LexLint

Know the law your code answers to.

The requirement register

About this documentUpdated 2026-09-21ShowHide

Sean McDermott, Co-Founder and CEO, UnGovr

Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.

Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.

© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.

Corpus figures as of 2026-09-21.

Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.

Every requirement line the LexLint software-law corpus carries for AI, privacy, scraping and cybersecurity law, typed and dated, with the class of duty it belongs to, the party it binds, the territory it reaches through and what a runtime control can do about it. Tabulated by obligation class, and offered whole as a file.

1What this is

The LexLint software-law corpus records each instrument, a provision-level record of a statute or regulation with its citation, source, status and date, together with the requirement lines it imposes: short, atomic statements of what the provision asks, kept in the modal language the text uses. On 2026-09-21 the corpus held 6,825 such lines across the four topics that carry them, AI (1,083), privacy (3,522), scraping (1,149), cybersecurity (1,071), of which 5,713 belong to an instrument in force on that date. This document is the register of those lines: what each one asks, in which class of duty, of which party, reaching through which territory, and what a control on the request path can do about it. It is a reference, read by class; the file in section 6 is the whole of it.

Every line carries the same facts. Its type and the modal language it uses. The party it is addressed to, read off its wording. The obligation classes of its instrument, from a closed list of twenty, which is the axis this register is sorted on. The party whose position triggers scope, restated as one of The 6 parties, and the territorial hook the duty reaches through, which is what Where the parties are builds on. The runtime tier, which says whether a control on the request path can prevent the conduct, detect it, evidence it, or never sees it, and which Legal constraints at the gateway and What you must constrain read by layer. And the jurisdiction, the instrument, its source, its lifecycle band and the date it was read.

The same lines sorted under the sixteen extraction themes of the Agentic AI Foundation's governance working group, with the crosswalk from these classes to those themes, are a separate page outside this handbook: the sixteen themes and the law. This register is keyed on the corpus's classes because a class is recorded on the instrument by the research, while a theme is a rule applied to the wording afterwards.

2Method

Source. 6,825 requirement lines drawn from the LexLint software-law corpus on 2026-09-21. Of those, 5,713 belong to an instrument in force on that date; the rest are enacted but not yet commenced, or proposed, and are kept in the register with their lifecycle band so a reader can see what is coming.

Obligation class. Recorded on the instrument by the research, one or more per instrument from a closed list of twenty; a line takes its instrument's classes, so a line can sit in more than one class where its instrument does. 4,712 of the 6,825 lines belong to an instrument with at least one class. The 2,113 that do not are counted on their own row at the end of section 3 rather than folded into a class, and the file leaves their class cell empty.

Type. Derived from the line's wording and, where one exists, from an independent hand classification of the same line (obligation, prohibition, scope condition, remedy note, permission): a mandatory obligation, a conditional one, a prohibition, a definition, a consequence (a penalty or remedy stated as a requirement line), a permission or exemption, or guidance. The modal language column preserves the verbs the line uses.

Applicable entity. Read off the line's own wording where it names a role (provider, deployer, controller, processor, platform, employer, manufacturer). Where it names none, the entity is the OPERATOR, the party running the application, which is whom the LexLint software-law corpus binds by default.

Territorial hook. Derived from the instrument's topic and law family under a stated rule: a privacy duty reaches through the data subject's residence and the OPERATOR'S establishment, a transfer duty through the destination, a scraping duty through the COUNTERPARTY'S location, an AI transparency duty through where the output is used and the market it was placed on, a security duty through the OPERATOR'S establishment or the placing on the market. The column is a rule applied to every line, and it is the first thing a reviewer should correct. Where the parties are prints the rule in full.

Party whose position triggers scope, and runtime tier. Both come from a separate hand classification of 4,357 of the 6,825 lines, made for a study of what an AGENT gateway can enforce. The party is the one of six (OPERATOR, principal, provider, COUNTERPARTY, affected person, data subject) whose location or status the duty turns on; the tier says whether a control on the request path can prevent the conduct, detect it, evidence it, or never sees it. Only a line that states a duty, an obligation or a prohibition, has a party and a tier. A line that states a scope condition, a consequence or a permission was read and carries neither, and both columns say not a duty (1,551 lines). A line the classification has not reached says not yet classified (2,079), and a line reworded since it was read says so (389). The file carries the same words in a column of its own, so the three can be filtered apart. The column after the party names that party's group, one of The 6 parties, by the mapping in section 6.

Line identifier. Every line carries an identifier of the form topic:instrument-code:position, which is the topic it was researched under, the instrument's code on lexlint.org, and the line's position in that instrument's requirement list. Rewording the text at a position leaves the identifier in place; the classification above goes stale and is marked reworded instead of moving under a new one. What it does not survive is an insertion or a reorder inside the same instrument's requirement list, which shifts every later position onto a different sentence with no signal that it happened. Cite an identifier together with the requirement text it names, never alone, and note the date in this page's byline: that pairing holds even where the identifier by itself would not.

3The register by class

One row per obligation class, largest first. "Lines" is every requirement line whose instrument records the class, in force or not; "in force" is the subset whose instrument binds today; "instruments" and "jurisdictions" count the distinct sources those lines come from. The last column says which of the four topics the lines were researched under, largest first, which is a fair proxy for which body of law a class really lives in.

ClassLinesIn forceInstrumentsJurisdictionsWhere the lines come from
Secure the system and the data in it 1,693 1,467 336 176 cybersecurity 992 · privacy 663 · scraping 31 · AI 7
Govern the system: policies, roles, assessments 1,530 1,211 333 157 privacy 1,028 · cybersecurity 296 · AI 203 · scraping 3
Disclose the use of AI 1,104 926 217 127 privacy 838 · AI 201 · cybersecurity 63 · scraping 2
Get consent first 1,091 945 212 108 privacy 1,051 · AI 34 · scraping 6
Report to a regulator 1,046 891 227 132 privacy 567 · cybersecurity 406 · AI 71 · scraping 2
Do not get in without authorisation 712 675 198 123 scraping 360 · privacy 352
Do not do the named thing 705 625 222 150 privacy 340 · AI 309 · scraping 56
Honour the person's rights over their data 623 528 121 105 privacy 619 · AI 4
Keep records for a set time 499 439 77 69 privacy 430 · cybersecurity 42 · AI 27
Hold a licence or registration 367 337 79 58 privacy 271 · scraping 47 · cybersecurity 26 · AI 23
Limits on biometric use 310 255 77 66 privacy 281 · AI 21 · scraping 8
Tell somebody when there is a breach 300 231 85 79 privacy 290 · AI 5 · cybersecurity 5
Assess the impact on personal data first 290 242 50 41 privacy 255 · AI 31 · cybersecurity 4
Conditions on sending data abroad 283 240 90 84 privacy 279 · scraping 4
Label generated content 147 84 41 31 AI 147
Check the user's age 134 112 31 31 privacy 134
Put the terms in the contract 56 51 9 8 privacy 50 · AI 4 · scraping 2
Respect text and data mining opt-outs 54 52 26 24 scraping 51 · AI 3
Meet a design code 45 9 8 8 AI 27 · privacy 18
Credit or licence the publisher's content 31 31 15 13 scraping 31
No class recorded on the instrument 2,113 1,727 1,039 194 privacy 995 · scraping 646 · AI 432 · cybersecurity 40

The last row is a gap in the corpus, not a class: the research records an instrument's obligation classes as one attribute among several, and on the date above it had not reached every instrument. A line on that row still carries every other column, and the file lists it with an empty class cell so it can be found.

4What the distribution says

Four classes carry most of the register: secure the system and the data in it (1,693 lines), govern the system: policies, roles, assessments (1,530 lines), disclose the use of AI (1,104 lines) and get consent first (1,091 lines). That is the centre of gravity of software law as the corpus finds it: an operator is told to secure what it holds, to govern the system with named roles and assessments, to tell people what it is doing, and to have consent before it does it. The smallest classes are the newest or the narrowest duties, a design code for children's services or a credit to a publisher, and their size says how few statutes yet impose them, not how little they matter to a system that falls under one.

The second table reads the classes against what a control on the request path can do about them. The four tier columns carry the tiers' short names, enforceable for enforceable at a runtime control, detectable for detectable at a runtime control, evidenced for evidenced by the runtime's record and out of path for outside any runtime path; what each tier means is Legal constraints at the gateway. Only a classified duty has a tier, so the columns after the four count the lines that were read and state no duty, the lines the classification has not reached, and the lines reworded since it read them. A zero is set light, so the cells that hold lines stand out.

ClassEnforceableDetectableEvidencedOut of pathNot a dutyNot yet classifiedReworded
Secure the system and the data in it 6711165366 330 387 367
Govern the system: policies, roles, assessments 422216252 216 641 341
Disclose the use of AI 588116139 76 593 141
Get consent first 6910477 28 546 357
Report to a regulator 171217777 130 618 15
Do not get in without authorisation 23413021 95 338 11
Do not do the named thing 64143146 132 318 1
Honour the person's rights over their data 377661 16 493 3
Keep records for a set time 213162 28 138 246
Hold a licence or registration 420333 31 126 132
Limits on biometric use 212518 13 247 4
Tell somebody when there is a breach 704612 24 211 0
Assess the impact on personal data first 76141 14 77 144
Conditions on sending data abroad 212426 4 226 0
Label generated content 579213 48 0 0
Check the user's age 1001 0 131 1
Put the terms in the contract 1103 1 17 33
Respect text and data mining opt-outs 19006 29 0 0
Meet a design code 51316 4 11 5
Credit or licence the publisher's content 15003 12 0 1

A class whose lines sit mostly outside any runtime path is met by a decision or a record rather than a control: a licence held, an assessment made, a retention period kept. A class whose lines are enforceable at a control is one a gateway can refuse on behalf of the OPERATOR. What you must constrain reads the same tiers by the layer a control sits on, and What you must be able to show by the record that meets the duty instead.

5The twenty classes

Each class below gives its counts and holds a sample of up to fourteen lines in force, drawn to span jurisdictions rather than to rank them, folded away until opened. The requirement is stated first, as the LexLint software-law corpus records it; under it, the facts the columns hold, then the jurisdiction, the instrument and its date, and the line identifier. The full register, every line in every class, is the file in section 6.

Secure the system and the data in it

1,693 lines 1,467 in force 336 provisions 176 jurisdictions by type: mandatory obligation 809, conditional obligation 416, definition 249, prohibition 105, consequence (penalty or remedy) 81, permission or exemption 27, recommendation/guidance 6

Sample requirement lines Show 13 of the 1,467 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
General Data Protection Regulation (GDPR), Comprehensive Regime, Regulation (EU) 2016/679 Source as of 2026-08-23 privacy:eu-2016-679:0

California

If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24), Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA) Source as of 2026-08-23 privacy:us-ca-cal-civ-1798-100-et-seq-ccpa-as-amended-by:0

Colorado

This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market Runtime not a duty
Disposal of personal identifying information, written policy duty, C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) Source as of 2026-09-12 security:us-co-c-r-s-6-1-713:0

Texas

This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market Runtime not a duty
Cybersecurity Program safe harbor from exemplary damages (S.B. 2610), Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) Source as of 2026-09-12 security:us-tx-tex-bus-com-ch-542-secs-542-001-542-004:0

South Korea

This binds a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating this particular duty; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Information and Communications Network Act, Report on Computer Security Incidents, Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024) Source as of 2026-09-12 security:kr-48-3-48-4-promotion-information-communication:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

India

This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) Source as of 2026-09-12 security:in-directions-under-70b-6-information-technology:0

Vietnam

This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Cybersecurity Law, Incident Response and Reporting Duties, Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) Source as of 2026-09-16 security:vn-no-116-2025-qh15-cybersecurity-40-1-c-41-2-4:0

Germany

This binds a besonders wichtige Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider (Anlage 2 Nummer 6) among the digital-service providers it reaches expressly, at the wichtige Einrichtung threshold of at least 50 employees or an annual turnover and balance-sheet total each over EUR 10 million; the wider sector classes Section 28 also reaches (critical-facility operators, large telecommunications and digital-infrastructure providers including cloud computing, and public administration) are a designation and sector class no activity in this vocabulary expresses, so they are not separately flagged here.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Establishment of the operator (entity in scope) Runtime not a duty
BSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities, BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8(1) of the Act of 23 July 2026 (BGBl. 2026 I Nr. 226), §§ 28, 30, 38 Source as of 2026-09-12 security:de-bsi-gesetz-bsig-vom-2-dezember-2025-28-30-38:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of 2026-08-24 privacy:ie-data-protection-2018-no-7-2018:0

Italy

This binds an essential or important entity under Article 3, which names an online marketplace, an online search engine and a cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches are not separately flagged here, for the reason given on this jurisdiction's companion risk-management row.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification, D.Lgs. 4 settembre 2024, n. 138, Art. 25 Source as of 2026-09-12 security:it-d-lgs-4-settembre-2024-n-138-25:0

Spain

This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Establishment of the operator (entity in scope) Runtime not a duty
Real Decreto-ley 12/2018, Security Obligations for Operators of Essential Services and Digital Service Providers, Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero Source as of 2026-09-12 security:es-rdl-12-2018-art16-seguridad:0

1,454 more lines in force in this class, and 1,693 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Govern the system: policies, roles, assessments

1,530 lines 1,211 in force 333 provisions 157 jurisdictions by type: mandatory obligation 827, conditional obligation 369, definition 125, consequence (penalty or remedy) 101, prohibition 85, permission or exemption 19, recommendation/guidance 4

Sample requirement lines Show 13 of the 1,211 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), Regulation (EU) 2022/2065, Article 35(1)(k) Source as of 2026-08-14 ai:eu-2022-2065-35-1-k:0

