| Abu Dhabi | Department of Health – Abu Dhabi | ADHICS |
| Abu Dhabi Global Market | Commissioner of Data Protection, ADGM Office of Data Protection | ADGM DPR |
| African Union | AU Commission | AU Data Policy Framework |
| African Union | National data protection authorities (to be set up by each party); AU Commission | Malabo Convention |
| Alabama | Alabama Attorney General | Alabama PDPA |
| Alabama | Alabama Attorney General | AL breach law |
| Alaska | Alaska Department of Law (Attorney General) | AK breach law |
| Albania | Commissioner for the Right to Information and Personal Data Protection (IDP) | Law 124/2024 |
| Alberta | Office of the Information and Privacy Commissioner of Alberta (OIPC) | Alberta PIPA, Alberta POPA, Alberta HIA |
| Algeria | Autorité Nationale de Protection des Données à caractère Personnel (ANPDP) | Law 18-07 |
| Andorra | Agència Andorrana de Protecció de Dades (APDA) | LQPD |
| Angola | Agência de Proteção de Dados (APD) | Law 22/11 |
| Antigua and Barbuda | Information Commissioner | Antigua DPA |
| Argentina | Agencia de Acceso a la Información Pública (AAIP) | PDPL 25.326, No Llame, Law 27.699 |
| Arizona | Arizona Attorney General | AZ breach law |
| Arkansas | Arkansas Attorney General | AR breach law |
| Armenia | Personal Data Protection Agency (Ministry of Justice) | PDP Law |
| Aruba | Public Prosecutor / Minister of Justice | Aruba LPR |
| Asia-Pacific Economic Cooperation (APEC) | APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup | APEC Privacy Framework |
| Asia-Pacific Economic Cooperation (APEC) | Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents | APEC CBPR / PRP |
| Association of Southeast Asian Nations (ASEAN) | ASEAN Digital Ministers (ADGMIN) | ASEAN DMF / MCCs |
| Association of Southeast Asian Nations (ASEAN) | ASEAN Digital Ministers (ADGMIN) / ASEAN Digital Senior Officials | ASEAN PDP Framework |
| Australia | ACCC (regulator) and OAIC (privacy safeguards) | CDR |
| Australia | Australian Communications and Media Authority (ACMA) | DNCR Act, Spam Act |
| Australia | Courts (private right of action) | Privacy Tort |
| Australia | eSafety Commissioner (age obligation); OAIC (Part 4A privacy) | Social Media Minimum Age Act |
| Australia | Office of the Australian Information Commissioner (OAIC) | Privacy Act, POLA Act 2024, NDB Scheme, Children's Online Privacy Code |
| Australian Capital Territory | ACT Privacy Commissioner (functions performed by OAIC); ACT Human Rights Commission | IP Act (ACT) |
| Austria | Fernmeldebüros (telecom offices) for TKG breaches; Datenschutzbehörde (DSB) where personal data is processed | TKG 2021 |
| Austria | Österreichische Datenschutzbehörde (DSB) | DSG |
| Azerbaijan | Ministry of Digital Development and Transport | Law on Personal Data |
| Bahamas | Office of the Data Protection Commissioner | Bahamas DPA 2003, Bahamas DPA 2025 |
| Bahrain | Personal Data Protection Authority (functions exercised by Ministry of Justice, Islamic Affairs and Endowments) | Bahrain PDPL |
| Bangladesh | Data Protection Authority / National Data Governance (Management) Authority | PDPA |
| Bangladesh | National Cyber Security Agency | CSO 2025 |
| Barbados, Saint Lucia | Data Protection Commissioner | Barbados DPA, Saint Lucia DPA |
| Belarus | National Personal Data Protection Centre (NPDPC) | Law 99-Z |
| Belgium | APD-GBA (cookies/personal data); BIPT/IBPT (telecom); FPS Economy (e-marketing) | LCE / WEC |
| Belgium | Autorité de protection des données / Gegevensbeschermingsautoriteit (APD-GBA) | Belgian Data Protection Law 2018 |
| Belize | Data Protection Commissioner (Not yet established; Ministry of IT and Digital Transformation) | Belize DPA |
| Benin | Autorité de Protection des Données à caractère Personnel (APDP) | Code du numérique |
| Bermuda | Office of the Privacy Commissioner for Bermuda (PrivCom) | PIPA |
| Bolivia | None designated (sector regulators) | Art. 130 CPE |
| Bosnia and Herzegovina | Personal Data Protection Agency of Bosnia and Herzegovina (AZLP) | ZZLP 2025 |
| Botswana | Information and Data Protection Commission (IDPC) | Botswana DPA 2024 |
| Brazil | Agência Nacional de Proteção de Dados (ANPD) | LGPD, ANPD Res. 15/2024, ECA Digital, ANPD Res. 19/2024 |
| Brazil | Courts (STF) | EC 115/2022 |
| Brazil | Courts; ANPD/consumer authorities for overlapping matters | Marco Civil |
| British Columbia | Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) | BC PIPA |
| British Virgin Islands | Office of the Information Commissioner (not yet staffed) | BVI DPA |
| Brunei | Responsible Authority (expected: Authority for Info-communications Technology Industry, AITI) | PDPO (Brunei) |
| Bulgaria | Commission for Personal Data Protection (CPDP) | PDPA / ZZLD |
| Bulgaria | Commission for Personal Data Protection (CPDP); Communications Regulation Commission (CRC) for telecom | ECA |
| Burkina Faso | Commission de l'Informatique et des Libertés (CIL) | Law 001-2021 |
| Burundi | Not yet established (independent administrative authority provided for) | Law 1/03 |
| Cabo Verde | Comissão Nacional de Proteção de Dados Pessoais (CNPD) | Law 133/V/2001 |
| California | California Attorney General | CalOPPA |
| California | California Attorney General | SOPIPA, SB 976, CAADCA |
