Law / Privacy
Privacy law, instrument by instrument
Every privacy law instrument LexLint holds, grouped by the place that made it. Choose which stages of law to show: the map, the counts and the tables all answer to that choice. To see every area of law, follow Law in the breadcrumb above.
- 1
- 5
- 10
- 20+
- instruments shown
- law on file, none at these stages
- tracked, no law on file
- not tracked
Unions6 in 1 place
Law made above the state, binding its members.
| Stage | Instrument | In force from |
|---|---|---|
| European Union eu 6 instruments | ||
| Digital Omnibus Regulation Proposal, GDPR and ePrivacy ReformCOM(2025) 837 final | [proposed] | |
| GDPR Article 9, Special Categories of Personal Data Including Biometric DataRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 12-22, Data Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and RemediesRegulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| General Data Protection Regulation (GDPR), Comprehensive RegimeRegulation (EU) 2016/679 | 2018-05-25 | |
Countries920 in 178 places
Grouped by region, the European Union heading its member states as a block; alphabetical within each group.
| Stage | Instrument | In force from |
|---|---|---|
| Europe | ||
| European Union · 27 member states | ||
| Austria at 6 instruments | ||
| Datenschutzgesetz (DSG), Data Protection ActDatenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 24/2018 | 2018-05-25 | |
| GDPR Article 22 and DSG Sections 42-45, Automated Decision-Making in AustriaRegulation (EU) 2016/679, Art. 22; Datenschutzgesetz (DSG) §§42-45 | 2018-05-25 | |
| GDPR Article 82 and Datenschutzbehörde Enforcement in AustriaRegulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in AustriaRegulation (EU) 2016/679, Art. 9, as applied in Austria | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in AustriaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from AustriaRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Belgium be 10 instruments | ||
| Act of 3 December 2017, GBA/APD and Litigation ChamberLoi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916) | 2018-05-25 | |
| Act of 30 July 2018 Article 10/1, Recorded Commercial CommunicationsLoi du 30 juillet 2018, Art. 10/1, as inserted by the Act of 21 December 2021, article 255 | 2022-01-10 | |
| Act of 30 July 2018 Article 9 and GBA/APD Biometric Recommendation and EnforcementLoi du 30 juillet 2018, Art. 9; GBA/APD Aanbeveling nr. 01/2021; GBA/APD Beslissing ten gronde nr. 114/2024 | 2018-09-05 | |
| Act of 30 July 2018 Articles 8-10, Special-Category Processing GroundsLoi du 30 juillet 2018, Arts. 8-10 | 2018-09-05 | |
| Act of 30 July 2018 Title 5, Action en Cessation, and GDPR Article 22Loi du 30 juillet 2018, Arts. 11-17, 209-211, 220; Regulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| Act of 30 July 2018 Title 6 Chapter II, Criminal SanctionsLoi du 30 juillet 2018, Arts. 222-230 | 2018-09-05 | |
| Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal DataLoi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581) | 2018-09-05 | |
| Code de Droit Économique Article XVII.37, 10 degrees/1, Collective Redress for GDPR ClaimsCode de droit economique, Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5); Loi du 30 juillet 2018, Art. 222, 4 | 2018-05-25 | |
| Bulgaria bg 6 instruments | ||
| GDPR Article 9 and PDPA Employment and National-ID-Number RulesRegulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions | [future] | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| KZLD Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)Закон за защита на личните данни (ЗЗЛД), Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of 4 January 2002, as amended) | 2019-02-26 | |
| Croatia hr 6 instruments | ||
| AZOP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Act on the Implementation of the General Data Protection RegulationZakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18 | 2018-05-25 | |
| Croatian Act Articles 21-23, Biometric Data by SectorZakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23 | 2018-05-25 | |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Cyprus cy 6 instruments | ||
| GDPR Article 22 and Law 125(I)/2018, Automated Decisions in CyprusRegulation (EU) 2016/679, Art. 22; Law 125(I)/2018 | 2018-07-31 | |
| GDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in CyprusRegulation (EU) 2016/679, Art. 9; Law 125(I)/2018 | 2018-07-31 | |
| GDPR Articles 33-34, Breach Notification in CyprusRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and ODPC Enforcement in CyprusRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from CyprusRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Law 125(I)/2018, Cyprus GDPR SupplementLaw 125(I)/2018 of 2018 | 2018-07-31 | |
| Czech Republic cz 6 instruments | ||
| Act on Personal Data ProcessingZakon c. 110/2019 Sb., o zpracovani osobnich udaju | 2019-04-24 | |
| GDPR Article 9, Special Categories Including Biometric DataRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| UOOU Enforcement, GDPR Article 82, and the Act on Collective Civil Court ProceedingRegulation (EU) 2016/679, Arts. 82-83; Zakon c. 179/2024 Sb., o hromadnem obcanskem soudnim rizeni; Zakon c. 180/2024 Sb. | 2024-07-01 | |
| Denmark dk 6 instruments | ||
| Danish Data Protection Act (Databeskyttelsesloven)Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of 8 March 2024 | 2018-05-25 | |
| GDPR Article 22 and Data Subject Rights as Applied in DenmarkRegulation (EU) 2016/679, Arts. 12-23; Databeskyttelsesloven | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in DenmarkRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in DenmarkRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and Datatilsynet Enforcement in DenmarkRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from DenmarkRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Estonia ee 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in EstoniaRegulation (EU) 2016/679, Arts. 15-22; Isikuandmete kaitse seadus | 2019-01-15 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in EstoniaRegulation (EU) 2016/679, Art. 9 | 2019-01-15 | |
| GDPR Articles 33-34, Breach Notification in EstoniaRegulation (EU) 2016/679, Arts. 33-34 | 2019-01-15 | |
| GDPR Articles 82-83 and AKI Enforcement in EstoniaRegulation (EU) 2016/679, Arts. 82-83 | 2019-01-15 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from EstoniaRegulation (EU) 2016/679, Arts. 44-50 | 2019-01-15 | |
| Personal Data Protection Act (Isikuandmete kaitse seadus)Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted 12 December 2018 | 2019-01-15 | |
| Finland fi 6 instruments | ||
| Data Protection Act (Tietosuojalaki)Tietosuojalaki 1050/2018 (amendments up to 29/2024 included) | 2019-01-01 | |
| GDPR Article 22 and Data Protection Act Sections 33-34, Data Subject Rights in FinlandRegulation (EU) 2016/679, Arts. 15-22; Tietosuojalaki 1050/2018 secs. 21, 33-34 | 2019-01-01 | |
| GDPR Article 9 and Data Protection Act Section 6, Special Categories in FinlandRegulation (EU) 2016/679, Art. 9; Tietosuojalaki 1050/2018 sec. 6 | 2019-01-01 | |
| GDPR Articles 33-34, Breach Notification in FinlandRegulation (EU) 2016/679, Arts. 33-34 | 2019-01-01 | |
| GDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in FinlandRegulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24 | 2019-01-01 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from FinlandRegulation (EU) 2016/679, Arts. 44-50; Tietosuojalaki 1050/2018 sec. 27 | 2019-01-01 | |
| France fr 8 instruments | ||
| CNIL Enforcement, GDPR Article 83 and Code Pénal Articles 226-16 to 226-22-2Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 | 2018-05-25 | |
| CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique | 2019-01-10 | |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| Loi 78-17 Article 47, Automated Administrative DecisionsLoi n. 78-17 du 6 janvier 1978, Art. 47 | 1978-01-06 | |
| Loi Informatique et Libertés, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)Loi n. 78-17 du 6 janvier 1978 relative a l'informatique, aux fichiers et aux libertes, as amended (JORFTEXT000000886460) | 2018-05-25 | |
| Germany de 6 instruments | ||
| Bundesdatenschutzgesetz (BDSG), Federal Data Protection ActBundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended | 2018-05-25 | |
| GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in GermanyRegulation (EU) 2016/679, Art. 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 | 2018-05-25 | |
| GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehörden Enforcement in GermanyRegulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43 | 2018-05-25 | |
| GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in GermanyRegulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3) | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in GermanyRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GermanyRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Greece gr 6 instruments | ||
| GDPR Article 22 and Law 4624/2019 Article 27, Data Subject Rights and Employment in GreeceRegulation (EU) 2016/679, Arts. 12-23; Law 4624/2019, Art. 27 | 2019-08-29 | |
| GDPR Article 9 and Law 4624/2019, Special Categories in GreeceRegulation (EU) 2016/679, Art. 9; Law 4624/2019 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in GreeceRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and HDPA Enforcement in GreeceRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GreeceRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Law 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)Law 4624/2019, FEK A' 137/29-08-2019 | 2019-08-29 | |
| Hungary hu 6 instruments | ||
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Infotörvény (Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information)2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol | 2012-01-01 | |
| Infotörvény Definitions, Biometric and Special-Category Data2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat") | 2018-05-25 | |
| Infotörvény Sections 25/J-25/K, Breach Notification, Inserted by Act XXXVIII of 20182011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section | 2019-04-26 | |
| NAIH Enforcement, GDPR Article 82, and Infotörvény Section 24 SérelemdíjRegulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section | 2012-01-01 | |
| Ireland ie 7 instruments | ||
| DPC Guidance: AI, Large Language Models and Data ProtectionData Protection Commission, "AI, Large Language Models and Data Protection" guidance (18 July 2024) | 2024-07-18 | |
| Data Protection Act 2018Data Protection Act 2018 (No. 7 of 2018) | 2018-05-25 | |
| GDPR Article 22, Automated Decision-Making in IrelandRegulation (EU) 2016/679, Art. 22, as transposed by the Data Protection Act 2018 | 2018-05-25 | |
| GDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in IrelandRegulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117 | 2018-05-25 | |
| GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in IrelandRegulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in IrelandRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from IrelandRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Italy it 7 instruments | ||
| Codice Privacy (Personal Data Protection Code), as Amended for GDPR AlignmentDecreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101 | 2018-09-19 | |
| GDPR Article 22 and the Garante's OpenAI/ChatGPT EnforcementRegulation (EU) 2016/679, Art. 22; Garante Provvedimento 30 marzo 2023 | 2018-05-25 | |
| GDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis)Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) | 2018-05-25 | |
| GDPR Article 9 Special Categories and Codice Privacy Article 167(2)Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| Garante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data PrescriptionsGarante Provvedimento n. 146 del 5 giugno 2019 | 2019-06-05 | |
| Latvia lv 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in LatviaRegulation (EU) 2016/679, Arts. 15-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LatviaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and DVI Enforcement in LatviaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LatviaRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Personal Data Processing Law (Fizisko personu datu apstrādes likums)Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force 5 July 2018 | 2018-07-05 | |
| Personal Data Processing Law Article 25(2), Special Categories in LatviaFizisko personu datu apstrades likums, Art. 25(2); Regulation (EU) 2016/679, Art. 9 | 2018-07-05 | |
| Lithuania lt 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in LithuaniaRegulation (EU) 2016/679, Arts. 15-22 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in LithuaniaRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LithuaniaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and VDAI Enforcement in LithuaniaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V and VDAI Article 46(3) Authorization, Cross-Border Transfer from LithuaniaRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Law on Legal Protection of Personal DataRepublic of Lithuania Law No. XIII-1426, in force 16 July 2018 (as amended) | 2018-07-16 | |
| Luxembourg lu 6 instruments | ||
| Act of 1 August 2018 on the Organisation of the CNPD and the General Data Protection FrameworkLoi du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees et du regime general sur la protection des donnees | 2018-08-20 | |
| GDPR Article 22, Automated Decisions as Applied in LuxembourgRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in LuxembourgRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LuxembourgRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and CNPD Enforcement in LuxembourgRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LuxembourgRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Malta mt 6 instruments | ||
| Data Protection Act, Chapter 586 of the Laws of MaltaData Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Article 22 and Cap. 586, Automated Decisions in MaltaRegulation (EU) 2016/679, Art. 22; Data Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in MaltaRegulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in MaltaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and IDPC Enforcement in MaltaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from MaltaRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Netherlands nl 7 instruments | ||
| AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action RegimeRegulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) | 2018-05-25 | |
| GDPR Articles 33-34 and UAVG Article 42, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| GDPR and UAVG Articles 40-43, Data-Subject Rights and Journalistic ExceptionRegulation (EU) 2016/679, Arts. 12-23; UAVG, Arts. 40, 41, 43 | 2018-05-25 | |
| UAVG Article 29, Biometric-Data Exception for Authentication or SecurityUAVG, Art. 29 | 2018-05-25 | |
| UAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number DataUAVG, Arts. 30-33, 46 | 2018-05-25 | |
| Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), GDPR Implementation ActWet van 16 mei 2018, houdende regels ter uitvoering van de Algemene verordening gegevensbescherming (BWBR0040940) | 2018-05-25 | |
| Poland pl 6 instruments | ||
| Act on the Protection of Personal Data of 10 May 2018Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000 | 2018-05-25 | |
| GDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric DataRegulation (EU) 2016/679, Art. 9(1); Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b) | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| GDPR Data-Subject Rights, Act Articles 92-97Regulation (EU) 2016/679, Arts. 12-23; Ustawa z 10 maja 2018 r., Arts. 92-97 | 2018-05-25 | |
| UODO Enforcement, GDPR Article 82, and Act Articles 98, 101-108Regulation (EU) 2016/679, Art. 83; Ustawa z 10 maja 2018 r., Arts. 98, 101-108 | 2018-05-25 | |
| Portugal pt 6 instruments | ||
| CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in PortugalCNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Article 22 and Lei 58/2019, Automated Decisions in PortugalRegulation (EU) 2016/679, Art. 22; Lei n.o 58/2019, de 8 de agosto | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in PortugalRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in PortugalRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from PortugalRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execução do RGPD)Lei n.o 58/2019, de 8 de agosto | 2019-08-08 | |
| Romania ro 6 instruments | ||
| ANSPDCP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP RulesRegulation (EU) 2016/679, Art. 9; Legea nr. 190/2018, automated decision-making and national identification number provisions | [future] | |
| GDPR Articles 12-22, Data-Subject Rights and Electronic Employee MonitoringRegulation (EU) 2016/679, Arts. 12-22; Legea nr. 190/2018, electronic monitoring of employees | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Law No. 190/2018 on Measures for the Implementation of Regulation (EU) 2016/679Legea nr. 190/2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679 | 2018-07-31 | |
| Slovakia sk 6 instruments | ||
| Act on the Protection of Personal DataZakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov | 2018-05-25 | |
| GDPR Article 9 and Act Section 78, National Birth NumberRegulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78 | [future] | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Office for Personal Data Protection Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Slovenia si 6 instruments | ||
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| GDPR Data-Subject Rights and ZVOP-2 Article 11, Judicial ProtectionRegulation (EU) 2016/679, Arts. 12-22; ZVOP-2, Art. 11 | 2018-05-25 | |
| Informacijski pooblaščenec Enforcement, GDPR Article 82, and ZVOP-2 Articles 114-116Regulation (EU) 2016/679, Art. 82; ZVOP-2, Arts. 105, 114-116 | 2018-05-25 | |
| ZVOP-2 Chapter 4 (Articles 81-84) and Article 80, Biometric and Genetic DataZVOP-2, Arts. 80-84, 105 | 2023-01-26 | |
| Zakon o varstvu osebnih podatkov (ZVOP-2), Personal Data Protection ActZakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS, st. 163/22 | 2023-01-26 | |
| Spain es 6 instruments | ||
| AEPD Enforcement, GDPR Article 82 and LOPDGDD Título IXRegulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 | 2018-05-25 | |
| GDPR Article 9 and AEPD Biometric Guidance, Special CategoriesRegulation (EU) 2016/679, Art. 9; LOPDGDD, Art. 9 | 2018-12-07 | |
| GDPR Articles 33-34 and LOPDGDD Article 69, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 69, Art. 73(r)-(s) | 2018-05-25 | |
