in force from ) | since |
| GDPR Articles 12-21 and Data Protection Act Sections 21 and 33-34, Data Subject Rights in FinlandRegulation (EU) 2016/679, Arts. 12-21; Tietosuojalaki 1050/2018 secs. 21, 33-34 | since |
| GDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in FinlandRegulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24 | since |
| GDPR Article 22, Automated Decisions in FinlandRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 33-34, Breach Notification in FinlandRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from FinlandRegulation (EU) 2016/679, Arts. 44-49; Tietosuojalaki 1050/2018 sec. 27 | since |
| Act on the Protection of Privacy in Working Life, Sections 15 to 17, Genetic Testing and Camera Surveillance of EmployeesLaki yksityisyyden suojasta työelämässä 759/2004, 15-17 § | since |
 France
fr
11 instruments
| |
| Loi 78-17 Articles 65, 66, 73 and 76, Health-Data Processing Through CNIL Référentiels and a Declaration of Conformity (as Amended by the Simplification Law of 26 May 2026)Loi n. 78-17 du 6 janvier 1978, Arts. 65, 66, 73 and 76, as amended by the loi du 26 mai 2026 de simplification de la vie économique, Art. 54 (JORFTEXT000054131304) | since |
| Loi 78-17 Article 47, Automated Administrative DecisionsLoi n. 78-17 du 6 janvier 1978, Art. 47 | since |
| Loi 78-17 Articles 48 and 51 II, Rights of Minors in FranceLoi n. 78-17 du 6 janvier 1978, Arts. 48 and 51 II | since |
| CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique | since |
| CNIL Enforcement, GDPR Article 83 and Code Pénal Articles 226-16 to 226-22-2Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 | since |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6 | since |
| GDPR Articles 12-21 and Loi 78-17 Article 49, Data Subject Rights in FranceRegulation (EU) 2016/679, Arts. 12-21; Loi n. 78-17 du 6 janvier 1978, Art. 49 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| Loi Informatique et Libertés, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)Loi n. 78-17 du 6 janvier 1978 relative a l'informatique, aux fichiers et aux libertes, as amended (JORFTEXT000000886460) | since |
 Germany
de
11 instruments
| |
| Social Code Book V Section 342, Electronic Patient Record with Opt-OutFünftes Buch Sozialgesetzbuch (SGB V), § 342 Abs. 1 und 2 | since |
| Health Data Use Act (GDNG) Sections 1 and 6 to 9, Secondary Use and Protection of Health DataGesundheitsdatennutzungsgesetz (GDNG), §§ 1, 6-9 | since |
| BDSG Sections 32, 33 and 36, Limits on the Duty to Inform and the Right to Object in GermanyBundesdatenschutzgesetz (BDSG) §§ 32, 33, 36 | since |
| Bundesdatenschutzgesetz (BDSG), Federal Data Protection ActBundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended | since |
| GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in GermanyRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 | since |
| GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehörden Enforcement in GermanyRegulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43 | since |
| GDPR Article 9 and BDSG Section 26(3), Special Categories of Personal Data and Their Processing for Employment in GermanyRegulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3) | since |
| GDPR Articles 12-21 and BDSG Sections 34 and 35, Data Subject Rights in GermanyRegulation (EU) 2016/679, Arts. 12-21; Bundesdatenschutzgesetz (BDSG) §§ 34, 35 | since |
| GDPR Articles 33-34, Breach Notification in GermanyRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GermanyRegulation (EU) 2016/679, Arts. 44-49 | since |
| Genetic Diagnostics Act (GenDG), Genetic Examinations, Genetic Samples and Data, and Genetic Discrimination in Insurance and EmploymentGendiagnostikgesetz (GenDG) vom 31. Juli 2009 (BGBl. I S. 2529, 3672), as amended | since |
 Greece
gr
7 instruments
| |
| GDPR Articles 12-21 and Law 4624/2019 Article 27, Data Subject Rights and Employment in GreeceRegulation (EU) 2016/679, Arts. 12-21; Law 4624/2019, Art. 27(2), (7) | since |
| Law 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)Law 4624/2019, FEK A' 137/29-08-2019 | since |
| GDPR Article 22, Automated Decisions in GreeceRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9 and Law 4624/2019, Special Categories in GreeceRegulation (EU) 2016/679, Art. 9; Law 4624/2019 | since |
| GDPR Articles 33-34, Breach Notification in GreeceRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and HDPA Enforcement in GreeceRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GreeceRegulation (EU) 2016/679, Arts. 44-49 | since |
 Hungary
hu
10 instruments
| |
| Labour Code Section 11/A, Monitoring of Employees and Employer-Provided Devices2012. évi I. törvény a munka törvénykönyvéről (Mt.), 11/A. § | since |
| GDPR Article 22, Automated Decisions in HungaryRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21 and Infotv. Sections 23 and 25, Data Subject Rights in HungaryRegulation (EU) 2016/679, Arts. 12-21; 2011. évi CXII. törvény (Infotv.), §§ 23, 25 | since |
| GDPR Articles 33-34 and Infotörvény Sections 25/J-25/K, Breach Notification in HungaryRegulation (EU) 2016/679, Arts. 33-34; 2011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| Infotörvény Definitions, Biometric and Special-Category Data2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat") | since |
| Infotörvény (Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information)2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol | since |
| NAIH Enforcement, GDPR Article 82, and Infotörvény Section 24 SérelemdíjRegulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section | since |
| Act C of 2003 on Electronic Communications, Section 156, Personal Data Breach Notification by Electronic Communications Providers2003. évi C. törvény (Eht.) 156. § (2)-(5) | since |
| Electronic Commerce Act Section 13/A, Personal Data of Recipients of Information Society Services2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről (Ekertv.), 13/A. § | since |
 Ireland
ie
10 instruments
| |
| Health Information Act 2026 Sections 10, 12 and 19 to 22, Electronic Health Record, Personal Public Service Number and Data Requests by the Health Service ExecutiveHealth Information Act 2026 (No. 10 of 2026), ss. 10, 12, 19-22 | since |
| Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in IrelandData Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018), regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021 | since |
| Data Protection Act 2018Data Protection Act 2018 (No. 7 of 2018) | since |
| GDPR Article 22 and Data Protection Act 2018 Section 57, Automated Decision-Making in IrelandRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act 2018, s. 57 | since |
| GDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in IrelandRegulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117 | since |
| GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories of Personal Data in Employment and Social Welfare Law in IrelandRegulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 | since |
| GDPR Articles 12-21 and Data Protection Act 2018 Sections 60-61, Data Subject Rights in IrelandRegulation (EU) 2016/679, Arts. 12-21; Data Protection Act 2018, ss. 60-61 | since |
| GDPR Articles 33-34, Breach Notification in IrelandRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from IrelandRegulation (EU) 2016/679, Arts. 44-49 | since |
| Health Information Act 2026 Sections 7, 8 and 13 to 15, Duty to Share Health Data and Patient Access to Electronic Health RecordsHealth Information Act 2026 (No. 10 of 2026), ss. 7-8, 13-15 | from a date not yet set |
 Italy
it
9 instruments
| |
| Law 132/2025 Article 8, Health Data Processing for Research and Experimentation in Building AI SystemsLegge 23 settembre 2025, n. 132, art. 8 | since |
| Garante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data PrescriptionsGarante Provvedimento n. 146 del 5 giugno 2019 | since |
| Codice Privacy (Personal Data Protection Code), as Amended for GDPR AlignmentDecreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101 | since |
| GDPR Article 22 and the Garante's OpenAI/ChatGPT EnforcementRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Garante Provvedimento 30 marzo 2023 | since |
| GDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis)Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) | since |
| GDPR Article 9 Special Categories and Codice Privacy Article 167(2)Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) | since |
| GDPR Articles 12-21 and Codice Articles 2-undecies and 2-terdecies, Data Subject Rights in ItalyRegulation (EU) 2016/679, Arts. 12-21; D.Lgs. 196/2003, as amended by D.Lgs. 101/2018, Arts. 2-undecies, 2-terdecies | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
 Latvia
lv
7 instruments
| |
| Personal Data Processing Law (Fizisko personu datu apstrādes likums)Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force | since |
| Personal Data Processing Law Article 25(2), Special Categories in LatviaFizisko personu datu apstrades likums, Art. 25(2); Regulation (EU) 2016/679, Art. 9 | since |
| GDPR Article 22, Automated Decisions in LatviaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21, Data Subject Rights as Applied in LatviaRegulation (EU) 2016/679, Arts. 12-21; Fizisko personu datu apstrādes likums, Art. 27(1) | since |
| GDPR Articles 33-34, Breach Notification in LatviaRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and DVI Enforcement in LatviaRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LatviaRegulation (EU) 2016/679, Arts. 44-49 | since |
 Lithuania
lt
8 instruments
| |
| Law on Legal Protection of Personal DataRepublic of Lithuania Law No. XIII-1426, in force (as amended) | since |
| GDPR Article 22, Automated Decisions in LithuaniaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Special Categories of Personal Data as Applied in LithuaniaRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21, Data Subject Rights as Applied in LithuaniaRegulation (EU) 2016/679, Arts. 12-21 | since |
| GDPR Articles 33-34, Breach Notification in LithuaniaRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and VDAI Enforcement in LithuaniaRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V and VDAI Article 46(3) Authorization, Cross-Border Transfer from LithuaniaRegulation (EU) 2016/679, Arts. 44-49 | since |
| Law on Electronic Communications Article 74, Personal Data Breach Notification by Electronic Communications ProvidersLietuvos Respublikos elektroninių ryšių įstatymas Nr. IX-2135, Art. 74(4)-(8) | since |
 Luxembourg
lu
9 instruments
| |
| Insurance Sector Law Article 181-3, Lawful Processing of Health Data by Insurers and ReinsurersLoi du 6 février 2025 modifiant la loi modifiée du 7 décembre 2015 sur le secteur des assurances, Art. 181-3 | since |
| Act of 1 August 2018 on the Organisation of the CNPD and the General Data Protection FrameworkLoi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données (Mémorial A n° 686 du 16 août 2018) | since |
| Labour Code Article L.261-1, Monitoring of Employees and Personal Data in the Employment RelationshipCode du travail, Art. L.261-1 (Titre VI, loi du 1er août 2018) | since |
| GDPR Article 22, Automated Decisions as Applied in LuxembourgRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Special Categories of Personal Data as Applied in LuxembourgRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21 and Loi du 1er août 2018 Article 63, Data Subject Rights in LuxembourgRegulation (EU) 2016/679, Arts. 12-21; Loi du 1er aout 2018, Arts. 63, 65 | since |
| GDPR Articles 33-34, Breach Notification in LuxembourgRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and CNPD Enforcement in LuxembourgRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LuxembourgRegulation (EU) 2016/679, Arts. 44-49 | since |
 Malta
mt
7 instruments
| |
| Data Protection Act, Chapter 586 of the Laws of MaltaData Protection Act, Cap. 586 | since |
| GDPR Article 22, Automated Decisions in MaltaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Data Protection Act, Cap. 586 | since |
| GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in MaltaRegulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 | since |
| GDPR Articles 12-21 and Cap. 586, Data Subject Rights in MaltaRegulation (EU) 2016/679, Arts. 12-21; Data Protection Act, Cap. 586, art. 6; Subsidiary Legislation 586.09, reg. 4(e); Subsidiary Legislation 586.11 | since |
| GDPR Articles 33-34, Breach Notification in MaltaRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Articles 82-83 and IDPC Enforcement in MaltaRegulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from MaltaRegulation (EU) 2016/679, Arts. 44-49 | since |
 Netherlands
nl
9 instruments
| |
| AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action RegimeRegulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) | since |
| GDPR Article 22 and UAVG Article 40, Automated Decisions in the NetherlandsRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; UAVG, Art. 40 | since |
| GDPR Articles 12-21 and UAVG Articles 41 and 43, Data Subject Rights in the NetherlandsRegulation (EU) 2016/679, Arts. 12-21; UAVG, Arts. 41, 43 | since |
| GDPR Articles 33-34 and UAVG Article 42, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| UAVG Article 29, Biometric-Data Exception for Authentication or SecurityUAVG, Art. 29 | since |
| UAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number DataUAVG, Arts. 30-33, 46 | since |
| Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), GDPR Implementation ActWet van 16 mei 2018, houdende regels ter uitvoering van de Algemene verordening gegevensbescherming (BWBR0040940) | since |
| Telecommunicatiewet Article 11.3a, Personal Data Breach Notification by Electronic Communications ProvidersTelecommunicatiewet, Art. 11.3a | since |
 Poland
pl
7 instruments
| |
| Act on the Protection of Personal Data of 10 May 2018Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000 | since |
| GDPR Article 22, Automated Decisions in PolandRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric DataRegulation (EU) 2016/679, Art. 9; Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b) | since |
| GDPR Articles 12-21 and Act of 10 May 2018 Articles 92-97, Data Subject Rights in PolandRegulation (EU) 2016/679, Arts. 12-21; Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Arts. 92-97 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| UODO Enforcement, GDPR Article 82, and Act Articles 98, 101-108Regulation (EU) 2016/679, Art. 83; Ustawa z 10 maja 2018 r., Arts. 98, 101-108 | since |
 Portugal
pt
7 instruments
| |
| Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execução do RGPD)Lei n.o 58/2019, de 8 de agosto | since |
| CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in PortugalCNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Article 22, Automated Decisions in PortugalRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Lei n.o 58/2019, de 8 de agosto | since |
| GDPR Article 9, Special Categories of Personal Data as Applied in PortugalRegulation (EU) 2016/679, Art. 9 | since |
| GDPR Articles 12-21 and Lei n.o 58/2019, Data Subject Rights in PortugalRegulation (EU) 2016/679, Arts. 12-21; Lei n.o 58/2019, de 8 de agosto, arts. 20, 31 | since |
| GDPR Articles 33-34, Breach Notification in PortugalRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from PortugalRegulation (EU) 2016/679, Arts. 44-49 | since |
 Romania
ro
8 instruments
| |
| GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP RulesRegulation (EU) 2016/679, Art. 9; Legea nr. 190/2018, automated decision-making and national identification number provisions | since |
| Law No. 190/2018 on Measures for the Implementation of Regulation (EU) 2016/679Legea nr. 190/2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679 | since |
| ANSPDCP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | since |
| GDPR Article 22, Automated Decisions in RomaniaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21 and Legea nr. 190/2018 Article 8, Data Subject Rights in RomaniaRegulation (EU) 2016/679, Arts. 12-21; Legea nr. 190/2018, Art. 8 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| Law 506/2004 Article 3, Personal Data Breach Notification by Electronic Communications ProvidersLegea nr. 506/2004 privind prelucrarea datelor cu caracter personal și protecția vieții private în sectorul comunicațiilor electronice, Art. 3(5)-(12) | since |
 Slovakia
sk
7 instruments
| |
| Act on the Protection of Personal DataZakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov | since |
| GDPR Article 22, Automated Decisions in SlovakiaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Zákon č. 18/2018 Z. z., § 28 | since |
| GDPR Article 9 and Act Section 78, National Birth NumberRegulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78 | since |
| GDPR Articles 12-21, Data Subject Rights in SlovakiaRegulation (EU) 2016/679, Arts. 12-21; Zákon č. 18/2018 Z. z. | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| Office for Personal Data Protection Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | since |
 Slovenia
si
8 instruments
| |
| ZVOP-2 Chapter 4 (Articles 81-84) and Article 80, Biometric and Genetic DataZVOP-2, Arts. 80-84, 105 | since |
| Zakon o varstvu osebnih podatkov (ZVOP-2), Personal Data Protection ActZakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS, st. 163/22 | since |
| Electronic Communications Act (ZEKom-2) Article 227, Personal Data Breach Notification by Providers of Public Communications ServicesZakon o elektronskih komunikacijah (ZEKom-2), Uradni list RS, št. 130/2022, 227. člen | since |
| GDPR Article 22, Automated Decisions in SloveniaRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Articles 12-21 and ZVOP-2 Articles 11 and 69, Data Subject Rights in SloveniaRegulation (EU) 2016/679, Arts. 12-21; ZVOP-2, Arts. 11, 69 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| Informacijski pooblaščenec Enforcement, GDPR Article 82, and ZVOP-2 Articles 114-116Regulation (EU) 2016/679, Art. 82; ZVOP-2, Arts. 105, 114-116 | since |
 Spain
es
9 instruments
| |
| GDPR Article 22 and LOPDGDD Article 11(2), Automated Decisions in SpainRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; LOPDGDD, Ley Orgánica 3/2018, Art. 11(2) | since |
| LOPDGDD Título III and Título X, Data-Subject and Digital RightsLOPDGDD, Arts. 11-18, 93-96 | since |
| Ley Orgánica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive RegimeLey Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales (BOE-A-2018-16673) | since |
| AEPD Enforcement, GDPR Article 82 and LOPDGDD Título IXRegulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 | since |
| GDPR Articles 33-34 and LOPDGDD Articles 73(r)-(s) and 74(m)-(n), Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 73(r)-(s), Art. 74(m)-(n) | since |
| LOPDGDD Título VI, International Transfers, Layered on GDPR Chapter VRegulation (EU) 2016/679, Arts. 44-49; LOPDGDD, Arts. 40-43, 72.1(l) | since |
| Ley 14/2007, Confidentiality, Consent and Secrecy Rules for Personal Health Data in Biomedical Research in SpainLey 14/2007, art. 5 | since |
| Ley 41/2002, Confidentiality of Patients' Health Data and Security of Clinical Records in SpainLey 41/2002, arts. 7, 16 and 17 | since |
| Ley 41/2002, Patient Right of Access to the Clinical Record and Active Custody of It in SpainLey 41/2002, de 14 de noviembre, arts. 18 and 19 | since |
 Sweden
se
8 instruments
| |
| Kamerabevakningslagen (Camera Surveillance Act)Kamerabevakningslag, SFS 2018:1200 | since |
| Dataskyddslagen (Data Protection Act), GDPR-Complementing ProvisionsDataskyddslagen, SFS 2018:218 | since |
| GDPR Article 22, Automated Decisions in SwedenRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition DecisionRegulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221 | since |
| GDPR Articles 12-21 and Dataskyddslagen Chapter 5, Data Subject Rights in SwedenRegulation (EU) 2016/679, Arts. 12-21; Dataskyddslagen (2018:218), ch. 5 §§ 1-2 | since |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; Dataskyddslagen (2018:218), ch. 1 § 4 | since |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49 | since |
| IMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group ProceedingsRegulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang | since |
| Europe (non EU) | |
 Albania
al
7 instruments
| |
| Law No. 124/2024 On the Protection of Personal DataLaw No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force | since |
| Law No. 124/2024, Commissioner, remedies, liability and penaltiesLaw No. 124/2024, Arts. 75-95 (Commissioner, remedies, liability and penalties) | since |
| Law No. 124/2024, automated decisionsLaw No. 124/2024, art. 20 (automated individual decisions) | since |
| Law No. 124/2024, international data transferLaw No. 124/2024, Arts. 39-42 (international data transfer) | since |
| Law No. 124/2024, notification of a personal data breachLaw No. 124/2024, Art. 29 (notification of a personal data breach) | since |
| Law No. 124/2024, rights of the data subjectLaw No. 124/2024, Arts. 12-19, 21 (rights of the data subject) | since |
| Law No. 124/2024, special categories of personal data, criminal records and children's dataLaw No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) | since |
 Andorra
ad
7 instruments
| |
| LQPD, Llei 29/2021 del 28 d'octubreLQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) | since |
| LQPD, automated decisionsLlei 29/2021, art. 25 (automated individual decisions) | since |
| LQPD, personal data breach notificationLlei 29/2021, arts. 36-37 (personal data breach notification) | since |
| LQPD, rights of the data subjectLlei 29/2021, arts. 15-24, 26 (rights of the data subject) | since |
| LQPD, special categories, children and criminal-offence dataLlei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) | since |
| LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctionsLlei 29/2021, arts. 46-74 (the Andorran Data Protection Agency, its powers, infractions and sanctions) | since |
| LQPD, transfers of personal data to third countries or international organisationsLlei 29/2021, arts. 42-45 (transfers of personal data to third countries or international organisations) | since |
 Belarus
by
6 instruments
| |
| Law of the Republic of Belarus On Personal Data ProtectionZakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of ), arts. 1-7, 17 and 20-21 (general processing and security) | since |
| Law of the Republic of Belarus On Personal Data Protection, authorized agency and liabilityLaw No. 99-Z, arts. 15, 18-19 (authorized agency and liability) | since |
| Law of the Republic of Belarus On Personal Data Protection, cross border transfer of personal dataLaw No. 99-Z, art. 9 (cross border transfer of personal data) | since |
| Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violationsLaw No. 99-Z, art. 16.1 (notification of personal data protection violations) | since |
| Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subjectLaw No. 99-Z, arts. 10-14 (rights of the personal data subject) | since |
| Law of the Republic of Belarus On Personal Data Protection, special personal dataLaw No. 99-Z, arts. 1, 8 (special personal data) | since |
 Bosnia and Herzegovina
ba
8 instruments
| |
| Law on the Protection of Personal Data of Bosnia and HerzegovinaLaw on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable , arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, automated decisionsLaw on the Protection of Personal Data, art. 24 (automated individual decisions) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, biometric data processingLaw on the Protection of Personal Data, arts. 57a-57b (biometric data processing) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transferLaw on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notificationLaw on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjectsLaw on the Protection of Personal Data, arts. 14-23, 25 (rights of data subjects) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consentLaw on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) | since |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penaltiesLaw on the Protection of Personal Data, arts. 96-115 (enforcement, supervision and penalties) | since |
 Iceland
is
7 instruments
| |
| Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from IcelandLog nr. 90/2018, Art. 16 | since |
