All instruments
559 instruments, as of . Sort by any column, or narrow the list with the filters.
| Jurisdiction | Instrument | Category | Status | In force | Authority | Confidence |
|---|---|---|---|---|---|---|
| Abu Dhabi | ADHICS Abu Dhabi Healthcare Information and Cyber Security Standard | Health data | In force | Department of Health – Abu Dhabi | Medium | |
| Abu Dhabi Global Market | ADGM DPR ADGM Data Protection Regulations 2021 | Comprehensive data protection | In force | Commissioner of Data Protection, ADGM Office of Data Protection | Medium | |
| African Union | Malabo Convention African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) | Comprehensive data protection | In force | National data protection authorities (to be set up by each party); AU Commission | Medium | |
| African Union | AU Data Policy Framework African Union Data Policy Framework | Data access / sharing | In force | AU Commission | Medium | |
| Alabama | Alabama PDPA Alabama Personal Data Protection Act (HB 351, 2026) | Comprehensive data protection | Enacted – not yet in force | Alabama Attorney General | High | |
| Alabama | AL breach law Alabama data breach notification law (Ala. Code § 8-38-1 et seq. (Data Breach Notification Act of 2018)) | Breach notification | In force | Alabama Attorney General | Medium | |
| Alaska | AK breach law Alaska data breach notification law (Alaska Stat. § 45.48.010 et seq. (Personal Information Protection Act)) | Breach notification | In force | Alaska Department of Law (Attorney General) | Medium | |
| Albania | Law 124/2024 Law No. 124/2024 on Personal Data Protection | Comprehensive data protection | Partially in force | Commissioner for the Right to Information and Personal Data Protection (IDP) | High | |
| Alberta | Alberta PIPA Personal Information Protection Act (SA 2003, c. P-6.5) | Comprehensive data protection | In force | Office of the Information and Privacy Commissioner of Alberta (OIPC) | Medium | |
| Alberta | Alberta POPA Protection of Privacy Act (SA 2024, c. P-28.5) | Sectoral privacy | In force | Office of the Information and Privacy Commissioner of Alberta (OIPC) | Medium | |
| Alberta | Alberta HIA Health Information Act (RSA 2000, c. H-5) | Health data | In force | Office of the Information and Privacy Commissioner of Alberta (OIPC) | Medium | |
| Algeria | Law 18-07 Law No. 18-07 of 10 June 2018 on the Protection of Natural Persons in the Processing of Personal Data (as amended by Law No. 25-11 of 24 July 2025) | Comprehensive data protection | In force | Autorité Nationale de Protection des Données à caractère Personnel (ANPDP) | Medium | |
| Andorra | LQPD Qualified Law 29/2021 of 28 October on the protection of personal data (Llei 29/2021, qualificada de protecció de dades personals) | Comprehensive data protection | In force | Agència Andorrana de Protecció de Dades (APDA) | Medium | |
| Angola | Law 22/11 Lei da Proteção de Dados Pessoais – Law No. 22/11 of 17 June 2011 | Comprehensive data protection | In force | Agência de Proteção de Dados (APD) | Medium | |
| Antigua and Barbuda | Antigua DPA Data Protection Act, 2013 (No. 10 of 2013) | Comprehensive data protection | In force | Information Commissioner | Low | |
| Argentina | PDPL 25.326 Personal Data Protection Law No. 25,326 (Ley de Protección de los Datos Personales) | Comprehensive data protection | In force | Agencia de Acceso a la Información Pública (AAIP) | High | |
| Argentina | No Llame National Do Not Call Registry Law No. 26,951 (Registro Nacional No Llame) | ePrivacy / marketing | In force | Agencia de Acceso a la Información Pública (AAIP) | Medium | |
| Argentina | Law 27.699 Law No. 27,699 approving the Protocol amending Convention 108 (Convention 108+) | Treaty / framework | In force | Agencia de Acceso a la Información Pública (AAIP) | Medium | |
| Arizona | AZ breach law Arizona data breach notification law (Ariz. Rev. Stat. §§ 18-551 to 18-552) | Breach notification | In force | Arizona Attorney General | Medium | |
| Arkansas | AR breach law Arkansas data breach notification law (Ark. Code §§ 4-110-101 et seq. (Personal Information Protection Act)) | Breach notification | In force | Arkansas Attorney General | Medium | |
| Armenia | PDP Law Law of the Republic of Armenia on Protection of Personal Data (HO-49-N of 18 May 2015) | Comprehensive data protection | In force | Personal Data Protection Agency (Ministry of Justice) | Medium | |
| Aruba | Aruba LPR National Ordinance on Person Registration (Landsverordening persoonsregistraties) | Comprehensive data protection | In force | Public Prosecutor / Minister of Justice | Medium | |
| Asia-Pacific Economic Cooperation (APEC) | APEC CBPR / PRP APEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) System | Data localisation / cross-border | In force | Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents | Medium | |
| Asia-Pacific Economic Cooperation (APEC) | APEC Privacy Framework | Treaty / framework | In force | APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup | Medium | |
| Association of Southeast Asian Nations (ASEAN) | ASEAN DMF / MCCs ASEAN Digital Data Governance Framework, ASEAN Data Management Framework and ASEAN Model Contractual Clauses for Cross Border Data Flows | Data localisation / cross-border | In force | ASEAN Digital Ministers (ADGMIN) | High | |
| Association of Southeast Asian Nations (ASEAN) | ASEAN PDP Framework ASEAN Framework on Personal Data Protection | Treaty / framework | In force | ASEAN Digital Ministers (ADGMIN) / ASEAN Digital Senior Officials | Medium | |
| Australia | Privacy Act Privacy Act 1988 (Cth) | Comprehensive data protection | In force | Office of the Australian Information Commissioner (OAIC) | High | |
| Australia | POLA Act 2024 Privacy and Other Legislation Amendment Act 2024 (Cth) | Comprehensive data protection | Partially in force | Office of the Australian Information Commissioner (OAIC) | Medium | |
| Australia | DNCR Act Do Not Call Register Act 2006 (Cth) | ePrivacy / marketing | In force | Australian Communications and Media Authority (ACMA) | Low | |
| Australia | Spam Act Spam Act 2003 (Cth) | ePrivacy / marketing | In force | Australian Communications and Media Authority (ACMA) | High | |
| Australia | NDB Scheme Notifiable Data Breaches Scheme (Privacy Act 1988 Part IIIC, inserted by Privacy Amendment (Notifiable Data Breaches) Act 2017) | Breach notification | In force | Office of the Australian Information Commissioner (OAIC) | High | |
| Australia | Social Media Minimum Age Act Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth) | Children's privacy | In force | eSafety Commissioner (age obligation); OAIC (Part 4A privacy) | High | |
| Australia | Children's Online Privacy Code Children's Online Privacy Code (to be made under Privacy Act 1988 s 26GC) | Children's privacy | Bill/proposed | Office of the Australian Information Commissioner (OAIC) | High | |
| Australia | CDR Consumer Data Right (Competition and Consumer Act 2010 Part IVD, inserted by Treasury Laws Amendment (Consumer Data Right) Act 2019) | Data access / sharing | In force | ACCC (regulator) and OAIC (privacy safeguards) | Medium | |
| Australia | Privacy Tort Statutory Tort for Serious Invasions of Privacy (Schedule 2, Privacy Act 1988) | Human rights / constitutional | In force | Courts (private right of action) | Medium | |
| Australian Capital Territory | IP Act (ACT) Information Privacy Act 2014 (ACT) | Comprehensive data protection | In force | ACT Privacy Commissioner (functions performed by OAIC); ACT Human Rights Commission | Medium | |
| Austria | DSG Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Datenschutzgesetz – DSG) | Comprehensive data protection | In force | Österreichische Datenschutzbehörde (DSB) | Medium | |
| Austria | TKG 2021 Telecommunications Act 2021 (Telekommunikationsgesetz 2021 – TKG 2021) | ePrivacy / marketing | In force | Fernmeldebüros (telecom offices) for TKG breaches; Datenschutzbehörde (DSB) where personal data is processed | Medium | |
| Azerbaijan | Law on Personal Data Law of the Republic of Azerbaijan on Personal Data (No. 998-IIIQ of 11 May 2010) | Comprehensive data protection | In force | Ministry of Digital Development and Transport | Low | |
| Bahamas | Bahamas DPA 2003 Data Protection (Privacy of Personal Information) Act, 2003 | Comprehensive data protection | In force | Office of the Data Protection Commissioner | Medium | |
| Bahamas | Bahamas DPA 2025 Data Protection Act, 2025 | Comprehensive data protection | Enacted – not yet in force | Office of the Data Protection Commissioner | Low | |
| Bahrain | Bahrain PDPL Law No. (30) of 2018 with Respect to Personal Data Protection | Comprehensive data protection | In force | Personal Data Protection Authority (functions exercised by Ministry of Justice, Islamic Affairs and Endowments) | High | |
| Bangladesh | PDPA Personal Data Protection Act, 2026 (Act No. 63 of 2026; formerly Personal Data Protection Ordinance, 2025) | Comprehensive data protection | Partially in force | Data Protection Authority / National Data Governance (Management) Authority | Medium | |
| Bangladesh | CSO 2025 Cyber Security Ordinance, 2025 (Ordinance No. 25 of 2025), as continued and amended by Parliament 2026 | Cybersecurity | In force | National Cyber Security Agency | Low | |
| Barbados | Barbados DPA Data Protection Act, 2019 (Act 2019-29) | Comprehensive data protection | Partially in force | Data Protection Commissioner | Medium | |
| Belarus | Law 99-Z Law of the Republic of Belarus No. 99-Z of 7 May 2021 'On Personal Data Protection' | Comprehensive data protection | In force | National Personal Data Protection Centre (NPDPC) | Medium | |
| Belgium | Belgian Data Protection Law 2018 Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data | Comprehensive data protection | In force | Autorité de protection des données / Gegevensbeschermingsautoriteit (APD-GBA) | Medium | |
| Belgium | LCE / WEC Law of 13 June 2005 on electronic communications (Article 10/2 on cookies) and Code of Economic Law Book XII (e-marketing) | ePrivacy / marketing | In force | APD-GBA (cookies/personal data); BIPT/IBPT (telecom); FPS Economy (e-marketing) | Low | |
| Belize | Belize DPA Data Protection Act, 2021 (Act No. 45 of 2021) | Comprehensive data protection | Enacted – not yet in force | Data Protection Commissioner (Not yet established; Ministry of IT and Digital Transformation) | Low | |
| Benin | Code du numérique Law No. 2017-20 of 20 April 2018 on the Digital Code of the Republic of Benin – Book V (Protection of personal data) | Comprehensive data protection | In force | Autorité de Protection des Données à caractère Personnel (APDP) | High | |
| Bermuda | PIPA Personal Information Protection Act 2016 (PIPA) | Comprehensive data protection | In force | Office of the Privacy Commissioner for Bermuda (PrivCom) | High | |
| Bolivia | Art. 130 CPE Political Constitution of the Plurinational State of Bolivia, Article 130 (Acción de Protección de Privacidad) | Human rights / constitutional | In force | None designated (sector regulators) | Medium | |
| Bosnia and Herzegovina | ZZLP 2025 Law on Personal Data Protection of Bosnia and Herzegovina, Official Gazette of BiH No. 12/25 | Comprehensive data protection | In force | Personal Data Protection Agency of Bosnia and Herzegovina (AZLP) | Medium | |