California

If you are a large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the prior calendar year), write, implement and publish on your website a frontier AI framework describing how you define and assess catastrophic-risk thresholds for your frontier models and apply mitigations, and review that framework at least once a year
Type Conditional Obligation Modal imperative Binds, by its wording Developer, distributor or importer Scope turns on Provider Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Transparency in Frontier Artificial Intelligence Act (SB 53), Cal. Bus. and Prof. Code Sections 22757.10 to 22757.16 Source as of 2026-09-08 ai:us-ca-cal-bus-prof-sections-22757-10-22757-16:0

Texas

If you operate a social media platform, provide an easily accessible complaint system letting a user report explicit deep fake material, alongside illegal content and content-removal decisions.
Type Conditional Obligation Modal imperative Binds, by its wording Platform or intermediary Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
H.B. 3133 (2025), social media platform complaint system for explicit deep fake material, Tex. Bus. & Com. Code §§ 120.101, 120.1001, 120.102, 120.1015, 120.1025, 120.152 Source as of 2026-09-06 ai:us-tx-tex-bus-com-ch-120-subch-c:0

South Korea

If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of 2026-09-20 ai:kr-no-20676-32:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

Vietnam

If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, incident management and reporting obligation, Law No. 134/2025/QH15, art. 12 Source as of 2026-09-20 ai:vn-no-134-2025-qh15-12:0

Germany

Expect the Bundesnetzagentur to be Germany's central market surveillance authority, single point of contact, and central complaints office under the EU AI Act, unless your AI system is directly tied to a regulated financial activity that the Bundesanstalt für Finanzdienstleistungsaufsicht already supervises, in which case expect that authority instead.
Type Consequence (penalty or remedy) Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market; where the output is used Runtime not a duty
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16 Source as of 2026-09-06 ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of 2026-08-24 privacy:ie-data-protection-2018-no-7-2018:0

Italy

Expect the Garante to have GDPR Article 83 fining power over your processing of personal data of a person in Italy.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
GDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis), Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) Source as of 2026-09-02 privacy:it-eu-2016-679-82-codice-di-procedura-civile-840:0

Spain

Expect the AEPD to sort a violation into a muy grave, grave, or leve infraction tied to a GDPR Article 83 fine tier when assessing exposure for processing personal data of a person in Spain.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
AEPD Enforcement, GDPR Article 82 and LOPDGDD Título IX, Regulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 Source as of 2026-09-02 privacy:es-eu-2016-679-82-83-lopdgdd-47-70-78:0

France

Expect the CNIL to have GDPR Article 83 fining power, plus France's own criminal-offense exposure under Code penal Articles 226-16 to 226-22-2 for unlawful processing.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
CNIL Enforcement, GDPR Article 83 and Code Pénal Articles 226-16 to 226-22-2, Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 Source as of 2026-09-02 privacy:fr-eu-2016-679-83-penal-226-16-226-22-2:0

Netherlands

Expect the AP to have GDPR Article 83 fining power, plus UAVG's own administrative powers, over your processing of personal data of a person in the Netherlands.
Type Consequence (penalty or remedy) Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action Regime, Regulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) Source as of 2026-09-02 privacy:nl-eu-2016-679-82-83-uavg-16-18-wet-afwikkeling:0

1,198 more lines in force in this class, and 1,530 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Disclose the use of AI

1,104 lines 926 in force 217 provisions 127 jurisdictions by type: mandatory obligation 538, conditional obligation 326, prohibition 139, definition 62, permission or exemption 18, consequence (penalty or remedy) 16, recommendation/guidance 5

Sample requirement lines Show 14 of the 926 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Tell users they are talking to an AI when your app deploys a chatbot or voice agent
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
AI Act, Article 50 (transparency obligations for AI systems and synthetic content), Regulation (EU) 2024/1689, Article 50 Source as of 2026-08-14 ai:eu-2024-1689-50:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of 2026-09-08 ai:us-ca-11-cal-regs-sections-7200-7222:0

Texas

If you are a governmental agency making an AI system available to interact with consumers, disclose before or at the time of interaction that the consumer is interacting with an AI system, even if that would already be obvious to a reasonable consumer.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), consumer AI-interaction disclosure duty, Tex. Bus. & Com. Code § 552.051 Source as of 2026-09-06 ai:us-tx-tex-bus-com-552-051:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of 2026-09-20 ai:kr-no-20676-34:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-22 (rights of the data subject) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of 2026-08-24 privacy:ie-data-protection-2018-no-7-2018:0

France

This binds a large online platform operator under Code de la consommation Article L. 111-7 (an online marketplace, a service ranking or referencing content, or a price-comparison service) above the visitor-count threshold a decree sets. A large number-independent interpersonal communications service (a large-scale messaging application) is separately bound and is not expressed by any activity in this vocabulary.
Type Definition Modal imperative Binds, by its wording Platform or intermediary Scope turns on not a duty Hook Establishment of the operator (entity in scope) Runtime not a duty
Loi n° 2022-309 du 3 mars 2022 (loi Cyberscore), Cybersecurity Audit and Disclosure Duty, Loi n° 2022-309 du 3 mars 2022, art. 1 (Code de la consommation, art. L. 111-7-3) Source as of 2026-09-12 security:fr-loi-n-2022-309-du-3-mars-2022-1-de-la-consomm:0

Australia

This binds a manufacturer or supplier of a relevant connectable product that will be acquired in Australia, and does not by itself reach a company that only publishes an app or other software with no connectable device of its own; the standard for consumer grade products does not reach a desktop computer, a laptop, a tablet computer, a smartphone, a therapeutic good, a road vehicle, or a road vehicle component.
Type Definition Modal imperative Binds, by its wording Manufacturer of a product with digital elements Scope turns on not a duty Hook Placing on the market Runtime not a duty
Security Standards for Smart Devices, Cyber Security Act 2024 (Cth), No. 98, 2024, Part 2, ss. 13-24; Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), Schedule 1 Source as of 2026-09-12 security:au-cyber-security-2024-cth-part-2-ss-13-24-cyber:0

Illinois

Do not use artificial intelligence in a way that has the effect of subjecting an employee or applicant to discrimination on the basis of a protected class, and do not use a zip code as a proxy for a protected class, in recruitment, hiring, promotion, discipline, discharge, or the terms and conditions of employment.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Illinois Human Rights Act, use of artificial intelligence in employment decisions, 775 ILCS 5/2-102(L) (P.A. 103-0804, eff. January 1, 2026) Source as of 2026-09-06 ai:us-il-775-ilcs-5-2-102-l-p-103-0804-eff-january:0

Peru

Before a high-risk AI system interacts with a user, tell them, clearly and simply, its purpose or use, its main functions, and the kind of decisions it can make.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Reglamento de la Ley 31814, high-risk AI system duties, Decreto Supremo 115-2025-PCM, arts. 24-25 (Reglamento de la Ley 31814, Riesgo Alto y Transparencia Algorítmica) Source as of 2026-09-05 ai:pe-decreto-supremo-115-2025-pcm-24-25-reglamento:0

South Africa

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of Personal Information Act, rights of data subjects, POPIA, ss. 18, 23-25 and 69-71 (the information notice, access and correction, direct marketing and automated decision making) Source as of 2026-09-19 privacy:za-popia-ss-18-23-25-69-71-information-notice-ac:0

Nigeria

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms, and give effect to their rights to rectification, data portability, erasure, and lodging a complaint with the Commission.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023, rights of a data subject, Nigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-rights-data-subj:0

United States

Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Establishment of the operator Runtime Outside any runtime path
FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement), 15 U.S.C. Section 45 Source as of 2026-08-23 privacy:us-15-u-s-c-45:0

912 more lines in force in this class, and 1,104 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Report to a regulator

1,046 lines 891 in force 227 provisions 132 jurisdictions by type: mandatory obligation 547, conditional obligation 312, definition 95, prohibition 47, consequence (penalty or remedy) 31, permission or exemption 11, recommendation/guidance 3

Sample requirement lines Show 13 of the 891 lines in forceHide the sample

What follows is a sample of 13 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
Type Conditional Obligation Modal imperative Binds, by its wording Platform or intermediary Scope turns on Operator Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Digital Services Act, Article 37 (independent audit of very large online platforms and search engines), Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 Source as of 2026-09-15 ai:eu-2022-2065-37:0

California

If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Companion Chatbot Safety and Accountability Act (SB 243), Cal. Bus. and Prof. Code Sections 22601 to 22606 Source as of 2026-09-08 ai:us-ca-cal-bus-prof-sections-22601-22606:0

South Korea

If your AI system was trained using cumulative compute of 10^26 floating-point operations or more, applies the most advanced AI technology currently in use, and could broadly and seriously affect people's life, physical safety or fundamental rights, identify, assess and mitigate risk across the system's full life cycle.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 32 (safety-assurance duty for high-compute AI systems), Act No. 20676, Article 32 Source as of 2026-09-20 ai:kr-no-20676-32:0

Brazil

Expect administrative sanctions, including a simple fine of up to 2% of the private legal entity's, group's, or conglomerate's revenue in Brazil in its last fiscal year, excluding taxes, capped in total at R$50,000,000.00 per infraction, for violations the ANPD investigates through due administrative process.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator Runtime not yet classified
LGPD, civil liability, administrative sanctions and the ANPD, Lei nº 13.709, de 2018 (LGPD), arts. 42-45, 52-54, 55-A a 58-B (civil liability, administrative sanctions and the ANPD) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-42-45-52-54-55-58-b:0

India

This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
CERT-In Cyber Security Directions, Incident Reporting, Logging and Time Synchronisation, Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) Source as of 2026-09-12 security:in-directions-under-70b-6-information-technology:0

Vietnam

Classify your AI system's risk level (high, medium, or low) before putting it into service, based on its potential impact on rights, safety, security, and public interest, and the scale and context of its use.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Law on Artificial Intelligence, risk classification and conformity assessment, Law No. 134/2025/QH15, arts. 9-10, 13-14 Source as of 2026-09-06 ai:vn-no-134-2025-qh15-9-10-13-14:0

Germany

Expect the Bundesnetzagentur to be Germany's central market surveillance authority, single point of contact, and central complaints office under the EU AI Act, unless your AI system is directly tied to a regulated financial activity that the Bundesanstalt für Finanzdienstleistungsaufsicht already supervises, in which case expect that authority instead.
Type Consequence (penalty or remedy) Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market; where the output is used Runtime not a duty
Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-MIG), AI Market Surveillance and Innovation Promotion Act, Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16 Source as of 2026-09-06 ai:de-gesetz-zur-markt-berwachung-und-innovationsf:0

Ireland

This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2) and a designated operator of essential services under Schedule 1; the operator-of-essential-services sector and designation class is not separately flagged here, for the reason given on this jurisdiction's companion security-requirements row.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
European Union (NIS) Regulations 2018, Incident Notification, S.I. No. 360/2018, Regs. 18 and 22 Source as of 2026-09-12 security:ie-s-i-no-360-2018-regs-18-22:0

Italy

This binds an essential or important entity under Article 3, which names an online marketplace, an online search engine and a cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches are not separately flagged here, for the reason given on this jurisdiction's companion risk-management row.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Decreto Legislativo 4 settembre 2024, n. 138 (Decreto NIS2), Incident Notification, D.Lgs. 4 settembre 2024, n. 138, Art. 25 Source as of 2026-09-12 security:it-d-lgs-4-settembre-2024-n-138-25:0

Spain

This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Real Decreto-ley 12/2018, Incident Notification Obligation, Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero Source as of 2026-09-12 security:es-rdl-12-2018-art19-notificacion:0

France

This binds a fournisseur de service numérique (digital service provider) operating an online marketplace, an online search engine or a cloud computing service above the fifty-employee, EUR 10 million turnover threshold, and an opérateur de services essentiels the Premier ministre designates by sector; the operator-of-essential-services sector and designation class is not separately flagged here, for the reason given on this jurisdiction's companion security-requirements row.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Loi n° 2018-133 du 26 février 2018 (transposition NIS1), Incident Notification, Loi n° 2018-133 du 26 février 2018, Titre Ier, art. 7 et 13 Source as of 2026-09-12 security:fr-loi-n-2018-133-du-26-f-vrier-2018-titre-ier-7:0

Netherlands

This binds an essential entity (Article 8 or 9) or an important entity (Article 12 or 13) drawn from Annex 1 or Annex 2, on the same scope as this jurisdiction's companion risk-management row: Annex 2's digital-provider entry names an online marketplace, an online search engine and a social-networking-services platform, and Annex 1 separately names a cloud-computing-service provider, a data-centre-service provider and a content-delivery-network provider, each at the medium-enterprise size threshold or above; the wider sector classes are not raised here for the same reason.
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Placing on the market; establishment of the manufacturer Runtime not a duty
Cyberbeveiligingswet, Significant-Incident Reporting Obligations, Cyberbeveiligingswet, Artt. 25-29 Source as of 2026-09-12 security:nl-cyberbeveiligingswet-artt-25-29:0

New York

This duty reaches your organization only if it is a Covered Entity under 23 NYCRR 500.1(e): any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law, regardless of whether it is also regulated by another agency. Declare provides_financial_services where that status holds; the limited exemptions in 500.19 do not reach this section, so a small or otherwise exempt covered entity owes the Superintendent-notice duty in full.
Type Conditional Obligation Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Placing on the market; establishment of the manufacturer Runtime not yet classified
New York Department of Financial Services Cybersecurity Regulation, Notices to the Superintendent, 23 NYCRR 500.17 Source as of 2026-09-20 security:us-ny-23-nycrr-500-17:0

878 more lines in force in this class, and 1,046 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Do not get in without authorisation

712 lines 675 in force 198 provisions 123 jurisdictions by type: prohibition 316, mandatory obligation 167, conditional obligation 134, permission or exemption 39, consequence (penalty or remedy) 34, definition 22

Sample requirement lines Show 14 of the 675 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-22 (rights of the data subject) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