| LOPDGDD Título III and Título X, Data-Subject and Digital RightsLOPDGDD, Arts. 11-18, 93-96 | 2018-12-07 | |
| LOPDGDD Título VI, International Transfers, Layered on GDPR Chapter VRegulation (EU) 2016/679, Arts. 44-49, 83(5); LOPDGDD, Arts. 40-43, 72.1(l) | 2018-05-25 | |
| Ley Orgánica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive RegimeLey Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales (BOE-A-2018-16673) | 2018-12-07 | |
| Sweden se 7 instruments | ||
| Dataskyddslagen (Data Protection Act), GDPR-Complementing ProvisionsDataskyddslagen, SFS 2018:218 | 2018-05-25 | |
| Dataskyddslagen Chapter 7, Data-Subject Rights and Appeal RoutesDataskyddslagen, ch. 7 | 2018-05-25 | |
| GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition DecisionRegulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| IMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group ProceedingsRegulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang | 2018-05-25 | |
| Kamerabevakningslagen (Camera Surveillance Act)Kamerabevakningslag, SFS 2018:1200 | 2018-08-01 | |
| Europe (non EU) | ||
| Albania al 6 instruments | ||
| Law No. 124/2024 On the Protection of Personal DataLaw No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025 | 2025-01-31 | |
| Law No. 124/2024, Commissioner, remedies, liability and penaltiesLaw No. 124/2024, Arts. 75-95 (Commissioner, remedies, liability and penalties) | 2025-01-31 | |
| Law No. 124/2024, international data transferLaw No. 124/2024, Arts. 39-42 (international data transfer) | 2025-01-31 | |
| Law No. 124/2024, notification of a personal data breachLaw No. 124/2024, Art. 29 (notification of a personal data breach) | 2025-01-31 | |
| Law No. 124/2024, rights of the data subjectLaw No. 124/2024, Arts. 12-21 (rights of the data subject) | 2025-01-31 | |
| Law No. 124/2024, special categories of personal data, criminal records and children's dataLaw No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) | 2025-01-31 | |
| Andorra ad 6 instruments | ||
| LQPD, Llei 29/2021 del 28 d'octubreLQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) | 2022-05-17 | |
| LQPD, personal data breach notificationLlei 29/2021, arts. 36-37 (personal data breach notification) | 2022-05-17 | |
| LQPD, rights of the data subjectLlei 29/2021, arts. 15-26 (rights of the data subject) | 2022-05-17 | |
| LQPD, special categories, children and criminal-offence dataLlei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) | 2022-05-17 | |
| LQPD, the Andorran Data Protection Agency, its powers, infractions and sanctionsLlei 29/2021, arts. 46-74 (the Andorran Data Protection Agency, its powers, infractions and sanctions) | 2022-05-17 | |
| LQPD, transfers of personal data to third countries or international organisationsLlei 29/2021, arts. 42-45 (transfers of personal data to third countries or international organisations) | 2022-05-17 | |
| Belarus by 6 instruments | ||
| Law of the Republic of Belarus On Personal Data ProtectionZakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021), arts. 1-7, 17 and 20-21 (general processing and security) | 2021-11-15 | |
| Law of the Republic of Belarus On Personal Data Protection, authorized agency and liabilityLaw No. 99-Z, arts. 15, 18-19 (authorized agency and liability) | 2021-11-15 | |
| Law of the Republic of Belarus On Personal Data Protection, cross border transfer of personal dataLaw No. 99-Z, art. 9 (cross border transfer of personal data) | 2021-11-15 | |
| Law of the Republic of Belarus On Personal Data Protection, notification of personal data protection violationsLaw No. 99-Z, art. 16.1 (notification of personal data protection violations) | 2021-11-15 | |
| Law of the Republic of Belarus On Personal Data Protection, rights of the personal data subjectLaw No. 99-Z, arts. 10-14 (rights of the personal data subject) | 2021-11-15 | |
| Law of the Republic of Belarus On Personal Data Protection, special personal dataLaw No. 99-Z, arts. 1, 8 (special personal data) | 2021-11-15 | |
| Bosnia and Herzegovina ba 7 instruments | ||
| Law on the Protection of Personal Data of Bosnia and HerzegovinaLaw on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable 4 October 2025, arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, biometric data processingLaw on the Protection of Personal Data, arts. 57a-57b (biometric data processing) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transferLaw on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notificationLaw on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, rights of data subjectsLaw on the Protection of Personal Data, arts. 14-25, 67-74 (rights of data subjects) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consentLaw on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) | 2025-10-04 | |
| Law on the Protection of Personal Data of Bosnia and Herzegovina, the Agency, enforcement and penaltiesLaw on the Protection of Personal Data, arts. 96-115 (enforcement, supervision and penalties) | 2025-10-04 | |
| Iceland is 6 instruments | ||
| Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from IcelandLog nr. 90/2018, Art. 16 | 2018-07-15 | |
| Act No. 90/2018 Articles 3(14) and 9, Special Categories in IcelandLog nr. 90/2018, Art. 3(14), Art. 9 | 2018-07-15 | |
| Act No. 90/2018 on Data Protection and the Processing of Personal DataLog nr. 90/2018 um personuvernd og vinnslu personuupplysinga (Act No. 90/2018), passed by Althingi 27 June 2018, in force 15 July 2018 | 2018-07-15 | |
| Act No. 90/2018, Breach Notification in IcelandLog nr. 90/2018 (breach notification provisions) | 2018-07-15 | |
| Act No. 90/2018, Data Subject Rights in IcelandLog nr. 90/2018 (data subject rights provisions) | 2018-07-15 | |
| Act No. 90/2018, Persoonuvernd Enforcement in IcelandLog nr. 90/2018 (enforcement provisions) | 2018-07-15 | |
| Liechtenstein li 6 instruments | ||
| DSG Automated-Decision Rights in LiechtensteinDSG, LGBl. 2018 Nr. 272, automated decision provisions | 2019-01-01 | |
| DSG Breach Notification in LiechtensteinDSG, LGBl. 2018 Nr. 272, breach notification provisions | 2019-01-01 | |
| DSG Cross-Border Transfer Chapter and EEA Joint Committee Decision No. 154/2018Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272; EEA Joint Committee Decision No. 154/2018 | 2019-01-01 | |
| DSG Datenschutzstelle Enforcement in LiechtensteinDSG, LGBl. 2018 Nr. 272, enforcement provisions | 2019-01-01 | |
| DSG Special-Category Data and Datenschutzstelle Biometric-Data Concept in LiechtensteinDSG, LGBl. 2018 Nr. 272, special categories provisions | 2019-01-01 | |
| Datenschutzgesetz (DSG)Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, dated 4 October 2018, in effect 1 January 2019 | 2019-01-01 | |
| Moldova md 6 instruments | ||
| Law No. 195/2024 on Personal Data ProtectionLegea Nr. 195 din 25 iulie 2024, articolele 1-7, 11 si 24-43 (principii, temeiuri legale si obligatiile operatorului) | 2026-08-23 | |
| Moldova Law No. 195/2024, personal data breach notificationLegea Nr. 195 din 25 iulie 2024, articolele 33-34 (notificarea incalcarii securitatii datelor) | 2026-08-23 | |
| Moldova Law No. 195/2024, rights of the data subjectLegea Nr. 195 din 25 iulie 2024, articolele 12-23 (drepturile subiectului de date) | 2026-08-23 | |
| Moldova Law No. 195/2024, special categories, a child's consent and conviction dataLegea Nr. 195 din 25 iulie 2024, articolele 8-10 (categorii speciale de date si consimtamantul copilului) | 2026-08-23 | |
| Moldova Law No. 195/2024, the Centre, complaints, compensation and sanctionsLegea Nr. 195 din 25 iulie 2024, articolele 55-86 (Centrul National, plangeri, despagubiri si sanctiuni) | 2026-08-23 | |
| Moldova Law No. 195/2024, transfers of personal data abroadLegea Nr. 195 din 25 iulie 2024, articolele 44-50 (transferuri catre tari terte) | 2026-08-23 | |
| Monaco mc 6 instruments | ||
| Loi sur la Protection des Données PersonnellesLoi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) | 2024-12-13 | |
| Loi sur la Protection des Données Personnelles, autorite de controle et sanctionsLoi n. 1.565 du 3 decembre 2024, arts. 37-57, 102-106 (supervisory authority, sanctions and right to reparation) | 2024-12-13 | |
| Loi sur la Protection des Données Personnelles, données sensibles et mineursLoi n. 1.565 du 3 decembre 2024, arts. 2, 6-8, 77 (sensitive data, biometric data and minors) | 2024-12-13 | |
| Loi sur la Protection des Données Personnelles, droits de la personne concernéeLoi n. 1.565 du 3 decembre 2024, arts. 10-20 (rights of the data subject) | 2024-12-13 | |
| Loi sur la Protection des Données Personnelles, notification des violations de donnéesLoi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification) | 2024-12-13 | |
| Loi sur la Protection des Données Personnelles, transfert des donnéesLoi n. 1.565 du 3 decembre 2024, arts. 96-101 (transfer of personal data) | 2024-12-13 | |
| Montenegro me 6 instruments | ||
| Law on Personal Data ProtectionOfficial Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended, arts. 1-10, 16-30 and 33-40 (general processing, security and registration) | [future] | |
| Law on Personal Data Protection, agency, supervision and penal provisionsLaw on Personal Data Protection, arts. 47-74 (agency, supervision and penal provisions) | [future] | |
| Law on Personal Data Protection, biometric measuresLaw on Personal Data Protection, arts. 31-32 (biometric measures) | [future] | |
| Law on Personal Data Protection, rights of the data subjectLaw on Personal Data Protection, arts. 11, 20-21, 23, 43-46 (rights of the data subject) | [future] | |
| Law on Personal Data Protection, special categories of dataLaw on Personal Data Protection, arts. 9(7)-(9), 12-14 (special categories of data) | [future] | |
| Law on Personal Data Protection, transfer of personal data from MontenegroLaw on Personal Data Protection, arts. 41-42 (transfer of personal data from Montenegro) | [future] | |
| North Macedonia mk 7 instruments | ||
| Law on Personal Data Protection (LPDP)Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020, fully applicable 24 August 2021, arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), personal data breach notificationZakon za zastita na licnite podatoci, arts. 37-38 (personal data breach notification) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), rights of the data subjectZakon za zastita na licnite podatoci, arts. 16-27 (rights of the data subject) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), special categories, a child's consent and biometric, health and genetic dataZakon za zastita na licnite podatoci, arts. 12-14, 84 (special categories, a child's consent and biometric, health and genetic data) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), the Agency, supervision and misdemeanour provisionsZakon za zastita na licnite podatoci, arts. 57-80, 97-116 (the Agency, supervision and misdemeanour provisions) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), transfer of personal dataZakon za zastita na licnite podatoci, arts. 48-56 (transfer of personal data) | 2021-08-24 | |
| Law on Personal Data Protection (LPDP), video surveillanceZakon za zastita na licnite podatoci, arts. 89-93 (video surveillance, notice, retention and destruction) | 2021-08-24 | |
| Norway no 6 instruments | ||
| Personal Data Act (personopplysningsloven)Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38, in force 20 July 2018 | 2018-07-20 | |
| Personal Data Act Chapter 3 and GDPR Article 9, Special Categories in Norwaypersonopplysningsloven, special categories chapter (Chapter 3) | 2018-07-20 | |
| Personal Data Act Chapter 7, Datatilsynet Enforcement in Norwaypersonopplysningsloven, enforcement chapter (Chapter 7) | 2018-07-20 | |
| Personal Data Act and GDPR Chapter V, Cross-Border Transfer from Norwaypersonopplysningsloven LOV-2018-06-15-38, transfer provisions | 2018-07-20 | |
| Personal Data Act, Breach Notification in Norwaypersonopplysningsloven LOV-2018-06-15-38, breach notification provisions | 2018-07-20 | |
| Personal Data Act, Data Subject Rights in Norwaypersonopplysningsloven LOV-2018-06-15-38, data subject rights provisions | 2018-07-20 | |
| Russia ru 7 instruments | ||
| Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal DataCriminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force 11 December 2024 | 2024-12-11 | |
| Federal Law No. 152-FZ "On Personal Data"Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (as amended) | 2006-07-27 | |
| Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZFederal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of 28 February 2025 | 2025-07-01 | |
| Federal Law No. 152-FZ, Article 21 Part 3.1, Breach NotificationFederal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force 1 September 2022) | 2022-09-01 | |
| Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data DefinitionFederal Law No. 152-FZ, Art. 10-11 | 2006-07-27 | |
| Federal Law No. 152-FZ, Articles 14-17, Data Subject RightsFederal Law No. 152-FZ, Art. 14-17 | 2006-07-27 | |
| Federal Law No. 572-FZ, Unified Biometric System for Identification and AuthenticationFederal Law No. 572-FZ of 29 December 2022 "On the identification and/or authentication of individuals using biometric personal data" | 2023-06-01 | |
| San Marino sm 6 instruments | ||
| San Marino Law No. 171 on the Protection of Natural PersonsLegge 21 dicembre 2018 n. 171, articoli 1-7, 9-11 e 23-44 (principi, basi giuridiche e obblighi del titolare) | 2018-12-21 | |
| San Marino Law No. 171, personal data breach notificationLegge 21 dicembre 2018 n. 171, articoli 34-35 (violazione dei dati personali) | 2018-12-21 | |
| San Marino Law No. 171, rights of the data subjectLegge 21 dicembre 2018 n. 171, articoli 12-22 (diritti dell'interessato) | 2018-12-21 | |
| San Marino Law No. 171, special categories of personal dataLegge 21 dicembre 2018 n. 171, articolo 8 (categorie particolari di dati personali) | 2018-12-21 | |
| San Marino Law No. 171, the Data Protection Authority, remedies and finesLegge 21 dicembre 2018 n. 171, articoli 51-75 (Autorita Garante, rimedi e sanzioni) | 2018-12-21 | |
| San Marino Law No. 171, transfers of personal data abroadLegge 21 dicembre 2018 n. 171, articoli 45-50 (trasferimenti verso paesi terzi) | 2018-12-21 | |
| Serbia rs 6 instruments | ||
| Draft Law on Personal Data Protection (2026 reform)Draft Law on Personal Data Protection, Ministry of Justice of the Republic of Serbia, public consultation opened 30 July 2026 | [proposed] | |
| Law on Personal Data ProtectionZakon o zastiti podataka o licnosti (Law on Personal Data Protection), Official Gazette RS No. 87/2018, arts. 1-15, 20, 41-51, 54-62, 88-94 (general provisions, principles, lawful basis, controller and processor obligations, data protection impact assessment, data protection officer, and special processing cases) | 2019-08-21 | |
| Law on Personal Data Protection, personal data breach notificationLaw on Personal Data Protection, arts. 52-53 (personal data breach notification), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Law on Personal Data Protection, rights of the data subjectLaw on Personal Data Protection, arts. 21-40 (rights of the data subject), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Law on Personal Data Protection, special categories of personal data and minorsLaw on Personal Data Protection, arts. 16-19 (special categories of personal data and minors), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Law on Personal Data Protection, the Commissioner, legal remedies and penaltiesLaw on Personal Data Protection, arts. 73-87 and 95 (the Commissioner, legal remedies and penalties), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Law on Personal Data Protection, transfer of personal data to other statesLaw on Personal Data Protection, arts. 63-72 (transfer of personal data to other states and international organizations), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Switzerland ch 6 instruments | ||
| FADP Article 24, Breach Notification in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24 | 2023-09-01 | |
| FADP Article 5 lit. c, Sensitive Personal Data Including Biometric DataFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 5 lit. c, Art. 6 para. 7, Art. 22 | 2023-09-01 | |
| FADP Articles 16-17, Cross-Border Transfer of Personal Data from SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 16-17 | 2023-09-01 | |
| FADP Articles 25-32, Data Subject Rights in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 25-32 | 2023-09-01 | |
| FADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65 | 2023-09-01 | |
| Federal Act on Data Protection (nFADP), General Processing PrinciplesFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31 | 2023-09-01 | |
| Ukraine ua 1 instrument | ||
| Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)Draft Law of Ukraine No. 8153, first reading passed 20 November 2024 (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA) | [proposed] | |
| Draft Law No. 8153, National Commission and penaltiesDraft Law No. 8153, National Commission on Personal Data Protection and penalty structure | [proposed] | |
| Draft Law No. 8153, automated decision making and data subject rightsDraft Law No. 8153, arts. 18, 25 (automated decision making disclosure and data subject rights: erasure, restriction, portability) | [proposed] | |
| Draft Law No. 8153, cross border transfer reformDraft Law No. 8153, GDPR Chapter V style cross border transfer framework | [proposed] | |
| Draft Law No. 8153, personal data breach notificationDraft Law No. 8153, 72 hour breach notification to the National Commission | [proposed] | |
| Law of Ukraine On the Protection of Personal DataZakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force 1 January 2011 (Law of Ukraine No. 2297-VI) | 2011-01-01 | |
| United Kingdom gb 7 instruments | ||
| Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22DData (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425 | 2026-02-05 | |
| R (Bridges) v Chief Constable of South Wales Police, Automated Facial Recognition by PoliceR (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058 | 2020-08-11 | |
| UK GDPR Article 82, Data Protection Act 2018 Section 169, and ICO EnforcementUK GDPR, Arts. 82-83; Data Protection Act 2018 §169 | 2018-05-25 | |
| UK GDPR Article 9, Special Categories of Personal Data Including Biometric DataUK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 | 2018-05-25 | |
| UK GDPR Articles 33-34 and PECR, Breach Notification in the United KingdomUK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 | 2018-05-25 | |
| UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United KingdomUK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025 | 2018-05-25 | |
| UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 | 2018-05-25 | |
| Vatican City va 3 instruments | ||
| General Regulation on the Protection of Personal Data for Vatican City StateDecreto n. DCLVII del 30 aprile 2024 (ad experimentum, three-year period), Arts. 1, 2, 11, 12 and 13 (purpose, scope and controller duties) | 2024-04-30 | |
| General Regulation on the Protection of Personal Data, Data Protection Officer and complaintsDecreto n. DCLVII del 30 aprile 2024, Arts. 10 and 25 (Data Protection Officer and complaints) | 2024-04-30 | |
| General Regulation on the Protection of Personal Data, data subject rightsDecreto n. DCLVII del 30 aprile 2024, data subject rights (access, rectification, erasure, portability and restriction) | 2024-04-30 | |
| Americas | ||
| Antigua and Barbuda ag 4 instruments | ||
| Data Protection Act, 2013Data Protection Act, 2013 (No. 10 of 2013), ss. 5, 7-10, 17, 19-20 | not recorded | |
| Data Protection Act, 2013, information commissioner and enforcementData Protection Act, 2013, ss. 21-27 (information commissioner and enforcement) | not recorded | |
| Data Protection Act, 2013, notice and rights of data subjectsData Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects) | not recorded | |
| Data Protection Act, 2013, sensitive personal dataData Protection Act, 2013, s. 18 (sensitive personal data) | not recorded | |
| Argentina ar 5 instruments | ||
| Ley 25.326, Ley de Protección de los Datos PersonalesLey 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) | 2000-10-30 | |
| Ley 25.326, cross-border transferLey 25.326, art. 12 (cross-border transfer) | 2000-10-30 | |
| Ley 25.326, enforcement, sanctions, and the habeas data actionLey 25.326, arts. 29-43 (supervisory authority, sanctions, and habeas data) | 2000-10-30 | |
| Ley 25.326, rights of data subjectsLey 25.326, arts. 6, 13-17, 19-20, 27.3 (data subject rights) | 2000-10-30 | |
| Ley 25.326, sensitive data categories and health dataLey 25.326, arts. 7-8 (sensitive data categories and health data) | 2000-10-30 | |
| Bahamas bs 3 instruments | ||
| Data Protection Act 2003, Commissioner, enforcement and penaltiesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences) | 2007-04-02 | |
| Data Protection Act 2003, application and processing principlesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 1-13 (application and data protection principles) | 2007-04-02 | |
| Data Protection Act 2003, cross-border transfer of personal dataData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas) | 2007-04-02 | |
| Barbados bb 6 instruments | ||
| Data Protection Act, 2019Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 | 2021-03-26 | |
| Data Protection Act, 2019, a child's consent and sensitive personal dataData Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) | 2021-03-26 | |
| Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019, ss. 63-64 (personal data breach notification) | 2021-03-26 | |
| Data Protection Act, 2019, rights of a data subjectData Protection Act, 2019, ss. 10-21 (rights of a data subject) | 2021-03-26 | |
| Data Protection Act, 2019, the Commissioner, enforcement and penaltiesData Protection Act, 2019, ss. 70-95 (Commissioner, enforcement, tribunal and penalties) | 2021-03-26 | |
| Data Protection Act, 2019, transfers of personal data outside of BarbadosData Protection Act, 2019, ss. 22-28 (transfers of personal data outside of Barbados) | 2021-03-26 | |
| Belize bz 4 instruments | ||
| Data Protection Act 2021, Commissioner, Tribunal, and enforcementData Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92 | [future] | |
| Data Protection Act 2021, comprehensive regimeData Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22 | [future] | |
| Data Protection Act 2021, cross-border transfer of personal dataData Protection Act, 2021 (Act No. 45 of 2021), ss. 23-29 (Transfers of Personal Data outside of Belize) | [future] | |
| Data Protection Act 2021, personal data breach notificationData Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62 | [future] | |
| Bolivia bo 3 instruments | ||
| Anteproyecto de Ley de Protección de Datos Personales (AGETIC)Anteproyecto de Ley de Protección de Datos Personales | [proposed] | |
| Constitución Política del Estado, Acción de Protección de PrivacidadCPE, art. 130 (Acción de Protección de Privacidad), promulgada 7 de febrero de 2009 | 2009-02-07 | |
| Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos PersonalesLey No. 164, arts. 56 (Protección de Datos Personales), promulgada 8 de agosto de 2011 | 2011-08-08 | |
| Reglamento para el Desarrollo de TIC, Tratamiento de los Datos PersonalesDS No. 1793, Reglamento a la Ley No. 164, art. 56 (Tratamiento de los Datos Personales), 13 de noviembre de 2013 | 2013-11-13 | |
| Brazil br 6 instruments | ||
| LGPD, civil liability, administrative sanctions and the ANPDLei nº 13.709, de 2018 (LGPD), arts. 42-45, 52-54, 55-A a 58-B (civil liability, administrative sanctions and the ANPD) | 2021-08-01 | |
| LGPD, international transfer of dataLei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data) | 2020-09-18 | |
| LGPD, rights of the data subjectLei nº 13.709, de 2018 (LGPD), arts. 17-22 (rights of the data subject) | 2020-09-18 | |
| LGPD, security incident notificationLei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification) | 2020-09-18 | |
| LGPD, sensitive personal data and children's dataLei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) | 2020-09-18 | |
| Lei Geral de Proteção de Dados Pessoais (LGPD)Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) | 2020-09-18 | |
| Canada ca 2 instruments | ||
| Bill C-36, Protecting Privacy and Consumer Data ActBill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session | [proposed] | |
| PIPEDA breach of security safeguards regimeS.C. 2000, c. 5, ss. 10.1-10.3 | 2018-11-01 | |
| Personal Information Protection and Electronic Documents Act (PIPEDA)S.C. 2000, c. 5, Part 1 | 2001-01-01 | |
| Chile cl 3 instruments | ||
| Ley 19.628, sobre Protección de la Vida PrivadaLey 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal) | 1999-08-28 | |
| Ley 21.719, Agencia de Protección de Datos Personales, SancionesLey 21.719, art. 35 (sanciones) y arts. 42-45 (procedimiento administrativo y judicial) | 2026-12-01[future] | |
| Ley 21.719, Regula la Protección y el Tratamiento de los Datos PersonalesLey 21.719, Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos) | 2026-12-01[future] | |
| Colombia co 9 instruments | ||
| Ley 1581 de 2012, Cross Border Data TransferLey 1581 de 2012, arts. 26-27 (Transferencia a Terceros Paises) | 2012-10-17 | |
| Ley 1581 de 2012, Data Subject Rights and ProceduresLey 1581 de 2012, arts. 8, 12, 14-16 (Derechos de los Titulares) | 2012-10-17 | |
| Ley 1581 de 2012, General Personal Data ProtectionLey Estatutaria 1581 de 2012, arts. 1-4, 9-11, 13, 17-18, 25, 28-30 (Objeto, Principios, Autorizacion y Deberes Generales) | 2012-10-17 | |
| Ley 1581 de 2012, Security Breach Notification to the AuthorityLey 1581 de 2012, arts. 17(n), 18(k) (Notificacion de Violaciones de Seguridad) | 2012-10-17 | |
| Ley 1581 de 2012, Sensitive Categories and Children's DataLey 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores) | 2012-10-17 | |
| Ley 1581 de 2012, Supervisory Authority and SanctionsLey 1581 de 2012, arts. 19-24 (Autoridad y Sanciones) | 2012-10-17 | |
| SIC Circular on AI, Data Subject RightsSIC Circular Externa 002 de 2024, instrucciones VII, X (Derechos de los Titulares en Sistemas de IA) | 2024-08-21 | |
| SIC Circular on AI, Demonstrated AccountabilitySIC Circular Externa 002 de 2024, Decreto 1074 de 2015 art. 2.2.2.25.6.1 (Responsabilidad Demostrada) | 2024-08-21 | |
| Superintendencia Circular on AI and Personal DataSIC Circular Externa 002 de 2024, instrucciones I, II, VIII-IX (Lineamientos sobre Tratamiento de Datos en Sistemas de IA), 21 de agosto de 2024 | 2024-08-21 | |
| Costa Rica cr 2 instruments | ||
| Código Penal, artículo 196 bis, Violación de datos personalesCodigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048 | not recorded | |
| Protección de la Persona frente al Tratamiento de sus Datos PersonalesLey No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales | not recorded | |
| Cuba cu 2 instruments | ||
| Ley 149/2022, De Protección de Datos Personales, general regimeLey 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022) | 2023-02-21 | |
| Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic formResolución 58/2022, Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022) | 2023-02-21 | |
| Dominican Republic do 5 instruments | ||
| Ley No. 172-13 sobre Protección Integral de los Datos PersonalesLey No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013, arts. 1-6, 27-28, 42-43, 60 y 63 | 2013-12-15 | |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, cross border transfer of dataLey No. 172-13, art. 80 (cross border transfer of data) | 2013-12-15 | |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, rights of data subjects and habeas dataLey No. 172-13, arts. 7-26, 44, 71 (rights of data subjects and habeas data) | 2013-12-15 | |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, special and sensitive categories of dataLey No. 172-13, arts. 66, 75-79 (special categories of data) | 2013-12-15 | |
| Ley No. 172-13 sobre Protección Integral de los Datos Personales, supervision, administrative sanctions, and offencesLey No. 172-13, arts. 29, 81-88 (supervision, administrative sanctions, and offences) | 2013-12-15 | |
| Ecuador ec 7 instruments | ||
| LOPDP, categorías especiales de datos personalesLOPDP, arts. 25-32 (categorias especiales de datos personales) | 2021-05-26 | |
| LOPDP, comprehensive personal-data protection regimeLey Orgánica de Protección de Datos Personales (LOPDP), arts. 1-11 y 33-54 (ámbito, principios, seguridad y obligaciones del responsable) | 2021-05-26 | |
| LOPDP, control, infracciones, sanciones y la AutoridadLOPDP, arts. 61-77 (control, infracciones, sanciones y la Autoridad) | 2021-05-26 | |
| LOPDP, derechos del titularLOPDP, arts. 12-24 (derechos del titular) | 2021-05-26 | |
| LOPDP, notificación de vulneración de seguridadLOPDP, arts. 43 y 46 (notificacion de vulneracion de seguridad) | 2021-05-26 | |
| LOPDP, transferencia internacional de datos personalesLOPDP, arts. 55-60 (transferencia internacional de datos personales) | 2021-05-26 | |
| SPDP Norma General guaranteeing personal-data protection in the use of AI systemsResolución No. SPDP-SPD-2026-0009-R, Superintendencia de Protección de Datos Personales, 12 de febrero de 2026 | [future] | |
| El Salvador sv 6 instruments | ||
| Ley para la Protección de Datos PersonalesDecreto Legislativo No. 144, 12 de noviembre de 2024, arts. 1-5, 26-36, 40, 46-49 and 60-64 (general provisions, lawful basis and accountability) | 2024-11-23 | |
| Ley para la Protección de Datos Personales, cross border transfer of personal dataDecreto Legislativo No. 144, arts. 41, 44 and 45 (international transfer of personal data) | 2024-11-23 | |
| Ley para la Protección de Datos Personales, enforcement and sanctionsDecreto Legislativo No. 144, arts. 35 and 50-59 (enforcement, infractions and sanctions) | 2024-11-23 | |
| Ley para la Protección de Datos Personales, personal data breach notificationDecreto Legislativo No. 144, art. 25 (personal data breach notification) | 2024-11-23 | |
| Ley para la Protección de Datos Personales, rights of data subjectsDecreto Legislativo No. 144, arts. 6-24 and 46-48 (ARCO-POL rights) | 2024-11-23 | |
| Ley para la Protección de Datos Personales, sensitive personal data and childrenDecreto Legislativo No. 144, arts. 4(g), 26, 37, 38, 39 and 42 (sensitive personal data and children) | 2024-11-23 | |
| Grenada gd 4 instruments | ||
| Data Protection Act, No. 1 of 2023Data Protection Act, No. 1 of 2023, ss. 1, 3-7, 9-12, 14, 20 and 22-23 (scope, principles, disclosure restriction and exemptions) | [future] | |
| Data Protection Act, No. 1 of 2023, Information Commission, enforcement and offencesData Protection Act, No. 1 of 2023, ss. 24-47 (Information Commission, enforcement, civil remedies and offences) | [future] | |
| Data Protection Act, No. 1 of 2023, rights of data subjectsData Protection Act, No. 1 of 2023, ss. 8, 13 and 15-19 (rights of data subjects) | [future] | |
| Data Protection Act, No. 1 of 2023, sensitive personal dataData Protection Act, No. 1 of 2023, s. 21 (sensitive personal data) | [future] | |
| Guatemala gt 2 instruments | ||
| Constitución Política de la República de Guatemala, Art. 31 (habeas data)Const. Pol. de la República de Guatemala, art. 31 (acceso a archivos y registros estatales) | 1986-01-14 | |
| Iniciativa de Ley 6105, Ley de Protección de DatosIniciativa de Ley 6105, Ley de Protección de Datos | [proposed] | |
| Ley de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67 | not recorded | |
| Guyana gy 1 instrument | ||
| Data Protection Act 2023Data Protection Act 2023 (Act No. 18 of 2023), not yet commenced | [future] | |
| Honduras hn 3 instruments | ||
| Constitución de la República de Honduras, garantía de Hábeas DataConstitución de la República de Honduras (1982, reformada), art. 182 (Hábeas Data) | 2013-03-27 | |
| Código Penal, acceso no autorizado a datos personales (descubrimiento y revelación de secretos)Decreto No. 130-2017, Código Penal, art. 272 (Descubrimiento y Revelación de Secretos) | 2019-11-10 | |
| Ley de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas dataDecreto No. 170-2006, Ley de Transparencia y Acceso a la Información Pública, arts. 3(7), 23-29 (Datos Personales y Hábeas Data) | 2013-03-27 | |
| Jamaica jm 6 instruments | ||
| Data Protection Act, 2020, conditions for processing sensitive personal dataData Protection Act, 2020 (Act 7 of 2020), ss. 2(1), 24 | not recorded | |
| Data Protection Act, 2020, registration, lawful basis and standards for processingData Protection Act, 2020 (Act 7 of 2020), ss. 3, 14-20, 21(1), 22, 23, 25-30, 45 | not recorded | |
| Data Protection Act, 2020, reporting a contravention or security breachData Protection Act, 2020 (Act 7 of 2020), ss. 21(2)-(5), 30(1)(b), (4)-(5) | not recorded | |
| Data Protection Act, 2020, rights of data subjects and automated decision-takingData Protection Act, 2020 (Act 7 of 2020), ss. 5-13 | not recorded | |
| Data Protection Act, 2020, the Information Commissioner, penalties and compensationData Protection Act, 2020 (Act 7 of 2020), ss. 4, 44, 46-55, 61, 62, 67-69 | not recorded | |
| Data Protection Act, 2020, transfer of personal data outside JamaicaData Protection Act, 2020 (Act 7 of 2020), s. 31 (the eighth standard) | not recorded | |
| Mexico mx 6 instruments | ||
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025, arts. 1-7, 9-18, 20 and 37 (scope, principles, consent, notice, security and confidentiality, self-regulation) | 2025-03-21 | |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, ARCO rightsLFPDPPP, arts. 21-34 (ARCO rights and their exercise) | 2025-03-21 | |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, enforcement, sanctions and offencesLFPDPPP, arts. 38-64 (Secretaría, rights-protection procedure, verification, sanctions and offences) | 2025-03-21 | |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, security-breach noticeLFPDPPP, art. 19 (security-breach notice) | 2025-03-21 | |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, sensitive personal dataLFPDPPP, arts. 2(VI), 8 and 12 (sensitive personal data) | 2025-03-21 | |
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares, transfer of personal dataLFPDPPP, arts. 35-36 (transfer of personal data) | 2025-03-21 | |
| Nicaragua ni 6 instruments | ||
| Ley No. 787, Ley de Protección de Datos PersonalesLey No. 787, 29-Mar-2012, Gaceta Oficial No. 61, arts. 1-6, 9, 11-13, 19, 22-24, 27 | 2012-03-29 | |
| Ley No. 787, Ley de Protección de Datos Personales, cross border transfer of dataLey No. 787, arts. 14-15 (cross border transfer of data) | 2012-03-29 | |
| Ley No. 787, Ley de Protección de Datos Personales, rights of data subjectsLey No. 787, arts. 7, 10, 16-21, 25-26 (rights of data subjects) | 2012-03-29 | |
| Ley No. 787, Ley de Protección de Datos Personales, security incident noticeLey No. 787, art. 11 (security incident notice to the affected institution) | 2012-03-29 | |
| Ley No. 787, Ley de Protección de Datos Personales, sensitive categories of dataLey No. 787, arts. 3(g), 7(l), 8 (sensitive categories of data) | 2012-03-29 | |
| Ley No. 787, Ley de Protección de Datos Personales, supervision, sanctions, and complaintsLey No. 787, arts. 28-29, 34-35, 44-52 (supervision, sanctions, and complaints) | 2012-03-29 | |
| Panama pa 6 instruments | ||
| Ley 81 de 2019, Sobre Protección de Datos PersonalesLey No. 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A, arts. 1-4, 6-12, 14, 24-32, 44 and 47 (general provisions, lawful basis and accountability) | 2021-03-29 | |
| Ley 81 de 2019, cross border transfer of personal dataLey 81 de 2019, arts. 5 and 33 (cross border transfer of personal data) | 2021-03-29 | |
| Ley 81 de 2019, enforcement and sanctionsLey 81 de 2019, arts. 34-37 and 38-46 (enforcement, sanctions and offences) | 2021-03-29 | |
| Ley 81 de 2019, personal data breach notificationLey 81 de 2019, arts. 2(5) and 26 (duty to notify security breaches) | 2021-03-29 | |
| Ley 81 de 2019, rights of data subjectsLey 81 de 2019, arts. 15-19 and 21-23 (rights of data subjects) | 2021-03-29 | |
| Ley 81 de 2019, sensitive personal dataLey 81 de 2019, arts. 4(11), 8, 13 and 20 (sensitive personal data) | 2021-03-29 | |
| Paraguay py 7 instruments | ||
| Ley N° 6534/2020, de Protección de Datos Personales CrediticiosLey N° 6534, del año 2020, de Protección de Datos Personales Crediticios | 2020-10-27 | |
| Ley N° 7593/2025, de Protección de Datos Personales en la República del ParaguayLey N° 7593/2025, arts. 1-16, 18 y 24-25 (ámbito, principios, seguridad y obligaciones del responsable) | 2027-11-27[future] | |
| Ley N° 7593/2025, derechos del titular de datosLey 7593/2025, arts. 26-33 (derechos del titular de datos) | 2027-11-27[future] | |
| Ley N° 7593/2025, la Agencia Nacional, faltas y sancionesLey 7593/2025, arts. 34-56 (la Agencia Nacional, faltas y sanciones) | 2027-11-27[future] | |
| Ley N° 7593/2025, notificación de un incidente de seguridadLey 7593/2025, art. 17 (notificacion de un incidente de seguridad) | 2027-11-27[future] | |
| Ley N° 7593/2025, transferencias internacionales de datos personalesLey 7593/2025, art. 19 (transferencias internacionales de datos personales) | 2027-11-27[future] | |
