Law / Privacy

Privacy law, instrument by instrument

Every privacy law instrument LexLint holds, grouped by the place that made it. Choose which stages of law to show: the map, the counts and the tables all answer to that choice. To see every area of law, follow Law in the breadcrumb above.

Where privacy law applies, at the stages chosen below. A darker fill means more instruments at those stages. Point at, click, or tab to a place for the privacy law that applies there.
  • 1
  • 5
  • 10
  • 20+
  • instruments shown
  • law on file, none at these stages
  • tracked, no law on file
  • not tracked
The United States is drawn as its states; its federal instruments are a row group in Countries below.

Stages of law

Stages of law to show

787 instruments in 235 places.

No commencement date on file for 114.

Unions6 in 1 place

Law made above the state, binding its members.

Stage Instrument In force from
European Union eu 6 instruments
GDPR Article 9, Special Categories of Personal Data Including Biometric DataRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 12-22, Data Subject RightsRegulation (EU) 2016/679, Arts. 12-22 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and RemediesRegulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-50 2018-05-25
General Data Protection Regulation (GDPR), Comprehensive RegimeRegulation (EU) 2016/679 2018-05-25

Countries578 in 177 places

One row group per country, alphabetically.

Stage Instrument In force from
Afghanistan af 1 instrument
Constitution of the Islamic Republic of Afghanistan, Articles 37 and 38 (Privacy)Constitution of the Islamic Republic of Afghanistan (2004), Arts. 37 and 38 2004-01-26
Albania al 1 instrument
Law No. 124/2024 On the Protection of Personal DataLaw No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, in force 31 January 2025 2025-01-31
Algeria dz 1 instrument
Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, Journal officiel n° 48 2023-08-11
Andorra ad 1 instrument
LQPD, Llei 29/2021 del 28 d'octubreLlei Qualificada de Proteccio de Dades Personals (LQPD), Butlleti Oficial del Principat d'Andorra, as amended by Llei 12/2024 2022-05-17
Angola ao 1 instrument
Law on the Protection of Personal DataLei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais) not recorded
Antigua and Barbuda ag 1 instrument
Data Protection Act, 2013Data Protection Act, 2013 (No. 10 of 2013), ss. 5-23 not recorded
Argentina ar 1 instrument
Ley 25.326, Ley de Protección de los Datos PersonalesLey 25.326, Ley de Protección de los Datos Personales (2000) 2000-10-30
Armenia am 6 instruments
Law on Protection of Personal Data, biometric data provisionsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 3(13), 13, 19(4), 19(6), 23(3) 2015-07-01
Law on Protection of Personal Data, comprehensive regimeLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N (2015), Arts. 1, 3-8 2015-07-01
Law on Protection of Personal Data, cross-border transferLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 27 2015-07-01
Law on Protection of Personal Data, data subject rightsLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Arts. 15-17 2015-07-01
Law on Protection of Personal Data, enforcementLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 24 2015-07-01
Law on Protection of Personal Data, special category dataLaw of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 12 2015-07-01
Australia au 5 instruments
Privacy Act 1988 (Cth), Comprehensive Regime and Civil PenaltiesPrivacy Act 1988 (Cth), No. 119, 1988, ss. 6, 13, 13G, 13H, 14, 15 1989-01-01
Privacy Act 1988 (Cth), Notifiable Data Breaches SchemePrivacy Act 1988 (Cth), Part IIIC, ss. 26WE, 26WK, 26WL 2018-02-22
Privacy Act 1988 (Cth), Schedule 1, Sensitive and Biometric InformationPrivacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 3, read with s. 6 2014-03-12
Privacy Act 1988 (Cth), Schedule 2, Statutory Tort for Serious Invasions of PrivacyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 2, inserting Schedule 2 to the Privacy Act 1988 2025-06-10
Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making TransparencyPrivacy and Other Legislation Amendment Act 2024 (Cth), No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988 2026-12-10[future]
Austria at 6 instruments
Datenschutzgesetz (DSG), Data Protection ActDatenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 24/2018 2018-05-25
GDPR Article 22 and DSG Sections 42-45, Automated Decision-Making in AustriaRegulation (EU) 2016/679, Art. 22; Datenschutzgesetz (DSG) §§42-45 2018-05-25
GDPR Article 82 and Datenschutzbehorde Enforcement in AustriaRegulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4 2018-05-25
GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in AustriaRegulation (EU) 2016/679, Art. 9, as applied in Austria 2018-05-25
GDPR Articles 33-34, Breach Notification in AustriaRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from AustriaRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Azerbaijan az 6 instruments
Law on Personal Data, biometric data enumeration and general processing conditionsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 9.5 2010-05-11
Law on Personal Data, comprehensive regime and lawful basisLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ (11 May 2010, as amended through 2023), Arts. 1-2, 8-13 2010-05-11
Law on Personal Data, cross-border transferLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 14 2010-05-11
Law on Personal Data, data subject rightsLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Art. 7 2010-05-11
Law on Personal Data, enforcement and liabilityLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 7.4, 17, 19 2010-05-11
Law on Personal Data, special categories of personal dataLaw of the Republic of Azerbaijan on Personal Data, Law No. 998-IIIQ, Arts. 2.1.6, 9.7 2010-05-11
Bahrain bh 6 instruments
Personal Data Protection Law, biometric data prior authorisationLaw No. 30 of 2018, Art. 15 2019-08-01
Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 30 of 2018, Arts. 4-9 2019-08-01
Personal Data Protection Law, cross-border transferLaw No. 30 of 2018, Arts. 12-13 2019-08-01
Personal Data Protection Law, data subject rightsLaw No. 30 of 2018, Arts. 17-23 2019-08-01
Personal Data Protection Law, enforcement and penaltiesLaw No. 30 of 2018, Arts. 55, 57-60 2019-08-01
Personal Data Protection Law, sensitive personal dataLaw No. 30 of 2018, Arts. 1, 5 2019-08-01
Bangladesh bd 5 instruments
Personal Data Protection Act, 2026, breach notification dutiesPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.20 2025-11-06
Personal Data Protection Act, 2026, complaints, penalties and appealsPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.31-38 [future]
Personal Data Protection Act, 2026, comprehensive regime and lawful basisPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.5, 8, 18 2025-11-06
Personal Data Protection Act, 2026, cross-border transfer of personal dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, ss.29, 30 2025-11-06
Personal Data Protection Act, 2026, sensitive personal data and biometric dataPersonal Data Protection Act, 2026, Act No. 63 of 2026, s.2(21), s.2(14), s.7 2025-11-06
Barbados bb 1 instrument
Data Protection Act, 2019Data Protection Act, 2019 (Act 2019-29) 2021-03-26
Belarus by 1 instrument
Law of the Republic of Belarus On Personal Data ProtectionZakon Respubliki Belarus No. 99-Z ot 7 maia 2021 g. O zashchite personalnykh dannykh, v sile s 15 noiabria 2021 (Law No. 99-Z of 7 May 2021) 2021-11-15
Belgium be 10 instruments
Act of 3 December 2017, GBA/APD and Litigation ChamberLoi du 3 decembre 2017 portant creation de l'Autorite de protection des donnees (numac 2017031916) 2018-05-25
Act of 30 July 2018 Article 10/1, Recorded Commercial CommunicationsLoi du 30 juillet 2018, Art. 10/1, as inserted by the Act of 21 December 2021, article 255 2022-01-10
Act of 30 July 2018 Article 9 and GBA/APD Biometric Recommendation and EnforcementLoi du 30 juillet 2018, Art. 9; GBA/APD Aanbeveling nr. 01/2021; GBA/APD Beslissing ten gronde nr. 114/2024 2018-09-05
Act of 30 July 2018 Articles 8-10, Special-Category Processing GroundsLoi du 30 juillet 2018, Arts. 8-10 2018-09-05
Act of 30 July 2018 Title 5, Action en Cessation, and GDPR Article 22Loi du 30 juillet 2018, Arts. 11-17, 209-211, 220; Regulation (EU) 2016/679, Art. 22 2018-05-25
Act of 30 July 2018 Title 6 Chapter II, Criminal SanctionsLoi du 30 juillet 2018, Arts. 222-230 2018-09-05
Act of 30 July 2018 on the Protection of Natural Persons with regard to Personal DataLoi du 30 juillet 2018 relative a la protection des personnes physiques a l'egard des traitements de donnees a caractere personnel (numac 2018040581) 2018-09-05
Code de Droit Economique Article XVII.37, 10 degrees/1, Collective Redress for GDPR ClaimsCode de droit economique, Art. XVII.37, 10 degrees/1, as inserted by the Loi du 30 juillet 2018 portant dispositions diverses en matiere d'Economie (numac 2018031589), Art. 43 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V and Act Article 222, 4, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5); Loi du 30 juillet 2018, Art. 222, 4 2018-05-25
Belize bz 4 instruments
Data Protection Act 2021, Commissioner, Tribunal, and enforcementData Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92 [future]
Data Protection Act 2021, comprehensive regimeData Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22 [future]
Data Protection Act 2021, cross-border transfer of personal dataData Protection Act, 2021 (Act No. 45 of 2021), ss. 23-29 (Transfers of Personal Data outside of Belize) [future]
Data Protection Act 2021, personal data breach notificationData Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62 [future]
Benin bj 1 instrument
Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)Loi n°2017-20 du 20 avril 2018, Livre V, Protection des Données à Caractère Personnel, portant Code du Numérique en République du Bénin 2018-04-20
Bermuda bm 5 instruments
Personal Information Protection Act 2016, Commissioner, enforcement and offencesPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 26-46, 48 (the Privacy Commissioner, orders, offences and penalties) not recorded
Personal Information Protection Act 2016, application and general principlesPersonal Information Protection Act 2016 (Bermuda), 2016:43, Parts 1-2 (application, exclusions and general principles) not recorded
Personal Information Protection Act 2016, breach of security notificationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security) not recorded
Personal Information Protection Act 2016, cross-border transfer of personal informationPersonal Information Protection Act 2016 (Bermuda), 2016:43, s. 15 (transfer of personal information to an overseas third party) not recorded
Personal Information Protection Act 2016, rights of individualsPersonal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals) not recorded
Bhutan bt 5 instruments
Cybersecurity Code of Practice for ICT/Telecommunications Service Providers, privacy and PII dutyCybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of Bhutan 2018, s.58), s.8.6 2024-10-10
Information, Communications and Media Act of Bhutan 2018, data protection and privacy dutiesInformation, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386 2018-01-08
Information, Communications and Media Act of Bhutan 2018, offences and compensation for data failuresInformation, Communications and Media Act of Bhutan 2018, ss.387-388 2018-01-08
Information, Communications and Media Act of Bhutan 2018, sensitive personal data and biometric informationInformation, Communications and Media Act of Bhutan 2018, definitions clause, item 89(f) 2018-01-08
Information, Communications and Media Act of Bhutan 2018, user review and removal rightsInformation, Communications and Media Act of Bhutan 2018, ss.338(3), 340 2018-01-08
Bolivia bo 3 instruments
Constitución Política del Estado, Acción de Protección de PrivacidadCPE, art. 130 (Acción de Protección de Privacidad), promulgada 7 de febrero de 2009 2009-02-07
Ley General de Telecomunicaciones, Inviolabilidad y Secreto de las Comunicaciones y Protección de Datos PersonalesLey No. 164, arts. 56 (Protección de Datos Personales), promulgada 8 de agosto de 2011 2011-08-08
Reglamento para el Desarrollo de TIC, Tratamiento de los Datos PersonalesDS No. 1793, Reglamento a la Ley No. 164, art. 56 (Tratamiento de los Datos Personales), 13 de noviembre de 2013 2013-11-13
Bosnia and Herzegovina ba 1 instrument
Law on the Protection of Personal Data of Bosnia and HerzegovinaLaw on the Protection of Personal Data, Official Gazette of Bosnia and Herzegovina No. 12/25, applicable 4 October 2025 2025-10-04
Botswana bw 1 instrument
Data Protection Act, 2024 (Act No. 18 of 2024)Data Protection Act, 2024 (Act No. 18 of 2024) 2025-01-14
Brazil br 1 instrument
Lei Geral de Proteção de Dados Pessoais (LGPD)Lei nº 13.709, de 14 de agosto de 2018 (LGPD) 2020-09-18
Brunei Darussalam bn 5 instruments
Personal Data Protection Order 2025, breach notificationPersonal Data Protection Order, 2025 (S 1/2025), Part 7 (ss.25-29) 2026-01-01
Personal Data Protection Order 2025, comprehensive regimePersonal Data Protection Order, 2025 (S 1/2025), ss.2, 3, 8 2026-01-01
Personal Data Protection Order 2025, cross-border transferPersonal Data Protection Order, 2025 (S 1/2025), s.24 2026-01-01
Personal Data Protection Order 2025, data-subject rightsPersonal Data Protection Order, 2025 (S 1/2025), ss.18-20 2026-01-01
Personal Data Protection Order 2025, enforcement and penaltiesPersonal Data Protection Order, 2025 (S 1/2025), ss.37, 59 2026-01-01
Bulgaria bg 6 instruments
GDPR Article 9 and PDPA Employment and National-ID-Number RulesRegulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions [future]
GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
KZLD Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 2018-05-25
Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)Закон за защита на личните данни (ЗЗЛД), Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of 4 January 2002, as amended) 2019-02-26
Burkina Faso bf 1 instrument
Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnelLoi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel 2021-03-30
Burundi bi 1 instrument
Law No. 1/03 of March 10, 2026 on the Protection of Personal DataLoi n°1/03 du 10 mars 2026 portant protection des données à caractère personnel 2026-03-10
Cabo Verde cv 1 instrument
Law No. 133/V/2001 on the Protection of Personal DataLei n.º 133/V/2001, de 22 de Janeiro (Lei de Protecção de Dados Pessoais), Assembleia Nacional da República de Cabo Verde not recorded
Cameroon cm 2 instruments
Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)Loi n°2010/012 du 21 décembre 2010, art. 74 2010-12-21
Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au CamerounLoi n°2024/017 du 23 décembre 2024 [future]
Canada ca 2 instruments
PIPEDA breach of security safeguards regimeS.C. 2000, c. 5, ss. 10.1-10.3 2018-11-01
Personal Information Protection and Electronic Documents Act (PIPEDA)S.C. 2000, c. 5, Part 1 2001-01-01
Cayman Islands ky 4 instruments
Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offencesData Protection Act (2021 Revision), ss. 52-57 (Ombudsman investigatory powers, monetary penalties and offences) 2019-09-30
Data Protection Act 2021 Revision, application, principles and data subject rightsData Protection Act (2021 Revision), Law 33 of 2017, ss. 1-14 (application, principles and data subject rights) 2019-09-30
Data Protection Act 2021 Revision, cross-border transfer of personal dataData Protection Act (2021 Revision), Schedule 1 (eighth principle) and Schedule 4 (transfers to which the eighth principle does not apply) 2019-09-30
Data Protection Act 2021 Revision, personal data breach notificationData Protection Act (2021 Revision), s. 16 (personal data breaches) 2019-09-30
Central African Republic cf 1 instrument
Loi n° 24.001 portant protection des données à caractère personnelLoi n° 24.001 portant protection des données à caractère personnel (janvier 2024) not recorded
Chad td 6 instruments
Loi n°007/PR/2015, droits de la personne concernée (information, accès, opposition, rectification)Loi n°007/PR/2015 du 10 février 2015, arts. 35-50 2015-02-10
Loi n°007/PR/2015, obligation de notification des violations de données à l'ANSICELoi n°007/PR/2015 du 10 février 2015, art. 61 2015-02-10
Loi n°007/PR/2015, principes directeurs du traitement des données (consentement, licéité, finalité, conservation)Loi n°007/PR/2015 du 10 février 2015, arts. 1-15 2015-02-10