Peru

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, rights of the data subject, Ley No. 29733, arts. 18-27 (rights of the data subject) Source as of 2026-09-19 privacy:pe-ley-no-29733-18-27-rights-data-subject:0

Andorra

Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, rights of the data subject, Llei 29/2021, arts. 15-26 (rights of the data subject) Source as of 2026-09-19 privacy:ad-llei-29-2021-15-26-rights-data-subject:0

Afghanistan

Do not access a computer, program, or data belonging to someone else without authorization; the Penal Code's wording carries no exception for a public, unauthenticated page, and no reported case construes the term.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
Penal Code, Part Twelve, Chapter One (Cyber Crimes and Punishment), Penal Code of Afghanistan (2017), Part Twelve, Chapter One (Cyber Crimes and Punishment), arts. 851-859 Source as of 2026-09-06 scraping:af-penal-afghanistan-2017-part-twelve-chapter-on:0

Antigua and Barbuda

Tell a data subject, on request, the purposes of collecting and processing their personal data, its source if known, the classes of third parties it may be disclosed to, whether supplying it is obligatory or voluntary and the consequences of not supplying it, and how to contact you with inquiries or complaints.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2013, notice and rights of data subjects, Data Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects) Source as of 2026-09-19 privacy:ag-data-protection-2013-ss-6-11-16-notice-rights:0

Albania

Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, rights of the data subject, Law No. 124/2024, Arts. 12-21 (rights of the data subject) Source as of 2026-09-19 privacy:al-no-124-2024-12-21-rights-data-subject:0

Angola

Tell a data subject at least your identity and address, the purposes of processing and the file's existence, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, when you collect their data or, if collected elsewhere, at the latest thirty days after collection.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law on the Protection of Personal Data, rights of data subjects, Lei n.º 22/11, de 17 de Junho de 2011, arts. 25-29 (direitos dos titulares dos dados) Source as of 2026-09-19 privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-25-29-dire:0

Argentina

Do not require a person to provide sensitive data (racial or ethnic origin, political opinions, religious, philosophical, or moral convictions, union membership, or health or sexual-life information).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 25.326, sensitive data categories and health data, Ley 25.326, arts. 7-8 (sensitive data categories and health data) Source as of 2026-09-19 privacy:ar-ley-25-326-7-8-sensitive-data-categories-heal:0

Austria

Do not overcome a computer system's specific security measure to gain access, if your purpose is to obtain personal data protected by a secrecy interest, or to use the accessed data or system to harm another, per StGB Section 118a.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
StGB Sections 118a and 126a to 126c, Computer-Misuse Offenses, StGB Sec. 118a, 126a-126c, BGBl. Nr. 60/1974 as amended Source as of 2026-09-06 scraping:at-stgb-sec-118a-126a-126c-bgbl-nr-60-1974-as-am:0

Bosnia and Herzegovina

Rely on a Council of Ministers adequacy decision, or an appropriate safeguard such as standard contractual clauses, binding business rules, or an approved code of conduct or certification, before transferring personal data outside Bosnia and Herzegovina, under Articles 46 to 49.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer, Law on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer) Source as of 2026-09-19 privacy:ba-protection-personal-data-46-51-91-95-cross-bo:0

Bangladesh

Do not gain illegal entry into a computer, digital device, computer system, or computer network, and do not assist another person to do so; a higher penalty applies where the entry is for the purpose of committing an offence, and a further higher penalty applies where the entry results in the theft, destruction, or alteration of information, or in an AI agent generating new data through that access.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
Cyber Security Act, 2026, unauthorised access to a computer system, Cyber Security Act, 2026, Act No. 81 of 2026, s.18 (illegal entry into computer, digital device, computer system or network) Source as of 2026-09-06 scraping:bd-cyber-security-2026-no-81-2026-s-18-illegal-e:0

Belgium

Do not access or remain in a computer system knowing you are not authorised to do so.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
Code pénal, Livre II, articles 524 à 527, accès non autorisé dans un système informatique, Code pénal, Livre II, arts. 524-527 (accès non autorisé dans un système informatique), inséré par la loi du 29 février 2024 introduisant le livre II du Code pénal; peines fixées au Livre Ier, art. 36 et 38 Source as of 2026-09-06 scraping:be-penal-livre-ii-524-527-acces-non-autorise-dan:0

Burkina Faso

Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Personal Data Protection Law, rights of the data subject, Loi n°001-2021/AN, arts. 14-22, 31 (droits de la personne concernée) Source as of 2026-09-19 privacy:bf-loi-n-001-2021-14-22-31-droits-de-la-personne:0

Bulgaria

Do not unlawfully access an information system or a part of it; a non-immaterial unauthorized access carries imprisonment of up to two years under Article 319a(1), rising with aggravating circumstances.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook Location of the counterparty's machine Runtime Enforceable at a runtime control
Criminal Code (Nakazatelen kodeks), Art. 319a, Unauthorized Access to an Information System, Наказателен кодекс (НК, Nakazatelen kodeks), chl. 319a, obn. DV br. 26 ot 1968 g., izm. DV br. 101 ot 2017 g. Source as of 2026-09-06 scraping:bg-nakazatelen-kodeks-chl-319a-obn-dv-br-26-ot-1:0

661 more lines in force in this class, and 712 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Do not do the named thing

705 lines 625 in force 222 provisions 150 jurisdictions by type: prohibition 311, mandatory obligation 156, conditional obligation 106, consequence (penalty or remedy) 46, permission or exemption 45, definition 41

Sample requirement lines Show 14 of the 625 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

California

Disclose that the media has been manipulated when you distribute materially deceptive audio or visual election media depicting a candidate within 60 days of an election
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
AB 730, as extended by AB 972, election deepfake disclosure law, Cal. Elec. Code Section 20010 Source as of 2026-08-14 ai:us-ca-cal-elec-20010:0

Texas

Do not develop or deploy an AI system that intentionally aims to incite or encourage physical self-harm, harm to another person, or criminal activity.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TRAIGA (H.B. 149, 2025), prohibited AI practices binding any person, Tex. Bus. & Com. Code §§ 552.052, 552.055-552.057 Source as of 2026-09-06 ai:us-tx-tex-bus-com-552-052-552-055-552-057:0

Brazil

Do not use fabricated or manipulated content in electoral advertising to spread notoriously untrue or gravely decontextualized facts capable of harming the balance of the election or the integrity of the electoral process.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
TSE Resolution, Prohibition on Electoral Deepfakes, Resolução TSE nº 23.610/2019, art. 9º-C (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of 2026-09-05 ai:br-resolu-o-tse-n-23-610-2019-9-c-reda-o-dada-pe:0

France

Do not create or share, by any means, a non-consensual sexual montage, or a non-consensual, algorithmically generated sexual image, video, or audio reproducing a real person's likeness or voice; France punishes this with two years' imprisonment and a 60,000 euro fine.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Code Pénal Article 226-8-1, Non-Consensual Sexual Montage and Algorithmically Generated Sexual Content, Code penal, art. 226-8-1, insere par la loi n. 2024-449 du 21 mai 2024 visant a securiser et a reguler l'espace numerique (SREN), art. 21 Source as of 2026-09-06 ai:fr-penal-226-8-1-insere-par-la-loi-n-2024-449-du:0

Australia

Do not use a carriage service to transmit material that depicts, or appears to depict, a person aged 18 or over in a sexual pose or sexual activity, or their sexual organ, anal region, or, for a female, breasts, without that person's consent, knowing of the lack of consent or reckless as to it.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Using a Carriage Service to Transmit Sexual Material Without Consent (Deepfake Offences), Criminal Code Amendment (Deepfake Sexual Material) Act 2024 (Cth), No. 78, 2024, inserting ss. 474.17A, 474.17AA into the Criminal Code Act 1995 (Cth), No. 12, 1995 Source as of 2026-09-06 ai:au-criminal-amendment-deepfake-sexual-material-2:0

Illinois

An artificial-intelligence-generated or digitally altered image or video that is or appears to be a child under 18 is child sexual abuse material regardless of how it was produced; do not film, produce, disseminate, solicit, or possess one.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Child sexual abuse material, computer-generated and digitally altered depictions, 720 ILCS 5/11-20.1 (P.A. 104-245, eff. Jan. 1, 2026) Source as of 2026-09-06 ai:us-il-720-ilcs-5-11-20-1-p-104-245-eff-jan-1-202:0

Utah

Do not treat the use of generative AI, computer animation, or digital manipulation as a defense to a libel or slander claim
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator; placing on the market; where the output is used Runtime not a duty
Identity Protection Modifications, AI Defamation and Identity Replication (SB 256, 2026 General Session), Utah Code 45-2-3.5, 45-2-14, 45-3-2 to 45-3-7, as amended Source as of 2026-09-08 ai:us-ut-utah-45-2-3-5-45-2-14-45-3-2-45-3-7-as-ame:0

Peru

Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Reglamento de la Ley 31814, prohibited AI uses, Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido) Source as of 2026-09-05 ai:pe-decreto-supremo-115-2025-pcm-22-23-reglamento:0

South Africa

Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of Personal Information Act, special personal information and children, POPIA, ss. 26-35 (special personal information and children) Source as of 2026-09-19 privacy:za-popia-ss-26-35-special-personal-information-c:0

Nigeria

Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023, sensitive personal data and a child's data, Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-sensitive-person:0

United States

Establish a process to remove a nonconsensual intimate visual depiction, including an AI-generated depiction, within 48 hours of a valid request from the depicted individual or their representative.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Residence of the data subject Runtime Outside any runtime path
TAKE IT DOWN Act, Pub. L. 119-12, S. 146, 119th Cong. (2025) Source as of 2026-08-23 privacy:us-pub-l-119-12-s-146-119th-cong-2025:0

Andorra

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, special categories, children and criminal-offence data, Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) Source as of 2026-09-19 privacy:ad-llei-29-2021-8-10-special-categories-children:0

Antigua and Barbuda

Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, unless the data subject has given explicit consent to the processing.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2013, sensitive personal data, Data Protection Act, 2013, s. 18 (sensitive personal data) Source as of 2026-09-19 privacy:ag-data-protection-2013-s-18-sensitive-personal:0

Albania

Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, special categories of personal data, criminal records and children's data, Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) Source as of 2026-09-19 privacy:al-no-124-2024-8-6-9-10-special-categories-crimi:0

611 more lines in force in this class, and 705 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Honour the person's rights over their data

623 lines 528 in force 121 provisions 105 jurisdictions by type: mandatory obligation 308, conditional obligation 207, prohibition 84, definition 17, consequence (penalty or remedy) 7

Sample requirement lines Show 14 of the 528 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
General Data Protection Regulation (GDPR), Comprehensive Regime, Regulation (EU) 2016/679 Source as of 2026-08-23 privacy:eu-2016-679:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of 2026-09-08 ai:us-ca-11-cal-regs-sections-7200-7222:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Let a data subject confirm that processing exists, access their data, correct it, or have it anonymized, blocked, deleted, or ported to another provider, on request.
Type Mandatory Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, rights of the data subject, Lei nº 13.709, de 2018 (LGPD), arts. 17-22 (rights of the data subject) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-17-22-rights-data-s:0

Vietnam

An app processing the personal data of an individual in Vietnam must be prepared to answer to the agency in charge of personal data protection, facing a fine of up to 5 percent of prior-year revenue for a cross-border transfer violation, and an individual harmed by the app's processing may file a complaint, initiate a lawsuit, and request compensation for damage.
Type Consequence (penalty or remedy) Modal must, may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Law on Personal Data Protection, enforcement and data subject rights, Law No. 91/2025/QH15, enforcement and data subject rights provisions Source as of 2026-09-02 privacy:vn-no-91-2025-qh15-enforcement-data-subject-righ:0

Ireland

Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Ireland.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act 2018, Data Protection Act 2018 (No. 7 of 2018) Source as of 2026-08-24 privacy:ie-data-protection-2018-no-7-2018:0

Peru

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, rights of the data subject, Ley No. 29733, arts. 18-27 (rights of the data subject) Source as of 2026-09-19 privacy:pe-ley-no-29733-18-27-rights-data-subject:0

South Africa

Do not base a decision that has legal or substantially similar consequences for a person solely on automated processing of their personal information, unless the person can make representations about the decision and you have explained the underlying logic of the processing to them.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of Personal Information Act, rights of data subjects, POPIA, ss. 18, 23-25 and 69-71 (the information notice, access and correction, direct marketing and automated decision making) Source as of 2026-09-19 privacy:za-popia-ss-18-23-25-69-71-information-notice-ac:0

Nigeria

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms, and give effect to their rights to rectification, data portability, erasure, and lodging a complaint with the Commission.
Type Conditional Obligation Modal subject to Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023, rights of a data subject, Nigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-rights-data-subj:0

United States

Do not use or disclose protected health information except as the Privacy Rule permits or requires, and limit use and disclosure to the minimum necessary.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
HIPAA Privacy Rule, 45 CFR Part 164, Subpart E (Sections 164.500-164.534) Source as of 2026-08-23 privacy:us-45-cfr-part-164-subpart-e-sections-164-500-16:0

Andorra

Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, rights of the data subject, Llei 29/2021, arts. 15-26 (rights of the data subject) Source as of 2026-09-19 privacy:ad-llei-29-2021-15-26-rights-data-subject:0

Antigua and Barbuda

Tell a data subject, on request, the purposes of collecting and processing their personal data, its source if known, the classes of third parties it may be disclosed to, whether supplying it is obligatory or voluntary and the consequences of not supplying it, and how to contact you with inquiries or complaints.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2013, notice and rights of data subjects, Data Protection Act, 2013, ss. 6, 11-16 (notice and rights of data subjects) Source as of 2026-09-19 privacy:ag-data-protection-2013-ss-6-11-16-notice-rights:0

