Law / Privacy
Privacy law, instrument by instrument
Every privacy law instrument LexLint holds, grouped by the place that made it. Choose which stages of law to show: the map, the counts and the tables all answer to that choice. To see every area of law, follow Law in the breadcrumb above.
- 1
- 5
- 10
- 20+
- instruments shown
- law on file, none at these stages
- tracked, no law on file
- not tracked
Unions6 in 1 place
Law made above the state, binding its members.
| Stage | Instrument | In force from |
|---|---|---|
| European Union eu 6 instruments | ||
| Digital Omnibus Regulation Proposal, GDPR and ePrivacy ReformCOM(2025) 837 final | [proposed] | |
| GDPR Article 9, Special Categories of Personal Data Including Biometric DataRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 12-22, Data Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and RemediesRegulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| General Data Protection Regulation (GDPR), Comprehensive RegimeRegulation (EU) 2016/679 | 2018-05-25 | |
Countries578 in 177 places
One row group per country, alphabetically.
| Stage | Instrument | In force from |
|---|---|---|
| Afghanistan af 1 instrument | ||
| Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38 | 2004-01-26 | |
| Albania al 1 instrument | ||
| Law No. 124/2024 On the Protection of Personal DataLaw No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, in force 31 January 2025 | 2025-01-31 | |
| Algeria dz 1 instrument | ||
| Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, Journal officiel n° 48 | 2023-08-11 | |
| Andorra ad 1 instrument | ||
| LQPD, Llei 29/2021 del 28 d'octubreLlei Qualificada de Proteccio de Dades Personals (LQPD), Butlleti Oficial del Principat d'Andorra, as amended by Llei 12/2024 | 2022-05-17 | |
| Angola ao 1 instrument | ||
| Law on the Protection of Personal DataLei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais) | not recorded | |
| Antigua and Barbuda ag 1 instrument | ||
| Data Protection Act, 2013Data Protection Act, 2013 (No. 10 of 2013), ss. 5-23 | not recorded | |
| Argentina ar 1 instrument | ||
| Ley 25.326, Ley de Protección de los Datos PersonalesLey 25.326, Ley de Protección de los Datos Personales (2000) | 2000-10-30 | |
| Armenia am 6 instruments | ||
| Law on Protection of Personal Data, biometric data provisionsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 3(13), 13, 19(4), 19(6), 23(3) | 2015-07-01 | |
| Law on Protection of Personal Data, comprehensive regimeLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N (2015), Arts. 1, 3-8 | 2015-07-01 | |
| Law on Protection of Personal Data, cross-border transferLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 27 | 2015-07-01 | |
| Law on Protection of Personal Data, data subject rightsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 15-17 | 2015-07-01 | |
| Law on Protection of Personal Data, enforcementLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 24 | 2015-07-01 | |
| Law on Protection of Personal Data, special category dataLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 12 | 2015-07-01 | |
| Australia au 5 instruments | ||
| Privacy Act 1988 (Cth), Comprehensive Regime and Civil PenaltiesPrivacy Act 1988 (Cth), No. 119, 1988, ss. 6, 13, 13G, 13H, 14, 15 | 1989-01-01 | |
| Privacy Act 1988 (Cth), Notifiable Data Breaches SchemePrivacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL | 2018-02-22 | |
| Privacy Act 1988 (Cth), Schedule 1, Sensitive and Biometric InformationPrivacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6 | 2014-03-12 | |
| Privacy Act 1988 (Cth), Schedule 2, Statutory Tort for Serious Invasions of PrivacyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 2, inserting Schedule 2 to the Privacy Act 1988 | 2025-06-10 | |
| Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making TransparencyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988 | 2026-12-10[future] | |
| Austria at 6 instruments | ||
| Datenschutzgesetz (DSG), Data Protection ActDatenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 24/2018 | 2018-05-25 | |
| GDPR Article 22 and DSG Sections 42-45, Automated Decision-Making in AustriaRegulation (EU) 2016/679, Art. 22; Datenschutzgesetz (DSG) §§42-45 | 2018-05-25 | |
| GDPR Article 82 and Datenschutzbehorde Enforcement in AustriaRegulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in AustriaRegulation (EU) 2016/679, Art. 9, as applied in Austria | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in AustriaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from AustriaRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Azerbaijan az 6 instruments | ||
| Law on Personal Data, biometric data enumeration and general processing conditionsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5 | 2010-05-11 | |
| Law on Personal Data, comprehensive regime and lawful basisLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ (11 May 2010, as amended through 2023), Arts. 1-2, 8-13 | 2010-05-11 | |
| Law on Personal Data, cross-border transferLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14 | 2010-05-11 | |
| Law on Personal Data, data subject rightsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7 | 2010-05-11 | |
| Law on Personal Data, enforcement and liabilityLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 | 2010-05-11 | |
| Law on Personal Data, special categories of personal dataLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7 | 2010-05-11 | |
| Bahrain bh 6 instruments | ||
| Personal Data Protection Law, biometric data prior authorisationLaw No. 30 of 2018, Art. 15 | 2019-08-01 | |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 30 of 2018, Arts. 4-9 | 2019-08-01 | |
| Personal Data Protection Law, cross-border transferLaw No. 30 of 2018, Arts. 12-13 | 2019-08-01 | |
| Personal Data Protection Law, data subject rightsLaw No. 30 of 2018, Arts. 17-23 | 2019-08-01 | |
| Personal Data Protection Law, enforcement and penaltiesLaw No. 30 of 2018, Arts. 55, 57-60 | 2019-08-01 | |
| Personal Data Protection Law, sensitive personal dataLaw No. 30 of 2018, Arts. 1, 5 | 2019-08-01 | |
| Bangladesh bd 5 instruments | ||
| Personal Data Protection Act, 2026, breach notification dutiesPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.20 | 2025-11-06 | |
| Personal Data Protection Act, 2026, complaints, penalties and appealsPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 | [future] | |
| Personal Data Protection Act, 2026, comprehensive regime and lawful basisPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 | 2025-11-06 | |
| Personal Data Protection Act, 2026, cross-border transfer of personal dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 | 2025-11-06 | |
| Personal Data Protection Act, 2026, sensitive personal data and biometric dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 | 2025-11-06 | |
| Barbados bb 1 instrument | ||
| Data Protection Act, 2019Data Protection Act, 2019 (Act 2019-29) | 2021-03-26 | |
| Belarus by 1 instrument | ||
| Law of the Republic of Belarus On Personal Data ProtectionZakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021) | 2021-11-15 | |
| Belgium be 10 instruments | ||
| Act of 3 December 2017, GBA/APD and Litigation ChamberLoi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916) | 2018-05-25 | |
| Act of 30 July 2018 Article 10/1, Recorded Commercial CommunicationsLoi du 30 juillet 2018, Art. 10/1, as inserted by the Act of 21 December 2021, article 255 | 2022-01-10 | |
| Act of 30 July 2018 Article 9 and GBA/APD Biometric Recommendation and EnforcementLoi du 30 juillet 2018, Art. 9; GBA/APD Aanbeveling nr. 01/2021; GBA/APD Beslissing ten gronde nr. 114/2024 | 2018-09-05 | |
| Act of 30 July 2018 Articles 8-10, Special-Category Processing GroundsLoi du 30 juillet 2018, Arts. 8-10 | 2018-09-05 | |
| Act of 30 July 2018 Title 5, Action en Cessation, and GDPR Article 22Loi du 30 juillet 2018, Arts. 11-17, 209-211, 220; Regulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| Act of 30 July 2018 Title 6 Chapter II, Criminal SanctionsLoi du 30 juillet 2018, Arts. 222-230 | 2018-09-05 | |
| Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal DataLoi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581) | 2018-09-05 | |
| Code de Droit Economique Article XVII.37, 10 degrees/1, Collective Redress for GDPR ClaimsCode de droit economique, Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5); Loi du 30 juillet 2018, Art. 222, 4 | 2018-05-25 | |
| Belize bz 4 instruments | ||
| Data Protection Act 2021, Commissioner, Tribunal, and enforcementData Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92 | [future] | |
| Data Protection Act 2021, comprehensive regimeData Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22 | [future] | |
| Data Protection Act 2021, cross-border transfer of personal dataData Protection Act, 2021 (Act No. 45 of 2021), ss. 23-29 (Transfers of Personal Data outside of Belize) | [future] | |
| Data Protection Act 2021, personal data breach notificationData Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62 | [future] | |
| Benin bj 1 instrument | ||
| Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnel, portant Code du Numérique en République du Bénin | 2018-04-20 | |
| Bermuda bm 5 instruments | ||
| Personal Information Protection Act 2016, Commissioner, enforcement and offencesPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 26-46, 48 (the Privacy Commissioner, orders, offences and penalties) | not recorded | |
| Personal Information Protection Act 2016, application and general principlesPersonal Information Protection Act 2016 (Bermuda), 2016:43, Parts 1-2 (application, exclusions and general principles) | not recorded | |
| Personal Information Protection Act 2016, breach of security notificationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security) | not recorded | |
| Personal Information Protection Act 2016, cross-border transfer of personal informationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 15 (transfer of personal information to an overseas third party) | not recorded | |
| Personal Information Protection Act 2016, rights of individualsPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals) | not recorded | |
| Bhutan bt 5 instruments | ||
| Cybersecurity Code of Practice for ICT/Telecommunications Service Providers, privacy and PII dutyCybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of Bhutan 2018, s.58), s.8.6 | 2024-10-10 | |
| Information, Communications and Media Act of Bhutan 2018, data protection and privacy dutiesInformation, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, offences and compensation for data failuresInformation, Communications and Media Act of Bhutan 2018, ss.387-388 | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, sensitive personal data and biometric informationInformation, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) | 2018-01-08 | |