| Botswana | Botswana DPA 2024 Data Protection Act, 2024 (Act No. 18 of 2024) | Comprehensive data protection | In force | Information and Data Protection Commission (IDPC) | Medium | |
| Brazil | LGPD General Personal Data Protection Law, Law No. 13,709/2018 (Lei Geral de Proteção de Dados Pessoais - LGPD) | Comprehensive data protection | In force | Agência Nacional de Proteção de Dados (ANPD) | High | |
| Brazil | Marco Civil Brazilian Civil Rights Framework for the Internet, Law No. 12,965/2014 (Marco Civil da Internet) | Sectoral privacy | In force | Courts; ANPD/consumer authorities for overlapping matters | Medium | |
| Brazil | ANPD Res. 15/2024 Resolution CD/ANPD No. 15/2024 - Regulation on Security Incident Reporting | Breach notification | In force | Agência Nacional de Proteção de Dados (ANPD) | Medium | |
| Brazil | ECA Digital Digital Statute of Children and Adolescents, Law No. 15,211/2025 (ECA Digital) | Children's privacy | In force | Agência Nacional de Proteção de Dados (ANPD) | High | |
| Brazil | ANPD Res. 19/2024 Resolution CD/ANPD No. 19/2024 - Regulation on International Data Transfers and Standard Contractual Clauses | Data localisation / cross-border | In force | Agência Nacional de Proteção de Dados (ANPD) | High | |
| Brazil | EC 115/2022 Constitutional Amendment No. 115/2022 (fundamental right to personal data protection) | Human rights / constitutional | In force | Courts (STF) | Medium | |
| British Columbia | BC PIPA Personal Information Protection Act (SBC 2003, c. 63) | Comprehensive data protection | In force | Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) | Medium | |
| British Virgin Islands | BVI DPA Data Protection Act, 2021 (No. 3 of 2021) | Comprehensive data protection | In force | Office of the Information Commissioner (not yet staffed) | High | |
| Brunei | PDPO (Brunei) Personal Data Protection Order, 2025 | Comprehensive data protection | Partially in force | Responsible Authority (expected: Authority for Info-communications Technology Industry, AITI) | Medium | |
| Bulgaria | PDPA / ZZLD Personal Data Protection Act (Закон за защита на личните данни) | Comprehensive data protection | In force | Commission for Personal Data Protection (CPDP) | Medium | |
| Bulgaria | ECA Electronic Commerce Act (Article 4a) and Electronic Communications Act | ePrivacy / marketing | In force | Commission for Personal Data Protection (CPDP); Communications Regulation Commission (CRC) for telecom | Low | |
| Burkina Faso | Law 001-2021 Law No. 001-2021/AN of 30 March 2021 on the protection of persons with regard to the processing of personal data | Comprehensive data protection | In force | Commission de l'Informatique et des Libertés (CIL) | High | |
| Burundi | Law 1/03 Law No. 1/03 of 10 March 2026 on the protection of personal data | Comprehensive data protection | In force | Not yet established (independent administrative authority provided for) | Medium | |
| Cabo Verde | Law 133/V/2001 Law No. 133/V/2001 on the protection of personal data (as amended by Law 41/VIII/2013 and Law 121/IX/2021) | Comprehensive data protection | In force | Comissão Nacional de Proteção de Dados Pessoais (CNPD) | Medium | |
| California | CCPA/CPRA California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) | Comprehensive data protection | In force | California Privacy Protection Agency (CalPrivacy) and California Attorney General | High | |
| California | Shine the Light California 'Shine the Light' law (Cal. Civ. Code § 1798.83) | Sectoral privacy | In force | California Attorney General; private litigants | Medium | |
| California | CalOPPA California Online Privacy Protection Act (Cal. Bus. & Prof. Code §§ 22575–22579) | Sectoral privacy | In force | California Attorney General | Medium | |
| California | CA breach law California data breach notification law (Cal. Civ. Code §§ 1798.29, 1798.82) | Breach notification | In force | California Attorney General (Department of Justice) | High | |
| California | SOPIPA Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584) | Children's privacy | In force | California Attorney General | Medium | |
| California | SB 976 Protecting Our Kids from Social Media Addiction Act (SB 976, 2024) | Children's privacy | Partially in force | California Attorney General | Medium | |
| California | CAADCA California Age-Appropriate Design Code Act (AB 2273; Cal. Civ. Code § 1798.99.28 et seq.) | Children's privacy | Partially in force | California Attorney General | Medium | |
| California | CCPA ADMT/Risk/Audit Regulations CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, Cybersecurity Audits and Insurance (Cal. Code Regs. tit. 11, § 7000 et seq., 2025 update) | AI / automated decisions | Partially in force | California Privacy Protection Agency (CalPrivacy) | High | |
| California | Delete Act / DROP California Delete Act (SB 362, 2023; Cal. Civ. Code § 1798.99.80 et seq.) | Data access / sharing | In force | California Privacy Protection Agency (CalPrivacy) | High | |
| California | Cal. Const. Art. I §1 California Constitution, Article I, Section 1 (inalienable right to privacy) | Human rights / constitutional | In force | California courts | Medium | |
| Cambodia | Draft PDP Law (Cambodia) Draft Law on Personal Data Protection | Comprehensive data protection | Bill/proposed | Ministry of Post and Telecommunications (MPTC) | Medium | |
| Cambodia | E-Commerce Law (Cambodia) Law on Electronic Commerce (2019) | Sectoral privacy | In force | Ministry of Commerce; MPTC | Low | |
| Cameroon | Law 2024/017 Law No. 2024/017 of 23 December 2024 on the protection of personal data | Comprehensive data protection | In force | Not yet established (Personal Data Protection Authority provided for) | Medium | |
| Canada | PIPEDA Personal Information Protection and Electronic Documents Act (PIPEDA) | Comprehensive data protection | In force | Office of the Privacy Commissioner of Canada (OPC) | High | |
| Canada | Bill C-36 (PPCDA) Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA) and to make related amendments | Comprehensive data protection | Bill/proposed | Proposed Digital Safety and Data Protection Commission of Canada | Medium | |
| Canada | Bill C-27 Bill C-27, Digital Charter Implementation Act, 2022 (CPPA, PIDPTA, AIDA) | Comprehensive data protection | Repealed/superseded | Would have been OPC + Personal Information and Data Protection Tribunal | High | |
| Canada | Privacy Act Privacy Act (R.S.C. 1985, c. P-21) | Sectoral privacy | In force | Office of the Privacy Commissioner of Canada (OPC) | Medium | |
| Canada | CASL An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (Canada's Anti-Spam Legislation) | ePrivacy / marketing | Partially in force | Canadian Radio-television and Telecommunications Commission (CRTC); Competition Bureau; OPC | High | |
| Canada | BSSR Breach of Security Safeguards Regulations (SOR/2018-64) | Breach notification | In force | Office of the Privacy Commissioner of Canada (OPC) | High | |
| Canada | Charter s.8 Canadian Charter of Rights and Freedoms, section 8 (unreasonable search or seizure) | Human rights / constitutional | In force | Courts | Medium | |
| Cayman Islands | Cayman DPA Data Protection Act (2021 Revision) (originally Data Protection Law, 2017) | Comprehensive data protection | In force | Office of the Ombudsman | High | |
| Central African Republic | Law 24/001 Law No. 24/001 on the protection of personal data | Comprehensive data protection | In force | Not yet established | Medium | |
| Chad | Law 007/PR/2015 Law No. 007/PR/2015 of 10 February 2015 on the protection of personal data | Comprehensive data protection | In force | Agence Nationale de Sécurité Informatique et de Certification Électronique (ANSICE) | Medium | |
| Chile | Law 19.628 Law No. 19,628 on the Protection of Private Life (Ley sobre Protección de la Vida Privada) | Comprehensive data protection | In force | None designated (courts; SERNAC for consumer aspects) | Medium | |
| Chile | Law 21.719 Law No. 21,719 regulating the protection and processing of personal data and creating the Personal Data Protection Agency | Comprehensive data protection | Enacted – not yet in force | Agencia de Protección de Datos Personales (Not yet established) | High | |
| China | PI Compliance Audit Measures Administrative Measures for Personal Information Protection Compliance Audits (个人信息保护合规审计管理办法) | Comprehensive data protection | In force | Cyberspace Administration of China (CAC) | High | |
| China | NDSMR Regulations on Network Data Security Management (网络数据安全管理条例) (State Council Decree No. 790) | Comprehensive data protection | In force | Cyberspace Administration of China (CAC) | High | |
| China | PIPL Personal Information Protection Law of the People's Republic of China (个人信息保护法) | Comprehensive data protection | In force | Cyberspace Administration of China (CAC) | High | |
| China | Cyber Incident Reporting Measures Administrative Measures for Reporting National Cybersecurity Incidents (国家网络安全事件报告管理办法) | Breach notification | In force | Cyberspace Administration of China (CAC) | Medium | |
| China | Minors Online Protection Regulations Regulations on the Protection of Minors Online (未成年人网络保护条例) (State Council Decree No. 766) | Children's privacy | In force | Cyberspace Administration of China (CAC) | High | |
| China | AI Content Labelling Measures Measures for Labelling Artificial Intelligence-Generated and Synthetic Content (人工智能生成合成内容标识办法) | AI / automated decisions | In force | CAC with MIIT, MPS and NRTA | High | |
| China | GenAI Measures Interim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法) | AI / automated decisions | In force | CAC with NDRC, MOE, MOST, MIIT, MPS, NRTA | High | |
| China | CSL Amendment 2025 Decision on Amending the Cybersecurity Law of the People's Republic of China (2025) | Cybersecurity | In force | Cyberspace Administration of China (CAC) | High | |
| China | CSL Cybersecurity Law of the People's Republic of China (网络安全法) | Cybersecurity | In force | Cyberspace Administration of China (CAC) | High | |
| China | PI Export Certification Measures Measures for Certification of Outbound Transfer of Personal Information (个人信息出境认证办法) | Data localisation / cross-border | In force | Cyberspace Administration of China (CAC) and State Administration for Market Regulation (SAMR) | High | |
| China | Cross-Border Data Flow Provisions Provisions on Promoting and Regulating Cross-Border Data Flows (促进和规范数据跨境流动规定) | Data localisation / cross-border | In force | Cyberspace Administration of China (CAC) | High | |
| China | China SCC Measures Measures on the Standard Contract for Outbound Transfer of Personal Information (个人信息出境标准合同办法) | Data localisation / cross-border | In force | Cyberspace Administration of China (CAC) | High | |
| China | Security Assessment Measures Measures for the Security Assessment of Outbound Data Transfers (数据出境安全评估办法) | Data localisation / cross-border | In force | Cyberspace Administration of China (CAC) | High | |
| China | DSL Data Security Law of the People's Republic of China (数据安全法) | Data localisation / cross-border | In force | Cyberspace Administration of China (CAC) | High | |
| China | National Network ID Measures Measures for the Administration of National Network Identity Authentication Public Services (国家网络身份认证公共服务管理办法) | Data access / sharing | In force | Ministry of Public Security and CAC (with other ministries) | Medium | |
