Data is the new economic driver as it brings more value and innovation. The same data can also expose companies to risks if left undiscovered, unmonitored, and unprotected. To ensure organizations are handling and processing users' data transparently, regional privacy regulations have been established globally.
So far, more than 137 countries have established privacy and security regulations that protect residents' data privacy and security. In fact, more local laws have been passed and are soon going into effect, enforcing obligations on data controllers and processors to protect consumers' right to privacy.
Experts at Securiti have compiled a list of key privacy laws that are in force or going into effect soon. It is organized by country and region; for each law you'll find its effective date, region, a short summary and related Securiti resources.
United StatesEffective Date: January 1, 2023
Region: NA (North America)
The California Privacy Rights Act (CPRA) was passed in the November 2020 ballot by 56% of California voters. Amending the California Consumer Privacy Act (CCPA) 2018, the CPRA imposes even more stringent privacy protection obligations on organizations and greatly increases the rights of consumers. The law applies to for-profit businesses that do business in California or serve California residents and meet one of the following criteria: they have gross annual revenue of over $25 million (adjusted for inflation; currently $26,625,000) in the preceding calendar year, or they buy, receive, sell or share the personal information of 100,000 or more California residents or households, or they derive 50% or more of their annual revenue from selling or sharing California residents' personal information. The CPRA took effect on January 1, 2023, and enforcement began on July 1, 2023. The California Privacy Protection Agency's (CPPA) regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on January 1, 2026, with phased compliance dates through 2030.
Resources:
Effective Date: Since January 1, 2020
Region: NA (North America)
The California Consumer Privacy Act (CCPA) governs companies and individuals that collect and process consumers' personal information. The law mandates companies to ensure the secure management of data and gives consumers the right to access and control how their personal information is collected, used, or shared. The law does not require companies to have a physical presence in California. It applies to for-profit entities providing goods and services to California residents that meet threshold criteria. Since 2023, the CCPA has been read as amended by the CPRA.
Resources:
Effective Date: January 1, 2023
Region: NA (North America)
Virginia became the second state in the United States, after California, to pass a comprehensive data privacy law, the Virginia Consumer Data Protection Act (VCDPA). The law provides comprehensive data privacy rights to residents of Virginia and imposes new obligations and duties on businesses managing consumers' personal data. The law is structurally very similar to the CPRA, even if its content diverges. It went into effect on January 1, 2023. The law applies to persons or entities conducting business in the Commonwealth or offering products or services to Virginia residents that meet threshold criteria.
Resources:
Effective Date: July 1, 2023
Region: NA (North America)
Soon after Virginia, Colorado became the third state in the United States to pass a comprehensive data privacy law, the Colorado Privacy Act (the "CPA"). The CPA applies to companies that conduct business in Colorado or sell products or services intentionally targeted to residents of Colorado that meet threshold criteria. The Colorado law is very similar to the VCDPA, with few but significant differences. The law took effect on July 1, 2023. Controllers have had to honor universal opt-out mechanisms since July 1, 2024, and amendments added protections for biometric data (July 1, 2025) and minors' data (October 1, 2025).
Resources:
Effective Date: July 1, 2023
Region: NA (North America)
Connecticut Senate Bill 6: An Act Concerning Personal Data Privacy and Online Monitoring (CTDPA), effective from July 1, 2023, is modeled on the Colorado Privacy Act but includes distinct features such as enhanced privacy rights for children. The CTDPA grants consumers greater control over their personal data, including transparency into who processes and shares their information. It was signed into law by Governor Ned Lamont on May 10, 2022. Amendments under SB 1295 took effect on July 1, 2026, lowering applicability thresholds and expanding the definition of sensitive data.
Resources:
Effective Date: January 1, 2025
Region: NA (North America)
The Delaware Personal Data Privacy Act (DPDPA), signed into law on September 11, 2023, by Governor John Carney, made Delaware the 12th U.S. state with comprehensive data privacy legislation and the 7th to pass such a law in 2023. Similar to the Connecticut Data Privacy Act (CTDPA), with some differences, the DPDPA took effect on January 1, 2025.
Resources:
Effective Date: July 1, 2024
Region: NA (North America)
Florida's Digital Bill of Rights (FDBR), signed into law by Governor Ron DeSantis on June 6, 2023, establishes Florida's data privacy law, effective July 1, 2024. It applies mainly to very large businesses (for example, those with more than $1 billion in annual global revenue that meet additional criteria) operating in Florida or offering products or services to its residents that process or sell personal data.
Resources:
Effective Date: December 31, 2023
Region: NA (North America)
Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA) on March 24, 2022, making Utah the fourth state after California, Virginia, and Colorado to implement comprehensive privacy legislation. The UCPA, which took effect on December 31, 2023, applies to data controllers and processors. Compared to its predecessors, the UCPA takes a lighter, more business-friendly approach to consumer privacy.
Resources:
Effective Date: January 1, 2025
Region: NA (North America)
Iowa became the sixth U.S. state to enact a comprehensive data privacy law, Senate File 262. Passed unanimously and signed by Governor Reynolds on March 28, 2023, the law took effect on January 1, 2025. It applies to businesses handling the personal data of over 100,000 Iowa residents, or 25,000 residents with over 50% of revenue from data sales.
Resources:
Effective Date: January 1, 2026
Region: NA (North America)
Indiana enacted the Indiana Consumer Data Protection Act (ICDPA), becoming the seventh U.S. state with its own data protection law. Modeled after the Virginia Consumer Data Protection Act, the ICDPA was signed into law by Governor Eric Holcomb on May 1, 2023, and took effect on January 1, 2026. It ensures consumer data privacy rights and imposes strict obligations on businesses.
Resources:
Effective Date: January 1, 2026
Region: NA (North America)
Kentucky's Consumer Data Privacy Act (KCDPA), outlined in Senate Bill 15, enhances consumer privacy rights by granting individuals greater control over their personal data and imposing obligations on businesses handling such data. The law took effect on January 1, 2026, marking a significant step in Kentucky's data protection efforts.
Resources:
Effective Date: October 1, 2025
Region: NA (North America)
The Maryland Online Data Privacy Act (MODPA), signed into law on May 9, 2024, introduces strict regulations on the collection, use, and sharing of personal data. Effective October 1, 2025, the law prohibits the sale of sensitive personal data without exception, distinguishing it from other U.S. state privacy laws. It applies to personal data processing activities from April 1, 2026.
Resources:
Effective Date: July 31, 2025
Region: NA (North America)
The Minnesota Consumer Data Privacy Act (MCDPA), signed into law on May 24, 2024, enhances Minnesotans' control over their personal data and imposes strict obligations on businesses regarding data handling. Effective July 31, 2025, the law exempts postsecondary institutions under the Office of Higher Education's regulation until July 31, 2029.
Resources:
Effective Date: October 1, 2024
Region: NA (North America)
The Montana Consumer Data Privacy Act (MCDPA), approved on April 21, 2023, became effective on October 1, 2024. It mandates universal opt-out mechanisms, making it the first such law in a Republican-majority state legislature. Businesses had to comply with these opt-out requirements by January 1, 2025. 2025 amendments, effective October 1, 2025, lowered the applicability thresholds and added protections for minors.