| Information, Communications and Media Act of Bhutan 2018, user review and removal rightsInformation, Communications and Media Act of Bhutan 2018, ss.338(3), 340 | 2018-01-08 | |
| Bolivia bo 3 instruments | ||
| Anteproyecto de Ley de Protección de Datos Personales (AGETIC)Anteproyecto de Ley de Protección de Datos Personales | [proposed] | |
| Constitución Política del Estado, Acción de Protección de PrivacidadCPE, art. 130 (Acción de Protección de Privacidad), promulgada 7 de febrero de 2009 | 2009-02-07 | |
| Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos PersonalesLey No. 164, arts. 56 (Protección de Datos Personales), promulgada 8 de agosto de 2011 | 2011-08-08 | |
| Reglamento para el Desarrollo de TIC, Tratamiento de los Datos PersonalesDS No. 1793, Reglamento a la Ley No. 164, art. 56 (Tratamiento de los Datos Personales), 13 de noviembre de 2013 | 2013-11-13 | |
| Bosnia and Herzegovina ba 1 instrument | ||
| Law on the Protection of Personal Data of Bosnia and HerzegovinaLaw on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable 4 October 2025 | 2025-10-04 | |
| Botswana bw 1 instrument | ||
| Data Protection Act, 2024 (Act No. 18 of 2024)Data Protection Act, 2024 (Act No. 18 of 2024) | 2025-01-14 | |
| Brazil br 1 instrument | ||
| Lei Geral de Proteção de Dados Pessoais (LGPD)Lei nº 13.709, de 14 de agosto de 2018 (LGPD) | 2020-09-18 | |
| Brunei Darussalam bn 5 instruments | ||
| Personal Data Protection Order 2025, breach notificationPersonal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29) | 2026-01-01 | |
| Personal Data Protection Order 2025, comprehensive regimePersonal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8 | 2026-01-01 | |
| Personal Data Protection Order 2025, cross-border transferPersonal Data Protection Order, 2025 (S 1/2025), s.24 | 2026-01-01 | |
| Personal Data Protection Order 2025, data-subject rightsPersonal Data Protection Order, 2025 (S 1/2025), ss.18-20 | 2026-01-01 | |
| Personal Data Protection Order 2025, enforcement and penaltiesPersonal Data Protection Order, 2025 (S 1/2025), ss.37, 59 | 2026-01-01 | |
| Bulgaria bg 6 instruments | ||
| GDPR Article 9 and PDPA Employment and National-ID-Number RulesRegulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions | [future] | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| KZLD Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)Закон за защита на личните данни (ЗЗЛД), Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of 4 January 2002, as amended) | 2019-02-26 | |
| Burkina Faso bf 1 instrument | ||
| Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnelLoi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel | 2021-03-30 | |
| Burundi bi 1 instrument | ||
| Law No. 1/03 of March 10, 2026 on the Protection of Personal DataLoi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel | 2026-03-10 | |
| Cabo Verde cv 1 instrument | ||
| Law No. 133/V/2001 on the Protection of Personal DataLei n.º 133/V/2001, de 22 de Janeiro (Lei de Protecção de Dados Pessoais), Assembleia Nacional da República de Cabo Verde | not recorded | |
| Cambodia kh 0 instruments | ||
| Draft Law on Personal Data Protection, final draftDraft Law on Personal Data Protection (Final Draft, 23 June 2025), Ministry of Post and Telecommunications, Kingdom of Cambodia | [proposed] | |
| Cameroon cm 2 instruments | ||
| Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)Loi n°2010/012 du 21 décembre 2010, art. 74 | 2010-12-21 | |
| Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au CamerounLoi n°2024/017 du 23 décembre 2024 | [future] | |
| Canada ca 2 instruments | ||
| Bill C-36, Protecting Privacy and Consumer Data ActBill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session | [proposed] | |
| PIPEDA breach of security safeguards regimeS.C. 2000, c. 5, ss. 10.1-10.3 | 2018-11-01 | |
| Personal Information Protection and Electronic Documents Act (PIPEDA)S.C. 2000, c. 5, Part 1 | 2001-01-01 | |
| Cayman Islands ky 4 instruments | ||
| Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offencesData Protection Act (2021 Revision), ss. 52-57 (Ombudsman investigatory powers, monetary penalties and offences) | 2019-09-30 | |
| Data Protection Act 2021 Revision, application, principles and data subject rightsData Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights) | 2019-09-30 | |
| Data Protection Act 2021 Revision, cross-border transfer of personal dataData Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply) | 2019-09-30 | |
| Data Protection Act 2021 Revision, personal data breach notificationData Protection Act (2021 Revision), s. 16 (personal data breaches) | 2019-09-30 | |
| Central African Republic cf 1 instrument | ||
| Loi n° 24.001 portant protection des données à caractère personnelLoi n° 24.001 portant protection des données à caractère personnel (janvier 2024) | not recorded | |
| Chad td 6 instruments | ||
| Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)Loi n°007/PR/2015 du 10 février 2015, arts. 35-50 | 2015-02-10 | |
| Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICELoi n°007/PR/2015 du 10 février 2015, art. 61 | 2015-02-10 | |
| Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)Loi n°007/PR/2015 du 10 février 2015, arts. 1-15 | 2015-02-10 | |
| Loi n°007/PR/2015, sanctions administratives et pénales et recoursLoi n°007/PR/2015 du 10 février 2015, arts. 80-94 | 2015-02-10 | |
| Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)Loi n°007/PR/2015 du 10 février 2015, arts. 16-25 | 2015-02-10 | |
| Loi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMACLoi n°007/PR/2015 du 10 février 2015, arts. 29-32 | 2015-02-10 | |
| Chile cl 3 instruments | ||
| Ley 19.628, sobre Protección de la Vida PrivadaLey 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal) | 1999-08-28 | |
| Ley 21.719, Agencia de Protección de Datos Personales, SancionesLey 21.719, art. 35 (sanciones) y arts. 42-45 (procedimiento administrativo y judicial) | 2026-12-01[future] | |
| Ley 21.719, Regula la Protección y el Tratamiento de los Datos PersonalesLey 21.719, Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos) | 2026-12-01[future] | |
| China cn 8 instruments | ||
| Personal Information Protection Law of the PRC, General Processing Rules and Lawful BasesPIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, 20 August 2021; effective 1 November 2021 | 2021-11-01 | |
| Personal Information Protection Law, Cross-Border TransferPIPL Arts. 38-40 | 2021-11-01 | |
| Personal Information Protection Law, Data Breach NotificationPIPL Art. 57 | 2021-11-01 | |
| Personal Information Protection Law, Individual Rights and Automated Decision-MakingPIPL Arts. 24, 44-50, 55(2) | 2021-11-01 | |
| Personal Information Protection Law, Sensitive Personal InformationPIPL Arts. 28-32 | 2021-11-01 | |
| Personal Information Protection Law, Supervision and Legal LiabilityPIPL Arts. 60-71 | 2021-11-01 | |
| Provisions on Promoting and Regulating Cross-Border Data Flows促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective 22 March 2024 | 2024-03-22 | |
| Provisions on Security Management of Facial Recognition Technology Application人脸识别技术应用安全管理办法, issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed 13 March 2025, effective 1 June 2025 | 2025-06-01 | |
| Colombia co 2 instruments | ||
| Ley 1581 de 2012, General Personal Data ProtectionLey Estatutaria 1581 de 2012, arts. 1-30 (Proteccion de Datos Personales) | 2012-10-17 | |
| Superintendencia Circular on AI and Personal DataSIC Circular Externa 002 de 2024 (Lineamientos sobre Tratamiento de Datos Personales en Sistemas de Inteligencia Artificial), 21 de agosto de 2024 | 2024-08-21 | |
| Comoros km 1 instrument | ||
| Law on the Protection of Personal DataLoi n° 14-029/AU portant protection des données à caractère personnel, deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on 26 June 2014 | not recorded | |
| Costa Rica cr 2 instruments | ||
| Codigo Penal, articulo 196 bis, Violacion de datos personalesCodigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048 | not recorded | |
| Proteccion de la Persona frente al Tratamiento de sus Datos PersonalesLey No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales | not recorded | |
| Croatia hr 6 instruments | ||
| AZOP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Act on the Implementation of the General Data Protection RegulationZakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18 | 2018-05-25 | |
| Croatian Act Articles 21-23, Biometric Data by SectorZakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23 | 2018-05-25 | |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Cuba cu 2 instruments | ||
| Ley 149/2022, De Protección de Datos Personales, general regimeLey 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022) | 2023-02-21 | |
| Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic formResolución 58/2022, Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022) | 2023-02-21 | |
| Cyprus cy 6 instruments | ||
| GDPR Article 22 and Law 125(I)/2018, Automated Decisions in CyprusRegulation (EU) 2016/679, Art. 22; Law 125(I)/2018 | 2018-07-31 | |
| GDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in CyprusRegulation (EU) 2016/679, Art. 9; Law 125(I)/2018 | 2018-07-31 | |
| GDPR Articles 33-34, Breach Notification in CyprusRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and ODPC Enforcement in CyprusRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from CyprusRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Law 125(I)/2018, Cyprus GDPR SupplementLaw 125(I)/2018 of 2018 | 2018-07-31 | |
| Czechia cz 6 instruments | ||
| Act on Personal Data ProcessingZakon c. 110/2019 Sb., o zpracovani osobnich udaju | 2019-04-24 | |
| GDPR Article 9, Special Categories Including Biometric DataRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| UOOU Enforcement, GDPR Article 82, and the Act on Collective Civil Court ProceedingRegulation (EU) 2016/679, Arts. 82-83; Zakon c. 179/2024 Sb., o hromadnem obcanskem soudnim rizeni; Zakon c. 180/2024 Sb. | 2024-07-01 | |
| Côte d'Ivoire ci 1 instrument | ||
| Law No. 2013-450 on the Protection of Personal DataLoi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel | not recorded | |
| Democratic Republic of the Congo cd 1 instrument | ||
| Digital Code, Title III: Personal Data ProtectionCode du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 267) | 2023-03-13 | |
| Denmark dk 6 instruments | ||
| Danish Data Protection Act (Databeskyttelsesloven)Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of 8 March 2024 | 2018-05-25 | |