| Colombia | Decree 1074/2015 Single Regulatory Decree of the Commerce, Industry and Tourism Sector, Decree 1074 of 2015 (incorporating Decree 1377 of 2013) | Comprehensive data protection | In force | Superintendencia de Industria y Comercio (SIC) - Delegatura para la Protección de Datos Personales | Medium | |
| Colombia | Law 1581 Statutory Law No. 1581 of 2012 on general provisions for personal data protection (Ley Estatutaria 1581 de 2012) | Comprehensive data protection | In force | Superintendencia de Industria y Comercio (SIC) - Delegatura para la Protección de Datos Personales | High | |
| Colombia | Law 1266 Statutory Law No. 1266 of 2008 (Habeas Data - financial, credit, commercial and services data) | Financial data | In force | SIC; Superintendencia Financiera de Colombia (for supervised entities) | Medium | |
| Colorado | CPA Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) | Comprehensive data protection | In force | Colorado Attorney General and District Attorneys | Medium | |
| Colorado | CO breach law Colorado data breach notification law (Colo. Rev. Stat. § 6-1-716 (private); § 24-73-103 (government)) | Breach notification | In force | Colorado Attorney General | Medium | |
| Colorado | Colorado biometric amendment Colorado Privacy Act biometric identifier amendment (HB 24-1130) | Biometric | In force | Colorado Attorney General | Medium | |
| Colorado | Colorado AI law (SB 189) Colorado artificial intelligence consumer protection law (SB 26-189) | AI / automated decisions | Enacted – not yet in force | Colorado Attorney General | Medium | |
| Colorado | Colorado AI Act (SB 205) Colorado Consumer Protections for Artificial Intelligence (SB 24-205) | AI / automated decisions | Repealed/superseded | Colorado Attorney General | High | |
| Commonwealth of Nations | Commonwealth Model Law Commonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy Bill | Comprehensive data protection | In force | Commonwealth Secretariat (Rule of Law) | Medium | |
| Comoros | Law on the protection of personal data (2021) | Comprehensive data protection | In force | Not yet established (National Authority provided for) | Low | |
| Connecticut | CTDPA Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.) | Comprehensive data protection | In force | Connecticut Attorney General | High | |
| Connecticut | CT breach law Connecticut data breach notification law (Conn. Gen. Stat. § 36a-701b) | Breach notification | In force | Connecticut Attorney General | Medium | |
| Connecticut | CT consumer health data Connecticut consumer health data provisions (SB 3, Public Act 23-56, amending the CTDPA) | Health data | In force | Connecticut Attorney General | Medium | |
| Costa Rica | Law 8968 Law No. 8968 on the Protection of the Person in the Processing of Personal Data (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales) | Comprehensive data protection | In force | Agencia de Protección de Datos de los Habitantes (PRODHAB) | Medium | |
| Côte d'Ivoire | Law 2013-450 Law No. 2013-450 of 19 June 2013 on the protection of personal data | Comprehensive data protection | In force | Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI) | High | |
| Council of Europe | Convention 108 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data | Comprehensive data protection | In force | Consultative Committee of Convention 108 (T-PD) | High | |
| Council of Europe | Convention 108+ Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+) | Comprehensive data protection | Enacted – not yet in force | Convention Committee (T-PD); national supervisory authorities | High | |
| Council of Europe | CoE AI Convention Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law | AI / automated decisions | Signed – not ratified | Conference of the Parties (once in force) | Medium | |
| Council of Europe | Protocol 181 Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flows | Data localisation / cross-border | In force | National supervisory authorities; T-PD | Medium | |
| Council of Europe | Budapest Convention Convention on Cybercrime (Budapest Convention) | Surveillance / law enforcement access | In force | Cybercrime Convention Committee (T-CY) | Medium | |
| Council of Europe | Budapest 2nd Additional Protocol Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence | Surveillance / law enforcement access | Signed – not ratified | Cybercrime Convention Committee (T-CY) | Medium | |
| Council of Europe | ECHR Art 8 Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8 | Human rights / constitutional | In force | European Court of Human Rights | High | |
| Council of Europe | Rec 509 (1968) Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological Developments | Treaty / framework | In force | None designated | Medium | |
| Council of Europe | Res (74) 29 Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public Sector | Treaty / framework | Repealed/superseded | None designated | Medium | |
| Council of Europe | Res (73) 22 Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private Sector | Treaty / framework | Repealed/superseded | None designated | Medium | |
| Croatia | ZPOUZP Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka) | Comprehensive data protection | In force | Agencija za zaštitu osobnih podataka (AZOP) | High | |
| Croatia | ZEK Electronic Communications Act (Zakon o elektroničkim komunikacijama) | ePrivacy / marketing | In force | Croatian Regulatory Authority for Network Industries (HAKOM); AZOP for personal data | Low | |
| Cuba | Law 149 Law No. 149/2022 on Personal Data Protection (Ley de Protección de Datos Personales) | Comprehensive data protection | In force | Ministry of Justice (with Ministry of Communications) | Low | |
| Curaçao | Lbp Curaçao National Ordinance on Personal Data Protection (Landsverordening bescherming persoonsgegevens) | Comprehensive data protection | In force | College Bescherming Persoonsgegevens (Personal Data Protection Committee) | Medium | |
| Cyprus | Law 125(I)/2018 Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data, Law 125(I)/2018 | Comprehensive data protection | In force | Commissioner for Personal Data Protection | Medium | |
| Cyprus | Law 112(I)/2004 Regulation of Electronic Communications and Postal Services Law, Law 112(I)/2004 | ePrivacy / marketing | In force | Commissioner for Personal Data Protection (cookies/spam); OCECPR (telecom) | Low | |
| Czech Republic | Act 110/2019 Act No. 110/2019 Coll. on the Processing of Personal Data (zákon o zpracování osobních údajů) | Comprehensive data protection | In force | Úřad pro ochranu osobních údajů (ÚOOÚ) | Medium | |
| Czech Republic | Electronic Communications Act Act No. 127/2005 Coll. on Electronic Communications (§89(3) cookies) and Act No. 480/2004 Coll. on Certain Information Society Services (marketing) | ePrivacy / marketing | In force | Úřad pro ochranu osobních údajů (ÚOOÚ) for cookies and commercial communications; Czech Telecommunication Office (ČTÚ) for telecom | Medium | |
| Delaware | DPDPA Delaware Personal Data Privacy Act (6 Del. C. ch. 12D) | Comprehensive data protection | In force | Delaware Department of Justice (Attorney General) | Medium | |
| Delaware | DE breach law Delaware data breach notification law (Del. Code tit. 6, § 12B-101 et seq.) | Breach notification | In force | Delaware Department of Justice (Attorney General) | Medium | |
| Democratic Republic of the Congo | Code du numérique Ordonnance-loi No. 23/010 of 13 March 2023 on the Digital Code (Code du numérique) – personal data provisions | Comprehensive data protection | In force | Not yet established (Autorité de Protection des Données; ARPTIC acting on interim basis) | Medium | |
| Denmark | Databeskyttelsesloven Act on supplementary provisions to the regulation on the protection of natural persons with regard to the processing of personal data (Databeskyttelsesloven), Act No. 502 of 23 May 2018 | Comprehensive data protection | In force | Datatilsynet | Medium | |
| Denmark | Markedsføringsloven Marketing Practices Act (Markedsføringsloven), §10 unsolicited communications | ePrivacy / marketing | In force | Consumer Ombudsman (Forbrugerombudsmanden) | Low | |
| Denmark | Cookie Order Executive Order No. 1148 of 9 December 2011 on information and consent when storing or accessing information in end-user terminal equipment (Cookiebekendtgørelsen) | ePrivacy / marketing | In force | Danish Agency for Digital Government / Danish Business Authority (cookie order); Datatilsynet (GDPR aspects) | Low | |
| District of Columbia | DC breach law District of Columbia data breach notification law (D.C. Code § 28-3851 et seq.) | Breach notification | In force | Office of the Attorney General for the District of Columbia | Medium | |
| Djibouti | Code du numérique Digital Code (Code du numérique) – Book One: Protection of personal data | Comprehensive data protection | In force | Not yet established (Commission Nationale de Protection des Données à Caractère Personnel provided for) | Low | |
| Dominican Republic | Law 172-13 Organic Law No. 172-13 on the Comprehensive Protection of Personal Data | Comprehensive data protection | In force | None general (Superintendencia de Bancos for credit bureaus; Pro Consumidor) | Medium | |
| Dubai | Dubai Data Law Dubai Law No. 26 of 2015 on the Regulation of Data Dissemination and Exchange in the Emirate of Dubai | Data access / sharing | In force | Digital Dubai (Dubai Data and Statistics Establishment) | Medium | |
| Dubai Healthcare City | DHCC HDPR DHCC Health Data Protection Regulation No. 7 of 2013 | Health data | In force | Dubai Healthcare City Authority; Centre for Healthcare Planning and Quality (CPQ) | Medium | |
| Dubai International Financial Centre | DIFC DPL Data Protection Law, DIFC Law No. 5 of 2020 | Comprehensive data protection | In force | Commissioner of Data Protection (DIFC) | High | |
| Dubai International Financial Centre | DIFC Regulation 10 DIFC Data Protection Regulations – Regulation 10 (Processing Personal Data Through Autonomous and Semi-Autonomous Systems) | AI / automated decisions | In force | Commissioner of Data Protection (DIFC) | Medium | |
| East African Community (EAC) | EAC Cyberlaws Framework EAC Legal Framework for Cyberlaws (Phase I) | Treaty / framework | In force | None designated | Low | |
| Economic Community of West African States (ECOWAS) | ECOWAS Supplementary Act Supplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWAS | Comprehensive data protection | In force | National data protection authorities of ECOWAS member states | Medium | |
| Ecuador | LOPDP Regulation General Regulation of the Organic Law on Personal Data Protection (Executive Decree No. 904) | Comprehensive data protection | In force | Superintendencia de Protección de Datos Personales (SPDP) | Medium | |
| Ecuador | LOPDP Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales - LOPDP) | Comprehensive data protection | In force | Superintendencia de Protección de Datos Personales (SPDP) | High | |
| Egypt | Egypt PDPL Executive Regulations Executive Regulations of the Personal Data Protection Law (Ministerial Decree No. 816 of 2025) | Comprehensive data protection | In force | Personal Data Protection Centre (PDPC) | High | |