| Ley N° 7593/2025, tratamiento de datos sensibles y categorías especialesLey 7593/2025, arts. 20-23 (datos sensibles, crediticios, videovigilancia y penales) | 2027-11-27[future] | |
| Peru pe 5 instruments | ||
| Ley 29733, Ley de Protección de Datos PersonalesLey No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations) | 2011-07-03 | |
| Ley 29733, cross-border transfer of personal dataLey No. 29733, arts. 11, 15 (cross-border transfer) | 2011-07-03 | |
| Ley 29733, enforcement, supervisory authority and sanctionsLey No. 29733, arts. 32-40 and Disposición complementaria final sexta (enforcement, supervisory authority and sanctions) | 2011-07-03 | |
| Ley 29733, rights of the data subjectLey No. 29733, arts. 18-27 (rights of the data subject) | 2011-07-03 | |
| Ley 29733, sensitive personal data and minorsLey No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) | 2011-07-03 | |
| Saint Kitts and Nevis kn 4 instruments | ||
| Data Protection Act, 2018Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018), ss. 1-12, 19 and 21-22 | [future] | |
| Data Protection Act, 2018, Information Commissioner, enforcement and offencesData Protection Act, 2018, ss. 23-38 (Information Commissioner, enforcement and offences) | [future] | |
| Data Protection Act, 2018, processing of sensitive personal dataData Protection Act, 2018, s. 20 (processing of sensitive personal data) | [future] | |
| Data Protection Act, 2018, rights of data subjectsData Protection Act, 2018, ss. 13-18 (rights of data subjects) | [future] | |
| Saint Lucia lc 5 instruments | ||
| Data Protection ActAct 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-34 and 39-43, Part 6 (ss. 58-68) and Schedule 2 | 2023-01-31 | |
| Data Protection Act, Commissioner, offences and penaltiesAct 11 of 2011, ss. 5-31 and 69-74 (Commissioner, offences and penalties) | [future] | |
| Data Protection Act, rights of data subjects and othersAct 11 of 2011, ss. 52-57A (rights of data subjects) | [future] | |
| Data Protection Act, sensitive personal dataAct 11 of 2011, ss. 35-38 (sensitive personal data) | 2023-01-31 | |
| Data Protection Act, transfer of personal dataAct 11 of 2011, s. 45 (transfer of personal data) | [future] | |
| Suriname sr 0 instruments | ||
| Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens)Wet Bescherming Privacy en Persoonsgegevens, arts. 1-6, 12, 14-19, 21 (general obligations) | [proposed] | |
| Draft Law on the Protection of Privacy and Personal Data, Commissioner, remedies and finesArts. 23-42 Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Draft Law on the Protection of Privacy and Personal Data, breach notificationArt. 20 Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Draft Law on the Protection of Privacy and Personal Data, cross border transferArt. 22 Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Draft Law on the Protection of Privacy and Personal Data, rights of the data subjectArts. 10-11 Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Draft Law on the Protection of Privacy and Personal Data, special categories, children and criminal dataArts. 7-9 Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Trinidad and Tobago tt 5 instruments | ||
| Data Protection Act, 2011Act No. 13 of 2011 (Data Protection Act), Chap. 22:04, ss. 1-6, excluding paragraphs (h) and (l) of section 6 | 2012-01-06 | |
| Data Protection Act, 2011, Commissioner, contravention and enforcementAct 13 of 2011, ss. 7-28 and 87-96 (Commissioner, contravention and enforcement) | 2012-01-06 | |
| Data Protection Act, 2011, cross border disclosure of personal informationAct 13 of 2011, ss. 6(l), 46 and 72 (cross border disclosure) | 2012-01-06 | |
| Data Protection Act, 2011, rights of access and correctionAct 13 of 2011, ss. 52-59 and 75-85 (rights of access and correction) | [future] | |
| Data Protection Act, 2011, sensitive personal informationAct 13 of 2011, ss. 6(h), 40 and 76 (sensitive personal information) | 2012-01-06 | |
| United States us 8 instruments | ||
| Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments16 CFR Part 312, as amended effective June 23, 2025 | 2000-04-21 | |
| DOJ Data Security Program (Bulk Sensitive Personal Data Rule)28 CFR Part 202 | 2025-04-08 | |
| FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)15 U.S.C. Section 45 | 1914-09-26 | |
| GLBA Safeguards Rule Breach Notification Amendment16 CFR Section 314.4(j) | 2024-05-13 | |
| HIPAA Breach Notification Rule45 CFR Part 164, Subpart D (Sections 164.400-164.414) | 2009-09-23 | |
| HIPAA Privacy Rule45 CFR Part 164, Subpart E (Sections 164.500-164.534) | 2003-04-14 | |
| TAKE IT DOWN ActPub. L. 119-12, S. 146, 119th Cong. (2025) | 2026-05-19 | |
| Video Privacy Protection Act18 U.S.C. Section 2710 | 1988-11-05 | |
| Uruguay uy 7 instruments | ||
| Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amendedLey N° 18.331, de 11 de agosto de 2008, arts. 1-12, 17, 20, 22, 24, 28-30, según Ley N° 19.670, de 2018, arts. 37 y 40, y Decreto N° 64/020, de 2020 | not recorded | |
| Ley N° 18.331, biometric dataLey N° 18.331, arts. 4 (literal Ñ) y 18-BIS, según Ley N° 19.924, de 18 de diciembre de 2020 (datos biométricos) | not recorded | |
| Ley N° 18.331, cross border transfer of personal dataLey N° 18.331, art. 23 (transferencia internacional de datos personales) | not recorded | |
| Ley N° 18.331, enforcement, sanctions and habeas dataLey N° 18.331, arts. 31-36 y 37-45 (órgano de control, potestades sancionatorias y acción de habeas data) | not recorded | |
| Ley N° 18.331, rights of data subjectsLey N° 18.331, arts. 13-17 y 21, según Ley N° 20.075, de 2022, y Ley N° 18.719, de 2010 (derechos de los titulares de los datos) | not recorded | |
| Ley N° 18.331, sensitive personal data and health dataLey N° 18.331, de 2008, arts. 4 (literal E), 18 y 19 (datos sensibles y datos relativos a la salud) | not recorded | |
| Ley N° 19.670, personal data breach notificationLey N° 19.670, de 15 de octubre de 2018, art. 38, reglamentado por Decreto N° 64/020, de 2020 (notificación de vulneración de seguridad) | 2019-01-01 | |
| Venezuela ve 2 instruments | ||
| Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)Constitución de la República Bolivariana de Venezuela, Gaceta Oficial Extraordinaria N° 36.860, 30 de diciembre de 1999, arts. 28 y 60 | 1999-12-30 | |
| Ley Especial contra los Delitos Informáticos, privacy of personal data and communications (Arts. 20-22)LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 20-22 | 2001-11-29 | |
| Asia | ||
| Afghanistan af 1 instrument | ||
| Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38 | 2004-01-26 | |
| Armenia am 6 instruments | ||
| Law on Protection of Personal Data, biometric data provisionsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 3(13), 13, 19(4), 19(6), 23(3) | 2015-07-01 | |
| Law on Protection of Personal Data, comprehensive regimeLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N (2015), Arts. 1, 3-8 | 2015-07-01 | |
| Law on Protection of Personal Data, cross-border transferLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 27 | 2015-07-01 | |
| Law on Protection of Personal Data, data subject rightsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 15-17 | 2015-07-01 | |
| Law on Protection of Personal Data, enforcementLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 24 | 2015-07-01 | |
| Law on Protection of Personal Data, special category dataLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 12 | 2015-07-01 | |
| Azerbaijan az 6 instruments | ||
| Law on Personal Data, biometric data enumeration and general processing conditionsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5 | 2010-05-11 | |
| Law on Personal Data, comprehensive regime and lawful basisLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ (11 May 2010, as amended through 2023), Arts. 1-2, 8-13 | 2010-05-11 | |
| Law on Personal Data, cross-border transferLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14 | 2010-05-11 | |
| Law on Personal Data, data subject rightsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7 | 2010-05-11 | |
| Law on Personal Data, enforcement and liabilityLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 | 2010-05-11 | |
| Law on Personal Data, special categories of personal dataLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7 | 2010-05-11 | |
| Bahrain bh 6 instruments | ||
| Personal Data Protection Law, biometric data prior authorisationLaw No. 30 of 2018, Art. 15 | 2019-08-01 | |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 30 of 2018, Arts. 4-9 | 2019-08-01 | |
| Personal Data Protection Law, cross-border transferLaw No. 30 of 2018, Arts. 12-13 | 2019-08-01 | |
| Personal Data Protection Law, data subject rightsLaw No. 30 of 2018, Arts. 17-23 | 2019-08-01 | |
| Personal Data Protection Law, enforcement and penaltiesLaw No. 30 of 2018, Arts. 55, 57-60 | 2019-08-01 | |
| Personal Data Protection Law, sensitive personal dataLaw No. 30 of 2018, Arts. 1, 5 | 2019-08-01 | |
| Bangladesh bd 5 instruments | ||
| Personal Data Protection Act, 2026, breach notification dutiesPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.20 | 2025-11-06 | |
| Personal Data Protection Act, 2026, complaints, penalties and appealsPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 | [future] | |
| Personal Data Protection Act, 2026, comprehensive regime and lawful basisPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 | 2025-11-06 | |
| Personal Data Protection Act, 2026, cross-border transfer of personal dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 | 2025-11-06 | |
| Personal Data Protection Act, 2026, sensitive personal data and biometric dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 | 2025-11-06 | |
| Bhutan bt 5 instruments | ||
| Cybersecurity Code of Practice for ICT/Telecommunications Service Providers, privacy and PII dutyCybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of Bhutan 2018, s.58), s.8.6 | 2024-10-10 | |
| Information, Communications and Media Act of Bhutan 2018, data protection and privacy dutiesInformation, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, offences and compensation for data failuresInformation, Communications and Media Act of Bhutan 2018, ss.387-388 | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, sensitive personal data and biometric informationInformation, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, user review and removal rightsInformation, Communications and Media Act of Bhutan 2018, ss.338(3), 340 | 2018-01-08 | |
| Brunei Darussalam bn 5 instruments | ||
| Personal Data Protection Order 2025, breach notificationPersonal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29) | 2026-01-01 | |
| Personal Data Protection Order 2025, comprehensive regimePersonal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8 | 2026-01-01 | |
| Personal Data Protection Order 2025, cross-border transferPersonal Data Protection Order, 2025 (S 1/2025), s.24 | 2026-01-01 | |
| Personal Data Protection Order 2025, data-subject rightsPersonal Data Protection Order, 2025 (S 1/2025), ss.18-20 | 2026-01-01 | |
| Personal Data Protection Order 2025, enforcement and penaltiesPersonal Data Protection Order, 2025 (S 1/2025), ss.37, 59 | 2026-01-01 | |
| Cambodia kh 0 instruments | ||
| Cambodia's Draft Law on Personal Data Protection, cross-border data transferDraft Law on Personal Data Protection, article 23 (data transfer outside Cambodia) | [proposed] | |
| Cambodia's Draft Law on Personal Data Protection, enforcement and penaltiesDraft Law on Personal Data Protection, chapters 2, 8-10 (competent institution, inspection, dispute resolution and penalties) | [proposed] | |
| Cambodia's Draft Law on Personal Data Protection, personal data breach notificationDraft Law on Personal Data Protection, articles 21-22 (personal data breach notification) | [proposed] | |
| Cambodia's Draft Law on Personal Data Protection, rights of data subjectsDraft Law on Personal Data Protection, articles 26-36 (rights of data subjects) | [proposed] | |
| Cambodia's Draft Law on Personal Data Protection, sensitive personal dataDraft Law on Personal Data Protection, article 14 (sensitive personal data) | [proposed] | |
| Draft Law on Personal Data Protection, final draftDraft Law on Personal Data Protection (Final Draft, 23 June 2025), articles 1-13, 15-20, 24-25 and 37-39 (general provisions, principles and lawful basis, controller and processor obligations, security of processing, data protection officer, and guidelines) | [proposed] | |
| China cn 8 instruments | ||
| Personal Information Protection Law of the PRC, General Processing Rules and Lawful BasesPIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, 20 August 2021; effective 1 November 2021 | 2021-11-01 | |
| Personal Information Protection Law, Cross-Border TransferPIPL Arts. 38-40 | 2021-11-01 | |
| Personal Information Protection Law, Data Breach NotificationPIPL Art. 57 | 2021-11-01 | |
| Personal Information Protection Law, Individual Rights and Automated Decision-MakingPIPL Arts. 24, 44-50, 55(2) | 2021-11-01 | |
| Personal Information Protection Law, Sensitive Personal InformationPIPL Arts. 28-32 | 2021-11-01 | |
| Personal Information Protection Law, Supervision and Legal LiabilityPIPL Arts. 60-71 | 2021-11-01 | |
| Provisions on Promoting and Regulating Cross-Border Data Flows促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective 22 March 2024 | 2024-03-22 | |
| Provisions on Security Management of Facial Recognition Technology Application人脸识别技术应用安全管理办法, issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed 13 March 2025, effective 1 June 2025 | 2025-06-01 | |
| Georgia ge 7 instruments | ||
| Law on Personal Data Protection, biometric data articleLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d) | 2024-03-01 | |
| Law on Personal Data Protection, breach notificationLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 (17 December 2025) | 2024-03-01 | |
| Law on Personal Data Protection, comprehensive regime and lawful basisLaw of Georgia on Personal Data Protection, Law No. 3144-XI, adopted 14 June 2023, Arts. 1-5, 7-8 | 2024-03-01 | |
| Law on Personal Data Protection, cross-border transferLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 37-38, as amended by Law No. 1289 (17 December 2025) | 2024-03-01 | |
| Law on Personal Data Protection, data subject rightsLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 10-23) | 2024-03-01 | |
| Law on Personal Data Protection, enforcement and penaltiesLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79 | 2024-03-01 | |
| Law on Personal Data Protection, special categories of dataLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 6 | 2024-03-01 | |
| India in 6 instruments | ||
| Digital Personal Data Protection Act, 2023, Data Protection Board and penaltiesDigital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 | 2025-11-13 | |
| Digital Personal Data Protection Act, 2023, breach notification dutiesDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6) | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basisDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8 | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, cross-border transfer restrictionsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16 | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, data subject rightsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14 | 2027-05-13[future] | |
| Digital Personal Data Protection Rules, 2025G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified 13 November 2025 | 2025-11-13 | |
| Indonesia id 5 instruments | ||
| Law on Personal Data Protection, biometric data definitionLaw No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation | 2022-10-17 | |
| Law on Personal Data Protection, breach notificationLaw No. 27 of 2022 on Personal Data Protection, Article 46 | 2022-10-17 | |
| Law on Personal Data Protection, comprehensive regimeLaw No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated 17 October 2022 | 2022-10-17 | |
| Law on Personal Data Protection, cross-border transferLaw No. 27 of 2022 on Personal Data Protection, Article 56 | 2022-10-17 | |
| Law on Personal Data Protection, enforcement and private right to sueLaw No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 | 2022-10-17 | |
| Iran ir 1 instrument | ||
| Electronic Commerce Law (2003), Personal Data ChapterElectronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter) | 2004-01-01 | |
| Israel il 6 instruments | ||
| Privacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transferPrivacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 | [future] | |
| Protection of Privacy Law, biometric identifier definition and security-level tieringProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions | 2025-08-14 | |
| Protection of Privacy Law, breach notification dutyPrivacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21) | 2018-05-08 | |
| Protection of Privacy Law, comprehensive regime and database registrationProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A | 2025-08-14 | |
| Protection of Privacy Law, data subject rightsProtection of Privacy Law, 5741-1981, Arts. 13, 13A, 14 | [future] | |
| Protection of Privacy Law, enforcement, DPO duty and private rights of actionProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Arts. 15A, 17B1-17B3, 29A, 31B, Chapters D3-D4 | 2025-08-14 | |
| Japan jp 5 instruments | ||
| Act on the Protection of Personal Information, breach notificationAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26 | 2022-04-01 | |
| Act on the Protection of Personal Information, comprehensive regime and lawful basisAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 15, 20, 25 | 2022-04-01 | |
| Act on the Protection of Personal Information, cross-border transferAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28 | 2022-04-01 | |
| Act on the Protection of Personal Information, enforcementAct No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII | 2022-04-01 | |
| Act on the Protection of Personal Information, individual identification code and biometric provisionsAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 | 2022-04-01 | |
| Jordan jo 6 instruments | ||
| Personal Data Protection Law, breach notificationLaw No. 24 of 2023, Art. 20 | 2024-03-17 | |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 24 of 2023, Arts. 1-2, 11 | 2024-03-17 | |
| Personal Data Protection Law, cross-border transferLaw No. 24 of 2023, Art. 14 | 2024-03-17 | |
| Personal Data Protection Law, data subject rightsLaw No. 24 of 2023, data subject rights list | 2024-03-17 | |