| Act No. 90/2018 Article 22, Automated Decisions in IcelandLog nr. 90/2018, arts. 2 and 22, incorporating Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| Act No. 90/2018 Article 3 Item 3 and Article 11, Sensitive Personal Data in IcelandLog nr. 90/2018, Art. 3, item 3, point (e), Art. 9, Art. 11 | since |
| Act No. 90/2018 on Data Protection and the Processing of Personal DataLog nr. 90/2018 um personuvernd og vinnslu personuupplysinga (Act No. 90/2018), passed by Althingi , in force | since |
| Act No. 90/2018, Breach Notification in IcelandLog nr. 90/2018, arts. 2 and 27, incorporating Regulation (EU) 2016/679, Arts. 33-34; art. 17 | since |
| Act No. 90/2018, Data Subject Rights in IcelandLog nr. 90/2018, art. 2, incorporating Regulation (EU) 2016/679, Arts. 12-21; arts. 17 to 19 | since |
| Act No. 90/2018, Persoonuvernd Enforcement in IcelandLog nr. 90/2018, arts. 39, 41, 42, 45 to 48 and 51; Regulation (EU) 2016/679, Arts. 82-83 | since |
 Liechtenstein
li
8 instruments
| |
| DSG Automated-Decision Rights in LiechtensteinRegulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Arts. 1 and 37 | since |
| DSG Breach Notification in LiechtensteinRegulation (EU) 2016/679, Articles 33 and 34; Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 43, 64 and 65 | since |
| DSG Datenschutzstelle Enforcement in LiechtensteinDatenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 10, 40 to 42 and 44 | since |
| DSG Special Categories of Personal Data, GDPR Article 9 and DSG Article 21 in LiechtensteinDatenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Article 21 | since |
| Datenschutzgesetz (DSG)Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, dated , in effect ; Regulation (EU) 2016/679 as incorporated into the EEA Agreement by EEA Joint Committee Decision No. 154/2018 | since |
| Datenschutzgesetz (DSG), Chapter III, record of processing categories and loggingDatenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 69 and 75 | since |
| GDPR Articles 12-21 and DSG Articles 27 and 35, Data Subject Rights in LiechtensteinRegulation (EU) 2016/679, Arts. 12-21; Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Arts. 27(4), 35(1) | since |
| GDPR Chapter V and DSG Transfer Provisions (Articles 77 to 80 and 84), Cross-Border Transfers in LiechtensteinDatenschutzgesetz (DSG), LGBl. 2018 Nr. 272, Articles 77 to 80, 84 and 85; Regulation (EU) 2016/679, Articles 44 to 49; EEA Joint Committee Decision No. 154/2018 | since |
 Moldova
md
7 instruments
| |
| Law No. 195/2024 on Personal Data ProtectionLegea Nr. 195 din 25 iulie 2024, articolele 1-7, 11 si 24-43 (principii, temeiuri legale si obligatiile operatorului) | since |
| Moldova Law No. 195/2024, automated decisionsLegea Nr. 195 din 25 iulie 2024, articolul 22 (automated individual decisions) | since |
| Moldova Law No. 195/2024, personal data breach notificationLegea Nr. 195 din 25 iulie 2024, articolele 33-34 (notificarea incalcarii securitatii datelor) | since |
| Moldova Law No. 195/2024, rights of the data subjectLegea Nr. 195 din 25 iulie 2024, articolele 12-21, 23 (drepturile subiectului de date) | since |
| Moldova Law No. 195/2024, special categories, a child's consent and conviction dataLegea Nr. 195 din 25 iulie 2024, articolele 8-10 (categorii speciale de date si consimtamantul copilului) | since |
| Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctionsLegea Nr. 195 din 25 iulie 2024, articolele 55-86 (Centrul National, plangeri, despagubiri si sanctiuni) | since |
| Moldova Law No. 195/2024, transfers of personal data abroadLegea Nr. 195 din 25 iulie 2024, articolele 44-50 (transferuri catre tari terte) | since |
 Monaco
mc
7 instruments
| |
| Loi n. 1.565 du 3 décembre 2024, automated decisionsLoi n. 1.565 du 3 decembre 2024, art. 19 (automated individual decisions) | since |
| Loi sur la Protection des Données PersonnellesLoi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) | since |
| Loi sur la Protection des Données Personnelles, autorité de contrôle et sanctionsLoi n. 1.565 du 3 decembre 2024, arts. 37-57, 102-106 (supervisory authority, sanctions and right to reparation) | since |
| Loi sur la Protection des Données Personnelles, données sensibles et mineursLoi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors) | since |
| Loi sur la Protection des Données Personnelles, droits de la personne concernéeLoi n. 1.565 du 3 decembre 2024, arts. 10-18, 20 (rights of the data subject) | since |
| Loi sur la Protection des Données Personnelles, notification des violations de donnéesLoi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification) | since |
| Loi sur la Protection des Données Personnelles, transfert des donnéesLoi n. 1.565 du 3 decembre 2024, arts. 96-101 (transfer of personal data) | since |
 Montenegro
me
7 instruments
| |
| Law on Personal Data ProtectionOfficial Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended, arts. 1-10, 16-30 and 33-40 (general processing, security and registration) | since |
| Law on Personal Data Protection, agency, supervision and penal provisionsLaw on Personal Data Protection, arts. 47-74 (agency, supervision and penal provisions) | since |
| Law on Personal Data Protection, biometric measuresLaw on Personal Data Protection, arts. 31-32 (biometric measures) | since |
| Law on Personal Data Protection, rights of the data subjectLaw on Personal Data Protection, arts. 20-21, 23, 43-46 (rights of the data subject; art. 11 deleted by Official Gazette 44/12) | since |
| Law on Personal Data Protection, special categories of dataLaw on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data) | since |
| Law on Personal Data Protection, transfer of personal data from MontenegroLaw on Personal Data Protection, arts. 41-42 (transfer of personal data from Montenegro) | since |
| Law on Personal Data Protection (2026), scope, principles, lawful basis and special categoriesLaw on Personal Data Protection, Official Gazette of Montenegro No. 133/2026, arts. 1-10 and 105-106 (scope, principles, lawful basis, special categories, repeal of the 2008 Law and application) | from , in 4 months |
 North Macedonia
mk
8 instruments
| |
| Law on Personal Data Protection (LPDP)Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020 as amended by Official Gazette Nos. 294/2021 and 101/2025, fully applicable , arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations) | since |
| Law on Personal Data Protection (LPDP), automated individual decision-makingZakon za zastita na licnite podatoci, art. 26 (automated individual decision-making, including profiling) | since |
| Law on Personal Data Protection (LPDP), personal data breach notificationZakon za zastita na licnite podatoci, arts. 37-38 (personal data breach notification) | since |
| Law on Personal Data Protection (LPDP), rights of the data subjectZakon za zastita na licnite podatoci, arts. 16-25 and 27 (rights of the data subject) | since |
| Law on Personal Data Protection (LPDP), special categories, a child's consent and biometric, health and genetic dataZakon za zastita na licnite podatoci, arts. 12-14, 84 (special categories, a child's consent and biometric, health and genetic data) | since |
| Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisionsZakon za zastita na licnite podatoci, arts. 57-80, 97-116 (the Agency, supervision and misdemeanour provisions) | since |
| Law on Personal Data Protection (LPDP), transfer of personal dataZakon za zastita na licnite podatoci, arts. 48-56 (transfer of personal data), as amended by Official Gazette 101/2025 | since |
| Law on Personal Data Protection (LPDP), video surveillanceZakon za zastita na licnite podatoci, arts. 89-93 (video surveillance, notice, retention and destruction) | since |
 Norway
no
7 instruments
| |
| Personal Data Act (personopplysningsloven)Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38, in force | since |
| Personal Data Act Chapter 3 and GDPR Article 9, Special Categories in NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Art. 9; §§ 6, 7, 9 and 10 | since |
| Personal Data Act Chapter 7, Datatilsynet Enforcement in NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 82-83; §§ 26 to 30 | since |
| Personal Data Act and GDPR Chapter V, Cross-Border Transfer from NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 44-49 | since |
| Personal Data Act, Automated Decisions in NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 | since |
| Personal Data Act, Breach Notification in NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 33-34; § 16 | since |
| Personal Data Act, Data Subject Rights in NorwayPersonopplysningsloven (LOV-2018-06-15-38) § 1, incorporating Regulation (EU) 2016/679, Arts. 12-21; §§ 16 and 17 | since |
 Russia
ru
8 instruments
| |
| Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZFederal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of | since |
| Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal DataCriminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force | since |
| Federal Law No. 572-FZ, Unified Biometric System for Identification and AuthenticationFederal Law No. 572-FZ of "On the identification and/or authentication of individuals using biometric personal data" | since |
| Federal Law No. 152-FZ, Article 21 Part 3.1, Breach NotificationFederal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force ) | since |
| Federal Law No. 152-FZ "On Personal Data"Federal Law No. 152-FZ of "On Personal Data" (as amended) | since |
| Federal Law No. 152-FZ, Article 16, Decisions Based Solely on Automated ProcessingFederal Law No. 152-FZ, Art. 16 | since |
| Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data DefinitionFederal Law No. 152-FZ, Art. 10-11 | since |
| Federal Law No. 152-FZ, Articles 14 and 17, Data Subject RightsFederal Law No. 152-FZ, Art. 14 and 17 | since |
 San Marino
sm
7 instruments
| |
| San Marino Law No. 171 on the Protection of Natural PersonsLegge 21 dicembre 2018 n. 171, articoli 1-7, 9-11 e 23-44 (principi, basi giuridiche e obblighi del titolare) | since |
| San Marino Law No. 171, automated decisionsLegge 21 dicembre 2018 n. 171, articolo 22 (automated individual decisions) | since |
| San Marino Law No. 171, personal data breach notificationLegge 21 dicembre 2018 n. 171, articoli 34-35 (violazione dei dati personali) | since |
| San Marino Law No. 171, rights of the data subjectLegge 21 dicembre 2018 n. 171, articoli 12-21 (diritti dell'interessato) | since |
| San Marino Law No. 171, special categories of personal dataLegge 21 dicembre 2018 n. 171, articolo 8 (categorie particolari di dati personali) | since |
| San Marino Law No. 171, the Data Protection Authority, remedies and finesLegge 21 dicembre 2018 n. 171, articoli 51-75 (Autorita Garante, rimedi e sanzioni) | since |
| San Marino Law No. 171, transfers of personal data abroadLegge 21 dicembre 2018 n. 171, articoli 45-50 (trasferimenti verso paesi terzi) | since |
 Serbia
rs
7 instruments
| |
| Law on Personal Data ProtectionZakon o zastiti podataka o licnosti (Law on Personal Data Protection), Official Gazette RS No. 87/2018, arts. 1-15, 20, 41-51, 54-62, 88-94 (general provisions, principles, lawful basis, controller and processor obligations, data protection impact assessment, data protection officer, and special processing cases) | since |
| Law on Personal Data Protection, automated decisionsLaw on Personal Data Protection, art. 38 (automated individual decisions), Official Gazette RS No. 87/2018 | since |
| Law on Personal Data Protection, personal data breach notificationLaw on Personal Data Protection, arts. 52-53 (personal data breach notification), Official Gazette RS No. 87/2018 | since |
| Law on Personal Data Protection, rights of the data subjectLaw on Personal Data Protection, arts. 21-37, 39-40 (rights of the data subject), Official Gazette RS No. 87/2018 | since |
| Law on Personal Data Protection, special categories of personal data and minorsLaw on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018 | since |
| Law on Personal Data Protection, the Commissioner, legal remedies and penaltiesLaw on Personal Data Protection, arts. 73-87 and 95 (the Commissioner, legal remedies and penalties), Official Gazette RS No. 87/2018 | since |
| Law on Personal Data Protection, transfer of personal data to other statesLaw on Personal Data Protection, arts. 63-72 (transfer of personal data to other states and international organizations), Official Gazette RS No. 87/2018 | since |
| Draft Law on Personal Data Protection (2026 reform)Draft Law on Personal Data Protection, Ministry of Justice of the Republic of Serbia, public consultation opened | proposed |
 Switzerland
ch
9 instruments
| |
| Data Protection Ordinance, logging of automated processingData Protection Ordinance (DPO / DSV / OPDo), SR 235.11, Art. 4 | since |
| Data Protection Ordinance, retention of the impact assessment and breach documentationData Protection Ordinance, SR 235.11, Art. 14, Art. 15 para. 4 | since |
| FADP Article 24, Breach Notification in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24 | since |
| FADP Article 5 lit. c, Sensitive Personal Data Including Biometric DataFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 5 lit. c, Art. 6 para. 7, Art. 22 | since |
| FADP Articles 16-17, Cross-Border Transfer of Personal Data from SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 16-17 | since |
| FADP Articles 25-32, Data Subject Rights in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 25-32 | since |
| FADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65 | since |
| Federal Act on Data Protection (nFADP), General Processing PrinciplesFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31 | since |
| Federal Act on Data Protection, record of processing activitiesFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 12 | since |
 Ukraine
ua
1 instrument
| |
| Law of Ukraine On the Protection of Personal DataZakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force (Law of Ukraine No. 2297-VI) | since |
| Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)Draft Law of Ukraine No. 8153, first reading passed (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA) | proposed |
| Draft Law No. 8153, National Commission and penaltiesDraft Law No. 8153, National Commission on Personal Data Protection and penalty structure | proposed |
| Draft Law No. 8153, automated decision makingDraft Law No. 8153, arts. 18, 25 (automated individual decisions) | proposed |
| Draft Law No. 8153, cross border transfer reformDraft Law No. 8153, GDPR Chapter V style cross border transfer framework | proposed |
| Draft Law No. 8153, data subject rightsDraft Law No. 8153 (data subject rights: erasure, restriction, portability) | proposed |
| Draft Law No. 8153, personal data breach notificationDraft Law No. 8153, 72 hour breach notification to the National Commission | proposed |
 United Kingdom
gb
8 instruments
| |
| Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22DData (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425 | since |
| Data Protection (Charges and Information) Regulations 2018, Annual Charge and Information Duty for Data ControllersData Protection (Charges and Information) Regulations 2018 (S.I. 2018/480), regs. 2-3; Data Protection Act 2018, ss. 137, 158 | since |
| UK GDPR Article 82, Data Protection Act 2018 Section 169, and Information Commission EnforcementUK GDPR, Arts. 82-83; Data Protection Act 2018 §169 | since |
| UK GDPR Article 9, Special Categories of Personal Data Including Biometric DataUK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 | since |
| UK GDPR Articles 12-21 and Data Protection Act 2018 Section 164A, Data Subject Rights in the United KingdomUK GDPR, Arts. 12-21; Data Protection Act 2018, s. 164A | since |
| UK GDPR Articles 33-34 and PECR, Breach Notification in the United KingdomUK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 | since |
| UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United KingdomUK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025 | since |
| UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 | since |
 Vatican City
va
5 instruments
| |
| General Regulation on the Protection of Personal Data for Vatican City StateDecreto n. DCLVII del 30 aprile 2024 (ad experimentum, three-year period), Arts. 1, 2, 11, 12 and 13 (purpose, scope and controller duties) | since |
| General Regulation on the Protection of Personal Data, Data Protection Officer and complaintsDecreto n. DCLVII del 30 aprile 2024, Arts. 10 and 25 (Data Protection Officer and complaints) | since |
| General Regulation on the Protection of Personal Data, data subject rightsDecreto n. DCLVII del 30 aprile 2024, Regulation Arts. 15 to 22 (data subject rights: access, rectification, erasure, portability, objection and restriction) | since |
| General Regulation on the Protection of Personal Data, reporting of personal data violationsDecreto n. DCLVII del 30 aprile 2024, Regulation Art. 13, paragraph 2 (72-hour report of personal data violations) | since |
| General Regulation on the Protection of Personal Data, special categories of personal dataDecreto n. DCLVII del 30 aprile 2024, Regulation Art. 6 (special categories of personal data) | since |
| Americas | |
 Antigua and Barbuda
ag
4 instruments
| |
| Data Protection Act, 2013Data Protection Act, 2013 (No. 10 of 2013), ss. 5, 7-10, 17, 19-20 | since |
| Data Protection Act, 2013, information commissioner and enforcementData Protection Act, 2013, ss. 21-27 (information commissioner and enforcement) | since |
| Data Protection Act, 2013, notice and rights of data subjectsData Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects) | since |
| Data Protection Act, 2013, sensitive personal dataData Protection Act, 2013, s. 18 (sensitive personal data) | since |
 Argentina
ar
14 instruments
| |
| AAIP Resolución 126/2024: classification of infringements and graduation of sanctions under Ley 25.326Resolución 126/2024 de la Agencia de Acceso a la Información Pública, Anexos I y II (clasificación de infracciones y régimen de graduación de las sanciones) | since |
| AAIP Resolución 4/2019, Anexo I, Criterio 2: explanation of the logic of a solely automated decisionAgencia de Acceso a la Información Pública, Resolución 4/2019, Anexo I, Criterio 2 (tratamiento automatizado de datos) | since |
| Ley 25.326, Ley de Protección de los Datos PersonalesLey 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) | since |
| Ley 25.326, cross-border transferLey 25.326, art. 12 (cross-border transfer) | since |
| Ley 25.326, enforcement, sanctions, and the habeas data actionLey 25.326, arts. 29-43 (supervisory authority, sanctions, and habeas data) | since |
| Ley 25.326, rights of data subjectsLey 25.326, arts. 6, 13-16, 19, 27.3 (data subject rights) | since |
| Ley 25.326, sensitive data categories and health dataLey 25.326, arts. 7-8 (sensitive data categories and health data) | since |
| Decreto 1558/2001, regulation of Ley 25.326: advertising databases, profiles without consent and the right to withdrawal or blockingDecreto 1558/2001, art. 27 (reglamentación de la Ley 25.326: bases de datos con fines de publicidad, retiro o bloqueo) | in force |
| Decreto 1558/2001, regulation of Ley 25.326: consent and public-register exceptions to the transfer prohibition and the adequacy testDecreto 1558/2001, art. 12 (reglamentación de la Ley 25.326: transferencia internacional) | in force |
| Decreto 1558/2001, regulation of Ley 25.326: control body, sanction grading and complaint procedureDecreto 1558/2001, arts. 29 and 31 (reglamentación de la Ley 25.326: órgano de control y procedimiento sancionatorio) | in force |
| Decreto 1558/2001, regulation of Ley 25.326: health data used for offers of goods and servicesDecreto 1558/2001, art. 27, último párrafo (reglamentación de la Ley 25.326: datos vinculados a la salud) | in force |
| Decreto 1558/2001, regulation of Ley 25.326: how the rights of access, rectification, updating, erasure and confidentiality are exercisedDecreto 1558/2001, arts. 14-16 (reglamentación de la Ley 25.326: derecho de acceso y derechos de rectificación, actualización, supresión y confidencialidad) | in force |
| Decreto 1558/2001, regulation of Ley 25.326: private databases, deletion of stale data, informed consent and processorsDecreto 1558/2001, arts. 1, 4, 5 and 25 (reglamentación de la Ley 25.326: private reporting databases, stale data, informed consent, processing on behalf) | in force |
| Disposición DNPDP 60-E/2016: model contract clauses and adequate-country list for international transfersDisposición 60-E/2016 de la Dirección Nacional de Protección de Datos Personales, arts. 1-3 (cláusulas contractuales tipo de transferencia internacional) | in force |
 Bahamas
bs
10 instruments
| |
| Data Protection Act 2003, Commissioner, enforcement and penaltiesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences) | since |
| Data Protection Act 2003, application and processing principlesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 1-13 (application and data protection principles) | since |
| Data Protection Act 2003, cross-border transfer of personal dataData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas) | since |
| Data Protection Act 2003, data subject rightsData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 8-11 (access, rectification or erasure and direct marketing objection) | since |
| Data Protection Act, 2025, comprehensive regime as enactedData Protection Act, 2025 (No. 74 of 2025), Laws of The Bahamas, assented , repealing the Data Protection (Privacy of Personal Information) Act, Ch. 324A | from a date not yet set |
| Data Protection Act, 2025, data subject rightsData Protection Act, 2025 (No. 74 of 2025), ss. 24-32 (data subject rights) | from a date not yet set |
| Data Protection Act, 2025, enforcement and penaltiesData Protection Act, 2025 (No. 74 of 2025), ss. 12, 74-77, 80, 88, 90, 94-96 (enforcement, offences and penalty notices) | from a date not yet set |
| Data Protection Act, 2025, personal data breach notificationData Protection Act, 2025 (No. 74 of 2025), ss. 48-49 (personal data breach notification) | from a date not yet set |
| Data Protection Act, 2025, sensitive personal dataData Protection Act, 2025 (No. 74 of 2025), ss. 2(1), 35-36 (sensitive personal data) | from a date not yet set |
| Data Protection Act, 2025, transfer of personal data outside The BahamasData Protection Act, 2025 (No. 74 of 2025), ss. 54-56 (transfer of personal data outside The Bahamas) | from a date not yet set |
 Barbados
bb
7 instruments
| |
| Data Protection Act, 2019Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 | since |
| Data Protection Act, 2019, a child's consent and sensitive personal dataData Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) | since |
| Data Protection Act, 2019, automated decisionsData Protection Act, 2019, s. 18 (automated individual decision-making, including profiling) | since |
| Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019, ss. 63-64 (personal data breach notification) | since |
| Data Protection Act, 2019, rights of a data subjectData Protection Act, 2019, ss. 10-17, 19-21 (rights of a data subject) | since |
| Data Protection Act, 2019, the Commissioner, enforcement and penaltiesData Protection Act, 2019, ss. 70-95 (Commissioner, enforcement, tribunal and penalties) | since |
| Data Protection Act, 2019, transfers of personal data outside of BarbadosData Protection Act, 2019, ss. 22-28 (transfers of personal data outside of Barbados) | since |
 Belize
bz
4 instruments
| |
| Data Protection Act 2021, Commissioner, Tribunal, and enforcementData Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92 | from a date not yet set |
| Data Protection Act 2021, comprehensive regimeData Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22 | from a date not yet set |
| Data Protection Act 2021, cross-border transfer of personal dataData Protection Act, 2021 (Act No. 45 of 2021), ss. 23-29 (Transfers of Personal Data outside of Belize) | from a date not yet set |
| Data Protection Act 2021, personal data breach notificationData Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62 | from a date not yet set |
 Bolivia
bo
3 instruments
| |
| Reglamento para el Desarrollo de TIC, Tratamiento de los Datos PersonalesDS No. 1793, Reglamento a la Ley No. 164, art. 56 (Tratamiento de los Datos Personales), 13 de noviembre de 2013 | since |
| Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos PersonalesLey No. 164, arts. 56 (Protección de Datos Personales), promulgada 8 de agosto de 2011 | since |