| Egypt | Egypt PDPL Law No. 151 of 2020 on the Protection of Personal Data | Comprehensive data protection | In force | Personal Data Protection Centre (PDPC) | High | |
| Egypt | Anti-Cybercrime Law Law No. 175 of 2018 on Combating Information Technology Crimes | Surveillance / law enforcement access | In force | National Telecom Regulatory Authority (NTRA); Public Prosecution | Medium | |
| El Salvador | LPDP El Salvador Personal Data Protection Law (Ley de Protección de Datos Personales, Legislative Decree No. 144) | Comprehensive data protection | In force | Agencia de Ciberseguridad del Estado (ACE) | Medium | |
| El Salvador | Ley de Ciberseguridad Cybersecurity and Information Security Law (Ley de Ciberseguridad y Seguridad de la Información) | Cybersecurity | In force | Agencia de Ciberseguridad del Estado (ACE) | Medium | |
| Equatorial Guinea | Law 1/2016 Law No. 1/2016 of 22 July 2016 on the protection of personal data (Ley de Protección de Datos Personales) | Comprehensive data protection | In force | Not yet established (Órgano Rector de Protección de Datos Personales provided for) | Medium | |
| Estonia | IKS / PDPA Personal Data Protection Act (Isikuandmete kaitse seadus) | Comprehensive data protection | In force | Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) | Medium | |
| Estonia | ESS Electronic Communications Act (Elektroonilise side seadus) and Information Society Services Act | ePrivacy / marketing | In force | Andmekaitse Inspektsioon (cookies/marketing); Consumer Protection and Technical Regulatory Authority (TTJA) | Low | |
| Eswatini | Eswatini DPA Data Protection Act, 2022 (Act No. 5 of 2022) | Comprehensive data protection | In force | Eswatini Communications Commission (ESCCOM) as Data Protection Authority | Low | |
| Ethiopia | PDPP Personal Data Protection Proclamation No. 1321/2024 | Comprehensive data protection | In force | Ethiopian Communications Authority (ECA) | Medium | |
| European Economic Area | GDPR in the EEA EEA Joint Committee Decision No 154/2018 incorporating Regulation (EU) 2016/679 into the EEA Agreement | Comprehensive data protection | In force | National DPAs of Iceland, Liechtenstein and Norway (EDPB members without voting rights on some matters); EFTA Surveillance Authority | High | |
| European Union | EUDPR Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies | Comprehensive data protection | In force | European Data Protection Supervisor (EDPS) | High | |
| European Union | GDPR Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) | Comprehensive data protection | In force | European Data Protection Board (EDPB) / national supervisory authorities | High | |
| European Union | GDPR Procedural Regulation Regulation (EU) 2025/2518 laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 | Comprehensive data protection | Enacted – not yet in force | European Data Protection Board (EDPB) / national supervisory authorities | Medium | |
| European Union | Digital Omnibus (data) Proposal for a Regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus) | Comprehensive data protection | Bill/proposed | Medium | ||
| European Union | Data Protection Directive Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data | Comprehensive data protection | Repealed/superseded | Article 29 Working Party (replaced by EDPB) / national DPAs | High | |
| European Union | DSA Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act) | Sectoral privacy | In force | European Commission (VLOPs/VLOSEs); national Digital Services Coordinators | High | |
| European Union | TTPA Regulation (EU) 2024/900 on the transparency and targeting of political advertising | ePrivacy / marketing | In force | National DPAs (targeting rules, Art 18–19); other national competent authorities; EDPB | Medium | |
| European Union | ePrivacy Directive Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive) | ePrivacy / marketing | In force | National telecoms regulators and/or data protection authorities (varies by member state) | High | |
| European Union | EHDS Regulation (EU) 2025/327 on the European Health Data Space | Health data | Partially in force | National digital health authorities; health data access bodies; EHDS Board | High | |
| European Union | AI Act Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) | AI / automated decisions | Partially in force | European AI Office (GPAI); national market surveillance authorities; European AI Board | High | |
| European Union | NIS2 Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive) | Cybersecurity | In force | National competent authorities and CSIRTs; ENISA; NIS Cooperation Group | High | |
| European Union | DORA Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) | Cybersecurity | In force | National financial supervisors; ESAs (EBA, EIOPA, ESMA) as lead overseers of critical ICT third-party providers | Medium | |
| European Union | CRA Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act) | Cybersecurity | Partially in force | National market surveillance authorities; ENISA (single reporting platform); CSIRTs | High | |
| European Union | EU–US DPF Commission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy Framework | Data localisation / cross-border | In force | European Commission; US Department of Commerce (DPF list); FTC/DoT enforcement; Data Protection Review Court | High | |
| European Union | EU SCCs 2021 Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countries | Data localisation / cross-border | In force | European Data Protection Board (EDPB) / national supervisory authorities | High | |
| European Union | Free Flow of Non-Personal Data Regulation Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European Union | Data localisation / cross-border | In force | Member state single points of contact; European Commission | High | |
| European Union | DMA Regulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act) | Data access / sharing | In force | European Commission | High | |
| European Union | DGA Regulation (EU) 2022/868 on European data governance (Data Governance Act) | Data access / sharing | In force | National competent authorities; European Data Innovation Board | High | |
| European Union | Data Act Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act) | Data access / sharing | Partially in force | National competent authorities (data coordinator); DPAs for personal data aspects | High | |
| European Union | LED Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law enforcement purposes (Law Enforcement Directive) | Surveillance / law enforcement access | In force | National supervisory authorities | High | |
| European Union | CFR Arts 7–8 Charter of Fundamental Rights of the European Union, Articles 7 and 8 | Human rights / constitutional | In force | Court of Justice of the European Union; independent supervisory authorities (Art 8(3)) | High | |
| European Union | TFEU Art 16 Treaty on the Functioning of the European Union, Article 16 | Human rights / constitutional | In force | Independent supervisory authorities | High | |
| Faroe Islands | Dátuverndarlógin Faroese Data Protection Act – Løgtingslóg nr. 80 frá 7. juni 2020 um vernd av persónupplýsingum (Dátuverndarlógin) | Comprehensive data protection | In force | Dátueftirlitið (Faroese Data Protection Authority) | Medium | |
| Fiji | Constitution s24 Constitution of the Republic of Fiji (2013), Section 24 – Right to Privacy | Human rights / constitutional | In force | None designated | Medium | |
| Finland | Tietosuojalaki Data Protection Act (Tietosuojalaki) 1050/2018 | Comprehensive data protection | In force | Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) | Medium | |
| Finland | Electronic Communications Services Act Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista) 917/2014 | ePrivacy / marketing | In force | Finnish Transport and Communications Agency (Traficom) for cookies; Data Protection Ombudsman for direct marketing | Low | |
| Florida | FDBR Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.) | Comprehensive data protection | In force | Florida Attorney General (Department of Legal Affairs) | Low | |
| Florida | FL breach law Florida data breach notification law (Fla. Stat. § 501.171 (Florida Information Protection Act of 2014)) | Breach notification | In force | Florida Department of Legal Affairs (Attorney General) | High | |
| France | LIL Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (Loi Informatique et Libertés) | Comprehensive data protection | In force | Commission Nationale de l'Informatique et des Libertés (CNIL) | Medium | |
| France | Art 82 LIL / CPCE L34-5 Article 82 of Law 78-17 (cookies) and Article L34-5 of the Postal and Electronic Communications Code (CPCE) (direct marketing) | ePrivacy / marketing | In force | CNIL (cookies and marketing); DGCCRF also enforces L34-5 | Medium | |
| France | Projet de loi Résilience Bill on the resilience of critical infrastructure and strengthening of cybersecurity (Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité) | Cybersecurity | Bill/proposed | Agence nationale de la sécurité des systèmes d'information (ANSSI) | Medium | |
| Gabon | Law 001/2011 Law No. 001/2011 of 25 September 2011 on the protection of personal data, as amended by Law No. 025/2023 of 9 July 2023 | Comprehensive data protection | In force | Autorité de Protection des Données Personnelles et de la Vie Privée (APDPVP), formerly CNPDCP | Medium | |
| Georgia | PDP Law 2023 Law of Georgia on Personal Data Protection (No. 3144-XIმს-Xმპ of 14 June 2023) | Comprehensive data protection | In force | State Audit Office of Georgia (since 2 March 2026; previously Personal Data Protection Service) | Medium | |
| Georgia | GA breach law Georgia data breach notification law (Ga. Code §§ 10-1-910 to 10-1-912) | Breach notification | In force | Georgia Attorney General (Consumer Protection Division) | Medium | |
| Germany | BDSG Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) | Comprehensive data protection | In force | Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) for federal public bodies/telecom; 16 Länder DPAs for the private sector | Medium | |
| Germany | EinwV Consent Management Ordinance (Einwilligungsverwaltungsverordnung – EinwV) | ePrivacy / marketing | In force | Federal Commissioner (BfDI) recognises consent management services | Medium | |
| Germany | TDDDG (ex-TTDSG) Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), formerly TTDSG | ePrivacy / marketing | In force | BfDI (telecom services); Länder DPAs (digital services/websites) | Medium | |
| Germany | UWG §7 Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG), §7 unreasonable harassment | ePrivacy / marketing | In force | Private enforcement (competitors, associations); Bundesnetzagentur for telephone marketing | Low | |
| Germany | NIS2UmsuCG / BSIG NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), incl. the recast BSI Act (BSIG) | Cybersecurity | In force | Bundesamt für Sicherheit in der Informationstechnik (BSI) | High | |
| Ghana | Act 843 Data Protection Act, 2012 (Act 843) | Comprehensive data protection | In force | Data Protection Commission (DPC) | High | |