Resources:
Effective Date: January 1, 2025
Region: NA (North America)
Nebraska enacted the Nebraska Data Privacy Act (NDPA) on April 17, 2024, to enhance consumer privacy and impose strict data protection obligations on organizations. Introduced in January 2024, the law ensures consumers have significant control over their data. It took effect on January 1, 2025.
Resources:
Effective Date: October 1, 2019
Region: NA (North America)
The Nevada Privacy of Information Collected on the Internet from Consumers Act (NPICICA), initially enacted in 2017, has been amended through SB-220 (effective October 1, 2019) and SB-260 (effective October 1, 2021). The latest amendment expands the law to include data brokers and broadens the definition of "sale" of personal data, enhancing consumers' opt-out rights. Nevada also has a consumer health data law (SB 370), effective March 31, 2024. Nevada does not have a comprehensive consumer privacy law.
Resources:
Effective Date: January 1, 2025
Region: NA (North America)
On March 6, 2024, New Hampshire enacted the New Hampshire Data Privacy Act (NHDPA), becoming the 14th U.S. state with a comprehensive privacy law. Modeled after other state laws like those in Colorado and California, it grants consumers privacy rights over their personal data. Enforceable by the Attorney General, it includes a 60-day cure period for violations and took effect on January 1, 2025.
Resources:
Effective Date: January 15, 2025
Region: NA (North America)
On January 16, 2024, New Jersey enacted the New Jersey Data Privacy Act (NJDPA), becoming the first state in 2024 and the 13th overall to pass a comprehensive privacy law. Notably, it has broader applicability than other state privacy laws, lacks a private right of action, and does not establish an independent regulatory authority. The law took effect on January 15, 2025.
Resources:
Effective Date: July 1, 2024
Region: NA (North America)
The Oregon Consumer Privacy Act (OCPA), passed by the Senate on June 20, 2023, and the House on June 22, 2023, reflects bipartisan support for stronger privacy protections. Modeled after Connecticut and Virginia laws, it was developed over four years by the Attorney General's Consumer Privacy Task Force. The law took effect on July 1, 2024, and has applied to nonprofit organizations since July 1, 2025.
Resources:
Effective Date: January 1, 2026
Region: NA (North America)
Rhode Island enacted the Data Transparency and Privacy Protection Act (RIDTPPA) on June 25, 2024, becoming the 19th state with a comprehensive data privacy law. Similar to other state privacy laws, it introduces obligations for data controllers but uniquely includes small-scale businesses handling personal data. The law took effect on January 1, 2026.
Resources:
Effective Date: July 1, 2025
Region: NA (North America)
The Tennessee Information Protection Act (TIPA), signed into law on May 11, 2023, introduces comprehensive data privacy regulations, emphasizing affirmative defenses for organizations adopting the NIST Privacy Framework. While sharing provisions with laws in Virginia and Indiana, it stands out by allowing Tennessee courts to award treble damages for willful violations. TIPA took effect on July 1, 2025.
Resources:
Effective Date: July 1, 2024
Region: NA (North America)
The Texas Data Privacy and Security Act (TDPSA), signed into law on June 18, 2023, made Texas the 10th state to enact a comprehensive data privacy law. Modeled after Virginia's Consumer Data Protection Act, the TDPSA took effect on July 1, 2024. Controllers have had to honor opt-out preference signals for data sales and targeted advertising since January 1, 2025.
Resources:
Effective Date: January 1, 2027
Region: NA (North America)
Signed on March 20, 2026, the Oklahoma Consumer Data Privacy Act follows the Virginia model. It is enforced exclusively by the Attorney General, with no private right of action, and requires assessments for higher-risk processing.
Resources:
Effective Date: May 1, 2027
Region: NA (North America)
Signed on April 16, 2026, the Alabama Personal Data Protection Act follows the framework used by most state laws. It is enforced by the Attorney General, with no private right of action and a 45-day cure period.
Resources:
Effective Date: January 1, 2027
Region: NA (North America)
Signed on May 29, 2026, the Louisiana Data Privacy Act is enforced by the Attorney General with a 30-day cure period that sunsets on July 31, 2027, and requires assessments for higher-risk processing.
Resources:
Effective Date: January 1, 2028
Region: NA (North America)
Signed on June 16, 2026, Vermont's law includes restrictions on handling consumer health data and disclosure requirements for training large language models. It is enforced by the Attorney General with a 60-day cure period that sunsets on June 30, 2029.
Resources:
The following entries previously appeared as laws. None of these bills was enacted:
ChinaEffective Date: November 1, 2021
Region: APAC (Asia-Pacific)
China enacted its main data protection regulation, the Personal Information Protection Law (PIPL), on August 20, 2021, and it came into effect on November 1, 2021. PIPL applies to organizations providing services within China and to organizations processing and analyzing personal information of individuals in China from within or outside the country. It imposes several strict obligations on personal information processors and provides extensive rights to individuals. Recent implementing rules include the March 2024 Provisions on Promoting and Regulating Cross-Border Data Flows, the Network Data Security Management Regulations (January 1, 2025), the PI protection compliance audit measures (May 1, 2025) and the cross-border certification measures (January 1, 2026).
Resources:
Effective Date: Since September 1, 2021
Region: APAC (Asia-Pacific)
The DSL applies to and regulates data processing activities by organizations and individuals, and security supervision of such activities within the territory of China. The DSL also regulates data processing activities conducted outside of China that harm China's national security or the public interest, or the legal interests of citizens and organizations in China. It imposes a number of obligations on organizations and individuals, even those that are not based in China, regarding data categorization and classification, data risk controls and risk assessments, cross-border data transfers, and data export controls.
Resources:
Effective Date: Since June 1, 2017 (amended effective January 1, 2026)
Region: APAC (Asia-Pacific)
China's Cybersecurity Law (the "CSL") applies to the operation, maintenance, and use of information networks to protect the legal interests and rights of organizations as well as individuals in China. It also promotes the secure development of technology and the digitization of the economy in China. The CSL imposes several important cybersecurity obligations on network operators. Amendments effective January 1, 2026 raise maximum fines to RMB 10 million and broaden extraterritorial enforcement, and incident-reporting measures in force since November 1, 2025 set deadlines as short as one hour.
Resources:
ThailandEffective Date: June 1, 2022
Region: APAC (Asia-Pacific)
Thailand's first consolidated Personal Data Protection Act (PDPA) aims to guarantee the protection of individuals' personal data and impose obligations on businesses that deal with the collection, use, and disclosure of personal data. The PDPA applies to any organization located inside Thailand and to organizations outside Thailand that deal with the personal data of individuals in Thailand.
Resources:
SwitzerlandEffective Date: September 1, 2023
Region: EMEA (Europe, the Middle East, and Africa)
The revised Swiss Federal Act on Data Protection (FADP) replaced Switzerland's Federal Act on Data Protection of 1992. The revised law expands the definition of sensitive personal data by including genetic and biometric data. Organizations have enhanced information obligations and are required to conduct data protection impact assessments for high-risk data processing activities. The revised FADP came into effect on September 1, 2023.