Loi n°007/PR/2015, sanctions administratives et pénales et recoursLoi n°007/PR/2015 du 10 février 2015, arts. 80-94 2015-02-10
Loi n°007/PR/2015, traitement des catégories particulières de données (données sensibles et biométriques)Loi n°007/PR/2015 du 10 février 2015, arts. 16-25 2015-02-10
Loi n°007/PR/2015, transfert des données vers un pays non membre de la CEEAC/CEMACLoi n°007/PR/2015 du 10 février 2015, arts. 29-32 2015-02-10
Chile cl 3 instruments
Ley 19.628, sobre Protección de la Vida PrivadaLey 19.628, sobre Protección de la Vida Privada (Ley sobre Protección de Datos de Carácter Personal) 1999-08-28
Ley 21.719, Agencia de Protección de Datos Personales, SancionesLey 21.719, art. 35 (sanciones) y arts. 42-45 (procedimiento administrativo y judicial) 2026-12-01[future]
Ley 21.719, Regula la Protección y el Tratamiento de los Datos PersonalesLey 21.719, Regula la Protección y el Tratamiento de los Datos Personales y Crea la Agencia de Protección de Datos Personales (Boletines 11.092-07 y 11.144-07, refundidos) 2026-12-01[future]
China cn 8 instruments
Personal Information Protection Law of the PRC, General Processing Rules and Lawful BasesPIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, 20 August 2021; effective 1 November 2021 2021-11-01
Personal Information Protection Law, Cross-Border TransferPIPL Arts. 38-40 2021-11-01
Personal Information Protection Law, Data Breach NotificationPIPL Art. 57 2021-11-01
Personal Information Protection Law, Individual Rights and Automated Decision-MakingPIPL Arts. 24, 44-50, 55(2) 2021-11-01
Personal Information Protection Law, Sensitive Personal InformationPIPL Arts. 28-32 2021-11-01
Personal Information Protection Law, Supervision and Legal LiabilityPIPL Arts. 60-71 2021-11-01
Provisions on Promoting and Regulating Cross-Border Data Flows促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective 22 March 2024 2024-03-22
Provisions on Security Management of Facial Recognition Technology Application人脸识别技术应用安全管理办法, issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed 13 March 2025, effective 1 June 2025 2025-06-01
Colombia co 2 instruments
Ley 1581 de 2012, General Personal Data ProtectionLey Estatutaria 1581 de 2012, arts. 1-30 (Proteccion de Datos Personales) 2012-10-17
Superintendencia Circular on AI and Personal DataSIC Circular Externa 002 de 2024 (Lineamientos sobre Tratamiento de Datos Personales en Sistemas de Inteligencia Artificial), 21 de agosto de 2024 2024-08-21
Comoros km 1 instrument
Law on the Protection of Personal DataLoi n° 14-029/AU portant protection des données à caractère personnel, deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on 26 June 2014 not recorded
Costa Rica cr 2 instruments
Codigo Penal, articulo 196 bis, Violacion de datos personalesCodigo Penal (Ley No. 4573), art. 196 bis, segun reforma por Ley No. 9048 not recorded
Proteccion de la Persona frente al Tratamiento de sus Datos PersonalesLey No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales not recorded
Croatia hr 6 instruments
AZOP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 2018-05-25
Act on the Implementation of the General Data Protection RegulationZakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18 2018-05-25
Croatian Act Articles 21-23, Biometric Data by SectorZakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23 2018-05-25
GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
Cuba cu 2 instruments
Ley 149/2022, De Protección de Datos Personales, general regimeLey 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022) 2023-02-21
Resolución 58/2022 (MINCOM), security and localization rules for personal data in electronic formResolución 58/2022, Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022) 2023-02-21
Cyprus cy 6 instruments
GDPR Article 22 and Law 125(I)/2018, Automated Decisions in CyprusRegulation (EU) 2016/679, Art. 22; Law 125(I)/2018 2018-07-31
GDPR Article 9 and Law 125(I)/2018, Genetic and Biometric Data in CyprusRegulation (EU) 2016/679, Art. 9; Law 125(I)/2018 2018-07-31
GDPR Articles 33-34, Breach Notification in CyprusRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and ODPC Enforcement in CyprusRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from CyprusRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Law 125(I)/2018, Cyprus GDPR SupplementLaw 125(I)/2018 of 2018 2018-07-31
Czechia cz 6 instruments
Act on Personal Data ProcessingZakon c. 110/2019 Sb., o zpracovani osobnich udaju 2019-04-24
GDPR Article 9, Special Categories Including Biometric DataRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
UOOU Enforcement, GDPR Article 82, and the Act on Collective Civil Court ProceedingRegulation (EU) 2016/679, Arts. 82-83; Zakon c. 179/2024 Sb., o hromadnem obcanskem soudnim rizeni; Zakon c. 180/2024 Sb. 2024-07-01
Côte d'Ivoire ci 1 instrument
Law No. 2013-450 on the Protection of Personal DataLoi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel not recorded
Democratic Republic of the Congo cd 1 instrument
Digital Code, Title III: Personal Data ProtectionCode du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 267) 2023-03-13
Denmark dk 6 instruments
Danish Data Protection Act (Databeskyttelsesloven)Lov nr. 502 af 23. maj 2018 om supplerende bestemmelser til forordningen om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sadanne oplysninger (databeskyttelsesloven), consolidated as Act No. 289 of 8 March 2024 2018-05-25
GDPR Article 22 and Data Subject Rights as Applied in DenmarkRegulation (EU) 2016/679, Arts. 12-23; Databeskyttelsesloven 2018-05-25
GDPR Article 9, Special Categories of Personal Data as Applied in DenmarkRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 33-34, Breach Notification in DenmarkRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and Datatilsynet Enforcement in DenmarkRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from DenmarkRegulation (EU) 2016/679, Arts. 44-50 2018-05-25
Djibouti dj 1 instrument
Digital Code, Book I: Personal Data Protection and CNDPLoi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier (Arts. 2 à 156) 2025-09-18
Dominican Republic do 1 instrument
Ley No. 172-13 sobre Protección Integral de los Datos PersonalesLey No. 172-13, Gaceta Oficial No. 10737, 15 de diciembre de 2013 2013-12-15
Ecuador ec 2 instruments
LOPDP, comprehensive personal-data protection regimeLey Orgánica de Protección de Datos Personales (LOPDP), Quinto Suplemento del Registro Oficial No. 459, 26 de mayo de 2021 2021-05-26
SPDP Norma General guaranteeing personal-data protection in the use of AI systemsResolución No. SPDP-SPD-2026-0009-R, Superintendencia de Protección de Datos Personales, 12 de febrero de 2026 [future]
Egypt eg 1 instrument
Law No. 151 of 2020 Promulgating the Personal Data Protection LawLaw No. 151 of 2020 Promulgating the Personal Data Protection Law 2020-10-16
El Salvador sv 1 instrument
Ley para la Protección de Datos PersonalesDecreto Legislativo No. 144, 12 de noviembre de 2024 2024-11-23
Equatorial Guinea gq 1 instrument
Ley de Protección de Datos PersonalesLey Núm. 1/2016, de 22 de julio, de Protección de Datos Personales not recorded
Eritrea er 2 instruments
Civil Code of the State of Eritrea, Personality Rights (Image and Correspondence)Civil Code of the State of Eritrea (2015), arts. 26-30 (Image and Privacy; Inviolability of Correspondence) [future]
Penal Code of the State of Eritrea, Violation of PrivacyPenal Code of the State of Eritrea (2015), art. 298 (Violation of Privacy) [future]
Estonia ee 6 instruments
GDPR Article 22 and Data Subject Rights as Applied in EstoniaRegulation (EU) 2016/679, Arts. 15-22; Isikuandmete kaitse seadus 2019-01-15
GDPR Article 9, Special Categories of Personal Data as Applied in EstoniaRegulation (EU) 2016/679, Art. 9 2019-01-15
GDPR Articles 33-34, Breach Notification in EstoniaRegulation (EU) 2016/679, Arts. 33-34 2019-01-15
GDPR Articles 82-83 and AKI Enforcement in EstoniaRegulation (EU) 2016/679, Arts. 82-83 2019-01-15
GDPR Chapter V, Cross-Border Transfer of Personal Data from EstoniaRegulation (EU) 2016/679, Arts. 44-50 2019-01-15
Personal Data Protection Act (Isikuandmete kaitse seadus)Isikuandmete kaitse seadus, RT I, 04.01.2019, 11, adopted 12 December 2018 2019-01-15
Eswatini sz 1 instrument
Data Protection Act, 2022 (Act No. 5 of 2022)Data Protection Act, 2022 (Act No. 5 of 2022) 2022-03-04
Ethiopia et 1 instrument
Personal Data Protection ProclamationProclamation No. 1321/2024 (Federal Negarit Gazette) 2024-07-24
Finland fi 6 instruments
Data Protection Act (Tietosuojalaki)Tietosuojalaki 1050/2018 (amendments up to 29/2024 included) 2019-01-01
GDPR Article 22 and Data Protection Act Sections 33-34, Data Subject Rights in FinlandRegulation (EU) 2016/679, Arts. 15-22; Tietosuojalaki 1050/2018 secs. 21, 33-34 2019-01-01
GDPR Article 9 and Data Protection Act Section 6, Special Categories in FinlandRegulation (EU) 2016/679, Art. 9; Tietosuojalaki 1050/2018 sec. 6 2019-01-01
GDPR Articles 33-34, Breach Notification in FinlandRegulation (EU) 2016/679, Arts. 33-34 2019-01-01
GDPR Articles 82-83 and Data Protection Act Section 24, Enforcement in FinlandRegulation (EU) 2016/679, Arts. 82-83; Tietosuojalaki 1050/2018 sec. 24 2019-01-01
GDPR Chapter V, Cross-Border Transfer of Personal Data from FinlandRegulation (EU) 2016/679, Arts. 44-50; Tietosuojalaki 1050/2018 sec. 27 2019-01-01
France fr 8 instruments
CNIL Enforcement, GDPR Article 83 and Code Penal Articles 226-16 to 226-22-2Regulation (EU) 2016/679, Art. 83; Code penal, Arts. 226-16 to 226-22-2 2018-05-25
CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique 2019-01-10
GDPR Article 22, Right Against Automated Individual Decision-MakingRegulation (EU) 2016/679, Art. 22 2018-05-25
GDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) 2018-05-25
Loi 78-17 Article 47, Automated Administrative DecisionsLoi n. 78-17 du 6 janvier 1978, Art. 47 1978-01-06
Loi Informatique et Libertes, GDPR-Aligned Comprehensive Regime (Data Processing, Data Files and Individual Liberties Act)Loi n. 78-17 du 6 janvier 1978 relative a l'informatique, aux fichiers et aux libertes, as amended (JORFTEXT000000886460) 2018-05-25
Gabon ga 1 instrument
Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023 2023-07-15
Georgia ge 7 instruments
Law on Personal Data Protection, biometric data articleLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d) 2024-03-01
Law on Personal Data Protection, breach notificationLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 (17 December 2025) 2024-03-01
Law on Personal Data Protection, comprehensive regime and lawful basisLaw of Georgia on Personal Data Protection, Law No. 3144-XI, adopted 14 June 2023, Arts. 1-5, 7-8 2024-03-01
Law on Personal Data Protection, cross-border transferLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 37-38, as amended by Law No. 1289 (17 December 2025) 2024-03-01
Law on Personal Data Protection, data subject rightsLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 10-23) 2024-03-01
Law on Personal Data Protection, enforcement and penaltiesLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79 2024-03-01
Law on Personal Data Protection, special categories of dataLaw of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 6 2024-03-01
Germany de 6 instruments
Bundesdatenschutzgesetz (BDSG), Federal Data Protection ActBundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended 2018-05-25
GDPR Article 22 and BDSG Sections 31 and 37, Automated Decisions and Credit Scoring in GermanyRegulation (EU) 2016/679, Art. 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 2018-05-25
GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehorden Enforcement in GermanyRegulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43 2018-05-25
GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in GermanyRegulation (EU) 2016/679, Art. 9; Bundesdatenschutzgesetz (BDSG) §26(3) 2018-05-25
GDPR Articles 33-34, Breach Notification in GermanyRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from GermanyRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Ghana gh 1 instrument
Data Protection ActData Protection Act, 2012 (Act 843) not recorded
Greece gr 6 instruments
GDPR Article 22 and Law 4624/2019 Article 27, Data Subject Rights and Employment in GreeceRegulation (EU) 2016/679, Arts. 12-23; Law 4624/2019, Art. 27 2019-08-29
GDPR Article 9 and Law 4624/2019, Special Categories in GreeceRegulation (EU) 2016/679, Art. 9; Law 4624/2019 2018-05-25
GDPR Articles 33-34, Breach Notification in GreeceRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and HDPA Enforcement in GreeceRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from GreeceRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Law 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)Law 4624/2019, FEK A' 137/29-08-2019 2019-08-29
Grenada gd 1 instrument
Data Protection Act, No. 1 of 2023Data Protection Act, No. 1 of 2023 [future]
Guatemala gt 2 instruments
Constitución Política de la República de Guatemala, Art. 31 (habeas data)Const. Pol. de la República de Guatemala, art. 31 (acceso a archivos y registros estatales) 1986-01-14
Ley de Acceso a la Información Pública, Decreto 57-2008 (personal-data provisions)Decreto Número 57-2008, Ley de Acceso a la Información Pública, arts. 9, 31-32, 61-67 not recorded
Guinea gn 1 instrument
Loi n° L/2016/037/AN portant Cybersécurité et Protection des Données à Caractère Personnel, titre relatif à la protection des données à caractère personnelLoi n° L/2016/037/AN, titre données à caractère personnel, portant Cybersécurité et Protection des Données à Caractère Personnel not recorded
Guyana gy 1 instrument
Data Protection Act 2023Data Protection Act 2023 (Act No. 18 of 2023) [future]
Honduras hn 3 instruments
Constitución de la República de Honduras, garantía de Hábeas DataConstitución de la República de Honduras (1982, reformada), art. 182 (Hábeas Data) 2013-03-27
Código Penal, acceso no autorizado a datos personales (descubrimiento y revelación de secretos)Decreto No. 130-2017, Código Penal, art. 272 (Descubrimiento y Revelación de Secretos) 2019-11-10
Ley de Transparencia y Acceso a la Información Pública, protección de datos personales y hábeas dataDecreto No. 170-2006, Ley de Transparencia y Acceso a la Información Pública, arts. 3(7), 23-29 (Datos Personales y Hábeas Data) 2013-03-27
Hungary hu 6 instruments
GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
Infotorveny (Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information)2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol 2012-01-01
Infotorveny Definitions, Biometric and Special-Category Data2011. evi CXII. torveny, point 3 and point 3b ("kulonleges adat" and "biometrikus adat") 2018-05-25
Infotorveny Sections 25/J-25/K, Breach Notification, Inserted by Act XXXVIII of 20182011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section 2019-04-26
NAIH Enforcement, GDPR Article 82, and Infotorveny Section 24 SerelemdijRegulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section 2012-01-01
Iceland is 6 instruments
Act No. 90/2018 Article 16, Cross-Border Transfer of Personal Data from IcelandLog nr. 90/2018, Art. 16 2018-07-15
Act No. 90/2018 Articles 3(14) and 9, Special Categories in IcelandLog nr. 90/2018, Art. 3(14), Art. 9 2018-07-15
Act No. 90/2018 on Data Protection and the Processing of Personal DataLog nr. 90/2018 um personuvernd og vinnslu personuupplysinga (Act No. 90/2018), passed by Althingi 27 June 2018, in force 15 July 2018 2018-07-15
Act No. 90/2018, Breach Notification in IcelandLog nr. 90/2018 (breach notification provisions) 2018-07-15
Act No. 90/2018, Data Subject Rights in IcelandLog nr. 90/2018 (data subject rights provisions) 2018-07-15
Act No. 90/2018, Persoonuvernd Enforcement in IcelandLog nr. 90/2018 (enforcement provisions) 2018-07-15
India in 6 instruments
Digital Personal Data Protection Act, 2023, Data Protection Board and penaltiesDigital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 2025-11-13
Digital Personal Data Protection Act, 2023, breach notification dutiesDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6) 2027-05-13[future]
Digital Personal Data Protection Act, 2023, comprehensive regime and lawful basisDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8 2027-05-13[future]
Digital Personal Data Protection Act, 2023, cross-border transfer restrictionsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16 2027-05-13[future]
Digital Personal Data Protection Act, 2023, data subject rightsDigital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14 2027-05-13[future]