| Personal Data Protection Law, enforcement and data subject remediesLaw No. 24 of 2023, Arts. 21-22 | 2024-03-17 | |
| Personal Data Protection Law, sensitive personal data and biometric dataLaw No. 24 of 2023, Art. 2 definitions | 2024-03-17 | |
| Kazakhstan kz 6 instruments | ||
| Code of Administrative Offences, personal data violationsCode of the Republic of Kazakhstan on Administrative Offences No. 235-V (2014), Art. 79 | 2015-01-01 | |
| Law on Personal Data and Their Protection, biometric data provisionsLaw No. 94-V (21 May 2013), Arts. 7(12), 11(3), 12(2) | 2013-11-25 | |
| Law on Personal Data and Their Protection, breach notificationLaw No. 94-V (21 May 2013), Art. 25(2) | 2013-11-25 | |
| Law on Personal Data and Their Protection, comprehensive regime and lawful basesLaw No. 94-V (21 May 2013), as amended through Law No. 256-VIII (09.01.2026), Arts. 1, 4-9 | 2013-11-25 | |
| Law on Personal Data and Their Protection, data subject rightsLaw No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1 | 2013-11-25 | |
| Law on Personal Data and Their Protection, localization and cross-border transferLaw No. 94-V (21 May 2013), Arts. 12(2), 16 | 2013-11-25 | |
| Kuwait kw 1 instrument | ||
| CITRA Data Privacy Protection RegulationCITRA Decision No. 26 of 2024 (amending or superseding Decision No. 42 of 2021) | [future] | |
| Kyrgyzstan kg 4 instruments | ||
| Digital Code, comprehensive personal data regimeDigital Code, Law No. 178 (18 June 2025), in force 6 February 2026, Chapter 11, Arts. 78, 88 | 2026-02-06 | |
| Digital Code, cross-border transfer of personal dataDigital Code, Law No. 178, Art. 89 | 2026-02-06 | |
| Digital Code, sectoral regulator for personal dataDigital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data) | 2026-02-06 | |
| Digital Code, special categories of personal dataDigital Code, Law No. 178, Art. 80 | 2026-02-06 | |
| Lebanon lb 5 instruments | ||
| Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)Law No. 81, Official Gazette of Lebanon, promulgated 10 October 2018 (in force 31 March 2019), Arts. 85, 87, 90, 93 to 98 and 103 to 105 (Part V, Personal Data Protection), with the definitions in Article One and the provider retention duties in Arts. 72 and 74 | 2019-03-31 | |
| Law No. 81/2018, Part V, health, genetic identity and sexual-life dataLaw No. 81/2018, Arts. 91 and 97(3) (health, genetic identity and sexual-life data) | 2019-03-31 | |
| Law No. 81/2018, Part V, notice, objection, access and correctionLaw No. 81/2018, Arts. 86, 88, 89, 92, 99 to 101, 103, 105 and 32 (notice, objection, access and correction) | 2019-03-31 | |
| Law No. 81/2018, Part V, penal provisions and supervisionLaw No. 81/2018, Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98 | 2019-03-31 | |
| Law No. 81/2018, Part V, transfer of personal data to another StateLaw No. 81/2018, Arts. 96(12) and 98(8) (transfer of personal data to another State) | 2019-03-31 | |
| Malaysia my 6 instruments | ||
| Personal Data Protection Act, biometric data definition and sensitive categoryAct 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force 2025-04-01 | 2025-04-01 | |
| Personal Data Protection Act, comprehensive regime and lawful basesAct 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727 | 2013-11-15 | |
| Personal Data Protection Act, cross-border transferAct 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force 2025-04-01 | 2025-04-01 | |
| Personal Data Protection Act, data portabilityAct 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force 2025-06-01 | 2025-06-01 | |
| Personal Data Protection Act, data protection officer and breach notificationAct 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force 2025-06-01 | 2025-06-01 | |
| Personal Data Protection Act, enforcementAct 709 (Malaysia) ss.5(2), 12B(3) | 2013-11-15 | |
| Maldives mv 0 instruments | ||
| Maldives Personal Data Protection Bill, cross-border transfersPersonal Data Protection Bill, chapters 7-8 (personal data transfers and cross-border transfers) | [proposed] | |
| Maldives Personal Data Protection Bill, investigation, enforcement and compensationPersonal Data Protection Bill, chapter 9 and sections 52-55 (investigation, enforcement and compensation) | [proposed] | |
| Maldives Personal Data Protection Bill, personal data breach notificationPersonal Data Protection Bill, section 34 (personal data breach notification) | [proposed] | |
| Maldives Personal Data Protection Bill, rights of data subjectsPersonal Data Protection Bill, chapter 4 (rights of data subjects) | [proposed] | |
| Maldives Personal Data Protection Bill, special categories of personal dataPersonal Data Protection Bill, section 17 and the section 56 definition (special categories of personal data) | [proposed] | |
| Personal Data Protection Bill, pending before the People's MajlisPersonal Data Protection Bill, chapters 1-3, 5 and 10 (introduction, the Authority, principles, security and miscellaneous provisions) | [proposed] | |
| Mongolia mn 7 instruments | ||
| Law on Protection of Personal Data, biometric information definition and legacy fingerprint destructionLaw on Protection of Personal Data (17 December 2021), Art. 4.1.1; Art. 31 | 2022-05-01 | |
| Law on Protection of Personal Data, breach notificationLaw on Protection of Personal Data (17 December 2021), Art. 25.1.3; Art. 10.5 | 2022-05-01 | |
| Law on Protection of Personal Data, comprehensive regimeLaw on Protection of Personal Data (17 December 2021), in force 1 May 2022, Arts. 1-4 | 2022-05-01 | |
| Law on Protection of Personal Data, cross-border transferLaw on Protection of Personal Data (17 December 2021), Art. 14 | 2022-05-01 | |
| Law on Protection of Personal Data, data subject rightsLaw on Protection of Personal Data (17 December 2021), Art. 16; Art. 15 | 2022-05-01 | |
| Law on Protection of Personal Data, enforcementLaw on Protection of Personal Data (17 December 2021), Arts. 24-26, 28, 30 | 2022-05-01 | |
| Law on Protection of Personal Data, sensitive personal informationLaw on Protection of Personal Data (17 December 2021), Arts. 4.1.12, 9 | 2022-05-01 | |
| Myanmar mm 1 instrument | ||
| Cybersecurity Law, digital platform data retention and disclosure dutyCybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34 | [future] | |
| Nepal np 4 instruments | ||
| Privacy Act, 2075, correction rightPrivacy Act, 2075 (2018), Act Number 14 of 2075, s.28 | 2018-09-18 | |
| Privacy Act, 2075, enforcement and compensationPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32 | 2018-09-18 | |
| Privacy Act, 2075, general privacy and collection regimePrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1) | 2018-09-18 | |
| Privacy Act, 2075, sensitive information and biometric dataPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27 | 2018-09-18 | |
| Oman om 6 instruments | ||
| Personal Data Protection Law, biometric and sensitive data prior permitRoyal Decree No. 6/2022, Arts. 1, 5 | 2023-02-13 | |
| Personal Data Protection Law, breach notificationRoyal Decree No. 6/2022, breach notification provision | 2023-02-13 | |
| Personal Data Protection Law, comprehensive regime and scopeRoyal Decree No. 6/2022, Arts. 3-4, 7 | 2023-02-13 | |
| Personal Data Protection Law, cross-border transferRoyal Decree No. 6/2022, Art. 23 | 2023-02-13 | |
| Personal Data Protection Law, data subject rightsRoyal Decree No. 6/2022, Art. 11 | 2023-02-13 | |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. 6/2022, Art. 8, penalties provisions | 2023-02-13 | |
| Philippines ph 5 instruments | ||
| Data Privacy Act of 2012, breach notificationRepublic Act No. 10173 (2012), Section 20(f) | 2012-08-15 | |
| Data Privacy Act of 2012, comprehensive regime and lawful processing criteriaRepublic Act No. 10173 (2012), Sections 3, 12, 13 | 2012-08-15 | |
| Data Privacy Act of 2012, cross-border transfer accountabilityRepublic Act No. 10173 (2012), Section 21 | 2012-08-15 | |
| Data Privacy Act of 2012, data subject rightsRepublic Act No. 10173 (2012), Sections 16-18 | 2012-08-15 | |
| Data Privacy Act of 2012, enforcement and restitutionRepublic Act No. 10173 (2012), Sections 25-37 | 2012-08-15 | |
| Qatar qa 5 instruments | ||
| Personal Data Privacy Protection Law, breach notificationLaw No. 13 of 2016, Arts. 13-14 | 2017-01-01 | |
| Personal Data Privacy Protection Law, comprehensive regimeLaw No. 13 of 2016, Chapter One | 2017-01-01 | |
| Personal Data Privacy Protection Law, cross-border data flowLaw No. 13 of 2016, Art. 15 | 2017-01-01 | |
| Personal Data Privacy Protection Law, enforcement and penaltiesLaw No. 13 of 2016, Arts. 23-26 | 2017-01-01 | |
| Personal Data Privacy Protection Law, special-nature personal dataLaw No. 13 of 2016, Art. 16 | 2017-01-01 | |
| Saudi Arabia sa 5 instruments | ||
| Personal Data Protection Law, breach notificationRoyal Decree No. M/19, Art. 20 | 2023-09-14 | |
| Personal Data Protection Law, comprehensive regime and lawful basisRoyal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12 | 2023-09-14 | |
| Personal Data Protection Law, cross-border transferRoyal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom | 2023-09-14 | |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. M/19, Arts. 35-36 | 2023-09-14 | |
| Personal Data Protection Law, sensitive data and biometric processingRoyal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) | 2023-09-14 | |
| Singapore sg 5 instruments | ||
| Personal Data Protection Act, comprehensive consent-based regimeAct 26 of 2012 (Singapore), as amended by the Personal Data Protection (Amendment) Act 2020, Act 40 of 2020 | 2021-02-01 | |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act 2012, s.26 | 2014-07-02 | |
| Personal Data Protection Act, data breach notificationPersonal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020 | 2021-02-01 | |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act 2012, ss.21-22 | 2014-07-02 | |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 | 2022-10-01 | |
| South Korea kr 7 instruments | ||
| PIPC Guideline on Processing Publicly Available Data for AI Development and ServicesPIPC Guideline (issued 2024-07-18), applying Personal Information Protection Act (Act No. 10465, as amended), Art. 15(1)(6) | 2024-07-18 | |
| Personal Information Protection Act, breach notification dutiesAct No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40 | 2023-09-15 | |
| Personal Information Protection Act, comprehensive regime and lawful basesAct No. 10465 (Mar. 29, 2011), as amended by Act No. 19234 (Mar. 14, 2023), Art. 15 | 2023-09-15 | |
| Personal Information Protection Act, cross-border transfer restrictionsAct No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11 | 2023-09-15 | |
| Personal Information Protection Act, data subject rights and automated decisionsAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37, 37-2 | 2024-03-15 | |
| Personal Information Protection Act, enforcement and private civil remedyAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 | 2023-09-15 | |
| Personal Information Protection Act, sensitive information and biometric dataAct No. 10465 (as amended by Act No. 19234, 2023), Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Art. 18 | 2023-09-15 | |
| Sri Lanka lk 6 instruments | ||
| Personal Data Protection Act, Data Protection Authority and penaltiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38 | 2025-03-18 | |
| Personal Data Protection Act, breach notification dutiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23 | 2025-03-18 | |
| Personal Data Protection Act, comprehensive regime and lawful basisPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 | 2025-03-18 | |
| Personal Data Protection Act, cross-border transfer of personal dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26 | 2025-03-18 | |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 | 2025-03-18 | |
| Personal Data Protection Act, special categories and biometric dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II | 2025-03-18 | |
| State of Palestine ps 1 instrument | ||
| Palestinian Basic Law (Amended 2003), Privacy and Remedy ProvisionsPalestinian Basic Law (Amended) 2003, Arts. 17 and 32 | 2003-03-18 | |
| Syria sy 6 instruments | ||
| Law No. 12 of 2024 on Protection of Electronic Personal DataLaw No. 12 of 2024 (Syrian Arab Republic), arts. 1-2, 4-7, 9-10, 12, 27-30, 40, 45 (definitions, lawful processing, controller and processor obligations, licensing and scope) | 2025-01-01[future] | |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penaltiesLaw No. 12 of 2024, arts. 19-26, 31, 34-39, 43 (Authority, complaints, fines and offences) | 2025-01-01[future] | |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, cross border transferLaw No. 12 of 2024, arts. 15-16 (cross-border transfer of personal data) | 2025-01-01[future] | |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, personal data breach notificationLaw No. 12 of 2024, art. 8 (personal data breach notification) | 2025-01-01[future] | |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketingLaw No. 12 of 2024, arts. 3, 11, 17-18, 33 (rights, requests and electronic marketing) | 2025-01-01[future] | |
| Law No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal dataLaw No. 12 of 2024, arts. 13-14 (sensitive personal data) | 2025-01-01[future] | |
| Tajikistan tj 5 instruments | ||
| Law on the Protection of Personal Data, biometric personal dataLaw No. 1537 (3 August 2018), Art. 17; Art. 1; Art. 11 | 2018-08-03 | |
| Law on the Protection of Personal Data, comprehensive regimeLaw No. 1537 (3 August 2018), Arts. 1-3, 5, 8-9 | 2018-08-03 | |
| Law on the Protection of Personal Data, data subject rightsLaw No. 1537 (3 August 2018), Art. 8; Arts. 19-20 | 2018-08-03 | |
| Law on the Protection of Personal Data, enforcementLaw No. 1537 (3 August 2018), Arts. 6-7 | 2018-08-03 | |
| Law on the Protection of Personal Data, localization and cross-border transferLaw No. 1537 (3 August 2018), Art. 14; Art. 18 | 2018-08-03 | |
| Thailand th 5 instruments | ||
| Personal Data Protection Act, breach notificationPersonal Data Protection Act B.E. 2562 (2019), Section 37(4) | 2022-06-01 | |
| Personal Data Protection Act, comprehensive regimePersonal Data Protection Act B.E. 2562 (2019), Government Gazette Vol. 136, Special Issue 69 Kor, fully enforceable 2022-06-01 | 2022-06-01 | |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act B.E. 2562 (2019), Section 28 | 2022-06-01 | |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act B.E. 2562 (2019), Sections 77, 78, 84-88 | 2022-06-01 | |
| Personal Data Protection Act, sensitive and biometric categoriesPersonal Data Protection Act B.E. 2562 (2019), Section 26 | 2022-06-01 | |
| Timor-Leste tl 3 instruments | ||
| Constitution of Timor-Leste, Section 38(1) (Access to personal data)Section 38(1) (access), Constitution of Timor-Leste (2002) | 2002-05-20 | |
| Constitution of Timor-Leste, Section 38(3) (Sensitive categories of personal data)Section 38(3) (sensitive categories), Constitution of Timor-Leste (2002) | 2002-05-20 | |
| Constitution of the Democratic Republic of Timor-Leste, Section 38(2) (Personal data deferred to statute)Constitution of the Democratic Republic of Timor-Leste (2002), Section 38(2) | 2002-05-20 | |
| Turkey tr 6 instruments | ||
| Personal Data Protection Law (KVKK), breach notificationLaw No. 6698, Art. 12(5) | 2016-04-07 | |
| Personal Data Protection Law (KVKK), comprehensive regime and lawful basisLaw No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), cross-border transferLaw No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3 | 2024-09-01 | |
| Personal Data Protection Law (KVKK), data subject rightsLaw No. 6698, Art. 11 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), enforcement and compensationLaw No. 6698, Arts. 11(1)(g), 18 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), special categories and biometric dataLaw No. 6698, Art. 6, as amended by Law No. 7499 (2 March 2024) | 2024-03-02 | |
| Turkmenistan tm 5 instruments | ||
| Law on Information About Private Life, biometric informationLaw No. 519-V (20 March 2017), Arts. 1(1), 7(7), 11(2) | 2017-07-01 | |
| Law on Information About Private Life, comprehensive regimeLaw No. 519-V (20 March 2017), in force 1 July 2017, Arts. 1, 6-9 | 2017-07-01 | |
| Law on Information About Private Life, enforcementLaw No. 519-V (20 March 2017), Arts. 28(2), 29, 31, 32 | 2017-07-01 | |
| Law on Information About Private Life, localization and cross-border transferLaw No. 519-V (20 March 2017), Arts. 12, 17 | 2017-07-01 | |
| Law on Information About Private Life, special categories of personal informationLaw No. 519-V (20 March 2017), Art. 21 | 2017-07-01 | |
| United Arab Emirates ae 7 instruments | ||
| ADGM Data Protection Regulations, breach notificationADGM Data Protection Regulations 2021, personal data breach notification provisions | 2021-02-14 | |
| ADGM Data Protection Regulations, comprehensive regimeADGM Data Protection Regulations 2021 (consolidated February 2024) | 2021-02-14 | |
| DIFC Data Protection Law, comprehensive regimeDIFC Law No. 5 of 2020 | 2020-07-01 | |
| Federal Decree-Law on the Protection of Personal Data, breach notificationFederal Decree-Law No. 45 of 2021, Art. 9 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basisFederal Decree-Law No. 45 of 2021, Arts. 1, 4 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, cross-border transferFederal Decree-Law No. 45 of 2021, Arts. 22-23 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, enforcement and supervisionFederal Decree-Law No. 45 of 2021, Arts. 25-26 | 2022-01-02 | |
| Uzbekistan uz 6 instruments | ||
| Law on Personal Data, biometric and genetic dataLaw No. ZRU-547 (2 July 2019), Art. 26 | 2019-10-01 | |
| Law on Personal Data, comprehensive regime and lawful basesLaw No. ZRU-547 (2 July 2019), Arts. 1-14, 18-23, 28, 30-31 | 2019-10-01 | |
| Law on Personal Data, cross-border transfer and citizen data localizationLaw No. ZRU-547 (2 July 2019), Art. 15; Art. 27-1 (added 2021, in force April 2021) | 2019-10-01 | |
| Law on Personal Data, data subject rightsLaw No. ZRU-547 (2 July 2019), Art. 30 | 2019-10-01 | |
| Law on Personal Data, enforcementLaw No. ZRU-547 (2 July 2019), Art. 33 | 2019-10-01 | |
| Law on Personal Data, special personal dataLaw No. ZRU-547 (2 July 2019), Art. 25 | 2019-10-01 | |
| Vietnam vn 5 instruments | ||
| Law on Personal Data Protection, biometric and location data protectionLaw No. 91/2025/QH15, Article 31 | 2026-01-01 | |
| Law on Personal Data Protection, breach notificationLaw No. 91/2025/QH15, Article 23 | 2026-01-01 | |
| Law on Personal Data Protection, comprehensive regimeLaw No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, 26 June 2025, in force 1 January 2026 | 2026-01-01 | |