| California | California Attorney General (Department of Justice) | CA breach law |
| California | California Attorney General; private litigants | Shine the Light |
| California | California courts | Cal. Const. Art. I §1 |
| California | California Privacy Protection Agency (CalPrivacy) | CCPA ADMT/Risk/Audit Regulations |
| California | California Privacy Protection Agency (CalPrivacy) | Delete Act / DROP |
| California | California Privacy Protection Agency (CalPrivacy) and California Attorney General | CCPA/CPRA |
| Cambodia | Ministry of Commerce; MPTC | E-Commerce Law (Cambodia) |
| Cambodia | Ministry of Post and Telecommunications (MPTC) | Draft PDP Law (Cambodia) |
| Cameroon | Not yet established (Personal Data Protection Authority provided for) | Law 2024/017 |
| Canada | Canadian Radio-television and Telecommunications Commission (CRTC); Competition Bureau; OPC | CASL |
| Canada | Courts | Charter s.8 |
| Canada | Office of the Privacy Commissioner of Canada (OPC) | PIPEDA, Privacy Act, BSSR |
| Canada | Proposed Digital Safety and Data Protection Commission of Canada | Bill C-36 (PPCDA) |
| Canada | Would have been OPC + Personal Information and Data Protection Tribunal | Bill C-27 |
| Cayman Islands | Office of the Ombudsman | Cayman DPA |
| Central African Republic, Guinea, Saint Kitts and Nevis | Not yet established | Law 24/001, L/2016/037/AN, SKN DPA |
| Chad | Agence Nationale de Sécurité Informatique et de Certification Électronique (ANSICE) | Law 007/PR/2015 |
| Chile | Agencia de Protección de Datos Personales (Not yet established) | Law 21.719 |
| Chile | None designated (courts; SERNAC for consumer aspects) | Law 19.628 |
| China | CAC with MIIT, MPS and NRTA | AI Content Labelling Measures |
| China | CAC with NDRC, MOE, MOST, MIIT, MPS, NRTA | GenAI Measures |
| China | Cyberspace Administration of China (CAC) | PI Compliance Audit Measures, NDSMR, PIPL, Cyber Incident Reporting Measures, Minors Online Protection Regulations, CSL Amendment 2025, CSL, Cross-Border Data Flow Provisions, China SCC Measures, Security Assessment Measures, DSL |
| China | Cyberspace Administration of China (CAC) and State Administration for Market Regulation (SAMR) | PI Export Certification Measures |
| China | Ministry of Public Security and CAC (with other ministries) | National Network ID Measures |
| Colombia | SIC; Superintendencia Financiera de Colombia (for supervised entities) | Law 1266 |
| Colombia | Superintendencia de Industria y Comercio (SIC) - Delegatura para la Protección de Datos Personales | Decree 1074/2015, Law 1581 |
| Colorado | Colorado Attorney General | CO breach law |
| Colorado | Colorado Attorney General | Colorado biometric amendment, Colorado AI law (SB 189), Colorado AI Act (SB 205) |
| Colorado | Colorado Attorney General and District Attorneys | CPA |
| Commonwealth of Nations | Commonwealth Secretariat (Rule of Law) | Commonwealth Model Law |
| Comoros | Not yet established (National Authority provided for) | Law on the protection of personal data (2021) |
| Connecticut | Connecticut Attorney General | CTDPA, CT consumer health data |
| Connecticut | Connecticut Attorney General | CT breach law |
| Costa Rica | Agencia de Protección de Datos de los Habitantes (PRODHAB) | Law 8968 |
| Côte d'Ivoire | Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI) | Law 2013-450 |
| Council of Europe | Conference of the Parties (once in force) | CoE AI Convention |
| Council of Europe | Consultative Committee of Convention 108 (T-PD) | Convention 108 |
| Council of Europe | Convention Committee (T-PD); national supervisory authorities | Convention 108+ |
| Council of Europe | Cybercrime Convention Committee (T-CY) | Budapest Convention |
| Council of Europe | Cybercrime Convention Committee (T-CY) | Budapest 2nd Additional Protocol |
| Council of Europe | European Court of Human Rights | ECHR Art 8 |
| Council of Europe | National supervisory authorities; T-PD | Protocol 181 |
| Council of Europe, East African Community (EAC), Fiji, Myanmar, Nepal, Organisation for Economic Co-operation and Development (OECD), Papua New Guinea, Saint Vincent and the Grenadines, Timor-Leste, United Nations | None designated | Rec 509 (1968), Res (74) 29, Res (73) 22, EAC Cyberlaws Framework, Constitution s24, Citizens' Privacy Law, Privacy Act, OECD Trusted Government Access Declaration, OECD Guidelines 1980, Constitution s49, SVG Privacy Act, Constitution Art. 38, UDHR Art 12, UN Guidelines 1990 |
| Croatia | Agencija za zaštitu osobnih podataka (AZOP) | ZPOUZP |
| Croatia | Croatian Regulatory Authority for Network Industries (HAKOM); AZOP for personal data | ZEK |
| Cuba | Ministry of Justice (with Ministry of Communications) | Law 149 |
| Curaçao | College Bescherming Persoonsgegevens (Personal Data Protection Committee) | Lbp Curaçao |
| Cyprus | Commissioner for Personal Data Protection | Law 125(I)/2018 |
| Cyprus | Commissioner for Personal Data Protection (cookies/spam); OCECPR (telecom) | Law 112(I)/2004 |
| Czech Republic | Úřad pro ochranu osobních údajů (ÚOOÚ) | Act 110/2019 |
| Czech Republic | Úřad pro ochranu osobních údajů (ÚOOÚ) for cookies and commercial communications; Czech Telecommunication Office (ČTÚ) for telecom | Electronic Communications Act |