| Constitución Política del Estado, Acción de Protección de PrivacidadCPE, art. 130 (Acción de Protección de Privacidad), promulgada 7 de febrero de 2009 | since |
| Anteproyecto de Ley de Protección de Datos Personales (AGETIC)Anteproyecto de Ley de Protección de Datos Personales | proposed |
 Brazil
br
12 instruments
| |
| ECA Digital (Lei nº 15.211/2025), children's personal data and profilingLei nº 15.211, de 17 de setembro de 2025 (Estatuto Digital da Criança e do Adolescente), arts. 7º, 16, 22 and 26 | since |
| ANPD International Data Transfer Regulation (Resolution CD/ANPD No. 19/2024)Resolução CD/ANPD nº 19, de 23 de agosto de 2024 (Regulamento de Transferência Internacional de Dados), Anexo I, arts. 4º, 9º, 16, 17, 21 and 28 | since |
| ANPD Regulation on the Data Protection Officer (Resolution CD/ANPD No. 18/2024)Resolução CD/ANPD nº 18, de 16 de julho de 2024 (Regulamento sobre a atuação do encarregado pelo tratamento de dados pessoais), Anexo, arts. 3º, 5º, 8º-10 and 19-21 | since |
| ANPD Regulation on Reporting Security Incidents (Resolution CD/ANPD No. 15/2024)Resolução CD/ANPD nº 15, de 24 de abril de 2024 (Regulamento de Comunicação de Incidente de Segurança), Anexo, arts. 4º-6º, 9º and 10 | since |
| ANPD Inspection and Sanctioning Procedure Regulation (Resolution CD/ANPD No. 1/2021)Resolução CD/ANPD nº 1, de 28 de outubro de 2021 (Regulamento do Processo de Fiscalização e do Processo Administrativo Sancionador), Anexo, arts. 5º and 6º | since |
| LGPD, civil liability, administrative sanctions and the ANPDLei nº 13.709, de 2018 (LGPD), arts. 42-45, 52-54, 55-A a 58-B (civil liability, administrative sanctions and the ANPD) | since |
| LGPD, international transfer of dataLei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data) | since |
| LGPD, review of automated decisionsLei nº 13.709, de 2018 (LGPD), art. 20 (review of automated decisions) | since |
| LGPD, rights of the data subjectLei nº 13.709, de 2018 (LGPD), arts. 17-19, 21-22 (rights of the data subject) | since |
| LGPD, security incident notificationLei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification) | since |
| LGPD, sensitive personal data and children's dataLei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) | since |
| Lei Geral de Proteção de Dados Pessoais (LGPD)Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) | since |
 Canada
ca
2 instruments
| |
| PIPEDA breach of security safeguards regimeS.C. 2000, c. 5, ss. 10.1-10.3 | since |
| Personal Information Protection and Electronic Documents Act (PIPEDA)S.C. 2000, c. 5, Part 1 | since |
| Bill C-36, Protecting Privacy and Consumer Data ActBill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session | proposed |
 Chile
cl
9 instruments
| |
| Ley 19.628, sobre Protección de la Vida PrivadaLey 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal) | since |
| Ley 21.719, Agencia de Protección de Datos Personales, SancionesLey 21.719, art. 35 (sanciones) y arts. 42-45 (procedimiento administrativo y judicial) | from , in 4 weeks |
| Ley 21.719, Regula la Protección y el Tratamiento de los Datos PersonalesLey 21.719, Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos) | from , in 4 weeks |
| Ley 21.719, express consent for sensitive personal dataLey 21.719, art. 16 of Ley 19.628 as substituted by Artículo primero (tratamiento de datos personales sensibles) | from , in 4 weeks |
| Ley 21.719, health data and human biological profile dataLey 21.719, art. 16 bis of Ley 19.628 as inserted by Artículo primero (datos personales sensibles relativos a la salud y al perfil biológico humano) | from , in 4 weeks |
| Ley 21.719, international transfers of personal dataLey 21.719, arts. 27 to 29 of Ley 19.628 as substituted by Artículo primero (transferencia internacional de datos) | from , in 4 weeks |
| Ley 21.719, notification of security breaches to the Agencia and to data subjectsLey 21.719, art. 14 sexies of Ley 19.628 as inserted by Artículo primero (deber de reportar las vulneraciones a las medidas de seguridad) | from , in 4 weeks |
| Ley 21.719, right to object to automated individual decisions, including profilingArticle 8 bis of Ley 19.628, as substituted by Artículo primero of Ley 21.719 | from , in 4 weeks |
| Ley 21.719, rights of access, rectification, suppression, opposition, blocking and portabilityLey 21.719, arts. 4 to 11 of Ley 19.628 as substituted by Artículo primero (derechos del titular de datos) | from , in 4 weeks |
 Colombia
co
18 instruments
| |
| SIC Circular on AI, Data Subject RightsSIC Circular Externa 002 de 2024, instrucciones VII, X (Derechos de los Titulares en Sistemas de IA) | since |
| SIC Circular on AI, Demonstrated AccountabilitySIC Circular Externa 002 de 2024, Decreto 1074 de 2015 art. 2.2.2.25.6.1 (Responsabilidad Demostrada) | since |
| Superintendencia Circular on AI and Personal DataSIC Circular Externa 002 de 2024, instrucciones I, II, VIII-IX (Lineamientos sobre Tratamiento de Datos en Sistemas de IA), 21 de agosto de 2024 | since |
| Decreto 1074 de 2015, Binding Corporate Rules for International TransfersDecreto 1074 de 2015, arts. 2.2.2.25.7.1 a 2.2.2.25.7.8 (Normas Corporativas Vinculantes) | since |
| Decreto 1074 de 2015, National Database Registry (Registro Nacional de Bases de Datos)Decreto 1074 de 2015, arts. 2.2.2.26.1.1 a 2.2.2.26.3.4 (Registro Nacional de Bases de Datos) | since |
| Decreto 1074 de 2015, Authorization, Retention and Processing Policy Rules (Ley 1581 Regulations)Decreto 1074 de 2015, arts. 2.2.2.25.1.2, 2.2.2.25.2.1, 2.2.2.25.2.2, 2.2.2.25.2.4, 2.2.2.25.2.5, 2.2.2.25.2.8, 2.2.2.25.3.1 a 2.2.2.25.3.5 (Autorizacion y Politicas de Tratamiento) | since |
| Decreto 1074 de 2015, Demonstrated Accountability Before the SuperintendenciaDecreto 1074 de 2015, arts. 2.2.2.25.6.1 y 2.2.2.25.6.2 (Responsabilidad Demostrada) | since |
| Decreto 1074 de 2015, Exercise of Data Subject RightsDecreto 1074 de 2015, arts. 2.2.2.25.2.6, 2.2.2.25.3.6 y 2.2.2.25.4.1 a 2.2.2.25.4.4 (Ejercicio de los Derechos de los Titulares) | since |
| Decreto 1074 de 2015, International Transfers and Transmissions of Personal DataDecreto 1074 de 2015, arts. 2.2.2.25.5.1 y 2.2.2.25.5.2 (Transferencia y Transmision Internacional de Datos Personales) | since |
| Decreto 1074 de 2015, Sensitive Data and Children's Data RulesDecreto 1074 de 2015, arts. 2.2.2.25.2.3 y 2.2.2.25.2.9 (Datos Sensibles y Datos de Ninos, Ninas y Adolescentes) | since |
| Ley 1581 de 2012, Cross Border Data TransferLey 1581 de 2012, arts. 26-27 (Transferencia a Terceros Paises) | since |
| Ley 1581 de 2012, Data Subject Rights and ProceduresLey 1581 de 2012, arts. 8, 12, 14-16 (Derechos de los Titulares) | since |
| Ley 1581 de 2012, General Personal Data ProtectionLey Estatutaria 1581 de 2012, arts. 1-4, 9-11, 13, 17-18, 25, 28-30 (Objeto, Principios, Autorizacion y Deberes Generales) | since |
| Ley 1581 de 2012, Security Breach Notification to the AuthorityLey 1581 de 2012, arts. 17(n), 18(k) (Notificacion de Violaciones de Seguridad) | since |
| Ley 1581 de 2012, Sensitive Categories and Children's DataLey 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores) | since |
| Ley 1581 de 2012, Supervisory Authority and SanctionsLey 1581 de 2012, arts. 19-24 (Autoridad y Sanciones) | since |
| Ley 1266 de 2008, Habeas Data Rights and Procedures for Credit and Financial Data BanksLey Estatutaria 1266 de 2008, arts. 2, 6 y 16 (Derechos de los Titulares y Peticiones, Consultas y Reclamos) | since |
| Ley 1266 de 2008, Supervision and Sanctions for Credit and Financial Data BanksLey Estatutaria 1266 de 2008, arts. 17 y 18 (Funcion de Vigilancia y Sanciones) | since |
 Costa Rica
cr
2 instruments
| |
| Código Penal, artículo 196 bis, Violación de datos personalesCodigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048 | since |
| Protección de la Persona frente al Tratamiento de sus Datos PersonalesLey No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales | since |
 Cuba
cu
2 instruments
| |
| Ley 149/2022, De Protección de Datos Personales, general regimeLey 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022) | since |
| Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic formResolución 58/2022, Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022) | since |
 Dominican Republic
do
5 instruments
| |
| Ley No. 172-13 sobre Protección Integral de los Datos PersonalesLey No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013, arts. 1-6, 27-28, 42-43, 60 y 63 | since |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, cross border transfer of dataLey No. 172-13, art. 80 (cross border transfer of data) | since |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas dataLey No. 172-13, arts. 7-26, 44, 71 (rights of data subjects and habeas data) | since |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, special and sensitive categories of dataLey No. 172-13, arts. 66, 75-79 (special categories of data) | since |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, supervision, administrative sanctions, and offencesLey No. 172-13, arts. 29, 81-88 (supervision, administrative sanctions, and offences) | since |
 Ecuador
ec
8 instruments
| |
| SPDP Norma General guaranteeing personal-data protection in the use of AI systemsResolución No. SPDP-SPD-2026-0009-R, Superintendencia de Protección de Datos Personales, 12 de febrero de 2026 | since |
| LOPDP, automated decisionsLOPDP, arts. 20-21 (right not to be the object of a decision based on automated processing) | since |
| LOPDP, categorías especiales de datos personalesLOPDP, arts. 25-32 (categorias especiales de datos personales) | since |
| LOPDP, comprehensive personal-data protection regimeLey Orgánica de Protección de Datos Personales (LOPDP), arts. 1-11 y 33-54 (ámbito, principios, seguridad y obligaciones del responsable) | since |
| LOPDP, control, infracciones, sanciones y la AutoridadLOPDP, arts. 61-77 (control, infracciones, sanciones y la Autoridad) | since |
| LOPDP, derechos del titularLOPDP, arts. 12-19, 22-24 (derechos del titular) | since |
| LOPDP, notificación de vulneración de seguridadLOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad) | since |
| LOPDP, transferencia internacional de datos personalesLOPDP, arts. 55-60 (transferencia internacional de datos personales) | since |
 El Salvador
sv
7 instruments
| |
| Ley para la Protección de Datos PersonalesDecreto Legislativo No. 144, 12 de noviembre de 2024, arts. 1-5, 26-36, 40, 46-49 and 60-64 (general provisions, lawful basis and accountability) | since |
| Ley para la Protección de Datos Personales, cross border transfer of personal dataDecreto Legislativo No. 144, arts. 41, 44 and 45 (international transfer of personal data) | since |
| Ley para la Protección de Datos Personales, enforcement and sanctionsDecreto Legislativo No. 144, arts. 35 and 50-59 (enforcement, infractions and sanctions) | since |
| Ley para la Protección de Datos Personales, personal data breach notificationDecreto Legislativo No. 144, art. 25 (personal data breach notification) | since |
| Ley para la Protección de Datos Personales, rights of data subjectsDecreto Legislativo No. 144, arts. 6-24 and 46-48 (ARCO-POL rights) | since |
| Ley para la Protección de Datos Personales, sensitive personal data and childrenDecreto Legislativo No. 144, arts. 4(g), 26, 37, 38, 39 and 42 (sensitive personal data and children) | since |
| Ley de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas, rights of consumers over credit-history dataLey de Regulación de los Servicios de Información sobre el Historial de Crédito de las Personas (Decreto Legislativo No. 695 of 2011), arts. 4(a), 19(h), 20-25 and 28-30 | since |
 Grenada
gd
4 instruments
| |
| Data Protection Act, No. 1 of 2023Data Protection Act, No. 1 of 2023, ss. 1, 3-7, 9-12, 14, 20 and 22-23 (scope, principles, disclosure restriction and exemptions) | from a date not yet set |
| Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offencesData Protection Act, No. 1 of 2023, ss. 24-47 (Information Commission, enforcement, civil remedies and offences) | from a date not yet set |
| Data Protection Act, No. 1 of 2023, rights of data subjectsData Protection Act, No. 1 of 2023, ss. 8, 13 and 15-19 (rights of data subjects) | from a date not yet set |
| Data Protection Act, No. 1 of 2023, sensitive personal dataData Protection Act, No. 1 of 2023, s. 21 (sensitive personal data) | from a date not yet set |
 Guatemala
gt
2 instruments
| |
| Ley de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67 | since |
| Constitución Política de la República de Guatemala, Art. 31 (habeas data)Const. Pol. de la República de Guatemala, art. 31 (acceso a archivos y registros estatales) | since |
| Iniciativa de Ley 6105, Ley de Protección de DatosIniciativa de Ley 6105, Ley de Protección de Datos | proposed |
 Guyana
gy
7 instruments
| |
| Data Protection Act 2023Data Protection Act 2023 (Act No. 18 of 2023), not yet commenced | from a date not yet set |
| Data Protection Act 2023, automated individual decision-making including profilingData Protection Act 2023, s. 19 (automated individual decision-making including profiling) | from a date not yet set |
| Data Protection Act 2023, personal data breach notificationData Protection Act 2023, ss. 65-66 (notification and communication of a personal data breach) | from a date not yet set |
| Data Protection Act 2023, rights of data subjects and information to be providedData Protection Act 2023, ss. 11-18 and 20-22 (rights of data subjects) | from a date not yet set |
| Data Protection Act 2023, sensitive personal data and children's consentData Protection Act 2023, ss. 8-9 (child's consent and sensitive personal data) | from a date not yet set |
| Data Protection Act 2023, the Commissioner, enforcement and offencesData Protection Act 2023, ss. 4(10), 72-73, 78-85 and 97-99 (the Commissioner, enforcement, compensation and penalties) | from a date not yet set |
| Data Protection Act 2023, transfers of personal data outside GuyanaData Protection Act 2023, ss. 23-30 (transfers outside Guyana) | from a date not yet set |
 Honduras
hn
3 instruments
| |
| Código Penal, acceso no autorizado a datos personales (descubrimiento y revelación de secretos)Decreto No. 130-2017, Código Penal, art. 272 (Descubrimiento y Revelación de Secretos) | since |
| Constitución de la República de Honduras, garantía de Hábeas DataConstitución de la República de Honduras (1982, reformada), art. 182 (Hábeas Data) | since |
| Ley de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas dataDecreto No. 170-2006, Ley de Transparencia y Acceso a la Información Pública, arts. 3(7), 23-29 (Datos Personales y Hábeas Data) | since |
 Jamaica
jm
7 instruments
| |
| Data Protection Act, 2020, automated decision-takingData Protection Act, 2020 (Act 7 of 2020), ss. 6(2)(d) and 12 (automated decision-taking) | since |
| Data Protection Act, 2020, conditions for processing sensitive personal dataData Protection Act, 2020 (Act 7 of 2020), ss. 2(1), 24 | since |
| Data Protection Act, 2020, registration, lawful basis and standards for processingData Protection Act, 2020 (Act 7 of 2020), ss. 3, 14-20, 21(1), 22, 23, 25-30, 45 | since |
| Data Protection Act, 2020, reporting a contravention or security breachData Protection Act, 2020 (Act 7 of 2020), ss. 21(2)-(5), 30(1)(b), (4)-(5) | since |
| Data Protection Act, 2020, rights of data subjectsData Protection Act, 2020 (Act 7 of 2020), ss. 5-11 and 13 | since |
| Data Protection Act, 2020, the Information Commissioner, penalties and compensationData Protection Act, 2020 (Act 7 of 2020), ss. 4, 44, 46-55, 61, 62, 67-69 | since |
| Data Protection Act, 2020, transfer of personal data outside JamaicaData Protection Act, 2020 (Act 7 of 2020), s. 31 (the eighth standard) | since |
 Mexico
mx
11 instruments
| |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025, arts. 1-7, 9-18, 20 and 37 (scope, principles, consent, notice, security and confidentiality, self-regulation) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rightsLFPDPPP, arts. 21-34 (ARCO rights and their exercise) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, automated decisionsLFPDPPP, art. 26, fracción II (automated individual decisions) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, enforcement, sanctions and offencesLFPDPPP, arts. 38-64 (Secretaría, rights-protection procedure, verification, sanctions and offences) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach noticeLFPDPPP, art. 19 (security-breach notice) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal dataLFPDPPP, arts. 2(VI), 8 and 12 (sensitive personal data) | since |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal dataLFPDPPP, arts. 35-36 (transfer of personal data) | since |
| Ley para Regular las Instituciones de Tecnología Financiera, open finance interfacesLRITF, art. 76 (open finance interfaces) | in force |
| Ley para Regular las Sociedades de Información Crediticia, authorization to operateLRSIC, art. 6 (authorization to operate) | in force |
| Ley para Regular las Sociedades de Información Crediticia, signed authorization for disclosureLRSIC, art. 28 (signed authorization for disclosure) | in force |
| Ley para Regular las Sociedades de Información Crediticia, special credit report and claimsLRSIC, arts. 40-42 (special credit report and claims) | in force |
 Nicaragua
ni
6 instruments
| |
| Ley No. 787, Ley de Protección de Datos PersonalesLey No. 787, 29-Mar-2012, Gaceta Oficial No. 61, arts. 1-6, 9, 11-13, 19, 22-24, 27 | since |
| Ley No. 787, Ley de Protección de Datos Personales, cross border transfer of dataLey No. 787, arts. 14-15 (cross border transfer of data) | since |
| Ley No. 787, Ley de Protección de Datos Personales, rights of data subjectsLey No. 787, arts. 7, 10, 16-21, 25-26 (rights of data subjects) | since |
| Ley No. 787, Ley de Protección de Datos Personales, security incident noticeLey No. 787, art. 11 (security incident notice to the affected institution) | since |
| Ley No. 787, Ley de Protección de Datos Personales, sensitive categories of dataLey No. 787, arts. 3(g), 7(l), 8 (sensitive categories of data) | since |
| Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaintsLey No. 787, arts. 28-29, 34-35, 44-52 (supervision, sanctions, and complaints) | since |
 Panama
pa
7 instruments
| |
| Ley 81 de 2019, Sobre Protección de Datos PersonalesLey No. 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A, arts. 1-4, 6-12, 14, 24-32, 44 and 47 (general provisions, lawful basis and accountability) | since |
| Ley 81 de 2019, automated decisionsLey 81 de 2019, art. 19 (automated individual decisions) | since |
| Ley 81 de 2019, cross border transfer of personal dataLey 81 de 2019, arts. 5 and 33 (cross border transfer of personal data) | since |
| Ley 81 de 2019, enforcement and sanctionsLey 81 de 2019, arts. 34-37 and 38-46 (enforcement, sanctions and offences) | since |
| Ley 81 de 2019, personal data breach notificationLey 81 de 2019, arts. 2(5) and 26 (duty to notify security breaches) | since |
| Ley 81 de 2019, rights of data subjectsLey 81 de 2019, arts. 15-18 and 21-23 (rights of data subjects) | since |
| Ley 81 de 2019, sensitive personal dataLey 81 de 2019, arts. 4(11), 8, 13 and 20 (sensitive personal data) | since |
 Paraguay
py
8 instruments
| |
| Ley N° 6534/2020, de Protección de Datos Personales CrediticiosLey N° 6534, del año 2020, de Protección de Datos Personales Crediticios | since |
| Ley N° 7593/2025, automated or semi-automated individual decisionsLey 7593/2025, art. 33 (automated or semi-automated individual decisions) | from , in 13 months |
| Ley N° 7593/2025, de Protección de Datos Personales en la República del ParaguayLey N° 7593/2025, arts. 1-16, 18 y 24-25 (ámbito, principios, seguridad y obligaciones del responsable) | from , in 13 months |
| Ley N° 7593/2025, derechos del titular de datosLey 7593/2025, arts. 26-32 (derechos del titular de datos) | from , in 13 months |
| Ley N° 7593/2025, la Agencia Nacional, faltas y sancionesLey 7593/2025, arts. 34-56 (la Agencia Nacional, faltas y sanciones) | from , in 13 months |
| Ley N° 7593/2025, notificación de un incidente de seguridadLey 7593/2025, art. 17 (notificacion de un incidente de seguridad) | from , in 13 months |
| Ley N° 7593/2025, transferencias internacionales de datos personalesLey 7593/2025, art. 19 (transferencias internacionales de datos personales) | from , in 13 months |
| Ley N° 7593/2025, tratamiento de datos sensibles y categorías especialesLey 7593/2025, arts. 20-23 (datos sensibles, crediticios, videovigilancia y penales) | from , in 13 months |
 Peru
pe
12 instruments
| |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), consent, data protection officer and registration of data banksReglamento Ley 29733 (DS 016-2024-JUS) consent, data protection officer and registration, arts. 2-7, 9-10, 37, 42 and first final provision | since |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), cross-border flow of personal dataReglamento Ley 29733 (DS 016-2024-JUS) cross-border flow, arts. 18-21 | since |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), enforcement measures, coercive fines and infractionsReglamento Ley 29733 (DS 016-2024-JUS) enforcement and sanctions, arts. 121-122, 124, 129-134 | since |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), exercise of data subject rightsReglamento Ley 29733 (DS 016-2024-JUS) data subject rights, arts. 68-69, 71, 73, 75-76, 82-83, 86-87 | since |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), security incidents and access recordsDecreto Supremo No. 016-2024-JUS, Reglamento de la Ley No. 29733, Ley de Protección de Datos Personales, arts. 34-36 and 46 (security-incident notice and documentation; records of interactions with personal data) | since |
| Reglamento de la Ley 29733 (Decreto Supremo 016-2024-JUS), sensitive data and the data of children and adolescentsReglamento Ley 29733 (DS 016-2024-JUS) sensitive data and children, arts. 8, 22-23, 25 | since |
| Ley 29733, Ley de Protección de Datos PersonalesLey No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations) | since |
| Ley 29733, cross-border transfer of personal dataLey No. 29733, arts. 11, 15 (cross-border transfer) | since |
| Ley 29733, enforcement, supervisory authority and sanctionsLey No. 29733, arts. 32-40 and Disposición complementaria final sexta (enforcement, supervisory authority and sanctions) | since |
| Ley 29733, right to objective processingLey No. 29733, art. 23 (automated individual decisions) | since |
| Ley 29733, rights of the data subjectLey No. 29733, arts. 18-22 and 24-27 (rights of the data subject) | since |
| Ley 29733, sensitive personal data and minorsLey No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) | since |
 Saint Kitts and Nevis
kn
4 instruments
| |
| Data Protection Act, 2018Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018), ss. 1-12, 19 and 21-22 | from a date not yet set |
| Data Protection Act, 2018, Information Commissioner, enforcement and offencesData Protection Act, 2018, ss. 23-38 (Information Commissioner, enforcement and offences) | from a date not yet set |
| Data Protection Act, 2018, processing of sensitive personal dataData Protection Act, 2018, s. 20 (processing of sensitive personal data) | from a date not yet set |
| Data Protection Act, 2018, rights of data subjectsData Protection Act, 2018, ss. 13-18 (rights of data subjects) | from a date not yet set |
 Saint Lucia
lc
5 instruments
| |
| Data Protection ActAct 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-34 and 39-43, Part 6 (ss. 58-68) and Schedule 2 | since |
| Data Protection Act, sensitive personal dataAct 11 of 2011, ss. 35-38 (sensitive personal data) | since |
| Data Protection Act, Commissioner, offences and penaltiesAct 11 of 2011, ss. 5-31 and 69-74 (Commissioner, offences and penalties) | from a date not yet set |
| Data Protection Act, rights of data subjects and othersAct 11 of 2011, ss. 52-57A (rights of data subjects) | from a date not yet set |
| Data Protection Act, transfer of personal dataAct 11 of 2011, s. 45 (transfer of personal data) | from a date not yet set |
 Suriname
sr
0 instruments
| |
| Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens)Wet Bescherming Privacy en Persoonsgegevens, arts. 1-6, 12, 14-19, 21 (general obligations) | proposed |
| Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and finesArts. 23-42 Wet Bescherming Privacy en Persoonsgegevens | proposed |
| Draft Law on the Protection of Privacy and Personal Data, automated decisionsArt. 11, lid 2 Wet Bescherming Privacy en Persoonsgegevens (automated individual decisions) | proposed |
| Draft Law on the Protection of Privacy and Personal Data, breach notificationArt. 20 Wet Bescherming Privacy en Persoonsgegevens | proposed |
| Draft Law on the Protection of Privacy and Personal Data, cross border transferArt. 22 Wet Bescherming Privacy en Persoonsgegevens | proposed |
| Draft Law on the Protection of Privacy and Personal Data, rights of the data subjectArts. 10-11 Wet Bescherming Privacy en Persoonsgegevens | proposed |
| Draft Law on the Protection of Privacy and Personal Data, special categories, children and criminal dataArts. 7-9 Wet Bescherming Privacy en Persoonsgegevens | proposed |
 Trinidad and Tobago
tt
5 instruments
| |
| Data Protection Act, 2011Act No. 13 of 2011 (Data Protection Act), Chap. 22:04, ss. 1-6, excluding paragraphs (h) and (l) of section 6 | since |
| Data Protection Act, 2011, Commissioner, contravention and enforcementAct 13 of 2011, ss. 7-28 and 87-96 (Commissioner, contravention and enforcement) | since |
| Data Protection Act, 2011, cross border disclosure of personal informationAct 13 of 2011, ss. 6(l), 46 and 72 (cross border disclosure) | since |
| Data Protection Act, 2011, sensitive personal informationAct 13 of 2011, ss. 6(h), 40 and 76 (sensitive personal information) | since |
| Data Protection Act, 2011, rights of access and correctionAct 13 of 2011, ss. 52-59 and 75-85 (rights of access and correction) | from a date not yet set |
 United States
us
24 instruments
| |
| Homebuyers Privacy Protection Act, limit on furnishing consumer reports after a mortgage report requestPub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) | since |
| Regulation S-P: incident response program and customer breach notice17 CFR 248.30(a)(3) to (a)(5) | since |
| DOJ Data Security Program (Bulk Sensitive Personal Data Rule)28 CFR Part 202 | since |
| Protecting Americans' Data from Foreign Adversaries Act of 2024 (PADFAA)Protecting Americans' Data from Foreign Adversaries Act of 2024, 15 U.S.C. 9901 | since |
| GLBA Safeguards Rule Breach Notification Amendment16 CFR Section 314.4(j) | since |
| Confidentiality of Substance Use Disorder Patient Records42 CFR Part 2, as amended by the 2024 final rule (89 FR 12472) | since |
| 21st Century Cures Act information blocking, interference with access, exchange or use of electronic health information42 U.S.C. 300jj-52; 45 CFR Part 171 | since |
| Stored Communications Act, required preservation and disclosure of data held anywhere, and the provider's motion to quash (CLOUD Act)18 U.S.C. 2713 and 2703(h) | since |
| CFTC identity theft red flags rule17 CFR 162.30 | since |
| Regulation S-ID: identity theft red flags program (SEC)17 CFR 248.201 | since |
| Regulation P: limits on disclosure to nonaffiliated third parties and the opt out12 CFR 1016.7 and 1016.10 to 1016.15 | since |
| Regulation P: privacy notices to customers and consumers12 CFR 1016.4 to 1016.6, 1016.8 and 1016.9 | since |
| FTC Health Breach Notification Rule16 CFR Part 318 | since |
| HIPAA Breach Notification Rule45 CFR Part 164, Subpart D (Sections 164.400-164.414) | since |
| HIPAA Privacy Rule45 CFR Part 164, Subpart E (Sections 164.500-164.534) | since |
| Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments16 CFR Part 312, as amended effective | since |
| Driver's Privacy Protection Act18 U.S.C. 2721 to 2725 | since |
| Video Privacy Protection Act18 U.S.C. Section 2710 | since |
| Stored Communications Act, order barring a provider from notifying anyone of a warrant, subpoena or order18 U.S.C. 2705(b) | since |
| Family Educational Rights and Privacy Act (FERPA), disclosure of education records to contractors and redisclosure limits20 U.S.C. 1232g(b); 34 CFR 99.31(a)(1)(i)(B), 99.33 | since |
| FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)15 U.S.C. Section 45 | since |
| FCC CPNI breach notification rule47 CFR 64.2011 | in force |
| Fair Credit Reporting Act, consumer reporting agency, user and furnisher duties15 U.S.C. 1681 et seq. | in force |
| Stored Communications Act, provider disclosure of customer communications and records18 U.S.C. 2702-2703 | in force |
| CFPB Personal Financial Data Rights rule (open banking), data provider access duties and third party obligations12 CFR Part 1033 | blocked by a court |
| Management of Individuals' Neural Data Act of 2025 (MIND Act)S. 2925, 119th Congress | proposed |
 Uruguay
uy
10 instruments
| |
| Ley N° 18.331, biometric dataLey N° 18.331, arts. 4 (literal Ñ) y 18-BIS, según Ley N° 19.924, de 18 de diciembre de 2020 (datos biométricos) | since |
| Decreto N° 64/020, personal data breach communicationDecreto N° 64/020, de 17 de febrero de 2020, art. 4 (comunicación de vulneraciones de seguridad) | since |
| Ley N° 19.670, accountability, extraterritorial scope and data-protection officerLey N° 19.670, de 15 de octubre de 2018, arts. 37, 39 y 40 (Ley N° 18.331, art. 12) | since |
| Ley N° 19.670, personal data breach notificationLey N° 19.670, de 15 de octubre de 2018, art. 38, reglamentado por Decreto N° 64/020, de 2020 (notificación de vulneración de seguridad) | since |
| Ley N° 18.331, automated decisionsLey N° 18.331, art. 16, según Ley N° 18.719, de 2010 (automated individual decisions) | since |
| Ley N° 18.331, Personal Data Protection and Habeas Data LawLey N° 18.331, de 11 de agosto de 2008, arts. 9-11, 17, 20, 22, 24 y 29 | since |
| Ley N° 18.331, cross border transfer of personal dataLey N° 18.331, art. 23 (transferencia internacional de datos personales) | since |
| Ley N° 18.331, sensitive personal data and health dataLey N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud) | since |
| Ley N° 18.331, enforcement, sanctions and habeas dataLey N° 18.331, arts. 31-36 y 37-45 (órgano de control, potestades sancionatorias y acción de habeas data) | in force |
| Ley N° 18.331, rights of data subjectsLey N° 18.331, arts. 13-15 y 21, según Ley N° 20.075, de 2022, y Ley N° 18.719, de 2010 (derechos de los titulares de los datos) | in force |
 Venezuela
ve
2 instruments
| |
| Ley Especial contra los Delitos Informáticos, privacy of personal data and communications (Arts. 20-22)LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 20-22 | since |
| Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)Constitución de la República Bolivariana de Venezuela, Gaceta Oficial Extraordinaria N° 36.860, 30 de diciembre de 1999, arts. 28 y 60 | since |
| Asia | |
 Afghanistan
af
1 instrument
| |
| Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38 | since |
 Armenia
am
6 instruments
| |
| Law on Protection of Personal Data, biometric data provisionsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 3(13), 13, 19(6), 23(3) | since |
| Law on Protection of Personal Data, comprehensive regimeLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N (2015), Arts. 1, 3-8 | since |
| Law on Protection of Personal Data, cross-border transferLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 27 | since |
| Law on Protection of Personal Data, data subject rightsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 15-17 | since |
| Law on Protection of Personal Data, enforcementLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 24 | since |
| Law on Protection of Personal Data, special category dataLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 12 | since |
 Azerbaijan
az
7 instruments
| |
| Law on Personal Data, biometric data enumeration and general processing conditionsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5 | since |
| Law on Personal Data, comprehensive regime and lawful basisLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ (, as amended through 2023), Arts. 1-2, 8-13 | since |
| Law on Personal Data, cross-border transferLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14 | since |
| Law on Personal Data, data subject rightsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7 | since |
| Law on Personal Data, enforcement and liabilityLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 | since |
| Law on Personal Data, purpose limitation, data minimization and retention principlesArts. 9.1 to 9.4 and 11.1, Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ | since |
| Law on Personal Data, special categories of personal dataLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7 | since |
 Bahrain
bh
6 instruments
| |
| Personal Data Protection Law, biometric data prior authorisationLaw No. 30 of 2018, Art. 15 | since |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 30 of 2018, Arts. 4-9 | since |
| Personal Data Protection Law, cross-border transferLaw No. 30 of 2018, Arts. 12-13 | since |
| Personal Data Protection Law, data subject rightsLaw No. 30 of 2018, Arts. 17-23 | since |
| Personal Data Protection Law, enforcement and penaltiesLaw No. 30 of 2018, Arts. 55, 57-60 | since |
| Personal Data Protection Law, sensitive personal dataLaw No. 30 of 2018, Arts. 1, 5 | since |
 Bangladesh
bd
7 instruments
| |
| Personal Data Protection Act, 2026, breach notification dutiesPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.20 | since |
| Personal Data Protection Act, 2026, children's personal dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.9 | since |
| Personal Data Protection Act, 2026, comprehensive regime and lawful basisPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 | since |
| Personal Data Protection Act, 2026, cross-border transfer of personal dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 | since |
| Personal Data Protection Act, 2026, data principal rights of access, correction, withdrawal and erasurePersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.10-14 | since |
| Personal Data Protection Act, 2026, sensitive personal data and biometric dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 | since |
| Personal Data Protection Act, 2026, complaints, penalties and appealsPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 | from a date not yet set |
 Bhutan
bt
5 instruments
| |
| Cybersecurity Code of Practice for ICT/Telecommunications Service Providers, privacy and PII dutyCybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of Bhutan 2018, s.58), s.8.6 | since |
| Information, Communications and Media Act of Bhutan 2018, data protection and privacy dutiesInformation, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 | since |
| Information, Communications and Media Act of Bhutan 2018, offences and compensation for data failuresInformation, Communications and Media Act of Bhutan 2018, ss.387-388 | since |
| Information, Communications and Media Act of Bhutan 2018, privacy policy disclosures on review and removal, and removal on requestInformation, Communications and Media Act of Bhutan 2018, ss.338(3), 340 | since |
| Information, Communications and Media Act of Bhutan 2018, sensitive personal data and biometric informationInformation, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) | since |
 Brunei Darussalam
bn
5 instruments
| |
| Personal Data Protection Order 2025, breach notificationPersonal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29) | since |
| Personal Data Protection Order 2025, comprehensive regimePersonal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8 | since |
| Personal Data Protection Order 2025, cross-border transferPersonal Data Protection Order, 2025 (S 1/2025), s.24 | since |
| Personal Data Protection Order 2025, data-subject rightsPersonal Data Protection Order, 2025 (S 1/2025), ss.18-20 | since |
| Personal Data Protection Order 2025, enforcement and penaltiesPersonal Data Protection Order, 2025 (S 1/2025), ss.37, 59 | since |
 Cambodia
kh
0 instruments
| |
| Cambodia's Draft Law on Personal Data Protection, automated decisionsDraft Law on Personal Data Protection, article 34 (automated individual decision-making, including profiling) | proposed |
| Cambodia's Draft Law on Personal Data Protection, cross-border data transferDraft Law on Personal Data Protection, article 23 (data transfer outside Cambodia) | proposed |
| Cambodia's Draft Law on Personal Data Protection, enforcement and penaltiesDraft Law on Personal Data Protection, chapters 2, 8-10 (competent institution, inspection, dispute resolution and penalties) | proposed |
| Cambodia's Draft Law on Personal Data Protection, personal data breach notificationDraft Law on Personal Data Protection, articles 21-22 (personal data breach notification) | proposed |
| Cambodia's Draft Law on Personal Data Protection, rights of data subjectsDraft Law on Personal Data Protection, articles 26-33 (rights of data subjects) | proposed |
| Cambodia's Draft Law on Personal Data Protection, sensitive personal dataDraft Law on Personal Data Protection, article 14 (sensitive personal data) | proposed |
| Draft Law on Personal Data Protection, final draftDraft Law on Personal Data Protection (Final Draft, ), articles 1-13, 15-20, 24-25 and 37-39 (general provisions, principles and lawful basis, controller and processor obligations, security of processing, data protection officer, and guidelines) | proposed |
 China
cn
11 instruments
| |
| Provisions on Security Management of Facial Recognition Technology Application人脸识别技术应用安全管理办法, issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed , effective | since |
| Provisions on Promoting and Regulating Cross-Border Data Flows促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective | since |
| Personal Information Protection Law of the PRC, General Processing Rules and Lawful BasesPIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, ; effective | since |
| Personal Information Protection Law, Anonymization, De-identification and Security MeasuresPIPL Arts. 4, 51 and 73 | since |
| Personal Information Protection Law, Cross-Border TransferPIPL Arts. 38-40 | since |
| Personal Information Protection Law, Data Breach NotificationPIPL Art. 57 | since |
| Personal Information Protection Law, Individual RightsPIPL Arts. 44-50 | since |
| Personal Information Protection Law, Sensitive Personal InformationPIPL Arts. 28-32 | since |
| Personal Information Protection Law, Supervision and Legal LiabilityPIPL Arts. 60-71 | since |
| Personal Information Protection Law, automated decisionsPIPL Art. 24, Art. 55(2) and Art. 56 (automated decision-making) | since |
| Personal Information Protection Law, compliance audit of personal information handlingPIPL Art. 54; CAC Order No. 18 (Measures for the Administration of Personal Information Protection Compliance Audits), Arts. 3-4, 6, 12 | since |
 Georgia
ge
8 instruments
| |
| Law on Personal Data Protection, biometric data articleLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d) | since |
| Law on Personal Data Protection, breach notificationLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 () | since |
| Law on Personal Data Protection, comprehensive regime and lawful basisLaw of Georgia on Personal Data Protection, Law No. 3144-XI, adopted , Arts. 1-5, 7-8 | since |
| Law on Personal Data Protection, cross-border transferLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 37-38, as amended by Law No. 1289 () | since |
| Law on Personal Data Protection, data subject rightsLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 13-22) and Art. 23 | since |
| Law on Personal Data Protection, enforcement and penaltiesLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79 | since |
| Law on Personal Data Protection, special categories of dataLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 6 | since |
| Criminal Code of Georgia, disclosure of information on private life or of personal dataCriminal Code of Georgia, Law No. 2287 of , Art. 157 | since |
 India
in
6 instruments
| |
| Digital Personal Data Protection Act, 2023, Data Protection Board and penaltiesDigital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 | since |
| Digital Personal Data Protection Rules, 2025G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified | since |
| Digital Personal Data Protection Act, 2023, breach notification dutiesDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6) | from , in 6 months |
| Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basisDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8 | from , in 6 months |
| Digital Personal Data Protection Act, 2023, cross-border transfer restrictionsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16 | from , in 6 months |
| Digital Personal Data Protection Act, 2023, data subject rightsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14 | from , in 6 months |
 Indonesia
id
8 instruments
| |
| Law on Personal Data Protection, biometric data definitionLaw No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation | since |
| Law on Personal Data Protection, breach notificationLaw No. 27 of 2022 on Personal Data Protection, Article 46 | since |
| Law on Personal Data Protection, comprehensive regimeLaw No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated | since |
| Law on Personal Data Protection, cross-border transferLaw No. 27 of 2022 on Personal Data Protection, Article 56 | since |
| Law on Personal Data Protection, enforcement and private right to sueLaw No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 | since |
| Implementing Regulation on Personal Data Protection, administrative sanctionsGovernment Regulation No. 33 of 2026, Article 184 | from a date not yet set |
| Implementing Regulation on Personal Data Protection, breach notificationGovernment Regulation No. 33 of 2026, Article 114 | from a date not yet set |
| Implementing Regulation on Personal Data Protection, cross-border transferGovernment Regulation No. 33 of 2026, Article 165 | from a date not yet set |
 Iran
ir
1 instrument
| |
| Electronic Commerce Law (2003), Personal Data ChapterElectronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter) | in force |
 Iraq
iq
1 instrument
| |
| CMC Framework Regulations for Digital Platforms and Services, data protection and localization conditionsCommunications and Media Commission, Framework Regulations for Digital Platforms and Services, Annex 2 () | since |
 Israel
il
7 instruments
| |
| Protection of Privacy Law, biometric identifier definition and security-level tieringProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions | since |
| Protection of Privacy Law, comprehensive regime and database registrationProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A | since |
| Protection of Privacy Law, enforcement, DPO duty and private rights of actionProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Arts. 15A, 17B1-17B3, 29A, 31B, Chapters D3-D4 | since |
| Privacy Protection Regulations (Data Security), access-monitoring records and their retentionData Security Regulations, 5777-2017 (Privacy Protection), Regs. 10 and 17(a) | since |
| Protection of Privacy Law, breach notification dutyPrivacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21) | since |
| Privacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transferPrivacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 | in force |
| Protection of Privacy Law, data subject rightsProtection of Privacy Law, 5741-1981, Arts. 13, 13A, 14 | in force |
 Japan
jp
12 instruments
| |
| Act on the Protection of Personal Information, breach notificationAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26 | since |
| Act on the Protection of Personal Information, comprehensive regime and lawful basisAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 17, 20, 21, 25 | since |
| Act on the Protection of Personal Information, cross-border transferAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28 | since |
| Act on the Protection of Personal Information, enforcementAct No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII | since |
| Act on the Protection of Personal Information, individual identification code and biometric provisionsAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 | since |
| Act on the Protection of Personal Information, pseudonymized and anonymized personal informationAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 41-46 | since |
| Act on the Protection of Personal Information, records of provision to and receipt from third partiesAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 29, 30 | since |
| Act on the Protection of Personal Information, Specific Biometric Personal InformationAct No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 16(5), 21-2, 27(2), 35(7)-(8) | from a date not yet set |
| Act on the Protection of Personal Information, administrative surcharge orderAct No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 148-3 to 148-17 | from a date not yet set |
| Act on the Protection of Personal Information, contact particulars in pseudonymized and anonymized informationAct No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 42(4), 46-2 | from a date not yet set |
| Act on the Protection of Personal Information, personal information of persons under 16Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 40-2, 35(9)-(10) | from a date not yet set |
| Act on the Protection of Personal Information, statistics-creation consent exemptionAct No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 30-2, 31-3 | from a date not yet set |
 Jordan
jo
6 instruments
| |
| Personal Data Protection Law, breach notificationLaw No. 24 of 2023, Art. 20 | since |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 24 of 2023, Arts. 1-2, 11 | since |
| Personal Data Protection Law, cross-border transferLaw No. 24 of 2023, Art. 14 | since |
| Personal Data Protection Law, data subject rightsLaw No. 24 of 2023, data subject rights list | since |
| Personal Data Protection Law, enforcement and data subject remediesLaw No. 24 of 2023, Arts. 21-22 | since |
| Personal Data Protection Law, sensitive personal data and biometric dataLaw No. 24 of 2023, Art. 2 definitions | since |
 Kazakhstan
kz
9 instruments
| |
| Digital Code, rights to deletion, anonymization and restriction of personal dataDigital Code No. 255-VIII (), Arts. 37(4)-(6), 41 | since |
| Code of Administrative Offences, personal data violationsCode of the Republic of Kazakhstan on Administrative Offences No. 235-V (2014), Art. 79 | since |
| Criminal Code, offences against private life and personal dataCriminal Code of the Republic of Kazakhstan No. 226-V (), Art. 147 | since |
| Law on Personal Data and Their Protection, biometric data provisionsLaw No. 94-V (), Arts. 6, 7(12), 11(3), 12(2) | since |
| Law on Personal Data and Their Protection, breach notificationLaw No. 94-V (), Art. 25(2) | since |
| Law on Personal Data and Their Protection, comprehensive regime and lawful basesLaw No. 94-V (), as amended through Law No. 350-VIII (14.07.2026), Arts. 1, 4-9, 10-1 | since |
| Law on Personal Data and Their Protection, data subject rightsLaw No. 94-V (), Art. 24; Art. 8(7); Art. 19-1 | since |
| Law on Personal Data and Their Protection, localization and cross-border transferLaw No. 94-V (), Arts. 12(2), 16 | since |
| Law on Personal Data and Their Protection, protection duties of owners and operatorsLaw No. 94-V (), Art. 22 | since |
 Kuwait
kw
5 instruments
| |
| CITRA Data Privacy Protection RegulationCITRA Decision No. 26 of 2024 (repealing Decision No. 42 of 2021) | in force |
| CITRA Data Privacy Protection Regulation, personal data breach notificationCITRA Decision No. 26 of 2024, regulation Article 4(15), Article 5(12) and Article 6 (breach notification) | in force |
| CITRA Data Privacy Protection Regulation, records, reporting to CITRA and compliance periodCITRA Decision No. 26 of 2024, regulation Article 4(5), Article 5(4)-(5) and Article 7 (records, reporting to CITRA and compliance) | in force |
| CITRA Data Privacy Protection Regulation, storage location and transfers outside KuwaitCITRA Decision No. 26 of 2024, regulation Article 4(7) and (9) (storage location and transfer outside Kuwait) | in force |
| CITRA Data Privacy Protection Regulation, user rights and consent controlsCITRA Decision No. 26 of 2024, regulation Article 4(6), (8), (10), (12), (13) and Article 5(9) (user rights) | in force |
 Kyrgyzstan
kg
6 instruments
| |
| Digital Code, comprehensive personal data regimeDigital Code, Law No. 178 (), in force , Chapter 11, Arts. 78, 88 | since |