Resources:
AustraliaEffective Date: Since 1988
Region: APAC (Asia-Pacific)
The Privacy Act has been in force in Australia for more than 35 years. It was enacted to protect the privacy of individuals and regulate how Australian Government agencies and organizations with an annual turnover of more than AUD 3 million handle personal information. It includes 13 Australian Privacy Principles (APPs), which apply to private sector organizations as well as most Australian Government agencies. The Privacy and Other Legislation Amendment Act 2024 created a statutory tort for serious invasions of privacy (from June 10, 2025), requires a Children's Online Privacy Code, and adds transparency duties for automated decisions from December 10, 2026.
Resources:
BahrainEffective Date: Since August 1, 2019
Region: EMEA (Europe, the Middle East and Africa)
The PDPL (Law No. 30 of 2018) applies to every individual normally living or working in Bahrain (not just citizens of Bahrain), every business with a place of business in Bahrain, and individuals and businesses outside Bahrain who collect the personal data of individuals in Bahrain using means available in Bahrain. The PDPL recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate purposes.
Resources:
BrazilEffective Date: Since September 18, 2020
Region: LATAM (Latin America)
Lei Geral de Proteção de Dados (LGPD) is a comprehensive data protection law in Brazil that takes its inspiration from the EU's GDPR. The law applies to the processing of personal data of individuals in Brazil, whether by companies operating inside or outside Brazil, and to public authorities in Brazil. It establishes ten legal bases for processing, as well as accountability requirements, mandatory breach notifications and data subject rights, with heavy penalties for violations. The ANPD now requires security incidents to be reported within three business days (Resolution 15/2024) and its standard contractual clauses for transfers (mandatory since August 23, 2025). In January 2026, the EU and Brazil adopted mutual adequacy decisions.
Resources:
CanadaEffective Date: Since January 1, 2004
Region: NA (North America)
PIPEDA is a federal law that governs the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activities in Canada, and by federal works, undertakings and businesses. It applies in provinces without substantially similar legislation and to federally regulated organizations such as banks, airlines, telecommunication companies and railways. Bill C-27, which would have replaced PIPEDA, died when Parliament was prorogued in January 2025.
Resources:
Effective Date: September 22, 2022 (fully in force since September 22, 2024)
Region: NA (North America)
Law 25 modernized Quebec's private-sector privacy law. It came into effect in three stages: September 22, 2022 (privacy officers, breach reporting and biometrics), September 22, 2023 (most obligations, including privacy impact assessments, default privacy settings and consent rules) and September 22, 2024 (data portability).
Resources:
Hong KongEffective Date: Since 1995
Region: APAC (Asia-Pacific)
The PDPO is the primary legislation in Hong Kong enacted to protect the privacy of individuals' personal data and regulate the collection, holding, processing, disclosure, or use of personal data by organizations. It applies to private and public sector organizations that collect, hold, process or use personal data, irrespective of where processing takes place, provided the data is controlled by a data user based in Hong Kong.
Resources:
IrelandEffective Date: May 24, 2018
Region: EMEA (Europe, the Middle East and Africa)
The Irish DPA 2018 gives further effect to the GDPR in national law, with limited additions. It contains several provisions restricting data subjects' rights under the GDPR, for example where restrictions are necessary for the enforcement of civil law claims.
Resources:
Irish DPA Overview
JapanEffective Date (Amended APPI): April 01, 2022
Region: APAC (Asia-Pacific)
Japan's APPI applies to any business operator handling personal information in Japan, and to foreign business operators that handle personal information of individuals in Japan in connection with supplying goods or services to them. The act protects individuals' rights to privacy while enabling the legitimate use of personal data for economic development.
Resources:
New ZealandEffective Date: December 1, 2020
Region: APAC (Asia-Pacific)
New Zealand's Privacy Act 2020 replaced the Privacy Act 1993. It applies to New Zealand entities and to overseas entities carrying on business in New Zealand, irrespective of their size or location. It introduced mandatory breach notification, including for breaches caused by outsourced third parties, in addition to other obligations. Since May 1, 2026, a new IPP 3A requires agencies to notify individuals when personal information is collected indirectly (Privacy Amendment Act 2025).
Resources:
New Zealand's Privacy Act of 2020
PhilippinesEffective Date: Since 2012
Region: APAC (Asia-Pacific)
The Philippines Data Privacy Act of 2012 sets the ground rules for organizations dealing with the personal information of Filipinos. It applies to "the processing of all types of personal information and to any natural and juridical person involved in personal information processing", in both the public and private sectors. It gives data subjects the right to control the handling of their data and to file complaints with the National Privacy Commission.
Resources:
QatarEffective Date: Since 2016
Region: EMEA (Europe, the Middle East and Africa)
Qatar was the first member of the Gulf Cooperation Council (GCC) to establish a data protection law (Law No. 13 of 2016), regulating how organizations treat the personal information of individuals in Qatar. Compliance guidelines were issued in 2021, and the law is now overseen by the National Data Privacy Office of the National Cyber Security Agency.
Resources:
South KoreaEffective Date: Since September 30, 2011
Region: APAC (Asia-Pacific)
South Korea's PIPA is one of the strictest privacy laws in the world. It requires strict consent compliance, timely breach notifications, and timely fulfillment of data subject requests, with heavy fines for violations. Major amendments in force since September 2023 aligned consent rules more closely with international standards, introduced a right to object to automated decisions, and raised penalties to up to 3% of total revenue. Foreign businesses meeting thresholds must appoint a domestic representative.
Resources:
Saudi ArabiaEffective Date: Since October 2019
Region: EMEA (Europe, the Middle East and Africa)
The E-Commerce Law (Royal Decree M/126) came into force on October 24, 2019, and its Executive Regulations were issued on January 31, 2020. It protects consumers in e-commerce, including by requiring service providers to protect consumers' personal data, and applies to providers inside or outside Saudi Arabia offering goods or services to consumers in the Kingdom. Personal data is now mainly governed by the PDPL.
Resources:
Effective Date: September 14, 2023 (fully enforceable since September 14, 2024)
Region: EMEA (Europe, the Middle East and Africa)
The PDPL (Royal Decree M/19 of 2021, amended in 2023) and its Implementing Regulations protect the personal data of individuals in Saudi Arabia and regulate its collection, processing, disclosure and retention. The law applies to entities within or outside Saudi Arabia processing the personal data of individuals in the Kingdom. It is enforced by the Saudi Data & AI Authority (SDAIA), which published 48 penalty decisions in January 2026.
Resources:
SingaporeEffective Date: Since November 2012
Region: APAC (Asia-Pacific)
Singapore enacted the Personal Data Protection Act (the "PDPA") in 2012, which came into force in phases; the data protection provisions took effect on July 2, 2014. The PDPA recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate and reasonable purposes. It covers personal data in electronic and non-electronic forms; anonymized data does not come under its scope. Amendments in force since February 1, 2021 introduced mandatory breach notification and new consent exceptions, and maximum fines rose to 10% of Singapore turnover in October 2022.