| Delaware | Delaware Department of Justice (Attorney General) | DPDPA |
| Delaware | Delaware Department of Justice (Attorney General) | DE breach law |
| Democratic Republic of the Congo | Not yet established (Autorité de Protection des Données; ARPTIC acting on interim basis) | Code du numérique |
| Denmark | Consumer Ombudsman (Forbrugerombudsmanden) | Markedsføringsloven |
| Denmark | Danish Agency for Digital Government / Danish Business Authority (cookie order); Datatilsynet (GDPR aspects) | Cookie Order |
| Denmark | Datatilsynet | Databeskyttelsesloven |
| District of Columbia | Office of the Attorney General for the District of Columbia | DC breach law |
| Djibouti | Not yet established (Commission Nationale de Protection des Données à Caractère Personnel provided for) | Code du numérique |
| Dominican Republic | None general (Superintendencia de Bancos for credit bureaus; Pro Consumidor) | Law 172-13 |
| Dubai | Digital Dubai (Dubai Data and Statistics Establishment) | Dubai Data Law |
| Dubai Healthcare City | Dubai Healthcare City Authority; Centre for Healthcare Planning and Quality (CPQ) | DHCC HDPR |
| Dubai International Financial Centre | Commissioner of Data Protection (DIFC) | DIFC DPL, DIFC Regulation 10 |
| Economic Community of West African States (ECOWAS) | National data protection authorities of ECOWAS member states | ECOWAS Supplementary Act |
| Ecuador | Superintendencia de Protección de Datos Personales (SPDP) | LOPDP Regulation, LOPDP |
| Egypt | National Telecom Regulatory Authority (NTRA); Public Prosecution | Anti-Cybercrime Law |
| Egypt | Personal Data Protection Centre (PDPC) | Egypt PDPL Executive Regulations |
| Egypt | Personal Data Protection Centre (PDPC) | Egypt PDPL |
| El Salvador | Agencia de Ciberseguridad del Estado (ACE) | LPDP El Salvador, Ley de Ciberseguridad |
| Equatorial Guinea | Not yet established (Órgano Rector de Protección de Datos Personales provided for) | Law 1/2016 |
| Estonia | Andmekaitse Inspektsioon (cookies/marketing); Consumer Protection and Technical Regulatory Authority (TTJA) | ESS |
| Estonia | Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) | IKS / PDPA |
| Eswatini | Eswatini Communications Commission (ESCCOM) as Data Protection Authority | Eswatini DPA |
| Ethiopia | Ethiopian Communications Authority (ECA) | PDPP |
| European Economic Area | National DPAs of Iceland, Liechtenstein and Norway (EDPB members without voting rights on some matters); EFTA Surveillance Authority | GDPR in the EEA |
| European Union | Article 29 Working Party (replaced by EDPB) / national DPAs | Data Protection Directive |
| European Union | Court of Justice of the European Union; independent supervisory authorities (Art 8(3)) | CFR Arts 7–8 |
| European Union | European AI Office (GPAI); national market surveillance authorities; European AI Board | AI Act |
| European Union | European Commission | DMA |
| European Union | European Commission (VLOPs/VLOSEs); national Digital Services Coordinators | DSA |
| European Union | European Commission; US Department of Commerce (DPF list); FTC/DoT enforcement; Data Protection Review Court | EU–US DPF |
| European Union | European Data Protection Board (EDPB) / national supervisory authorities | GDPR, GDPR Procedural Regulation, EU SCCs 2021 |
| European Union | European Data Protection Supervisor (EDPS) | EUDPR |
| European Union | Independent supervisory authorities | TFEU Art 16 |
| European Union | Member state single points of contact; European Commission | Free Flow of Non-Personal Data Regulation |
| European Union | National competent authorities (data coordinator); DPAs for personal data aspects | Data Act |
| European Union | National competent authorities and CSIRTs; ENISA; NIS Cooperation Group | NIS2 |
| European Union | National competent authorities; European Data Innovation Board | DGA |
| European Union | National digital health authorities; health data access bodies; EHDS Board | EHDS |
| European Union | National DPAs (targeting rules, Art 18–19); other national competent authorities; EDPB | TTPA |
| European Union | National financial supervisors; ESAs (EBA, EIOPA, ESMA) as lead overseers of critical ICT third-party providers | DORA |
| European Union | National market surveillance authorities; ENISA (single reporting platform); CSIRTs | CRA |
| European Union | National supervisory authorities | LED |
| European Union | National telecoms regulators and/or data protection authorities (varies by member state) | ePrivacy Directive |
| Faroe Islands | Dátueftirlitið (Faroese Data Protection Authority) | Dátuverndarlógin |
| Finland | Finnish Transport and Communications Agency (Traficom) for cookies; Data Protection Ombudsman for direct marketing | Electronic Communications Services Act |
| Finland | Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) | Tietosuojalaki |
| Florida | Florida Attorney General (Department of Legal Affairs) | FDBR |
| Florida | Florida Department of Legal Affairs (Attorney General) | FL breach law |
| France | Agence nationale de la sécurité des systèmes d'information (ANSSI) | Projet de loi Résilience |
| France | CNIL (cookies and marketing); DGCCRF also enforces L34-5 | Art 82 LIL / CPCE L34-5 |