| Digital Code, cross-border transfer of personal dataDigital Code, Law No. 178, Art. 89 | since |
| Digital Code, processing of children's personal dataDigital Code, Law No. 178, Art. 81 | since |
| Digital Code, sectoral regulator for personal dataDigital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data) | since |
| Digital Code, special categories of personal dataDigital Code, Law No. 178, Art. 80 | since |
| Code on Offenses, administrative fines for personal data breachesCode of the Kyrgyz Republic on Offenses of No. 128, Art. 228-11, as added by Law 150 of | from a date not yet set |
 Lebanon
lb
5 instruments
| |
| Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)Law No. 81, Official Gazette of Lebanon, promulgated (in force ), Arts. 85, 87, 90, 93 to 98 and 103 to 105 (Part V, Personal Data Protection), with the definitions in Article One and the provider retention duties in Arts. 72 and 74 | since |
| Law No. 81/2018, Part V, health, genetic identity and sexual-life dataLaw No. 81/2018, Arts. 91 and 97(3) (health, genetic identity and sexual-life data) | since |
| Law No. 81/2018, Part V, notice, objection, access and correctionLaw No. 81/2018, Arts. 86, 88, 89, 92, 99 to 101, 103, 105 and 32 (notice, objection, access and correction) | since |
| Law No. 81/2018, Part V, penal provisions and supervisionLaw No. 81/2018, Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98 | since |
| Law No. 81/2018, Part V, transfer of personal data to another StateLaw No. 81/2018, Arts. 96(12) and 98(8) (transfer of personal data to another State) | since |
 Malaysia
my
8 instruments
| |
| Personal Data Protection Act, data portabilityAct 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force | since |
| Personal Data Protection Act, data protection officer and breach notificationAct 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force | since |
| Personal Data Protection Act, biometric data definition and sensitive categoryAct 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force | since |
| Personal Data Protection Act, cross-border transferAct 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force | since |
| Personal Data Protection Act, comprehensive regime and lawful basesAct 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727 | since |
| Personal Data Protection Act, data access requestPersonal Data Protection Act 2010 (Act 709), ss. 30 and 31 | since |
| Personal Data Protection Act, enforcementAct 709 (Malaysia) ss.5(2), 12B(3) | since |
| Personal Data Protection Act, processing of sensitive personal dataPersonal Data Protection Act 2010 (Act 709), s. 40 | since |
 Maldives
mv
0 instruments
| |
| Maldives Personal Data Protection Bill, cross-border transfersPersonal Data Protection Bill, chapters 7-8 (personal data transfers and cross-border transfers) | proposed |
| Maldives Personal Data Protection Bill, investigation, enforcement and compensationPersonal Data Protection Bill, chapter 9 and sections 52-55 (investigation, enforcement and compensation) | proposed |
| Maldives Personal Data Protection Bill, personal data breach notificationPersonal Data Protection Bill, section 34 (personal data breach notification) | proposed |
| Maldives Personal Data Protection Bill, rights of data subjectsPersonal Data Protection Bill, chapter 4 (rights of data subjects) | proposed |
| Maldives Personal Data Protection Bill, special categories of personal dataPersonal Data Protection Bill, section 17 and the section 56 definition (special categories of personal data) | proposed |
| Personal Data Protection Bill, pending before the People's MajlisPersonal Data Protection Bill, chapters 1-3, 5 and 10 (introduction, the Authority, principles, security and miscellaneous provisions) | proposed |
 Mongolia
mn
9 instruments
| |
| Law on Protection of Personal Data, biometric information definition and legacy fingerprint destructionLaw on Protection of Personal Data (), Art. 4.1.1; Art. 31 | since |
| Law on Protection of Personal Data, breach notificationLaw on Protection of Personal Data (), Art. 22; Art. 25.1.3; Art. 10.5 | since |
| Law on Protection of Personal Data, comprehensive regimeLaw on Protection of Personal Data (), in force , Arts. 1-4 | since |
| Law on Protection of Personal Data, cross-border transferLaw on Protection of Personal Data (), Art. 14 | since |
| Law on Protection of Personal Data, data subject rightsLaw on Protection of Personal Data (), Art. 16; Art. 15 | since |
| Law on Protection of Personal Data, decisions made without human involvementLaw on Protection of Personal Data (), Art. 18.2.6 (decisions made without human involvement) | since |
| Law on Protection of Personal Data, enforcementLaw on Protection of Personal Data (), Arts. 24-26, 28, 30 | since |
| Law on Protection of Personal Data, proof of consent, record of processing and assessmentsLaw on Protection of Personal Data (), Arts. 8.9, 18.2.12, 18.2.13, 23.1-23.2 | since |
| Law on Protection of Personal Data, sensitive personal informationLaw on Protection of Personal Data (), Arts. 4.1.12, 9 | since |
 Myanmar
mm
1 instrument
| |
| Cybersecurity Law, digital platform data retention and disclosure dutyCybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34 | since |
 Nepal
np
4 instruments
| |
| Privacy Act, 2075, correction rightPrivacy Act, 2075 (2018), Act Number 14 of 2075, s.28 | since |
| Privacy Act, 2075, enforcement and compensationPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32 | since |
| Privacy Act, 2075, general privacy and collection regimePrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1) | since |
| Privacy Act, 2075, sensitive information and biometric dataPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27 | since |
 Oman
om
7 instruments
| |
| Personal Data Protection Law, biometric and sensitive data prior permitRoyal Decree No. 6/2022, Arts. 1, 5, 5 bis, as amended by Royal Decree No. 68/2026 | since |
| Personal Data Protection Law, breach notificationRoyal Decree No. 6/2022, Art. 19, breach notification provision | since |
| Personal Data Protection Law, cross-border transferRoyal Decree No. 6/2022, Art. 23 | since |
| Personal Data Protection Law, data subject rightsRoyal Decree No. 6/2022, Art. 11 | since |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. 6/2022, Art. 8, penalties provisions, as amended by Royal Decree No. 68/2026 | since |
| Personal Data Protection Law, proof of express consent, external audit and processing documentsRoyal Decree No. 6/2022, Arts. 10 (as replaced by Royal Decree No. 68/2026), 16, 17 | since |
| Personal Data Protection Law, comprehensive regime and scopeRoyal Decree No. 6/2022, Arts. 3-4, 7, as amended by Royal Decree No. 68/2026 | since |
 Philippines
ph
8 instruments
| |
| Data Privacy Act of 2012, extraterritorial applicationRepublic Act No. 10173 (2012), Section 6; Implementing Rules and Regulations, Rule II, Section 4 | since |
| Data Privacy Act of 2012, scope and exclusionsRepublic Act No. 10173 (2012), Section 4; Implementing Rules and Regulations, Rule II, Sections 5 and 6 | since |
| Data Privacy Act of 2012, breach notificationRepublic Act No. 10173 (2012), Section 20(f) | since |
| Data Privacy Act of 2012, comprehensive regime and lawful processing criteriaRepublic Act No. 10173 (2012), Sections 3, 12, 13 | since |
| Data Privacy Act of 2012, cross-border transfer accountabilityRepublic Act No. 10173 (2012), Section 21 | since |
| Data Privacy Act of 2012, data subject rightsRepublic Act No. 10173 (2012), Sections 16-18 | since |
| Data Privacy Act of 2012, enforcement and restitutionRepublic Act No. 10173 (2012), Sections 25-37 | since |
| National Privacy Commission Circular on Registration of Data Processing Systems and Data Protection OfficersNPC Circular No. 2022-04, Sections 5, 7 and 39 | in force |
 Qatar
qa
12 instruments
| |
| Personal Data Privacy Protection Law, breach notificationLaw No. 13 of 2016, Arts. 13-14 | since |
| Personal Data Privacy Protection Law, comprehensive regimeLaw No. 13 of 2016, Chapter One | since |
| Personal Data Privacy Protection Law, cross-border data flowLaw No. 13 of 2016, Art. 15 | since |
| Personal Data Privacy Protection Law, enforcement and penaltiesLaw No. 13 of 2016, Arts. 23-26 | since |
| Personal Data Privacy Protection Law, special-nature personal dataLaw No. 13 of 2016, Art. 16 | since |
| Personal Data Privacy Protection Law, rights of the individualLaw No. 13 of 2016, Arts. 5-6 | in force |
| QFC Data Protection Regulations 2021, breach notificationQFC Data Protection Regulations 2021, Art. 31 | in force |
| QFC Data Protection Regulations 2021, data subject rightsQFC Data Protection Regulations 2021, Arts. 16-21 | in force |
| QFC Data Protection Regulations 2021, general regimeQFC Data Protection Regulations 2021, Arts. 6-10 | in force |
| QFC Data Protection Regulations 2021, sensitive personal dataQFC Data Protection Regulations 2021, Art. 12 | in force |
| QFC Data Protection Regulations 2021, supervision and penaltiesQFC Data Protection Regulations 2021, Arts. 33-36 | in force |
| QFC Data Protection Regulations 2021, transfers out of the QFCQFC Data Protection Regulations 2021, Arts. 23-24 | in force |
 Saudi Arabia
sa
7 instruments
| |
| Implementing Regulations, record of processing activities, breach report copies and request recordsImplementing Regulations of the Personal Data Protection Law, Arts. 3(1)(d), 24(3), 33 | since |
| Personal Data Protection Law, breach notificationRoyal Decree No. M/19, Art. 20; Implementing Regulations Art. 24(1) | since |
| Personal Data Protection Law, comprehensive regime and lawful basisRoyal Decree M/19 (9/2/1443H, ), comprehensive regime; Implementing Regulations Arts. 4, 11-12 | since |
| Personal Data Protection Law, cross-border transferRoyal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom | since |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. M/19, Arts. 35-36, 40 | since |
| Personal Data Protection Law, sensitive data categories and processingRoyal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) | since |
| Personal Data Protection Law, data subject rightsPersonal Data Protection Law (Royal Decree No. M/19), Arts. 4 and 9; Implementing Regulations Arts. 3(1)(a)-(c), 5-8 | in force |
 Singapore
sg
6 instruments
| |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 | since |
| Personal Data Protection Act, comprehensive consent-based regimeAct 26 of 2012 (Singapore), as amended by the Personal Data Protection (Amendment) Act 2020, Act 40 of 2020 | since |
| Personal Data Protection Act, data breach notificationPersonal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020 | since |
| Personal Data Protection Act, offence of unauthorised re-identification of anonymised informationPersonal Data Protection Act 2012, s.48F (Part 9B), as added by Act 40 of 2020 | since |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act 2012, s.26 | since |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act 2012, ss.21-22 | since |
 South Korea
kr
10 instruments
| |
| Personal Information Protection Act, rights regarding automated decisionsAct No. 10465 (as amended by Act No. 19234, 2023), Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Arts. 44-2 to 44-4 | since |
| Personal Information Protection Act, breach notification dutiesAct No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40 | since |
| Personal Information Protection Act, comprehensive regime and lawful basesAct No. 10465 (), as amended by Act No. 19234 (), Art. 15 | since |
| Personal Information Protection Act, cross-border transfer restrictionsAct No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11 | since |
| Personal Information Protection Act, data subject rightsAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37 | since |
| Personal Information Protection Act, enforcement and private civil remedyAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 | since |
| Personal Information Protection Act, safety measures and access recordsAct No. 10465 (as amended by Act No. 21445, 2026), Art. 29; Enforcement Decree (Presidential Decree No. 36671, 2026), Art. 30(1); Personal Information Protection Commission Notice No. 2025-9 (Standards for Personal Information Safety Measures), Art. 8 | since |
| Personal Information Protection Act, sensitive information and biometric dataAct No. 10465 (as amended by Act No. 19234, 2023), Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, ), Art. 18 | since |
| Personal Information Protection Act, pseudonymized informationAct No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) | since |
| Personal Information Protection Act, special rules for personal information processing in AI developmentAct No. 21910 (2026), Personal Information Protection Act, Arts. 28-12 to 28-15 | from , in 4 months |
 Sri Lanka
lk
6 instruments
| |
| Personal Data Protection Act, breach notification dutiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23 | from , in 2 months |
| Personal Data Protection Act, comprehensive regime and lawful basisPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 | from , in 2 months |
| Personal Data Protection Act, cross-border transfer of personal dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26 | from , in 2 months |
| Personal Data Protection Act, special categories and biometric dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II | from , in 2 months |
| Personal Data Protection Act, Data Protection Authority and penaltiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38 | from a date not yet set |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 | from a date not yet set |
 State of Palestine
ps
1 instrument
| |
| Palestinian Basic Law (Amended 2003), Privacy and Remedy ProvisionsPalestinian Basic Law (Amended) 2003, Arts. 17 and 32 | since |
 Syria
sy
6 instruments
| |
| Law No. 12 of 2024 on Protection of Electronic Personal DataLaw No. 12 of 2024 (Syrian Arab Republic), arts. 1-2, 4-7, 9-10, 12, 27-30, 40, 45 (definitions, lawful processing, controller and processor obligations, licensing and scope) | since |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penaltiesLaw No. 12 of 2024, arts. 19-26, 31, 34-39, 43 (Authority, complaints, fines and offences) | since |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, cross border transferLaw No. 12 of 2024, arts. 15-16 (cross-border transfer of personal data) | since |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notificationLaw No. 12 of 2024, art. 8 (personal data breach notification) | since |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketingLaw No. 12 of 2024, arts. 3, 11, 17-18, 33 (rights, requests and electronic marketing) | since |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal dataLaw No. 12 of 2024, arts. 13-14 (sensitive personal data) | since |
 Tajikistan
tj
6 instruments
| |
| Law on the Protection of Personal Data, biometric personal dataLaw No. 1537 (), Art. 17; Art. 1; Art. 11 | since |
| Law on the Protection of Personal Data, comprehensive regimeLaw No. 1537 (), Arts. 1-3, 5, 8-9 | since |
| Law on the Protection of Personal Data, data subject rightsLaw No. 1537 (), Art. 8; Arts. 19-22 | since |
| Law on the Protection of Personal Data, duties of the possessor, operator and third partyLaw No. 1537 (), Art. 25 | since |
| Law on the Protection of Personal Data, enforcementLaw No. 1537 (), Arts. 6-7, 22, 26 | since |
| Law on the Protection of Personal Data, localization and cross-border transferLaw No. 1537 (), Art. 14; Art. 18 | since |
 Thailand
th
5 instruments
| |
| Personal Data Protection Act, breach notificationPersonal Data Protection Act B.E. 2562 (2019), Section 37(4) | since |
| Personal Data Protection Act, comprehensive regimePersonal Data Protection Act B.E. 2562 (2019), Government Gazette Vol. 136, Special Issue 69 Kor, fully enforceable | since |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act B.E. 2562 (2019), Section 28 | since |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act B.E. 2562 (2019), Sections 77, 78, 84-88 | since |
| Personal Data Protection Act, sensitive and biometric categoriesPersonal Data Protection Act B.E. 2562 (2019), Section 26 | since |
 Timor-Leste
tl
3 instruments
| |
| Constitution of Timor-Leste, Section 38(1) (Access to personal data)Section 38(1) (access), Constitution of Timor-Leste (2002) | since |
| Constitution of Timor-Leste, Section 38(3) (Sensitive categories of personal data)Section 38(3) (sensitive categories), Constitution of Timor-Leste (2002) | since |
| Constitution of the Democratic Republic of Timor-Leste, Section 38(2) (Personal data deferred to statute)Constitution of the Democratic Republic of Timor-Leste (2002), Section 38(2) | since |
 Turkey
tr
7 instruments
| |
| Personal Data Protection Law (KVKK), cross-border transferLaw No. 6698, Art. 9, as amended by Law No. 7499 (), Provisional Art. 3 | since |
| Personal Data Protection Law (KVKK), special categories and biometric dataLaw No. 6698, Art. 6, as amended by Law No. 7499 () | since |
| Personal Data Protection Law (KVKK), data subject rightsLaw No. 6698, Art. 11(1)(a)-(f) and (ğ) | since |
| Personal Data Protection Law (KVKK), enforcement and compensationLaw No. 6698, Arts. 11(1)(ğ), 18 | since |
| Personal Data Protection Law (KVKK), objection to a result of solely automated analysisLaw No. 6698, Art. 11(1)(g) | since |
| Personal Data Protection Law (KVKK), breach notificationLaw No. 6698, Art. 12(5) | since |
| Personal Data Protection Law (KVKK), comprehensive regime and lawful basisLaw No. 6698 (), as amended by Law No. 7499 (), Arts. 1, 3, 5, 7-8, 10 | since |
 Turkmenistan
tm
6 instruments
| |
| Law on Information About Private Life and Its Protection, proof of consent and detection of unlawful accessLaw No. 519-V (), Arts. 24(1)(2), 27(2)(6) | since |
| Law on Information About Private Life, biometric informationLaw No. 519-V (), Arts. 1(1), 7(7), 11(2) | since |
| Law on Information About Private Life, comprehensive regimeLaw No. 519-V (), in force , Arts. 1, 3, 6-9, 14 | since |
| Law on Information About Private Life, enforcementLaw No. 519-V (), Arts. 26(1), 28(2), 29, 30, 31, 32 | since |
| Law on Information About Private Life, localization and cross-border transferLaw No. 519-V (), Arts. 12, 17 | since |
| Law on Information About Private Life, special categories of personal informationLaw No. 519-V (), Art. 21 | since |
 United Arab Emirates
ae
7 instruments
| |
| Federal Decree-Law on the Protection of Personal Data, breach notificationFederal Decree-Law No. 45 of 2021, Art. 9 | since |
| Federal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basisFederal Decree-Law No. 45 of 2021, Arts. 1, 4 | since |
| Federal Decree-Law on the Protection of Personal Data, cross-border transferFederal Decree-Law No. 45 of 2021, Arts. 22-23 | since |
| Federal Decree-Law on the Protection of Personal Data, enforcement and supervisionFederal Decree-Law No. 45 of 2021, Arts. 25-26 | since |
| ADGM Data Protection Regulations, breach notificationADGM Data Protection Regulations 2021, personal data breach notification provisions | since |
| ADGM Data Protection Regulations, comprehensive regimeADGM Data Protection Regulations 2021 (consolidated February 2024) | since |
| DIFC Data Protection Law, comprehensive regimeDIFC Law No. 5 of 2020 | since |
 Uzbekistan
uz
8 instruments
| |
| Law ZRU-1115, personal data processed using artificial intelligenceLaw of the Republic of Uzbekistan ZRU-1115 (), Article 2 (Code of Administrative Responsibility, Article 46-2, Part 2) and Article 1(5) (Law on Informatization, Article 12-1) | since |
| Regulation on levels of protection of personal data, special, biometric and genetic dataResolution of the Cabinet of Ministers No. 570 (), Annex 1 (Regulation on setting the levels of protection of personal data in processing), paras. 1-2, 9-17 | since |
| Law on Personal Data, biometric and genetic dataLaw No. ZRU-547 (), Art. 26 | since |
| Law on Personal Data, comprehensive regime and lawful basesLaw No. ZRU-547 (), Arts. 1-14, 18-23, 28, 30-31 | since |
| Law on Personal Data, cross-border transfer and citizen data localizationLaw ZRU-547 (), Article 15; Article 27-1 (as restated by Law ZRU-1125 of ) | since |
| Law on Personal Data, data subject rightsLaw No. ZRU-547 (), Art. 30 | since |
| Law on Personal Data, enforcementLaw No. ZRU-547 (), Art. 33 | since |
| Law on Personal Data, special personal dataLaw No. ZRU-547 (), Art. 25 | since |
 Vietnam
vn
6 instruments
| |
| Decree on administrative sanctions for personal data protection violationsDecree No. 330/2026/ND-CP of , personal data protection sanctions (Chapter II, Section 6, Articles 39 to 71) | since |
| Law on Personal Data Protection, biometric and location data protectionLaw No. 91/2025/QH15, Article 31 | since |
| Law on Personal Data Protection, breach notificationLaw No. 91/2025/QH15, Article 23 | since |
| Law on Personal Data Protection, comprehensive regimeLaw No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, , in force | since |
| Law on Personal Data Protection, cross-border transferLaw No. 91/2025/QH15, Article 20 | since |
| Law on Personal Data Protection, enforcement and data subject rightsLaw No. 91/2025/QH15, enforcement and data subject rights provisions | since |
| Africa | |
| Economic Community of West African States · 11 member states | |
 Benin
bj
7 instruments
| |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénalesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 448-490 et Livre VI, arts. 514-517 (Autorité, sanctions et infractions pénales) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, automated decisionsLoi n°2017-20 du 20 avril 2018, Livre V, arts. 401 et 437 (automated individual decisions) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineursLoi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernéesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 399-400, 415-423, 437-445 et 447 (droits des personnes concernées) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécuritéLoi n°2017-20 du 20 avril 2018, Livre V, art. 427 (notification des ruptures de sécurité) | in force |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, transfert transfrontalier de donnéesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 391-392 (transfert transfrontalier de données) | in force |
 Cabo Verde
cv
17 instruments
| |
| Law No. 133/V/2001 on the Protection of Personal Data, automated decisionsLei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 23 (nos. 1 and 2) (automated individual decisions) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, data portabilityLei n.º 133/V/2001, de 22 de Janeiro, art. 18 as republished by Lei n.º 121/IX/2021, de 17 de Março (direito de portabilidade dos dados) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, data protection by design and by defaultLei n.º 133/V/2001, de 22 de Janeiro, art. 26 as republished by Lei n.º 121/IX/2021, de 17 de Março (proteção de dados desde a conceção e por defeito) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, data protection impact assessmentLei n.º 133/V/2001, de 22 de Janeiro, art. 29 as republished by Lei n.º 121/IX/2021, de 17 de Março (avaliação de impacto sobre a proteção de dados) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, data protection officerLei n.º 133/V/2001, de 22 de Janeiro, arts. 30 to 32 as republished by Lei n.º 121/IX/2021, de 17 de Março (encarregado da proteção de dados) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contractsLei n.º 133/V/2001, de 22 de Janeiro, arts. 6 and 24 (nos. 4 to 6) as amended by Lei n.º 121/IX/2021, de 17 de Março (qualidade dos dados e subcontratação) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, personal data breach notificationLei n.º 133/V/2001, de 22 de Janeiro, arts. 27 and 28 as republished by Lei n.º 121/IX/2021, de 17 de Março (violação de dados pessoais) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjectsLei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 13 (nos. 1 and 3), 14 (no. 1) and 20 (a) (direitos dos titulares dos dados) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categoriesLei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, art. 8 and art. 11 (no. 2) (dados sensíveis) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, undue access and data diversion crimesLei n.º 133/V/2001, de 22 de Janeiro, arts. 60 and 64 to 67 as republished by Lei n.º 121/IX/2021, de 17 de Março (acesso indevido e crimes contra os dados pessoais) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, nature of the supervisory authorityLei n.º 133/V/2001, de 22 de Janeiro, art. 38 as republished by Lei n.º 121/IX/2021, de 17 de Março (natureza da fiscalização) | since |