Resources:
South AfricaEffective Date: Since July 1, 2021
Region: EMEA (Europe, the Middle East and Africa)
POPIA empowers data subjects to have better control over their personal information. It applies to public and private bodies domiciled in South Africa, and to those not domiciled in South Africa if they process personal information there (unless only to forward it through the country). POPIA sets out eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation. Violators may be fined up to ZAR 10 million or imprisoned for up to 10 years for certain offences.
Resources:
TurkeyEffective Date: Since April 7, 2016
Region: EMEA (Europe, the Middle East and Africa)
Türkiye published the Law on the Protection of Personal Data No. 6698 (LPPD) on April 7, 2016. Based on the EU Data Protection Directive 95/46/EC, it has several similarities with the GDPR. It gives data subjects control over their personal data and sets obligations for organizations processing it. The LPPD applies to entities in Türkiye and to foreign entities processing the personal data of individuals in Türkiye. Amendments in force since June 1, 2024 broadened the legal bases for processing sensitive data and introduced new cross-border transfer mechanisms, including standard contracts that must be notified to the Authority.
Resources:
United Arab EmiratesEffective Date: January 2, 2022
Region: EMEA (Europe, the Middle East and Africa)
The UAE's first federal data protection law applies to the processing of personal data of individuals in the UAE by controllers and processors inside or outside the country, outside the financial free zones. Its Executive Regulations, which set details such as penalties and timelines, have not been formally published. In June 2026, the Cabinet approved a new Artificial Intelligence and Data Authority.
Resources:
Effective Date: 31 December 2021
Region: EMEA (Europe, the Middle East and Africa)
The UAE Telecommunications and Digital Government Regulatory Authority (TDRA, formerly the TRA) established Consumer Protection Regulations (CPR) requiring all licensed companies in the UAE to protect consumers' personal information. Licensees must take measures against data leakage, unauthorized access, privacy risks, and inappropriate use of personal information.
Resources:
Effective Date: 15 November 2020
Region: EMEA (Europe, the Middle East and Africa)
The Central Bank of the UAE (CBUAE) established the Stored Value Facilities (SVF) Regulations. Apart from fostering digital payment systems, the regulations require licensed companies to protect their customers' personal information and secure their systems and data against unauthorized access, misuse, and tampering.
Resources:
Effective Date: July 1, 2020
Region: EMEA (Europe, the Middle East and Africa)
The Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020 superseded the Data Protection Law 2007. It sets obligations for the collection, disclosure and processing of personal data in the DIFC, a financial free zone in Dubai, and is consistent with the GDPR and OECD guidelines. Amendment Law No. 1 of 2025 (in force July 15, 2025) gives individuals a direct right to claim compensation in the DIFC Courts.
Resources:
Effective Date: February 14, 2021 (applied to existing entities from February 14, 2022)
Region: EMEA (Europe, the Middle East and Africa)
The Abu Dhabi Global Market's GDPR-style regulations apply to the processing of personal data in the context of an establishment in the ADGM free zone, and are enforced by the ADGM Office of Data Protection.
Resources:
FranceEffective Date: Since May 25, 2018
Region: EMEA (Europe, the Middle East and Africa)
As a member of the European Union (EU), France is subject to the General Data Protection Regulation (GDPR), which it supplements through the Act on Information Technology, Data Files and Civil Liberties (Law No. 78-17 of 6 January 1978, as amended). The Act recognizes that information technology serves the needs of every citizen and must not violate human identity, human rights, privacy, or civil liberties. The CNIL is one of Europe's most active regulators, particularly on cookies.
Resources:
GermanyEffective Date: Since May 25, 2018
Region: EMEA (Europe, the Middle East and Africa)
As a member of the EU, Germany is subject to the GDPR, which it supplements through the Federal Data Protection Act (BDSG). The BDSG provides the same rights to data subjects as the GDPR, with some limitations in certain circumstances, and contains specific provisions for processing employees' personal data. Cookie and similar tracking rules are set by the Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG).
Resources:
ItalyEffective Date: Since May 25, 2018
Region: EMEA (Europe, the Middle East and Africa)
Italy is an EU member state where the GDPR is fully effective. Italy adapted its Personal Data Protection Code (Legislative Decree 196/2003) to the GDPR through Legislative Decree No. 101 of 10 August 2018, in force since September 19, 2018. The amended Code designates the Garante per la protezione dei dati personali as the supervisory authority.
Resources:
SpainEffective Date: Since December 7, 2018
Region: EMEA (Europe, the Middle East and Africa)
Spain was one of the first countries to take active legislative measures to protect personal data. The Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights implements the GDPR in Spain. In addition to GDPR rights, it provides rights such as data portability for social media data, the right to be delisted from internet searches and social media, the right to digital security, and the right to universal access to the internet. It also requires controllers to provide granular, layered information in privacy notices.
Resources:
ZimbabweEffective Date: Since December 3, 2021
Region: EMEA (Europe, the Middle East and Africa)
Zimbabwe formally enacted the Cyber and Data Protection Act in December 2021. It covers data privacy as well as cybersecurity and the prevention of cybercrime. It applies to organizations established within or outside Zimbabwe if the means used to process data are located in Zimbabwe, other than for transit purposes. Licensing regulations for data controllers took effect in 2024.
Resources:
RwandaEffective Date: Since Oct 15, 2021
Region: EMEA (Europe, the Middle East and Africa)
Rwanda's data protection law (Law No. 058/2021) came into force in October 2021 after a comprehensive consultation process. It applies to data controllers, processors, and third parties established or ordinarily resident in Rwanda and processing personal data there, and to those outside Rwanda that process the personal data of individuals in Rwanda. Organizations subject to the law must register with the National Cyber Security Authority, the regulator.
Resources:
IndonesiaEffective Date: -: October 17, 2022 (fully applicable since October 17, 2024)
Region: APAC (Asia-Pacific)
Indonesia's Personal Data Protection Law (Law No. 27 of 2022) came into effect in October 2022, giving organizations two years to bring their processing into compliance. It protects individuals' privacy online by granting data subject rights and placing data-related obligations on organizations. Implementing Government Regulation 33/2026, signed July 16, 2026, takes effect on January 16, 2027. The independent PDP Agency has not yet been established.
Resources:
GhanaEffective Date: Since Oct, 2012
Region: EMEA (Europe, the Middle East and Africa)
Ghana's Data Protection Act 2012 sets comprehensive rules for the collection, processing, use, and protection of personal data by data controllers and processors. It applies to organizations that process the personal data of Ghana's residents, inside and outside the country.
Resources:
KenyaEffective Date: Since Nov, 2019
Region: EMEA (Europe, the Middle East and Africa)
Kenya's Data Protection Act, 2019 (DPA) is based on the framework of the EU's GDPR, making Kenya the third country in East Africa to enact a data protection law. The DPA protects the personal data of individuals in Kenya by setting obligations for data controllers and processors, who must register with the Office of the Data Protection Commissioner.
Resources:
UgandaEffective Date: Since 1st Mar, 2019
Region: EMEA (Europe, the Middle East and Africa)
Uganda's Data Protection and Privacy Act 2019 protects individuals' personal data by setting rules for the processing of personal and sensitive data by entities within or outside the country. It gives individuals rights to control how their data is collected and processed, and applies to both public and private entities.