| France | Commission Nationale de l'Informatique et des Libertés (CNIL) | LIL |
| Gabon | Autorité de Protection des Données Personnelles et de la Vie Privée (APDPVP), formerly CNPDCP | Law 001/2011 |
| Georgia | Georgia Attorney General (Consumer Protection Division) | GA breach law |
| Georgia | State Audit Office of Georgia (since 2 March 2026; previously Personal Data Protection Service) | PDP Law 2023 |
| Germany | BfDI (telecom services); Länder DPAs (digital services/websites) | TDDDG (ex-TTDSG) |
| Germany | Bundesamt für Sicherheit in der Informationstechnik (BSI) | NIS2UmsuCG / BSIG |
| Germany | Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) for federal public bodies/telecom; 16 Länder DPAs for the private sector | BDSG |
| Germany | Federal Commissioner (BfDI) recognises consent management services | EinwV |
| Germany | Private enforcement (competitors, associations); Bundesnetzagentur for telephone marketing | UWG §7 |
| Ghana | Data Protection Commission (DPC) | Act 843 |
| Gibraltar | Gibraltar Regulatory Authority (as Information Commissioner) | Gibraltar GDPR, DPA 2004 |
| Global Cross-Border Privacy Rules Forum | Global CBPR Forum; Accountability Agents | Global CBPR / Global PRP |
| Greece | Hellenic Data Protection Authority (cookies/marketing); Hellenic Authority for Communication Security and Privacy (ADAE) for confidentiality of communications | Law 3471/2006 |
| Greece | Hellenic Data Protection Authority (HDPA) | Law 4624/2019 |
| Greenland | Datatilsynet (Danish Data Protection Agency) | Persondataloven (Greenland) |
| Grenada | Information Commission (three commissioners) | Grenada DPA |
| Guam | Office of the Attorney General of Guam | GU breach law |
| Guatemala | Procurador de los Derechos Humanos (Human Rights Ombudsman) | LAIP (Decree 57-2008) |
| Guernsey (Bailiwick of) | Data Protection Authority / Office of the Data Protection Authority (ODPA) | DPL 2017 |
| Guyana | Data Protection Commissioner (not yet established) | Guyana DPA |
| Hawaii | Hawaii Office of Consumer Protection (DCCA) | HI breach law |
| Honduras | Instituto de Acceso a la Información Pública (IAIP) | Habeas data (Art. 182) |
| Hong Kong | Commissioner's Office under the Security Bureau | PCICSO |
| Hong Kong | Office of the Privacy Commissioner for Personal Data (PCPD) | PDPO, PDPO Doxxing Amendment |
| Hong Kong | PCPD / Innovation, Technology and Industry Bureau with CAC | GBA Standard Contract |
| Hungary | NAIH (cookies/personal data); National Media and Infocommunications Authority (NMHH); Consumer protection authority (advertising) | Eht. |
| Hungary | Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) | Infotv. |
| Ibero-American Data Protection Network (RIPD) | Red Iberoamericana de Protección de Datos (RIPD) | RIPD Standards |
| Iceland | Persónuvernd (Icelandic Data Protection Authority) | Act 90/2018 |
| Idaho | Idaho Attorney General | ID breach law |
| Illinois | Illinois Attorney General | IL breach law |
| Illinois | Illinois Department of Human Rights; Illinois Human Rights Commission | IL AI in employment |
| Illinois | Private litigants (courts); Illinois Attorney General | BIPA |
| India | Adjudicating officers under IT Act / courts; MeitY | IT Act s43A/72A |
| India | Data Protection Board of India | DPDP Act, DPDP Rules |
| India | Department of Telecommunications (DoT) | Telecom Act 2023 |
| India | Indian Computer Emergency Response Team (CERT-In) | CERT-In Directions 2022 |
| India | MeitY / adjudicating officers under IT Act | SPDI Rules |
| India | Ministry of Electronics and Information Technology (MeitY) | IT Rules 2021 |
| India | Reserve Bank of India (RBI) | RBI data localisation |
| India | Supreme Court of India | Puttaswamy |
| Indiana | Indiana Attorney General | Indiana CDPA |
| Indiana | Indiana Attorney General | IN breach law |
| Indonesia | PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI) | PDP Law, GR 71/2019 |
| Iowa | Iowa Attorney General | Iowa CDPA |
| Iowa | Iowa Attorney General (Consumer Protection Division) | IA breach law |
| Ireland | Data Protection Commission (DPC) | DPA 2018 |
| Ireland | Data Protection Commission (DPC); ComReg for some telecom aspects | ePrivacy Regulations 2011 |
| Isle of Man | Isle of Man Information Commissioner | IoM DPA 2018 |
| Israel | Privacy Protection Authority (PPA) | PPL, Data Security Regulations, EEA Data Regulations, Transfer Regulations |
| Italy | Agenzia per l'Italia Digitale (AgID) and Agenzia per la Cybersicurezza Nazionale (ACN); Garante for personal data | Legge 132/2025 (Legge IA) |
| Italy | Agenzia per la Cybersicurezza Nazionale (ACN) | D.Lgs. 138/2024 (Decreto NIS) |
| Italy | Garante per la protezione dei dati personali | Codice Privacy, Codice Privacy Arts 122/130 |
| Jamaica | Office of the Information Commissioner (OIC) | Jamaica DPA |
| Japan | AI Strategy Headquarters (Cabinet) | AI Promotion Act |
| Japan | Ministry of Internal Affairs and Communications (MIC) | TBA External Transmission Rule |
| Japan | Ministry of Internal Affairs and Communications / Consumer Affairs Agency | Anti-Spam Act |
| Japan | Personal Information Protection Commission (PPC) | APPI, APPI Amendment 2026, My Number Act |
| Jersey | Jersey Data Protection Authority | DPAJL |