Digital Personal Data Protection Rules, 2025G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, notified 13 November 2025 2025-11-13
Indonesia id 5 instruments
Law on Personal Data Protection, biometric data definitionLaw No. 27 of 2022 on Personal Data Protection, Article 4(2)(b) and its official elucidation 2022-10-17
Law on Personal Data Protection, breach notificationLaw No. 27 of 2022 on Personal Data Protection, Article 46 2022-10-17
Law on Personal Data Protection, comprehensive regimeLaw No. 27 of 2022 on Personal Data Protection, State Gazette 2022 No. 196, signed and promulgated 17 October 2022 2022-10-17
Law on Personal Data Protection, cross-border transferLaw No. 27 of 2022 on Personal Data Protection, Article 56 2022-10-17
Law on Personal Data Protection, enforcement and private right to sueLaw No. 27 of 2022 on Personal Data Protection, Articles 12, 57-58 2022-10-17
Iran ir 1 instrument
Electronic Commerce Law (2003), Personal Data ChapterElectronic Commerce Law, approved by the Islamic Consultative Assembly, 2003, Arts. 58-61 (personal-data chapter) 2004-01-01
Ireland ie 7 instruments
DPC Guidance: AI, Large Language Models and Data ProtectionData Protection Commission, "AI, Large Language Models and Data Protection" guidance (18 July 2024) 2024-07-18
Data Protection Act 2018Data Protection Act 2018 (No. 7 of 2018) 2018-05-25
GDPR Article 22, Automated Decision-Making in IrelandRegulation (EU) 2016/679, Art. 22, as transposed by the Data Protection Act 2018 2018-05-25
GDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in IrelandRegulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117 2018-05-25
GDPR Article 9 and Data Protection Act 2018 Section 46, Special Categories and Employment Biometric Data in IrelandRegulation (EU) 2016/679, Art. 9; Data Protection Act 2018 §46 2018-05-25
GDPR Articles 33-34, Breach Notification in IrelandRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from IrelandRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Israel il 6 instruments
Privacy Protection (Transfer of Data to Databases Abroad) Regulations, cross-border transferPrivacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 [future]
Protection of Privacy Law, biometric identifier definition and security-level tieringProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions 2025-08-14
Protection of Privacy Law, breach notification dutyPrivacy Protection Regulations (Data Security), 5777-2017, Art. 11(d)(1); Protection of Privacy Law, 5741-1981, monetary sanctions schedule item (21) 2018-05-08
Protection of Privacy Law, comprehensive regime and database registrationProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, 5784-2024, Arts. 1-2, 4, 7-8A 2025-08-14
Protection of Privacy Law, data subject rightsProtection of Privacy Law, 5741-1981, Arts. 13, 13A, 14 [future]
Protection of Privacy Law, enforcement, DPO duty and private rights of actionProtection of Privacy Law, 5741-1981, as amended by Amendment No. 13, Arts. 15A, 17B1-17B3, 29A, 31B, Chapters D3-D4 2025-08-14
Italy it 7 instruments
Codice Privacy (Personal Data Protection Code), as Amended for GDPR AlignmentDecreto Legislativo 30 giugno 2003, n. 196, as amended by Decreto Legislativo 10 agosto 2018, n. 101 2018-09-19
GDPR Article 22 and the Garante's OpenAI/ChatGPT EnforcementRegulation (EU) 2016/679, Art. 22; Garante Provvedimento 30 marzo 2023 2018-05-25
GDPR Article 82 and Azione di Classe (Codice di Procedura Civile Art. 840-bis)Regulation (EU) 2016/679, Art. 82; Codice di procedura civile, Art. 840-bis (as reformed by Legge 12 aprile 2019, n. 31) 2018-05-25
GDPR Article 9 Special Categories and Codice Privacy Article 167(2)Regulation (EU) 2016/679, Art. 9; D.Lgs. 196/2003, Art. 167(2) 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) 2018-05-25
Garante Provvedimento n. 146/2019, Genetic, Health, and Biometric Data PrescriptionsGarante Provvedimento n. 146 del 5 giugno 2019 2019-06-05
Jamaica jm 1 instrument
Data Protection Act, 2020, comprehensive data-protection regime and automated decision-takingData Protection Act, 2020 (Act 7 of 2020) not recorded
Japan jp 5 instruments
Act on the Protection of Personal Information, breach notificationAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26 2022-04-01
Act on the Protection of Personal Information, comprehensive regime and lawful basisAct No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 15, 20, 25 2022-04-01
Act on the Protection of Personal Information, cross-border transferAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28 2022-04-01
Act on the Protection of Personal Information, enforcementAct No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII 2022-04-01
Act on the Protection of Personal Information, individual identification code and biometric provisionsAct No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 2022-04-01
Jordan jo 6 instruments
Personal Data Protection Law, breach notificationLaw No. 24 of 2023, Art. 20 2024-03-17
Personal Data Protection Law, comprehensive regime and lawful basisLaw No. 24 of 2023, Arts. 1-2, 11 2024-03-17
Personal Data Protection Law, cross-border transferLaw No. 24 of 2023, Art. 14 2024-03-17
Personal Data Protection Law, data subject rightsLaw No. 24 of 2023, data subject rights list 2024-03-17
Personal Data Protection Law, enforcement and data subject remediesLaw No. 24 of 2023, Arts. 21-22 2024-03-17
Personal Data Protection Law, sensitive personal data and biometric dataLaw No. 24 of 2023, Art. 2 definitions 2024-03-17
Kazakhstan kz 6 instruments
Code of Administrative Offences, personal data violationsCode of the Republic of Kazakhstan on Administrative Offences No. 235-V (2014), Art. 79 2015-01-01
Law on Personal Data and Their Protection, biometric data provisionsLaw No. 94-V (21 May 2013), Arts. 7(12), 11(3), 12(2) 2013-11-25
Law on Personal Data and Their Protection, breach notificationLaw No. 94-V (21 May 2013), Art. 25(2) 2013-11-25
Law on Personal Data and Their Protection, comprehensive regime and lawful basesLaw No. 94-V (21 May 2013), as amended through Law No. 256-VIII (09.01.2026), Arts. 1, 4-9 2013-11-25
Law on Personal Data and Their Protection, data subject rightsLaw No. 94-V (21 May 2013), Art. 24; Art. 8(7); Art. 19-1 2013-11-25
Law on Personal Data and Their Protection, localization and cross-border transferLaw No. 94-V (21 May 2013), Arts. 12(2), 16 2013-11-25
Kenya ke 7 instruments
Data Protection (General) Regulations, 2021Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50 2022-01-14
Data Protection Act, 2019Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) 2019-11-25
Data Protection Act, 2019, enforcement, penalties and compensationData Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74) 2019-11-25
Data Protection Act, 2019, personal data breach notificationData Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach) 2019-11-25
Data Protection Act, 2019, rights of data subjects and automated decision-makingData Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-38 (rights of data subjects, including automated individual decision-making, s. 35) 2019-11-25
Data Protection Act, 2019, sensitive personal dataData Protection Act, 2019 (No. 24 of 2019), Part V (ss. 44-47) 2019-11-25
Data Protection Act, 2019, transfer of personal data outside KenyaData Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54) 2019-11-25
Kiribati ki 1 instrument
Data Protection Act 2025Data Protection Act 2025 [future]
Kosovo xk 1 instrument
Law No. 06/L-082 on Protection of Personal DataLaw No. 06/L-082 on Protection of Personal Data (Albanian: Ligji Nr. 06/L-082 per Mbrojtjen e te Dhenave Personale) 2019-02-25
Kuwait kw 1 instrument
CITRA Data Privacy Protection RegulationCITRA Decision No. 26 of 2024 (amending or superseding Decision No. 42 of 2021) [future]
Kyrgyzstan kg 4 instruments
Digital Code, comprehensive personal data regimeDigital Code, Law No. 178 (18 June 2025), in force 6 February 2026, Chapter 11, Arts. 78, 88 2026-02-06
Digital Code, cross-border transfer of personal dataDigital Code, Law No. 178, Art. 89 2026-02-06
Digital Code, sectoral regulator for personal dataDigital Code, Law No. 178, Art. 90 (State Agency for Protection of Personal Data) 2026-02-06
Digital Code, special categories of personal dataDigital Code, Law No. 178, Art. 80 2026-02-06
Latvia lv 6 instruments
GDPR Article 22 and Data Subject Rights as Applied in LatviaRegulation (EU) 2016/679, Arts. 15-22 2018-05-25
GDPR Articles 33-34, Breach Notification in LatviaRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and DVI Enforcement in LatviaRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from LatviaRegulation (EU) 2016/679, Arts. 44-50 2018-05-25
Personal Data Processing Law (Fizisko personu datu apstrades likums)Fizisko personu datu apstrades likums, Latvijas Vestnesis No. 132 (2018), in force 5 July 2018 2018-07-05
Personal Data Processing Law Article 25(2), Special Categories in LatviaFizisko personu datu apstrades likums, Art. 25(2); Regulation (EU) 2016/679, Art. 9 2018-07-05
Lebanon lb 1 instrument
Law No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)Law No. 81, Official Gazette of Lebanon, promulgated 10 October 2018 (in force 31 March 2019), Arts. 85-106 (Part V, Personal Data Protection) 2019-03-31
Lesotho ls 1 instrument
Data Protection Act, 2011 (Act No. 5 of 2012)Data Protection Act, 2011 (Act No. 5 of 2012) 2012-02-22
Liberia lr 2 instruments
Data Protection Act of LiberiaAn Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia) [future]
Telecommunications Act of 2007, Protection of Personal Information (§§ 51-52)Telecommunications Act of 2007, §§ 51-52 (Protection of Personal Information) not recorded
Libya ly 1 instrument
Law No. 6 of 2022, protection of personal data collected in electronic transactionsLaw No. 6 of 2022 Concerning Electronic Transactions, arts. 73-79 (Protection of Personal Data) 2022-10-04
Liechtenstein li 6 instruments
DSG Automated-Decision Rights in LiechtensteinDSG, LGBl. 2018 Nr. 272, automated decision provisions 2019-01-01
DSG Breach Notification in LiechtensteinDSG, LGBl. 2018 Nr. 272, breach notification provisions 2019-01-01
DSG Cross-Border Transfer Chapter and EEA Joint Committee Decision No. 154/2018Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272; EEA Joint Committee Decision No. 154/2018 2019-01-01
DSG Datenschutzstelle Enforcement in LiechtensteinDSG, LGBl. 2018 Nr. 272, enforcement provisions 2019-01-01
DSG Special-Category Data and Datenschutzstelle Biometric-Data Concept in LiechtensteinDSG, LGBl. 2018 Nr. 272, special categories provisions 2019-01-01
Datenschutzgesetz (DSG)Datenschutzgesetz (DSG), LGBl. 2018 Nr. 272, dated 4 October 2018, in effect 1 January 2019 2019-01-01
Lithuania lt 6 instruments
GDPR Article 22 and Data Subject Rights as Applied in LithuaniaRegulation (EU) 2016/679, Arts. 15-22 2018-05-25
GDPR Article 9, Special Categories of Personal Data as Applied in LithuaniaRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 33-34, Breach Notification in LithuaniaRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and VDAI Enforcement in LithuaniaRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V and VDAI Article 46(3) Authorization, Cross-Border Transfer from LithuaniaRegulation (EU) 2016/679, Arts. 44-50 2018-05-25
Law on Legal Protection of Personal DataRepublic of Lithuania Law No. XIII-1426, in force 16 July 2018 (as amended) 2018-07-16
Luxembourg lu 6 instruments
Act of 1 August 2018 on the Organisation of the CNPD and the General Data Protection FrameworkLoi du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees et du regime general sur la protection des donnees 2018-08-20
GDPR Article 22, Automated Decisions as Applied in LuxembourgRegulation (EU) 2016/679, Art. 22 2018-05-25
GDPR Article 9, Special Categories of Personal Data as Applied in LuxembourgRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 33-34, Breach Notification in LuxembourgRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and CNPD Enforcement in LuxembourgRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from LuxembourgRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Madagascar mg 1 instrument
Law No. 2014-038, protection of personal dataLoi n° 2014-038 sur la protection des données à caractère personnel 2015-01-09
Malawi mw 2 instruments
Data Protection Act, 2024Data Protection Act, 2024 [future]
Electronic Transactions and Cyber Security Act, 2016, data protection and privacy (Part VII)Electronic Transactions and Cyber Security Act, 2016, Part VII (ss. 71-74) 2017-06-01
Malaysia my 6 instruments
Personal Data Protection Act, biometric data definition and sensitive categoryAct 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force 2025-04-01 2025-04-01
Personal Data Protection Act, comprehensive regime and lawful basesAct 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727 2013-11-15
Personal Data Protection Act, cross-border transferAct 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force 2025-04-01 2025-04-01
Personal Data Protection Act, data portabilityAct 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force 2025-06-01 2025-06-01
Personal Data Protection Act, data protection officer and breach notificationAct 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force 2025-06-01 2025-06-01
Personal Data Protection Act, enforcementAct 709 (Malaysia) ss.5(2), 12B(3) 2013-11-15
Mali ml 1 instrument
Loi n° 2013-015, protection des données à caractère personnelLoi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali, telle que modifiée 2013-06-28
Malta mt 6 instruments
Data Protection Act, Chapter 586 of the Laws of MaltaData Protection Act, Cap. 586 2018-05-25
GDPR Article 22 and Cap. 586, Automated Decisions in MaltaRegulation (EU) 2016/679, Art. 22; Data Protection Act, Cap. 586 2018-05-25
GDPR Article 9 and Cap. 586, Genetic, Biometric and Health Data Research Processing in MaltaRegulation (EU) 2016/679, Art. 9; Data Protection Act, Cap. 586 2018-05-25
GDPR Articles 33-34, Breach Notification in MaltaRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Articles 82-83 and IDPC Enforcement in MaltaRegulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from MaltaRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Marshall Islands mh 2 instruments
Criminal Code 2011, Violation of Privacy (unlawful eavesdropping, surveillance, and breach of privacy of messages)Criminal Code 2011, 31 MIRC Ch. 1, sec. 250.12 2011-10-17
Personal Data Protection Act 2025, government personal-data protection regimePersonal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43) 2025-10-07
Mauritania mr 1 instrument
Loi n° 2017-020, protection des données à caractère personnelLoi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel 2017-07-22
Mauritius mu 6 instruments
Data Protection Act 2017, enforcement, offences and penaltiesData Protection Act 2017 (Act No. 20 of 2017), ss. 9, 42-43, 51-54 (enforcement, offences and penalties) 2018-01-15
Data Protection Act 2017, establishment and lawful processingData Protection Act 2017 (Act No. 20 of 2017), ss. 1-28, 30 (establishment, principles, lawful processing, and personal data of a child) 2018-01-15
Data Protection Act 2017, personal data breach notificationData Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach) 2018-01-15
Data Protection Act 2017, rights of data subjectsData Protection Act 2017 (Act No. 20 of 2017), ss. 37-41 (rights of data subjects, including automated individual decision making, s. 38) 2018-01-15
Data Protection Act 2017, special categories of personal dataData Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data) 2018-01-15
Data Protection Act 2017, transfer of personal data outside MauritiusData Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius) 2018-01-15
Mexico mx 1 instrument
Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Nueva Ley publicada en el Diario Oficial de la Federación el 20 de marzo de 2025, última reforma DOF 14-11-2025 2025-03-21
Moldova md 1 instrument
Law No. 195/2024 on Personal Data ProtectionLegea Nr. 195 din 25 iulie 2024 privind protectia datelor cu caracter personal, effective 23 August 2026 (Law No. 195 of 25 July 2024) 2026-08-23
Monaco mc 1 instrument
Loi sur la Protection des Donnees PersonnellesLoi n. 1.565 du 3 decembre 2024 relative a la protection des donnees a caractere personnel, Journal de Monaco n. 8725 2024-12-13
Mongolia mn 7 instruments
Law on Protection of Personal Data, biometric information definition and legacy fingerprint destructionLaw on Protection of Personal Data (17 December 2021), Art. 4.1.1; Art. 31 2022-05-01