Resources:
MalaysiaEffective Date: Since 15 Nov, 2013
Region: APAC (Asia-Pacific)
Malaysia's Personal Data Protection Act (PDPA) was passed by Parliament on June 2, 2010. It sets out a cross-sectoral framework to protect personal data in commercial transactions and applies to any person who processes or controls personal data. The PDPA (Amendment) Act 2024 came into force in phases during 2025, introducing mandatory breach notification, DPO appointment, a data portability right and direct obligations for data processors.
Resources:
ArgentinaEffective Date: 2000
Region: LATAM (Latin America)
Argentina's Personal Data Protection Law has been in force since 2000 and applies to persons or legal entities processing personal data. Together with Decree No. 1558/2001 (as amended by Decree No. 1160/2010), it establishes general data protection and habeas data standards. Penalties range from ARS 1,000 to ARS 5 million and imprisonment of six months to two years. The 2018 reform bill lapsed; a new GDPR-aligned bill was submitted to Congress in June 2023 and has not yet been enacted.
ChileEffective Date: 1999; Law 21.719 applies from December 1, 2026
Region: LATAM (Latin America)
Chile's Law 21.719, published on December 13, 2024, replaces Law 19.628 from December 1, 2026. It introduces GDPR-style legal bases and data subject rights, and creates an autonomous Personal Data Protection Agency with powers to impose fines of up to 4% of annual revenue for very serious infringements by large companies. Until then, Law 19.628 applies to public and private organizations processing personal data. It has no dedicated authority, so penalties must be sought in court, although consumers can lodge complaints with the consumer protection agency, SERNAC.
ColombiaEffective Date: October 17, 2012
Region: LATAM (Latin America)
In Colombia, the general legal framework for managing personal data is Law 1581 of 2012. It applies to individuals, private and public companies, and governmental entities that collect the personal data of persons domiciled in Colombia or process personal data in Colombia. Its main goal is to preserve people's right to know, update, and correct information about them stored in databases or files. It is enforced by the Superintendence of Industry and Commerce (SIC).
EcuadorEffective Date: 26 May 2021 (sanctions regime since May 26, 2023)
Region: LATAM (Latin America)
Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP) applies to organizations domiciled in Ecuador that process personal data there, and to organizations outside Ecuador that process the personal data of individuals in Ecuador by offering them goods or services or monitoring their behavior. Fines range from 0.1% to 0.7% of annual turnover for minor infringements and from 0.7% to 1% for serious infringements. A General Regulation to the law was issued in November 2023.
PeruEffective Date: June 7, 2011
Region: LATAM (Latin America)
Peru's Personal Data Protection Law is the primary data protection legislation in Peru. A new regulation (Supreme Decree No. 016-2024-JUS) replaced the 2013 regulation on March 30, 2025. It extends the law to foreign controllers offering goods or services to people in Peru (who must appoint a local representative), adds a data portability right, and phases in a data protection officer requirement. Law No. 27489 (2001) separately governs credit information bureaus and the processing of data used to assess economic solvency.
Resources:
UruguayEffective Date: August 11, 2008
Region: LATAM (Latin America)
Uruguay's law, together with Decree No. 414/009 of August 31, 2009, applies to individuals, government departments, and public or private organizations processing personal data, whether established in Uruguay or not, if they supply goods and services to, or analyze the behavior of, individuals in Uruguay, or use means of processing located there. It is enforced by the Personal Data Regulatory and Control Unit (URCDP). Uruguay holds an EU adequacy decision.
ParaguayEffective Date: November 28, 2025 (fully applicable from November 2027)
Region: LATAM (Latin America)
Paraguay enacted its first comprehensive data protection law on November 27, 2025. It establishes data subject rights, including access, rectification, deletion and portability, and creates a National Personal Data Protection Agency. Most obligations apply after a two-year transition. Until then, Law No. 6534/2020 on the protection of personal credit data continues to apply.
EgyptEffective Date: October 2020; Executive Regulations issued November 2025
Region: EMEA (Europe, the Middle East and Africa)
Egypt's Data Protection Law is largely modeled on the GDPR. It applies to controllers and processors that process personal data of Egyptian residents, whether or not they are based in Egypt. Breaches must be reported to the Personal Data Protection Center within 72 hours, and processing is allowed only on a legal basis. The law remained largely dormant until its Executive Regulations (Ministerial Decree No. 816 of 2025) were issued in November 2025, introducing a licensing regime; organizations have until November 1, 2026 to comply.
Resources:
IsraelEffective Date: 1981
Region: EMEA (Europe, the Middle East and Africa)
Israel's Protection of Privacy Law of 1981 is one of the oldest privacy laws still in effect. It is supplemented by the Privacy Protection (Data Security) Regulations, covering data security and international data transfers, and applies to companies that do business in Israel. Amendment 13, in force since August 14, 2025, broadened key definitions, introduced mandatory privacy protection officers for certain organizations, reduced database registration requirements, and gave the Privacy Protection Authority powers to impose substantial fines. Israel holds an EU adequacy decision.
Resources:
AndorraEffective Date: Since May 17, 2022
Region: EMEA (Europe, the Middle East and Africa)
Andorra's Qualified Law 29/2021 on personal data protection came into force on May 17, 2022, and is enforced by the Andorra Data Protection Agency (APDA). It applies to automated and non-automated processing by individuals or companies in Andorra, and to those outside Andorra using processing means located there. Key provisions cover deceased persons' data, consent, data protection officers, data subject rights, breach notification, and cross-border transfers.
Resources:
United KingdomEffective Date: Since May 25, 2018
Region: EMEA (Europe, the Middle East and Africa)
The UK Data Protection Act (DPA) 2018 replaced the Data Protection Act 1998 and, together with the UK GDPR (the GDPR as retained in UK law after December 31, 2020), forms the UK's data protection framework. It covers general processing, processing by law enforcement agencies, and processing by intelligence services. The Data (Use and Access) Act 2025 amended the UK GDPR, the DPA 2018 and PECR in stages through 2026, introducing "recognised legitimate interests", relaxing rules on automated decisions, adding cookie consent exemptions and a complaints-handling duty, and raising PECR fines. The UK holds an EU adequacy decision.
Resources:
BotswanaEffective Date: Since October 15, 2021
Region: EMEA (Europe, the Middle East and Africa)
The Data Protection Act (Act No. 32 of 2018), Botswana's first major data protection law, came into effect on October 15, 2021 under the Data Protection Act (Commencement Date) Order 2021. It contains the main provisions needed to protect individuals' data rights. A new Data Protection Act was passed in 2024 to replace it.
ZambiaEffective Date: March 31, 2021
Region: EMEA (Europe, the Middle East and Africa)
On March 31, 2021, Zambia passed the Data Protection Act No. 3 of 2021 and the Electronic Communications and Transactions Act No. 4 of 2021. The Act regulates the use, protection, transmission, storage, and sale of personal data and establishes the Office of the Data Protection Commissioner, which registers data controllers and processors and resolves complaints.