| Law on Personal Data Protection, cross-border transferLaw No. 91/2025/QH15, Article 20 | 2026-01-01 | |
| Law on Personal Data Protection, enforcement and data subject rightsLaw No. 91/2025/QH15, enforcement and data subject rights provisions | 2026-01-01 | |
| Africa | ||
| Algeria dz 6 instruments | ||
| Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, arts. 4, 7-9 et 12, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 38-39 et 41 bis à 41 bis 3 | 2023-08-11 | |
| Loi n° 18-07 relative à la protection des personnes physiques, catégories de données sensibles et biométriquesLoi n° 18-07 du 10 juin 2018, art. 18, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 3 et 45 bis 7 | 2023-08-11 | |
| Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recoursLoi n° 18-07 du 10 juin 2018, arts. 47, 52 et 54-74, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, art. 27 bis | 2023-08-11 | |
| Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernéeLoi n° 18-07 du 10 juin 2018, arts. 34-36, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, art. 7 (abrogation de l'art. 11) et art. 45 bis 1 | 2023-08-11 | |
| Loi n° 18-07 relative à la protection des personnes physiques, notification des violations de donnéesLoi n° 18-07 du 10 juin 2018, art. 43, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 45 bis 8 et 45 bis 10 | 2023-08-11 | |
| Loi n° 18-07 relative à la protection des personnes physiques, transfert de données vers un pays étrangerLoi n° 18-07 du 10 juin 2018, arts. 44-45 | 2023-08-11 | |
| Angola ao 5 instruments | ||
| Law on the Protection of Personal DataLei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 | not recorded | |
| Law on the Protection of Personal Data, cross border transferLei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados) | not recorded | |
| Law on the Protection of Personal Data, enforcement and supervisionLei n.º 22/11, de 17 de Junho de 2011, arts. 44-62 (Agência de Protecção de Dados, contravenções e crimes) | not recorded | |
| Law on the Protection of Personal Data, rights of data subjectsLei n.º 22/11, de 17 de Junho de 2011, arts. 25-29 (direitos dos titulares dos dados) | not recorded | |
| Law on the Protection of Personal Data, sensitive data categoriesLei n.º 22/11, de 17 de Junho de 2011, arts. 13-15 e 17 (dados sensíveis) | not recorded | |
| Benin bj 6 instruments | ||
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) | 2018-04-20 | |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, Autorité de Protection des Données Personnelles, sanctions et infractions pénalesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 448-490 et Livre VI, arts. 514-517 (Autorité, sanctions et infractions pénales) | 2018-04-20 | |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineursLoi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) | 2018-04-20 | |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, droits des personnes concernéesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 399-401, 415-423, 437-445 et 447 (droits des personnes concernées) | 2018-04-20 | |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécuritéLoi n°2017-20 du 20 avril 2018, Livre V, art. 427 (notification des ruptures de sécurité) | 2018-04-20 | |
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, transfert transfrontalier de donnéesLoi n°2017-20 du 20 avril 2018, Livre V, arts. 391-392 (transfert transfrontalier de données) | 2018-04-20 | |
| Botswana bw 6 instruments | ||
| Data Protection Act, 2024 (Act No. 18 of 2024)Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73 | 2025-01-14 | |
| Data Protection Act, 2024, compensation, administrative fines and offencesData Protection Act, 2024 (Act No. 18 of 2024), Part XV (ss. 80-84) | 2025-01-14 | |
| Data Protection Act, 2024, personal data breach notificationData Protection Act, 2024 (Act No. 18 of 2024), ss. 63-64 | 2025-01-14 | |
| Data Protection Act, 2024, rights of data subjectsData Protection Act, 2024 (Act No. 18 of 2024), Part VIII (ss. 37-49) | 2025-01-14 | |
| Data Protection Act, 2024, sensitive personal data and children's dataData Protection Act, 2024 (Act No. 18 of 2024), s. 29, Part VI (ss. 30-33) | 2025-01-14 | |
| Data Protection Act, 2024, transfer of personal data to third countries or international organisationsData Protection Act, 2024 (Act No. 18 of 2024), Part XIV (ss. 74-79) | 2025-01-14 | |
| Burkina Faso bf 5 instruments | ||
| Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnelLoi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, arts. 1-11, 13, 23-41 (dispositions générales, principes fondamentaux, obligations du responsable et formalités préalables) | 2021-03-30 | |
| Personal Data Protection Law, cross-border transfer of personal dataLoi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso) | 2021-03-30 | |
| Personal Data Protection Law, rights of the data subjectLoi n°001-2021/AN, arts. 14-22, 31 (droits de la personne concernée) | 2021-03-30 | |
| Personal Data Protection Law, sensitive personal data categoriesLoi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles) | 2021-03-30 | |
| Personal Data Protection Law, supervisory authority and sanctionsLoi n°001-2021/AN, arts. 45-79 (autorité de contrôle et sanctions) | 2021-03-30 | |
| Burundi bi 1 instrument | ||
| Law No. 1/03 of March 10, 2026 on the Protection of Personal DataLoi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel | 2026-03-10 | |
| Cabo Verde cv 5 instruments | ||
| Law No. 133/V/2001 on the Protection of Personal DataLei n.º 133/V/2001, de 22 de Janeiro (Lei de Protecção de Dados Pessoais), arts. 1-7, 10, 15, 17-18, 23-27 and 47-49 | not recorded | |
| Law No. 133/V/2001 on the Protection of Personal Data, cross border transferLei n.º 133/V/2001, de 22 de Janeiro, arts. 19-20 (transferência internacional de dados) | not recorded | |
| Law No. 133/V/2001 on the Protection of Personal Data, enforcement and supervisionLei n.º 133/V/2001, de 22 de Janeiro, arts. 21-22 e 28-46 (CNPD, recursos, contra-ordenacoes e crimes) | not recorded | |
| Law No. 133/V/2001 on the Protection of Personal Data, rights of data subjectsLei n.º 133/V/2001, de 22 de Janeiro, arts. 11-14 (direitos dos titulares dos dados) | not recorded | |
| Law No. 133/V/2001 on the Protection of Personal Data, sensitive data categoriesLei n.º 133/V/2001, de 22 de Janeiro, arts. 8-9 e 16 (dados sensíveis) | not recorded | |
| Cameroon cm 2 instruments | ||
| Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)Loi n°2010/012 du 21 décembre 2010, art. 74 | 2010-12-21 | |
| Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au CamerounLoi n°2024/017 du 23 décembre 2024 | [future] | |
| Central African Republic cf 5 instruments | ||
| Loi n° 24.001 portant protection des données à caractère personnelLoi n° 24.001 portant protection des données à caractère personnel, Chapitres Ier, II, V, VII et IX (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales) | not recorded | |
| Loi n° 24.001 portant protection des données à caractère personnel, données sensibles et mineursLoi n° 24.001, Chapitre Ier Section 2 et Chapitre II (données sensibles et mineurs) | not recorded | |
| Loi n° 24.001 portant protection des données à caractère personnel, droits liés au traitementLoi n° 24.001, Chapitre II et Chapitre VI (droits liés au traitement, prospection directe) | not recorded | |
| Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalierLoi n° 24.001, Chapitre III (flux transfrontalier) | not recorded | |
| Loi n° 24.001 portant protection des données à caractère personnel, sanctions et agenceLoi n° 24.001, Chapitre VIII et Chapitre IX (sanctions et agence) | not recorded | |
| Chad td 6 instruments | ||
| Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)Loi n°007/PR/2015 du 10 février 2015, arts. 35-50 | 2015-02-10 | |
| Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICELoi n°007/PR/2015 du 10 février 2015, art. 61 | 2015-02-10 | |
| Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)Loi n°007/PR/2015 du 10 février 2015, arts. 1-15 | 2015-02-10 | |
| Loi n°007/PR/2015, sanctions administratives et pénales et recoursLoi n°007/PR/2015 du 10 février 2015, arts. 80-94 | 2015-02-10 | |
| Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)Loi n°007/PR/2015 du 10 février 2015, arts. 16-25 | 2015-02-10 | |
| Loi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMACLoi n°007/PR/2015 du 10 février 2015, arts. 29-32 | 2015-02-10 | |
| Comoros km 5 instruments | ||
| Law on the Protection of Personal DataLoi n° 14-029/AU portant protection des données à caractère personnel, deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on 26 June 2014, arts. 1-5, 41-42, 43(a) and (e)-(g), 44-46, 49-53 and 66-68 (comprehensive regime, formalities and obligations) | not recorded | |
| Law on the Protection of Personal Data, rights of data subjectsLoi n° 14-029/AU, arts. 10-18, 48 (rights of data subjects) | not recorded | |
| Law on the Protection of Personal Data, sensitive personal dataLoi n° 14-029/AU, arts. 6-8, 43(b)-(d) (sensitive personal data) | not recorded | |
| Law on the Protection of Personal Data, the Commission and sanctionsLoi n° 14-029/AU, arts. 19-40, 47, 54-65 (enforcement, sanctions and offenses) | not recorded | |
| Law on the Protection of Personal Data, transfer to a foreign stateLoi n° 14-029/AU, arts. 9, 43(h) (cross border transfer) | not recorded | |
| Côte d'Ivoire ci 5 instruments | ||
| Law No. 2013-450 on the Protection of Personal DataLoi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel, arts. 1-20, 22, 27, 39-44 (lawful basis, registration and security) | not recorded | |
| Law No. 2013-450 on the Protection of Personal Data, cross-border transferLoi n° 2013-450, arts. 7, 26 (cross-border transfer) | not recorded | |
| Law No. 2013-450 on the Protection of Personal Data, enforcement and the Protection BodyLoi n° 2013-450, arts. 45-52 (enforcement and the Protection Body) | not recorded | |
| Law No. 2013-450 on the Protection of Personal Data, rights of the data subjectLoi n° 2013-450, arts. 25, 28-38 (rights of the data subject) | not recorded | |
| Law No. 2013-450 on the Protection of Personal Data, sensitive categories of personal dataLoi n° 2013-450, arts. 7, 21 (sensitive categories of personal data) | not recorded | |
| Democratic Republic of the Congo cd 6 instruments | ||
| Digital Code, Data Protection Authority and sanctionsCode du numérique, Titre III, arts. 234, 249 à 261 et Titre IV, arts. 262 à 270 (autorité de protection des données, sanctions et voies de recours) | 2023-03-13 | |
| Digital Code, Title III, cross-border transfer of personal dataCode du numérique, Titre III, arts. 201 à 203 (transfert des données personnelles) | 2023-03-13 | |
| Digital Code, Title III, personal data breach notificationCode du numérique, Titre III, art. 244 (violation de données à caractère personnel) | 2023-03-13 | |
| Digital Code, Title III, rights of the data subjectCode du numérique, Titre III, arts. 200, 207 à 218, 220, 235 à 237, 240 à 242 et 248 (droits de la personne concernée) | 2023-03-13 | |
| Digital Code, Title III, sensitive personal data and minorsCode du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs) | 2023-03-13 | |
| Digital Code, Title III: Personal Data ProtectionCode du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) | 2023-03-13 | |
| Djibouti dj 6 instruments | ||
| Digital Code, Book I: Personal Data Protection and CNDPLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier, Arts. 2 à 13, 54, 57 et 66 à 73 (objet, champ d'application, obligations du responsable de traitement et formalités préalables) | 2025-09-18 | |
| Digital Code, Book I: automated individual decision-makingCode Numérique, Livre Premier, Art. 65 (décisions individuelles automatisées) | 2025-09-18 | |
| Digital Code, Book I: cross-border transfer of personal dataCode Numérique, Livre Premier, Arts. 99 à 102 (transferts vers un pays tiers) | 2025-09-18 | |
| Digital Code, Book I: personal-data breach notificationCode Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité) | 2025-09-18 | |
| Digital Code, Book I: sensitive categories of personal data and the minor's consentCode Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles) | 2025-09-18 | |
| Digital Code, Book I: the Commission, administrative sanctions and criminal offencesCode Numérique, Livre Premier, Arts. 104, 135 et 140 à 156 (Commission et sanctions) | 2025-09-18 | |
| Egypt eg 6 instruments | ||
| Egypt Personal Data Protection Law, Personal Data Infringement notificationLaw No. 151 of 2020, Article 7 (Personal Data Infringement notification) | 2020-10-16 | |
| Egypt Personal Data Protection Law, Sensitive Personal Data and a child's dataLaw No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data) | 2020-10-16 | |
| Egypt Personal Data Protection Law, cross-border transfer of Personal DataLaw No. 151 of 2020, Articles 14-16 (cross-border transfer of Personal Data) | 2020-10-16 | |
| Egypt Personal Data Protection Law, rights of the Data SubjectLaw No. 151 of 2020, Articles 2, 32 and 33 (rights of the Data Subject) | 2020-10-16 | |
| Egypt Personal Data Protection Law, the Center, judicial control and penaltiesLaw No. 151 of 2020, Articles 19-31 and 34-44 (the Center, judicial control and penalties) | 2020-10-16 | |
| Law No. 151 of 2020 Promulgating the Personal Data Protection LawLaw No. 151 of 2020 Promulgating the Personal Data Protection Law, general duties (annexed arts. 1-6, 8-11, 13 and 17-18) | 2020-10-16 | |
| Equatorial Guinea gq 1 instrument | ||
| Ley de Protección de Datos PersonalesLey Núm. 1/2016, de 22 de julio, de Protección de Datos Personales | not recorded | |
| Eritrea er 2 instruments | ||
| Civil Code of the State of Eritrea, Personality Rights (Image and Correspondence)Civil Code of the State of Eritrea (2015), arts. 26-30 (Image and Privacy; Inviolability of Correspondence) | [future] | |
| Penal Code of the State of Eritrea, Violation of PrivacyPenal Code of the State of Eritrea (2015), art. 298 (Violation of Privacy) | [future] | |
| Eswatini sz 6 instruments | ||
| Data Protection Act, 2022 (Act No. 5 of 2022)Data Protection Act, 2022 (Act No. 5 of 2022), ss. 1-5, 7-16, 18, 21, 31, 46-48, 54-55 (general processing principles) | 2022-03-04 | |
| Data Protection Act, 2022, enforcement and offencesData Protection Act, 2022, ss. 6, 34-43, 49-50, 52-53 (enforcement and offences) | 2022-03-04 | |
| Data Protection Act, 2022, notification of security compromisesData Protection Act, 2022, s. 17 (notification of security compromises) | 2022-03-04 | |
| Data Protection Act, 2022, rights of data subjectsData Protection Act, 2022, ss. 19-20, 44-45, 51 (rights of data subjects) | 2022-03-04 | |
| Data Protection Act, 2022, sensitive personal informationData Protection Act, 2022, ss. 22-30 (sensitive personal information) | 2022-03-04 | |
| Data Protection Act, 2022, transfer of personal information outside EswatiniData Protection Act, 2022, ss. 32-33 (transfer outside Eswatini) | 2022-03-04 | |
| Ethiopia et 6 instruments | ||
| Personal Data Protection ProclamationProclamation No. 1321/2024 (Federal Negarit Gazette), arts. 1-3, 6-8, 12-17, 33-42 and 45-52 | 2024-07-24 | |
| Personal Data Protection Proclamation, cross-border transfer and data sovereigntyProclamation No. 1321/2024, arts. 18-22 (cross-border transfer and data sovereignty) | 2024-07-24 | |
| Personal Data Protection Proclamation, enforcement, sanctions and offencesProclamation No. 1321/2024, arts. 55-64 (enforcement, administrative sanctions and offences) | 2024-07-24 | |
| Personal Data Protection Proclamation, personal data breach notificationProclamation No. 1321/2024, arts. 43-44 (personal data breach notification) | 2024-07-24 | |
| Personal Data Protection Proclamation, rights of data subjectsProclamation No. 1321/2024, arts. 24-32 (rights of data subjects) | 2024-07-24 | |
| Personal Data Protection Proclamation, sensitive personal data and minorsProclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors) | 2024-07-24 | |
| Gabon ga 6 instruments | ||
| Law No. 025/2023, interconnection and cross-border transfer of personal dataLoi n°025/2023, articles 168 à 174 (interconnexion et transfert transfrontalier de données) | 2023-07-15 | |
| Law No. 025/2023, personal-data breach notificationLoi n°025/2023, articles 142 à 147 (violation de données à caractère personnel) | 2023-07-15 | |
| Law No. 025/2023, recourse, oversight and sanctionsLoi n°025/2023, articles 200 à 214 (recours, contrôle et sanctions) | 2023-07-15 | |
| Law No. 025/2023, rights of the data subject and transparency obligationsLoi n°025/2023, articles 43 à 69 et 91 à 110 (droits de la personne concernée et obligation de transparence) | 2023-07-15 | |
| Law No. 025/2023, sensitive categories of personal data and children's dataLoi n°025/2023, articles 74 à 77, 148 à 163 et 188 à 199 (catégories sensibles de données et protection des mineurs) | 2023-07-15 | |
| Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023, articles 1 à 6, 70 à 73, 78 à 90, 111 à 141, 164 à 167, 175 à 187 et 215 à 221 | 2023-07-15 | |
| Gambia gm 6 instruments | ||
| Personal Data Protection and Privacy Act, 2025Personal Data Protection and Privacy Act, 2025, scope, principles, lawful basis and the obligations of controllers and processors | [future] | |
| Personal Data Protection and Privacy Act, 2025, personal data breach notificationPersonal Data Protection and Privacy Act, 2025, breach notification | [future] | |
| Personal Data Protection and Privacy Act, 2025, rights of the data subjectPersonal Data Protection and Privacy Act, 2025, rights of the data subject | [future] | |
| Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's dataPersonal Data Protection and Privacy Act, 2025, sensitive personal data and children's data | [future] | |
| Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penaltiesPersonal Data Protection and Privacy Act, 2025, offences, penalties and the Information Commission | [future] | |
| Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The GambiaPersonal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia | [future] | |
| Ghana gh 5 instruments | ||
| Data Protection ActData Protection Act, 2012 (Act 843), ss. 1-30, 45-74 and 82-94 | not recorded | |
| Data Protection Act, enforcement, offences and penaltiesData Protection Act, 2012 (Act 843), ss. 43, 75-81, 88-89 and 95 (enforcement, offences and penalties) | not recorded | |
| Data Protection Act, notification of security compromisesData Protection Act, 2012 (Act 843), s. 31 (notification of security compromises) | not recorded | |