| Law No. 133/V/2001 on the Protection of Personal DataLei n.º 133/V/2001, de 22 de Janeiro (Lei de Protecção de Dados Pessoais), as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 7, 12, 24 (nos. 1 to 3), 33-34, 39-40, 43 and 71 | since |
| Law No. 133/V/2001 on the Protection of Personal Data, automated decisions authorized by the CNPDLei n.º 133/V/2001, de 22 de Janeiro, art. 23 (no. 3) as republished by Lei n.º 121/IX/2021, de 17 de Março (decisões automatizadas autorizadas pela CNPD) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, cross border transferLei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 35-36 (transferência internacional de dados) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervisionLei n.º 133/V/2001, de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 37, 45-47, 49-50, 59, 61-63 and 69 (recursos, contraordenações e crimes) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measuresLei n.º 133/V/2001, de 22 de Janeiro, arts. 11 (nos. 1 and 3) and 25 as republished by Lei n.º 121/IX/2021, de 17 de Março (registos de infrações e medidas especiais de segurança) | since |
| Law No. 133/V/2001 on the Protection of Personal Data, open-network warning, health-data access and marketing objectionLei n.º 133/V/2001, de 22 de Janeiro, arts. 13 (no. 4), 14 (no. 5) and 20 (b) and (c) as republished by Lei n.º 121/IX/2021, de 17 de Março (direitos dos titulares dos dados) | since |
 Côte d'Ivoire
ci
6 instruments
| |
| Law No. 2013-450 on the Protection of Personal DataLoi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel, arts. 1-20, 22, 27, 39-44 (lawful basis, registration and security) | in force |
| Law No. 2013-450 on the Protection of Personal Data, automated decisionsLoi n° 2013-450, art. 25 (automated individual decisions) | in force |
| Law No. 2013-450 on the Protection of Personal Data, cross-border transferLoi n° 2013-450, arts. 7, 26 (cross-border transfer) | in force |
| Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection BodyLoi n° 2013-450, arts. 45-52 (enforcement and the Protection Body) | in force |
| Law No. 2013-450 on the Protection of Personal Data, rights of the data subjectLoi n° 2013-450, arts. 28-38 (rights of the data subject) | in force |
| Law No. 2013-450 on the Protection of Personal Data, sensitive categories of personal dataLoi n° 2013-450, arts. 7, 21 (sensitive categories of personal data) | in force |
 Gambia
gm
7 instruments
| |
| Personal Data Protection and Privacy Act, 2025Personal Data Protection and Privacy Act, 2025, scope, principles, lawful basis and the obligations of controllers and processors | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, automated decision-makingPersonal Data Protection and Privacy Act, 2025, automated decision-making | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, personal data breach notificationPersonal Data Protection and Privacy Act, 2025, breach notification | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, rights of the data subjectPersonal Data Protection and Privacy Act, 2025, rights of the data subject | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's dataPersonal Data Protection and Privacy Act, 2025, sensitive personal data and children's data | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penaltiesPersonal Data Protection and Privacy Act, 2025, offences, penalties and the Information Commission | from a date not yet set |
| Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The GambiaPersonal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia | from a date not yet set |
 Ghana
gh
8 instruments
| |
| Data Protection ActData Protection Act, 2012 (Act 843), ss. 1-30, 45-74 and 82-94 | since |
| Data Protection Act, 2012, automated decision-takingData Protection Act, 2012 (Act 843), s. 41 (automated decision-taking) | since |
| Data Protection Act, enforcement, offences and penaltiesData Protection Act, 2012 (Act 843), ss. 43, 75-81, 88-89 and 95 (enforcement, offences and penalties) | since |
| Data Protection Act, notification of security compromisesData Protection Act, 2012 (Act 843), s. 31 (notification of security compromises) | since |
| Data Protection Act, rights of data subjectsData Protection Act, 2012 (Act 843), ss. 32-36, 39-40 and 42-44 (rights of data subjects) | since |
| Data Protection Act, special personal dataData Protection Act, 2012 (Act 843), ss. 37-38 (special personal data) | since |
| National Identity Register Regulations, mandatory use and verification of the Ghana CardNational Identity Register Regulations, 2012 (L.I. 2111), regs. 7-9 and 13-18 (mandatory use, verification and user agencies) | since |
| National Identity Register Act, personal information, user agencies and offencesNational Identity Register Act, 2008 (Act 750), ss. 41-42, 48, 50, 53-61 and 65-73 (national identity cards, Register data and offences) | in force |
 Guinea
gn
6 instruments
| |
| Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif à la protection des données à caractère personnelLoi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel | since |
| Loi n° L/2016/037/AN, protection des données à caractère personnel, autorité de protection et sanctionsLoi n° L/2016/037/AN, arts. 47-53, 55-61 (autorité et sanctions) | since |
| Loi n° L/2016/037/AN, protection des données à caractère personnel, catégories de données sensiblesLoi n° L/2016/037/AN, art. 54 (données sensibles) | since |
| Loi n° L/2016/037/AN, protection des données à caractère personnel, droits de la personne concernéeLoi n° L/2016/037/AN, arts. 30-38 et 40 (droits de la personne concernée) | since |
| Loi n° L/2016/037/AN, protection des données à caractère personnel, décisions fondées sur un traitement automatiséLoi n° L/2016/037/AN, art. 27 (décisions fondées sur un traitement automatisé) | since |
| Loi n° L/2016/037/AN, protection des données à caractère personnel, transfert vers un pays tiersLoi n° L/2016/037/AN, art. 28 (transfert vers un pays tiers) | since |
 Liberia
lr
2 instruments
| |
| Data Protection Act of LiberiaAn Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia) | since |
| Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)Telecommunications Act of 2007, §§ 51-52 (Protection of Personal Information) | in force |
 Nigeria
ng
12 instruments
| |
| Internet Code of Practice 2026, data breach notificationInternet Code of Practice 2026, data breach notification (s. 3.4) | since |
| Nigeria Data Protection Act, 2023 (NDPA), general data protection dutiesNigeria Data Protection Act, 2023 (No. 37 of 2023), general duties (ss. 1-3, 24-29, 32-33, 39 and 63-65; GAID 2025, arts. 1-17, 19-32, 34-35 and 41-42) | since |
| Nigeria Data Protection Act, 2023 and GAID 2025, automated decisionsGAID 2025, art. 43(2)(a), under the Nigeria Data Protection Act, 2023 (automated decisions) | since |
| Nigeria Data Protection Act, 2023, complaints, enforcement and redressNigeria Data Protection Act, 2023, complaints and enforcement (ss. 46 and 48; GAID 2025, arts. 39, 47 and 48) | since |
| Nigeria Data Protection Act, 2023, cross-border data transferNigeria Data Protection Act, 2023, cross-border data transfer (Part VIII; GAID 2025, art. 45 and Schedule 5) | since |
| Nigeria Data Protection Act, 2023, data breach notificationNigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33) | since |
| Nigeria Data Protection Act, 2023, rights of a data subjectNigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) | since |
| Nigeria Data Protection Act, 2023, sensitive personal data and a child's dataNigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) | since |
| Central Bank of Nigeria Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (revised October 2021)Central Bank of Nigeria, Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021) | since |
| Access to Registered Information in the National Identity Database Regulations, 2017Access to Registered Information in the National Identity Database Regulations, 2017 (S.I. No. 16 of 2017) | since |
| Mandatory Use of the National Identification Number Regulations, 2017Mandatory Use of the National Identification Number Regulations, 2017 (S.I. No. 15 of 2017) | since |
| Guidelines for Nigerian Content Development in ICT, local hosting of subscriber and consumer dataGuidelines for Nigerian Content Development in Information and Communication Technology (ICT), as amended, August 2019, paragraph 4 of sections 11.1 and 12.1 | in force |
| Nigeria Data Protection Regulation 2019 (NDPR), general data protection dutiesNigeria Data Protection Regulation 2019 (issued by the National Information Technology Development Agency on ), clauses 1.2, 2.1-2.3, 2.5-2.7, 2.10-2.12 | |
| National Identity Management Commission Act, 2007, access to the National Identity Database and mandatory use of the National Identification NumberNational Identity Management Commission Act, 2007 (Act No. 23 of 2007), ss. 26-30 | |
 Senegal
sn
11 instruments
| |
| Décret n° 2008-721 du 30 juin 2008 portant application de la loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, Commission des données personnelles, contrôles et sanctionsDécret n° 2008-721 du 30 juin 2008, arts. 2-19, 55-57, 67-75 (Commission des données personnelles, contrôles et sanctions) | in force |
| Décret n° 2008-721 du 30 juin 2008 portant application de la loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, données génétiques, recherche médicale et traitements ultérieursDécret n° 2008-721 du 30 juin 2008, arts. 33-41 (données génétiques, recherche médicale et traitements ultérieurs) | in force |
| Décret n° 2008-721 du 30 juin 2008 portant application de la loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, droits de la personne concernéeDécret n° 2008-721 du 30 juin 2008, arts. 45-62 (droits de la personne concernée) | in force |
| Décret n° 2008-721 du 30 juin 2008 portant application de la loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, régimes de traitement et obligations du responsableDécret n° 2008-721 du 30 juin 2008, arts. 20-32, 63-66 (régimes de traitement et obligations du responsable) | in force |
| Décret n° 2008-721 du 30 juin 2008 portant application de la loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel, transferts vers un pays tiersDécret n° 2008-721 du 30 juin 2008, arts. 42-44 (transferts vers un pays tiers) | in force |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, arts. 1-4, 17-24, 33-39, 45-46, 52-57, 70-74 (principes généraux, formalités préalables et obligations du responsable) | in force |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctionsLoi n° 2008-12 du 25 janvier 2008, arts. 5-16, 25-32, 75 (Commission des Données Personnelles, contrôles et sanctions) | in force |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, catégories sensibles de donnéesLoi n° 2008-12 du 25 janvier 2008, arts. 20, 40-44 (catégories sensibles de données) | in force |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernéeLoi n° 2008-12 du 25 janvier 2008, arts. 47, 58-69 (droits de la personne concernée) | in force |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, transferts vers un pays tiersLoi n° 2008-12 du 25 janvier 2008, arts. 49-51 (transferts vers un pays tiers) | in force |
| Loi n° 2008-12 du 25 janvier 2008, automated decisionsLoi n° 2008-12 du 25 janvier 2008, art. 48 (automated individual decisions) | in force |
 Sierra Leone
sl
4 instruments
| |
| National Communications Authority Act 2022, offence of unauthorised handling of subscriber informationNational Communications Authority Act, 2022 (Act No. 16 of 2022), s. 190(1) | since |
| National Communications Authority Act 2022, transfer of personal data outside Sierra LeoneNational Communications Authority Act, 2022 (Act No. 16 of 2022), s. 155(3)(h) | since |
| Telecommunications (Subscribers Identification and Registration) Regulations 2020, notification of unauthorised disclosure of subscriber informationTelecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(5)-(6) | in force |
| Telecommunications (Subscribers Identification and Registration) Regulations 2020, transfer of subscriber registration information outside Sierra LeoneTelecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(3)-(4) | in force |
 Togo
tg
6 instruments
| |
| Loi n° 2019-014, automated individual decisionsLoi n° 2019-014 du 29 octobre 2019, art. 27 (automated individual decisions) | in force |
| Loi n° 2019-014, cadre institutionnel et dispositions pénalesLoi n° 2019-014 du 29 octobre 2019, arts. 55-74, 79-93 (institutional framework, sanctions and offenses) | in force |
| Loi n° 2019-014, données sensiblesLoi n° 2019-014 du 29 octobre 2019, arts. 8, 21-25 (sensitive personal data) | in force |
| Loi n° 2019-014, droits de la personne concernéeLoi n° 2019-014 du 29 octobre 2019, arts. 26, 35-50 (rights of data subjects) | in force |
| Loi n° 2019-014, protection des données à caractère personnelLoi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel, arts. 1-20, 32-34, 51-54, 75-78 and 94-97 (comprehensive regime, formalities and obligations) | in force |
| Loi n° 2019-014, transfert des données vers un pays tiersLoi n° 2019-014 du 29 octobre 2019, arts. 28-31 (cross border transfer) | in force |
| Africa (non ECOWAS) | |
 Algeria
dz
6 instruments
| |
| Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, arts. 4, 7-9 et 12, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 38-39 et 41 bis à 41 bis 3 | since |
| Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriquesLoi n° 18-07 du 10 juin 2018, art. 18, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 3 et 45 bis 7 | since |
| Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recoursLoi n° 18-07 du 10 juin 2018, arts. 47, 52 et 54-74, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, art. 27 bis | since |
| Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernéeLoi n° 18-07 du 10 juin 2018, arts. 34-36 | since |
| Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de donnéesLoi n° 18-07 du 10 juin 2018, art. 43, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 45 bis 8 et 45 bis 10 | since |
| Loi n° 18-07 relative à la protection des personnes physiques, transfert de données vers un pays étrangerLoi n° 18-07 du 10 juin 2018, arts. 44-45 | since |
 Angola
ao
6 instruments
| |
| Law on the Protection of Personal DataLei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 | since |
| Law on the Protection of Personal Data, automated decisionsLei n.º 22/11, de 17 de Junho de 2011, art. 29 (automated individual decisions) | since |
| Law on the Protection of Personal Data, cross border transferLei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados) | since |
| Law on the Protection of Personal Data, enforcement and supervisionLei n.º 22/11, de 17 de Junho de 2011, arts. 44-62 (Agência de Protecção de Dados, contravenções e crimes) | since |
| Law on the Protection of Personal Data, rights of data subjectsLei n.º 22/11, de 17 de Junho de 2011, arts. 25-28 (direitos dos titulares dos dados) | since |
| Law on the Protection of Personal Data, sensitive data categoriesLei n.º 22/11, de 17 de Junho de 2011, arts. 13-15 e 17 (dados sensíveis) | since |
 Botswana
bw
7 instruments
| |
| Data Protection Act, 2024 (Act No. 18 of 2024)Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73 | since |
| Data Protection Act, 2024, automated decisionsData Protection Act, 2024 (Act No. 18 of 2024), s. 49 (automated individual decisions) | since |
| Data Protection Act, 2024, compensation, administrative fines and offencesData Protection Act, 2024 (Act No. 18 of 2024), Part XV (ss. 80-84) | since |
| Data Protection Act, 2024, personal data breach notificationData Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64 | since |
| Data Protection Act, 2024, rights of data subjectsData Protection Act, 2024 (Act No. 18 of 2024), Part VIII (ss. 37-48) | since |
| Data Protection Act, 2024, sensitive personal data and children's dataData Protection Act, 2024 (Act No. 18 of 2024), s. 29, Part VI (ss. 30-33) | since |
| Data Protection Act, 2024, transfer of personal data to third countries or international organisationsData Protection Act, 2024 (Act No. 18 of 2024), Part XIV (ss. 74-79) | since |
 Burkina Faso
bf
6 instruments
| |
| Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnelLoi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, arts. 1-11, 13, 23-41 (dispositions générales, principes fondamentaux, obligations du responsable et formalités préalables) | since |
| Personal Data Protection Law, automated decisionsLoi n°001-2021/AN, arts. 15, 19, 31 (automated individual decisions) | since |
| Personal Data Protection Law, cross-border transfer of personal dataLoi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso) | since |
| Personal Data Protection Law, rights of the data subjectLoi n°001-2021/AN, arts. 14, 16-17, 19-22 (droits de la personne concernée) | since |
| Personal Data Protection Law, sensitive personal data categoriesLoi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles) | since |
| Personal Data Protection Law, supervisory authority and sanctionsLoi n°001-2021/AN, arts. 45-79 (autorité de contrôle et sanctions) | since |
 Burundi
bi
8 instruments
| |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal DataLoi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, automated decisionsLoi n°1/03 du 10 mars 2026, articles 19-20 (décisions automatisées) | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, information, access and other rights of the person concernedLoi n°1/03 du 10 mars 2026, articles 17-18 and 21-33 (droits des personnes concernées) | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, personal data breach notificationLoi n°1/03 du 10 mars 2026, articles 45-46 (notification des violations de données) | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, sensitive data and biometric identificationLoi n°1/03 du 10 mars 2026, articles 9-10 (données sensibles) | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, the Agence de protection des données à caractère personnel and penaltiesLoi n°1/03 du 10 mars 2026, articles 26-27, 35, 42 and 47-51 (organe de protection et dispositions pénales) | since |
| Law No. 1/03 of March 10, 2026 on the Protection of Personal Data, transfers of personal data abroadLoi n°1/03 du 10 mars 2026, articles 15-16 (transfert de données à l'étranger) | since |
| Law No. 1/10 of March 16, 2022 on the Prevention and Repression of Cybercrime in Burundi, sensitive personal data offenseLoi n°1/10 du 16 mars 2022 portant prévention et répression de la cybercriminalité au Burundi, article 62 (données nominatives sensibles) | since |
 Cameroon
cm
2 instruments
| |
| Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)Loi n°2010/012 du 21 décembre 2010, art. 74 | in force |
| Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au CamerounLoi n°2024/017 du 23 décembre 2024 | in force |
 Central African Republic
cf
5 instruments
| |
| Loi n° 24.001 portant protection des données à caractère personnelLoi n° 24.001 du 25 janvier 2024 portant protection des données à caractère personnel, Chapitres Ier, II, V, VII et IX, articles 1 à 21, 28, 38 à 43, 57 et 58 (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales) | since |
| Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineursLoi n° 24.001 du 25 janvier 2024, Chapitre Ier Section 2 et Chapitre II, articles 11 à 21 (données sensibles et mineurs) | since |
| Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitementLoi n° 24.001 du 25 janvier 2024, Chapitre II et Chapitre VI, articles 11 à 21 et 29 à 37 (droits liés au traitement, prospection directe) | since |
| Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalierLoi n° 24.001 du 25 janvier 2024, Chapitre III, articles 22 à 27 (flux transfrontalier) | since |
| Loi n° 24.001 portant protection des données à caractère personnel, sanctions et agenceLoi n° 24.001 du 25 janvier 2024, Chapitre VIII et Chapitre IX, articles 44 à 58 (sanctions et agence) | since |
 Chad
td
6 instruments
| |
| Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)Loi n°007/PR/2015 du 10 février 2015, arts. 35-50 | since |
| Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICELoi n°007/PR/2015 du 10 février 2015, art. 61 | since |
| Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)Loi n°007/PR/2015 du 10 février 2015, arts. 1-15 | since |
| Loi n°007/PR/2015, sanctions administratives et pénales et recoursLoi n°007/PR/2015 du 10 février 2015, arts. 80-94 | since |
| Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)Loi n°007/PR/2015 du 10 février 2015, arts. 16-25 | since |
| Loi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMACLoi n°007/PR/2015 du 10 février 2015, arts. 29-32 | since |
 Comoros
km
5 instruments
| |
| Law on the Protection of Personal DataLoi n° 14-029/AU portant protection des données à caractère personnel, deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on , arts. 1-5, 41-42, 43(a) and (e)-(g), 44-46, 49-53 and 66-68 (comprehensive regime, formalities and obligations) | in force |
| Law on the Protection of Personal Data, rights of data subjectsLoi n° 14-029/AU, arts. 10-18, 48 (rights of data subjects) | in force |
| Law on the Protection of Personal Data, sensitive personal dataLoi n° 14-029/AU, arts. 6-8, 43(b)-(d) (sensitive personal data) | in force |
| Law on the Protection of Personal Data, the Commission and sanctionsLoi n° 14-029/AU, arts. 19-40, 47, 54-65 (enforcement, sanctions and offenses) | in force |
| Law on the Protection of Personal Data, transfer to a foreign stateLoi n° 14-029/AU, arts. 9, 43(h) (cross border transfer) | in force |
 Democratic Republic of the Congo
cd
6 instruments
| |
| Digital Code, Data Protection Authority and sanctionsCode du numérique, Titre III, arts. 234, 249 à 261 et Titre IV, arts. 262 à 270 (autorité de protection des données, sanctions et voies de recours) | since |
| Digital Code, Title III, cross-border transfer of personal dataCode du numérique, Titre III, arts. 201 à 203 (transfert des données personnelles) | since |
| Digital Code, Title III, personal data breach notificationCode du numérique, Titre III, art. 244 (violation de données à caractère personnel) | since |
| Digital Code, Title III, rights of the data subjectCode du numérique, Titre III, arts. 200, 207 à 218, 220, 235 à 237, 240 à 242 et 248 (droits de la personne concernée) | since |
| Digital Code, Title III, sensitive personal data and minorsCode du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs) | since |
| Digital Code, Title III: Personal Data ProtectionCode du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) | since |
 Djibouti
dj
6 instruments
| |
| Digital Code, Book I: Personal Data Protection and CNDPLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier, Arts. 2 à 13, 54, 57 et 66 à 73 (objet, champ d'application, obligations du responsable de traitement et formalités préalables) | since |
| Digital Code, Book I: automated individual decision-makingCode Numérique, Livre Premier, Art. 65 (décisions individuelles automatisées) | since |
| Digital Code, Book I: cross-border transfer of personal dataCode Numérique, Livre Premier, Arts. 99 à 102 (transferts vers un pays tiers) | since |
| Digital Code, Book I: personal-data breach notificationCode Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité) | since |
| Digital Code, Book I: sensitive categories of personal data and the minor's consentCode Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles) | since |
| Digital Code, Book I: the Commission, administrative sanctions and criminal offencesCode Numérique, Livre Premier, Arts. 104, 135 et 140 à 156 (Commission et sanctions) | since |
 Egypt
eg
6 instruments
| |
| Egypt Personal Data Protection Law, Personal Data Infringement notificationLaw No. 151 of 2020, Article 7 (Personal Data Infringement notification) | since |
| Egypt Personal Data Protection Law, Sensitive Personal Data and a child's dataLaw No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data) | since |
| Egypt Personal Data Protection Law, cross-border transfer of Personal DataLaw No. 151 of 2020, Articles 14-16 (cross-border transfer of Personal Data) | since |