| GDPR Article 22 and Data Subject Rights as Applied in DenmarkRegulation (EU) 2016/679, Arts. 12-23; Databeskyttelsesloven | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in DenmarkRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in DenmarkRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and Datatilsynet Enforcement in DenmarkRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from DenmarkRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Djibouti dj 1 instrument | ||
| Digital Code, Book I: Personal Data Protection and CNDPLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier (Arts. 2 à 156) | 2025-09-18 | |
| Dominican Republic do 1 instrument | ||
| Ley No. 172-13 sobre Protección Integral de los Datos PersonalesLey No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013 | 2013-12-15 | |
| Ecuador ec 2 instruments | ||
| LOPDP, comprehensive personal-data protection regimeLey Orgánica de Protección de Datos Personales (LOPDP), Quinto Suplemento del Registro Oficial No. 459, 26 de mayo de 2021 | 2021-05-26 | |
| SPDP Norma General guaranteeing personal-data protection in the use of AI systemsResolución No. SPDP-SPD-2026-0009-R, Superintendencia de Protección de Datos Personales, 12 de febrero de 2026 | [future] | |
| Egypt eg 1 instrument | ||
| Law No. 151 of 2020 Promulgating the Personal Data Protection LawLaw No. 151 of 2020 Promulgating the Personal Data Protection Law | 2020-10-16 | |
| El Salvador sv 1 instrument | ||
| Ley para la Protección de Datos PersonalesDecreto Legislativo No. 144, 12 de noviembre de 2024 | 2024-11-23 | |
| Equatorial Guinea gq 1 instrument | ||
| Ley de Protección de Datos PersonalesLey Núm. 1/2016, de 22 de julio, de Protección de Datos Personales | not recorded | |
| Eritrea er 2 instruments | ||
| Civil Code of the State of Eritrea, Personality Rights (Image and Correspondence)Civil Code of the State of Eritrea (2015), arts. 26-30 (Image and Privacy; Inviolability of Correspondence) | [future] | |
| Penal Code of the State of Eritrea, Violation of PrivacyPenal Code of the State of Eritrea (2015), art. 298 (Violation of Privacy) | [future] | |
| Estonia ee 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in EstoniaRegulation (EU) 2016/679, Arts. 15-22; Isikuandmete kaitse seadus | 2019-01-15 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in EstoniaRegulation (EU) 2016/679, Art. 9 | 2019-01-15 | |
| GDPR Articles 33-34, Breach Notification in EstoniaRegulation (EU) 2016/679, Arts. 33-34 | 2019-01-15 | |
| GDPR Articles 82-83 and AKI Enforcement in EstoniaRegulation (EU) 2016/679, Arts. 82-83 | 2019-01-15 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from EstoniaRegulation (EU) 2016/679, Arts. 44-50 | 2019-01-15 | |
| Personal Data Protection Act (Isikuandmete kaitse seadus)Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted 12 December 2018 | 2019-01-15 | |
| Eswatini sz 1 instrument | ||
| Data Protection Act, 2022 (Act No. 5 of 2022)Data Protection Act, 2022 (Act No. 5 of 2022) | 2022-03-04 | |
| Ethiopia et 1 instrument | ||
| Personal Data Protection ProclamationProclamation No. 1321/2024 (Federal Negarit Gazette) | 2024-07-24 | |
| Finland fi 6 instruments | ||
| Data Protection Act (Tietosuojalaki)Tietosuojalaki 1050/2018 (amendments up to 29/2024 included) | 2019-01-01 | |
| GDPR Article 22 and Data Protection Act Sections 33-34, Data Subject Rights in FinlandRegulation (EU) 2016/679, Arts. 15-22; Tietosuojalaki 1050/2018 secs. 21, 33-34 | 2019-01-01 | |
| GDPR Article 9 and Data Protection Act Section 6, Special Categories in FinlandRegulation (EU) 2016/679, Art. 9; Tietosuojalaki 1050/2018 sec. 6 | 2019-01-01 | |
| GDPR Articles 33-34, Breach Notification in FinlandRegulation (EU) 2016/679, Arts. 33-34 | 2019-01-01 | |
| GDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in FinlandRegulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24 | 2019-01-01 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from FinlandRegulation (EU) 2016/679, Arts. 44-50; Tietosuojalaki 1050/2018 sec. 27 | 2019-01-01 | |
| France fr 8 instruments | ||
| CNIL Enforcement, GDPR Article 83 and Code Penal Articles 226-16 to 226-22-2Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 | 2018-05-25 | |
| CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique | 2019-01-10 | |
| GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| Loi 78-17 Article 47, Automated Administrative DecisionsLoi n. 78-17 du 6 janvier 1978, Art. 47 | 1978-01-06 | |
| Loi Informatique et Libertes, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)Loi n. 78-17 du 6 janvier 1978 relative a l'informatique, aux fichiers et aux libertes, as amended (JORFTEXT000000886460) | 2018-05-25 | |
| Gabon ga 1 instrument | ||
| Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023 | 2023-07-15 | |
| Georgia ge 7 instruments | ||
| Law on Personal Data Protection, biometric data articleLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d) | 2024-03-01 | |
| Law on Personal Data Protection, breach notificationLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 (17 December 2025) | 2024-03-01 | |
| Law on Personal Data Protection, comprehensive regime and lawful basisLaw of Georgia on Personal Data Protection, Law No. 3144-XI, adopted 14 June 2023, Arts. 1-5, 7-8 | 2024-03-01 | |
| Law on Personal Data Protection, cross-border transferLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 37-38, as amended by Law No. 1289 (17 December 2025) | 2024-03-01 | |
| Law on Personal Data Protection, data subject rightsLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 10-23) | 2024-03-01 | |
| Law on Personal Data Protection, enforcement and penaltiesLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79 | 2024-03-01 | |
| Law on Personal Data Protection, special categories of dataLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 6 | 2024-03-01 | |
| Germany de 6 instruments | ||
| Bundesdatenschutzgesetz (BDSG), Federal Data Protection ActBundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended | 2018-05-25 | |
| GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in GermanyRegulation (EU) 2016/679, Art. 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 | 2018-05-25 | |
| GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehorden Enforcement in GermanyRegulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43 | 2018-05-25 | |
| GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in GermanyRegulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3) | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in GermanyRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GermanyRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Ghana gh 1 instrument | ||
| Data Protection ActData Protection Act, 2012 (Act 843) | not recorded | |
| Greece gr 6 instruments | ||
| GDPR Article 22 and Law 4624/2019 Article 27, Data Subject Rights and Employment in GreeceRegulation (EU) 2016/679, Arts. 12-23; Law 4624/2019, Art. 27 | 2019-08-29 | |
| GDPR Article 9 and Law 4624/2019, Special Categories in GreeceRegulation (EU) 2016/679, Art. 9; Law 4624/2019 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in GreeceRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and HDPA Enforcement in GreeceRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from GreeceRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Law 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)Law 4624/2019, FEK A' 137/29-08-2019 | 2019-08-29 | |
| Grenada gd 1 instrument | ||
| Data Protection Act, No. 1 of 2023Data Protection Act, No. 1 of 2023 | [future] | |
| Guatemala gt 2 instruments | ||
| Constitución Política de la República de Guatemala, Art. 31 (habeas data)Const. Pol. de la República de Guatemala, art. 31 (acceso a archivos y registros estatales) | 1986-01-14 | |
| Iniciativa de Ley 6105, Ley de Protección de DatosIniciativa de Ley 6105, Ley de Protección de Datos | [proposed] | |
| Ley de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67 | not recorded | |
| Guinea gn 1 instrument | ||
| Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif à la protection des données à caractère personnelLoi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel | not recorded | |
| Guyana gy 1 instrument | ||
| Data Protection Act 2023Data Protection Act 2023 (Act No. 18 of 2023) | [future] | |
| Honduras hn 3 instruments | ||
| Constitución de la República de Honduras, garantía de Hábeas DataConstitución de la República de Honduras (1982, reformada), art. 182 (Hábeas Data) | 2013-03-27 | |
| Código Penal, acceso no autorizado a datos personales (descubrimiento y revelación de secretos)Decreto No. 130-2017, Código Penal, art. 272 (Descubrimiento y Revelación de Secretos) | 2019-11-10 | |
| Ley de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas dataDecreto No. 170-2006, Ley de Transparencia y Acceso a la Información Pública, arts. 3(7), 23-29 (Datos Personales y Hábeas Data) | 2013-03-27 | |
| Hungary hu 6 instruments | ||
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Infotorveny (Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information)2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol | 2012-01-01 | |
| Infotorveny Definitions, Biometric and Special-Category Data2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat") | 2018-05-25 | |
| Infotorveny Sections 25/J-25/K, Breach Notification, Inserted by Act XXXVIII of 20182011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section | 2019-04-26 | |
| NAIH Enforcement, GDPR Article 82, and Infotorveny Section 24 SerelemdijRegulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section | 2012-01-01 | |
| Iceland is 6 instruments | ||
| Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from IcelandLog nr. 90/2018, Art. 16 | 2018-07-15 | |
| Act No. 90/2018 Articles 3(14) and 9, Special Categories in IcelandLog nr. 90/2018, Art. 3(14), Art. 9 | 2018-07-15 | |
| Act No. 90/2018 on Data Protection and the Processing of Personal DataLog nr. 90/2018 um personuvernd og vinnslu personuupplysinga (Act No. 90/2018), passed by Althingi 27 June 2018, in force 15 July 2018 | 2018-07-15 | |
| Act No. 90/2018, Breach Notification in IcelandLog nr. 90/2018 (breach notification provisions) | 2018-07-15 | |
| Act No. 90/2018, Data Subject Rights in IcelandLog nr. 90/2018 (data subject rights provisions) | 2018-07-15 | |
| Act No. 90/2018, Persoonuvernd Enforcement in IcelandLog nr. 90/2018 (enforcement provisions) | 2018-07-15 | |
| India in 6 instruments | ||
| Digital Personal Data Protection Act, 2023, Data Protection Board and penaltiesDigital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 | 2025-11-13 | |