| Data Protection Act, rights of data subjectsData Protection Act, 2012 (Act 843), ss. 32-36 and 39-44 (rights of data subjects) | not recorded | |
| Data Protection Act, special personal dataData Protection Act, 2012 (Act 843), ss. 37-38 (special personal data) | not recorded | |
| Guinea gn 1 instrument | ||
| Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif à la protection des données à caractère personnelLoi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel | not recorded | |
| Kenya ke 7 instruments | ||
| Data Protection (General) Regulations, 2021Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50 | 2022-01-14 | |
| Data Protection Act, 2019Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) | 2019-11-25 | |
| Data Protection Act, 2019, enforcement, penalties and compensationData Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74) | 2019-11-25 | |
| Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach) | 2019-11-25 | |
| Data Protection Act, 2019, rights of data subjects and automated decision-makingData Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-38 (rights of data subjects, including automated individual decision-making, s. 35) | 2019-11-25 | |
| Data Protection Act, 2019, sensitive personal dataData Protection Act, 2019 (No. 24 of 2019), Part V (ss. 44-47) | 2019-11-25 | |
| Data Protection Act, 2019, transfer of personal data outside KenyaData Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54) | 2019-11-25 | |
| Lesotho ls 6 instruments | ||
| Data Protection Act, 2011 (Act No. 5 of 2012)Data Protection Act, 2011 (Act No. 5 of 2012), ss. 1-22, 24, 28, 38, 53-54, 56-57 (general processing principles) | 2012-02-22 | |
| Data Protection Act, 2011, enforcement and offencesData Protection Act, 2011, ss. 39-49, 55 (enforcement and offences) | 2012-02-22 | |
| Data Protection Act, 2011, notification of security compromisesData Protection Act, 2011, s. 23 (notification of security compromises) | 2012-02-22 | |
| Data Protection Act, 2011, rights of data subjectsData Protection Act, 2011, ss. 25-27, 50-51 (rights of data subjects) | 2012-02-22 | |
| Data Protection Act, 2011, sensitive personal informationData Protection Act, 2011, ss. 29-37 (sensitive personal information) | 2012-02-22 | |
| Data Protection Act, 2011, transfer of personal information outside LesothoData Protection Act, 2011, s. 52 (transfer outside Lesotho) | 2012-02-22 | |
| Liberia lr 2 instruments | ||
| Data Protection Act of LiberiaAn Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia) | [future] | |
| Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)Telecommunications Act of 2007, §§ 51-52 (Protection of Personal Information) | not recorded | |
| Libya ly 4 instruments | ||
| Law No. 6 of 2022, cross border transfer of personal dataLaw No. 6 of 2022, art. 78 (Electronic Transactions, cross border transfer) | 2022-10-04 | |
| Law No. 6 of 2022, notice, access and objection rights over personal dataLaw No. 6 of 2022, arts. 76-77, 79 (Electronic Transactions, notice, access and objection) | 2022-10-04 | |
| Law No. 6 of 2022, protection of personal data collected in electronic transactionsLaw No. 6 of 2022 Concerning Electronic Transactions, arts. 73-75 (Protection of Personal Data: lawful basis, purpose limitation and confidentiality) | 2022-10-04 | |
| Law No. 6 of 2022, supervisory authority, licensing and penaltiesLaw No. 6 of 2022, arts. 80-82 (Electronic Transactions, licensing and penalties) | 2022-10-04 | |
| Madagascar mg 5 instruments | ||
| Law No. 2014-038, CMIL, sanctions and offencesLoi n° 2014-038, arts. 4, 28-42, 50, 55-60, 61-73 (commission, contrôle, sanctions et pénalités) | 2015-01-09 | |
| Law No. 2014-038, cross-border transfer of personal dataLoi n° 2014-038, art. 20 (transfert de données à l'étranger) | 2015-01-09 | |
| Law No. 2014-038, protection of personal dataLoi n° 2014-038 sur la protection des données à caractère personnel, arts. 1-2, 5-17, 21, 43-49, 51-54 (dispositions générales, champ d'application, principes fondamentaux, formalités préalables et délégué à la protection des données) | 2015-01-09 | |
| Law No. 2014-038, rights of data subjectsLoi n° 2014-038, arts. 3, 22-27 (droits des personnes) | 2015-01-09 | |
| Law No. 2014-038, sensitive personal dataLoi n° 2014-038, arts. 18-19 (données sensibles) | 2015-01-09 | |
| Malawi mw 3 instruments | ||
| Data Protection Act, 2024Data Protection Act, 2024 | [future] | |
| Electronic Transactions and Cyber Security Act, 2016, personal data processing and security duties (Part VII)Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71, 74) | 2017-06-01 | |
| Electronic Transactions and Cyber Security Act, 2016, rights of a data subject and information notice (Part VII)ss. 72-73, Electronic Transactions and Cyber Security Act, 2016 (rights of a data subject; information notice) | 2017-06-01 | |
| Mali ml 5 instruments | ||
| Loi n° 2013-015, automated decisions and rights of data subjectsLoi n° 2013-015, arts. 2, 12-19 (automated decisions and rights of data subjects) | 2013-06-28 | |
| Loi n° 2013-015, protection des données à caractère personnelLoi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali, telle que modifiée, arts. 1, 4-8, 57 (objet, champ d'application, principes et déclaration) | 2013-06-28 | |
| Loi n° 2013-015, sensitive data and offence recordsLoi n° 2013-015, arts. 9-10 (sensitive data and offence records) | 2013-06-28 | |
| Loi n° 2013-015, the Autorité, supervision, and sanctionsLoi n° 2013-015, arts. 20-56, 58-67 (the Autorité, supervision, and sanctions) | 2013-06-28 | |
| Loi n° 2013-015, transfer of personal data abroadLoi n° 2013-015, art. 11 (transfer of personal data abroad) | 2013-06-28 | |
| Mauritania mr 5 instruments | ||
| Loi n° 2017-020, Autorité de Protection des Données et sanctionsLoi n° 2017-020 du 22 juillet 2017, arts. 64-98 (Autorité de Protection des Données et sanctions) | 2017-07-22 | |
| Loi n° 2017-020, catégories sensibles de donnéesLoi n° 2017-020 du 22 juillet 2017, arts. 12-16, 37 (catégories sensibles de données) | 2017-07-22 | |
| Loi n° 2017-020, droits de la personne concernéeLoi n° 2017-020 du 22 juillet 2017, arts. 18-19, 50-63 (droits de la personne concernée) | 2017-07-22 | |
| Loi n° 2017-020, protection des données à caractère personnelLoi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel, arts. 1, 3-11, 17, 26-49 (principes généraux, formalités préalables et obligations du responsable) | 2017-07-22 | |
| Loi n° 2017-020, transferts vers un pays tiersLoi n° 2017-020 du 22 juillet 2017, arts. 20-25 (transferts vers un pays tiers) | 2017-07-22 | |
| Mauritius mu 6 instruments | ||
| Data Protection Act 2017, enforcement, offences and penaltiesData Protection Act 2017 (Act No. 20 of 2017), ss. 9, 42-43, 51-54 (enforcement, offences and penalties) | 2018-01-15 | |
| Data Protection Act 2017, establishment and lawful processingData Protection Act 2017 (Act No. 20 of 2017), ss. 1-28, 30 (establishment, principles, lawful processing, and personal data of a child) | 2018-01-15 | |
| Data Protection Act 2017, personal data breach notificationData Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach) | 2018-01-15 | |
| Data Protection Act 2017, rights of data subjectsData Protection Act 2017 (Act No. 20 of 2017), ss. 37-41 (rights of data subjects, including automated individual decision making, s. 38) | 2018-01-15 | |
| Data Protection Act 2017, special categories of personal dataData Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data) | 2018-01-15 | |
| Data Protection Act 2017, transfer of personal data outside MauritiusData Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius) | 2018-01-15 | |
| Morocco ma 5 instruments | ||
| Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataLoi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009), arts. 1-4, 12-20, 23, 25-26, 45-48 (dispositions générales, déclaration et sécurité) | not recorded | |
| Law No. 09-08, rights of the data subjectLoi n° 09-08, arts. 5-11 (droits de la personne concernée) | not recorded | |
| Law No. 09-08, sensitive personal data and offense recordsLoi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées) | not recorded | |
| Law No. 09-08, the CNDP and sanctionsLoi n° 09-08, arts. 27-42, 51-66 (Commission nationale, sanctions) | not recorded | |
| Law No. 09-08, transfer of data to a foreign countryLoi n° 09-08, arts. 43-44 (transfert de données vers un pays étranger) | not recorded | |
| Mozambique mz 3 instruments | ||
| Electronic Transactions Law, Protection of Personal Electronic DataLei n.º 3/2017, de 9 de Janeiro, arts. 63(1)-(2), (5), 64, 65(1), (3) (dever de protecção de dados) | not recorded | |
| Electronic Transactions Law, data protection contraventions and enforcementLei n.º 3/2017, de 9 de Janeiro, arts. 67(m), 68(c), 69-70 (contravenções e fiscalização) | not recorded | |
| Electronic Transactions Law, data subject rights and information noticeLei n.º 3/2017, de 9 de Janeiro, arts. 63(3)-(4), (6), 65(2) (direitos do titular dos dados) | not recorded | |
| Niger ne 6 instruments | ||
| Loi n° 2022-59, contrôle, sanctions et recoursLoi n° 2022-59, arts. 87-110 (contrôle, sanctions administratives, dispositions pénales et recours) | not recorded | |
| Loi n° 2022-59, données sensibles, de santé et biométriquesLoi n° 2022-59, arts. 42-50 (données sensibles, de santé, génétiques et biométriques) | not recorded | |
| Loi n° 2022-59, droits des personnes concernéesLoi n° 2022-59, arts. 51-52 et 68-76 (droits des personnes concernées) | not recorded | |
| Loi n° 2022-59, notification des violations de donnéesLoi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel) | not recorded | |
| Loi n° 2022-59, protection des données à caractère personnelLoi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024, arts. 2-5, 29-41, 64-67 et 77-86 (objet, champ d'application, formalités, principes directeurs et outils de conformité) | not recorded | |
| Loi n° 2022-59, transfert transfrontalier des donnéesLoi n° 2022-59, arts. 62-63 (transfert des données vers un autre État) | not recorded | |
| Nigeria ng 6 instruments | ||
| Nigeria Data Protection Act, 2023 (NDPA), general data protection dutiesNigeria Data Protection Act, 2023 (No. 37 of 2023), general duties (ss. 1-3, 24-29, 32-33, 39 and 63-65; GAID 2025, arts. 1-17, 19-32, 34-35 and 41-42) | 2023-06-12 | |
| Nigeria Data Protection Act, 2023, complaints, enforcement and redressNigeria Data Protection Act, 2023, complaints and enforcement (ss. 46 and 48; GAID 2025, arts. 39, 47 and 48) | 2023-06-12 | |
| Nigeria Data Protection Act, 2023, cross-border data transferNigeria Data Protection Act, 2023, cross-border data transfer (Part VIII; GAID 2025, art. 45 and Schedule 5) | 2023-06-12 | |
| Nigeria Data Protection Act, 2023, data breach notificationNigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33) | 2023-06-12 | |
| Nigeria Data Protection Act, 2023, rights of a data subjectNigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) | 2023-06-12 | |
| Nigeria Data Protection Act, 2023, sensitive personal data and a child's dataNigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) | 2023-06-12 | |
| Republic of the Congo cg 6 instruments | ||
| Law No. 29-2019 on the Protection of Personal DataLoi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel, articles 2, 3, 5 à 12, 31 à 45, 63 à 70 et 79 à 91 (champ d'application, principes, formalités préalables et obligations du responsable de traitement) | not recorded | |
| Law No. 29-2019, cross-border transfer of personal dataLoi n° 29-2019, articles 23 à 25 (transfert transfrontalier de données à caractère personnel) | not recorded | |
| Law No. 29-2019, personal-data breach notificationLoi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel) | not recorded | |
| Law No. 29-2019, rights of the data subjectLoi n° 29-2019, articles 13 et 46 à 62 (droits de la personne concernée) | not recorded | |
| Law No. 29-2019, sanctionsLoi n° 29-2019, articles 92 à 98 (sanctions administratives et pénales) | not recorded | |
| Law No. 29-2019, special categories of personal dataLoi n° 29-2019, articles 4, 14 à 19 et 37 (catégories particulières de données et autorisation préalable) | not recorded | |
| Rwanda rw 6 instruments | ||
| Law relating to the Protection of Personal Data and PrivacyLaw N° 58/2021, arts. 1-8, 13-17, 29-41, 46-47 and 51-52, relating to the Protection of Personal Data and Privacy | 2021-10-15 | |
| Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storageLaw N° 58/2021, arts. 48-50 (cross-border transfer and data localisation) | 2021-10-15 | |
| Law relating to the Protection of Personal Data and Privacy, personal data breach notificationLaw N° 58/2021, arts. 43-45 (personal data breach notification) | 2021-10-15 | |
| Law relating to the Protection of Personal Data and Privacy, rights of the data subjectLaw N° 58/2021, arts. 18-26 and 42 (rights of the data subject and the information notice) | 2021-10-15 | |
| Law relating to the Protection of Personal Data and Privacy, sensitive personal data and children's dataLaw N° 58/2021, arts. 9-12 (sensitive personal data, children's data and criminal records) | 2021-10-15 | |
| Law relating to the Protection of Personal Data and Privacy, supervisory authority, penalties and offencesLaw N° 58/2021, arts. 27-28 and 53-65 (supervisory authority, penalties, offences and compensation) | 2021-10-15 | |
| Sao Tome and Principe st 5 instruments | ||
| Lei n.º 03/2016, Protecção de Dados PessoaisLei n.º 03/2016, de 15 de Fevereiro de 2016, sobre a Protecção de Dados Pessoais, arts. 1-6, 9, 15, 17-18, 21-26, 45, 47 | not recorded | |
| Lei n.º 03/2016, enforcement, offenses and the NAPPDLei n.º 03/2016, arts. 14, 27-44 (compensation, complaints, administrative offenses, crimes and the NAPPD) | not recorded | |
| Lei n.º 03/2016, rights of the data holderLei n.º 03/2016, arts. 10-13 (information, access, opposition and automated decisions) | not recorded | |
| Lei n.º 03/2016, sensitive categories and suspect recordsLei n.º 03/2016, arts. 7-8, 16 (sensitive categories, criminal-offense records and special security measures) | not recorded | |
| Lei n.º 03/2016, transfer of personal data abroadLei n.º 03/2016, arts. 19-20 (transfer of personal data abroad) | not recorded | |
| Senegal sn 5 instruments | ||
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, arts. 1-4, 17-24, 33-39, 45-46, 52-57, 70-74 (principes généraux, formalités préalables et obligations du responsable) | 2008-01-25 | |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctionsLoi n° 2008-12 du 25 janvier 2008, arts. 5-16, 25-32, 75 (Commission des Données Personnelles, contrôles et sanctions) | 2008-01-25 | |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, catégories sensibles de donnéesLoi n° 2008-12 du 25 janvier 2008, arts. 20, 40-44 (catégories sensibles de données) | 2008-01-25 | |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, droits de la personne concernéeLoi n° 2008-12 du 25 janvier 2008, arts. 47-48, 58-69 (droits de la personne concernée) | 2008-01-25 | |
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, transferts vers un pays tiersLoi n° 2008-12 du 25 janvier 2008, arts. 49-51 (transferts vers un pays tiers) | 2008-01-25 | |
| Seychelles sc 6 instruments | ||
| Data Protection Act, 2023, application and processing principlesData Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles) | 2023-12-22 | |
| Data Protection Act, 2023, cross-border data flowsData Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows) | 2023-12-22 | |
| Data Protection Act, 2023, enforcement and penaltiesData Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties) | 2023-12-22 | |
| Data Protection Act, 2023, personal data breach notificationData Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach) | 2023-12-22 | |
| Data Protection Act, 2023, rights of data subjectsData Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights) | 2023-12-22 | |
| Data Protection Act, 2023, sensitive data and data of minorsData Protection Act, 2023 (Act 24 of 2023), ss. 22-24 (processing special categories of personal data) | 2023-12-22 | |
| Somalia so 6 instruments | ||
| Data Protection Act No. 005 of 2023Data Protection Act, Law No. 005 of 2023 (Federal Republic of Somalia), arts. 4-5, 14-15, 17, 19, 24, 29, 32-34 | not recorded | |
| Data Protection Act, 2023, complaints, orders of the Authority and civil remediesData Protection Act, Law No. 005 of 2023, arts. 35-40 (complaints, orders and civil remedies) | not recorded | |
| Data Protection Act, 2023, cross-border transfers of personal dataData Protection Act, Law No. 005 of 2023, arts. 30-31 (cross-border transfers) | not recorded | |
| Data Protection Act, 2023, information to the data subject and rights of the data subjectData Protection Act, Law No. 005 of 2023, arts. 18 and 20-23 (information and rights of the data subject) | not recorded | |
| Data Protection Act, 2023, personal data breach notificationData Protection Act, Law No. 005 of 2023, arts. 25-27 (data breach notifications) | not recorded | |
| Data Protection Act, 2023, sensitive personal data and children's consentData Protection Act, Law No. 005 of 2023, arts. 2(15), 14(5) and 16 (sensitive personal data and children) | not recorded | |
| South Africa za 6 instruments | ||
| Protection of Personal Information Act 4 of 2013 (POPIA)Protection of Personal Information Act 4 of 2013 (POPIA), ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation) | 2020-07-01 | |
| Protection of Personal Information Act, cross-border transferPOPIA, s. 72 (transfer of personal information outside the Republic) | 2020-07-01 | |
| Protection of Personal Information Act, notification of security compromisesPOPIA, s. 22 (notification of security compromises) | 2020-07-01 | |
| Protection of Personal Information Act, rights of data subjectsPOPIA, ss. 18, 23-25 and 69-71 (the information notice, access and correction, direct marketing and automated decision making) | 2020-07-01 | |
| Protection of Personal Information Act, special personal information and childrenPOPIA, ss. 26-35 (special personal information and children) | 2020-07-01 | |
| Protection of Personal Information Act, the Information Regulator, enforcement and penaltiesPOPIA, ss. 39-54 and 73-109 (the Information Regulator, enforcement, civil remedies, offences and administrative fines) | 2020-07-01 | |
| Tanzania tz 6 instruments | ||
| Personal Data Protection Act, 2022Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 1-5, 14, 21-26 (principles, application and registration) | 2023-05-01 | |
| Personal Data Protection Act, 2022, investigation, enforcement and offencesPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty) | 2023-05-01 | |