| Jersey | Jersey Data Protection Authority / Jersey Office of the Information Commissioner (JOIC) | DPJL |
| Jordan | Personal Data Protection Council and Data Protection Unit, Ministry of Digital Economy and Entrepreneurship | Jordan PDPL |
| Kansas | Kansas Attorney General | KS breach law |
| Kazakhstan | Ministry of Artificial Intelligence and Digital Development | AI Law |
| Kazakhstan | Ministry of Artificial Intelligence and Digital Development (Committee for Information Security) | PD Law |
| Kentucky | Kentucky Attorney General | KCDPA |
| Kentucky | Kentucky Attorney General | KY breach law |
| Kenya | Office of the Data Protection Commissioner (ODPC) | Kenya DP Regulations 2021, Kenya DPA |
| Kosovo | Information and Privacy Agency (IPA / AIP) | LPPD |
| Kuwait | Communications and Information Technology Regulatory Authority (CITRA) | Kuwait DPPR |
| Kuwait | None designated | E-Transactions Law |
| Kyrgyzstan | State Agency for Personal Data Protection under the Cabinet of Ministers | Digital Code |
| Kyrgyzstan | State Agency for Personal Data Protection under the Cabinet of Ministers | Law on Personal Information |
| Laos | Ministry of Technology and Communications (MTC) | EDP Law (Laos) |
| Latvia | Data State Inspectorate (DVI); Consumer Rights Protection Centre for some marketing | ISS Law |
| Latvia | Datu valsts inspekcija (Data State Inspectorate, DVI) | PDPL |
| Lebanon | Ministry of Economy and Trade (permits/licences); no DPA | Law 81/2018 |
| Lesotho | Not yet established (Data Protection Commission provided for) | Lesotho DPA |
| Libya | National Information Security and Safety Authority (NISSA) | Cybercrime Law |
| Liechtenstein | Datenschutzstelle Liechtenstein | DSG |
| Lithuania | Valstybinė duomenų apsaugos inspekcija (VDAI) for cookies/marketing; Communications Regulatory Authority (RRT) for telecom | ERĮ |
| Lithuania | Valstybinė duomenų apsaugos inspekcija (VDAI); Inspector of Journalist Ethics for media | ADTAĮ |
| Louisiana | Louisiana Attorney General | LDPA |
| Louisiana | Louisiana Attorney General (Consumer Protection Section) | LA breach law |
| Luxembourg | CNPD; Institut Luxembourgeois de Régulation (ILR) for telecom | Loi du 30 mai 2005 |
| Luxembourg | Commission nationale pour la protection des données (CNPD) | Loi du 1er août 2018 |
| Macau | Cybersecurity Incident Alert and Response Center (CARIC) / Cybersecurity Committee | Macau Cybersecurity Law |
| Macau | Office for Personal Data Protection (GPDP/OPDP) | PDPA (Macau) |
| Madagascar | Commission Malagasy sur l'Informatique et des Libertés (CMIL) – not yet fully operational | Law 2014-038 |
| Maine | Maine Attorney General / Department of Professional and Financial Regulation | ME breach law |
| Malawi | Malawi Communications Regulatory Authority (MACRA) | Malawi DPA |
| Malaysia | Personal Data Protection Commissioner (JPDP) | PDPA (Malaysia), Malaysia DBN & DPO Guidelines, Malaysia CBPDT Guidelines |
| Mali | Autorité de Protection des Données à caractère Personnel (APDP) | Law 2013-015 |
| Malta | Information and Data Protection Commissioner (IDPC) | DPA Cap. 586, S.L. 586.01 |
| Maryland | Maryland Attorney General (Consumer Protection Division) | MODPA |
| Maryland | Maryland Attorney General (Identity Theft Unit) | MD breach law |
| Massachusetts | Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation | MA breach law |
| Massachusetts | Massachusetts Attorney General; Office of Consumer Affairs and Business Regulation | 201 CMR 17.00 |
| Mauritania | Autorité de Protection des Données à caractère Personnel (APD) | Law 2017-020 |
| Mauritius | Data Protection Office (Data Protection Commissioner) | Mauritius DPA |
| Mexico | SABG (federal) and state-level guarantor bodies | LGPDPPSO 2025 |
| Mexico | Secretaría Anticorrupción y Buen Gobierno (SABG) | LFPDPPP 2025 |
| Michigan | Michigan Attorney General | MI breach law |
| Minnesota | Minnesota Attorney General | MCDPA |
| Minnesota | Minnesota Attorney General | MN breach law |
| Mississippi | Mississippi Attorney General | MS breach law |
| Missouri | Missouri Attorney General | MO breach law |
| Moldova | National Center for Personal Data Protection (NCPDP) | Law 195/2024, Law 133/2011 |
| Monaco | Autorité de Protection des Données Personnelles (APDP), successor to the CCIN | Loi 1.565 |
| Mongolia | National Human Rights Commission; Ministry of Digital Development, Innovation and Communications | PDP Law (Mongolia) |
| Montana | Montana Attorney General (Department of Justice) | MCDPA |
| Montana | Montana Department of Justice, Office of Consumer Protection | MT breach law |
| Montenegro | Agency for Personal Data Protection and Free Access to Information (AZLP) | ZZPL 2008, ZZPL 2026 |
| Morocco | Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) | Law 09-08 |
| Myanmar | Ministry of Transport and Communications / Information Technology and Cybersecurity Department | Cybersecurity Law (Myanmar) |
| Nebraska | Nebraska Attorney General | NDPA |
| Nebraska | Nebraska Attorney General | NE breach law |
| Netherlands | Autoriteit Consument & Markt (ACM) for Art 11.7/11.7a; Autoriteit Persoonsgegevens for personal data in tracking cookies | Telecommunicatiewet |