| Digital Personal Data Protection Act, 2023, breach notification dutiesDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6) | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basisDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8 | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, cross-border transfer restrictionsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16 | 2027-05-13[future] | |
| Digital Personal Data Protection Act, 2023, data subject rightsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14 | 2027-05-13[future] | |
| Digital Personal Data Protection Rules, 2025G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified 13 November 2025 | 2025-11-13 | |
| Indonesia id 5 instruments | ||
| Law on Personal Data Protection, biometric data definitionLaw No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation | 2022-10-17 | |
| Law on Personal Data Protection, breach notificationLaw No. 27 of 2022 on Personal Data Protection, Article 46 | 2022-10-17 | |
| Law on Personal Data Protection, comprehensive regimeLaw No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated 17 October 2022 | 2022-10-17 | |
| Law on Personal Data Protection, cross-border transferLaw No. 27 of 2022 on Personal Data Protection, Article 56 | 2022-10-17 | |
| Law on Personal Data Protection, enforcement and private right to sueLaw No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 | 2022-10-17 | |
| Iran ir 1 instrument | ||
| Electronic Commerce Law (2003), Personal Data ChapterElectronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter) | 2004-01-01 | |
| Ireland ie 7 instruments | ||
| DPC Guidance: AI, Large Language Models and Data ProtectionData Protection Commission, "AI, Large Language Models and Data Protection" guidance (18 July 2024) | 2024-07-18 | |
| Data Protection Act 2018Data Protection Act 2018 (No. 7 of 2018) | 2018-05-25 | |
| GDPR Article 22, Automated Decision-Making in IrelandRegulation (EU) 2016/679, Art. 22, as transposed by the Data Protection Act 2018 | 2018-05-25 | |
| GDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in IrelandRegulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117 | 2018-05-25 | |
| GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in IrelandRegulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in IrelandRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from IrelandRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Israel il 6 instruments | ||
| Privacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transferPrivacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 | [future] | |
| Protection of Privacy Law, biometric identifier definition and security-level tieringProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions | 2025-08-14 | |
| Protection of Privacy Law, breach notification dutyPrivacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21) | 2018-05-08 | |
| Protection of Privacy Law, comprehensive regime and database registrationProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A | 2025-08-14 | |
| Protection of Privacy Law, data subject rightsProtection of Privacy Law, 5741-1981, Arts. 13, 13A, 14 | [future] | |
| Protection of Privacy Law, enforcement, DPO duty and private rights of actionProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Arts. 15A, 17B1-17B3, 29A, 31B, Chapters D3-D4 | 2025-08-14 | |
| Italy it 7 instruments | ||
| Codice Privacy (Personal Data Protection Code), as Amended for GDPR AlignmentDecreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101 | 2018-09-19 | |
| GDPR Article 22 and the Garante's OpenAI/ChatGPT EnforcementRegulation (EU) 2016/679, Art. 22; Garante Provvedimento 30 marzo 2023 | 2018-05-25 | |
| GDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis)Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) | 2018-05-25 | |
| GDPR Article 9 Special Categories and Codice Privacy Article 167(2)Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| Garante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data PrescriptionsGarante Provvedimento n. 146 del 5 giugno 2019 | 2019-06-05 | |
| Jamaica jm 1 instrument | ||
| Data Protection Act, 2020, comprehensive data-protection regime and automated decision-takingData Protection Act, 2020 (Act 7 of 2020) | not recorded | |
| Japan jp 5 instruments | ||
| Act on the Protection of Personal Information, breach notificationAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26 | 2022-04-01 | |
| Act on the Protection of Personal Information, comprehensive regime and lawful basisAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 15, 20, 25 | 2022-04-01 | |
| Act on the Protection of Personal Information, cross-border transferAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28 | 2022-04-01 | |
| Act on the Protection of Personal Information, enforcementAct No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII | 2022-04-01 | |
| Act on the Protection of Personal Information, individual identification code and biometric provisionsAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 | 2022-04-01 | |
| Jordan jo 6 instruments | ||
| Personal Data Protection Law, breach notificationLaw No. 24 of 2023, Art. 20 | 2024-03-17 | |
| Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 24 of 2023, Arts. 1-2, 11 | 2024-03-17 | |
| Personal Data Protection Law, cross-border transferLaw No. 24 of 2023, Art. 14 | 2024-03-17 | |
| Personal Data Protection Law, data subject rightsLaw No. 24 of 2023, data subject rights list | 2024-03-17 | |
| Personal Data Protection Law, enforcement and data subject remediesLaw No. 24 of 2023, Arts. 21-22 | 2024-03-17 | |
| Personal Data Protection Law, sensitive personal data and biometric dataLaw No. 24 of 2023, Art. 2 definitions | 2024-03-17 | |
| Kazakhstan kz 6 instruments | ||
| Code of Administrative Offences, personal data violationsCode of the Republic of Kazakhstan on Administrative Offences No. 235-V (2014), Art. 79 | 2015-01-01 | |
| Law on Personal Data and Their Protection, biometric data provisionsLaw No. 94-V (21 May 2013), Arts. 7(12), 11(3), 12(2) | 2013-11-25 | |
| Law on Personal Data and Their Protection, breach notificationLaw No. 94-V (21 May 2013), Art. 25(2) | 2013-11-25 | |
| Law on Personal Data and Their Protection, comprehensive regime and lawful basesLaw No. 94-V (21 May 2013), as amended through Law No. 256-VIII (09.01.2026), Arts. 1, 4-9 | 2013-11-25 | |
| Law on Personal Data and Their Protection, data subject rightsLaw No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1 | 2013-11-25 | |
| Law on Personal Data and Their Protection, localization and cross-border transferLaw No. 94-V (21 May 2013), Arts. 12(2), 16 | 2013-11-25 | |
| Kenya ke 7 instruments | ||
| Data Protection (General) Regulations, 2021Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50 | 2022-01-14 | |
| Data Protection Act, 2019Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) | 2019-11-25 | |
| Data Protection Act, 2019, enforcement, penalties and compensationData Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74) | 2019-11-25 | |
| Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach) | 2019-11-25 | |
| Data Protection Act, 2019, rights of data subjects and automated decision-makingData Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-38 (rights of data subjects, including automated individual decision-making, s. 35) | 2019-11-25 | |
| Data Protection Act, 2019, sensitive personal dataData Protection Act, 2019 (No. 24 of 2019), Part V (ss. 44-47) | 2019-11-25 | |
| Data Protection Act, 2019, transfer of personal data outside KenyaData Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54) | 2019-11-25 | |
| Kiribati ki 1 instrument | ||
| Data Protection Act 2025Data Protection Act 2025 | [future] | |
| Kosovo xk 1 instrument | ||
| Law No. 06/L-082 on Protection of Personal DataLaw No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale) | 2019-02-25 | |
| Kuwait kw 1 instrument | ||
| CITRA Data Privacy Protection RegulationCITRA Decision No. 26 of 2024 (amending or superseding Decision No. 42 of 2021) | [future] | |
| Kyrgyzstan kg 4 instruments | ||
| Digital Code, comprehensive personal data regimeDigital Code, Law No. 178 (18 June 2025), in force 6 February 2026, Chapter 11, Arts. 78, 88 | 2026-02-06 | |
| Digital Code, cross-border transfer of personal dataDigital Code, Law No. 178, Art. 89 | 2026-02-06 | |
| Digital Code, sectoral regulator for personal dataDigital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data) | 2026-02-06 | |
| Digital Code, special categories of personal dataDigital Code, Law No. 178, Art. 80 | 2026-02-06 | |
| Latvia lv 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in LatviaRegulation (EU) 2016/679, Arts. 15-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LatviaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and DVI Enforcement in LatviaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LatviaRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Personal Data Processing Law (Fizisko personu datu apstrades likums)Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force 5 July 2018 | 2018-07-05 | |
| Personal Data Processing Law Article 25(2), Special Categories in LatviaFizisko personu datu apstrades likums, Art. 25(2); Regulation (EU) 2016/679, Art. 9 | 2018-07-05 | |
| Lebanon lb 1 instrument | ||
| Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)Law No. 81, Official Gazette of Lebanon, promulgated 10 October 2018 (in force 31 March 2019), Arts. 85-106 (Part V, Personal Data Protection) | 2019-03-31 | |
| Lesotho ls 1 instrument | ||
| Data Protection Act, 2011 (Act No. 5 of 2012)Data Protection Act, 2011 (Act No. 5 of 2012) | 2012-02-22 | |
| Liberia lr 2 instruments | ||
| Data Protection Act of LiberiaAn Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia) | [future] | |
| Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)Telecommunications Act of 2007, §§ 51-52 (Protection of Personal Information) | not recorded | |
| Libya ly 1 instrument | ||
| Law No. 6 of 2022, protection of personal data collected in electronic transactionsLaw No. 6 of 2022 Concerning Electronic Transactions, arts. 73-79 (Protection of Personal Data) | 2022-10-04 | |
| Liechtenstein li 6 instruments | ||
| DSG Automated-Decision Rights in LiechtensteinDSG, LGBl. 2018 Nr. 272, automated decision provisions | 2019-01-01 | |
| DSG Breach Notification in LiechtensteinDSG, LGBl. 2018 Nr. 272, breach notification provisions | 2019-01-01 | |
| DSG Cross-Border Transfer Chapter and EEA Joint Committee Decision No. 154/2018Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272; EEA Joint Committee Decision No. 154/2018 | 2019-01-01 | |
| DSG Datenschutzstelle Enforcement in LiechtensteinDSG, LGBl. 2018 Nr. 272, enforcement provisions | 2019-01-01 | |