| Gibraltar | Gibraltar GDPR Gibraltar General Data Protection Regulation (Regulation (EU) 2016/679 as applied in Gibraltar, as amended by the Data Protection Regulations 2026) | Comprehensive data protection | In force | Gibraltar Regulatory Authority (as Information Commissioner) | Medium | |
| Gibraltar | DPA 2004 Data Protection Act 2004 (Gibraltar) | Comprehensive data protection | In force | Gibraltar Regulatory Authority (as Information Commissioner) | Medium | |
| Global Cross-Border Privacy Rules Forum | Global CBPR / Global PRP Global Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) Systems | Data localisation / cross-border | In force | Global CBPR Forum; Accountability Agents | Medium | |
| Greece | Law 4624/2019 Law 4624/2019 on the Hellenic Data Protection Authority, implementing measures for the GDPR and transposing Directive (EU) 2016/680 | Comprehensive data protection | In force | Hellenic Data Protection Authority (HDPA) | Medium | |
| Greece | Law 3471/2006 Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector | ePrivacy / marketing | In force | Hellenic Data Protection Authority (cookies/marketing); Hellenic Authority for Communication Security and Privacy (ADAE) for confidentiality of communications | Low | |
| Greenland | Persondataloven (Greenland) Danish Act on Processing of Personal Data (Act No. 429 of 31 May 2000) as brought into force for Greenland by Royal Decree | Comprehensive data protection | In force | Datatilsynet (Danish Data Protection Agency) | Low | |
| Grenada | Grenada DPA Data Protection Act, 2023 (No. 1 of 2023) | Comprehensive data protection | Enacted – not yet in force | Information Commission (three commissioners) | Low | |
| Guam | GU breach law Guam data breach notification law (9 GCA §§ 48-10 et seq. (Notification of Breaches of Personal Information)) | Breach notification | In force | Office of the Attorney General of Guam | Low | |
| Guatemala | LAIP (Decree 57-2008) Law on Access to Public Information (Decree 57-2008) - habeas data and personal data provisions | Sectoral privacy | In force | Procurador de los Derechos Humanos (Human Rights Ombudsman) | Medium | |
| Guernsey (Bailiwick of) | DPL 2017 Data Protection (Bailiwick of Guernsey) Law, 2017 | Comprehensive data protection | In force | Data Protection Authority / Office of the Data Protection Authority (ODPA) | High | |
| Guinea | L/2016/037/AN Law No. L/2016/037/AN of 28 July 2016 on cybersecurity and protection of personal data | Comprehensive data protection | In force | Not yet established | Medium | |
| Guyana | Guyana DPA Data Protection Act, 2023 (Act No. 18 of 2023) | Comprehensive data protection | Enacted – not yet in force | Data Protection Commissioner (not yet established) | Medium | |
| Hawaii | HI breach law Hawaii data breach notification law (Haw. Rev. Stat. § 487N-1 et seq.) | Breach notification | In force | Hawaii Office of Consumer Protection (DCCA) | Medium | |
| Honduras | Habeas data (Art. 182) Constitution of Honduras, Article 182 (habeas data) and Transparency and Access to Public Information Law (Decree 170-2006) | Human rights / constitutional | In force | Instituto de Acceso a la Información Pública (IAIP) | Medium | |
| Hong Kong | PDPO Personal Data (Privacy) Ordinance (Cap. 486) | Comprehensive data protection | In force | Office of the Privacy Commissioner for Personal Data (PCPD) | High | |
| Hong Kong | PDPO Doxxing Amendment Personal Data (Privacy) (Amendment) Ordinance 2021 | Sectoral privacy | In force | Office of the Privacy Commissioner for Personal Data (PCPD) | Medium | |
| Hong Kong | PCICSO Protection of Critical Infrastructures (Computer Systems) Ordinance | Cybersecurity | In force | Commissioner's Office under the Security Bureau | Medium | |
| Hong Kong | GBA Standard Contract Standard Contract for Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) | Data localisation / cross-border | In force | PCPD / Innovation, Technology and Industry Bureau with CAC | Medium | |
| Hungary | Infotv. Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.) | Comprehensive data protection | In force | Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) | Medium | |
| Hungary | Eht. Act C of 2003 on Electronic Communications (§155(4) cookies) and Act XLVIII of 2008 on Commercial Advertising (§6 marketing) | ePrivacy / marketing | In force | NAIH (cookies/personal data); National Media and Infocommunications Authority (NMHH); Consumer protection authority (advertising) | Low | |
| Ibero-American Data Protection Network (RIPD) | RIPD Standards Standards for Personal Data Protection for Ibero-American States (Estándares de Protección de Datos Personales para los Estados Iberoamericanos) | Treaty / framework | In force | Red Iberoamericana de Protección de Datos (RIPD) | Medium | |
| Iceland | Act 90/2018 Act No. 90/2018 on Data Protection and the Processing of Personal Data (Lög um persónuvernd og vinnslu persónuupplýsinga) | Comprehensive data protection | In force | Persónuvernd (Icelandic Data Protection Authority) | High | |
| Idaho | ID breach law Idaho data breach notification law (Idaho Code §§ 28-51-104 to 28-51-107) | Breach notification | In force | Idaho Attorney General | Medium | |
| Illinois | IL breach law Illinois data breach notification law (815 ILCS 530 (Personal Information Protection Act)) | Breach notification | In force | Illinois Attorney General | Medium | |
| Illinois | BIPA Biometric Information Privacy Act (740 ILCS 14) | Biometric | In force | Private litigants (courts); Illinois Attorney General | High | |
| Illinois | IL AI in employment Illinois Human Rights Act amendment on artificial intelligence in employment (HB 3773, Public Act 103-0804) | AI / automated decisions | In force | Illinois Department of Human Rights; Illinois Human Rights Commission | Low | |
| India | DPDP Act Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) | Comprehensive data protection | Partially in force | Data Protection Board of India | High | |
| India | DPDP Rules Digital Personal Data Protection Rules, 2025 | Comprehensive data protection | Partially in force | Data Protection Board of India | High | |
| India | IT Rules 2021 Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 | Sectoral privacy | In force | Ministry of Electronics and Information Technology (MeitY) | Medium | |
| India | SPDI Rules Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 | Sectoral privacy | In force | MeitY / adjudicating officers under IT Act | Medium | |
| India | IT Act s43A/72A Information Technology Act, 2000 - sections 43A and 72A | Sectoral privacy | In force | Adjudicating officers under IT Act / courts; MeitY | Medium | |
| India | CERT-In Directions 2022 CERT-In Directions under section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents | Cybersecurity | In force | Indian Computer Emergency Response Team (CERT-In) | High | |
| India | RBI data localisation RBI Directive on Storage of Payment System Data (RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018) | Data localisation / cross-border | In force | Reserve Bank of India (RBI) | High | |
| India | Telecom Act 2023 Telecommunications Act, 2023 (Act No. 44 of 2023) | Surveillance / law enforcement access | Partially in force | Department of Telecommunications (DoT) | Low | |
| India | Puttaswamy Justice K.S. Puttaswamy (Retd.) v Union of India - right to privacy judgment (Constitution of India, Article 21) | Human rights / constitutional | In force | Supreme Court of India | High | |
| Indiana | Indiana CDPA Indiana Consumer Data Protection Act (Ind. Code § 24-15) | Comprehensive data protection | In force | Indiana Attorney General | Medium | |
| Indiana | IN breach law Indiana data breach notification law (Ind. Code § 24-4.9 (private); § 4-1-11 (state agencies)) | Breach notification | In force | Indiana Attorney General | Medium | |
| Indonesia | PDP Law Law No. 27 of 2022 on Personal Data Protection (UU PDP) | Comprehensive data protection | In force | PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI) | High | |
| Indonesia | GR 71/2019 Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions | Sectoral privacy | In force | PDP Agency (not yet established); interim: Ministry of Communication and Digital Affairs (KOMDIGI) | Medium | |
| Iowa | Iowa CDPA Iowa Act Relating to Consumer Data Protection (Iowa Code ch. 715D) | Comprehensive data protection | In force | Iowa Attorney General | Medium | |
| Iowa | IA breach law Iowa data breach notification law (Iowa Code ch. 715C) | Breach notification | In force | Iowa Attorney General (Consumer Protection Division) | Medium | |
| Ireland | DPA 2018 Data Protection Act 2018 (No. 7 of 2018) | Comprehensive data protection | In force | Data Protection Commission (DPC) | High | |
| Ireland | ePrivacy Regulations 2011 European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011) | ePrivacy / marketing | In force | Data Protection Commission (DPC); ComReg for some telecom aspects | Medium | |
| Isle of Man | IoM DPA 2018 Data Protection Act 2018 (Isle of Man), with the Data Protection (Application of GDPR) Order 2018 and the GDPR and LED Implementing Regulations 2018 | Comprehensive data protection | In force | Isle of Man Information Commissioner | Low | |
| Israel | PPL Protection of Privacy Law, 5741-1981 (as amended by Amendment No. 13) | Comprehensive data protection | In force | Privacy Protection Authority (PPA) | High | |
| Israel | Data Security Regulations Protection of Privacy Regulations (Data Security), 5777-2017 | Cybersecurity | In force | Privacy Protection Authority (PPA) | High | |
| Israel | EEA Data Regulations Protection of Privacy Regulations (Instructions for Data Transferred to Israel from the European Economic Area), 5783-2023 | Data localisation / cross-border | In force | Privacy Protection Authority (PPA) | High | |
| Israel | Transfer Regulations Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001 | Data localisation / cross-border | In force | Privacy Protection Authority (PPA) | High | |
| Italy | Codice Privacy Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003 (Codice in materia di protezione dei dati personali) | Comprehensive data protection | In force | Garante per la protezione dei dati personali | Medium | |
| Italy | Codice Privacy Arts 122/130 Personal Data Protection Code, Title X (Arts 121-132-quater): electronic communications – cookies (Art 122) and unsolicited communications (Art 130) | ePrivacy / marketing | In force | Garante per la protezione dei dati personali | Medium | |
| Italy | Legge 132/2025 (Legge IA) Law No. 132 of 23 September 2025 on provisions and delegations to the Government on artificial intelligence | AI / automated decisions | In force | Agenzia per l'Italia Digitale (AgID) and Agenzia per la Cybersicurezza Nazionale (ACN); Garante for personal data | Medium | |
| Italy | D.Lgs. 138/2024 (Decreto NIS) Legislative Decree No. 138 of 4 September 2024 transposing Directive (EU) 2022/2555 (NIS2) | Cybersecurity | In force | Agenzia per la Cybersicurezza Nazionale (ACN) | High | |
| Jamaica | Jamaica DPA Data Protection Act, 2020 | Comprehensive data protection | In force | Office of the Information Commissioner (OIC) | Medium | |
| Japan | APPI Act on the Protection of Personal Information (Act No. 57 of 2003) | Comprehensive data protection | In force | Personal Information Protection Commission (PPC) | High | |