| Netherlands | Autoriteit Persoonsgegevens (AP) | UAVG |
| Netherlands | Sector supervisors incl. Rijksinspectie Digitale Infrastructuur (RDI) for digital providers; NCSC as CSIRT | Cbw |
| Nevada | Nevada Attorney General | NRS 603A privacy, Nevada SB 370 |
| Nevada | Nevada Attorney General | NV breach law |
| New Brunswick | Ombud New Brunswick | NB PHIPAA |
| New Hampshire | New Hampshire Attorney General (Consumer Protection Bureau) | NH privacy law |
| New Hampshire | New Hampshire Department of Justice (Attorney General) | NH breach law |
| New Jersey | New Jersey Division of Consumer Affairs / Attorney General | NJDPA |
| New Jersey | New Jersey Division of State Police (notice); Division of Consumer Affairs / Attorney General (enforcement) | NJ breach law |
| New Mexico | New Mexico Attorney General | NM breach law |
| New South Wales | Information and Privacy Commission NSW (IPC) | PPIP Act, HRIP Act |
| New York | New York Attorney General | NY CDPA, NY SHIELD Act |
| New York | New York Attorney General (with Department of State, State Police and DFS) | NY breach law |
| New York | New York State Department of Financial Services (NYDFS) | NYDFS Part 500 |
| New York City | NYC Department of Consumer and Worker Protection (DCWP) | NYC LL 144 |
| New Zealand | Department of Internal Affairs (DIA) | UEMA |
| New Zealand | Office of the Privacy Commissioner (OPC) | IPP 3A Amendment, Privacy Act (NZ), TIPC, HIPC, CRPC, Biometrics Code |
| Newfoundland and Labrador | Office of the Information and Privacy Commissioner for Newfoundland and Labrador | NL PHIA |
| Nicaragua | Dirección de Protección de Datos Personales (DIPRODAP) - not formally constituted | Law 787 |
| Niger | Haute Autorité de Protection des Données à caractère Personnel (HAPDP) | Law 2022-59 |
| Nigeria | Nigeria Data Protection Commission (NDPC) | GAID, NDPA |
| North Carolina | North Carolina Department of Justice (Attorney General) | NC breach law |
| North Dakota | North Dakota Attorney General (Consumer Protection Division) | ND breach law |
| North Macedonia | Personal Data Protection Agency (AZLP) | LPDP |
| Northern Territory | Office of the Information Commissioner Northern Territory | Information Act (NT) |
| Norway | Datatilsynet (Norwegian Data Protection Authority) | POL |
| Nova Scotia | Nova Scotia Information and Privacy Commissioner | NS PHIA |
| Ohio | Ohio Attorney General | OH breach law |
| Oklahoma | Oklahoma Attorney General | Oklahoma privacy law |
| Oklahoma | Oklahoma Attorney General | OK breach law |
| Oman | Ministry of Transport, Communications and Information Technology (MTCIT) | Oman PDPL |
| Oman | MTCIT | Oman PDPL Executive Regulation |
| Ontario | Information and Privacy Commissioner of Ontario (IPC) | PHIPA |
| Ontario | Ministry of Public and Business Service Delivery; Information and Privacy Commissioner of Ontario | Bill 194 / EDSTA |
| Oregon | Oregon Department of Justice (Attorney General) | OCPA |
| Oregon | Oregon Department of Justice (Attorney General) | OR breach law |
| Organisation for Economic Co-operation and Development (OECD) | OECD Working Party on AI Governance / OECD.AI | OECD AI Principles |
| Organisation for Economic Co-operation and Development (OECD) | OECD Working Party on Data Governance and Privacy | OECD Privacy Guidelines 2013 |
| Organization of American States (OAS) | OAS Inter-American Juridical Committee; Department of International Law | OAS Updated Principles |
| Pakistan | National Cyber Crime Investigation Agency (NCCIA); Pakistan Telecommunication Authority (PTA); SMPRA | PECA |
| Panama | ANTAI | Decree 285 |
| Panama | Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) - Directorate for Personal Data Protection | Law 81 |
| Paraguay | Banco Central del Paraguay; SEDECO | Law 6534 |
| Paraguay | National data protection agency created by the law (Not yet established) | Law 7593 |
| Pennsylvania | Pennsylvania Office of Attorney General | PA breach law |
| Peru | Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights | DS 016-2024-JUS, Law 29733 |
| Philippines | National Privacy Commission (NPC) | DPA (Philippines) |
| Poland | President of the Office of Electronic Communications (UKE); UODO; UOKiK for consumer marketing | PKE |
| Poland | Prezes Urzędu Ochrony Danych Osobowych (UODO) | UODO Act 2018 |
| Portugal | Comissão Nacional de Proteção de Dados (CNPD) | Lei 58/2019 |
| Portugal | Comissão Nacional de Proteção de Dados (CNPD); ANACOM for some telecom provisions | Lei 41/2004 |
| Puerto Rico | Puerto Rico Department of Consumer Affairs (DACO) | PR breach law |
| Qatar | National Cyber Security Agency – National Cyber Governance and Assurance Affairs (NCGAA) | PDPPL |
| Qatar Financial Centre | QFC Data Protection Office | QFC DPR |
| Quebec | Commission d'accès à l'information du Québec (CAI) | Quebec Private Sector Act / Law 25, Law 25 transfer PIA |
| Queensland | Office of the Information Commissioner Queensland (OIC) | IP Act (Qld) |
| Republic of the Congo | Not yet established (Commission Nationale de Protection des Données à caractère Personnel provided for) | Law 29-2019 |
| Rhode Island | Rhode Island Attorney General | RIDTPPA |
| Rhode Island | Rhode Island Attorney General | RI breach law |