Resources:
JamaicaEffective Date: December 1, 2023 (fully in force after a two-year transition)
Region: LATAM (Latin America)
Jamaica's Data Protection Act, 2020 was signed in July 2020, and its main provisions took effect on December 1, 2021, with a two-year transition period ending on December 1, 2023, when the Act became fully enforceable. It defines controllers' responsibilities, gives data rights to people who have been deceased for less than 30 years, establishes the Office of the Information Commissioner, and sets rules for transfers outside Jamaica.
BelarusEffective Date: November 15, 2021
Region: EMEA (Europe, the Middle East and Africa)
The Law on Personal Data Protection of May 7, 2021, No. 99-Z, entered into effect on November 15, 2021. The first act of its kind in Belarus, it implements the Protocol on Information and Communication Technologies and Informational Interaction within the Eurasian Economic Union (Annex 3 to the Treaty on the Eurasian Economic Union of May 29, 2014).
Russian FederationEffective Date: July 27, 2006
Region: EMEA (Europe, the Middle East and Africa)
Federal Law No. 152-FZ on Personal Data has been in effect since 2006. Amendments under Law 266-FZ, in force since September 1, 2022, redefined consent, shortened response times for data subject requests, added documentation requirements, tightened data localization, and required notification of cross-border transfers. Further changes in 2025 introduced turnover-based fines for data leaks (May 30, 2025), stricter localization (July 1, 2025) and a requirement that consent be a separate document (September 1, 2025).
Resources:
EswatiniEffective Date: March 4, 2022
Region: EMEA (Europe, the Middle East and Africa)
On March 4, 2022, the Eswatini Communications Commission published the Data Protection Act No. 5 of 2022, effective immediately. The Act gave organizations two years to comply, with a possible third year at the discretion of the Information and Communications Technology Minister.
OmanEffective Date: February 13, 2023
Region: EMEA (Europe, the Middle East and Africa)
Royal Decree 6/2022 promulgating the Personal Data Protection Law (PDPL) was issued on February 9, 2022, and the law took effect on February 13, 2023. Enforced by the Ministry of Transport, Communications and Information Technology (MTCIT), it gives individuals in Oman data privacy rights comparable to other major laws. The Executive Regulation (Ministerial Decision 34/2024) was issued in February 2024, and the compliance grace period ended on February 5, 2026.
Resources:
Sri LankaEffective Date: March 18, 2025 (main provisions)
Region: APAC (Asia-Pacific)
Sri Lanka's parliament passed the Personal Data Protection Act (PDPA), No. 9 of 2022, in March 2022. It gives individuals data subject rights and places obligations on organizations processing personal data in the country, with strict penalties for non-compliance. The Data Protection Authority was established in 2023, and the core provisions (Parts I, II, III and VII) came into operation on March 18, 2025. Rules on unsolicited messages will follow later.
Resources:
KuwaitEffective Date: February 19, 2024 (Resolution No. 26 of 2024)
Region: EMEA (Europe, the Middle East, and Africa)
Kuwait's Data Privacy Protection Regulation was issued by the Communication and Information Technology Regulatory Authority (CITRA) in line with the New Kuwait 2035 vision. Resolution No. 26 of 2024 replaced the earlier Resolution No. 42 of 2021. It applies to CITRA-licensed service providers and covers their responsibilities towards users, encryption, data centers, consent, and breach notification to CITRA within 24 hours.
Resources:
Brunei DarussalamEffective Date: January 1, 2026 (enacted January 8, 2025)
Region: APAC (Asia-Pacific)
Brunei's Personal Data Protection Order 2025 was enacted on January 8, 2025, and most of its provisions came into force on January 1, 2026. Administered by the Authority for Info-communications Technology Industry (AITI), it applies to private-sector organizations and sets rules on consent, purpose limitation, access and correction, security, retention, breach notification, overseas transfers, and direct marketing. It makes no distinction between types of personal data such as sensitive data, so organizations must apply uniform measures to all personal data.
Resources:
IndiaEffective Date: Phased: November 13, 2025 to May 2027
Region: APAC (Asia-Pacific)
After the 2019 and 2022 bills were withdrawn, India enacted the Digital Personal Data Protection Act in August 2023. The DPDP Rules, notified on November 13, 2025, bring it into force in phases: the Data Protection Board provisions applied immediately, consent manager rules apply after 12 months, and most obligations (notice, consent, security, breach notification and data principal rights) apply from May 2027. The Act applies to digital personal data processed in India and to processing outside India in connection with offering goods or services to people in India, with penalties of up to INR 250 crore.
Resources:
MyanmarEffective Date: March 8, 2017 and April 30, 2004
Region: APAC (Asia-Pacific)
Myanmar lacks a comprehensive data protection law. Data protection rules are scattered across several laws, such as the Financial Institutions Law, Telecommunications Law, Notification 116/97, the Law Relating to Private Health Care Services, and the Electronic Transactions Law and its 2021 amendment.
The Law Protecting the Privacy and Security of Citizens (2017), known as the "Privacy Law", is the main privacy law. Amendments in February 2021 allowed broad government surveillance and investigations, and several provisions guaranteeing individual privacy were suspended.
Similarly, the Electronic Transactions Law was amended in February 2021 to allow government access to personal data in the interest of cybersecurity. A Cybersecurity Law was enacted in January 2025.
MongoliaEffective Date: May 1, 2022
Region: APAC (Asia-Pacific)
Mongolia's Parliament (State Great Khural) passed the Law on Personal Data Protection in December 2021, and it came into effect in May 2022, replacing the 1995 Law on Personal Secrets. It protects biometric, genetic, and other modern forms of data and requires express consent for the collection, transfer, sale, sharing or disposal of data. It works alongside the Cybersecurity Law, Public Information Transparency Law, and Electronic Signature Law (all 2021).
PakistanEffective Date: Under discussion
Region: APAC (Asia-Pacific)
Pakistan still has no comprehensive data protection law. After the 2021 bill stalled, a revised Personal Data Protection Bill was approved in draft in 2023 but has not been enacted. Data protection is currently addressed in part by the Prevention of Electronic Crimes Act 2016.
Virgin Islands, BritishEffective Date: July 9, 2021
Region: LATAM (Latin America)
The Data Protection Act of 2021 came into effect in July 2021. The first law of its kind in the territory, it is designed to give the BVI data protection standards comparable to the UK and EU, given the many EU and UK firms that rely on the territory for financial operations.
Resources:
JamaicaEffective Date: December 1, 2023 (fully in force after a two-year transition)
Region: LATAM (Latin America)
Jamaica's Data Protection Act, 2020 was signed in July 2020, and its main provisions took effect on December 1, 2021, with a two-year transition period ending on December 1, 2023, when the Act became fully enforceable. It defines controllers' responsibilities, gives data rights to people who have been deceased for less than 30 years, establishes the Office of the Information Commissioner, and sets rules for transfers outside Jamaica.
UkraineEffective Date: January 1, 2011
Region: EMEA (Europe, Middle East, and Africa)
The Law of 1 June 2010 No. 2297-VI on Personal Data Protection is Ukraine's primary data protection law. It covers data subject rights, conditions for processing, and the obligations of controllers and processors. The Ukrainian Parliament Commissioner for Human Rights has enforced it since January 2014. A new GDPR-aligned draft law is under consideration as part of Ukraine's EU accession process.