| Egypt Personal Data Protection Law, rights of the Data SubjectLaw No. 151 of 2020, Articles 2, 32 and 33 (rights of the Data Subject) | since |
| Egypt Personal Data Protection Law, the Center, judicial control and penaltiesLaw No. 151 of 2020, Articles 19-31 and 34-44 (the Center, judicial control and penalties) | since |
| Law No. 151 of 2020 Promulgating the Personal Data Protection LawLaw No. 151 of 2020 Promulgating the Personal Data Protection Law, general duties (annexed arts. 1-6, 8-11, 13 and 17-18) | since |
 Equatorial Guinea
gq
6 instruments
| |
| Ley de Protección de Datos PersonalesLey Núm. 1/2016, de 22 de julio, de Protección de Datos Personales | in force |
| Ley de Protección de Datos Personales, comunicación internacional de datosLey Núm. 1/2016, arts. 27-28 (comunicación internacional de datos) | in force |
| Ley de Protección de Datos Personales, datos sensiblesLey Núm. 1/2016, art. 10 (datos sensibles) | in force |
| Ley de Protección de Datos Personales, derechos de los interesadosLey Núm. 1/2016, arts. 13-14, 22, 24 (derechos de los interesados) | in force |
| Ley de Protección de Datos Personales, impugnación de valoracionesLey Núm. 1/2016, art. 13(b) (impugnación de valoraciones) | in force |
| Ley de Protección de Datos Personales, tutela, inspección y régimen sancionadorLey Núm. 1/2016, arts. 29-47 (órgano rector y régimen sancionador) | in force |
 Eritrea
er
2 instruments
| |
| Civil Code of the State of Eritrea, Personality Rights (Image and Correspondence)Civil Code of the State of Eritrea (2015), arts. 26-30 (Image and Privacy; Inviolability of Correspondence) | from a date not yet set |
| Penal Code of the State of Eritrea, Violation of PrivacyPenal Code of the State of Eritrea (2015), art. 298 (Violation of Privacy) | from a date not yet set |
 Eswatini
sz
7 instruments
| |
| Data Protection Act, 2022 (Act No. 5 of 2022)Data Protection Act, 2022 (Act No. 5 of 2022), ss. 1-5, 7-16, 18, 21, 31, 46-48, 54-55 (general processing principles) | since |
| Data Protection Act, 2022, automated decisionsData Protection Act, 2022, s. 45 (automated individual decisions) | since |
| Data Protection Act, 2022, enforcement and offencesData Protection Act, 2022, ss. 6, 34-43, 49-50, 52-53 (enforcement and offences) | since |
| Data Protection Act, 2022, notification of security compromisesData Protection Act, 2022, s. 17 (notification of security compromises) | since |
| Data Protection Act, 2022, rights of data subjectsData Protection Act, 2022, ss. 19-20, 44, 51 (rights of data subjects) | since |
| Data Protection Act, 2022, sensitive personal informationData Protection Act, 2022, ss. 22-30 (sensitive personal information) | since |
| Data Protection Act, 2022, transfer of personal information outside EswatiniData Protection Act, 2022, ss. 32-33 (transfer outside Eswatini) | since |
 Ethiopia
et
7 instruments
| |
| Personal Data Protection ProclamationProclamation No. 1321/2024 (Federal Negarit Gazette), arts. 1-3, 6-8, 12-17, 33-42 and 45-52 | since |
| Personal Data Protection Proclamation, automated decisionsProclamation No. 1321/2024, art. 31 (automated individual decision-making) | since |
| Personal Data Protection Proclamation, cross-border transfer and data sovereigntyProclamation No. 1321/2024, arts. 18-22 (cross-border transfer and data sovereignty) | since |
| Personal Data Protection Proclamation, enforcement, sanctions and offencesProclamation No. 1321/2024, arts. 55-64 (enforcement, administrative sanctions and offences) | since |
| Personal Data Protection Proclamation, personal data breach notificationProclamation No. 1321/2024, arts. 43-44 (personal data breach notification) | since |
| Personal Data Protection Proclamation, rights of data subjectsProclamation No. 1321/2024, arts. 24-30, 32 (rights of data subjects) | since |
| Personal Data Protection Proclamation, sensitive personal data and minorsProclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors) | since |
 Gabon
ga
7 instruments
| |
| Law No. 025/2023, automated decisions and profilingLoi n°025/2023, articles 66 à 69 (automated individual decisions) | since |
| Law No. 025/2023, interconnection and cross-border transfer of personal dataLoi n°025/2023, articles 168 à 174 (interconnexion et transfert transfrontalier de données) | since |
| Law No. 025/2023, personal-data breach notificationLoi n°025/2023, articles 142 à 147 (violation de données à caractère personnel) | since |
| Law No. 025/2023, recourse, oversight and sanctionsLoi n°025/2023, articles 200 à 214 (recours, contrôle et sanctions) | since |
| Law No. 025/2023, rights of the data subject and transparency obligationsLoi n°025/2023, articles 43 à 65 et 91 à 110 (droits de la personne concernée et obligation de transparence) | since |
| Law No. 025/2023, sensitive categories of personal data and children's dataLoi n°025/2023, articles 74 à 77, 148 à 163 et 188 à 199 (catégories sensibles de données et protection des mineurs) | since |
| Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023, articles 1 à 6, 70 à 73, 78 à 90, 111 à 141, 164 à 167, 175 à 187 et 215 à 221 | since |
 Kenya
ke
10 instruments
| |
| Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Legal Notice No. 265 of 2021), regs. 4, 9, 11, 13, 15 and 18 | since |
| Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (Legal Notice No. 264 of 2021), regs. 11, 14, 17, 19-21 | since |
| Data Protection (General) Regulations, 2021Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50 | since |
| Data Protection Act, 2019Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) | since |
| Data Protection Act, 2019, automated individual decision makingData Protection Act, 2019 (No. 24 of 2019), s. 35 (automated individual decision making) | since |
| Data Protection Act, 2019, enforcement, penalties and compensationData Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74) | since |
| Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach) | since |
| Data Protection Act, 2019, rights of data subjectsData Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-34, 36-38 (rights of data subjects) | since |
| Data Protection Act, 2019, sensitive personal dataData Protection Act, 2019 (No. 24 of 2019), Part V (ss. 44-47) | since |
| Data Protection Act, 2019, transfer of personal data outside KenyaData Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54) | since |
 Lesotho
ls
7 instruments
| |
| Data Protection Act, 2011 (Act No. 5 of 2012)Data Protection Act, 2011 (Act No. 5 of 2012), ss. 1-22, 24, 28, 38, 53-54, 56-57 (general processing principles) | since |
| Data Protection Act, 2011, automated decision makingData Protection Act, 2011, s. 51 (automated decision making) | since |
| Data Protection Act, 2011, enforcement and offencesData Protection Act, 2011, ss. 39-49, 55 (enforcement and offences) | since |
| Data Protection Act, 2011, notification of security compromisesData Protection Act, 2011, s. 23 (notification of security compromises) | since |
| Data Protection Act, 2011, rights of data subjectsData Protection Act, 2011, ss. 25-27, 50 (rights of data subjects) | since |
| Data Protection Act, 2011, sensitive personal informationData Protection Act, 2011, ss. 29-37 (sensitive personal information) | since |
| Data Protection Act, 2011, transfer of personal information outside LesothoData Protection Act, 2011, s. 52 (transfer outside Lesotho) | since |
 Libya
ly
4 instruments
| |
| Law No. 6 of 2022, cross border transfer of personal dataLaw No. 6 of 2022, art. 78 (Electronic Transactions, cross border transfer) | since |
| Law No. 6 of 2022, notice, access and objection rights over personal dataLaw No. 6 of 2022, arts. 76-77, 79 (Electronic Transactions, notice, access and objection) | since |
| Law No. 6 of 2022, protection of personal data collected in electronic transactionsLaw No. 6 of 2022 Concerning Electronic Transactions, arts. 73-75 (Protection of Personal Data: lawful basis, purpose limitation and confidentiality) | since |
| Law No. 6 of 2022, supervisory authority, licensing and penaltiesLaw No. 6 of 2022, arts. 80-82 (Electronic Transactions, licensing and penalties) | since |
 Madagascar
mg
11 instruments
| |
| Law No. 2014-038, CMIL, sanctions and offencesLoi n° 2014-038, arts. 4, 28-42, 50, 55-60, 61-73 (commission, contrôle, sanctions et pénalités) | since |
| Law No. 2014-038, cross-border transfer of personal dataLoi n° 2014-038, art. 20 (transfert de données à l'étranger) | since |
| Law No. 2014-038, protection of personal dataLoi n° 2014-038 sur la protection des données à caractère personnel, arts. 1-2, 5-17, 21, 43-49, 51-54 (dispositions générales, champ d'application, principes fondamentaux, formalités préalables et délégué à la protection des données) | since |
| Law No. 2014-038, rights of data subjectsLoi n° 2014-038, arts. 22-27 (droits des personnes) | since |
| Law No. 2014-038, sensitive personal dataLoi n° 2014-038, arts. 18-19 (données sensibles) | since |
| Loi n° 2014-038, automated decisionsLoi n° 2014-038, art. 3 (automated individual decisions) | since |
| Decree No. 2023-1541, CMIL powers and inspection and sanction procedureDécret n° 2023-1541, arts. 4-6, 75-79 (attributions de la CMIL, contrôle et sanctions) | in force |
| Decree No. 2023-1541, declaration, register and data protection officerDécret n° 2023-1541, arts. 64-74 (déclaration, registre et délégué à la protection des données) | in force |
| Decree No. 2023-1541, procedure for data subject rightsDécret n° 2023-1541, arts. 56-58 (droits des personnes) | in force |
| Decree No. 2023-1541, sensitive personal dataDécret n° 2023-1541, arts. 59-61 (données sensibles) | in force |
| Decree No. 2023-1541, transfer of personal data abroadDécret n° 2023-1541, arts. 62-63 (transfert de données à l'étranger) | in force |
 Malawi
mw
3 instruments
| |
| Data Protection Act, 2024Data Protection Act, 2024 | since |
| Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71, 74) | since |
| Electronic Transactions and Cyber Security Act, 2016, rights of a data subject and information notice (Part VII)ss. 72-73, Electronic Transactions and Cyber Security Act, 2016 (rights of a data subject; information notice) | since |
 Mali
ml
6 instruments
| |
| Loi n° 2013-015, automated decisionsLoi n° 2013-015, art. 2 (automated individual decisions) | since |
| Loi n° 2013-015, protection des données à caractère personnelLoi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali, telle que modifiée, arts. 1, 4-8, 57 (objet, champ d'application, principes et déclaration) | since |
| Loi n° 2013-015, rights of data subjectsLoi n° 2013-015, arts. 12-19 (rights of data subjects) | since |
| Loi n° 2013-015, sensitive data and offence recordsLoi n° 2013-015, arts. 9-10 (sensitive data and offence records) | since |
| Loi n° 2013-015, the Autorité, supervision, and sanctionsLoi n° 2013-015, arts. 20-56, 58-67 (the Autorité, supervision, and sanctions) | since |
| Loi n° 2013-015, transfer of personal data abroadLoi n° 2013-015, art. 11 (transfer of personal data abroad) | since |
 Mauritania
mr
6 instruments
| |
| Loi n° 2017-020 du 22 juillet 2017, automated decisionsLoi n° 2017-020 du 22 juillet 2017, art. 19 (automated individual decisions) | since |
| Loi n° 2017-020, Autorité de Protection des Données et sanctionsLoi n° 2017-020 du 22 juillet 2017, arts. 64-98 (Autorité de Protection des Données et sanctions) | since |
| Loi n° 2017-020, catégories sensibles de donnéesLoi n° 2017-020 du 22 juillet 2017, arts. 12-16, 37 (catégories sensibles de données) | since |
| Loi n° 2017-020, droits de la personne concernéeLoi n° 2017-020 du 22 juillet 2017, arts. 18, 50-63 (droits de la personne concernée) | since |
| Loi n° 2017-020, protection des données à caractère personnelLoi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel, arts. 1, 3-11, 17, 26-49 (principes généraux, formalités préalables et obligations du responsable) | since |
| Loi n° 2017-020, transferts vers un pays tiersLoi n° 2017-020 du 22 juillet 2017, arts. 20-25 (transferts vers un pays tiers) | since |
 Mauritius
mu
8 instruments
| |
| Data Protection Act 2017, automated individual decision makingData Protection Act 2017 (Act No. 20 of 2017), s. 38 (automated individual decision making) | since |
| Data Protection Act 2017, enforcement, offences and penaltiesData Protection Act 2017 (Act No. 20 of 2017), ss. 9, 42-43, 51-54 (enforcement, offences and penalties) | since |
| Data Protection Act 2017, establishment and lawful processingData Protection Act 2017 (Act No. 20 of 2017), ss. 1-28, 30 (establishment, principles, lawful processing, and personal data of a child) | since |
| Data Protection Act 2017, personal data breach notificationData Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach) | since |
| Data Protection Act 2017, rights of data subjectsData Protection Act 2017 (Act No. 20 of 2017), ss. 37, 39-41 (rights of data subjects) | since |
| Data Protection Act 2017, special categories of personal dataData Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data) | since |
| Data Protection Act 2017, transfer of personal data outside MauritiusData Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius) | since |
| Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 (Government Notice No. 117 of 2026), regs. 3 to 9 | from , in 2 months |
 Morocco
ma
6 instruments
| |
| Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataLoi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009), arts. 1-4, 12-20, 23, 25-26, 45-48 (dispositions générales, déclaration et sécurité) | in force |
| Law No. 09-08, automated decisionsLoi n° 09-08, art. 11 (automated individual decisions) | in force |
| Law No. 09-08, rights of the data subjectLoi n° 09-08, arts. 5-10 (droits de la personne concernée) | in force |
| Law No. 09-08, sensitive personal data and offense recordsLoi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées) | in force |
| Law No. 09-08, the CNDP and sanctionsLoi n° 09-08, arts. 27-42, 51-66 (Commission nationale, sanctions) | in force |
| Law No. 09-08, transfer of data to a foreign countryLoi n° 09-08, arts. 43-44 (transfert de données vers un pays étranger) | in force |
 Mozambique
mz
5 instruments
| |
| Electronic Transactions Law, Protection of Personal Electronic DataLei n.º 3/2017, de 9 de Janeiro, arts. 63(1)-(2), (5), 64, 65(1), (3) (dever de protecção de dados) | since |
| Electronic Transactions Law, data protection contraventions and enforcementLei n.º 3/2017, de 9 de Janeiro, arts. 67(m), 68(c), 69-70 (contravenções e fiscalização) | since |
| Electronic Transactions Law, data subject rights and information noticeLei n.º 3/2017, de 9 de Janeiro, arts. 63(3)-(4), (6), 65(2) (direitos do titular dos dados) | since |
| Constitution of Mozambique, Article 71(1), sensitive categories of personal dataArt. 71(1) (categorias sensíveis), Constituição da República de Moçambique (2004) | since |
| Constitution of Mozambique, Article 71(4), access to and correction of personal dataArt. 71(4) (acesso e rectificação), Constituição da República de Moçambique (2004) | since |
 Namibia
na
0 instruments
| |
| Data Protection Bill (notice of motion for leave to introduce)Data Protection Bill, notice of motion for leave to introduce, National Assembly Order Paper of | proposed |
 Niger
ne
7 instruments
| |
| Loi n° 2022-59, automated decisionsLoi n° 2022-59, art. 52 (automated individual decisions) | in force |
| Loi n° 2022-59, contrôle, sanctions et recoursLoi n° 2022-59, arts. 87-110 (contrôle, sanctions administratives, dispositions pénales et recours) | in force |
| Loi n° 2022-59, données sensibles, de santé et biométriquesLoi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques) | in force |
| Loi n° 2022-59, droits des personnes concernéesLoi n° 2022-59, arts. 51-52 (part) et 68-76 (droits des personnes concernées) | in force |
| Loi n° 2022-59, notification des violations de donnéesLoi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel) | in force |
| Loi n° 2022-59, protection des données à caractère personnelLoi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024, arts. 2-5, 29-41, 64-67 et 77-86 (objet, champ d'application, formalités, principes directeurs et outils de conformité) | in force |
| Loi n° 2022-59, transfert transfrontalier des donnéesLoi n° 2022-59, arts. 62-63 (transfert des données vers un autre État) | in force |
 Republic of the Congo
cg
7 instruments
| |
| Law No. 29-2019 on the Protection of Personal DataLoi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel, articles 2, 3, 5 à 12, 31 à 45, 63 à 70 et 79 à 91 (champ d'application, principes, formalités préalables et obligations du responsable de traitement) | in force |
| Law No. 29-2019, automated decisionsLoi n° 29-2019, art. 13 (automated individual decisions) | in force |
| Law No. 29-2019, cross-border transfer of personal dataLoi n° 29-2019, articles 23 à 25 (transfert transfrontalier de données à caractère personnel) | in force |
| Law No. 29-2019, personal-data breach notificationLoi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel) | in force |
| Law No. 29-2019, rights of the data subjectLoi n° 29-2019, articles 46 à 62 (droits de la personne concernée) | in force |
| Law No. 29-2019, sanctionsLoi n° 29-2019, articles 92 à 98 (sanctions administratives et pénales) | in force |
| Law No. 29-2019, special categories of personal dataLoi n° 29-2019, articles 4, 14 à 19 et 37 (catégories particulières de données et autorisation préalable) | in force |
 Rwanda
rw
7 instruments
| |
| Law N° 58/2021, automated decisionsLaw N° 58/2021, art. 21 (automated individual decisions) | since |
| Law relating to the Protection of Personal Data and PrivacyLaw N° 58/2021, arts. 1-8, 13-17, 29-41, 46-47 and 51-52, relating to the Protection of Personal Data and Privacy | since |
| Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storageLaw N° 58/2021, arts. 48-50 (cross-border transfer and data localisation) | since |
| Law relating to the Protection of Personal Data and Privacy, personal data breach notificationLaw N° 58/2021, arts. 43-45 (personal data breach notification) | since |
| Law relating to the Protection of Personal Data and Privacy, rights of the data subjectLaw N° 58/2021, arts. 18-20 and 22-26 and 42 (rights of the data subject and the information notice) | since |
| Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's dataLaw N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records) | since |
| Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offencesLaw N° 58/2021, arts. 27-28 and 53-65 (supervisory authority, penalties, offences and compensation) | since |
 Sao Tome and Principe
st
6 instruments
| |
| Lei n.º 03/2016, Protecção de Dados PessoaisLei n.º 03/2016, de 10 de Maio, sobre a Protecção de Dados Pessoais, arts. 1-6, 9, 15, 17-18, 21-26, 45, 47 | in force |
| Lei n.º 03/2016, automated decisionsLei n.º 03/2016, art. 13 (automated individual decisions) | in force |
| Lei n.º 03/2016, enforcement, offenses and the NAPPDLei n.º 03/2016, arts. 14, 27-44 (compensation, complaints, administrative offenses, crimes and the NAPPD) | in force |
| Lei n.º 03/2016, rights of the data holderLei n.º 03/2016, arts. 10-12 (information, access and opposition) | in force |
| Lei n.º 03/2016, sensitive categories and suspect recordsLei n.º 03/2016, arts. 7-8, 16 (sensitive categories, criminal-offense records and special security measures) | in force |
| Lei n.º 03/2016, transfer of personal data abroadLei n.º 03/2016, arts. 19-20 (transfer of personal data abroad) | in force |
 Seychelles
sc
8 instruments
| |
| Data Protection Act, 2023, application and processing principlesData Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles) | since |
| Data Protection Act, 2023, automated decisionsData Protection Act, 2023 (Act 24 of 2023), s. 30(2) (automated individual decisions) | since |
| Data Protection Act, 2023, cross-border data flowsData Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows) | since |
| Data Protection Act, 2023, enforcement and penaltiesData Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties) | since |
| Data Protection Act, 2023, personal data breach notificationData Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach) | since |
| Data Protection Act, 2023, records of processing activities and logs of processing operationsData Protection Act, 2023 (Act 24 of 2023), ss. 37-38 (records of processing activities and logging) | since |
| Data Protection Act, 2023, rights of data subjectsData Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights) | since |
| Data Protection Act, 2023, sensitive data and data of minorsData Protection Act, 2023 (Act 24 of 2023), ss. 22-24 (processing special categories of personal data) | since |
 Somalia
so
7 instruments
| |
| Data Protection Act No. 005 of 2023Data Protection Act, Law No. 005 of 2023 (Federal Republic of Somalia), arts. 4-5, 14-15, 17, 19, 24, 29, 32-34 | in force |
| Data Protection Act, 2023, automated decisionsData Protection Act, Law No. 005 of 2023, art. 23 (automated individual decisions) | in force |
| Data Protection Act, 2023, complaints, orders of the Authority and civil remediesData Protection Act, Law No. 005 of 2023, arts. 35-40 (complaints, orders and civil remedies) | in force |
| Data Protection Act, 2023, cross-border transfers of personal dataData Protection Act, Law No. 005 of 2023, arts. 30-31 (cross-border transfers) | in force |
| Data Protection Act, 2023, information to the data subject and rights of the data subjectData Protection Act, Law No. 005 of 2023, arts. 18, 20-22 (information and rights of the data subject) | in force |
| Data Protection Act, 2023, personal data breach notificationData Protection Act, Law No. 005 of 2023, arts. 25-27 (data breach notifications) | in force |
| Data Protection Act, 2023, sensitive personal data and children's consentData Protection Act, Law No. 005 of 2023, arts. 2(15), 14(5) and 16 (sensitive personal data and children) | in force |
 South Africa
za
9 instruments
| |
| Protection of Personal Information Act Regulations, complaints and administrative fine instalmentsRegulations Relating to the Protection of Personal Information, 2018, regulation 7 (complaints) and the administrative fines regulation, as amended by Government Notice 6126 of | since |
| Protection of Personal Information Act Regulations, objection and correction requestsRegulations Relating to the Protection of Personal Information, 2018, regulations 2 and 3, as substituted by Government Notice 6126 of | since |
| POPIA, automated decisionsPOPIA, s. 71 (automated individual decisions) | since |
| Protection of Personal Information Act 4 of 2013 (POPIA)Protection of Personal Information Act 4 of 2013 (POPIA), ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation) | since |
| Protection of Personal Information Act, cross-border transferPOPIA, s. 72 (transfer of personal information outside the Republic) | since |
| Protection of Personal Information Act, notification of security compromisesPOPIA, s. 22 (notification of security compromises) | since |
| Protection of Personal Information Act, rights of data subjectsPOPIA, ss. 18, 23-25 and 69-70 (the information notice, access and correction, and direct marketing) | since |
| Protection of Personal Information Act, special personal information and childrenPOPIA, ss. 26-35 (special personal information and children) | since |
| Protection of Personal Information Act, the Information Regulator, enforcement and penaltiesPOPIA, ss. 39-54 and 73-109 (the Information Regulator, enforcement, civil remedies, offences and administrative fines) | since |
 Tanzania
tz
15 instruments
| |
| Personal Data Protection (Collection and Processing) Regulations, automated decision makingPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), reg. 19 (rights in relation to automated decision making) | since |
| Personal Data Protection (Collection and Processing) Regulations, cancellation of registration, offences and complaintsPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 12 to 14, 34(4), 35 and 36 (cancellation, appeal, offences and complaints) | since |
| Personal Data Protection (Collection and Processing) Regulations, data protection officer and impact assessmentPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 32 to 34 (data protection officer and impact assessment) | since |