Albania

Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, rights of the data subject, Law No. 124/2024, Arts. 12-21 (rights of the data subject) Source as of 2026-09-19 privacy:al-no-124-2024-12-21-rights-data-subject:0

Angola

Tell a data subject at least your identity and address, the purposes of processing and the file's existence, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, when you collect their data or, if collected elsewhere, at the latest thirty days after collection.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law on the Protection of Personal Data, rights of data subjects, Lei n.º 22/11, de 17 de Junho de 2011, arts. 25-29 (direitos dos titulares dos dados) Source as of 2026-09-19 privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-25-29-dire:0

514 more lines in force in this class, and 623 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Keep records for a set time

499 lines 439 in force 77 provisions 69 jurisdictions by type: mandatory obligation 267, conditional obligation 146, prohibition 42, definition 32, consequence (penalty or remedy) 9, permission or exemption 2, recommendation/guidance 1

Sample requirement lines Show 14 of the 439 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

California

If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24), Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA) Source as of 2026-08-23 privacy:us-ca-cal-civ-1798-100-et-seq-ccpa-as-amended-by:0

South Korea

Before you provide an AI system, or a product or service that uses one, review whether it is high-impact, meaning it may seriously affect a person's life, physical safety or fundamental rights and is used in energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education. You may ask the Ministry of Science and ICT to confirm your answer.
Type Mandatory Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
AI Framework Act, Article 34 (business-operator duties for high-impact AI), Act No. 20676, Article 34 Source as of 2026-09-20 ai:kr-no-20676-34:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

Illinois

Before asking an applicant to submit a video interview, notify them that artificial intelligence may be used to analyze it and consider their fitness for the position.
Type Recommendation/Guidance Modal may Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Artificial Intelligence Video Interview Act, 820 ILCS 42/1 et seq. (P.A. 101-260, eff. Jan. 1, 2020) Source as of 2026-09-06 ai:us-il-820-ilcs-42-1-et-seq-p-101-260-eff-jan-1-2:0

Peru

Obtain a person's prior, informed, express, and unequivocal consent before processing their personal data, unless a law authorizes the processing without it, and let them revoke that consent at any time under the same requirements that applied when they gave it.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Ley 29733, Ley de Protección de Datos Personales, Ley No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017), arts. 1-10, 12-14, 16-17, 28-31 (object, definitions, scope, principles, lawful processing, security, confidentiality, and personal-data-bank obligations) Source as of 2026-09-19 privacy:pe-ley-no-29733-ley-de-proteccion-de-datos-perso:0

South Africa

Obtain a lawful basis, such as the data subject's consent, before processing personal information, and limit processing to the purpose for which it was collected.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Protection of Personal Information Act 4 of 2013 (POPIA), Protection of Personal Information Act 4 of 2013 (POPIA), ss. 1-21, 36-38 and 55-59 (application, the general conditions for lawful processing, exemptions, the Information Officer and prior authorisation) Source as of 2026-09-19 privacy:za-protection-of-personal-information-act-4-2013:0

United States

Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments, 16 CFR Part 312, as amended effective June 23, 2025 Source as of 2026-08-23 privacy:us-16-cfr-part-312-as-amended-effective-june-23:0

Antigua and Barbuda

Obtain a data subject's consent before processing their personal data, other than sensitive personal data, arising from a commercial transaction, unless a listed alternative ground such as contract performance, a legal obligation, protecting vital interests or the administration of justice applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Data Protection Act, 2013, Data Protection Act, 2013 (No. 10 of 2013), ss. 5, 7-10, 17, 19-20 Source as of 2026-09-19 privacy:ag-data-protection-2013-no-10-2013-ss-5-23:0

Albania

Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law No. 124/2024 On the Protection of Personal Data, Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025 Source as of 2026-09-19 privacy:al-no-124-2024-ligj-nr-124-2024-protection-perso:0

Argentina

Obtain the data subject's free, express, and informed consent before processing their personal data, unless it comes from an unrestricted public-access source, is needed for a State function or legal obligation, is limited to a short listing of name and identifying numbers, arises from a contractual, scientific, or professional relationship, or is financial-entity customer data covered by Ley 21.526.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Ley 25.326, Ley de Protección de los Datos Personales, Ley 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) Source as of 2026-09-19 privacy:ar-ley-25-326-ley-de-protecci-n-de-los-datos-per:0

Barbados

Before processing personal data, establish a lawful basis and confine processing to the stated purpose.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act, 2019, Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 Source as of 2026-09-19 privacy:bb-2019-29-data-protection-2019:0

Burkina Faso

Obtain the data subject's prior consent before processing their personal data, unless a specific legal exception applies, such as performing a contract, complying with a legal obligation, protecting a vital interest, or a public interest ground.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel, arts. 1-11, 13, 23-41 (dispositions générales, principes fondamentaux, obligations du responsable et formalités préalables) Source as of 2026-09-19 privacy:bf-loi-n-001-2021-du-30-mars-2021-portant-protec:0

Benin

Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) Source as of 2026-09-19 privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-protec:0

Democratic Republic of the Congo

Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:0

425 more lines in force in this class, and 499 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Hold a licence or registration

367 lines 337 in force 79 provisions 58 jurisdictions by type: mandatory obligation 179, conditional obligation 104, prohibition 45, definition 25, permission or exemption 8, consequence (penalty or remedy) 6

Sample requirement lines Show 14 of the 337 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Brazil

Do not reproduce, translate, adapt, reorganize, distribute, or communicate to the public a database whose selection, organization, or arrangement of content is an intellectual creation, without the rightsholder's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright Law, Database Compilation Right, Lei nº 9.610/1998, arts. 7º, XIII, e 87 Source as of 2026-09-05 scraping:br-lei-n-9-610-1998-7-xiii-e-87:0

South Africa

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Protection of Personal Information Act, cross-border transfer, POPIA, s. 72 (transfer of personal information outside the Republic) Source as of 2026-09-19 privacy:za-popia-s-72-transfer-personal-information-outs:0

Angola

Obtain the data subject's unequivocal, express consent before processing their personal data, or notify the Agência de Protecção de Dados, unless a contract-performance, legal-obligation, vital-interest, public-interest, or legitimate-interest ground applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Law on the Protection of Personal Data, Lei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais), arts. 1-12, 16, 18-24, 30-32, 35-43 and 63-67 Source as of 2026-09-19 privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-protec-o-d:0

Azerbaijan

An app processing the personal data of a person in Azerbaijan must be prepared to answer to the relevant executive authority's compliance checks; Art. 19's own liability provision is a bare reference to other Azerbaijani law with no fine amounts stated in this Act, and an aggrieved person may separately sue in court for moral and material damage under Art. 7.4, but only on proof of the damage suffered.
Type Consequence (penalty or remedy) Modal must, may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Establishment of the operator Runtime not a duty
Law on Personal Data, enforcement and liability, Law of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 Source as of 2026-09-02 privacy:az-republic-azerbaijan-personal-data-no-998-ii-6:0

Bosnia and Herzegovina

Do not reproduce, distribute, make available to the public, or otherwise communicate the whole or a substantial part of a database whose making required a qualitatively or quantitatively substantial investment, without the producer's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Law on Copyright and Related Rights, Rights of Database Producers, Law on Copyright and Related Rights, arts. 141-146 (Rights of Database Producers), Official Gazette of BiH No. 63/10, 86/10 Source as of 2026-09-06 scraping:ba-copyright-related-rights-141-146-rights-datab:0

Burkina Faso

Before transferring personal data to a foreign country or an international organization, confirm that it assures a level of protection adequate to the protection Burkina Faso itself assures for privacy, fundamental freedoms and rights.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Personal Data Protection Law, cross-border transfer of personal data, Loi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso) Source as of 2026-09-19 privacy:bf-loi-n-001-2021-31-42-44-transfert-de-donn-es:0

Benin

Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) Source as of 2026-09-19 privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-protec:0

Bermuda

Do not extract or re-utilise all or a substantial part of the contents of a database that reflects substantial investment in obtaining, verifying or presenting its contents, without the database right owner's authorisation, unless a statutory exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright and Designs Act 2004, database right, Copyright and Designs Act 2004 (Bermuda), 2004:5, Part V (database right) Source as of 2026-09-07 scraping:bm-copyright-designs-2004-bermuda-2004-5-databa:0

Botswana

Treat a database compiled through the selection, coordination, or arrangement of its contents as a protected literary work: do not reproduce the whole or a substantial part of it without the rights holder's authorisation, even though the underlying facts and data are not themselves protected.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act, 2000 (Cap. 68:02), Database Protection, Copyright and Neighbouring Rights Act 2000, Database Protection Source as of 2026-09-04 scraping:bw-copyright-neighbouring-rights-2000-database-p:0

Belarus

Do not copy, reproduce, or otherwise use a protected database's compilation structure, or another copyrighted work it contains, beyond archival copying or another free-use ground this Law recognizes, without the rightsholder's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Law on Copyright and Related Rights, Database Right and Software Exceptions, Law No. 262-Z of 17 May 2011, arts. 14 and 39, on Copyright and Related Rights (as amended) Source as of 2026-09-06 scraping:by-no-262-z-17-may-2011-14-39-copyright-related:0

Democratic Republic of the Congo

Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.
Type Conditional Obligation Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Digital Code, Title III, cross-border transfer of personal data, Code du numérique, Titre III, arts. 201 à 203 (transfert des données personnelles) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-201-203-transfert-des:0

Central African Republic

This binds an operator, public or private, that the Agence Nationale de la Cybersécurité designates as an essential-service operator because its continuity could be gravely affected by an incident touching an electronic-communications network or an information system.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Establishment of the operator (entity in scope) Runtime not yet classified
Cybersecurity Law: Essential-Service Operator Cybersecurity Regime, Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre I (art. 7 à 12) Source as of 2026-09-20 security:cf-loi-n-24-002-relative-la-cybers-curit-et-la-l:0

Republic of the Congo

Do not collect or process personal data revealing ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data, or a person's state of health, unless one of the article 15 grounds applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 29-2019, special categories of personal data, Loi n° 29-2019, articles 4, 14 à 19 et 37 (catégories particulières de données et autorisation préalable) Source as of 2026-09-19 privacy:cg-loi-n-29-2019-articles-4-14-19-et-37-cat-gori:0

Côte d'Ivoire

Treat a database compiled through the choice, coordination or arrangement of its contents as a protected work: do not reproduce all or a substantial part of that arrangement without the rights holder's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright and Neighboring Rights Act, database compilation protection, Loi n° 2016-555 du 26 juillet 2016, art. 8 (protection des bases de données comme compilations), relative au droit d'auteur et aux droits voisins Source as of 2026-09-06 scraping:ci-loi-n-2016-555-du-26-juillet-2016-8-protectio:0

323 more lines in force in this class, and 367 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Limits on biometric use

310 lines 255 in force 77 provisions 66 jurisdictions by type: mandatory obligation 131, conditional obligation 87, prohibition 78, definition 7, consequence (penalty or remedy) 4, permission or exemption 3

Sample requirement lines Show 14 of the 255 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Obtain explicit consent, or establish another Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
GDPR Article 9, Special Categories of Personal Data Including Biometric Data, Regulation (EU) 2016/679, Art. 9 Source as of 2026-08-23 privacy:eu-2016-679-9:0

California

Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook Residence of the data subject Runtime not a duty
CCPA/CPRA Sensitive Personal Information and Biometric Data, Cal. Civ. Code section 1798.140(c), (ae); section 1798.121 Source as of 2026-08-23 privacy:us-ca-cal-civ-1798-140-c-ae-1798-121:0

United Kingdom

Obtain explicit consent, or establish another UK GDPR Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
UK GDPR Article 9, Special Categories of Personal Data Including Biometric Data, UK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 Source as of 2026-08-24 privacy:gb-uk-gdpr-9-data-protection-2018-sch-1:0

Brazil

Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, sensitive personal data and children's data, Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-5-ii-11-14-sensitiv:0

Ireland

Where you process special category data, including biometric data, about an employee in Ireland, ground it in a legitimate argument tied to vital interests or another Article 9(2) condition with a public-interest character, and put suitable and specific safeguarding measures in place, under Data Protection Act 2018 Section 46.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Residence of the data subject Runtime Outside any runtime path
GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in Ireland, Regulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 Source as of 2026-08-24 privacy:ie-eu-2016-679-9-data-protection-2018-46:0

Illinois

Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
Biometric Information Privacy Act (BIPA), 740 ILCS 14/1, 14/5, 14/10, 14/15, 14/25 (P.A. 95-994, eff. 2008-10-03, as amended by P.A. 103-0769, eff. 2024-08-02) Source as of 2026-08-23 privacy:us-il-740-ilcs-14-1-14-5-14-10-14-15-14-25:0

Peru

Do not use an AI-based system to influence a person's decision-making in a deceptive or manipulative way, including through subliminal techniques or by exploiting cognitive, emotional, or socioeconomic vulnerabilities to substantially alter their behavior.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Reglamento de la Ley 31814, prohibited AI uses, Decreto Supremo 115-2025-PCM, arts. 22-23 (Reglamento de la Ley 31814, Clasificación de Riesgos: Uso Indebido) Source as of 2026-09-05 ai:pe-decreto-supremo-115-2025-pcm-22-23-reglamento:0

South Africa

Do not process special personal information, including a person's biometric information, health, race, or political persuasion, unless a listed ground under sections 27 to 33 applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Protection of Personal Information Act, special personal information and children, POPIA, ss. 26-35 (special personal information and children) Source as of 2026-09-19 privacy:za-popia-ss-26-35-special-personal-information-c:0

Andorra

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, special categories, children and criminal-offence data, Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) Source as of 2026-09-19 privacy:ad-llei-29-2021-8-10-special-categories-children:0

Albania

Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, special categories of personal data, criminal records and children's data, Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) Source as of 2026-09-19 privacy:al-no-124-2024-8-6-9-10-special-categories-crimi:0