UzbekistanEffective Date: October 1, 2019
Region: APAC (Asia-Pacific)
Law on Personal Data: Uzbekistan adopted Law No. ZRU-547 "On Personal Data" on July 2, 2019. It designates the Cabinet of Ministers and the State Personalization Center as the main regulators. The State Inspection on Informatization and Telecommunications can monitor database owners and operators, issue binding orders, and maintain a register of infringers.
Amendments: A 2021 amendment requires personal data of Uzbek citizens to be stored on servers located in Uzbekistan. In October 2022, the Cabinet of Ministers adopted a Decree approving legal acts on processing personal data, requiring processors to take organizational and technical measures to protect data.
Law on Cybersecurity: The Law "On Cybersecurity" No. ZRU-764 of April 15, 2022 came into effect in July 2022. It regulates cybersecurity in public and private organizations, with the State Security Service responsible for enforcement.
MonacoEffective Date: December 14, 2024
Region: EMEA (Europe, Middle East, Africa)
Law No. 1.565 of December 3, 2024 replaced Act No. 1.165 of 1993 with a GDPR-inspired framework, with the aim of obtaining an EU adequacy decision. It applies to controllers and processors established in Monaco and to those outside Monaco processing data of individuals in Monaco, expands rights (including portability, erasure and restriction), and replaces the CCIN with a new Personal Data Protection Authority (APDP). Existing processing had to comply by December 14, 2025; Sovereign Ordinance No. 11.327 of July 10, 2025 implements the law.
El SalvadorEffective Date: November 2024
Region: LATAM (Latin America)
After the 2021 bill was vetoed, El Salvador's Legislative Assembly passed a Personal Data Protection Law on November 12, 2024, alongside a Cybersecurity Law. It was published on November 15, 2024 and is supervised by the State Cybersecurity Agency (ACE).
PanamaEffective Date: March 29, 2021
Region: LATAM (Latin America)
Panama's Personal Data Protection Law, Law No. 81 of 2019, came into full effect in March 2021 and is regulated by Executive Decree No. 285 of May 28, 2021. It sets data protection principles, data subject rights, controller and processor obligations, and enforcement mechanisms. Before it, sectoral laws such as the Banking, Insurance, Securities and Trust laws and the law on patients' rights covered personal data.
Resources:
JordanEffective Date: March 17, 2024 (fully enforceable since March 17, 2025)
Region: EMEA (Europe, Middle East, Africa)
After more than a decade of drafts, Jordan's Personal Data Protection Law was published on September 17, 2023, took effect on March 17, 2024, and became fully enforceable after a one-year transition on March 17, 2025. It is overseen by a Personal Data Protection Council chaired by the Minister of Digital Economy and Entrepreneurship, and a Data Subject Rights Regulation was approved in 2025.
Resources:
DenmarkEffective Date: May 25, 2018
Region: EMEA (Europe, Middle East, Africa)
Like other EU countries, Denmark has enacted a data protection act to implement the GDPR. The Danish Data Protection Act (Act No. 502 of 23 May 2018) protects natural persons with respect to the processing of personal data and regulates the free movement of personal data. It replaced the Danish Act on Processing of Personal Data (Act No. 429 of 31/05/2000). The Danish Data Protection Authority (Datatilsynet) supervises and enforces the Act and the GDPR and represents Denmark in the European Data Protection Board.
Resources:
FinlandEffective Date: January 1, 2019
Region: EMEA (Europe, Middle East, Africa)
Finland enacted the Data Protection Act (Tietosuojalaki, 1050/2018) to supplement the GDPR in January 2019. Other laws also deal with data privacy, such as the Act on Electronic Communications Services 917/2014, the Act on the Protection of Privacy in Working Life 759/2004, and the Act on the Processing of Personal Data in Criminal Cases and in connection with Maintaining National Security 1054/2018. The Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) supervises the GDPR and the Data Protection Act.
GreeceEffective Date: August 29, 2019
Region: EMEA (Europe, Middle East, Africa)
Greek Law 4624/2019 was enacted to implement the GDPR and Directive (EU) 2016/680. The Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) oversees the enforcement of Law 4624/2019 and the ePrivacy rules in Greece.
IcelandEffective Date: July 15, 2018
Region: EMEA (Europe, Middle East, Africa
Act 90/2018 on Data Protection and the Processing of Personal Data was passed by the Icelandic Parliament in July 2018 to implement the GDPR. It contains certain exemptions and derogations from the GDPR. The Icelandic Data Protection Authority supervises the GDPR and the Act and represents Iceland in the European Data Protection Board.
MexicoEffective Date: March 21, 2025
Region: NA (North America)
A new Federal Law on the Protection of Personal Data Held by Private Parties was published on March 20, 2025 and took effect on March 21, 2025, repealing the 2010 law and its 2011 Regulations. The reform dissolved the National Institute of Transparency, Access to Information and Personal Data Protection (INAI); data protection oversight moved to the Secretariat of Anti-Corruption and Good Governance. The new law also removes processing for purposes "similar or analogous" to those in the privacy notice and adds specific conditions for objecting to automated processing.
SwedenEffective Date: May 25, 2018
Region: EMEA (Europe, Middle East, Africa)
The Act with Supplementary Provisions to the GDPR (2018:218) and the Ordinance with Supplementary Provisions to the GDPR (2018:219) incorporate the GDPR into Swedish law. There are also sector-specific laws, such as the Camera Surveillance Act (2018:1200), Credit Information Act (1973:1173), and Patient Data Act (2008:355). The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) supervises the GDPR and other data protection laws and represents Sweden in the European Data Protection Board.
Resources:
VenezuelaEffective Date: None
Region: LATAM (Latin America)
Venezuela does not have a unified data protection law. Instead, isolated provisions in existing laws, including the constitutional right to habeas data, regulate aspects of data privacy and protection.
AlbaniaEffective Date: January 31, 2025
Region: EMEA (Europe, Middle East, Africa)
Albania's new law, adopted on December 19, 2024, is fully aligned with the GDPR and the EU Law Enforcement Directive, and repealed Law No. 9887 of 2008. It has GDPR-style extraterritorial reach (foreign controllers targeting people in Albania must appoint a local representative) and GDPR-level fines. It is enforced by the Information and Data Protection Commissioner (IDP). Some provisions take effect within two years.
ArmeniaEffective Date: July 1, 2015
Region: EMEA (Europe, Middle East, Africa)
Law No. HO-49-N of 18 May 2015 on the Protection of Personal Data is Armenia's primary data protection law. It regulates the data privacy of individuals and the responsibilities of public and private bodies collecting, processing, storing, sharing, and selling personal data. The Personal Data Protection Agency of the Ministry of Justice supervises the law, under Decision N 573-A of the Prime Minister of July 3, 2015.
AzerbaijanEffective Date: May 11, 2010
Region: EMEA (Europe, Middle East, Africa)
The Law on Personal Data, passed in 2010, is Azerbaijan's primary data protection law. It distinguishes between general and sensitive personal data and requires prior consent to collect or process data that is not publicly available. The Ministry of Digital Development and Transport supervises the law.