| Personal Data Protection Act, 2022, rights of data subjectsPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VI (ss. 33-38, rights of data subjects, including automated decision-making, s. 36, and compensation, s. 37) | 2023-05-01 | |
| Personal Data Protection Act, 2022, security and breach notificationPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data) | 2023-05-01 | |
| Personal Data Protection Act, 2022, sensitive personal dataPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) | 2023-05-01 | |
| Personal Data Protection Act, 2022, transborder data flowPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection) | 2023-05-01 | |
| Togo tg 5 instruments | ||
| Loi n° 2019-014, cadre institutionnel et dispositions pénalesLoi n° 2019-014 du 29 octobre 2019, arts. 55-74, 79-93 (institutional framework, sanctions and offenses) | not recorded | |
| Loi n° 2019-014, données sensiblesLoi n° 2019-014 du 29 octobre 2019, arts. 8, 21-25 (sensitive personal data) | not recorded | |
| Loi n° 2019-014, droits de la personne concernéeLoi n° 2019-014 du 29 octobre 2019, arts. 26-27, 35-50 (rights of data subjects) | not recorded | |
| Loi n° 2019-014, protection des données à caractère personnelLoi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel, arts. 1-20, 32-34, 51-54, 75-78 and 94-97 (comprehensive regime, formalities and obligations) | not recorded | |
| Loi n° 2019-014, transfert des données vers un pays tiersLoi n° 2019-014 du 29 octobre 2019, arts. 28-31 (cross border transfer) | not recorded | |
| Tunisia tn 5 instruments | ||
| Organic Act on the Protection of Personal DataLoi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel, arts. 1-12, 16-26, 44-49, 53-61, 66-74, 104-105 (comprehensive regime) | 2004-07-30 | |
| Organic Act on the Protection of Personal Data, cross-border transferLoi organique n° 2004-63, arts. 50-52 (transfert des données à l'étranger) | 2004-07-30 | |
| Organic Act on the Protection of Personal Data, enforcement and sanctionsLoi organique n° 2004-63, arts. 75-103 (l'Instance et les sanctions) | 2004-07-30 | |
| Organic Act on the Protection of Personal Data, rights of the data subjectLoi organique n° 2004-63, arts. 27, 29-43 (droits de la personne concernée) | 2004-07-30 | |
| Organic Act on the Protection of Personal Data, sensitive categories and minorsLoi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs) | 2004-07-30 | |
| Uganda ug 6 instruments | ||
| Data Protection and Privacy Act, 2019, breach notificationData Protection and Privacy Act, 2019, s. 23 (breach notification) | 2019-05-03 | |
| Data Protection and Privacy Act, 2019, children and special personal dataData Protection and Privacy Act, 2019, ss. 8-9 (children and special personal data) | 2019-05-03 | |
| Data Protection and Privacy Act, 2019, comprehensive personal-data regimeData Protection and Privacy Act, 2019 (Chapter 97), ss. 1-7, 10-12, 14-15, 17-18, 20-22, 29-30 (principles, lawful basis, security and registration) | 2019-05-03 | |
| Data Protection and Privacy Act, 2019, cross-border transferData Protection and Privacy Act, 2019, s. 19 (cross-border transfer) | 2019-05-03 | |
| Data Protection and Privacy Act, 2019, enforcement and offencesData Protection and Privacy Act, 2019, ss. 31-38 (enforcement and offences) | 2019-05-03 | |
| Data Protection and Privacy Act, 2019, rights of data subjectsData Protection and Privacy Act, 2019, ss. 13, 16, 24-28 (rights of data subjects) | 2019-05-03 | |
| Zambia zm 6 instruments | ||
| Data Protection Act, 2021, notification of a security breachData Protection Act, 2021, s. 49 (notification of a security breach) | 2021-04-01 | |
| Data Protection Act, 2021, offences, penalties, complaints and redressData Protection Act, 2021, ss. 18, 55 and 68-77 (offences, penalties, complaints and redress) | 2021-04-01 | |
| Data Protection Act, 2021, personal data processing frameworkData Protection Act, 2021 (Act No. 3 of 2021), general duties (ss. 1-13, 15-16, 19-48 and 50-57) | 2021-04-01 | |
| Data Protection Act, 2021, rights of the data subjectData Protection Act, 2021, ss. 58-67 (rights of the data subject) | 2021-04-01 | |
| Data Protection Act, 2021, sensitive personal data, children and vulnerable personsData Protection Act, 2021, ss. 14 and 17 (sensitive personal data, children and vulnerable persons) | 2021-04-01 | |
| Data Protection Act, 2021, transfer of personal data outside the RepublicData Protection Act, 2021, ss. 70-71 (transfer of personal data outside the Republic) | 2021-04-01 | |
| Zimbabwe zw 9 instruments | ||
| Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024), licensing, the data protection officer and security (ss. 3-9 and 11-16) | 2024-09-13 | |
| Cyber and Data Protection Act [Chapter 12:07]Cyber and Data Protection Act, No. 5 of 2021 (Zimbabwe), general duties (ss. 8-10, 13, 15-18 and 20-27) | 2022-03-11 | |
| Cyber and Data Protection Act, rights of the data subjectCyber and Data Protection Act, No. 5 of 2021, ss. 14-16, 25-26 (rights of the data subject) | 2022-03-11 | |
| Cyber and Data Protection Act, security breach notificationCyber and Data Protection Act, No. 5 of 2021, s. 19 (security breach notification) | 2022-03-11 | |
| Cyber and Data Protection Act, sensitive, genetic, biometric and health dataCyber and Data Protection Act, No. 5 of 2021, ss. 11-12 (sensitive information and genetic, biometric and health data) | 2022-03-11 | |
| Cyber and Data Protection Act, the Authority, offences and appealsCyber and Data Protection Act, No. 5 of 2021, ss. 5-7, 30-34 (the Authority, offences and appeals) | 2022-03-11 | |
| Cyber and Data Protection Act, transfer of personal information outside ZimbabweCyber and Data Protection Act, No. 5 of 2021, ss. 28-29 (transfer outside Zimbabwe) | 2022-03-11 | |
| Cyber and Data Protection Regulations 2024, children's information and automated decisionsStatutory Instrument 155 of 2024, regulation 10 (children's information and automated decisions) | 2024-09-13 | |
| Cyber and Data Protection Regulations 2024, security breach notificationStatutory Instrument 155 of 2024, regulation 17 (security breach notification) | 2024-09-13 | |
| Oceania | ||
| Australia au 5 instruments | ||
| Privacy Act 1988 (Cth), Comprehensive Regime and Civil PenaltiesPrivacy Act 1988 (Cth), No. 119, 1988, ss. 6, 13, 13G, 13H, 14, 15 | 1989-01-01 | |
| Privacy Act 1988 (Cth), Notifiable Data Breaches SchemePrivacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL | 2018-02-22 | |
| Privacy Act 1988 (Cth), Schedule 1, Sensitive and Biometric InformationPrivacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6 | 2014-03-12 | |
| Privacy Act 1988 (Cth), Schedule 2, Statutory Tort for Serious Invasions of PrivacyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 2, inserting Schedule 2 to the Privacy Act 1988 | 2025-06-10 | |
| Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making TransparencyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988 | 2026-12-10[future] | |
| Kiribati ki 6 instruments | ||
| Data Protection Act 2025Data Protection Act 2025, ss. 1-11, 14, 18, 21-22, 32-33 (lawful basis, purpose limitation, controller and processor duties, security measures, data protection impact assessments) | [future] | |
| Data Protection Act 2025, children and individuals lacking capacityData Protection Act 2025, s. 12 (consent for children and individuals lacking capacity) | [future] | |
| Data Protection Act 2025, enforcement, offences and civil remediesData Protection Act 2025, ss. 26-31 (complaints, investigations, notices, offences and civil remedies) | [future] | |
| Data Protection Act 2025, personal data breachesData Protection Act 2025, ss. 19-20 (personal data breaches) | [future] | |
| Data Protection Act 2025, processing and transfers outside KiribatiData Protection Act 2025, ss. 23-25 (processing and transfers outside Kiribati) | [future] | |
| Data Protection Act 2025, rights of a data subjectData Protection Act 2025, ss. 13, 15-17 (information notice and rights of data subjects) | [future] | |
| Marshall Islands mh 3 instruments | ||
| Criminal Code 2011, Violation of Privacy (unlawful eavesdropping, surveillance, and breach of privacy of messages)Criminal Code 2011, 31 MIRC Ch. 1, sec. 250.12 | 2011-10-17 | |
| Personal Data Protection Act 2025, competent authority, remedies, and complaintsPersonal Data Protection Act 2025, ss. 406-408, 410-414, 416-417 (6 MIRC Ch. 4, P.L. 2025-43) | 2025-10-07 | |
| Personal Data Protection Act 2025, government personal-data protection principlesPersonal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43), ss. 401-405, 409, 415, 418 | 2025-10-07 | |
| Nauru nr 1 instrument | ||
| Communications and Broadcasting Act 2018, confidentiality of subscriber information and communicationsCommunications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70-71 | 2018-05-10 | |
| New Zealand nz 5 instruments | ||
| Privacy Act 2020, Compliance Notices and OffencesPrivacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212 | 2020-12-01 | |
| Privacy Act 2020, Information Privacy Principle 12 (Disclosure Outside New Zealand)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12) | 2020-12-01 | |
| Privacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 3A), inserted by the Privacy Amendment Act 2025 (NZ), No 53, s. 4 | 2026-05-01 | |
| Privacy Act 2020, Information Privacy Principles and Extraterritorial ReachPrivacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13) | 2020-12-01 | |
| Privacy Act 2020, Notifiable Privacy BreachesPrivacy Act 2020 (NZ), No 31, ss. 112-118 | 2020-12-01 | |
| Samoa ws 3 instruments | ||
| National Digital Identification Act 2024, personal data breach notificationNational Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification) | 2024-02-05 | |
| National Digital Identification Act 2024, registered persons' data-subject rightsNational Digital Identification Act 2024, No. 3 (Samoa), s. 51 (registered persons' rights) | 2024-02-05 | |
| Telecommunications Act 2005, confidentiality and protection of customer personal informationTelecommunications Act 2005, No. 20 (Samoa), ss. 48-51, 75A-75B (confidentiality and protection of customer personal information) | 2005-07-27 | |
| Solomon Islands sb 1 instrument | ||
| Telecommunications Act 2009, Confidentiality and Consent DutiesTelecommunications Act 2009 (Solomon Islands), Part 11 (Relations with Consumers), ss. 72-74 | not recorded | |
| Tonga to 6 instruments | ||
| Privacy Act 2025, comprehensive personal information protection regimePrivacy Act 2025 (Act 34 of 2025), ss. 1-6, 27, 30-32, 34-36 and 38 | [future] | |
| Privacy Act 2025, notification to data subjects and rights of data subjectsPrivacy Act 2025, ss. 33 and 42-47 (notification and rights) | [future] | |
| Privacy Act 2025, penalties, enforcement and third party actionsPrivacy Act 2025, ss. 52-66 (penalties, enforcement and investigation) | [future] | |
| Privacy Act 2025, personal information breachesPrivacy Act 2025, s. 37 (personal information breaches) | [future] | |
| Privacy Act 2025, sensitive personal information and childrenPrivacy Act 2025, ss. 28-29 (sensitive personal information and children) | [future] | |
| Privacy Act 2025, transfers of personal information outside the KingdomPrivacy Act 2025, ss. 39-41 (transfers outside the Kingdom) | [future] | |
| Vanuatu vu 5 instruments | ||
| Data Protection and Privacy Act 2024, comprehensive personal data protection regimeData Protection and Privacy Act No. 13 of 2024, ss. 2-5 and 8 | 2025-01-02 | |
| Data Protection and Privacy Act 2024, enforcement powers and offencesData Protection and Privacy Act No. 13 of 2024, ss. 18-30 | 2025-01-02 | |
| Data Protection and Privacy Act 2024, rights of the data subjectData Protection and Privacy Act No. 13 of 2024, ss. 9-14 | 2025-01-02 | |
| Data Protection and Privacy Act 2024, special categories and children's personal dataData Protection and Privacy Act No. 13 of 2024, ss. 6-7 | 2025-01-02 | |
| Data Protection and Privacy Act 2024, transborder data flowsData Protection and Privacy Act No. 13 of 2024, ss. 15-17 | 2025-01-02 | |
| Other | ||
| Bermuda bm 5 instruments | ||
| Personal Information Protection Act 2016, Commissioner, enforcement and offencesPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 26-46, 48 (the Privacy Commissioner, orders, offences and penalties) | not recorded | |
| Personal Information Protection Act 2016, application and general principlesPersonal Information Protection Act 2016 (Bermuda), 2016:43, Parts 1-2 (application, exclusions and general principles) | not recorded | |
| Personal Information Protection Act 2016, breach of security notificationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security) | not recorded | |
| Personal Information Protection Act 2016, cross-border transfer of personal informationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 15 (transfer of personal information to an overseas third party) | not recorded | |
| Personal Information Protection Act 2016, rights of individualsPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals) | not recorded | |
| Cayman Islands ky 4 instruments | ||
| Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offencesData Protection Act (2021 Revision), ss. 52-57 (Ombudsman investigatory powers, monetary penalties and offences) | 2019-09-30 | |
| Data Protection Act 2021 Revision, application, principles and data subject rightsData Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights) | 2019-09-30 | |
| Data Protection Act 2021 Revision, cross-border transfer of personal dataData Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply) | 2019-09-30 | |
| Data Protection Act 2021 Revision, personal data breach notificationData Protection Act (2021 Revision), s. 16 (personal data breaches) | 2019-09-30 | |
| Kosovo xk 7 instruments | ||
| Law No. 06/L-082 on Protection of Personal DataLaw No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale), arts. 1-6, 10, 23-32, 35-43, 73, 75-90 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, direct marketing lawful basis, and other sector-specific processing rules) | 2019-02-25 | |
| Law No. 06/L-082 on Protection of Personal Data, personal data breach notificationLaw No. 06/L-082 on Protection of Personal Data, arts. 33-34 (personal data breach notification) | 2019-03-12 | |
| Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penaltiesLaw No. 06/L-082 on Protection of Personal Data, arts. 52-72, 91-107 (remedies, the supervisory Agency, inspections, and administrative and criminal penalties) | 2019-03-12 | |
| Law No. 06/L-082 on Protection of Personal Data, rights of the data subjectLaw No. 06/L-082 on Protection of Personal Data, arts. 11-22, 74 (rights of the data subject) | 2019-03-12 | |
| Law No. 06/L-082 on Protection of Personal Data, special categories, children and criminal-offence dataLaw No. 06/L-082 on Protection of Personal Data, arts. 7-9 (special categories, children and criminal-offence data) | 2019-03-12 | |
| Law No. 06/L-082 on Protection of Personal Data, transfer of personal data to other states and international organisationsLaw No. 06/L-082 on Protection of Personal Data, arts. 44-51 (transfer of personal data to other states and international organisations) | 2019-03-12 | |
| Law No. 06/L-082 on Protection of Personal Data, use of biometric characteristicsLaw No. 06/L-082 on Protection of Personal Data, arts. 80-83 (use of biometric characteristics) | 2019-03-12 | |
| Taiwan tw 1 instrument | ||
| Personal Data Protection Act (個人資料保護法)Personal Data Protection Act (個人資料保護法), Laws and Regulations Database of the Republic of China (Taiwan), pcode I0050021, as amended effective 2025-10-17 | 2025-10-17 | |
United States: states, territories and cities203 in 57 places
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
What this page claims, and what it does not
The stages are LexLint's own vocabulary. Four of the five boxes are
the binding classes the /law/<jurisdiction> docket already
draws (In force, Enacted but not yet in force, Proposed, and Repealed,
withdrawn or blocked), so a square here and a square there mean the same
thing. A struck-down instrument is spent on both readings.
Enjoined has its own box. Inside "Repealed, withdrawn or blocked" it would sit beside a mark that is a false description of a law a court has paused, and it would pool away a count that reads as a signal: how contested a jurisdictional hook is. The certainty ladder files enjoined as present law and the docket draws it spent; splitting it out here makes that disagreement the reader's choice instead of our silent one. It is off by default, which follows the docket.
One date column, and where a bare date would mislead it says what kind
of date it is. "In force from" is commencement: the earlier of a
published commencement event and the instrument's own effective date, the
same choice lifecycle_band() makes and for the same reason,
neither source is reliably the commencement, and the earlier one cannot make
a law look newer than it is. A bracket qualifies the date where a bare one
would mislead ([future] for a start date still ahead,
[proposed] for a bill with no commencement to show,
[enjoined], [struck down], [repealed],
[superseded] or [withdrawn] for a spent
instrument). Nothing is inferred from our own review date: a row with
neither a date nor a status to explain the gap says "not recorded" instead.
The map is the table. Its fill is the count of instruments at the
stages you chose, binned on the same RAMP_BINS edges
/law/map uses, and it redraws on
every change. Point at, click, or tab to a place for what applies there,
every stage it holds shown even when your filter is excluding it.
Three ways of showing nothing, and they are different claims. A place washed pale holds privacy law your filter is excluding, so widening the filter brings it back. A hatched place is one we track and hold no privacy law for at all: that is a statement about our research, not about the law. A white place has no jurisdiction record for this topic at all. Only the first of the three moves when you change the filter; the other two are facts about us and hold still.
Nothing here needs the script. The default resultset is in the
HTML: counts, tally, map fills and the hidden rows are all rendered at
build. The script recomputes them when a box changes and does nothing else,
which is what lets this page ship under script-src 'self' and
be read whole by a crawler.
Every instrument here links its own note page, which carries the primary source and the date it was read. This is a research index, not legal advice.