Bosnia and Herzegovina

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent, Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) Source as of 2026-09-19 privacy:ba-protection-personal-data-10-12-special-catego:0

Barbados

Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2019, a child's consent and sensitive personal data, Data Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) Source as of 2026-09-19 privacy:bb-data-protection-2019-ss-8-9-child-s-consent-s:0

Burkina Faso

Obtain the data subject's express consent before collecting or processing sensitive personal data, including data about health, biometric or genetic characteristics, sex life, racial or ethnic origin, political, philosophical, religious or trade union opinions or activity, morals, or criminal investigations, prosecutions, convictions and administrative or safety measures, unless a specific statutory exception applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Personal Data Protection Law, sensitive personal data categories, Loi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles) Source as of 2026-09-19 privacy:bf-loi-n-001-2021-5-12-30-31-35-donn-es-sensible:0

Benin

Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs, Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) Source as of 2026-09-19 privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-394-40:0

241 more lines in force in this class, and 310 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Tell somebody when there is a breach

300 lines 231 in force 85 provisions 79 jurisdictions by type: mandatory obligation 139, conditional obligation 129, consequence (penalty or remedy) 14, prohibition 11, definition 5, recommendation/guidance 2

Sample requirement lines Show 14 of the 231 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
General Data Protection Regulation (GDPR), Comprehensive Regime, Regulation (EU) 2016/679 Source as of 2026-08-23 privacy:eu-2016-679:0

California

Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
California Data Breach Notification Law, as amended by SB 446, Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319) Source as of 2026-08-23 privacy:us-ca-cal-civ-1798-82-as-amended-by-sb-446-2025:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Notify the ANPD and the affected data subjects of a security incident that may create relevant risk or harm to data subjects, within the reasonable period the ANPD sets by regulation, and state the reasons for the delay when the notice is not immediate.
Type Conditional Obligation Modal may Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
LGPD, security incident notification, Lei nº 13.709, de 2018 (LGPD), art. 48 (security incident notification) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-48-security-inciden:0

Vietnam

If a serious incident occurs in your AI system and you are its developer or provider, urgently apply technical measures to remedy, suspend, or recall the system, and at the same time notify the competent state authority of the incident.
Type Conditional Obligation Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not yet classified Hook Establishment of the operator; placing on the market; where the output is used Runtime not yet classified
Law on Artificial Intelligence, incident management and reporting obligation, Law No. 134/2025/QH15, art. 12 Source as of 2026-09-20 ai:vn-no-134-2025-qh15-12:0

Ireland

Notify the Data Protection Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Ireland, unless the breach is unlikely to risk their rights and freedoms.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
GDPR Articles 33-34, Breach Notification in Ireland, Regulation (EU) 2016/679, Arts. 33-34 Source as of 2026-08-24 privacy:ie-eu-2016-679-33-34:0

Illinois

Notify affected Illinois residents of a data breach in the most expedient time possible and without unreasonable delay after discovering unauthorized acquisition of their computerized personal information, which includes unique biometric data used to authenticate an individual.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
Personal Information Protection Act, data breach notification, 815 ILCS 530/1 et seq. (P.A. 94-36, eff. 2006-01-01) Source as of 2026-08-23 privacy:us-il-815-ilcs-530-1-et-seq-p-94-36-eff-2006-01:0

South Africa

Notify the Information Regulator of a security compromise as soon as reasonably possible after discovering that personal information has been accessed or acquired by an unauthorised person; the Act sets no fixed hour or day limit, only this standard.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Protection of Personal Information Act, notification of security compromises, POPIA, s. 22 (notification of security compromises) Source as of 2026-09-19 privacy:za-popia-s-22-notification-security-compromises:0

Nigeria

Notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Nigeria Data Protection Act, 2023, data breach notification, Nigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-data-breach-noti:0

United States

Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the affected person Runtime Evidenced by the runtime's record
HIPAA Breach Notification Rule, 45 CFR Part 164, Subpart D (Sections 164.400-164.414) Source as of 2026-08-23 privacy:us-45-cfr-part-164-subpart-d-sections-164-400-16:0

Andorra

Notify the Andorran Data Protection Agency of a personal data breach without undue delay and, where possible, within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
LQPD, personal data breach notification, Llei 29/2021, arts. 36-37 (personal data breach notification) Source as of 2026-09-19 privacy:ad-llei-29-2021-36-37-personal-data-breach-notif:0

Albania

Notify the Commissioner of a personal data breach as soon as possible and no later than 72 hours of becoming aware of the breach, unless the breach is unlikely to endanger the rights and freedoms of data subjects, and give the Commissioner your reasons for any later notification.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Law No. 124/2024, notification of a personal data breach, Law No. 124/2024, Art. 29 (notification of a personal data breach) Source as of 2026-09-19 privacy:al-no-124-2024-29-notification-personal-data-bre:0

Bosnia and Herzegovina

Notify the Agency of a personal data breach without undue delay and, if possible, within 72 hours of becoming aware of the breach, giving the Agency the reasons for the delay where notice comes later.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, personal data breach notification, Law on the Protection of Personal Data, arts. 35-36, 86-87 (personal data breach notification) Source as of 2026-09-19 privacy:ba-protection-personal-data-35-36-86-87-personal:0

Barbados

Notify a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of an individual, and give reasons for the delay if you notify later.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the affected person Runtime not yet classified
Data Protection Act, 2019, personal data breach notification, Data Protection Act, 2019, ss. 63-64 (personal data breach notification) Source as of 2026-09-19 privacy:bb-data-protection-2019-ss-63-64-personal-data-b:0

217 more lines in force in this class, and 300 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Assess the impact on personal data first

290 lines 242 in force 50 provisions 41 jurisdictions by type: mandatory obligation 160, conditional obligation 98, definition 22, prohibition 7, permission or exemption 3

Sample requirement lines Show 14 of the 242 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), Regulation (EU) 2022/2065, Article 35(1)(k) Source as of 2026-08-14 ai:eu-2022-2065-35-1-k:0

California

If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
CCPA Automated Decisionmaking Technology Regulations, Cal. Code Regs. tit. 11, Sections 7200 to 7222 Source as of 2026-09-08 ai:us-ca-11-cal-regs-sections-7200-7222:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Establish a lawful basis under article 7 before processing personal data, including data the person has made public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Lei Geral de Proteção de Dados Pessoais (LGPD), Lei nº 13.709, de 14 de agosto de 2018 (LGPD), arts. 1º-10, 15-16, 23-32, 37-41, 46-47, 49-51 (general regime, principles, lawful basis, public-sector processing, agents and governance) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-14-de-agosto-de-2018-lgpd:0

Vietnam

Classify your AI system's risk level (high, medium, or low) before putting it into service, based on its potential impact on rights, safety, security, and public interest, and the scale and context of its use.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Law on Artificial Intelligence, risk classification and conformity assessment, Law No. 134/2025/QH15, arts. 9-10, 13-14 Source as of 2026-09-06 ai:vn-no-134-2025-qh15-9-10-13-14:0

Ireland

Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
DPC Guidance: AI, Large Language Models and Data Protection, Data Protection Commission, "AI, Large Language Models and Data Protection" guidance (18 July 2024) Source as of 2026-08-24 privacy:ie-data-protection-commission-ai-large-language:0

Nigeria

Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.
Type Conditional Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Nigeria Data Protection Act, 2023 (NDPA), general data protection duties, Nigeria Data Protection Act, 2023 (No. 37 of 2023), general duties (ss. 1-3, 24-29, 32-33, 39 and 63-65; GAID 2025, arts. 1-17, 19-32, 34-35 and 41-42) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-no-37-2023:0

Andorra

Establish a lawful basis under Article 6 before processing personal data of a person in Andorra, and apply the Article 5 principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security throughout.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
LQPD, Llei 29/2021 del 28 d'octubre, LQPD, Llei 29/2021 del 28 d'octubre, arts. 1-2, 4-7, 11-14, 27-35, 38-41 (general provisions, lawful basis, controller and processor obligations, DPIA, the Data Protection Officer, and other general processing rules) Source as of 2026-09-19 privacy:ad-llei-qualificada-de-proteccio-de-dades-person:0

Albania

Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law No. 124/2024 On the Protection of Personal Data, Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025 Source as of 2026-09-19 privacy:al-no-124-2024-ligj-nr-124-2024-protection-perso:0

Bosnia and Herzegovina

Establish a lawful basis under Article 8 before processing personal data of a person in Bosnia and Herzegovina, and appoint a Data Protection Officer under Articles 39 to 41 wherever the processing meets the threshold the Act sets, such as processing carried out by a public authority or large-scale monitoring or special-category processing.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, Law on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable 4 October 2025, arts. 1-9, 13, 26-34, 37-45, 52-65 (excluding 57a-57b), 75-85, 88-90 (general provisions, lawful basis, controller and processor duties, security, DPIA, DPO) Source as of 2026-09-19 privacy:ba-protection-personal-data-official-gazette-bos:0

Barbados

Before processing personal data, establish a lawful basis and confine processing to the stated purpose.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act, 2019, Data Protection Act, 2019 (Act 2019-29), ss. 1-7, 29-62, 65-69 and 96-100 Source as of 2026-09-19 privacy:bb-2019-29-data-protection-2019:0

Benin

Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel), Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement) Source as of 2026-09-19 privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-protec:0

Botswana

Obtain a lawful basis before processing personal data of a person in Botswana, or of a person elsewhere if the processing is by a controller or processor established in Botswana.
Type Conditional Obligation Modal imperative Binds, by its wording Controller (the party that decides why and how personal data is processed) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Data Protection Act, 2024 (Act No. 18 of 2024), Data Protection Act, 2024 (Act No. 18 of 2024), ss. 1-5, 19-28, 51-62, 65-73 Source as of 2026-09-19 privacy:bw-data-protection-2024-no-18-2024:0

Democratic Republic of the Congo

Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:0

228 more lines in force in this class, and 290 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Conditions on sending data abroad

283 lines 240 in force 90 provisions 84 jurisdictions by type: mandatory obligation 160, conditional obligation 86, prohibition 33, consequence (penalty or remedy) 3, permission or exemption 1

Sample requirement lines Show 14 of the 240 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
General Data Protection Regulation (GDPR), Comprehensive Regime, Regulation (EU) 2016/679 Source as of 2026-08-23 privacy:eu-2016-679:0

United Kingdom

Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025, Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 Source as of 2026-08-24 privacy:gb-data-protection-2018-c-12-uk-gdpr-as-amended:0

Brazil

Transfer personal data outside Brazil only to a country or organization with an adequate level of protection, or under contractual clauses, corporate rules, or another article 33 safeguard.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
LGPD, international transfer of data, Lei nº 13.709, de 2018 (LGPD), arts. 33-36 (international transfer of data) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-33-36-international:0

Ireland

Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Ireland outside the European Economic Area.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Destination of a transfer Runtime Enforceable at a runtime control
GDPR Chapter V, Cross-Border Transfer of Personal Data from Ireland, Regulation (EU) 2016/679, Arts. 44-49 Source as of 2026-08-24 privacy:ie-eu-2016-679-44-49:0

Peru

Before a cross-border transfer of personal data, confirm the destination country maintains an adequate level of protection under the Law, or, where it does not, guarantee as the sender that the processing will comply with the Law.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Ley 29733, cross-border transfer of personal data, Ley No. 29733, arts. 11, 15 (cross-border transfer) Source as of 2026-09-19 privacy:pe-ley-no-29733-11-15-cross-border-transfer:0

South Africa

Before transferring personal information outside South Africa, confirm the recipient country, its binding rules, or an agreement provides an adequate level of protection substantially similar to the Act's conditions, or that another listed transfer ground, such as the data subject's consent, applies.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Protection of Personal Information Act, cross-border transfer, POPIA, s. 72 (transfer of personal information outside the Republic) Source as of 2026-09-19 privacy:za-popia-s-72-transfer-personal-information-outs:0

Nigeria

Before transferring personal data outside Nigeria, rely on an adequacy decision by the Commission, a Commission-approved cross-border data transfer instrument, or another lawful basis such as consent or a compelling legal or fiduciary duty.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Nigeria Data Protection Act, 2023, cross-border data transfer, Nigeria Data Protection Act, 2023, cross-border data transfer (Part VIII; GAID 2025, art. 45 and Schedule 5) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-cross-border-dat:0

United States

Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Destination of a transfer Runtime Enforceable at a runtime control
DOJ Data Security Program (Bulk Sensitive Personal Data Rule), 28 CFR Part 202 Source as of 2026-08-23 privacy:us-28-cfr-part-202:0

Andorra

Before transferring personal data to a country or international organisation outside Andorra, confirm the destination offers an adequate level of protection under Article 43, or put appropriate safeguards in place under Article 44, such as standard data-protection clauses or binding corporate rules.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
LQPD, transfers of personal data to third countries or international organisations, Llei 29/2021, arts. 42-45 (transfers of personal data to third countries or international organisations) Source as of 2026-09-19 privacy:ad-llei-29-2021-42-45-transfers-personal-data-th:0

Albania

Transfer personal data outside Albania only where the destination country, territory, sector or international organization has been found by the Commissioner to ensure an adequate level of protection, or where you provide an appropriate safeguard such as binding company rules, standard contractual clauses, or a Commissioner approved code of conduct or certification mechanism.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law No. 124/2024, international data transfer, Law No. 124/2024, Arts. 39-42 (international data transfer) Source as of 2026-09-19 privacy:al-no-124-2024-39-42-international-data-transfer:0

Angola

Notify the Agência de Protecção de Dados before transferring personal data to a country that ensures a level of protection at least equal to this law's, and expect the APD to assess adequacy by the nature, purpose and duration of the processing, the destination country and the legal, professional and security rules in force there.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law on the Protection of Personal Data, cross border transfer, Lei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados) Source as of 2026-09-19 privacy:ao-lei-n-22-11-de-17-de-junho-de-2011-33-34-tran:0