| Japan | APPI Amendment 2026 Act Partially Amending the Act on the Protection of Personal Information (Act No. 56 of 2026) | Comprehensive data protection | Enacted – not yet in force | Personal Information Protection Commission (PPC) | High | |
| Japan | My Number Act Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (Act No. 27 of 2013) | Sectoral privacy | In force | Personal Information Protection Commission (PPC) | Medium | |
| Japan | TBA External Transmission Rule Telecommunications Business Act – External Transmission of User Information Rule (Art. 27-12, 2022 amendment) | ePrivacy / marketing | In force | Ministry of Internal Affairs and Communications (MIC) | High | |
| Japan | Anti-Spam Act Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002) | ePrivacy / marketing | In force | Ministry of Internal Affairs and Communications / Consumer Affairs Agency | Medium | |
| Japan | AI Promotion Act Act on Promotion of Research and Development and Utilization of Artificial Intelligence-Related Technologies | AI / automated decisions | In force | AI Strategy Headquarters (Cabinet) | Medium | |
| Jersey | DPJL Data Protection (Jersey) Law 2018 | Comprehensive data protection | In force | Jersey Data Protection Authority / Jersey Office of the Information Commissioner (JOIC) | High | |
| Jersey | DPAJL Data Protection Authority (Jersey) Law 2018 | Comprehensive data protection | In force | Jersey Data Protection Authority | Medium | |
| Jordan | Jordan PDPL Personal Data Protection Law No. (24) of 2023 | Comprehensive data protection | In force | Personal Data Protection Council and Data Protection Unit, Ministry of Digital Economy and Entrepreneurship | Medium | |
| Kansas | KS breach law Kansas data breach notification law (Kan. Stat. § 50-7a01 et seq.) | Breach notification | In force | Kansas Attorney General | Medium | |
| Kazakhstan | PD Law Law of the Republic of Kazakhstan No. 94-V 'On Personal Data and Their Protection' | Comprehensive data protection | In force | Ministry of Artificial Intelligence and Digital Development (Committee for Information Security) | Medium | |
| Kazakhstan | AI Law Law of the Republic of Kazakhstan No. 230-VIII 'On Artificial Intelligence' | AI / automated decisions | In force | Ministry of Artificial Intelligence and Digital Development | Medium | |
| Kentucky | KCDPA Kentucky Consumer Data Protection Act (KRS 367.3611 et seq.) | Comprehensive data protection | In force | Kentucky Attorney General | Medium | |
| Kentucky | KY breach law Kentucky data breach notification law (Ky. Rev. Stat. § 365.732 (private); §§ 61.931-.934 (public agencies)) | Breach notification | In force | Kentucky Attorney General | Medium | |
| Kenya | Kenya DP Regulations 2021 Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 and Data Protection (General) Regulations, 2021 | Comprehensive data protection | In force | Office of the Data Protection Commissioner (ODPC) | High | |
| Kenya | Kenya DPA Data Protection Act, 2019 (No. 24 of 2019) | Comprehensive data protection | In force | Office of the Data Protection Commissioner (ODPC) | High | |
| Kosovo | LPPD Law No. 06/L-082 on Protection of Personal Data | Comprehensive data protection | In force | Information and Privacy Agency (IPA / AIP) | Medium | |
| Kuwait | Kuwait DPPR CITRA Data Privacy Protection Regulation (Administrative Decision No. 26 of 2024) | Sectoral privacy | In force | Communications and Information Technology Regulatory Authority (CITRA) | Medium | |
| Kuwait | E-Transactions Law Law No. 20 of 2014 on Electronic Transactions | Sectoral privacy | In force | None designated | Medium | |
| Kyrgyzstan | Digital Code Digital Code of the Kyrgyz Republic (No. 178) | Comprehensive data protection | In force | State Agency for Personal Data Protection under the Cabinet of Ministers | Medium | |
| Kyrgyzstan | Law on Personal Information Law of the Kyrgyz Republic No. 58 'On Personal Information' | Comprehensive data protection | Repealed/superseded | State Agency for Personal Data Protection under the Cabinet of Ministers | Medium | |
| Laos | EDP Law (Laos) Law on Electronic Data Protection (No. 25/NA) | Comprehensive data protection | In force | Ministry of Technology and Communications (MTC) | Medium | |
| Latvia | PDPL Personal Data Processing Law (Fizisko personu datu apstrādes likums) | Comprehensive data protection | In force | Datu valsts inspekcija (Data State Inspectorate, DVI) | Medium | |
| Latvia | ISS Law Law on Information Society Services (Informācijas sabiedrības pakalpojumu likums) | ePrivacy / marketing | In force | Data State Inspectorate (DVI); Consumer Rights Protection Centre for some marketing | Low | |
| Lebanon | Law 81/2018 Law No. 81 of 2018 on Electronic Transactions and Personal Data | Comprehensive data protection | In force | Ministry of Economy and Trade (permits/licences); no DPA | Medium | |
| Lesotho | Lesotho DPA Data Protection Act, 2011 (Act No. 5 of 2012) | Comprehensive data protection | In force | Not yet established (Data Protection Commission provided for) | Medium | |
| Libya | Cybercrime Law Law No. 5 of 2022 on Combating Cybercrime | Cybersecurity | In force | National Information Security and Safety Authority (NISSA) | Medium | |
| Liechtenstein | DSG Data Protection Act of 4 October 2018 (Datenschutzgesetz, DSG), LGBl. 2018 Nr. 272 | Comprehensive data protection | In force | Datenschutzstelle Liechtenstein | Medium | |
| Lithuania | ADTAĮ Law on Legal Protection of Personal Data (Asmens duomenų teisinės apsaugos įstatymas) | Comprehensive data protection | In force | Valstybinė duomenų apsaugos inspekcija (VDAI); Inspector of Journalist Ethics for media | Medium | |
| Lithuania | ERĮ Law on Electronic Communications (Elektroninių ryšių įstatymas) | ePrivacy / marketing | In force | Valstybinė duomenų apsaugos inspekcija (VDAI) for cookies/marketing; Communications Regulatory Authority (RRT) for telecom | Medium | |
| Louisiana | LDPA Louisiana Data Privacy Act | Comprehensive data protection | Enacted – not yet in force | Louisiana Attorney General | High | |
| Louisiana | LA breach law Louisiana data breach notification law (La. Rev. Stat. §§ 51:3071 et seq.; La. Admin. Code tit. 16, pt. III, § 701) | Breach notification | In force | Louisiana Attorney General (Consumer Protection Section) | High | |
| Luxembourg | Loi du 1er août 2018 Law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework | Comprehensive data protection | In force | Commission nationale pour la protection des données (CNPD) | Medium | |
| Luxembourg | Loi du 30 mai 2005 Law of 30 May 2005 on specific provisions for the protection of persons with regard to the processing of personal data in the electronic communications sector | ePrivacy / marketing | In force | CNPD; Institut Luxembourgeois de Régulation (ILR) for telecom | Low | |
| Macau | PDPA (Macau) Personal Data Protection Act (Law No. 8/2005) (Lei da Protecção de Dados Pessoais) | Comprehensive data protection | In force | Office for Personal Data Protection (GPDP/OPDP) | Medium | |
| Macau | Macau Cybersecurity Law Cybersecurity Law (Law No. 13/2019) | Cybersecurity | In force | Cybersecurity Incident Alert and Response Center (CARIC) / Cybersecurity Committee | Low | |
| Madagascar | Law 2014-038 Law No. 2014-038 on the protection of personal data | Comprehensive data protection | In force | Commission Malagasy sur l'Informatique et des Libertés (CMIL) – not yet fully operational | Medium | |
| Maine | ME breach law Maine data breach notification law (10 Me. Rev. Stat. § 1346 et seq. (Notice of Risk to Personal Data Act)) | Breach notification | In force | Maine Attorney General / Department of Professional and Financial Regulation | Medium | |
| Malawi | Malawi DPA Data Protection Act, 2024 | Comprehensive data protection | In force | Malawi Communications Regulatory Authority (MACRA) | Medium | |
| Malaysia | PDPA (Malaysia) Personal Data Protection Act 2010 (Act 709) | Comprehensive data protection | In force | Personal Data Protection Commissioner (JPDP) | Medium | |
| Malaysia | Malaysia DBN & DPO Guidelines Data Breach Notification Guideline and Data Protection Officer Guideline (Circulars 1/2025 and 2/2025) | Breach notification | In force | Personal Data Protection Commissioner (JPDP) | Medium | |
| Malaysia | Malaysia CBPDT Guidelines Cross Border Personal Data Transfer Guidelines (Guideline No. 03/2025) | Data localisation / cross-border | In force | Personal Data Protection Commissioner (JPDP) | High | |
| Mali | Law 2013-015 Law No. 2013-015 of 21 May 2013 on the protection of personal data | Comprehensive data protection | In force | Autorité de Protection des Données à caractère Personnel (APDP) | Medium | |
| Malta | DPA Cap. 586 Data Protection Act (Cap. 586) | Comprehensive data protection | In force | Information and Data Protection Commissioner (IDPC) | Medium | |
| Malta | S.L. 586.01 Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 586.01) | ePrivacy / marketing | In force | Information and Data Protection Commissioner (IDPC) | Low | |
| Maryland | MODPA Maryland Online Data Privacy Act of 2024 (Md. Code, Com. Law § 14-4601 et seq.) | Comprehensive data protection | In force | Maryland Attorney General (Consumer Protection Division) | Medium | |
| Maryland | MD breach law Maryland data breach notification law (Md. Code Com. Law § 14-3501 et seq. (Personal Information Protection Act)) | Breach notification | In force | Maryland Attorney General (Identity Theft Unit) | Medium | |
| Massachusetts | MA breach law Massachusetts data breach notification law (Mass. Gen. Laws ch. 93H; 201 CMR 17.00) | Breach notification | In force | Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation | High | |
| Massachusetts | 201 CMR 17.00 Standards for the Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00) | Cybersecurity | In force | Massachusetts Attorney General; Office of Consumer Affairs and Business Regulation | Medium | |
| Mauritania | Law 2017-020 Law No. 2017-020 of 22 July 2017 on the Protection of Personal Data | Comprehensive data protection | In force | Autorité de Protection des Données à caractère Personnel (APD) | Low | |
| Mauritius | Mauritius DPA Data Protection Act 2017 (Act No. 20 of 2017) | Comprehensive data protection | In force | Data Protection Office (Data Protection Commissioner) | Medium | |
| Mexico | LFPDPPP 2025 Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, 2025) | Comprehensive data protection | In force | Secretaría Anticorrupción y Buen Gobierno (SABG) | High | |
| Mexico | LGPDPPSO 2025 General Law on the Protection of Personal Data Held by Obligated Subjects (Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados, 2025) | Sectoral privacy | In force | SABG (federal) and state-level guarantor bodies | Low | |
| Michigan | MI breach law Michigan data breach notification law (Mich. Comp. Laws §§ 445.63, 445.72 (Identity Theft Protection Act)) | Breach notification | In force | Michigan Attorney General | Medium | |
| Minnesota | MCDPA Minnesota Consumer Data Privacy Act (Minn. Stat. ch. 325M) | Comprehensive data protection | In force | Minnesota Attorney General | Medium | |
| Minnesota | MN breach law Minnesota data breach notification law (Minn. Stat. § 325E.61 (private); § 13.055 (government)) | Breach notification | In force | Minnesota Attorney General | Medium | |