BahamasEffective Date: April 2, 2007
Region: LATAM (Latin America)
The Data Protection (Privacy of Personal Information) Act of 2007 is the primary data protection law in the Bahamas. It gives individuals rights of access, rectification, and erasure, and the right to prohibit processing for direct marketing. The Data Protection Commissioner supervises the law.
BarbadosEffective Date: March 31, 2021
Region: LATAM (Latin America)
The Data Protection Act, 2019 is Barbados' primary data protection law. Passed in August 2019, it came into effect in March 2021. It regulates the collection, keeping, processing, use, and dissemination of personal data. The Data Protection Commissioner has administered the Act since July 2021.
BelgiumEffective Date: September 5, 2018
Region: EMEA (Europe, Middle East, Africa)
The Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data is Belgium's main data protection law, implementing the GDPR provisions that allow national clarifications or derogations. The Belgian Data Protection Authority, established by the Act of 3 December 2017 as the successor to the Privacy Commission, supervises the GDPR and the Act in Belgium.
GeorgiaEffective Date: March 1, 2024
Region: EMEA (Europe, Middle East, Africa)
Georgia adopted a new, GDPR-aligned Law on Personal Data Protection on June 14, 2023, replacing the 2011 law. Its main provisions took effect on March 1, 2024, with others phased in through 2027. It introduces data protection officers, impact assessments and breach notification. In 2026, supervision moved from the Personal Data Protection Service to the State Audit Office.
Resources:
MaltaEffective Date: May 28, 2018
Region: EMEA (Europe, Middle East, Africa)
Chapter 586 of the Laws of Malta, the Data Protection Act of 2018, is Malta's primary data protection law. It repealed and replaced the previous Data Protection Act (Chapter 440). The Information and Data Protection Commissioner enforces the Act and represents Malta in the European Data Protection Board.
MauritiusEffective Date: January 15, 2018
Region: EMEA (Europe, Middle East, Africa)
Mauritius enacted the Data Protection Act 2017 via Proclamation No. 3 of 2018. It came into effect in January 2018, replacing the Data Protection Act 2004 and aligning the country's framework with the EU. The Data Protection Office, headed by the Data Protection Commissioner, oversees the law.
MontenegroEffective Date: December 23, 2008; new law applicable from March 19, 2027
Region: EMEA (Europe, Middle East, Africa)
The Law on Protection of Personal Data, first enacted in 2008 and last amended in 2017, is Montenegro's main data protection law, enforced by the Agency for Personal Data Protection and Free Access to Information. A new GDPR-aligned law was adopted in September 2026 and will apply from March 19, 2027, with fines of up to 4% of worldwide turnover.
SerbiaEffective Date: August 21, 2019
Region: EMEA (Europe, Middle East, Africa)
In November 2018, Serbia enacted its Law on Personal Data Protection to align with the GDPR. It came into force in August 2019. The Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti) enforces the law.
SlovakiaEffective Date: May 25, 2018
Region: EMEA (Europe, Middle East, Africa)
Act No. 18/2018 Coll. on the protection of personal data and on amending and supplementing certain acts implements the GDPR in Slovakia. The Office for Personal Data Protection of the Slovak Republic supervises the GDPR and the Act and represents Slovakia in the European Data Protection Board.
TajikistanEffective Date: August 3, 2018
Region: EMEA (Europe, Middle East, Africa)
Several laws govern aspects of data privacy in Tajikistan, but the Personal Data Protection Law No. 1537 (2018) is the primary law, giving individuals data rights and setting obligations for organizations processing their personal data. The Communication Service under the Government of Tajikistan enforces it.
VietnamEffective Date: January 1, 2026
Region: APAC (Asia-Pacific)
Vietnam's first comprehensive data protection law was passed on June 26, 2025 and took effect on January 1, 2026, together with Decree 356/2025/ND-CP, replacing Decree 13/2023/ND-CP for most purposes. It applies to Vietnamese and foreign organizations processing the personal data of Vietnamese citizens, requires consent and impact assessments for many activities, and allows fines of up to 5% of the previous year's revenue for cross-border transfer violations.
Resources:
NigeriaEffective Date: June 12, 2023
Region: EMEA (Europe, the Middle East and Africa)
The NDPA established the Nigeria Data Protection Commission (NDPC) and a GDPR-style framework of legal bases, data subject rights, breach notification and transfer rules. The General Application and Implementation Directive (GAID), in force since September 19, 2025, replaced the NDPR 2019 framework and requires "data controllers and processors of major importance" to register with the NDPC and file compliance audits.
Resources:
TaiwanEffective Date: October 1, 2012 (as amended)
Region: APAC (Asia-Pacific)
Taiwan's Personal Data Protection Act applies to government agencies and non-government entities collecting, processing and using personal data. A 2023 amendment provides for an independent Personal Data Protection Commission, which is being established in stages.
Resources:
TanzaniaEffective Date: May 1, 2023
Region: EMEA (Europe, the Middle East and Africa)
Tanzania's Personal Data Protection Act requires data controllers and processors to register with the Personal Data Protection Commission and sets rules on lawful processing, data subject rights, and cross-border transfers.
European UnionWhile the GDPR sets a unified standard for data protection across EU countries, each member state has its own laws that complement the GDPR, addressing national requirements and sector-specific needs.
Effective Date: Since May 25, 2018
Region: EMEA (Europe, the Middle East and Africa)
The European Union's General Data Protection Regulation (GDPR) is one of the most comprehensive data protection frameworks in the world, protecting the personal data of natural persons and granting them several rights. It applies to companies established in the EU and to organizations outside the EU that offer goods or services to, or monitor the behavior of, individuals in the EU. It also applies across the European Economic Area (Iceland, Liechtenstein and Norway). Many countries have modeled their data protection laws on it. Related EU laws include the ePrivacy Directive (cookies), the Data Act (applicable since September 12, 2025) and the AI Act (phased in from 2025). The Commission's November 2025 Digital Omnibus proposals to amend the GDPR and cookie rules are under negotiation.
Resources:
KazakhstanEffective Date: November 25, 2013
Region: EMEA (Europe, the Middle East and Africa)
Kazakhstan's Law No. 94-V on Personal Data and Their Protection was adopted on May 21, 2013. It has since been amended several times, including to designate the Ministry of Digital Development, Innovations and Aerospace Industry as the authorized body, require data localization in Kazakhstan, and introduce breach notification duties.
Compliance with global data privacy laws is obligatory for every business. Failure to comply can result in huge losses such as consumer trust, class-action lawsuits, and hefty fines.
Securiti's DataAI Command Platform helps organizations keep up with existing and upcoming privacy laws from one place. It discovers and maps personal data across cloud, SaaS and on-premises systems, automates data subject requests and consent, runs multi-regulation assessments, and manages breach notifications against each law's requirements.
Is your organization ready to comply with the existing as well as upcoming data privacy laws? Watch the demo to see how the DataAI Command Platform helps organizations with global privacy compliance.
Watch the demo to see how Securiti is helping organizations with global privacy regulatory compliance.
Watch the demoAt Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
[email protected]
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