Law on Protection of Personal Data, breach notificationLaw on Protection of Personal Data (17 December 2021), Art. 25.1.3; Art. 10.5 2022-05-01
Law on Protection of Personal Data, comprehensive regimeLaw on Protection of Personal Data (17 December 2021), in force 1 May 2022, Arts. 1-4 2022-05-01
Law on Protection of Personal Data, cross-border transferLaw on Protection of Personal Data (17 December 2021), Art. 14 2022-05-01
Law on Protection of Personal Data, data subject rightsLaw on Protection of Personal Data (17 December 2021), Art. 16; Art. 15 2022-05-01
Law on Protection of Personal Data, enforcementLaw on Protection of Personal Data (17 December 2021), Arts. 24-26, 28, 30 2022-05-01
Law on Protection of Personal Data, sensitive personal informationLaw on Protection of Personal Data (17 December 2021), Arts. 4.1.12, 9 2022-05-01
Montenegro me 1 instrument
Law on Personal Data ProtectionOfficial Gazette of Montenegro Nos. 79/08, 70/09, 44/12, 22/17 and 77/24, as amended [future]
Morocco ma 1 instrument
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataLoi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009) not recorded
Mozambique mz 1 instrument
Electronic Transactions Law, Protection of Personal Electronic DataLei n.º 3/2017, de 9 de Janeiro, arts. 63 a 65 (Transacções Electrónicas) not recorded
Myanmar mm 1 instrument
Cybersecurity Law, digital platform data retention and disclosure dutyCybersecurity Law, State Administration Council Law No. 1/2025, ss.33-34 [future]
Nauru nr 1 instrument
Communications and Broadcasting Act 2018, confidentiality of subscriber information and communicationsCommunications and Broadcasting Act 2018 (No. 21 of 2018), ss. 48-49, 70 2018-05-10
Nepal np 4 instruments
Privacy Act, 2075, correction rightPrivacy Act, 2075 (2018), Act Number 14 of 2075, s.28 2018-09-18
Privacy Act, 2075, enforcement and compensationPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.29-32 2018-09-18
Privacy Act, 2075, general privacy and collection regimePrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.1(2), 12(3), 23, 24, 26(1) 2018-09-18
Privacy Act, 2075, sensitive information and biometric dataPrivacy Act, 2075 (2018), Act Number 14 of 2075, ss.2(c)(6), 11(2)(f), 12(4)(e), 19(3), 27 2018-09-18
Netherlands nl 7 instruments
AP Enforcement, GDPR Article 82 and the WAMCA Collective-Action RegimeRegulation (EU) 2016/679, Arts. 82-83; UAVG, Arts. 16-18; Wet Afwikkeling Massaschade in Collectieve Actie (WAMCA) 2018-05-25
GDPR Articles 33-34 and UAVG Article 42, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; UAVG, Art. 42 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) 2018-05-25
GDPR and UAVG Articles 40-43, Data-Subject Rights and Journalistic ExceptionRegulation (EU) 2016/679, Arts. 12-23; UAVG, Arts. 40, 41, 43 2018-05-25
UAVG Article 29, Biometric-Data Exception for Authentication or SecurityUAVG, Art. 29 2018-05-25
UAVG Articles 30-33 and 46, Health, Criminal-Conviction, and National-ID-Number DataUAVG, Arts. 30-33, 46 2018-05-25
Uitvoeringswet Algemene verordening gegevensbescherming (UAVG), GDPR Implementation ActWet van 16 mei 2018, houdende regels ter uitvoering van de Algemene verordening gegevensbescherming (BWBR0040940) 2018-05-25
New Zealand nz 5 instruments
Privacy Act 2020, Compliance Notices and OffencesPrivacy Act 2020 (NZ), No 31, ss. 123, 126, 130, 212 2020-12-01
Privacy Act 2020, Information Privacy Principle 12 (Disclosure Outside New Zealand)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 12) 2020-12-01
Privacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)Privacy Act 2020 (NZ), No 31, s. 22 (IPP 3A), inserted by the Privacy Amendment Act 2025 (NZ), No 53, s. 4 2026-05-01
Privacy Act 2020, Information Privacy Principles and Extraterritorial ReachPrivacy Act 2020 (NZ), No 31, ss. 4, 22 (IPP 1, 2, 13) 2020-12-01
Privacy Act 2020, Notifiable Privacy BreachesPrivacy Act 2020 (NZ), No 31, ss. 112-118 2020-12-01
Nicaragua ni 1 instrument
Ley No. 787, Ley de Proteccion de Datos PersonalesLey No. 787, 29-Mar-2012; Gaceta Oficial No. 61 2012-03-29
Niger ne 1 instrument
Loi n° 2022-59, protection des données à caractère personnelLoi n° 2022-59, protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024 not recorded
Nigeria ng 1 instrument
Nigeria Data Protection Act, 2023 (NDPA), general data protection dutiesNigeria Data Protection Act, 2023 (No. 37 of 2023) 2023-06-12
North Macedonia mk 1 instrument
Law on Personal Data Protection (LPDP)Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020, fully applicable 24 August 2021 2021-08-24
Norway no 6 instruments
Personal Data Act (personopplysningsloven)Lov om behandling av personopplysninger (personopplysningsloven), LOV-2018-06-15-38, in force 20 July 2018 2018-07-20
Personal Data Act Chapter 3 and GDPR Article 9, Special Categories in Norwaypersonopplysningsloven, special categories chapter (Chapter 3) 2018-07-20
Personal Data Act Chapter 7, Datatilsynet Enforcement in Norwaypersonopplysningsloven, enforcement chapter (Chapter 7) 2018-07-20
Personal Data Act and GDPR Chapter V, Cross-Border Transfer from Norwaypersonopplysningsloven LOV-2018-06-15-38, transfer provisions 2018-07-20
Personal Data Act, Breach Notification in Norwaypersonopplysningsloven LOV-2018-06-15-38, breach notification provisions 2018-07-20
Personal Data Act, Data Subject Rights in Norwaypersonopplysningsloven LOV-2018-06-15-38, data subject rights provisions 2018-07-20
Oman om 6 instruments
Personal Data Protection Law, biometric and sensitive data prior permitRoyal Decree No. 6/2022, Arts. 1, 5 2023-02-13
Personal Data Protection Law, breach notificationRoyal Decree No. 6/2022, breach notification provision 2023-02-13
Personal Data Protection Law, comprehensive regime and scopeRoyal Decree No. 6/2022, Arts. 3-4, 7 2023-02-13
Personal Data Protection Law, cross-border transferRoyal Decree No. 6/2022, Art. 23 2023-02-13
Personal Data Protection Law, data subject rightsRoyal Decree No. 6/2022, Art. 11 2023-02-13
Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. 6/2022, Art. 8, penalties provisions 2023-02-13
Panama pa 1 instrument
Ley 81 de 2019, Sobre Protección de Datos PersonalesLey No. 81 de 26 de marzo de 2019, Sobre Protección de Datos Personales, Gaceta Oficial No. 28743-A 2021-03-29
Paraguay py 2 instruments
Ley N° 6534/2020, de Protección de Datos Personales CrediticiosLey N° 6534, del año 2020, de Protección de Datos Personales Crediticios 2020-10-27
Ley N° 7593/2025, de Protección de Datos Personales en la República del ParaguayLey N° 7593/2025, de Protección de Datos Personales en la República del Paraguay 2027-11-27[future]
Peru pe 1 instrument
Ley 29733, Ley de Protección de Datos PersonalesLey No. 29733, Ley de Protección de Datos Personales (2011), as amended by Decreto Legislativo 1353 (2017) 2011-07-03
Philippines ph 5 instruments
Data Privacy Act of 2012, breach notificationRepublic Act No. 10173 (2012), Section 20(f) 2012-08-15
Data Privacy Act of 2012, comprehensive regime and lawful processing criteriaRepublic Act No. 10173 (2012), Sections 3, 12, 13 2012-08-15
Data Privacy Act of 2012, cross-border transfer accountabilityRepublic Act No. 10173 (2012), Section 21 2012-08-15
Data Privacy Act of 2012, data subject rightsRepublic Act No. 10173 (2012), Sections 16-18 2012-08-15
Data Privacy Act of 2012, enforcement and restitutionRepublic Act No. 10173 (2012), Sections 25-37 2012-08-15
Poland pl 6 instruments
Act on the Protection of Personal Data of 10 May 2018Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych, Dz.U. 2018 poz. 1000 2018-05-25
GDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric DataRegulation (EU) 2016/679, Art. 9(1); Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b) 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) 2018-05-25
GDPR Data-Subject Rights, Act Articles 92-97Regulation (EU) 2016/679, Arts. 12-23; Ustawa z 10 maja 2018 r., Arts. 92-97 2018-05-25
UODO Enforcement, GDPR Article 82, and Act Articles 98, 101-108Regulation (EU) 2016/679, Art. 83; Ustawa z 10 maja 2018 r., Arts. 98, 101-108 2018-05-25
Portugal pt 6 instruments
CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in PortugalCNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Article 22 and Lei 58/2019, Automated Decisions in PortugalRegulation (EU) 2016/679, Art. 22; Lei n.o 58/2019, de 8 de agosto 2018-05-25
GDPR Article 9, Special Categories of Personal Data as Applied in PortugalRegulation (EU) 2016/679, Art. 9 2018-05-25
GDPR Articles 33-34, Breach Notification in PortugalRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer of Personal Data from PortugalRegulation (EU) 2016/679, Arts. 44-49 2018-05-25
Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execucao do RGPD)Lei n.o 58/2019, de 8 de agosto 2019-08-08
Qatar qa 5 instruments
Personal Data Privacy Protection Law, breach notificationLaw No. 13 of 2016, Arts. 13-14 2017-01-01
Personal Data Privacy Protection Law, comprehensive regimeLaw No. 13 of 2016, Chapter One 2017-01-01
Personal Data Privacy Protection Law, cross-border data flowLaw No. 13 of 2016, Art. 15 2017-01-01
Personal Data Privacy Protection Law, enforcement and penaltiesLaw No. 13 of 2016, Arts. 23-26 2017-01-01
Personal Data Privacy Protection Law, special-nature personal dataLaw No. 13 of 2016, Art. 16 2017-01-01
Republic of the Congo cg 1 instrument
Law No. 29-2019 on the Protection of Personal DataLoi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnel, Journal Officiel n° 45-2019 du jeudi 7 novembre 2019 not recorded
Romania ro 6 instruments
ANSPDCP Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 2018-05-25
GDPR Article 9 and Law 190/2018 Automated Decision-Making and CNP RulesRegulation (EU) 2016/679, Art. 9; Legea nr. 190/2018, automated decision-making and national identification number provisions [future]
GDPR Articles 12-22, Data-Subject Rights and Electronic Employee MonitoringRegulation (EU) 2016/679, Arts. 12-22; Legea nr. 190/2018, electronic monitoring of employees 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
Law No. 190/2018 on Measures for the Implementation of Regulation (EU) 2016/679Legea nr. 190/2018 privind masuri de punere in aplicare a Regulamentului (UE) 2016/679 2018-07-31
Russia ru 7 instruments
Criminal Code Article 272.1, Illegal Collection, Storage, Use, or Transfer of Personal DataCriminal Code of the Russian Federation, Art. 272.1, added by Federal Law No. 421-FZ, in force 11 December 2024 2024-12-11
Federal Law No. 152-FZ "On Personal Data"Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" (as amended) 2006-07-27
Federal Law No. 152-FZ, Article 18(5), Data Localization and Cross-Border Transfer, as Amended by Federal Law No. 23-FZFederal Law No. 152-FZ, Art. 12, Art. 18(5), as amended by Federal Law No. 23-FZ of 28 February 2025 2025-07-01
Federal Law No. 152-FZ, Article 21 Part 3.1, Breach NotificationFederal Law No. 152-FZ, Art. 21, part 3.1, added by Federal Law No. 266-FZ (in force 1 September 2022) 2022-09-01
Federal Law No. 152-FZ, Articles 10-11, Special Categories and the Biometric Data DefinitionFederal Law No. 152-FZ, Art. 10-11 2006-07-27
Federal Law No. 152-FZ, Articles 14-17, Data Subject RightsFederal Law No. 152-FZ, Art. 14-17 2006-07-27
Federal Law No. 572-FZ, Unified Biometric System for Identification and AuthenticationFederal Law No. 572-FZ of 29 December 2022 "On the identification and/or authentication of individuals using biometric personal data" 2023-06-01
Rwanda rw 1 instrument
Law relating to the Protection of Personal Data and PrivacyLaw N° 58 of 2021 relating to the Protection of Personal Data and Privacy 2021-10-15
Saint Kitts and Nevis kn 1 instrument
Data Protection Act, 2018Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018) [future]
Saint Lucia lc 1 instrument
Data Protection ActAct 11 of 2011 (as amended by Act 2 of 2015), Laws of Saint Lucia, ss. 1-4, 32-43 and Schedule 2 2023-01-31
Samoa ws 3 instruments
National Digital Identification Act 2024, personal data breach notificationNational Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification) 2024-02-05
National Digital Identification Act 2024, registered persons' data-subject rightsNational Digital Identification Act 2024, No. 3 (Samoa), s. 51 (registered persons' rights) 2024-02-05
Telecommunications Act 2005, confidentiality and protection of customer personal informationTelecommunications Act 2005, No. 20 (Samoa), ss. 48-51, 75A-75B (confidentiality and protection of customer personal information) 2005-07-27
San Marino sm 1 instrument
San Marino Law No. 171 on the Protection of Natural PersonsLegge 21 dicembre 2018 n. 171, sulla tutela delle persone fisiche con riguardo al trattamento dei dati personali 2018-12-21
Saudi Arabia sa 5 instruments
Personal Data Protection Law, breach notificationRoyal Decree No. M/19, Art. 20 2023-09-14
Personal Data Protection Law, comprehensive regime and lawful basisRoyal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12 2023-09-14
Personal Data Protection Law, cross-border transferRoyal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdom 2023-09-14
Personal Data Protection Law, enforcement and penaltiesRoyal Decree No. M/19, Arts. 35-36 2023-09-14
Personal Data Protection Law, sensitive data and biometric processingRoyal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a) 2023-09-14
Senegal sn 1 instrument
Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel 2008-01-25
Serbia rs 1 instrument
Law on Personal Data ProtectionZakon o zastiti podataka o licnosti (Law on Personal Data Protection), Official Gazette RS No. 87/2018 2019-08-21
Seychelles sc 6 instruments
Data Protection Act, 2023, application and processing principlesData Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles) 2023-12-22
Data Protection Act, 2023, cross-border data flowsData Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows) 2023-12-22
Data Protection Act, 2023, enforcement and penaltiesData Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties) 2023-12-22
Data Protection Act, 2023, personal data breach notificationData Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach) 2023-12-22
Data Protection Act, 2023, rights of data subjectsData Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights) 2023-12-22
Data Protection Act, 2023, sensitive data and data of minorsData Protection Act, 2023 (Act 24 of 2023), ss. 22-24 (processing special categories of personal data) 2023-12-22
Singapore sg 5 instruments
Personal Data Protection Act, comprehensive consent-based regimeAct 26 of 2012 (Singapore), as amended by the Personal Data Protection (Amendment) Act 2020, Act 40 of 2020 2021-02-01
Personal Data Protection Act, cross-border transferPersonal Data Protection Act 2012, s.26 2014-07-02
Personal Data Protection Act, data breach notificationPersonal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020 2021-02-01
Personal Data Protection Act, data subject rightsPersonal Data Protection Act 2012, ss.21-22 2014-07-02
Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 2022-10-01
Slovakia sk 6 instruments
Act on the Protection of Personal DataZakon c. 18/2018 Z. z. o ochrane osobnych udajov a o zmene a doplneni niektorych zakonov 2018-05-25
GDPR Article 9 and Act Section 78, National Birth NumberRegulation (EU) 2016/679, Art. 9; Zakon c. 18/2018 Z. z., section 78 [future]
GDPR Articles 12-22, Data-Subject RightsRegulation (EU) 2016/679, Arts. 12-22 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
Office for Personal Data Protection Enforcement and GDPR Article 82Regulation (EU) 2016/679, Arts. 82-83 2018-05-25
Slovenia si 6 instruments
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5)(c) 2018-05-25
GDPR Data-Subject Rights and ZVOP-2 Article 11, Judicial ProtectionRegulation (EU) 2016/679, Arts. 12-22; ZVOP-2, Art. 11 2018-05-25
Informacijski Pooblascenec Enforcement, GDPR Article 82, and ZVOP-2 Articles 114-116Regulation (EU) 2016/679, Art. 82; ZVOP-2, Arts. 105, 114-116 2018-05-25
ZVOP-2 Chapter 4 (Articles 81-84) and Article 80, Biometric and Genetic DataZVOP-2, Arts. 80-84, 105 2023-01-26
Zakon o varstvu osebnih podatkov (ZVOP-2), Personal Data Protection ActZakon o varstvu osebnih podatkov (ZVOP-2), Uradni list RS, st. 163/22 2023-01-26
Solomon Islands sb 1 instrument
Telecommunications Act 2009, Confidentiality and Consent DutiesTelecommunications Act 2009 (Solomon Islands), Part 11 (Relations with Consumers), ss. 71-76 not recorded
Somalia so 1 instrument
Data Protection Act No. 005 of 2023Data Protection Act, Law No. 005 of 2023 (Federal Republic of Somalia) not recorded
South Africa za 1 instrument