| Mississippi | MS breach law Mississippi data breach notification law (Miss. Code § 75-24-29) | Breach notification | In force | Mississippi Attorney General | Medium | |
| Missouri | MO breach law Missouri data breach notification law (Mo. Rev. Stat. § 407.1500) | Breach notification | In force | Missouri Attorney General | Medium | |
| Moldova | Law 195/2024 Law No. 195 of 25 July 2024 on Personal Data Protection | Comprehensive data protection | In force | National Center for Personal Data Protection (NCPDP) | Medium | |
| Moldova | Law 133/2011 Law No. 133 of 8 July 2011 on Personal Data Protection | Comprehensive data protection | Repealed/superseded | National Center for Personal Data Protection (NCPDP) | Medium | |
| Monaco | Loi 1.565 Law No. 1.565 of 3 December 2024 on the protection of personal data (Loi n° 1.565 relative à la protection des données personnelles) | Comprehensive data protection | In force | Autorité de Protection des Données Personnelles (APDP), successor to the CCIN | Medium | |
| Mongolia | PDP Law (Mongolia) Law on Personal Data Protection (Law on Protection of Personal Information) | Comprehensive data protection | In force | National Human Rights Commission; Ministry of Digital Development, Innovation and Communications | Medium | |
| Montana | MCDPA Montana Consumer Data Privacy Act (Mont. Code § 30-14-2801 et seq.) | Comprehensive data protection | In force | Montana Attorney General (Department of Justice) | High | |
| Montana | MT breach law Montana data breach notification law (Mont. Code §§ 30-14-1701 et seq.; 2-6-1501 et seq.; 33-19-321) | Breach notification | In force | Montana Department of Justice, Office of Consumer Protection | Medium | |
| Montenegro | ZZPL 2008 Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti), Official Gazette 79/2008 as amended (70/2009, 44/2012, 22/2017, 77/2024) | Comprehensive data protection | In force | Agency for Personal Data Protection and Free Access to Information (AZLP) | Medium | |
| Montenegro | ZZPL 2026 Law on Personal Data Protection 2026 (new Zakon o zaštiti podataka o ličnosti) | Comprehensive data protection | Enacted – not yet in force | Agency for Personal Data Protection and Free Access to Information (AZLP) | Low | |
| Morocco | Law 09-08 Law No. 09-08 on the Protection of Individuals with regard to the Processing of Personal Data | Comprehensive data protection | In force | Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) | High | |
| Myanmar | Cybersecurity Law (Myanmar) Cybersecurity Law (2025) | Surveillance / law enforcement access | In force | Ministry of Transport and Communications / Information Technology and Cybersecurity Department | Low | |
| Myanmar | Citizens' Privacy Law Law Protecting the Privacy and Security of Citizens (Pyidaungsu Hluttaw Law No. 5/2017) | Human rights / constitutional | In force | None designated | Low | |
| Nebraska | NDPA Nebraska Data Privacy Act (Neb. Rev. Stat. § 87-1101 et seq.) | Comprehensive data protection | In force | Nebraska Attorney General | Medium | |
| Nebraska | NE breach law Nebraska data breach notification law (Neb. Rev. Stat. §§ 87-801 to 87-808) | Breach notification | In force | Nebraska Attorney General | Medium | |
| Nepal | Privacy Act Individual Privacy Act, 2075 (2018) | Comprehensive data protection | In force | None designated | Medium | |
| Netherlands | UAVG General Data Protection Regulation Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) | Comprehensive data protection | In force | Autoriteit Persoonsgegevens (AP) | High | |
| Netherlands | Telecommunicatiewet Telecommunications Act (Telecommunicatiewet), Art 11.7a (cookies) and Art 11.7 (unsolicited communications) | ePrivacy / marketing | In force | Autoriteit Consument & Markt (ACM) for Art 11.7/11.7a; Autoriteit Persoonsgegevens for personal data in tracking cookies | Medium | |
| Netherlands | Cbw Cybersecurity Act (Cyberbeveiligingswet – Cbw) | Cybersecurity | In force | Sector supervisors incl. Rijksinspectie Digitale Infrastructuur (RDI) for digital providers; NCSC as CSIRT | Medium | |
| Nevada | NRS 603A privacy Nevada online privacy notice and sale opt-out law (NRS 603A.300–603A.360) | Sectoral privacy | In force | Nevada Attorney General | Medium | |
| Nevada | NV breach law Nevada data breach notification law (Nev. Rev. Stat. §§ 603A.010 et seq.) | Breach notification | In force | Nevada Attorney General | Medium | |
| Nevada | Nevada SB 370 Nevada consumer health data law (SB 370, 2023; NRS 603A.400 et seq.) | Health data | In force | Nevada Attorney General | Low | |
| New Brunswick | NB PHIPAA Personal Health Information Privacy and Access Act (SNB 2009, c. P-7.05) | Health data | In force | Ombud New Brunswick | Medium | |
| New Hampshire | NH privacy law New Hampshire Expectation of Privacy Act (RSA 507-H) | Comprehensive data protection | In force | New Hampshire Attorney General (Consumer Protection Bureau) | Medium | |
| New Hampshire | NH breach law New Hampshire data breach notification law (N.H. Rev. Stat. §§ 359-C:19 to 359-C:21) | Breach notification | In force | New Hampshire Department of Justice (Attorney General) | Medium | |
| New Jersey | NJDPA New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.) | Comprehensive data protection | In force | New Jersey Division of Consumer Affairs / Attorney General | Medium | |
| New Jersey | NJ breach law New Jersey data breach notification law (N.J. Stat. §§ 56:8-161, 56:8-163) | Breach notification | In force | New Jersey Division of State Police (notice); Division of Consumer Affairs / Attorney General (enforcement) | Medium | |
| New Mexico | NM breach law New Mexico data breach notification law (N.M. Stat. §§ 57-12C-1 et seq. (Data Breach Notification Act)) | Breach notification | In force | New Mexico Attorney General | Medium | |
| New South Wales | PPIP Act Privacy and Personal Information Protection Act 1998 (NSW) | Comprehensive data protection | In force | Information and Privacy Commission NSW (IPC) | High | |
| New South Wales | HRIP Act Health Records and Information Privacy Act 2002 (NSW) | Health data | In force | Information and Privacy Commission NSW (IPC) | Medium | |
| New York | NY breach law New York data breach notification law (N.Y. Gen. Bus. Law § 899-aa; N.Y. State Tech. Law § 208) | Breach notification | In force | New York Attorney General (with Department of State, State Police and DFS) | High | |
| New York | NY CDPA New York Child Data Protection Act (N.Y. Gen. Bus. Law § 899-ee et seq.) | Children's privacy | In force | New York Attorney General | Low | |
| New York | NY SHIELD Act Stop Hacks and Improve Electronic Data Security Act (SHIELD Act; N.Y. Gen. Bus. Law §§ 899-aa, 899-bb) | Cybersecurity | In force | New York Attorney General | Medium | |
| New York | NYDFS Part 500 NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500) | Cybersecurity | In force | New York State Department of Financial Services (NYDFS) | Medium | |
| New York City | NYC LL 144 New York City Local Law 144 of 2021 – Automated Employment Decision Tools | AI / automated decisions | In force | NYC Department of Consumer and Worker Protection (DCWP) | Medium | |
| New Zealand | IPP 3A Amendment Privacy Amendment Act 2025 | Comprehensive data protection | In force | Office of the Privacy Commissioner (OPC) | High | |
| New Zealand | Privacy Act (NZ) Privacy Act 2020 | Comprehensive data protection | In force | Office of the Privacy Commissioner (OPC) | High | |
| New Zealand | TIPC Telecommunications Information Privacy Code 2020 | Sectoral privacy | In force | Office of the Privacy Commissioner (OPC) | Medium | |
| New Zealand | UEMA Unsolicited Electronic Messages Act 2007 | ePrivacy / marketing | In force | Department of Internal Affairs (DIA) | Medium | |
| New Zealand | HIPC Health Information Privacy Code 2020 | Health data | In force | Office of the Privacy Commissioner (OPC) | Medium | |
| New Zealand | CRPC Credit Reporting Privacy Code 2020 | Financial data | In force | Office of the Privacy Commissioner (OPC) | Medium | |
| New Zealand | Biometrics Code Biometric Processing Privacy Code 2025 | Biometric | In force | Office of the Privacy Commissioner (OPC) | High | |
| Newfoundland and Labrador | NL PHIA Personal Health Information Act (SNL 2008, c. P-7.01) | Health data | In force | Office of the Information and Privacy Commissioner for Newfoundland and Labrador | Medium | |
| Nicaragua | Law 787 Law No. 787 on Personal Data Protection (Ley de Protección de Datos Personales) | Comprehensive data protection | In force | Dirección de Protección de Datos Personales (DIPRODAP) - not formally constituted | Medium | |
| Niger | Law 2022-59 Law No. 2022-59 on the protection of personal data (as amended by Law No. 2023-31) | Comprehensive data protection | In force | Haute Autorité de Protection des Données à caractère Personnel (HAPDP) | Medium | |
| Nigeria | GAID Nigeria Data Protection Act General Application and Implementation Directive 2025 (GAID) | Comprehensive data protection | In force | Nigeria Data Protection Commission (NDPC) | High | |
| Nigeria | NDPA Nigeria Data Protection Act 2023 (NDPA) | Comprehensive data protection | In force | Nigeria Data Protection Commission (NDPC) | High | |
| North Carolina | NC breach law North Carolina data breach notification law (N.C. Gen. Stat. §§ 75-61, 75-65 (Identity Theft Protection Act)) | Breach notification | In force | North Carolina Department of Justice (Attorney General) | Medium | |
| North Dakota | ND breach law North Dakota data breach notification law (N.D. Cent. Code § 51-30-01 et seq.) | Breach notification | In force | North Dakota Attorney General (Consumer Protection Division) | Medium | |
| North Macedonia | LPDP Law on Personal Data Protection, Official Gazette No. 42/2020 (as amended 294/2021, 101/2025) | Comprehensive data protection | In force | Personal Data Protection Agency (AZLP) | Medium | |
| Northern Territory | Information Act (NT) Information Act 2002 (NT) | Comprehensive data protection | In force | Office of the Information Commissioner Northern Territory | Medium | |
| Norway | POL Act relating to the processing of personal data (Personopplysningsloven) LOV-2018-06-15-38 | Comprehensive data protection | In force | Datatilsynet (Norwegian Data Protection Authority) | High | |
| Nova Scotia | NS PHIA Personal Health Information Act (SNS 2010, c. 41) | Health data | In force | Nova Scotia Information and Privacy Commissioner | Medium | |
| Ohio | OH breach law Ohio data breach notification law (Ohio Rev. Code §§ 1349.19, 1349.191, 1349.192; § 1347.12 (agencies)) | Breach notification | In force | Ohio Attorney General | Medium | |
| Oklahoma | Oklahoma privacy law Oklahoma consumer data privacy act (SB 546, 2026) | Comprehensive data protection | Enacted – not yet in force | Oklahoma Attorney General | High | |
| Oklahoma | OK breach law Oklahoma data breach notification law (Okla. Stat. tit. 24, §§ 161-166 (Security Breach Notification Act); tit. 74, § 3113.1) | Breach notification | In force | Oklahoma Attorney General | High | |
| Oman | Oman PDPL Executive Regulation Executive Regulation of the Personal Data Protection Law (Ministerial Decision No. 34/2024) | Comprehensive data protection | In force | MTCIT | High | |