| Romania | ANSPDCP (cookies/marketing); ANCOM (telecom) | Law 506/2004 |
| Romania | Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) | Law 190/2018 |
| Russia | Roskomnadzor | 242-FZ (localisation) |
| Russia | Roskomnadzor (Federal Service for Supervision of Communications, IT and Mass Media) | 152-FZ |
| Rwanda | National Cyber Security Authority (NCSA) – Data Protection and Privacy Office | Law 058/2021 |
| San Marino | Autorità Garante per la protezione dei dati personali (San Marino) | Law 171/2018 |
| São Tomé and Príncipe | Agência Nacional de Proteção de Dados Pessoais (ANPDP) | Law 03/2016 |
| Saudi Arabia | Communications, Space & Technology Commission (CST) | CCRF |
| Saudi Arabia | National Cybersecurity Authority (NCA) | DCC, CCC, ECC |
| Saudi Arabia | Public Prosecution; Communications, Space & Technology Commission | Anti-Cyber Crime Law |
| Saudi Arabia | Saudi Data & AI Authority (SDAIA) / National Data Management Office | KSA PDPL |
| Saudi Arabia | SDAIA | PDPL Implementing Regulations, KSA Transfer Regulation |
| Senegal | Commission de Protection des Données Personnelles (CDP) | Law 2008-12 |
| Serbia | Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) | ZZPL |
| Seychelles | Information Commission (Seychelles) | Seychelles DPA |
| Singapore | Cyber Security Agency of Singapore (CSA) | Cybersecurity Act (Singapore) |
| Singapore | Infocomm Media Development Authority (IMDA) | Spam Control Act |
| Singapore | Personal Data Protection Commission (PDPC) | PDPA (Singapore) |
| Sint Maarten | Personal Data Protection Committee | Lbp Sint Maarten |
| Slovakia | Regulatory Authority for Electronic Communications and Postal Services (RÚ); Personal Data Protection Office | Act 452/2021 |
| Slovakia | Úrad na ochranu osobných údajov Slovenskej republiky | Act 18/2018 |
| Slovenia | Informacijski pooblaščenec (Information Commissioner, IP RS) | ZVOP-2 |
| Slovenia | Informacijski pooblaščenec (IP RS) for cookies; AKOS for telecom | ZEKom-2 |
| Somalia | Somalia Data Protection Authority (DPA) | Somalia DPA |
| South Africa | Department of Communications and Digital Technologies; courts (criminal offence) | ECTA |
| South Africa | Information Regulator (South Africa) | POPIA |
| South Australia | Privacy Committee of South Australia | SA IPPs Instruction |
| South Carolina | South Carolina Department of Consumer Affairs | SC breach law |
| South Dakota | South Dakota Attorney General | SD breach law |
| South Korea | Financial Services Commission (FSC) | Credit Information Act |
| South Korea | Ministry of Science and ICT (MSIT) | AI Basic Act |
| South Korea | Ministry of Science and ICT (MSIT) / Korea Communications Commission (KCC) | Network Act |
| South Korea | Personal Information Protection Commission (PIPC) | PIPA Amendment 2026, PIPA |
| Southern African Development Community (SADC) | None designated (model for national DPAs) | SADC Model Law |
| Spain | Agencia Española de Protección de Datos (AEPD) for cookies and spam | LSSI |
| Spain | Agencia Española de Protección de Datos (AEPD); regional authorities in Catalonia and Basque Country | LOPDGDD |
| Sri Lanka | Data Protection Authority of Sri Lanka | PDPA |
| Sweden | Integritetsskyddsmyndigheten (IMY) | Dataskyddslagen |
| Sweden | Konsumentverket / Consumer Ombudsman (KO) | MFL |
| Sweden | Post- och telestyrelsen (PTS) for cookies; IMY for personal data | LEK |
| Switzerland | FDPIC; US Department of Commerce (certification) | Swiss–US DPF |
| Switzerland | Federal Data Protection and Information Commissioner (FDPIC / EDÖB) | FADP / nDSG, DPO / DSV |
| Taiwan | Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer | PDPA (Taiwan), PDPA Amendment 2025 |
| Tajikistan | Main Department for the Protection of State Secrets / Communication Service under the Government (sources inconsistent) | PDPL |
| Tanzania | Personal Data Protection Commission (PDPC) | PDPA |
| Tasmania | Ombudsman Tasmania | PIP Act (Tas) |
| Tennessee | Tennessee Attorney General | TIPA |
| Tennessee | Tennessee Attorney General / Division of Consumer Affairs | TN breach law |
| Texas | Texas Attorney General | TDPSA, CUBI, TRAIGA |
| Texas | Texas Attorney General | TX breach law |
| Texas | Texas Secretary of State (registry); Texas Attorney General | Texas data broker law |
| Thailand | Personal Data Protection Committee / Office of the PDPC (PDPC) | PDPA (Thailand) |
| The Gambia | Information Commission (The Gambia) | PDPP Act |
| Togo | Instance de Protection des Données à Caractère Personnel (IPDCP) | Law 2019-014 |
| Trinidad and Tobago | Office of the Information Commissioner (not established in practice) | T&T DPA |
| Tunisia | Instance Nationale de Protection des Données Personnelles (INPDP) | Organic Law 2004-63 |
| Turkey | Personal Data Protection Authority (KVKK) / Personal Data Protection Board | KVKK |
| Turkmenistan | None designated (General Prosecutor's Office for general oversight) | Data Protection Law |
| Uganda | Personal Data Protection Office (PDPO), under NITA-U | DPPA |
| Ukraine | Proposed: National Commission for Personal Data Protection and Access to Public Information | Draft Law 8153 |
| Ukraine | Ukrainian Parliament Commissioner for Human Rights (Ombudsman) | Law 2297-VI |