Argentina

Before transferring personal data of any kind to a country or international or supranational organization, confirm it provides an adequate level of protection; the transfer is prohibited otherwise.
Type Prohibition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Ley 25.326, cross-border transfer, Ley 25.326, art. 12 (cross-border transfer) Source as of 2026-09-19 privacy:ar-ley-25-326-12-cross-border-transfer:0

Bosnia and Herzegovina

Rely on a Council of Ministers adequacy decision, or an appropriate safeguard such as standard contractual clauses, binding business rules, or an approved code of conduct or certification, before transferring personal data outside Bosnia and Herzegovina, under Articles 46 to 49.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, cross-border transfer, Law on the Protection of Personal Data, arts. 46-51, 91-95 (cross-border transfer) Source as of 2026-09-19 privacy:ba-protection-personal-data-46-51-91-95-cross-bo:0

Barbados

Before transferring personal data outside Barbados, confirm the destination provides an adequate level of protection or rely on an appropriate safeguard such as standard clauses or binding corporate rules.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Data Protection Act, 2019, transfers of personal data outside of Barbados, Data Protection Act, 2019, ss. 22-28 (transfers of personal data outside of Barbados) Source as of 2026-09-19 privacy:bb-data-protection-2019-ss-22-28-transfers-perso:0

226 more lines in force in this class, and 283 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Label generated content

147 lines 84 in force 41 provisions 31 jurisdictions by type: mandatory obligation 46, conditional obligation 31, prohibition 22, definition 19, permission or exemption 18, consequence (penalty or remedy) 11

Sample requirement lines Show 14 of the 84 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
Type Definition Modal imperative Binds, by its wording Provider (the party that develops or places the system on the market) Scope turns on not a duty Hook Where the output is used; placing on the market Runtime not a duty
Digital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking), Regulation (EU) 2022/2065, Article 35(1)(k) Source as of 2026-08-14 ai:eu-2022-2065-35-1-k:0

California

Offer a manifest disclosure option, a visible AI-generated content label
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
California AI Transparency Act (SB 942, as amended by AB 853), Cal. Bus. and Prof. Code Sections 22757 to 22757.6 Source as of 2026-08-14 ai:us-ca-cal-bus-prof-sections-22757-22757-6:0

Brazil

Disclose, explicitly, prominently, and accessibly, when electoral advertising uses AI-generated synthetic content to create, replace, omit, merge, alter the speed of, or overlay images or sounds, and name the technology used.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
TSE Resolution, AI-Generated Content Disclosure Duty, Resolução TSE nº 23.610/2019, art. 9º-B (redação dada pela Resolução TSE nº 23.732, de 27 de fevereiro de 2024) Source as of 2026-09-05 ai:br-resolu-o-tse-n-23-610-2019-9-b-reda-o-dada-pe:0

Gabon

Do not circulate a realistic deepfake depicting an identifiable person in a sexual situation without their express consent.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Detectable at a runtime control
Ordonnance n°0011/PR/2026, contenus interdits générés par intelligence artificielle, Ordonnance n°0011/PR/2026, art. 32-33 (contenus IA interdits), du 26 février 2026 portant réglementation de l'usage des réseaux sociaux Source as of 2026-09-04 ai:ga-ordonnance-n-0011-pr-2026-32-33-contenus-ia-i:0

Greece

Do not remove or interfere with the machine-readable marking your AI system embeds in synthetic audio, image, video, or text output under EU AI Act Article 50(1).
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Law 5321/2026, National AI Act Implementation Law, Law 5321/2026, arts. 3-5, 16, 23 (FEK A' 114/20.07.2026) Source as of 2026-09-06 ai:gr-5321-2026-3-5-16-23-fek-114-20-07-2026:0

Kyrgyzstan

An app that lets a natural person interact with an AI system must tell that person they are dealing with an AI system, unless the interaction is obviously with one.
Type Conditional Obligation Modal must, unless Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Digital Code, Chapter 23: AI interaction and deepfake disclosure duties, Digital Code, Law No. 178 (18 June 2025), in force 6 February 2026, Chapter 23, Art. 197 Source as of 2026-09-07 ai:kg-digital-no-178-197:0

Turkey

Where an advertisement directed at consumers in Turkey uses artificial intelligence or other software in a way that significantly affects a consumer's economic behaviour, or presents an AI-generated digital character that a consumer could mistake for a real human being, disclose that fact clearly, understandably, and in a manner distinguishable from the rest of the advertisement.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Commercial Advertising Regulation, AI Disclosure Duty, Art. 18/8, Ticari Reklam ve Haksız Ticari Uygulamalar Yönetmeliği (RG No. 33297, 1 Temmuz 2026) Source as of 2026-09-06 ai:tr-18-8-ticari-reklam-ve-haks-z-ticari-uygulamal:0

Alabama

If you distribute AI-generated or AI-manipulated media that falsely depicts a candidate, and do so within 90 days of an election intending to harm that candidate's reputation or prospects or to change how electors vote, carry a clear and conspicuous disclaimer that the media has been manipulated by technical means and depicts speech or conduct that did not occur.
Type Definition Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Distribution of Materially Deceptive Media to Influence an Upcoming Election, Ala. Code § 17-5-16.1 Source as of 2026-09-06 ai:us-al-ala-17-5-16-1:0

Delaware

Do not distribute, or agree to distribute, a deep fake depicting a candidate or political party within 90 days of an election without the depicted individual's consent, if you know or reasonably should know the item is a deep fake.
Type Prohibition Modal do not, should Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
House Bill 316 (2024), use of deep fake technology to influence an election, Del. Code Ann. tit. 15, § 5145 Source as of 2026-09-06 ai:us-de-del-ann-tit-15-5145:0

Idaho

If you create or develop synthetic media (audio or video generated or manipulated using generative adversarial network techniques or similar digital technology) that deceptively depicts a candidate's action or speech in an electioneering communication, disclose that the media has been manipulated; a stated on-screen disclosure for video, or a spoken disclosure at defined intervals for audio, is an affirmative defense to liability under this section.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
FAIR Elections Act, disclosure duty for synthetic media in electioneering communications, Idaho Code section 67-6628A Source as of 2026-09-06 ai:us-id-idaho-67-6628a:0

Indiana

Include a disclaimer stating that elements of the media have been digitally altered or artificially generated, on any paid campaign communication that includes fabricated media of a candidate conveying a materially inaccurate depiction
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Use of Digitally Altered Media in Elections (House Enrolled Act 1133, 2024), Ind. Code § 3-9-8 Source as of 2026-09-06 ai:us-in-ind-3-9-8:0

Kentucky

If a communication you sponsor about a candidate for elective office alters that candidate's appearance, action, or speech through synthetic media, include a disclosure that is clear and conspicuous and placed in or alongside the content so a user is likely to notice it.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Synthetic Media Disclosure in Electioneering Communications, KRS 117.322 Source as of 2026-09-06 ai:us-ky-krs-117-322:0

Louisiana

Before placing a telephone call or automated call in a political campaign that was created using artificial intelligence and uses the voice of a public figure, an elected official, or a limited public figure, give a clear and understandable disclosure at the start of the call that it was created using artificial intelligence.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Act 559 (HB 639), AI-generated voice telephone campaign communication disclosure, La. R.S. 18:1463.1(D) to (H) Source as of 2026-09-06 ai:us-la-r-s-18-1463-1-d-h:0

Michigan

Do not distribute, or agree to distribute, AI-produced media that falsely depicts an identifiable individual's speech or conduct within 90 days before a Michigan election, if you know it is false and intend to harm a candidate or deceive voters.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Where the output is used; placing on the market Runtime Detectable at a runtime control
Distribution of Materially Deceptive Election Media (Public Act 265 of 2023), MCL 168.932f Source as of 2026-09-07 ai:us-mi-mcl-168-932f:0

70 more lines in force in this class, and 147 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Check the user's age

134 lines 112 in force 31 provisions 31 jurisdictions by type: mandatory obligation 60, conditional obligation 44, prohibition 30

Sample requirement lines Show 14 of the 112 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Brazil

Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LGPD, sensitive personal data and children's data, Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data) Source as of 2026-09-19 privacy:br-lei-n-13-709-de-2018-lgpd-5-ii-11-14-sensitiv:0

Peru

For sensitive data (biometric data that by itself identifies a person, racial or ethnic origin, income, political, religious, philosophical or moral opinions, union affiliation, or health or sex-life information), obtain the titleholder's consent in writing, in addition to the general consent requirements, and do not process it without that written consent unless a law authorizes processing without it on important public-interest grounds.
Type Conditional Obligation Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 29733, sensitive personal data and minors, Ley No. 29733, arts. 2.5, 13.3, 13.6, 14.6 (sensitive data and children) Source as of 2026-09-19 privacy:pe-ley-no-29733-2-5-13-3-13-6-14-6-sensitive-dat:0

Nigeria

Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Nigeria Data Protection Act, 2023, sensitive personal data and a child's data, Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) Source as of 2026-09-19 privacy:ng-nigeria-data-protection-2023-sensitive-person:0

United States

Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject Runtime Enforceable at a runtime control
Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments, 16 CFR Part 312, as amended effective June 23, 2025 Source as of 2026-08-23 privacy:us-16-cfr-part-312-as-amended-effective-june-23:0

Andorra

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, or process genetic data, biometric data used to uniquely identify a person, health data, or data about sex life or sexual orientation, unless a listed Article 9(2) exception applies, most commonly the data subject's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LQPD, special categories, children and criminal-offence data, Llei 29/2021, arts. 8-10 (special categories, children and criminal-offence data) Source as of 2026-09-19 privacy:ad-llei-29-2021-8-10-special-categories-children:0

Albania

Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law No. 124/2024, special categories of personal data, criminal records and children's data, Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data) Source as of 2026-09-19 privacy:al-no-124-2024-8-6-9-10-special-categories-crimi:0

Bosnia and Herzegovina

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union affiliation, genetic data, biometric data for unique identification, health data, or data about a person's sex life or sexual orientation, unless a listed exception in Article 11 applies, such as the person's explicit consent.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Law on the Protection of Personal Data of Bosnia and Herzegovina, special categories, criminal-conviction data and children's consent, Law on the Protection of Personal Data, arts. 10-12 (special categories, criminal-conviction data and children's consent) Source as of 2026-09-19 privacy:ba-protection-personal-data-10-12-special-catego:0

Barbados

Do not process sensitive personal data, including biometric data, unless the data subject consents or a specific statutory ground applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Data Protection Act, 2019, a child's consent and sensitive personal data, Data Protection Act, 2019, ss. 8-9 (child's consent and sensitive personal data) Source as of 2026-09-19 privacy:bb-data-protection-2019-ss-8-9-child-s-consent-s:0

Benin

Do not process sensitive personal data, including racial or ethnic origin, political opinions, religion or beliefs, trade union membership, genetic data, biometric data used to uniquely identify a person, health data, or data about a person's sex life or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent or data the person has manifestly made public.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, données sensibles et mineurs, Loi n°2017-20 du 20 avril 2018, Livre V, arts. 394-404, 407 et 446 (données sensibles et mineurs) Source as of 2026-09-19 privacy:bj-loi-n-2017-20-du-20-avril-2018-livre-v-394-40:0

Democratic Republic of the Congo

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Digital Code, Title III, sensitive personal data and minors, Code du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-195-199-206-et-247-cat:0

Colombia

Before processing sensitive personal data, including data revealing racial or ethnic origin, political opinion, religious or philosophical belief, union or human rights organization membership, health, sexual life, or biometric data, obtain the data subject's explicit authorization; processing sensitive personal data is otherwise prohibited.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Ley 1581 de 2012, Sensitive Categories and Children's Data, Ley 1581 de 2012, arts. 5-7 (Datos Sensibles y Menores) Source as of 2026-09-19 privacy:co-ley-1581-de-2012-5-7-datos-sensibles-y-menore:0

Djibouti

Do not process sensitive personal data (racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data) without the data subject's express consent or another statutory ground.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Digital Code, Book I: sensitive categories of personal data and the minor's consent, Code Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles) Source as of 2026-09-19 privacy:dj-num-rique-livre-premier-59-et-62-consentement:0

Ecuador

Do not process personal data without a lawful basis under the Act, and obtain explicit consent before processing a sensitive category of data unless another enumerated ground applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
LOPDP, categorías especiales de datos personales, LOPDP, arts. 25-32 (categorias especiales de datos personales) Source as of 2026-09-19 privacy:ec-lopdp-25-32-categorias-especiales-de-datos-pe:0

Egypt

Obtain a Personal Data Protection Center license before collecting, storing, transferring, or processing any Sensitive Personal Data, including a biometric, health, genetic, financial, religious, political, or criminal-record identifier, or any data relating to a child.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject Runtime not yet classified
Egypt Personal Data Protection Law, Sensitive Personal Data and a child's data, Law No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data) Source as of 2026-09-19 privacy:eg-no-151-2020-12-sensitive-personal-data-child:0

98 more lines in force in this class, and 134 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Put the terms in the contract

56 lines 51 in force 9 provisions 8 jurisdictions by type: mandatory obligation 34, conditional obligation 18, prohibition 3, definition 1

Sample requirement lines Show 14 of the 51 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Argentina

Obtain the data subject's free, express, and informed consent before processing their personal data, unless it comes from an unrestricted public-access source, is needed for a State function or legal obligation, is limited to a short listing of name and identifying numbers, arises from a contractual, scientific, or professional relationship, or is financial-entity customer data covered by Ley 21.526.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Ley 25.326, Ley de Protección de los Datos Personales, Ley 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) Source as of 2026-09-19 privacy:ar-ley-25-326-ley-de-protecci-n-de-los-datos-per:0