| DSG Special-Category Data and Datenschutzstelle Biometric-Data Concept in LiechtensteinDSG, LGBl. 2018 Nr. 272, special categories provisions | 2019-01-01 | |
| Datenschutzgesetz (DSG)Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, dated 4 October 2018, in effect 1 January 2019 | 2019-01-01 | |
| Lithuania lt 6 instruments | ||
| GDPR Article 22 and Data Subject Rights as Applied in LithuaniaRegulation (EU) 2016/679, Arts. 15-22 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in LithuaniaRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LithuaniaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and VDAI Enforcement in LithuaniaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V and VDAI Article 46(3) Authorization, Cross-Border Transfer from LithuaniaRegulation (EU) 2016/679, Arts. 44-50 | 2018-05-25 | |
| Law on Legal Protection of Personal DataRepublic of Lithuania Law No. XIII-1426, in force 16 July 2018 (as amended) | 2018-07-16 | |
| Luxembourg lu 6 instruments | ||
| Act of 1 August 2018 on the Organisation of the CNPD and the General Data Protection FrameworkLoi du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees et du regime general sur la protection des donnees | 2018-08-20 | |
| GDPR Article 22, Automated Decisions as Applied in LuxembourgRegulation (EU) 2016/679, Art. 22 | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in LuxembourgRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in LuxembourgRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and CNPD Enforcement in LuxembourgRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from LuxembourgRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Madagascar mg 1 instrument | ||
| Law No. 2014-038, protection of personal dataLoi n° 2014-038 sur la protection des données à caractère personnel | 2015-01-09 | |
| Malawi mw 2 instruments | ||
| Data Protection Act, 2024Data Protection Act, 2024 | [future] | |
| Electronic Transactions and Cyber Security Act, 2016, data protection and privacy (Part VII)Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71-74) | 2017-06-01 | |
| Malaysia my 6 instruments | ||
| Personal Data Protection Act, biometric data definition and sensitive categoryAct 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force 2025-04-01 | 2025-04-01 | |
| Personal Data Protection Act, comprehensive regime and lawful basesAct 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727 | 2013-11-15 | |
| Personal Data Protection Act, cross-border transferAct 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force 2025-04-01 | 2025-04-01 | |
| Personal Data Protection Act, data portabilityAct 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force 2025-06-01 | 2025-06-01 | |
| Personal Data Protection Act, data protection officer and breach notificationAct 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force 2025-06-01 | 2025-06-01 | |
| Personal Data Protection Act, enforcementAct 709 (Malaysia) ss.5(2), 12B(3) | 2013-11-15 | |
| Maldives mv 0 instruments | ||
| Personal Data Protection Bill, pending before the People's MajlisPersonal Data Protection Bill, submitted to the People's Majlis, first reported 11 May 2026 | [proposed] | |
| Mali ml 1 instrument | ||
| Loi n° 2013-015, protection des données à caractère personnelLoi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali, telle que modifiée | 2013-06-28 | |
| Malta mt 6 instruments | ||
| Data Protection Act, Chapter 586 of the Laws of MaltaData Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Article 22 and Cap. 586, Automated Decisions in MaltaRegulation (EU) 2016/679, Art. 22; Data Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in MaltaRegulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in MaltaRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Articles 82-83 and IDPC Enforcement in MaltaRegulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from MaltaRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Marshall Islands mh 2 instruments | ||
| Criminal Code 2011, Violation of Privacy (unlawful eavesdropping, surveillance, and breach of privacy of messages)Criminal Code 2011, 31 MIRC Ch. 1, sec. 250.12 | 2011-10-17 | |
| Personal Data Protection Act 2025, government personal-data protection regimePersonal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43) | 2025-10-07 | |
| Mauritania mr 1 instrument | ||
| Loi n° 2017-020, protection des données à caractère personnelLoi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel | 2017-07-22 | |
| Mauritius mu 6 instruments | ||
| Data Protection Act 2017, enforcement, offences and penaltiesData Protection Act 2017 (Act No. 20 of 2017), ss. 9, 42-43, 51-54 (enforcement, offences and penalties) | 2018-01-15 | |
| Data Protection Act 2017, establishment and lawful processingData Protection Act 2017 (Act No. 20 of 2017), ss. 1-28, 30 (establishment, principles, lawful processing, and personal data of a child) | 2018-01-15 | |
| Data Protection Act 2017, personal data breach notificationData Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach) | 2018-01-15 | |
| Data Protection Act 2017, rights of data subjectsData Protection Act 2017 (Act No. 20 of 2017), ss. 37-41 (rights of data subjects, including automated individual decision making, s. 38) | 2018-01-15 | |
| Data Protection Act 2017, special categories of personal dataData Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data) | 2018-01-15 | |
| Data Protection Act 2017, transfer of personal data outside MauritiusData Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius) | 2018-01-15 | |
| Mexico mx 1 instrument | ||
| Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025 | 2025-03-21 | |
| Moldova md 1 instrument | ||
| Law No. 195/2024 on Personal Data ProtectionLegea Nr. 195 din 25 iulie 2024 privind protectia datelor cu caracter personal, effective 23 August 2026 (Law No. 195 of 25 July 2024) | 2026-08-23 | |
| Monaco mc 1 instrument | ||
| Loi sur la Protection des Donnees PersonnellesLoi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725 | 2024-12-13 | |
| Mongolia mn 7 instruments | ||
| Law on Protection of Personal Data, biometric information definition and legacy fingerprint destructionLaw on Protection of Personal Data (17 December 2021), Art. 4.1.1; Art. 31 | 2022-05-01 | |
| Law on Protection of Personal Data, breach notificationLaw on Protection of Personal Data (17 December 2021), Art. 25.1.3; Art. 10.5 | 2022-05-01 | |
| Law on Protection of Personal Data, comprehensive regimeLaw on Protection of Personal Data (17 December 2021), in force 1 May 2022, Arts. 1-4 | 2022-05-01 | |
| Law on Protection of Personal Data, cross-border transferLaw on Protection of Personal Data (17 December 2021), Art. 14 | 2022-05-01 | |
| Law on Protection of Personal Data, data subject rightsLaw on Protection of Personal Data (17 December 2021), Art. 16; Art. 15 | 2022-05-01 | |
| Law on Protection of Personal Data, enforcementLaw on Protection of Personal Data (17 December 2021), Arts. 24-26, 28, 30 | 2022-05-01 | |
| Law on Protection of Personal Data, sensitive personal informationLaw on Protection of Personal Data (17 December 2021), Arts. 4.1.12, 9 | 2022-05-01 | |
| Montenegro me 1 instrument | ||
| Law on Personal Data ProtectionOfficial Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended | [future] | |
| Morocco ma 1 instrument | ||
| Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataLoi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009) | not recorded | |
| Mozambique mz 1 instrument | ||
| Electronic Transactions Law, Protection of Personal Electronic DataLei n.º 3/2017, de 9 de Janeiro, arts. 63 a 65 (Transacções Electrónicas) | not recorded | |
| Myanmar mm 1 instrument | ||
| Cybersecurity Law, digital platform data retention and disclosure dutyCybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34 | [future] | |
| Nauru nr 1 instrument | ||
| Communications and Broadcasting Act 2018, confidentiality of subscriber information and communicationsCommunications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70 | 2018-05-10 | |
| Nepal np 4 instruments | ||
| Privacy Act, 2075, correction rightPrivacy Act, 2075 (2018), Act Number 14 of 2075, s.28 | 2018-09-18 | |
| Privacy Act, 2075, enforcement and compensationPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32 | 2018-09-18 | |
| Privacy Act, 2075, general privacy and collection regimePrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1) | 2018-09-18 | |
| Privacy Act, 2075, sensitive information and biometric dataPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27 | 2018-09-18 | |
| Netherlands nl 7 instruments | ||
| AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action RegimeRegulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) | 2018-05-25 | |
| GDPR Articles 33-34 and UAVG Article 42, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| GDPR and UAVG Articles 40-43, Data-Subject Rights and Journalistic ExceptionRegulation (EU) 2016/679, Arts. 12-23; UAVG, Arts. 40, 41, 43 | 2018-05-25 | |
| UAVG Article 29, Biometric-Data Exception for Authentication or SecurityUAVG, Art. 29 | 2018-05-25 | |
| UAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number DataUAVG, Arts. 30-33, 46 | 2018-05-25 | |
| Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), GDPR Implementation ActWet van 16 mei 2018, houdende regels ter uitvoering van de Algemene verordening gegevensbescherming (BWBR0040940) | 2018-05-25 | |
| New Zealand nz 5 instruments | ||
| Privacy Act 2020, Compliance Notices and OffencesPrivacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212 | 2020-12-01 | |
| Privacy Act 2020, Information Privacy Principle 12 (Disclosure Outside New Zealand)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12) | 2020-12-01 | |
| Privacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 3A), inserted by the Privacy Amendment Act 2025 (NZ), No 53, s. 4 | 2026-05-01 | |
| Privacy Act 2020, Information Privacy Principles and Extraterritorial ReachPrivacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13) | 2020-12-01 | |
| Privacy Act 2020, Notifiable Privacy BreachesPrivacy Act 2020 (NZ), No 31, ss. 112-118 | 2020-12-01 | |
| Nicaragua ni 1 instrument | ||
| Ley No. 787, Ley de Proteccion de Datos PersonalesLey No. 787, 29-Mar-2012; Gaceta Oficial No. 61 | 2012-03-29 | |
| Niger ne 1 instrument | ||
| Loi n° 2022-59, protection des données à caractère personnelLoi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024 | not recorded | |
| Nigeria ng 1 instrument | ||
| Nigeria Data Protection Act, 2023 (NDPA), general data protection dutiesNigeria Data Protection Act, 2023 (No. 37 of 2023) | 2023-06-12 | |