Protection of Personal Information Act 4 of 2013 (POPIA)Protection of Personal Information Act 4 of 2013 (POPIA) 2020-07-01
South Korea kr 7 instruments
PIPC Guideline on Processing Publicly Available Data for AI Development and ServicesPIPC Guideline (issued 2024-07-18), applying Personal Information Protection Act (Act No. 10465, as amended), Art. 15(1)(6) 2024-07-18
Personal Information Protection Act, breach notification dutiesAct No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40 2023-09-15
Personal Information Protection Act, comprehensive regime and lawful basesAct No. 10465 (Mar. 29, 2011), as amended by Act No. 19234 (Mar. 14, 2023), Art. 15 2023-09-15
Personal Information Protection Act, cross-border transfer restrictionsAct No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11 2023-09-15
Personal Information Protection Act, data subject rights and automated decisionsAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37, 37-2 2024-03-15
Personal Information Protection Act, enforcement and private civil remedyAct No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 2023-09-15
Personal Information Protection Act, sensitive information and biometric dataAct No. 10465 (as amended by Act No. 19234, 2023), Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Art. 18 2023-09-15
Spain es 6 instruments
AEPD Enforcement, GDPR Article 82 and LOPDGDD Titulo IXRegulation (EU) 2016/679, Arts. 82-83; LOPDGDD, Art. 47, Arts. 70-78 2018-05-25
GDPR Article 9 and AEPD Biometric Guidance, Special CategoriesRegulation (EU) 2016/679, Art. 9; LOPDGDD, Art. 9 2018-12-07
GDPR Articles 33-34 and LOPDGDD Article 69, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34; LOPDGDD, Art. 69, Art. 73(r)-(s) 2018-05-25
LOPDGDD Titulo III and Titulo X, Data-Subject and Digital RightsLOPDGDD, Arts. 11-18, 93-96 2018-12-07
LOPDGDD Titulo VI, International Transfers, Layered on GDPR Chapter VRegulation (EU) 2016/679, Arts. 44-49, 83(5); LOPDGDD, Arts. 40-43, 72.1(l) 2018-05-25
Ley Organica 3/2018 (LOPDGDD), GDPR-Aligned Comprehensive RegimeLey Organica 3/2018, de 5 de diciembre, de Proteccion de Datos Personales y garantia de los derechos digitales (BOE-A-2018-16673) 2018-12-07
Sri Lanka lk 6 instruments
Personal Data Protection Act, Data Protection Authority and penaltiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.35, 38 2025-03-18
Personal Data Protection Act, breach notification dutiesPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.23 2025-03-18
Personal Data Protection Act, comprehensive regime and lawful basisPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, Schedule I, ss.5, 18(1), 20-25 2025-03-18
Personal Data Protection Act, cross-border transfer of personal dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.26 2025-03-18
Personal Data Protection Act, data subject rightsPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, ss.13-19 2025-03-18
Personal Data Protection Act, special categories and biometric dataPersonal Data Protection Act, No. 9 of 2022, as amended by Act No. 22 of 2025, s.56, Schedule II 2025-03-18
State of Palestine ps 1 instrument
Palestinian Basic Law (Amended 2003), Privacy and Remedy ProvisionsPalestinian Basic Law (Amended) 2003, Arts. 17 and 32 2003-03-18
Sweden se 7 instruments
Dataskyddslagen (Data Protection Act), GDPR-Complementing ProvisionsDataskyddslagen, SFS 2018:218 2018-05-25
Dataskyddslagen Chapter 7, Data-Subject Rights and Appeal RoutesDataskyddslagen, ch. 7 2018-05-25
GDPR Article 9, Dataskyddslagen Chapter 3, and the IMY Skelleftea Facial-Recognition DecisionRegulation (EU) 2016/679, Art. 9; Dataskyddslagen, ch. 3; IMY decision Di-2019-2221 2018-05-25
GDPR Articles 33-34, Breach NotificationRegulation (EU) 2016/679, Arts. 33-34 2018-05-25
GDPR Chapter V, Cross-Border Transfer RestrictionsRegulation (EU) 2016/679, Arts. 44-49, 83(5) 2018-05-25
IMY Enforcement, GDPR Article 82, Dataskyddslagen Chapter 6-7, and Group ProceedingsRegulation (EU) 2016/679, Arts. 82-83; Dataskyddslagen, ch. 6-7; Lag (2002:599) om grupprattegang 2018-05-25
Kamerabevakningslagen (Camera Surveillance Act)Kamerabevakningslag, SFS 2018:1200 2018-08-01
Switzerland ch 6 instruments
FADP Article 24, Breach Notification in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 24 2023-09-01
FADP Article 5 lit. c, Sensitive Personal Data Including Biometric DataFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 5 lit. c, Art. 6 para. 7, Art. 22 2023-09-01
FADP Articles 16-17, Cross-Border Transfer of Personal Data from SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 16-17 2023-09-01
FADP Articles 25-32, Data Subject Rights in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 25-32 2023-09-01
FADP Articles 43, 60-65, FDPIC Supervision and Criminal Sanctions in SwitzerlandFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 43, 60-65 2023-09-01
Federal Act on Data Protection (nFADP), General Processing PrinciplesFederal Act on Data Protection (nFADP / revDSG / nLPD), SR 235.1, Art. 1-4, 6, 30-31 2023-09-01
Syria sy 1 instrument
Law No. 12 of 2024 on Protection of Electronic Personal DataLaw No. 12 of 2024 (Syrian Arab Republic), issued by presidential decree [future]
São Tomé and Príncipe st 1 instrument
Lei n.º 03/2016, Protecção de Dados PessoaisLei n.º 03/2016, de 15 de Fevereiro de 2016, sobre a Protecção de Dados Pessoais not recorded
Tajikistan tj 5 instruments
Law on the Protection of Personal Data, biometric personal dataLaw No. 1537 (3 August 2018), Art. 17; Art. 1; Art. 11 2018-08-03
Law on the Protection of Personal Data, comprehensive regimeLaw No. 1537 (3 August 2018), Arts. 1-3, 5, 8-9 2018-08-03
Law on the Protection of Personal Data, data subject rightsLaw No. 1537 (3 August 2018), Art. 8; Arts. 19-20 2018-08-03
Law on the Protection of Personal Data, enforcementLaw No. 1537 (3 August 2018), Arts. 6-7 2018-08-03
Law on the Protection of Personal Data, localization and cross-border transferLaw No. 1537 (3 August 2018), Art. 14; Art. 18 2018-08-03
Tanzania tz 6 instruments
Personal Data Protection Act, 2022Personal Data Protection Act, 2022 (Act No. 11 of 2022), ss. 1-5, 14, 21-26 (principles, application and registration) 2023-05-01
Personal Data Protection Act, 2022, investigation, enforcement and offencesPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VII (ss. 39-50, investigation and enforcement) and Part IX (ss. 60-64, offences and general penalty) 2023-05-01
Personal Data Protection Act, 2022, rights of data subjectsPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part VI (ss. 33-38, rights of data subjects, including automated decision-making, s. 36, and compensation, s. 37) 2023-05-01
Personal Data Protection Act, 2022, security and breach notificationPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 27 (security of personal data) 2023-05-01
Personal Data Protection Act, 2022, sensitive personal dataPersonal Data Protection Act, 2022 (Act No. 11 of 2022), s. 30 (prohibition on processing of sensitive personal data) 2023-05-01
Personal Data Protection Act, 2022, transborder data flowPersonal Data Protection Act, 2022 (Act No. 11 of 2022), Part V (ss. 31-32, transfer of personal data to states with and without adequate data protection) 2023-05-01
Thailand th 5 instruments
Personal Data Protection Act, breach notificationPersonal Data Protection Act B.E. 2562 (2019), Section 37(4) 2022-06-01
Personal Data Protection Act, comprehensive regimePersonal Data Protection Act B.E. 2562 (2019), Government Gazette Vol. 136, Special Issue 69 Kor, fully enforceable 2022-06-01 2022-06-01
Personal Data Protection Act, cross-border transferPersonal Data Protection Act B.E. 2562 (2019), Section 28 2022-06-01
Personal Data Protection Act, enforcement and private right of actionPersonal Data Protection Act B.E. 2562 (2019), Sections 77, 78, 84-88 2022-06-01
Personal Data Protection Act, sensitive and biometric categoriesPersonal Data Protection Act B.E. 2562 (2019), Section 26 2022-06-01
The Bahamas bs 3 instruments
Data Protection Act 2003, Commissioner, enforcement and penaltiesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 14-16, 18-29 (the Data Protection Commissioner, enforcement notices and offences) 2007-04-02
Data Protection Act 2003, application and processing principlesData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, ss. 1-13 (application and data protection principles) 2007-04-02
Data Protection Act 2003, cross-border transfer of personal dataData Protection (Privacy of Personal Information) Act, Ch. 324A, Laws of The Bahamas, s. 17 (prohibition on transfer of personal data outside The Bahamas) 2007-04-02
The Gambia gm 1 instrument
Personal Data Protection and Privacy Act, 2025Personal Data Protection and Privacy Act, 2025 [future]
Timor-Leste tl 1 instrument
Constitution of the Democratic Republic of Timor-Leste, Section 38 (Protection of personal data)Constitution of the Democratic Republic of Timor-Leste (2002), Section 38 2002-05-20
Togo tg 1 instrument
Loi n° 2019-014, protection des données à caractère personnelLoi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel not recorded
Tonga to 1 instrument
Privacy Act 2025, comprehensive personal information protection regimePrivacy Act 2025 (Act 34 of 2025) [future]
Trinidad and Tobago tt 1 instrument
Data Protection Act, 2011Act No. 13 of 2011 (Data Protection Act), Chap. 22:04 [future]
Tunisia tn 1 instrument
Organic Act on the Protection of Personal DataLoi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel 2004-07-30
Turkey tr 6 instruments
Personal Data Protection Law (KVKK), breach notificationLaw No. 6698, Art. 12(5) 2016-04-07
Personal Data Protection Law (KVKK), comprehensive regime and lawful basisLaw No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10 2016-04-07
Personal Data Protection Law (KVKK), cross-border transferLaw No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3 2024-09-01
Personal Data Protection Law (KVKK), data subject rightsLaw No. 6698, Art. 11 2016-04-07
Personal Data Protection Law (KVKK), enforcement and compensationLaw No. 6698, Arts. 11(1)(g), 18 2016-04-07
Personal Data Protection Law (KVKK), special categories and biometric dataLaw No. 6698, Art. 6, as amended by Law No. 7499 (2 March 2024) 2024-03-02
Turkmenistan tm 5 instruments
Law on Information About Private Life, biometric informationLaw No. 519-V (20 March 2017), Arts. 1(1), 7(7), 11(2) 2017-07-01
Law on Information About Private Life, comprehensive regimeLaw No. 519-V (20 March 2017), in force 1 July 2017, Arts. 1, 6-9 2017-07-01
Law on Information About Private Life, enforcementLaw No. 519-V (20 March 2017), Arts. 28(2), 29, 31, 32 2017-07-01
Law on Information About Private Life, localization and cross-border transferLaw No. 519-V (20 March 2017), Arts. 12, 17 2017-07-01
Law on Information About Private Life, special categories of personal informationLaw No. 519-V (20 March 2017), Art. 21 2017-07-01
Uganda ug 1 instrument
Data Protection and Privacy Act, 2019, comprehensive personal-data regimeData Protection and Privacy Act, 2019 (Chapter 97) 2019-05-03
Ukraine ua 1 instrument
Law of Ukraine On the Protection of Personal DataZakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force 1 January 2011 (Law of Ukraine No. 2297-VI) 2011-01-01
United Arab Emirates ae 7 instruments
ADGM Data Protection Regulations, breach notificationADGM Data Protection Regulations 2021, personal data breach notification provisions 2021-02-14
ADGM Data Protection Regulations, comprehensive regimeADGM Data Protection Regulations 2021 (consolidated February 2024) 2021-02-14
DIFC Data Protection Law, comprehensive regimeDIFC Law No. 5 of 2020 2020-07-01
Federal Decree-Law on the Protection of Personal Data, breach notificationFederal Decree-Law No. 45 of 2021, Art. 9 2022-01-02
Federal Decree-Law on the Protection of Personal Data, comprehensive regime and lawful basisFederal Decree-Law No. 45 of 2021, Arts. 1, 4 2022-01-02
Federal Decree-Law on the Protection of Personal Data, cross-border transferFederal Decree-Law No. 45 of 2021, Arts. 22-23 2022-01-02
Federal Decree-Law on the Protection of Personal Data, enforcement and supervisionFederal Decree-Law No. 45 of 2021, Arts. 25-26 2022-01-02
United Kingdom gb 7 instruments
Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22DData (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425 2026-02-05
R (Bridges) v Chief Constable of South Wales Police, Automated Facial Recognition by PoliceR (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058 2020-08-11
UK GDPR Article 82, Data Protection Act 2018 Section 169, and ICO EnforcementUK GDPR, Arts. 82-83; Data Protection Act 2018 §169 2018-05-25
UK GDPR Article 9, Special Categories of Personal Data Including Biometric DataUK GDPR, Art. 9; Data Protection Act 2018, Sch. 1 2018-05-25
UK GDPR Articles 33-34 and PECR, Breach Notification in the United KingdomUK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025 2018-05-25
UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United KingdomUK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025 2018-05-25
UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18 2018-05-25
United States us 8 instruments
Children's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments16 CFR Part 312, as amended effective June 23, 2025 2000-04-21
DOJ Data Security Program (Bulk Sensitive Personal Data Rule)28 CFR Part 202 2025-04-08
FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement)15 U.S.C. Section 45 1914-09-26
GLBA Safeguards Rule Breach Notification Amendment16 CFR Section 314.4(j) 2024-05-13
HIPAA Breach Notification Rule45 CFR Part 164, Subpart D (Sections 164.400-164.414) 2009-09-23
HIPAA Privacy Rule45 CFR Part 164, Subpart E (Sections 164.500-164.534) 2003-04-14
TAKE IT DOWN ActPub. L. 119-12, S. 146, 119th Cong. (2025) 2026-05-19
Video Privacy Protection Act18 U.S.C. Section 2710 1988-11-05
Uruguay uy 1 instrument
Ley N° 18.331, Personal Data Protection and Habeas Data Law, as amendedLey N° 18.331, de 11 de agosto de 2008, arts. 37-40 según Ley N° 19.670, de 2018, y Decreto N° 64/020, de 2020 not recorded
Uzbekistan uz 6 instruments
Law on Personal Data, biometric and genetic dataLaw No. ZRU-547 (2 July 2019), Art. 26 2019-10-01
Law on Personal Data, comprehensive regime and lawful basesLaw No. ZRU-547 (2 July 2019), Arts. 1-14, 18-23, 28, 30-31 2019-10-01
Law on Personal Data, cross-border transfer and citizen data localizationLaw No. ZRU-547 (2 July 2019), Art. 15; Art. 27-1 (added 2021, in force April 2021) 2019-10-01
Law on Personal Data, data subject rightsLaw No. ZRU-547 (2 July 2019), Art. 30 2019-10-01
Law on Personal Data, enforcementLaw No. ZRU-547 (2 July 2019), Art. 33 2019-10-01
Law on Personal Data, special personal dataLaw No. ZRU-547 (2 July 2019), Art. 25 2019-10-01
Vanuatu vu 1 instrument
Data Protection and Privacy Act 2024, comprehensive personal data protection regimeData Protection and Privacy Act No. 13 of 2024 (Vanuatu) 2025-01-02
Vatican City State va 1 instrument
General Regulation on the Protection of Personal Data for Vatican City StateDecreto n. DCLVII del 30 aprile 2024 (ad experimentum, three-year period) 2024-04-30
Venezuela ve 2 instruments
Constitución de la República Bolivariana de Venezuela, Arts. 28 and 60 (habeas data and right to privacy)Constitución de la República Bolivariana de Venezuela, Gaceta Oficial Extraordinaria N° 36.860, 30 de diciembre de 1999, arts. 28 y 60 1999-12-30
Ley Especial contra los Delitos Informáticos, privacy of personal data and communications (Arts. 20-22)LECDI, Gaceta Oficial N° 37.313, 30/10/2001, arts. 20-22 2001-11-29
Vietnam vn 5 instruments
Law on Personal Data Protection, biometric and location data protectionLaw No. 91/2025/QH15, Article 31 2026-01-01
Law on Personal Data Protection, breach notificationLaw No. 91/2025/QH15, Article 23 2026-01-01
Law on Personal Data Protection, comprehensive regimeLaw No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, 26 June 2025, in force 1 January 2026 2026-01-01
Law on Personal Data Protection, cross-border transferLaw No. 91/2025/QH15, Article 20 2026-01-01
Law on Personal Data Protection, enforcement and data subject rightsLaw No. 91/2025/QH15, enforcement and data subject rights provisions 2026-01-01
Zambia zm 1 instrument
Data Protection Act, 2021, personal data processing frameworkData Protection Act, 2021 (Act No. 3 of 2021) 2021-04-01
Zimbabwe zw 2 instruments
Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024 (Statutory Instrument 155 of 2024) 2024-09-13
Cyber and Data Protection Act [Chapter 12:07]Cyber and Data Protection Act, No. 5 of 2021 (Zimbabwe) 2022-03-11