Belarus

Establish a lawful basis, generally the personal data subject's consent unless another basis in this Law applies, before processing personal data of a person in Belarus, and limit processing to explicit, pre declared, legitimate purposes, under Article 4.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law of the Republic of Belarus On Personal Data Protection, Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021), arts. 1-7, 17 and 20-21 (general processing and security) Source as of 2026-09-19 privacy:by-zakon-respubliki-belarus-no-99-z-ot-7-maia-20:0

Central African Republic

Have a lawful basis, such as a contract's performance, a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable consent, a vital interest, or a public interest mission, before processing someone's personal data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi n° 24.001 portant protection des données à caractère personnel, Loi n° 24.001 portant protection des données à caractère personnel, Chapitres Ier, II, V, VII et IX (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales) Source as of 2026-09-19 privacy:cf-loi-n-24-001-portant-protection-des-donn-es-c:0

Monaco

Establish one of the lawful bases Article 5 lists, such as consent, contract necessity, a legal obligation, vital interests, an important public interest ground, or legitimate interest, before processing personal data of a person in Monaco.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi sur la Protection des Données Personnelles, Loi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) Source as of 2026-09-19 privacy:mc-loi-n-1-565-du-3-decembre-2024-relative-la-pr:0

Mexico

Specify in a performing artist's labor contract the conditions and remuneration for any use of their image or voice through AI systems or other technology.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Decreto por el que se reforman y adicionan diversas disposiciones de la Ley Federal del Trabajo y de la Ley Federal del Derecho de Autor, en materia de derechos de las personas trabajadoras artistas intérpretes o ejecutantes, Diario Oficial de la Federación, 14 de mayo de 2026 (arts. 305 Bis LFT; 87, 102, 118 fracción VII, 121 LFDA) Source as of 2026-09-07 ai:mx-decreto-por-el-que-se-reforman-y-adicionan-di:0

Rwanda

Do not share or transfer personal data to a third party outside Rwanda unless you have the supervisory authority's authorisation with proof of appropriate safeguards, the data subject's consent, or another listed ground such as contract necessity, public interest, a legal claim, or a ratified international instrument.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage, Law N° 58/2021, arts. 48-50 (cross-border transfer and data localisation) Source as of 2026-09-19 privacy:rw-n-58-2021-48-50-cross-border-transfer-data-lo:0

Samoa

Where a service's terms condition access to the site on a user's or automated agent's acceptance, expect that acceptance may be found from conduct alone, since Samoan law lets consent to use an electronic record be inferred from a person's conduct rather than requiring a signed or clicked agreement.
Type Definition Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's terms, where the site is operated Runtime not a duty
Electronic Transactions Act 2008, electronic contract and signature recognition, Electronic Transactions Act 2008, No. 15 (Samoa), ss. 4, 8 (consent to electronic records and electronic signatures) Source as of 2026-09-07 scraping:ws-electronic-transactions-2008-no-15-samoa:0

Argentina

Collect only personal data that is true, adequate, relevant, and not excessive for the purpose you obtained it, use it only for that purpose, keep it accurate and updated, correct or delete it once you learn it is inaccurate or incomplete, store it so the data subject's access right can be exercised, and destroy it once it is no longer necessary.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Ley 25.326, Ley de Protección de los Datos Personales, Ley 25.326, Ley de Protección de los Datos Personales (2000), arts. 1-5, 9-11, 21-28, 47 (general regime, data quality, security, confidentiality, disclosure, registration, and sector rules) Source as of 2026-09-19 privacy:ar-ley-25-326-ley-de-protecci-n-de-los-datos-per:1

Belarus

Take consent that is freely given, unambiguous and informed, obtainable in writing, as an electronic document, or in another electronic form, and be ready to prove that it was obtained, under Article 5.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Law of the Republic of Belarus On Personal Data Protection, Zakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021), arts. 1-7, 17 and 20-21 (general processing and security) Source as of 2026-09-19 privacy:by-zakon-respubliki-belarus-no-99-z-ot-7-maia-20:1

Central African Republic

Apply the Act's core principles to every processing activity: lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and a retention period no longer than the purpose requires.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi n° 24.001 portant protection des données à caractère personnel, Loi n° 24.001 portant protection des données à caractère personnel, Chapitres Ier, II, V, VII et IX (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales) Source as of 2026-09-19 privacy:cf-loi-n-24-001-portant-protection-des-donn-es-c:1

Monaco

Take consent only as a free, specific, informed and unambiguous act, present a bundled consent request separately from other terms, and do not make consent a condition of a good or service unless the processing is indispensable to providing it.
Type Conditional Obligation Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Loi sur la Protection des Données Personnelles, Loi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725, arts. 1, 3-6, 9, 21-36, 58-63, 78-87 (scope, lawful basis, and controller and processor obligations) Source as of 2026-09-19 privacy:mc-loi-n-1-565-du-3-decembre-2024-relative-la-pr:1

Mexico

Obtain a performing artist's express consent, or that of their representative or rights-holder, before using or publishing their image or voice, including a result generated by an AI system or other technology, and limit that use to the purpose and modality actually agreed and remunerated.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Affected person Hook Establishment of the operator; placing on the market; where the output is used Runtime Enforceable at a runtime control
Reform to the Federal Labor Law and the Federal Copyright Law, AI Voice and Image Consent Regime for Performing Artists, Decreto por el que se reforman y adicionan diversas disposiciones de la Ley Federal del Trabajo y de la Ley Federal del Derecho de Autor, en materia de derechos de las personas trabajadoras artistas intérpretes o ejecutantes, Diario Oficial de la Federación, 14 de mayo de 2026 (arts. 305 Bis LFT; 87, 102, 118 fracción VII, 121 LFDA) Source as of 2026-09-07 ai:mx-decreto-por-el-que-se-reforman-y-adicionan-di:1

Rwanda

Enter into a written contract with anyone you authorise to access, share or transfer personal data outside Rwanda, setting out each party's respective roles and responsibilities.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Destination of a transfer Runtime not yet classified
Law relating to the Protection of Personal Data and Privacy, cross-border transfer and data storage, Law N° 58/2021, arts. 48-50 (cross-border transfer and data localisation) Source as of 2026-09-19 privacy:rw-n-58-2021-48-50-cross-border-transfer-data-lo:1

Samoa

Do not rely on an electronic signature to satisfy a signature requirement unless it identifies the signatory, indicates their approval, is as reliable as the purpose requires, and the recipient consents to receiving it.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's terms, where the site is operated Runtime Outside any runtime path
Electronic Transactions Act 2008, electronic contract and signature recognition, Electronic Transactions Act 2008, No. 15 (Samoa), ss. 4, 8 (consent to electronic records and electronic signatures) Source as of 2026-09-07 scraping:ws-electronic-transactions-2008-no-15-samoa:1

37 more lines in force in this class, and 56 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Respect text and data mining opt-outs

54 lines 52 in force 26 provisions 24 jurisdictions by type: permission or exemption 18, mandatory obligation 12, prohibition 10, definition 7, conditional obligation 6, consequence (penalty or remedy) 1

Sample requirement lines Show 14 of the 52 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

European Union

Publish a training-content summary if you provide a general-purpose model
Type Conditional Obligation Modal imperative Binds, by its wording Provider of a general-purpose model Scope turns on Provider Hook Establishment of the operator; placing on the market; where the output is used Runtime Outside any runtime path
AI Act, Article 53 (obligations for providers of general-purpose AI models), Regulation (EU) 2024/1689, Article 53 Source as of 2026-08-15 ai:eu-2024-1689-53:0

Italy

You may reproduce and extract text and data from lawfully accessible works, databases, or other materials for text-and-data-mining purposes, including through AI models and systems, whether for scientific research (art. 70-ter) or general and commercial use (art. 70-quater/70-septies).
Type Permission or exemption Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Legge sul Diritto d'Autore Artt. 70-ter and 70-quater, Text-and-Data-Mining Exceptions, Legge 22 aprile 1941, n. 633, artt. 70-ter, 70-quater, inserted by Decreto Legislativo 8 novembre 2021, n. 177; art. 70-septies inserted by Legge 23 settembre 2025, n. 132, art. 25 Source as of 2026-09-06 scraping:it-lda-70ter-70quater-tdm-exceptions:0

Australia

A use of a literary, dramatic, musical or artistic work is not infringing if it is a fair dealing for research or study, criticism or review, parody or satire, or reporting news; training an AI model on copyrighted text does not fit any of these purposes as such, and no separate text-and-data-mining exception is available.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act 1968 (Cth), Fair Dealing Exceptions and No Text-and-Data-Mining Exception, Copyright Act 1968 (Cth), No. 63, 1968, ss. 10, 40, 41, 41A, 42 Source as of 2026-09-06 scraping:au-copyright-1968-cth-no-63-1968-ss-10-40-41-41a:0

Peru

A quotation from a lawfully disclosed work may be made without the author's consent or payment if the author's name and the source are stated and the quotation follows proper practice and does not exceed what its purpose justifies.
Type Permission or exemption Modal may Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Decreto Legislativo 822, quotation exception, Decreto Legislativo 822, art. 44 (quotation exception), Ley sobre el Derecho de Autor, as consolidated to Decreto Legislativo 1391 (2018) Source as of 2026-09-05 scraping:pe-decreto-legislativo-822-44-quotation-exceptio:0

Bosnia and Herzegovina

Do not reproduce, distribute, make available, or otherwise exploit a copyrighted work, including for training a model on it, without a transfer of the relevant right or a license, because the Law recognizes no general text-and-data-mining or fair-use exception beyond its closed list of specific limitations.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Law on Copyright and Related Rights, Content Limitations (No Text-and-Data-Mining Exception), Law on Copyright and Related Rights, arts. 8, 40-54 (Content Limitations of Copyright), Official Gazette of BiH No. 63/10, 86/10 Source as of 2026-09-06 scraping:ba-copyright-related-rights-40-54-content-limita:0

Belgium

Do not reproduce a work made accessible in a lawful manner for text-and-data-mining purposes if the rightsholder has expressly reserved that use in an appropriate manner.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Code de droit économique, article XI.190, 20°, exception de fouille de textes et de données, Code de droit économique, art. XI.190, 20°, inséré par la loi du 19 juin 2022 transposant partiellement la directive (UE) 2019/790 (Moniteur belge, 1 août 2022) Source as of 2026-09-06 scraping:be-de-droit-economique-xi-190-20-insere-par-la-l:0

Bulgaria

Honor an express, machine-readable rights reservation before relying on the general text-and-data-mining exception to reproduce or extract a lawfully accessed work, per ZAPSP Article 26e(4).
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act (ZAPSP), Arts. 26e, 26zh and 26k, Text-and-Data-Mining Exception for Crawling and Training, ZAPSP crawling-training TDM exception (Закон за авторското право и сродните му права, Zakon za avtorskoto pravo i srodnite mu prava), chl. 26e, 26zh i 26k, izm. i dop. DV br. 100 ot 1 dekemvri 2023 g. Source as of 2026-09-06 scraping:bg-zapsp-crawling-training-tdm-exception-zakon-z:0

Belize

Reproducing copyrighted Belizean text for research, private study, or reporting current events may fall within fair dealing, but training a model on it or crawling it at scale has not been tested against the fair-dealing factors in a reported case.
Type Permission or exemption Modal may Binds, by its wording Operator of a crawler or bot Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act, fair dealing exceptions, Copyright Act, Cap. 252 (Act No. 12 of 2000, Revised Edition 2020), ss. 56-58 Source as of 2026-09-05 scraping:bz-copyright-cap-252-ss-56-58-fair-dealing:0

Cook Islands

Do not copy, reproduce, or communicate to the public a substantial part of a copyrighted work without the owner's authorisation, unless a section 14 to 25 exception applies, such as the section 22 exception for a single copy or adaptation of a computer program made to use it for the purpose it was obtained, for archival purposes, or to replace a lost or destroyed copy.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright Act 2013, economic rights, computer program copying, and technological protection measures, Copyright Act 2013, No. 8 (Cook Islands), ss. 8, 9, 22, 44 (economic rights, computer program copying, and technological protection measures) Source as of 2026-09-07 scraping:ck-copyright-2013-no-8-cook-islands-ss-8-9-22-44:0

Czech Republic

Honor a rightholder's express, suitably given reservation, including a machine-readable reservation on a work made available online, before relying on the general text-and-data-mining exception to mine that work in the Czech Republic.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Autorský zákon Sections 39c-39d, Text and Data Mining Exception for Automated Analysis, Zakon c. 121/2000 Sb., o pravu autorskem (autorsky zakon), Sec. 39c and Sec. 39d, as inserted by Zakon c. 429/2022 Sb. Source as of 2026-09-06 scraping:cz-autorsk-z-kon-121-2000-sb-39c-39d-tdm-obecne:0

Micronesia

A general fair use exception permits reproducing a copyrighted work, including for criticism, comment, news reporting, teaching, scholarship, or research, weighed against the purpose, nature, amount used, and market effect of the use.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
FSM Copyright Act, exclusive rights, fair use, and compilation protection, FSM Code Title 35, Ch. 1 (Copyrights), secs. 101-109 Source as of 2026-09-05 scraping:fm-fsm-title-35-ch-1-copyrights-secs-101-109:0

Georgia

This law carries no text-and-data-mining exception; obtain the rightsholder's authorisation or a licence before reproducing copyrighted text or data from a Georgian source for AI training or data mining, unless a general exception such as the quotation exception genuinely fits the use.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Related Rights, no text-and-data-mining exception, Law of Georgia on Copyright and Related Rights, adopted 22 June 1999, as amended Source as of 2026-09-06 scraping:ge-georgia-copyright-related-rights-adopted-22-j:0