| North Macedonia mk 1 instrument | ||
| Law on Personal Data Protection (LPDP)Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020, fully applicable 24 August 2021 | 2021-08-24 | |
| Norway no 6 instruments | ||
| Personal Data Act (personopplysningsloven)Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38, in force 20 July 2018 | 2018-07-20 | |
| Personal Data Act Chapter 3 and GDPR Article 9, Special Categories in Norwaypersonopplysningsloven, special categories chapter (Chapter 3) | 2018-07-20 | |
| Personal Data Act Chapter 7, Datatilsynet Enforcement in Norwaypersonopplysningsloven, enforcement chapter (Chapter 7) | 2018-07-20 | |
| Personal Data Act and GDPR Chapter V, Cross-Border Transfer from Norwaypersonopplysningsloven LOV-2018-06-15-38, transfer provisions | 2018-07-20 | |
| Personal Data Act, Breach Notification in Norwaypersonopplysningsloven LOV-2018-06-15-38, breach notification provisions | 2018-07-20 | |
| Personal Data Act, Data Subject Rights in Norwaypersonopplysningsloven LOV-2018-06-15-38, data subject rights provisions | 2018-07-20 | |
| Oman om 6 instruments | ||
| Personal Data Protection Law, biometric and sensitive data prior permitRoyal Decree No. 6/2022, Arts. 1, 5 | 2023-02-13 | |
| Personal Data Protection Law, breach notificationRoyal Decree No. 6/2022, breach notification provision | 2023-02-13 | |
| Personal Data Protection Law, comprehensive regime and scopeRoyal Decree No. 6/2022, Arts. 3-4, 7 | 2023-02-13 | |
| Personal Data Protection Law, cross-border transferRoyal Decree No. 6/2022, Art. 23 | 2023-02-13 | |
| Personal Data Protection Law, data subject rightsRoyal Decree No. 6/2022, Art. 11 | 2023-02-13 | |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. 6/2022, Art. 8, penalties provisions | 2023-02-13 | |
| Panama pa 1 instrument | ||
| Ley 81 de 2019, Sobre Protección de Datos PersonalesLey No. 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A | 2021-03-29 | |
| Paraguay py 2 instruments | ||
| Ley N° 6534/2020, de Protección de Datos Personales CrediticiosLey N° 6534, del año 2020, de Protección de Datos Personales Crediticios | 2020-10-27 | |
| Ley N° 7593/2025, de Protección de Datos Personales en la República del ParaguayLey N° 7593/2025, de Protección de Datos Personales en la República del Paraguay | 2027-11-27[future] | |
| Peru pe 1 instrument | ||
| Ley 29733, Ley de Protección de Datos PersonalesLey No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017) | 2011-07-03 | |
| Philippines ph 5 instruments | ||
| Data Privacy Act of 2012, breach notificationRepublic Act No. 10173 (2012), Section 20(f) | 2012-08-15 | |
| Data Privacy Act of 2012, comprehensive regime and lawful processing criteriaRepublic Act No. 10173 (2012), Sections 3, 12, 13 | 2012-08-15 | |
| Data Privacy Act of 2012, cross-border transfer accountabilityRepublic Act No. 10173 (2012), Section 21 | 2012-08-15 | |
| Data Privacy Act of 2012, data subject rightsRepublic Act No. 10173 (2012), Sections 16-18 | 2012-08-15 | |
| Data Privacy Act of 2012, enforcement and restitutionRepublic Act No. 10173 (2012), Sections 25-37 | 2012-08-15 | |
| Poland pl 6 instruments | ||
| Act on the Protection of Personal Data of 10 May 2018Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000 | 2018-05-25 | |
| GDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric DataRegulation (EU) 2016/679, Art. 9(1); Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b) | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| GDPR Data-Subject Rights, Act Articles 92-97Regulation (EU) 2016/679, Arts. 12-23; Ustawa z 10 maja 2018 r., Arts. 92-97 | 2018-05-25 | |
| UODO Enforcement, GDPR Article 82, and Act Articles 98, 101-108Regulation (EU) 2016/679, Art. 83; Ustawa z 10 maja 2018 r., Arts. 98, 101-108 | 2018-05-25 | |
| Portugal pt 6 instruments | ||
| CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in PortugalCNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Article 22 and Lei 58/2019, Automated Decisions in PortugalRegulation (EU) 2016/679, Art. 22; Lei n.o 58/2019, de 8 de agosto | 2018-05-25 | |
| GDPR Article 9, Special Categories of Personal Data as Applied in PortugalRegulation (EU) 2016/679, Art. 9 | 2018-05-25 | |
| GDPR Articles 33-34, Breach Notification in PortugalRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer of Personal Data from PortugalRegulation (EU) 2016/679, Arts. 44-49 | 2018-05-25 | |
| Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execucao do RGPD)Lei n.o 58/2019, de 8 de agosto | 2019-08-08 | |
| Qatar qa 5 instruments | ||
| Personal Data Privacy Protection Law, breach notificationLaw No. 13 of 2016, Arts. 13-14 | 2017-01-01 | |
| Personal Data Privacy Protection Law, comprehensive regimeLaw No. 13 of 2016, Chapter One | 2017-01-01 | |
| Personal Data Privacy Protection Law, cross-border data flowLaw No. 13 of 2016, Art. 15 | 2017-01-01 | |
| Personal Data Privacy Protection Law, enforcement and penaltiesLaw No. 13 of 2016, Arts. 23-26 | 2017-01-01 | |
| Personal Data Privacy Protection Law, special-nature personal dataLaw No. 13 of 2016, Art. 16 | 2017-01-01 | |
| Republic of the Congo cg 1 instrument | ||
| Law No. 29-2019 on the Protection of Personal DataLoi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel, Journal Officiel n° 45-2019 du jeudi 7 novembre 2019 | not recorded | |
| Romania ro 6 instruments | ||
| ANSPDCP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP RulesRegulation (EU) 2016/679, Art. 9; Legea nr. 190/2018, automated decision-making and national identification number provisions | [future] | |
| GDPR Articles 12-22, Data-Subject Rights and Electronic Employee MonitoringRegulation (EU) 2016/679, Arts. 12-22; Legea nr. 190/2018, electronic monitoring of employees | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Law No. 190/2018 on Measures for the Implementation of Regulation (EU) 2016/679Legea nr. 190/2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679 | 2018-07-31 | |
| Russia ru 7 instruments | ||
| Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal DataCriminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force 11 December 2024 | 2024-12-11 | |
| Federal Law No. 152-FZ "On Personal Data"Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (as amended) | 2006-07-27 | |
| Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZFederal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of 28 February 2025 | 2025-07-01 | |
| Federal Law No. 152-FZ, Article 21 Part 3.1, Breach NotificationFederal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force 1 September 2022) | 2022-09-01 | |
| Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data DefinitionFederal Law No. 152-FZ, Art. 10-11 | 2006-07-27 | |
| Federal Law No. 152-FZ, Articles 14-17, Data Subject RightsFederal Law No. 152-FZ, Art. 14-17 | 2006-07-27 | |
| Federal Law No. 572-FZ, Unified Biometric System for Identification and AuthenticationFederal Law No. 572-FZ of 29 December 2022 "On the identification and/or authentication of individuals using biometric personal data" | 2023-06-01 | |
| Rwanda rw 1 instrument | ||
| Law relating to the Protection of Personal Data and PrivacyLaw N° 58 of 2021 relating to the Protection of Personal Data and Privacy | 2021-10-15 | |
| Saint Kitts and Nevis kn 1 instrument | ||
| Data Protection Act, 2018Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018) | [future] | |
| Saint Lucia lc 1 instrument | ||
| Data Protection ActAct 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-43 and Schedule 2 | 2023-01-31 | |
| Samoa ws 3 instruments | ||
| National Digital Identification Act 2024, personal data breach notificationNational Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification) | 2024-02-05 | |
| National Digital Identification Act 2024, registered persons' data-subject rightsNational Digital Identification Act 2024, No. 3 (Samoa), s. 51 (registered persons' rights) | 2024-02-05 | |
| Telecommunications Act 2005, confidentiality and protection of customer personal informationTelecommunications Act 2005, No. 20 (Samoa), ss. 48-51, 75A-75B (confidentiality and protection of customer personal information) | 2005-07-27 | |
| San Marino sm 1 instrument | ||
| San Marino Law No. 171 on the Protection of Natural PersonsLegge 21 dicembre 2018 n. 171, sulla tutela delle persone fisiche con riguardo al trattamento dei dati personali | 2018-12-21 | |
| Saudi Arabia sa 5 instruments | ||
| Personal Data Protection Law, breach notificationRoyal Decree No. M/19, Art. 20 | 2023-09-14 | |
| Personal Data Protection Law, comprehensive regime and lawful basisRoyal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12 | 2023-09-14 | |
| Personal Data Protection Law, cross-border transferRoyal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom | 2023-09-14 | |
| Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. M/19, Arts. 35-36 | 2023-09-14 | |
| Personal Data Protection Law, sensitive data and biometric processingRoyal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) | 2023-09-14 | |
| Senegal sn 1 instrument | ||
| Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel | 2008-01-25 | |
| Serbia rs 1 instrument | ||
| Draft Law on Personal Data Protection (2026 reform)Draft Law on Personal Data Protection, Ministry of Justice of the Republic of Serbia, public consultation opened 30 July 2026 | [proposed] | |
| Law on Personal Data ProtectionZakon o zastiti podataka o licnosti (Law on Personal Data Protection), Official Gazette RS No. 87/2018 | 2019-08-21 | |
| Seychelles sc 6 instruments | ||
| Data Protection Act, 2023, application and processing principlesData Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles) | 2023-12-22 | |
| Data Protection Act, 2023, cross-border data flowsData Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows) | 2023-12-22 | |
| Data Protection Act, 2023, enforcement and penaltiesData Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties) | 2023-12-22 | |
| Data Protection Act, 2023, personal data breach notificationData Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach) | 2023-12-22 | |
| Data Protection Act, 2023, rights of data subjectsData Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights) | 2023-12-22 | |
| Data Protection Act, 2023, sensitive data and data of minorsData Protection Act, 2023 (Act 24 of 2023), ss. 22-24 (processing special categories of personal data) | 2023-12-22 | |
| Singapore sg 5 instruments | ||
| Personal Data Protection Act, comprehensive consent-based regimeAct 26 of 2012 (Singapore), as amended by the Personal Data Protection (Amendment) Act 2020, Act 40 of 2020 | 2021-02-01 | |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act 2012, s.26 | 2014-07-02 | |