| Personal Data Protection (Collection and Processing) Regulations, permit to transfer personal data out of the countryPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 20 to 22 (permit to transfer personal data out of the country) | since |
| Personal Data Protection (Collection and Processing) Regulations, procedures for data subject requestsPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 15 to 18 (preventing processing, rectification, erasure and children) | since |
| Personal Data Protection (Collection and Processing) Regulations, processing obligations and protection by designPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 23 to 25 (processing obligations, protection by design and lawfulness) | since |
| Personal Data Protection (Collection and Processing) Regulations, registration of controllers and processorsPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 4, 7, 8 and 10 (registration) | since |
| Personal Data Protection (Collection and Processing) Regulations, security of personal data and breach proceduresPersonal Data Protection (Personal Data Collection and Processing) Regulations, 2023 (GN No. 449C of 2023), regs. 23(g) and 27 (security of personal data), as amended by GN No. 808 of 2024 | since |
| Personal Data Protection Act, 2022Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 1-5, 14, 21-26 (principles, application and registration) | since |
| Personal Data Protection Act, 2022, automated decision makingPersonal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 33(1)(c) and 36 (automated decision making) | since |
| Personal Data Protection Act, 2022, investigation, enforcement and offencesPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty) | since |
| Personal Data Protection Act, 2022, rights of data subjectsPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VI (ss. 33-35, 37-38, rights of data subjects and compensation) | since |
| Personal Data Protection Act, 2022, security and breach notificationPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data) | since |
| Personal Data Protection Act, 2022, sensitive personal dataPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) | since |
| Personal Data Protection Act, 2022, transborder data flowPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection) | since |
 Tunisia
tn
5 instruments
| |
| Organic Act on the Protection of Personal DataLoi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel, arts. 1-12, 16-26, 44-49, 53-61, 66-74, 104-105 (comprehensive regime) | since |
| Organic Act on the Protection of Personal Data, cross-border transferLoi organique n° 2004-63, arts. 50-52 (transfert des données à l'étranger) | since |
| Organic Act on the Protection of Personal Data, enforcement and sanctionsLoi organique n° 2004-63, arts. 75-103 (l'Instance et les sanctions) | since |
| Organic Act on the Protection of Personal Data, rights of the data subjectLoi organique n° 2004-63, arts. 27, 29-43 (droits de la personne concernée) | since |
| Organic Act on the Protection of Personal Data, sensitive categories and minorsLoi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs) | since |
 Uganda
ug
7 instruments
| |
| Data Protection and Privacy Act, 2019, automated decisionsData Protection and Privacy Act, 2019, s. 27 (automated individual decisions) | since |
| Data Protection and Privacy Act, 2019, breach notificationData Protection and Privacy Act, 2019, s. 23 (breach notification) | since |
| Data Protection and Privacy Act, 2019, children and special personal dataData Protection and Privacy Act, 2019, ss. 8-9 (children and special personal data) | since |
| Data Protection and Privacy Act, 2019, comprehensive personal-data regimeData Protection and Privacy Act, 2019 (Chapter 97), ss. 1-7, 10-12, 14-15, 17-18, 20-22, 29-30 (principles, lawful basis, security and registration) | since |
| Data Protection and Privacy Act, 2019, cross-border transferData Protection and Privacy Act, 2019, s. 19 (cross-border transfer) | since |
| Data Protection and Privacy Act, 2019, enforcement and offencesData Protection and Privacy Act, 2019, ss. 31-38 (enforcement and offences) | since |
| Data Protection and Privacy Act, 2019, rights of data subjectsData Protection and Privacy Act, 2019, ss. 13, 16, 24-26, 28 (rights of data subjects) | since |
 Zambia
zm
7 instruments
| |
| Data Protection Act, 2021, automated decisionsData Protection Act, 2021, s. 62 (automated individual decisions) | since |
| Data Protection Act, 2021, notification of a security breachData Protection Act, 2021, s. 49 (notification of a security breach) | since |
| Data Protection Act, 2021, offences, penalties, complaints and redressData Protection Act, 2021, ss. 18, 55 and 68-77 (offences, penalties, complaints and redress) | since |
| Data Protection Act, 2021, personal data processing frameworkData Protection Act, 2021 (Act No. 3 of 2021), general duties (ss. 1-13, 15-16, 19-48 and 50-57) | since |
| Data Protection Act, 2021, rights of the data subjectData Protection Act, 2021, ss. 58-61, 63-67 (rights of the data subject) | since |
| Data Protection Act, 2021, sensitive personal data, children and vulnerable personsData Protection Act, 2021, ss. 14 and 17 (sensitive personal data, children and vulnerable persons) | since |
| Data Protection Act, 2021, transfer of personal data outside the RepublicData Protection Act, 2021, ss. 70-71 (transfer of personal data outside the Republic) | since |
 Zimbabwe
zw
9 instruments
| |
| Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), licensing, the data protection officer and security (ss. 3-9 and 11-16) | since |
| Cyber and Data Protection Regulations 2024, children's information and automated decisionsStatutory Instrument 155 of 2024, regulation 10 (children's information and automated decisions) | since |
| Cyber and Data Protection Regulations 2024, security breach notificationStatutory Instrument 155 of 2024, regulation 17 (security breach notification) | since |
| Cyber and Data Protection Act [Chapter 12:07]Cyber and Data Protection Act, No. 5 of 2021 (Zimbabwe), general duties (ss. 8-10, 13, 15-18 and 20-27) | since |
| Cyber and Data Protection Act, rights of the data subjectCyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject) | since |
| Cyber and Data Protection Act, security breach notificationCyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification) | since |
| Cyber and Data Protection Act, sensitive, genetic, biometric and health dataCyber and Data Protection Act, No. 5 of 2021, ss. 11-12 (sensitive information and genetic, biometric and health data) | since |
| Cyber and Data Protection Act, the Authority, offences and appealsCyber and Data Protection Act, No. 5 of 2021, ss. 5-7, 30-34 (the Authority, offences and appeals) | since |
| Cyber and Data Protection Act, transfer of personal information outside ZimbabweCyber and Data Protection Act, No. 5 of 2021, ss. 28-29 (transfer outside Zimbabwe) | since |
| Oceania | |
 Australia
au
8 instruments
| |
| Privacy Act 1988 (Cth), Schedule 2, Statutory Tort for Serious Invasions of PrivacyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 2, inserting Schedule 2 to the Privacy Act 1988 | since |
| Privacy Act 1988 (Cth), Civil Penalty for Interference with PrivacyPrivacy Act 1988 (Cth), No. 119, 1988, s. 13H, inserted by the Privacy and Other Legislation Amendment Act 2024, No. 128, 2024 | since |
| Privacy Act 1988 (Cth), Civil Penalties for Serious Interference with PrivacyPrivacy Act 1988 (Cth), No. 119, 1988, s. 13G, as amended by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, No. 83, 2022 | since |
| Privacy Act 1988 (Cth), Notifiable Data Breaches SchemePrivacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL | since |
| Privacy Act 1988 (Cth), Australian Privacy PrinciplesPrivacy Act 1988 (Cth), No. 119, 1988, ss. 5B, 6, 6D, 13, 14, 15 and Schedule 1 | since |
| Privacy Act 1988 (Cth), Schedule 1, sensitive information categoriesPrivacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6 | since |
| Australian Consumer Law ss. 18, 29 and 34, Misleading Conduct and Representations as Applied to Data Practices and RankingsCompetition and Consumer Act 2010 (Cth), Schedule 2 (Australian Consumer Law), ss 18, 29 and 34 | since |
| Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making TransparencyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988 | from , in 5 weeks |
| Privacy Amendment (Personal Data Protection) Bill 2026 (exposure draft)Exposure Draft, Privacy Amendment (Personal Data Protection) Bill 2026 (Cth), amending the Privacy Act 1988, released for consultation by the Attorney-General's Department on | proposed |
 Kiribati
ki
7 instruments
| |
| Data Protection Act 2025Data Protection Act 2025, ss. 1-11, 14, 18, 21-22, 32-33 (lawful basis, purpose limitation, controller and processor duties, security measures, data protection impact assessments) | since |
| Data Protection Act 2025, automated decisionsData Protection Act 2025, s. 17 (right not to be subject to a decision based solely on automated processing) | since |
| Data Protection Act 2025, children and individuals lacking capacityData Protection Act 2025, s. 12 (consent for children and individuals lacking capacity) | since |
| Data Protection Act 2025, enforcement, offences and civil remediesData Protection Act 2025, ss. 26-31 (complaints, investigations, notices, offences and civil remedies) | since |
| Data Protection Act 2025, personal data breachesData Protection Act 2025, ss. 19-20 (personal data breaches) | since |
| Data Protection Act 2025, processing and transfers outside KiribatiData Protection Act 2025, ss. 23-25 (processing and transfers outside Kiribati) | since |
| Data Protection Act 2025, rights of a data subjectData Protection Act 2025, ss. 13, 15-16 (information notice and rights of data subjects) | since |
 Marshall Islands
mh
3 instruments
| |
| Personal Data Protection Act 2025, competent authority, remedies, and complaintsPersonal Data Protection Act 2025, ss. 406-408, 410-414, 416-417 (6 MIRC Ch. 4, P.L. 2025-43) | since |
| Personal Data Protection Act 2025, government personal-data protection principlesPersonal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43), ss. 401-405, 409, 415, 418 | since |
| Criminal Code 2011, Violation of Privacy (unlawful eavesdropping, surveillance, and breach of privacy of messages)Criminal Code 2011, 31 MIRC Ch. 1, sec. 250.12 | since |
 Micronesia
fm
1 instrument
| |
| FSM Telecommunications Act of 2014, confidentiality of customer information and communicationsFSM Telecommunications Act of 2014 (Public Law No. 18-52), Title 21 of the FSM Code, sections 349 and 350 | since |
 Nauru
nr
1 instrument
| |
| Communications and Broadcasting Act 2018, confidentiality of subscriber information and communicationsCommunications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70-71 | since |
 New Zealand
nz
5 instruments
| |
| Privacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 3A), inserted by the Privacy Amendment Act 2025 (NZ), No 53, s. 4 | since |
| Privacy Act 2020, Compliance Notices and OffencesPrivacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212 | since |
| Privacy Act 2020, Information Privacy Principle 12 (Disclosure Outside New Zealand)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12) | since |
| Privacy Act 2020, Information Privacy Principles and Extraterritorial ReachPrivacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13) | since |
| Privacy Act 2020, Notifiable Privacy BreachesPrivacy Act 2020 (NZ), No 31, ss. 112-118 | since |
 Samoa
ws
5 instruments
| |
| National Digital Identification Act 2024, categories of data barred from the Identity DatabaseNational Digital Identification Act 2024, No. 3 (Samoa), s. 27(3) and (4) (data the Identity Database may and may not hold) | since |
| National Digital Identification Act 2024, compliance, information requests and penaltiesNational Digital Identification Act 2024, No. 3 (Samoa), ss. 54 and 58 (non-compliance, information requests and penalties) | since |
| National Digital Identification Act 2024, personal data breach notificationNational Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification) | since |
| National Digital Identification Act 2024, registered persons' data-subject rightsNational Digital Identification Act 2024, No. 3 (Samoa), s. 51 (registered persons' rights) | since |
| Telecommunications Act 2005, confidentiality and protection of customer personal informationTelecommunications Act 2005, No. 20 (Samoa), ss. 48-51, 75A-75B (confidentiality and protection of customer personal information) | since |
 Solomon Islands
sb
1 instrument
| |
| Telecommunications Act 2009, Confidentiality and Consent DutiesTelecommunications Act 2009 (Solomon Islands), Part 11 (Relations with Consumers), ss. 72-74 | since |
 Tonga
to
12 instruments
| |
| Personal Health Information Protection Act 2025, access to and correction of personal health informationAct 31 of 2025, ss. 57-60 (Personal Health Information Protection Act 2025, access and correction) | from a date not yet set |
| Personal Health Information Protection Act 2025, complaints, directions, penalties and offencesAct 31 of 2025, ss. 76-81, 87 and 89 (Personal Health Information Protection Act 2025, enforcement) | from a date not yet set |
| Personal Health Information Protection Act 2025, consent, security, genetic and sensitive personal health informationAct 31 of 2025, ss. 10, 14(1), 31-32, 40 and 55 (Personal Health Information Protection Act 2025) | from a date not yet set |
| Personal Health Information Protection Act 2025, disclosure of personal health information outside TongaAct 31 of 2025, s. 54 (Personal Health Information Protection Act 2025, disclosure outside Tonga) | from a date not yet set |
| Personal Health Information Protection Act 2025, notification of theft, loss and unauthorized use or disclosureAct 31 of 2025, ss. 14(2)-(3), 19(5)(b) and 70(6) (Personal Health Information Protection Act 2025) | from a date not yet set |
| Privacy Act 2025, automated decisionsPrivacy Act 2025, s. 44 (right not to be subject to a decision based solely on automated processing) | from a date not yet set |
| Privacy Act 2025, comprehensive personal information protection regimePrivacy Act 2025 (Act 34 of 2025), ss. 1-6, 27, 30-32, 34-36 and 38 | from a date not yet set |
| Privacy Act 2025, notification to data subjects and rights of data subjectsPrivacy Act 2025, ss. 33, 42-43, 45-47 (notification and rights) | from a date not yet set |
| Privacy Act 2025, penalties, enforcement and third party actionsPrivacy Act 2025, ss. 52-66 (penalties, enforcement and investigation) | from a date not yet set |
| Privacy Act 2025, personal information breachesPrivacy Act 2025, s. 37 (personal information breaches) | from a date not yet set |
| Privacy Act 2025, sensitive personal information and childrenPrivacy Act 2025, ss. 28-29 (sensitive personal information and children) | from a date not yet set |
| Privacy Act 2025, transfers of personal information outside the KingdomPrivacy Act 2025, ss. 39-41 (transfers outside the Kingdom) | from a date not yet set |
 Vanuatu
vu
6 instruments
| |
| Data Protection and Privacy Act 2024, automated decisionsData Protection and Privacy Act No. 13 of 2024, s. 13 (data subject's right not to be subject to automated decision making) | since |
| Data Protection and Privacy Act 2024, comprehensive personal data protection regimeData Protection and Privacy Act No. 13 of 2024, ss. 2-5 and 8 | since |
| Data Protection and Privacy Act 2024, enforcement powers and offencesData Protection and Privacy Act No. 13 of 2024, ss. 18-30 | since |
| Data Protection and Privacy Act 2024, rights of the data subjectData Protection and Privacy Act No. 13 of 2024, ss. 9-12, 14 | since |
| Data Protection and Privacy Act 2024, special categories and children's personal dataData Protection and Privacy Act No. 13 of 2024, ss. 6-7 | since |
| Data Protection and Privacy Act 2024, transborder data flowsData Protection and Privacy Act No. 13 of 2024, ss. 15-17 | since |
| Other | |
 Bermuda
bm
6 instruments
| |
| Personal Information Protection Act 2016, Commissioner, enforcement and offencesPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 26-46, 48 (the Privacy Commissioner, orders, offences and penalties) | since |
| Personal Information Protection Act 2016, application and general principlesPersonal Information Protection Act 2016 (Bermuda), 2016:43, Parts 1-2 (application, exclusions and general principles) | since |
| Personal Information Protection Act 2016, breach of security notificationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security) | since |
| Personal Information Protection Act 2016, cross-border transfer of personal informationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 15 (transfer of personal information to an overseas third party) | since |
| Personal Information Protection Act 2016, rights of individualsPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals) | since |
| Personal Information Protection Act 2016, sensitive personal informationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 7 (sensitive personal information) | since |
 Cayman Islands
ky
4 instruments
| |
| Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offencesData Protection Act (2021 Revision), ss. 52-57 (Ombudsman investigatory powers, monetary penalties and offences) | since |
| Data Protection Act 2021 Revision, application, principles and data subject rightsData Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights) | since |
| Data Protection Act 2021 Revision, cross-border transfer of personal dataData Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply) | since |
| Data Protection Act 2021 Revision, personal data breach notificationData Protection Act (2021 Revision), s. 16 (personal data breaches) | since |
 Hong Kong
hk
6 instruments
| |
| Personal Data (Privacy) Ordinance, offences for disclosing personal data without consentPersonal Data (Privacy) Ordinance (Cap. 486), s. 64 | since |
| Personal Data (Privacy) Ordinance, use and provision of personal data in direct marketingPersonal Data (Privacy) Ordinance (Cap. 486), Part 6A, ss. 35C-35L | since |
| Personal Data (Privacy) Ordinance, access and correction of personal dataPersonal Data (Privacy) Ordinance (Cap. 486), ss. 18-19, 22-23, 26-27 and Schedule 1, principle 6 | since |
| Personal Data (Privacy) Ordinance, data protection principles 1 to 5Personal Data (Privacy) Ordinance (Cap. 486), s. 4 and Schedule 1, principles 1-5 | since |
| Personal Data (Privacy) Ordinance, enforcement notices and compensationPersonal Data (Privacy) Ordinance (Cap. 486), ss. 50, 50A and 66 | since |
| Personal Data (Privacy) Ordinance, transfer of personal data outside Hong KongPersonal Data (Privacy) Ordinance (Cap. 486), s. 33 | from a date not yet set |
 Kosovo
xk
8 instruments
| |
| Law No. 06/L-082 on Protection of Personal DataLaw No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale), arts. 1-6, 10, 23-32, 35-43, 73, 75-90 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, direct marketing lawful basis, and other sector-specific processing rules) | since |
| Law No. 06/L-082 on Protection of Personal Data, automated decisionsLaw No. 06/L-082 on Protection of Personal Data, art. 21 (automated individual decisions) | since |
| Law No. 06/L-082 on Protection of Personal Data, personal data breach notificationLaw No. 06/L-082 on Protection of Personal Data, arts. 33-34 (personal data breach notification) | since |
| Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penaltiesLaw No. 06/L-082 on Protection of Personal Data, arts. 52-72, 91-107 (remedies, the supervisory Agency, inspections, and administrative and criminal penalties) | since |
| Law No. 06/L-082 on Protection of Personal Data, rights of the data subjectLaw No. 06/L-082 on Protection of Personal Data, arts. 11-20, 22, 74 (rights of the data subject) | since |
| Law No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence dataLaw No. 06/L-082 on Protection of Personal Data, arts. 7-9 (special categories, children and criminal-offence data) | since |
| Law No. 06/L-082 on Protection of Personal Data, transfer of personal data to other states and international organisationsLaw No. 06/L-082 on Protection of Personal Data, arts. 44-51 (transfer of personal data to other states and international organisations) | since |
| Law No. 06/L-082 on Protection of Personal Data, use of biometric characteristicsLaw No. 06/L-082 on Protection of Personal Data, arts. 80-83 (use of biometric characteristics) | since |
 Taiwan
tw
1 instrument
| |
| Personal Data Protection Act (個人資料保護法)Personal Data Protection Act (個人資料保護法), Laws and Regulations Database of the Republic of China (Taiwan), pcode I0050021, as amended effective | since |
United States: states, territories and cities549 in 57 jurisdictions
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
Canada: provinces105 in 12 jurisdictions
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
Brazil: states3 in 1 jurisdiction
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
| Instrument | When |
|---|---|
| Goiás br/goias 3 instruments | |
| Law No. 22.520 of 2023, ban on abusive requests for a consumer's personal dataLei nº 22.520, de 28 de dezembro de 2023, com a redação da Lei nº 24.211, de 8 de abril de 2026 | since |
| Law No. 20.396 of 2019, biometric identification and image monitoring at football stadiumsLei nº 20.396, de 3 de janeiro de 2019 | since |
| Law No. 14.913 of 2004, consumer privacy and the sharing of personal information without consentLei nº 14.913, de 11 de agosto de 2004 | since |
What this page claims, and what it does not
The stages are the in-force tag's. Each filter is one of the
states the tag names across lexlint.io, in its words (in force, not yet in
force, blocked by a court, proposed, no longer in force, and never in force),
and each filter's label wears that tag's mark. In the tables a law in force
is unmarked, its date in plain text, and every other law wears the same tag
the rest of lexlint.io draws: highlighted, boxed, dotted, or struck with its
reason underlined. A withdrawn bill has a filter of its own, never in force:
the /law/<jurisdiction> docket leaves it out, and "no
longer in force" would be false of a law that never was.
Blocked by a court has its own filter. A law a court has blocked is neither in force nor gone: an injunction can be lifted on appeal, and the duty with it. Pooled with a repeal it would hide a count that reads as a signal, how contested a jurisdictional hook is. It is off by default, with the proposals and the laws that have ended.
One date column, and it says what kind of date it is. The date is the day the law started or starts to bind: the earlier of a published start date and the instrument's own date. Neither source is reliably the start, and the earlier one cannot make a law look newer than it is. The column draws the in-force tag, so a bare date never stands beside a law that has stopped: a law in force reads "since" its date, a law not yet in force is highlighted with its date and how far off it is, a law a court has blocked is boxed in red, and an ended law has its dates struck and its reason underlined. Nothing is inferred from our own review date.
The map is the table. Its fill is the count of instruments at the
stages you chose, binned on the same RAMP_BINS edges
/law/map uses, and it redraws on
every change. Point at, click, or tab to a jurisdiction for what applies there,
every stage it holds shown even when your filter is excluding it.
Three ways of showing nothing, and they are different claims. A jurisdiction washed pale holds privacy law your filter is excluding, so widening the filter brings it back. A hatched jurisdiction is one we track and hold no privacy law for at all: that is a statement about our research, not about the law. A white shape has no jurisdiction record for this topic at all. Only the first of the three moves when you change the filter; the other two are facts about us and hold still.
Nothing here needs the script. The default resultset is in the
HTML: counts, tally, map fills and the hidden rows are all rendered at
build. The script recomputes them when a box changes and does nothing else,
which is what lets this page ship under script-src 'self' and
be read whole by a crawler.
Every instrument here links its own note page, which carries the primary source and the date it was read. This is a research index, not legal advice.