Honduras

Do not reproduce a protected work, or a collection of works or of data original in its selection, coordination or arrangement, beyond the narrow personal-use, library-preservation or teaching exceptions this law states.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Ley del Derecho de Autor, sin excepción de minería de textos y datos, protección de compilaciones, Decreto No. 4-99-E, Ley del Derecho de Autor y de los Derechos Conexos, arts. 9(5), 44-50 (Definiciones; Limitaciones y Excepciones) Source as of 2026-09-05 scraping:hn-decreto-no-4-99-e-ley-del-derecho-de-autor-y:0

Jamaica

Copying a compilation's selection and arrangement can infringe the compilation's own copyright, but extracting the underlying works, data, or other material it comprises does not, because no sui generis database right protects that material separately.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder) Runtime not a duty
Copyright Act, 1993 (as amended by Act 13 of 2015), compilations, Copyright Act, 1993 (Act 5 of 1993, as amended by Act 29 of 1999), s. 3(3A) Source as of 2026-09-05 scraping:jm-copyright-1993-as-amended-by-13-2015-compilat:0

38 more lines in force in this class, and 54 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Meet a design code

45 lines 9 in force 8 provisions 8 jurisdictions by type: mandatory obligation 26, conditional obligation 9, prohibition 6, definition 4

Sample requirement lines Show 9 of the 9 lines in forceHide the sample

What follows is a sample of 9 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Democratic Republic of the Congo

Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
Type Conditional Obligation Modal unless Binds, by its wording Operator (the party running the application) Scope turns on Data subject Hook Residence of the data subject; establishment of the operator Runtime Enforceable at a runtime control
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:0

Democratic Republic of the Congo

File a prior declaration with the Data Protection Authority before processing personal data, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, national-identification, or cross-border-transfer data.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Operator Hook Residence of the data subject; establishment of the operator Runtime Outside any runtime path
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:1

Democratic Republic of the Congo

Keep personal data reliable, adequate, relevant, accurate and not excessive, and correct or erase it once it becomes inaccurate or incomplete.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:2

Democratic Republic of the Congo

Do not process personal data for historical, statistical or scientific purposes beyond its original collection unless one of the statutory safeguards applies, or process only anonymous data for that further purpose.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:3

Democratic Republic of the Congo

Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:4

Democratic Republic of the Congo

Build data protection into the processing by design and by default, including pseudonymization, and process by default only the personal data necessary for each specific purpose.
Type Mandatory Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook Residence of the data subject; establishment of the operator Runtime reworded since it was classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:5

Democratic Republic of the Congo

Appoint a data protection officer where your processing is non-occasional, high-risk, or touches special-category or criminal-record data, and keep a written record of your processing activities available to the Data Protection Authority.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:6

Democratic Republic of the Congo

Govern any processor's engagement by a written contract confining it to your documented instructions, and require the processor not to engage a sub-processor without your prior written authorization.
Type Mandatory Obligation Modal imperative Binds, by its wording Processor (the party that processes personal data for a controller) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:7

Democratic Republic of the Congo

Carry out a data protection impact assessment before processing likely to create a high risk to individuals' rights and freedoms, and consult the Data Protection Authority in advance where that assessment shows a high risk you have not sufficiently mitigated.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not yet classified Hook Residence of the data subject; establishment of the operator Runtime not yet classified
Digital Code, Title III: Personal Data Protection, Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) Source as of 2026-09-19 privacy:cd-du-num-rique-titre-iii-des-donn-es-personnell:8

0 more lines in force in this class, and 45 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

Credit or licence the publisher's content

31 lines 31 in force 15 provisions 13 jurisdictions by type: prohibition 15, permission or exemption 9, conditional obligation 3, definition 2, mandatory obligation 1, consequence (penalty or remedy) 1

Sample requirement lines Show 14 of the 31 lines in forceHide the sample

What follows is a sample of 14 requirement lines from the LexLint software-law corpus, chosen to span jurisdictions.

Burkina Faso

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Outside any runtime path
Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Loi n°048-2019/AN, Database and News-Facts Exclusions (Arts. 10 et 22), portant protection de la propriété littéraire et artistique, 12 novembre 2019 Source as of 2026-09-04 scraping:bf-loi-n-048-2019-database-news-facts-exclusions:0

Burundi

Treat a database compiled through the selection or arrangement of its contents as a protected work: do not reproduce all or a substantial part of it without the rights holder's authorization, even for otherwise-permitted private use.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Law No. 1/021 of December 30, 2005 on the Protection of Copyright and Related Rights, database and facts exclusions, Loi n° 1/021, Database and Facts Exclusion (Arts. 7 et 26.1), portant protection du droit d'auteur et des droits voisins, 30 décembre 2005 Source as of 2026-09-04 scraping:bi-loi-n-1-021-database-facts-exclusion-7-et-26:0

Bahamas

Do not reproduce or commercially deal in a substantial part of a database or compilation that is original by reason of the selection, co-ordination or arrangement of its contents, without the compiler's authorisation.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright Act 1998, compilation and database protection, Copyright Act, Ch. 323, Laws of The Bahamas, s. 2 (definition of compilation), s. 5 (category of works of authorship) Source as of 2026-09-07 scraping:bs-copyright-ch-323-laws-bahamas-s-6-works-autho:0

Dominica

Do not reproduce the whole or a substantial part of a database that is original by reason of the selection or arrangement of its contents, in digital form, without the copyright owner's authorisation; the private-use, personal-purpose reproduction exception does not reach that reproduction.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright Act 2003, database and compilation protection, Copyright Act, 2003 (Act No. 5 of 2003, Commonwealth of Dominica), s. 6(1)(b), s. 63 Source as of 2026-09-07 scraping:dm-copyright-no-5-2003-database-compilation:0

Gabon

Do not reproduce a collection or database whose choice or arrangement of contents is an original intellectual creation without the rightsholder's authorization; Gabon has no sui generis database right, so an unoriginal, purely factual collection is not itself protected.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Loi n°1/87, protection des recueils et compilations, Loi n°1/87, art. 5 (recueils et compilations), du 29 juillet 1987 instituant la protection du droit d'auteur et des droits voisins Source as of 2026-09-04 scraping:ga-loi-n-1-87-5-recueils-et-compilations-du-29-j:0

Cayman Islands

Do not reproduce or commercially deal in a substantial part of a database or compilation protected as a literary work under the extended Copyright, Designs and Patents Act 1988 without the compiler's authorisation.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Copyright (Cayman Islands) Order 2015, database and compilation copyright, Copyright (Cayman Islands) Order 2015, s. 3(1) databases Source as of 2026-09-07 scraping:ky-copyright-cayman-islands-order-2015-s-3-1-dat:0

Maldives

Do not reproduce more than a short part of a published work as a quotation unless the reproduction is compatible with fair practice and does not exceed what the purpose justifies, and always indicate the source and the author's name.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Related Rights Act, quotation and informational-purpose exceptions, Copyright and Related Rights Act (Law No. 23/2010), ss. 10, 12(b)(3), 14, 17 Source as of 2026-09-06 scraping:mv-copyright-related-rights-no-23-2010-ss-10-12:0

Nicaragua

Do not reproduce the whole, or an important part, of a protected compilation or database in digital form without the rights holder's authorization; the personal-use privilege does not cover it.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Enforceable at a runtime control
Ley No. 312, protection of compilations and databases, Ley No. 312 (1999, as amended), arts. 14, 31.3 Source as of 2026-09-05 scraping:ni-ley-no-312-1999-as-amended-14-31-3:0

Nepal

Citing a small portion of a published work, or reproducing portions of a newspaper or journal to disseminate current information, does not require the author's authorisation so long as the source and author are named and the use is not prejudicial to the author's economic right.
Type Permission or exemption Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright Act, 2059, citation and current-information reproduction exceptions, Copyright Act, 2059 (2002), ss. 17, 20 Source as of 2026-09-07 scraping:np-copyright-2059-2002-ss-17-20:0

Papua New Guinea

Do not reproduce, adapt, or otherwise use a substantial part of a protected literary or artistic work, including text from a published article, beyond what the private-use, quotation, teaching, reprographic, or informatory-purposes exceptions in this Act allow, without the author's or copyright owner's authorization.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Copyright and Neighbouring Rights Act 2000, Exceptions to Copyright and Enforcement, Copyright and Neighbouring Rights Act 2000 (PNG), No. 21 of 2000, ss. 5, 8, 10, 14, 27-28 Source as of 2026-09-06 scraping:pg-copyright-neighbouring-rights-2000-exceptions:0

Sao Tome and Principe

Do not reproduce a compilation, anthology, or systematic collection whose choice or arrangement of contents is itself an intellectual creation, without the rightsholder's authorization; Sao Tome and Principe has no sui generis database right, so an unoriginal, purely factual collection of data is not itself protected against reproduction.
Type Prohibition Modal do not Binds, by its wording Operator (the party running the application) Scope turns on reworded since it was classified Hook The counterparty's establishment (rightsholder) Runtime reworded since it was classified
Decreto-Lei n.º 02/2017, protecção de compilações e exclusão das notícias do dia, Decreto-Lei n.º 02/2017, arts. 3 e 7, de 19 de Abril de 2017, Código do Direito de Autor e dos Direitos Conexos Source as of 2026-09-06 scraping:st-decreto-lei-n-02-2017-3-e-7-compila-es-e-excl:0

Uruguay

Do not reproduce, distribute, communicate, or make a copyrighted work available to the public without the author's consent, unless a free-use exception applies.
Type Prohibition Modal do not, unless Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime Enforceable at a runtime control
Ley N° 9.739 arts. 44-45, illicit-reproduction rule and free-use exceptions for quotation and news, Ley N° 9.739, de 17 de diciembre de 1937, arts. 44 y 45 Source as of 2026-09-05 scraping:uy-ley-n-9-739-de-17-de-diciembre-de-1937-44-y-4:0

Vatican City

Treat a work protected under the copyright and related-rights legislation in force in Italy as protected in Vatican City State too, including a future amendment Italy makes to that legislation, unless this law states an exception.
Type Definition Modal unless Binds, by its wording Operator (the party running the application) Scope turns on not a duty Hook The counterparty's establishment (rightsholder); where the copy is made Runtime not a duty
Copyright and related rights by reference to Italian law (Legge N. CXCVII), Legge N. CXCVII, Legge sulla protezione del diritto di autore sulle opere dell'ingegno e dei diritti connessi, 1 settembre 2017 Source as of 2026-09-06 scraping:va-legge-n-cxcvii-legge-sulla-protezione-del-dir:0

Burkina Faso

Rely only on the Law's enumerated exceptions rather than a general fair-use or text-and-data-mining defense when quoting, analyzing, or reproducing a protected work: a short quotation or analysis, a press review, or current-events reporting, each requiring clear credit to the author and source, and none framed as covering AI training.
Type Conditional Obligation Modal imperative Binds, by its wording Operator (the party running the application) Scope turns on Counterparty Hook The counterparty's establishment (rightsholder) Runtime Outside any runtime path
Loi n°048-2019/AN du 12 novembre 2019 portant protection de la propriété littéraire et artistique, database and news exceptions, Loi n°048-2019/AN, Database and News-Facts Exclusions (Arts. 10 et 22), portant protection de la propriété littéraire et artistique, 12 novembre 2019 Source as of 2026-09-04 scraping:bf-loi-n-048-2019-database-news-facts-exclusions:1

17 more lines in force in this class, and 31 lines in all, are in the LexLint software-law corpus; the full register is the file in section 6.

6The register as a file

requirement-register.csv holds every line in the register, one row per line, with the columns above and the topic, instrument, citation, summary page, source, lifecycle band and as-of date. The obligation classes are given as the corpus keys them, semicolon-separated, so a row can be joined to the class it is filed under here; the words for each key are the headings of section 5. It is generated from the LexLint software-law corpus on the date in this page's byline and it will be regenerated when the corpus moves; a copy taken today is a snapshot with that date on it.

Two links per row. Instrument page is LexLint's own summary of the instrument. Source URL, after it, is the link the LexLint software-law corpus researched the instrument from: for most rows the law's own text at its publisher (a gazette, a legislature, a regulator) or in a repository of legal texts such as WIPO Lex or an archived copy, and for a few rows the secondary source the research read, which is why the column is named for the source rather than for the law.

Classification. A Classification column after the runtime tier says which of four states the line is in: classified, not a duty, not yet classified, or reworded since it was classified. The party, party group and tier columns print the same words in place of a value for every line in the other three states, so a blank never has to be guessed at.

Party group. Party group (LexLint six parties), after the party column, restates the party whose position triggers scope as one of The 6 parties, so a row can be read against that document. Five of the classification's six values name one party inside a group; Counterparty already names a group, not one of its four members, so the group is the level every value can be stated at without adding detail the classification did not record. A line with no party has no group. The applicable-entity column is not restated this way: it is read off the line's wording, and one of its values, a developer, distributor or importer, spans two groups.

Party whose position triggers scopeParty group
OperatorOPERATOR
PrincipalUSER
ProviderMAKER
CounterpartyCOUNTERPARTY
Affected personUSER
Data subjectUSER

The same lines in the Agentic AI Foundation working group's sixteen-theme column contract, with the theme identifiers first, are the file offered from the sixteen themes, filled from binding law. The file here is licensed separately from the documents around it, under Creative Commons Attribution-NonCommercial 4.0 rather than the section's ShareAlike terms: use it for noncommercial purposes with credit to LexLint (UnGovr), and contact LexLint at hello@ungovr.org to discuss commercial use.

7What this register does not claim

It does not say that any line binds any particular organisation. That is the applicability question, and it is answered per deployment from the roles a system holds and where its parties are, which is what The 6 parties and Where the parties are are about. The addressee and the hook are rules applied to text, reviewed in samples, not findings made line by line; the class is the research's record on the instrument, and where the research has not recorded one the register says so rather than guessing. Every entry, on this page and in the file, links to the source the corpus researched it from, so that a reader can check the rule against the law.