| Personal Data Protection Act, data breach notificationPersonal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020 | 2021-02-01 | |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act 2012, ss.21-22 | 2014-07-02 | |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 | 2022-10-01 | |
| Slovakia sk 6 instruments | ||
| Act on the Protection of Personal DataZakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov | 2018-05-25 | |
| GDPR Article 9 and Act Section 78, National Birth NumberRegulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78 | [future] | |
| GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| Office for Personal Data Protection Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 | 2018-05-25 | |
| Slovenia si 6 instruments | ||
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) | 2018-05-25 | |
| GDPR Data-Subject Rights and ZVOP-2 Article 11, Judicial ProtectionRegulation (EU) 2016/679, Arts. 12-22; ZVOP-2, Art. 11 | 2018-05-25 | |
| Informacijski Pooblascenec Enforcement, GDPR Article 82, and ZVOP-2 Articles 114-116Regulation (EU) 2016/679, Art. 82; ZVOP-2, Arts. 105, 114-116 | 2018-05-25 | |
| ZVOP-2 Chapter 4 (Articles 81-84) and Article 80, Biometric and Genetic DataZVOP-2, Arts. 80-84, 105 | 2023-01-26 | |
| Zakon o varstvu osebnih podatkov (ZVOP-2), Personal Data Protection ActZakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS, st. 163/22 | 2023-01-26 | |
| Solomon Islands sb 1 instrument | ||
| Telecommunications Act 2009, Confidentiality and Consent DutiesTelecommunications Act 2009 (Solomon Islands), Part 11 (Relations with Consumers), ss. 71-76 | not recorded | |
| Somalia so 1 instrument | ||
| Data Protection Act No. 005 of 2023Data Protection Act, Law No. 005 of 2023 (Federal Republic of Somalia) | not recorded | |
| South Africa za 1 instrument | ||
| Protection of Personal Information Act 4 of 2013 (POPIA)Protection of Personal Information Act 4 of 2013 (POPIA) | 2020-07-01 | |
| South Korea kr 7 instruments | ||
| PIPC Guideline on Processing Publicly Available Data for AI Development and ServicesPIPC Guideline (issued 2024-07-18), applying Personal Information Protection Act (Act No. 10465, as amended), Art. 15(1)(6) | 2024-07-18 | |
| Personal Information Protection Act, breach notification dutiesAct No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40 | 2023-09-15 | |
| Personal Information Protection Act, comprehensive regime and lawful basesAct No. 10465 (Mar. 29, 2011), as amended by Act No. 19234 (Mar. 14, 2023), Art. 15 | 2023-09-15 | |
| Personal Information Protection Act, cross-border transfer restrictionsAct No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11 | 2023-09-15 | |
| Personal Information Protection Act, data subject rights and automated decisionsAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37, 37-2 | 2024-03-15 | |
| Personal Information Protection Act, enforcement and private civil remedyAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 | 2023-09-15 | |
| Personal Information Protection Act, sensitive information and biometric dataAct No. 10465 (as amended by Act No. 19234, 2023), Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Art. 18 | 2023-09-15 | |
| Spain es 6 instruments | ||
| AEPD Enforcement, GDPR Article 82 and LOPDGDD Titulo IXRegulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 | 2018-05-25 | |
| GDPR Article 9 and AEPD Biometric Guidance, Special CategoriesRegulation (EU) 2016/679, Art. 9; LOPDGDD, Art. 9 | 2018-12-07 | |
| GDPR Articles 33-34 and LOPDGDD Article 69, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 69, Art. 73(r)-(s) | 2018-05-25 | |
| LOPDGDD Titulo III and Titulo X, Data-Subject and Digital RightsLOPDGDD, Arts. 11-18, 93-96 | 2018-12-07 | |
| LOPDGDD Titulo VI, International Transfers, Layered on GDPR Chapter VRegulation (EU) 2016/679, Arts. 44-49, 83(5); LOPDGDD, Arts. 40-43, 72.1(l) | 2018-05-25 | |
| Ley Organica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive RegimeLey Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales (BOE-A-2018-16673) | 2018-12-07 | |
| Sri Lanka lk 6 instruments | ||
| Personal Data Protection Act, Data Protection Authority and penaltiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38 | 2025-03-18 | |
| Personal Data Protection Act, breach notification dutiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23 | 2025-03-18 | |
| Personal Data Protection Act, comprehensive regime and lawful basisPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 | 2025-03-18 | |
| Personal Data Protection Act, cross-border transfer of personal dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26 | 2025-03-18 | |
| Personal Data Protection Act, data subject rightsPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 | 2025-03-18 | |
| Personal Data Protection Act, special categories and biometric dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II | 2025-03-18 | |
| State of Palestine ps 1 instrument | ||
| Palestinian Basic Law (Amended 2003), Privacy and Remedy ProvisionsPalestinian Basic Law (Amended) 2003, Arts. 17 and 32 | 2003-03-18 | |
| Suriname sr 0 instruments | ||
| Draft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens)Wet Bescherming Privacy en Persoonsgegevens | [proposed] | |
| Sweden se 7 instruments | ||
| Dataskyddslagen (Data Protection Act), GDPR-Complementing ProvisionsDataskyddslagen, SFS 2018:218 | 2018-05-25 | |
| Dataskyddslagen Chapter 7, Data-Subject Rights and Appeal RoutesDataskyddslagen, ch. 7 | 2018-05-25 | |
| GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition DecisionRegulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221 | 2018-05-25 | |
| GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 | 2018-05-25 | |
| GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) | 2018-05-25 | |
| IMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group ProceedingsRegulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang | 2018-05-25 | |
| Kamerabevakningslagen (Camera Surveillance Act)Kamerabevakningslag, SFS 2018:1200 | 2018-08-01 | |
| Switzerland ch 6 instruments | ||
| FADP Article 24, Breach Notification in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24 | 2023-09-01 | |
| FADP Article 5 lit. c, Sensitive Personal Data Including Biometric DataFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 5 lit. c, Art. 6 para. 7, Art. 22 | 2023-09-01 | |
| FADP Articles 16-17, Cross-Border Transfer of Personal Data from SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 16-17 | 2023-09-01 | |
| FADP Articles 25-32, Data Subject Rights in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 25-32 | 2023-09-01 | |
| FADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65 | 2023-09-01 | |
| Federal Act on Data Protection (nFADP), General Processing PrinciplesFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31 | 2023-09-01 | |
| Syria sy 1 instrument | ||
| Law No. 12 of 2024 on Protection of Electronic Personal DataLaw No. 12 of 2024 (Syrian Arab Republic), issued by presidential decree | [future] | |
| São Tomé and Príncipe st 1 instrument | ||
| Lei n.º 03/2016, Protecção de Dados PessoaisLei n.º 03/2016, de 15 de Fevereiro de 2016, sobre a Protecção de Dados Pessoais | not recorded | |
| Tajikistan tj 5 instruments | ||
| Law on the Protection of Personal Data, biometric personal dataLaw No. 1537 (3 August 2018), Art. 17; Art. 1; Art. 11 | 2018-08-03 | |
| Law on the Protection of Personal Data, comprehensive regimeLaw No. 1537 (3 August 2018), Arts. 1-3, 5, 8-9 | 2018-08-03 | |
| Law on the Protection of Personal Data, data subject rightsLaw No. 1537 (3 August 2018), Art. 8; Arts. 19-20 | 2018-08-03 | |
| Law on the Protection of Personal Data, enforcementLaw No. 1537 (3 August 2018), Arts. 6-7 | 2018-08-03 | |
| Law on the Protection of Personal Data, localization and cross-border transferLaw No. 1537 (3 August 2018), Art. 14; Art. 18 | 2018-08-03 | |
| Tanzania tz 6 instruments | ||
| Personal Data Protection Act, 2022Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 1-5, 14, 21-26 (principles, application and registration) | 2023-05-01 | |
| Personal Data Protection Act, 2022, investigation, enforcement and offencesPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty) | 2023-05-01 | |
| Personal Data Protection Act, 2022, rights of data subjectsPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VI (ss. 33-38, rights of data subjects, including automated decision-making, s. 36, and compensation, s. 37) | 2023-05-01 | |
| Personal Data Protection Act, 2022, security and breach notificationPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data) | 2023-05-01 | |
| Personal Data Protection Act, 2022, sensitive personal dataPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) | 2023-05-01 | |
| Personal Data Protection Act, 2022, transborder data flowPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection) | 2023-05-01 | |
| Thailand th 5 instruments | ||
| Personal Data Protection Act, breach notificationPersonal Data Protection Act B.E. 2562 (2019), Section 37(4) | 2022-06-01 | |
| Personal Data Protection Act, comprehensive regimePersonal Data Protection Act B.E. 2562 (2019), Government Gazette Vol. 136, Special Issue 69 Kor, fully enforceable 2022-06-01 | 2022-06-01 | |
| Personal Data Protection Act, cross-border transferPersonal Data Protection Act B.E. 2562 (2019), Section 28 | 2022-06-01 | |
| Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act B.E. 2562 (2019), Sections 77, 78, 84-88 | 2022-06-01 | |
| Personal Data Protection Act, sensitive and biometric categoriesPersonal Data Protection Act B.E. 2562 (2019), Section 26 | 2022-06-01 | |
| The Bahamas bs 3 instruments | ||
| Data Protection Act 2003, Commissioner, enforcement and penaltiesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences) | 2007-04-02 | |
| Data Protection Act 2003, application and processing principlesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 1-13 (application and data protection principles) | 2007-04-02 | |
| Data Protection Act 2003, cross-border transfer of personal dataData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas) | 2007-04-02 | |
| The Gambia gm 1 instrument | ||
| Personal Data Protection and Privacy Act, 2025Personal Data Protection and Privacy Act, 2025 | [future] | |
| Timor-Leste tl 1 instrument | ||
| Constitution of the Democratic Republic of Timor-Leste, Section 38 (Protection of personal data)Constitution of the Democratic Republic of Timor-Leste (2002), Section 38 | 2002-05-20 | |
| Togo tg 1 instrument | ||
| Loi n° 2019-014, protection des données à caractère personnelLoi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel | not recorded | |
| Tonga to 1 instrument | ||