| United Arab Emirates | Ministry of Economy | Consumer Protection Law |
| United Arab Emirates | Ministry of Health and Prevention (MOHAP) and emirate health authorities (DOH Abu Dhabi, DHA) | ICT Health Law |
| United Arab Emirates | Public Prosecution / Police (criminal enforcement) | Cybercrime Law |
| United Arab Emirates | UAE Data Office | Data Office Law, UAE PDPL |
| United Kingdom | Information Commissioner's Office (ICO) | UK GDPR, DPA 2018, PECR, AADC / Children's Code, IDTA / UK Addendum |
| United Kingdom | Information Commissioner's Office (ICO); Department for Science, Innovation and Technology (smart data, DVS) | DUAA |
| United Kingdom | Information Commissioner's Office (ICO); DSIT | UK–US Data Bridge |
| United Kingdom | Investigatory Powers Commissioner's Office (IPCO); Investigatory Powers Tribunal | IPA |
| United Kingdom | Ofcom | OSA |
| United Kingdom | Sector competent authorities; ICO for relevant digital service providers (online marketplaces, search engines, cloud computing services) | NIS Regulations |
| United Kingdom | Sector regulators; ICO (digital services); DSIT | CS&R Bill |
| United Nations | Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy | Right to privacy in the digital age |
| United Nations | UN Human Rights Committee (treaty body) | ICCPR Art 17 |
| United Nations | UNODC (secretariat); Conference of the States Parties once in force | UN Cybercrime Convention |
| United States | CFPB and FTC; state Attorneys General | FCRA |
| United States | CFPB; FTC; federal banking regulators; state insurance regulators | GLBA |
| United States | Cybersecurity and Infrastructure Security Agency (CISA) | CIRCIA |
| United States | Federal agencies; DOJ Office of Privacy and Civil Liberties (guidance); OMB | Privacy Act |
| United States | Federal and state courts (no regulator) | Fourth Amendment |
| United States | Federal Communications Commission (FCC); state AGs; private litigants | TCPA |
| United States | Federal Trade Commission (FTC) | FTC Act s5, CAN-SPAM, HBNR, Amended COPPA Rule, GLBA Safeguards Rule, PADFA |
| United States | Federal Trade Commission (FTC) (platform duties); DOJ (criminal) | TAKE IT DOWN Act |
| United States | Federal Trade Commission (FTC) and state Attorneys General | COPPA |
| United States | Foreign Intelligence Surveillance Court; ODNI; DOJ; PCLOB | FISA 702 |
| United States | HHS Office for Civil Rights (OCR) | HIPAA Breach Rule / HITECH, HIPAA Security Rule, HIPAA Privacy Rule |
| United States | ODNI Civil Liberties Protection Officer; Data Protection Review Court; PCLOB | EO 14086 |
| United States | Private litigants (courts) | VPPA |
| United States | US Department of Education, Student Privacy Policy Office (SPPO) | FERPA |
| United States | US Department of Justice | CLOUD Act |
| United States | US Department of Justice, National Security Division (NSD) | DOJ Data Security Program |
| United States | US Department of Justice; courts | SCA |
| United States | US Department of Justice; private litigants | DPPA, Wiretap Act |
| United States | US Securities and Exchange Commission (SEC) | SEC cyber disclosure rules |
| Uruguay | Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC | Law 18.331, Decree 64/020 |
| US Virgin Islands | US Virgin Islands Department of Justice (Attorney General) | VI breach law |
| Utah | Utah Attorney General and Utah Cyber Center | UT breach law |
| Utah | Utah Division of Consumer Protection and Utah Attorney General | UCPA |
| Utah | Utah Division of Consumer Protection; Office of Artificial Intelligence Policy | Utah AI Policy Act |
| Uzbekistan | Personalization Agency under the Ministry of Justice (formerly State Personalization Centre); State Inspection on Informatization and Telecommunications (Uzcomnazorat) | ZRU-547 |
| Venezuela | None designated (courts) | CRBV Art. 28 |
| Vermont | Vermont Attorney General | Vermont privacy law |
| Vermont | Vermont Attorney General | VT breach law |
| Vermont | Vermont Secretary of State (registry); Vermont Attorney General (enforcement) | Vermont data broker law |
| Victoria | Health Complaints Commissioner (Vic) | Health Records Act (Vic) |
| Victoria | Office of the Victorian Information Commissioner (OVIC) | PDP Act (Vic) |
| Vietnam | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | Decree 356, PDPL (Vietnam), Decree 13, Cybersecurity Law 2025 (Vietnam), Cybersecurity Law 2018 (Vietnam), Data Law (Vietnam) |
| Virginia | Virginia Attorney General | VCDPA |
| Virginia | Virginia Attorney General | VA breach law |
| Washington | Washington Attorney General | WA breach law |
| Washington | Washington Attorney General | WA biometric law |
| Washington | Washington Attorney General; private litigants | MHMDA |
| West Virginia | West Virginia Attorney General | WV breach law |
| Western Australia | Information Commissioner (WA) with Privacy Deputy Commissioner; Chief Data Officer | PRIS Act |
| Wisconsin | Wisconsin Department of Agriculture, Trade and Consumer Protection | WI breach law |
| Wyoming | Wyoming Attorney General | WY breach law |
| Zambia | Office of the Data Protection Commissioner (Data Protection Commission) | Zambia DPA |
| Zimbabwe | Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as Data Protection Authority | CDPA |