United States: states, territories and cities203 in 57 places

Law made below the national level, binding inside it. The slug beside each name says which tier it is.

Stage Instrument In force from
Alabama us/al 5 instruments
Alabama Data Breach Notification Act of 2018Ala. Code sec. 8-38-1 et seq. (Act 2018-396) [future]
Alabama Personal Data Protection Act (HB 351), Attorney General enforcementAla. HB 351, 2026 Regular Session, Sec. 11 2027-05-01[future]
Alabama Personal Data Protection Act (HB 351), consumer rightsAla. HB 351, 2026 Regular Session, Secs. 5-6 2027-05-01[future]
Alabama Personal Data Protection Act (HB 351), general applicability and scopeAla. HB 351, 2026 Regular Session, Secs. 1-4 2027-05-01[future]
Alabama Personal Data Protection Act (HB 351), sensitive data and biometric consentAla. HB 351, 2026 Regular Session, Sec. 7(b)(2), Sec. 2(3), Sec. 2(21) 2027-05-01[future]
Alaska us/ak 2 instruments
Alaska Personal Information Protection Act, breach notification dutyAlaska Stat. Secs. 45.48.010-45.48.070 [future]
Alaska Personal Information Protection Act, violations and enforcementAlaska Stat. Sec. 45.48.080 [future]
Arizona us/az 1 instrument
Arizona data breach notification lawA.R.S. secs. 18-551 to 18-552 [future]
Arkansas us/ar 1 instrument
Arkansas Personal Information Protection Act, breach notification and securityArk. Code Ann. secs. 4-110-101 to 4-110-108 [future]
California us/ca 6 instruments
CCPA Cybersecurity Audit RegulationsCal. Code Regs. tit. 11, Sections 7120 to 7124 2026-01-01
CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-OutCal. Civ. Code sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.125, 1798.130 2020-01-01
CCPA/CPRA Enforcement: California Privacy Protection Agency and Private Right of ActionCal. Civ. Code sections 1798.150, 1798.155, 1798.199.10, 1798.199.90 2023-07-01
CCPA/CPRA Sensitive Personal Information and Biometric DataCal. Civ. Code section 1798.140(c), (ae); section 1798.121 2023-01-01
California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA) 2020-01-01
California Data Breach Notification Law, as amended by SB 446Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319) 2026-01-01
Colorado us/co 5 instruments
C.R.S. 6-1-716, Notification of Security BreachC.R.S. section 6-1-716 2018-09-01
HB 24-1058, Protect Privacy of Biological DataC.R.S. sections 6-1-1303(2.5), 6-1-1303(16.7), 6-1-1303(24)(b)-(d) (2024 Colo. Sess. Laws ch. 68) 2024-08-07
HB 24-1130, Privacy of Biometric Identifiers and DataC.R.S. sections 6-1-1303(2.2)-(2.4), 6-1-1314 (2024 Colo. Sess. Laws ch. 313) 2025-07-01
SB 21-190, Colorado Privacy Act (CPA)C.R.S. sections 6-1-1301 et seq. 2023-07-01
SB 24-041, Protecting Minors' Online DataC.R.S. sections 6-1-1305.5, 6-1-1308.5, 6-1-1309.5, 6-1-1311(1)(d)(II) (2024 Colo. Sess. Laws ch. 296) 2025-10-01
Connecticut us/ct 5 instruments
Breach of security re computerized data containing personal informationConn. Gen. Stat. § 36a-701b [future]
Connecticut Data Privacy Act (CTDPA), general applicability and controller/processor dutiesConn. Gen. Stat. §§ 42-515, 42-524 2023-07-01
Connecticut Data Privacy Act, Attorney General enforcementConn. Gen. Stat. § 42-525 2023-07-01
Connecticut Data Privacy Act, consumer rightsConn. Gen. Stat. § 42-518 2023-07-01
Connecticut Data Privacy Act, sensitive data and biometric data definitionsConn. Gen. Stat. § 42-515(4), (38) 2023-07-01
Delaware us/de 5 instruments
Computer Security BreachesDel. Code Ann. tit. 6, §§ 12B-101 to 12B-104 [future]
Delaware Personal Data Privacy Act (DPDPA), general applicability and controller/processor dutiesDel. Code Ann. tit. 6, §§ 12D-101, 12D-104 to 12D-109 2025-01-01
Delaware Personal Data Privacy Act, Department of Justice enforcementDel. Code Ann. tit. 6, § 12D-111 2025-01-01
Delaware Personal Data Privacy Act, consumer rightsDel. Code Ann. tit. 6, § 12D-104 2025-01-01
Delaware Personal Data Privacy Act, sensitive data and biometric data definitionsDel. Code Ann. tit. 6, § 12D-102(3), (30) 2025-01-01
District of Columbia us/dc 1 instrument
Consumer Security Breach NotificationD.C. Code §§ 28-3851 to 28-3853 (Title 28, Chapter 38, Subchapter II) 2007-07-01
Florida us/fl 5 instruments
Florida Digital Bill of Rights, Department of Legal Affairs enforcementFla. Stat. § 501.72 2024-07-01
Florida Digital Bill of Rights, consumer rightsFla. Stat. §§ 501.705, 501.706, 501.707 2024-07-01
Florida Digital Bill of Rights, general applicability and large-platform thresholdFla. Stat. §§ 501.701, 501.702(9) 2024-07-01
Florida Digital Bill of Rights, sensitive data and biometric data definitionsFla. Stat. §§ 501.702(4), 501.702(31), 501.71(2)(d) 2024-07-01
Florida Information Protection Act, breach notificationFla. Stat. § 501.171 [future]
Georgia us/ga 2 instruments
Georgia Fair Business Practices Act, civil action by individualsO.C.G.A. Sec. 10-1-399 [future]
Georgia Personal Identity Protection Act, notification of security breachO.C.G.A. Sec. 10-1-912 [future]
Guam us/gu 2 instruments
Guam Uniform Civil Remedies for Unauthorized Disclosure of Intimate Images Act of 20197 GCA §§ 53101-53108 not recorded
Notification of Breaches of Personal Information9 GCA §§ 48.10-48.80 not recorded
Hawaii us/hi 3 instruments
Hawaii Security Breach of Personal Information Act, notice of security breachHaw. Rev. Stat. Secs. 487N-1, 487N-2 [future]
Hawaii Security Breach of Personal Information Act, penalties and civil actionHaw. Rev. Stat. Sec. 487N-3 [future]
Hawaii Uniform Deceptive Trade Practices Act, private injunctive reliefHaw. Rev. Stat. Sec. 481A-4 [future]
Idaho us/id 5 instruments
Genetic Testing Privacy Act, enforcementIdaho Code § 39-8304 [future]
Genetic Testing Privacy Act, restrictions on employersIdaho Code § 39-8303 [future]
Identity Theft Act, breach notification enforcement and penaltiesIdaho Code § 28-51-107 [future]
Identity Theft Act, breach of security disclosure dutyIdaho Code § 28-51-105 [future]
Student Data Accessibility, Transparency and Accountability Act (SDATAA)Idaho Code § 33-133 [future]
Illinois us/il 3 instruments
BIPA Private Right of Action and 2024 Damages Amendment (SB 2979 / P.A. 103-0769)740 ILCS 14/20, as amended by P.A. 103-0769 (SB 2979), eff. 2024-08-02 2023-02-02
Biometric Information Privacy Act (BIPA)740 ILCS 14/1, 14/5, 14/10, 14/15, 14/25 (P.A. 95-994, eff. 2008-10-03, as amended by P.A. 103-0769, eff. 2024-08-02) 2008-10-03
Personal Information Protection Act, data breach notification815 ILCS 530/1 et seq. (P.A. 94-36, eff. 2006-01-01) 2006-01-01
Indiana us/in 5 instruments
Disclosure of Security Breach ActInd. Code §§ 24-4.9-3-1, 24-4.9-3-3, 24-4.9-4-1, 24-4.9-4-2 [future]
Indiana Consumer Data Protection Act (INCDPA), general applicability and controller dutiesInd. Code §§ 24-15-1-1, 24-15-4-1, 24-15-11-1 2026-01-01
Indiana Consumer Data Protection Act, Attorney General enforcementInd. Code §§ 24-15-10-1 to 24-15-10-4 2026-01-01
Indiana Consumer Data Protection Act, consumer rightsInd. Code § 24-15-3-1 2026-01-01
Indiana Consumer Data Protection Act, sensitive data and biometric data definitionsInd. Code §§ 24-15-2-4, 24-15-2-28, 24-15-4-1(5) 2026-01-01
Iowa us/ia 5 instruments
Iowa Consumer Data Protection Act (ICDPA), general applicability and controller/processor dutiesIowa Code ch. 715D, §§ 715D.2, 715D.4, 715D.5 2025-01-01
Iowa Consumer Data Protection Act, Attorney General enforcementIowa Code § 715D.8 2025-01-01
Iowa Consumer Data Protection Act, consumer rightsIowa Code § 715D.3 2025-01-01
Iowa Consumer Data Protection Act, sensitive data and biometric data definitionsIowa Code § 715D.1(4), (26) 2025-01-01
Personal Information Security Breach ProtectionIowa Code § 715C.2 [future]
Kansas us/ks 7 instruments
Genetic testing nondiscrimination in health-benefit insurance underwritingK.S.A. 40-2259 [future]
Kansas Breach Notification Act, enforcementK.S.A. 50-7a02(g)-(h) [future]
Kansas Breach Notification Act, notice of security breachK.S.A. 50-7a02(a)-(f) [future]
Student Data Privacy Act, biometric data collection consentK.S.A. 72-6315 [future]
Student Data Privacy Act, breach notice for student dataK.S.A. 72-6318 [future]
Student Data Privacy Act, definitions of biometric dataK.S.A. 72-6313 [future]
Student Data Privacy Act, enforcementK.S.A. 72-6317 [future]
Kentucky us/ky 5 instruments
Kentucky Consumer Data Protection Act (KCDPA), general applicability and controller and processor dutiesKRS 367.3611, 367.3613, 367.3617, 367.3619 2026-01-01
Kentucky Consumer Data Protection Act, Attorney General enforcementKRS 367.3627 2026-01-01
Kentucky Consumer Data Protection Act, consumer rightsKRS 367.3615 2026-01-01
Kentucky Consumer Data Protection Act, sensitive data and biometric data definitionsKRS 367.3611(28), 367.3611(3), 367.3617 2026-01-01
Notification to affected persons of computer security breachKRS 365.732 2014-07-15
Louisiana us/la 8 instruments
Database Security Breach Notification Law, definitionsLa. R.S. 51:3073 2006-01-01
Database Security Breach Notification Law, notice dutyLa. R.S. 51:3074(C), (E), (I) 2006-01-01
Database Security Breach Notification Law, unfair trade practice deemingLa. R.S. 51:3074(J), 51:1405(A) [future]
Louisiana Data Privacy Act (Act No. 502), Attorney General enforcementLa. R.S. 51:1780.5 2027-01-01[future]
Louisiana Data Privacy Act (Act No. 502), applicability and controller dutiesLa. R.S. 51:1780.1, 1780.2, 1780.4 2027-01-01[future]
Louisiana Data Privacy Act (Act No. 502), consumer rightsLa. R.S. 51:1780.3 2027-01-01[future]
Louisiana Data Privacy Act (Act No. 502), sensitive and biometric dataLa. R.S. 51:1780.1(3), (29) 2027-01-01[future]
Unfair Trade Practices and Consumer Protection Law, private right of action for a breach-notice violationLa. R.S. 51:1409(A) [future]
Maine us/me 2 instruments
Broadband internet access service, customer personal information privacy35-A M.R.S. sec. 9301 [future]
Notice of Risk to Personal Data10 M.R.S. secs. 1347-1349 [future]
Maryland us/md 5 instruments
Maryland Online Data Privacy Act (MODPA), Attorney General enforcement and cure periodMd. Code Ann., Com. Law §§ 14-4713, 14-4714 2025-10-01
Maryland Online Data Privacy Act (MODPA), consumer rights and appealMd. Code Ann., Com. Law § 14-4705 2025-10-01
Maryland Online Data Privacy Act (MODPA), general applicability and controller/processor dutiesMd. Code Ann., Com. Law §§ 14-4701, 14-4702 (Title 14, Subtitle 47) 2025-10-01
Maryland Online Data Privacy Act (MODPA), sensitive data and biometric consentMd. Code Ann., Com. Law §§ 14-4701(d), (gg), 14-4707(a) 2025-10-01
Maryland Personal Information Protection Act (MPIPA), breach notificationMd. Code Ann., Com. Law §§ 14-3501, 14-3504 (Title 14, Subtitle 35) [future]
Massachusetts us/ma 4 instruments
Consumer Protection General Regulations, deeming a data-security violation an unfair practice940 CMR 3.16(3); Mass. Gen. Laws ch. 93A, §§ 2, 9 [future]
Security Breach statute, Attorney General enforcementMass. Gen. Laws ch. 93H, § 6 [future]
Security Breach statute, credit monitoring offer requiredMass. Gen. Laws ch. 93H, § 3A [future]
Security Breach statute, duty to report breach of personal informationMass. Gen. Laws ch. 93H, § 3 [future]
Michigan us/mi 6 instruments
Genetic test; informed consentMCL 333.17020 [future]
Identity Theft Protection Act, breach of security notice dutyMCL 445.72 2006-07-02
Identity Theft Protection Act, enforcementMCL 445.72(13)-(15) 2006-07-02
Identity Theft Protection Act, personal information and personal identifying information definedMCL 445.63(q), (r) 2011-04-01
Insurance Data Security Act, no private cause of actionMCL 500.550 2021-01-20
Insurance Data Security Act, nonpublic information including biometric recordsMCL 500.553 2021-01-20
Minnesota us/mn 5 instruments
Minnesota Consumer Data Privacy Act (MCDPA), general applicabilityMinn. Stat. §§ 325M.10 to 325M.21 2025-07-31
Minnesota Consumer Data Privacy Act, Attorney General enforcementMinn. Stat. § 325M.20 2025-07-31
Minnesota Consumer Data Privacy Act, consumer rights and profilingMinn. Stat. § 325M.14 2025-07-31
Minnesota Consumer Data Privacy Act, sensitive data and biometric consentMinn. Stat. §§ 325M.11, 325M.16 2025-07-31
Minnesota breach notificationMinn. Stat. § 325E.61 [future]
Mississippi us/ms 4 instruments