| Privacy Act 2025, comprehensive personal information protection regimePrivacy Act 2025 (Act 34 of 2025) | [future] | |
| Trinidad and Tobago tt 1 instrument | ||
| Data Protection Act, 2011Act No. 13 of 2011 (Data Protection Act), Chap. 22:04 | [future] | |
| Tunisia tn 1 instrument | ||
| Organic Act on the Protection of Personal DataLoi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel | 2004-07-30 | |
| Turkey tr 6 instruments | ||
| Personal Data Protection Law (KVKK), breach notificationLaw No. 6698, Art. 12(5) | 2016-04-07 | |
| Personal Data Protection Law (KVKK), comprehensive regime and lawful basisLaw No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), cross-border transferLaw No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3 | 2024-09-01 | |
| Personal Data Protection Law (KVKK), data subject rightsLaw No. 6698, Art. 11 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), enforcement and compensationLaw No. 6698, Arts. 11(1)(g), 18 | 2016-04-07 | |
| Personal Data Protection Law (KVKK), special categories and biometric dataLaw No. 6698, Art. 6, as amended by Law No. 7499 (2 March 2024) | 2024-03-02 | |
| Turkmenistan tm 5 instruments | ||
| Law on Information About Private Life, biometric informationLaw No. 519-V (20 March 2017), Arts. 1(1), 7(7), 11(2) | 2017-07-01 | |
| Law on Information About Private Life, comprehensive regimeLaw No. 519-V (20 March 2017), in force 1 July 2017, Arts. 1, 6-9 | 2017-07-01 | |
| Law on Information About Private Life, enforcementLaw No. 519-V (20 March 2017), Arts. 28(2), 29, 31, 32 | 2017-07-01 | |
| Law on Information About Private Life, localization and cross-border transferLaw No. 519-V (20 March 2017), Arts. 12, 17 | 2017-07-01 | |
| Law on Information About Private Life, special categories of personal informationLaw No. 519-V (20 March 2017), Art. 21 | 2017-07-01 | |
| Uganda ug 1 instrument | ||
| Data Protection and Privacy Act, 2019, comprehensive personal-data regimeData Protection and Privacy Act, 2019 (Chapter 97) | 2019-05-03 | |
| Ukraine ua 1 instrument | ||
| Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)Draft Law of Ukraine No. 8153, first reading passed 20 November 2024 | [proposed] | |
| Law of Ukraine On the Protection of Personal DataZakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force 1 January 2011 (Law of Ukraine No. 2297-VI) | 2011-01-01 | |
| United Arab Emirates ae 7 instruments | ||
| ADGM Data Protection Regulations, breach notificationADGM Data Protection Regulations 2021, personal data breach notification provisions | 2021-02-14 | |
| ADGM Data Protection Regulations, comprehensive regimeADGM Data Protection Regulations 2021 (consolidated February 2024) | 2021-02-14 | |
| DIFC Data Protection Law, comprehensive regimeDIFC Law No. 5 of 2020 | 2020-07-01 | |
| Federal Decree-Law on the Protection of Personal Data, breach notificationFederal Decree-Law No. 45 of 2021, Art. 9 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basisFederal Decree-Law No. 45 of 2021, Arts. 1, 4 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, cross-border transferFederal Decree-Law No. 45 of 2021, Arts. 22-23 | 2022-01-02 | |
| Federal Decree-Law on the Protection of Personal Data, enforcement and supervisionFederal Decree-Law No. 45 of 2021, Arts. 25-26 | 2022-01-02 | |
| United Kingdom gb 7 instruments | ||
| Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22DData (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425 | 2026-02-05 | |
| R (Bridges) v Chief Constable of South Wales Police, Automated Facial Recognition by PoliceR (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058 | 2020-08-11 | |
| UK GDPR Article 82, Data Protection Act 2018 Section 169, and ICO EnforcementUK GDPR, Arts. 82-83; Data Protection Act 2018 §169 | 2018-05-25 | |
| UK GDPR Article 9, Special Categories of Personal Data Including Biometric DataUK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 | 2018-05-25 | |
| UK GDPR Articles 33-34 and PECR, Breach Notification in the United KingdomUK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 | 2018-05-25 | |
| UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United KingdomUK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025 | 2018-05-25 | |
| UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 | 2018-05-25 | |
| United States us 8 instruments | ||
| Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments16 CFR Part 312, as amended effective June 23, 2025 | 2000-04-21 | |
| DOJ Data Security Program (Bulk Sensitive Personal Data Rule)28 CFR Part 202 | 2025-04-08 | |
| FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)15 U.S.C. Section 45 | 1914-09-26 | |
| GLBA Safeguards Rule Breach Notification Amendment16 CFR Section 314.4(j) | 2024-05-13 | |
| HIPAA Breach Notification Rule45 CFR Part 164, Subpart D (Sections 164.400-164.414) | 2009-09-23 | |
| HIPAA Privacy Rule45 CFR Part 164, Subpart E (Sections 164.500-164.534) | 2003-04-14 | |
| TAKE IT DOWN ActPub. L. 119-12, S. 146, 119th Cong. (2025) | 2026-05-19 | |
| Video Privacy Protection Act18 U.S.C. Section 2710 | 1988-11-05 | |
| Uruguay uy 1 instrument | ||
| Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amendedLey N° 18.331, de 11 de agosto de 2008, arts. 37-40 según Ley N° 19.670, de 2018, y Decreto N° 64/020, de 2020 | not recorded | |
| Uzbekistan uz 6 instruments | ||
| Law on Personal Data, biometric and genetic dataLaw No. ZRU-547 (2 July 2019), Art. 26 | 2019-10-01 | |
| Law on Personal Data, comprehensive regime and lawful basesLaw No. ZRU-547 (2 July 2019), Arts. 1-14, 18-23, 28, 30-31 | 2019-10-01 | |
| Law on Personal Data, cross-border transfer and citizen data localizationLaw No. ZRU-547 (2 July 2019), Art. 15; Art. 27-1 (added 2021, in force April 2021) | 2019-10-01 | |
| Law on Personal Data, data subject rightsLaw No. ZRU-547 (2 July 2019), Art. 30 | 2019-10-01 | |
| Law on Personal Data, enforcementLaw No. ZRU-547 (2 July 2019), Art. 33 | 2019-10-01 | |
| Law on Personal Data, special personal dataLaw No. ZRU-547 (2 July 2019), Art. 25 | 2019-10-01 | |
| Vanuatu vu 1 instrument | ||
| Data Protection and Privacy Act 2024, comprehensive personal data protection regimeData Protection and Privacy Act No. 13 of 2024 (Vanuatu) | 2025-01-02 | |
| Vatican City State va 1 instrument | ||
| General Regulation on the Protection of Personal Data for Vatican City StateDecreto n. DCLVII del 30 aprile 2024 (ad experimentum, three-year period) | 2024-04-30 | |
| Venezuela ve 2 instruments | ||
| Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)Constitución de la República Bolivariana de Venezuela, Gaceta Oficial Extraordinaria N° 36.860, 30 de diciembre de 1999, arts. 28 y 60 | 1999-12-30 | |
| Ley Especial contra los Delitos Informáticos, privacy of personal data and communications (Arts. 20-22)LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 20-22 | 2001-11-29 | |
| Vietnam vn 5 instruments | ||
| Law on Personal Data Protection, biometric and location data protectionLaw No. 91/2025/QH15, Article 31 | 2026-01-01 | |
| Law on Personal Data Protection, breach notificationLaw No. 91/2025/QH15, Article 23 | 2026-01-01 | |
| Law on Personal Data Protection, comprehensive regimeLaw No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, 26 June 2025, in force 1 January 2026 | 2026-01-01 | |
| Law on Personal Data Protection, cross-border transferLaw No. 91/2025/QH15, Article 20 | 2026-01-01 | |
| Law on Personal Data Protection, enforcement and data subject rightsLaw No. 91/2025/QH15, enforcement and data subject rights provisions | 2026-01-01 | |
| Zambia zm 1 instrument | ||
| Data Protection Act, 2021, personal data processing frameworkData Protection Act, 2021 (Act No. 3 of 2021) | 2021-04-01 | |
| Zimbabwe zw 2 instruments | ||
| Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024) | 2024-09-13 | |
| Cyber and Data Protection Act [Chapter 12:07]Cyber and Data Protection Act, No. 5 of 2021 (Zimbabwe) | 2022-03-11 | |
United States: states, territories and cities203 in 57 places
Law made below the national level, binding inside it. The slug beside each name says which tier it is.
What this page claims, and what it does not
The stages are LexLint's own vocabulary. Four of the five boxes are
the binding classes the /law/<jurisdiction> docket already
draws (In force, Enacted but not yet in force, Proposed, and Repealed,
withdrawn or blocked), so a square here and a square there mean the same
thing. A struck-down instrument is spent on both readings.
Enjoined has its own box. Inside "Repealed, withdrawn or blocked" it would sit beside a mark that is a false description of a law a court has paused, and it would pool away a count that reads as a signal: how contested a jurisdictional hook is. The certainty ladder files enjoined as present law and the docket draws it spent; splitting it out here makes that disagreement the reader's choice instead of our silent one. It is off by default, which follows the docket.
One date column, and where a bare date would mislead it says what kind
of date it is. "In force from" is commencement: the earlier of a
published commencement event and the instrument's own effective date, the
same choice lifecycle_band() makes and for the same reason,
neither source is reliably the commencement, and the earlier one cannot make
a law look newer than it is. A bracket qualifies the date where a bare one
would mislead ([future] for a start date still ahead,
[proposed] for a bill with no commencement to show,
[enjoined], [struck down], [repealed],
[superseded] or [withdrawn] for a spent
instrument). Nothing is inferred from our own review date: a row with
neither a date nor a status to explain the gap says "not recorded" instead.
The map is the table. Its fill is the count of instruments at the
stages you chose, binned on the same RAMP_BINS edges
/law/map uses, and it redraws on
every change. Point at, click, or tab to a place for what applies there,
every stage it holds shown even when your filter is excluding it.
Three ways of showing nothing, and they are different claims. A place washed pale holds privacy law your filter is excluding, so widening the filter brings it back. A hatched place is one we track and hold no privacy law for at all: that is a statement about our research, not about the law. A white place has no jurisdiction record for this topic at all. Only the first of the three moves when you change the filter; the other two are facts about us and hold still.
Nothing here needs the script. The default resultset is in the
HTML: counts, tally, map fills and the hidden rows are all rendered at
build. The script recomputes them when a box changes and does nothing else,
which is what lets this page ship under script-src 'self' and
be read whole by a crawler.