Breach notification law, notice of security breachMiss. Code Ann. § 75-24-29(2)-(3) 2011-07-01
Breach notification law, unfair trade practice deeming and enforcementMiss. Code Ann. § 75-24-29(8) 2011-07-01
Insurance Data Security Law, no private cause of actionMiss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 § 2 2019-07-01
Insurance Data Security Law, nonpublic information including biometric recordsMiss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 § 3(k) 2019-07-01
Missouri us/mo 2 instruments
Genetic information, insurer and employer restrictions, confidentiality dutyMo. Rev. Stat. Secs. 375.1300, 375.1303, 375.1306, 375.1309 1998-08-28
Notice of security breach of personal informationMo. Rev. Stat. Sec. 407.1500 2009-08-28
Montana us/mt 5 instruments
Montana Consumer Data Privacy Act (MCDPA), general applicability and controller/processor dutiesMont. Code Ann. §§ 30-14-2803, 30-14-2811, 30-14-2813 2024-10-01
Montana Consumer Data Privacy Act, Attorney General enforcementMont. Code Ann. §§ 30-14-2817, 30-14-2820 2024-10-01
Montana Consumer Data Privacy Act, consumer rightsMont. Code Ann. § 30-14-2808 2024-10-01
Montana Consumer Data Privacy Act, sensitive data and biometric data definitionsMont. Code Ann. § 30-14-2802(4), (28) 2024-10-01
Notification of security breachMont. Code Ann. § 30-14-1704 [future]
Nebraska us/ne 5 instruments
Nebraska Data Privacy Act (NDPA), general applicability and controller/processor dutiesNeb. Rev. Stat. §§ 87-1101, 87-1107 to 87-1114 2025-01-01
Nebraska Data Privacy Act, Attorney General enforcementNeb. Rev. Stat. §§ 87-1119, 87-1122, 87-1124, 87-1125 2025-01-01
Nebraska Data Privacy Act, consumer rightsNeb. Rev. Stat. § 87-1108 2025-01-01
Nebraska Data Privacy Act, sensitive data and biometric data definitionsNeb. Rev. Stat. § 87-1102(3), (30) 2025-01-01
Nebraska Financial Data Protection and Consumer Notification of Data Security Breach ActNeb. Rev. Stat. § 87-803 [future]
Nevada us/nv 4 instruments
Consumer Health Data, access, disclosure, and deletion rightsNRS 603A.500-515 [future]
Consumer Health Data, biometric data definitionNRS 603A.415, 603A.430 [future]
Online Privacy Notice, opt-out of saleNRS 603A.300-360 [future]
Security breach of personal information, notificationNRS 603A.220 [future]
New Hampshire us/nh 5 instruments
New Hampshire Data Privacy Act (NHDPA), general applicability and controller and processor dutiesRSA 507-H:2, 507-H:6, 507-H:7, 507-H:10 2025-01-01
New Hampshire Data Privacy Act, Attorney General enforcementRSA 507-H:11 2025-01-01
New Hampshire Data Privacy Act, consumer rightsRSA 507-H:4 2025-01-01
New Hampshire Data Privacy Act, sensitive data and biometric data definitionsRSA 507-H:1, IV, XXVIII; RSA 507-H:6 2025-01-01
Notice of Security BreachRSA 359-C:19-21 2007-01-01
New Jersey us/nj 5 instruments
New Jersey Data Privacy Act (NJDPA), general applicability and scopeN.J. Stat. §§ 56:8-166.4 to 56:8-166.19 2025-01-15
New Jersey Data Privacy Act, Division of Consumer Affairs enforcementN.J. Stat. §§ 56:8-166.4 to 56:8-166.19 2025-01-15
New Jersey Data Privacy Act, consumer rights and universal opt-outN.J. Stat. §§ 56:8-166.4 to 56:8-166.19 2025-01-15
New Jersey Data Privacy Act, sensitive data and biometric definitionN.J. Stat. §§ 56:8-166.4 to 56:8-166.19 2025-01-15
New Jersey Identity Theft Prevention Act, breach notificationN.J. Stat. § 56:8-163 2006-01-01
New Mexico us/nm 2 instruments
Data Breach Notification ActNMSA 1978 Secs. 57-12C-1 to 57-12C-12 [future]
Genetic Information Privacy ActNMSA 1978 Secs. 24-21-1 to 24-21-7 [future]
New York us/ny 2 instruments
Stop Hacks and Improve Electronic Data Security (SHIELD) Act, Attorney General enforcementN.Y. Gen. Bus. Law §§ 899-aa(6), 899-bb(2)(d)-(2)(e) 2019-10-23
Stop Hacks and Improve Electronic Data Security (SHIELD) Act, breach notification dutyN.Y. Gen. Bus. Law § 899-aa 2019-10-23
North Carolina us/nc 1 instrument
Identity Theft Protection Act, security breach notificationN.C. Gen. Stat. Secs. 75-61, 75-65 [future]
North Dakota us/nd 1 instrument
Notice of Security Breach for Personal InformationN.D. Cent. Code ch. 51-30 [future]
Northern Mariana Islands us/mp 1 instrument
CNMI Consumer Protection Act, general applicability4 CMC §§ 5101-5123 1990-02-02
Ohio us/oh 1 instrument
Security Breach Notification ActOhio Rev. Code Sec. 1349.19 2007-03-30
Oklahoma us/ok 5 instruments
Oklahoma Consumer Data Privacy Act, Attorney General enforcementOkla. Stat. tit. 75A, Secs. 312-313 2027-01-01[future]
Oklahoma Consumer Data Privacy Act, consumer rightsOkla. Stat. tit. 75A, Secs. 301-303 2027-01-01[future]
Oklahoma Consumer Data Privacy Act, general applicability and exemptionsOkla. Stat. tit. 75A, Secs. 314-315 2027-01-01[future]
Oklahoma Consumer Data Privacy Act, sensitive data and biometric data definitionsOkla. Stat. tit. 75A, Sec. 300(3), (29) 2027-01-01[future]
Security Breach Notification ActOkla. Stat. tit. 24, Secs. 162-166 2008-11-01
Oregon us/or 5 instruments
Notice of breach of securityORS 646A.604 [future]
Oregon Consumer Privacy Act (OCPA), general applicability and controller dutiesORS 646A.570, 646A.578 2024-07-01
Oregon Consumer Privacy Act, Attorney General enforcementORS 646A.589 2024-07-01
Oregon Consumer Privacy Act, consumer rightsORS 646A.574, 646A.576, 646A.578 2024-07-01
Oregon Consumer Privacy Act, sensitive data and biometric data definitionsORS 646A.570(3), (18) 2024-07-01
Pennsylvania us/pa 1 instrument
Breach of Personal Information Notification Act73 P.S. secs. 2302, 2303, 2305, 2308 (Act 94 of 2005) 2006-06-20
Puerto Rico us/pr 3 instruments
Código Penal de Puerto Rico, delitos contra el derecho a la intimidad (unauthorized use and disclosure of personal data records)Ley Núm. 146 de 30 de julio de 2012, según enmendada (Código Penal de Puerto Rico), Arts. 172-175; 33 L.P.R.A. §§ 5238-5241 2012-09-01
Ley de Información al Ciudadano sobre la Seguridad de Bancos de Información (data breach notification)Ley Núm. 111 de 7 de septiembre de 2005, según enmendada; 10 L.P.R.A. §§ 4051-4055 not recorded
Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)Ley Núm. 185 de 27 de agosto de 2024 2025-03-01
Rhode Island us/ri 5 instruments
Identity Theft Protection Act of 2015, notification of breachR.I. Gen. Laws secs. 11-49.3-4, 11-49.3-5 [future]
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), general applicabilityR.I. Gen. Laws ch. 6-48.1, secs. 6-48.1-2, 6-48.1-5, 6-48.1-6 2026-01-01
Rhode Island Data Transparency and Privacy Protection Act, customer rightsR.I. Gen. Laws secs. 6-48.1-5, 6-48.1-6 2026-01-01
Rhode Island Data Transparency and Privacy Protection Act, enforcementR.I. Gen. Laws sec. 6-48.1-8 2026-01-01
Rhode Island Data Transparency and Privacy Protection Act, sensitive data and biometric data definitionsR.I. Gen. Laws sec. 6-48.1-2(26), (3) 2026-01-01
South Carolina us/sc 4 instruments
Age-Appropriate Design Code, enforcementS.C. Code Ann. sec. 39-80-80 (Act No. 96 of 2026, H. 3431) 2026-02-05
Age-Appropriate Design Code, sensitive personal data and biometric dataS.C. Code Ann. sec. 39-80-10(18) (Act No. 96 of 2026, H. 3431) 2026-02-05
Business data breach of security, notification statuteS.C. Code Ann. sec. 39-1-90 2009-07-01
South Carolina Age-Appropriate Design Code, general applicability and minor-protective design dutiesS.C. Code Ann. secs. 39-80-10 et seq. (Act No. 96 of 2026, H. 3431) 2026-02-05
South Dakota us/sd 3 instruments
Breach of system security, notification statuteSDCL secs. 22-40-19 to 22-40-26 (SL 2018 ch. 135) 2018-07-01
Genetic Data Privacy Act, definitions, consent, and consumer rightsSDCL secs. 37-24-59 to 37-24-61 (SB 49, SL 2026 ch. 164, secs. 1-3) 2026-07-01
Genetic Data Privacy Act, enforcementSDCL sec. 37-24-63 (SL 2026 ch. 164, sec. 5) 2026-07-01
Tennessee us/tn 4 instruments
Tennessee Information Protection Act (TIPA), general applicabilityTenn. Code Ann. §§ 47-18-3201 to 47-18-3214 2025-07-01
Tennessee Information Protection Act, Attorney General enforcement and NIST safe harborTenn. Code Ann. §§ 47-18-3201 to 47-18-3214 2025-07-01
Tennessee Information Protection Act, consumer rightsTenn. Code Ann. §§ 47-18-3201 to 47-18-3214 2025-07-01
Tennessee Information Protection Act, sensitive data and biometric definitionTenn. Code Ann. §§ 47-18-3201 to 47-18-3214 2025-07-01
Texas us/tx 6 instruments
Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025) 2009-04-01
Identity Theft Enforcement and Protection Act, breach notificationTex. Bus. & Com. Code sec. 521.053, as amended by Tex. SB 768, 88th Legislature (2023) 2009-04-01
Texas Data Privacy and Security Act (HB 4), general applicability and scopeTex. Bus. & Com. Code ch. 541, secs. 541.001-541.002 2024-07-01
Texas Data Privacy and Security Act, Attorney General enforcementTex. Bus. & Com. Code secs. 541.151, 541.154-541.156 2024-07-01
Texas Data Privacy and Security Act, consumer rights and assessmentsTex. Bus. & Com. Code secs. 541.051-541.053, 541.105 2024-07-01
Texas Data Privacy and Security Act, sensitive data and biometric consentTex. Bus. & Com. Code secs. 541.001, 541.101(b)(4) 2024-07-01
United States Virgin Islands us/vi 1 instrument
Disclosure of Breach of Security (Identity Theft and Privacy Protection)14 V.I.C. §§ 2208-2209 not recorded
Utah us/ut 6 instruments
Genetic Information Privacy ActUtah Code 13-60-101 et seq. 2023-05-03
Genetic sequencing, storage of genetic information (HB 182)Utah Code 26B-2-244 (enacted by HB 182, 2026 General Session) 2028-01-01[future]
Motor Vehicle Data PrivacyUtah Code 13-61-501 to 13-61-504 2027-01-01[future]
Protection of Personal Information ActUtah Code 13-44-101 et seq. 2024-05-01
Utah Consumer Privacy ActUtah Code 13-61-101 et seq. 2023-12-31
Utah Consumer Privacy Act, sensitive and biometric data provisionsUtah Code 13-61-101(6), 13-61-101(32)(a)(ii), 13-61-302(3) 2023-12-31
Vermont us/vt 5 instruments
Security Breach Notice Act9 V.S.A. sec. 2435 2007-01-01
Vermont Data Privacy and Online Surveillance Act, Attorney General enforcement9 V.S.A. sec. 2415j; 2026 Vt. Acts & Resolves Act 145, Secs. 2-3 2028-01-01[future]
Vermont Data Privacy and Online Surveillance Act, consumer rights9 V.S.A. sec. 2415d 2028-01-01[future]
Vermont Data Privacy and Online Surveillance Act, general applicability9 V.S.A. secs. 2415a, 2415b 2028-01-01[future]
Vermont Data Privacy and Online Surveillance Act, sensitive data and biometric data definitions9 V.S.A. sec. 2415a(b)(3), (47) 2028-01-01[future]
Virginia us/va 5 instruments
Breach of personal information notificationVa. Code Ann. § 18.2-186.6 [future]
Virginia Consumer Data Protection Act (VCDPA), general applicability and controller/processor dutiesVa. Code Ann. §§ 59.1-575, 59.1-576, 59.1-578, 59.1-579 2023-01-01
Virginia Consumer Data Protection Act, Attorney General enforcementVa. Code Ann. §§ 59.1-583, 59.1-584 2023-01-01
Virginia Consumer Data Protection Act, consumer rightsVa. Code Ann. § 59.1-577 2023-01-01
Virginia Consumer Data Protection Act, sensitive data and biometric data definitionsVa. Code Ann. § 59.1-575 2023-01-01
Washington us/wa 3 instruments
HB 1155, My Health My Data ActRCW 19.373; HB 1155, chapter 191, Laws of 2023 2024-03-31
HB 1493, Biometric Privacy LawRCW 19.375; HB 1493, chapter 299, Laws of 2017 2017-07-23
Notice of security breaches involving personal informationRCW 19.255, as amended by HB 1071 (2019 c 241); originally enacted 2005 c 368 2020-03-01
West Virginia us/wv 1 instrument
Breach of Security of Consumer InformationW. Va. Code secs. 46A-2A-101 to 46A-2A-105 [future]
Wisconsin us/wi 1 instrument
Notice of unauthorized acquisition of personal informationWis. Stat. sec. 134.98 [future]
Wyoming us/wy 2 instruments
Breach of the security of a computerized data system, enforcementWyo. Stat. Ann. sec. 40-12-502(f) [future]
Breach of the security of a computerized data system, notification dutyWyo. Stat. Ann. secs. 40-12-501 to 40-12-511 [future]
New York City us/ny/new-york-city 1 instrument
Biometric Identifier Information LawN.Y.C. Admin. Code tit. 22, ch. 12, secs. 22-1201 to 22-1205 (Local Law 3 of 2021) 2021-07-09
Portland us/or/portland 1 instrument
Prohibit the Use of Face Recognition Technologies by Private Entities in Places of Public AccommodationPortland City Code ch. 34.10 (secs. 34.10.010 to 34.10.060) 2021-01-01

What this page claims, and what it does not

The stages are LexLint's own vocabulary. Four of the five boxes are the binding classes the /law/<jurisdiction> docket already draws (In force, Enacted but not yet in force, Proposed, and Repealed, withdrawn or blocked), so a square here and a square there mean the same thing. A struck-down instrument is spent on both readings.

Enjoined has its own box. Inside "Repealed, withdrawn or blocked" it would sit beside a mark that is a false description of a law a court has paused, and it would pool away a count that reads as a signal: how contested a jurisdictional hook is. The certainty ladder files enjoined as present law and the docket draws it spent; splitting it out here makes that disagreement the reader's choice instead of our silent one. It is off by default, which follows the docket.

One date column, and where a bare date would mislead it says what kind of date it is. "In force from" is commencement: the earlier of a published commencement event and the instrument's own effective date, the same choice lifecycle_band() makes and for the same reason, neither source is reliably the commencement, and the earlier one cannot make a law look newer than it is. A bracket qualifies the date where a bare one would mislead ([future] for a start date still ahead, [proposed] for a bill with no commencement to show, [enjoined], [struck down], [repealed], [superseded] or [withdrawn] for a spent instrument). Nothing is inferred from our own review date: a row with neither a date nor a status to explain the gap says "not recorded" instead.

The map is the table. Its fill is the count of instruments at the stages you chose, binned on the same RAMP_BINS edges /law/map uses, and it redraws on every change. Point at, click, or tab to a place for what applies there, every stage it holds shown even when your filter is excluding it.

Three ways of showing nothing, and they are different claims. A place washed pale holds privacy law your filter is excluding, so widening the filter brings it back. A hatched place is one we track and hold no privacy law for at all: that is a statement about our research, not about the law. A white place has no jurisdiction record for this topic at all. Only the first of the three moves when you change the filter; the other two are facts about us and hold still.

Nothing here needs the script. The default resultset is in the HTML: counts, tally, map fills and the hidden rows are all rendered at build. The script recomputes them when a box changes and does nothing else, which is what lets this page ship under script-src 'self' and be read whole by a crawler.