| Oman | Oman PDPL Personal Data Protection Law (promulgated by Royal Decree No. 6/2022) | Comprehensive data protection | In force | Ministry of Transport, Communications and Information Technology (MTCIT) | High | |
| Ontario | PHIPA Personal Health Information Protection Act, 2004 (SO 2004, c. 3, Sch. A) | Health data | In force | Information and Privacy Commissioner of Ontario (IPC) | Medium | |
| Ontario | Bill 194 / EDSTA Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (SO 2024, c. 24; Bill 194) | Cybersecurity | Partially in force | Ministry of Public and Business Service Delivery; Information and Privacy Commissioner of Ontario | Medium | |
| Oregon | OCPA Oregon Consumer Privacy Act (ORS 646A.570 et seq.) | Comprehensive data protection | In force | Oregon Department of Justice (Attorney General) | Medium | |
| Oregon | OR breach law Oregon data breach notification law (Or. Rev. Stat. §§ 646A.600-646A.628 (Oregon Consumer Information Protection Act)) | Breach notification | In force | Oregon Department of Justice (Attorney General) | High | |
| Organisation for Economic Co-operation and Development (OECD) | OECD AI Principles Recommendation of the Council on Artificial Intelligence (OECD AI Principles) | AI / automated decisions | In force | OECD Working Party on AI Governance / OECD.AI | High | |
| Organisation for Economic Co-operation and Development (OECD) | OECD Trusted Government Access Declaration Declaration on Government Access to Personal Data Held by Private Sector Entities | Surveillance / law enforcement access | In force | None designated | High | |
| Organisation for Economic Co-operation and Development (OECD) | OECD Privacy Guidelines 2013 Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013) | Treaty / framework | In force | OECD Working Party on Data Governance and Privacy | High | |
| Organisation for Economic Co-operation and Development (OECD) | OECD Guidelines 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980) | Treaty / framework | Repealed/superseded | None designated | High | |
| Organization of American States (OAS) | OAS Updated Principles Inter-American Juridical Committee Updated Principles on Privacy and Personal Data Protection | Treaty / framework | In force | OAS Inter-American Juridical Committee; Department of International Law | Low | |
| Pakistan | PECA Prevention of Electronic Crimes Act, 2016 | Cybersecurity | In force | National Cyber Crime Investigation Agency (NCCIA); Pakistan Telecommunication Authority (PTA); SMPRA | Medium | |
| Panama | Decree 285 Executive Decree No. 285 of 28 May 2021 regulating Law 81 of 2019 | Comprehensive data protection | In force | ANTAI | Medium | |
| Panama | Law 81 Law No. 81 of 26 March 2019 on Personal Data Protection | Comprehensive data protection | In force | Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) - Directorate for Personal Data Protection | Medium | |
| Papua New Guinea | Constitution s49 Constitution of the Independent State of Papua New Guinea, Section 49 – Right to Privacy | Human rights / constitutional | In force | None designated | Medium | |
| Paraguay | Law 7593 Law No. 7593/2025 on Personal Data Protection (Ley de Protección de Datos Personales) | Comprehensive data protection | Enacted – not yet in force | National data protection agency created by the law (Not yet established) | Medium | |
| Paraguay | Law 6534 Law No. 6534/2020 on Protection of Personal Credit Data | Financial data | In force | Banco Central del Paraguay; SEDECO | Medium | |
| Pennsylvania | PA breach law Pennsylvania data breach notification law (73 Pa. Stat. § 2301 et seq. (Breach of Personal Information Notification Act)) | Breach notification | In force | Pennsylvania Office of Attorney General | High | |
| Peru | DS 016-2024-JUS Supreme Decree No. 016-2024-JUS approving the new Regulation of Law 29733 | Comprehensive data protection | In force | Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights | High | |
| Peru | Law 29733 Personal Data Protection Law, Law No. 29733 (Ley de Protección de Datos Personales) | Comprehensive data protection | In force | Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights | High | |
| Philippines | DPA (Philippines) Data Privacy Act of 2012 (Republic Act No. 10173) | Comprehensive data protection | In force | National Privacy Commission (NPC) | High | |
| Poland | UODO Act 2018 Act of 10 May 2018 on the Protection of Personal Data (Ustawa o ochronie danych osobowych) | Comprehensive data protection | In force | Prezes Urzędu Ochrony Danych Osobowych (UODO) | Medium | |
| Poland | PKE Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej – PKE) | ePrivacy / marketing | In force | President of the Office of Electronic Communications (UKE); UODO; UOKiK for consumer marketing | Medium | |
| Portugal | Lei 58/2019 Law No. 58/2019 ensuring the implementation of the GDPR in the national legal order | Comprehensive data protection | In force | Comissão Nacional de Proteção de Dados (CNPD) | Medium | |
| Portugal | Lei 41/2004 Law No. 41/2004 on the processing of personal data and protection of privacy in the electronic communications sector | ePrivacy / marketing | In force | Comissão Nacional de Proteção de Dados (CNPD); ANACOM for some telecom provisions | Low | |
| Puerto Rico | PR breach law Puerto Rico data breach notification law (10 L.P.R.A. § 4051 et seq. (Act 111-2005, Citizen Information on Data Banks Security Act)) | Breach notification | In force | Puerto Rico Department of Consumer Affairs (DACO) | Medium | |
| Qatar | PDPPL Law No. (13) of 2016 on Protecting Personal Data Privacy | Comprehensive data protection | In force | National Cyber Security Agency – National Cyber Governance and Assurance Affairs (NCGAA) | Medium | |
| Qatar Financial Centre | QFC DPR QFC Data Protection Regulations and Data Protection Rules | Comprehensive data protection | In force | QFC Data Protection Office | Low | |
| Quebec | Quebec Private Sector Act / Law 25 Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c. 25) | Comprehensive data protection | In force | Commission d'accès à l'information du Québec (CAI) | High | |
| Quebec | Law 25 transfer PIA Quebec Private Sector Act s.17 (as amended by Law 25) - privacy impact assessment for communication of personal information outside Quebec | Data localisation / cross-border | In force | Commission d'accès à l'information du Québec (CAI) | High | |
| Queensland | IP Act (Qld) Information Privacy Act 2009 (Qld) | Comprehensive data protection | In force | Office of the Information Commissioner Queensland (OIC) | Medium | |
| Republic of the Congo | Law 29-2019 Law No. 29-2019 of 10 October 2019 on the protection of personal data | Comprehensive data protection | In force | Not yet established (Commission Nationale de Protection des Données à caractère Personnel provided for) | Medium | |
| Rhode Island | RIDTPPA Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws § 6-48.1) | Comprehensive data protection | In force | Rhode Island Attorney General | Medium | |
| Rhode Island | RI breach law Rhode Island data breach notification law (R.I. Gen. Laws § 11-49.3-1 et seq. (Identity Theft Protection Act of 2015)) | Breach notification | In force | Rhode Island Attorney General | Medium | |
| Romania | Law 190/2018 Law No. 190/2018 on measures implementing Regulation (EU) 2016/679 | Comprehensive data protection | In force | Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) | Medium | |
| Romania | Law 506/2004 Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector | ePrivacy / marketing | In force | ANSPDCP (cookies/marketing); ANCOM (telecom) | Low | |
| Russia | 152-FZ Federal Law No. 152-FZ of 27 July 2006 'On Personal Data' | Comprehensive data protection | In force | Roskomnadzor (Federal Service for Supervision of Communications, IT and Mass Media) | Medium | |
| Russia | 242-FZ (localisation) Federal Law No. 242-FZ of 21 July 2014 (data localisation amendments to 152-FZ Art. 18(5)), as tightened by the February 2025 amendment | Data localisation / cross-border | In force | Roskomnadzor | Medium | |
| Rwanda | Law 058/2021 Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy | Comprehensive data protection | In force | National Cyber Security Authority (NCSA) – Data Protection and Privacy Office | High | |
| Saint Kitts and Nevis | SKN DPA Data Protection Act, 2018 (No. 5 of 2018) | Comprehensive data protection | Enacted – not yet in force | Not yet established | Medium | |
| Saint Lucia | Saint Lucia DPA Data Protection Act (No. 11 of 2011), as amended by Act 2 of 2015 | Comprehensive data protection | Partially in force | Data Protection Commissioner | Medium | |
| Saint Vincent and the Grenadines | SVG Privacy Act Privacy Act, 2003 | Comprehensive data protection | Enacted – not yet in force | None designated | Medium | |
| San Marino | Law 171/2018 Law No. 171 of 21 December 2018 on the protection of natural persons with regard to the processing of personal data (Legge n. 171/2018) | Comprehensive data protection | In force | Autorità Garante per la protezione dei dati personali (San Marino) | Low | |
| São Tomé and Príncipe | Law 03/2016 Law No. 03/2016 on the protection of personal data | Comprehensive data protection | In force | Agência Nacional de Proteção de Dados Pessoais (ANPDP) | Low | |
| Saudi Arabia | PDPL Implementing Regulations Implementing Regulation of the Personal Data Protection Law | Comprehensive data protection | In force | SDAIA | Medium | |
| Saudi Arabia | KSA PDPL Personal Data Protection Law (Royal Decree No. M/19 of 9/2/1443H, as amended by Royal Decree No. M/148 of 5/9/1444H) | Comprehensive data protection | In force | Saudi Data & AI Authority (SDAIA) / National Data Management Office | High | |
| Saudi Arabia | DCC NCA Data Cybersecurity Controls (DCC) | Cybersecurity | In force | National Cybersecurity Authority (NCA) | Medium | |
| Saudi Arabia | CCC NCA Cloud Cybersecurity Controls (CCC) | Cybersecurity | In force | National Cybersecurity Authority (NCA) | Low | |
| Saudi Arabia | ECC NCA Essential Cybersecurity Controls (ECC) | Cybersecurity | In force | National Cybersecurity Authority (NCA) | Low | |
| Saudi Arabia | Anti-Cyber Crime Law Anti-Cyber Crime Law (Royal Decree No. M/17 of 8/3/1428H) | Cybersecurity | In force | Public Prosecution; Communications, Space & Technology Commission | Low | |
| Saudi Arabia | KSA Transfer Regulation Regulation on Personal Data Transfer outside the Kingdom | Data localisation / cross-border | In force | SDAIA | High | |
| Saudi Arabia | CCRF CST Cloud Computing Regulatory Framework | Data localisation / cross-border | In force | Communications, Space & Technology Commission (CST) | Low | |
| Senegal | Law 2008-12 Law No. 2008-12 of 25 January 2008 on the protection of personal data | Comprehensive data protection | In force | Commission de Protection des Données Personnelles (CDP) | High | |
| Serbia | ZZPL Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti), Official Gazette RS No. 87/2018 | Comprehensive data protection | In force | Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) | High | |
| Seychelles | Seychelles DPA Data Protection Act, 2023 (Act 24 of 2023) | Comprehensive data protection | In force | Information Commission (Seychelles) | Medium | |
| Singapore | PDPA (Singapore) Personal Data Protection Act 2012 | Comprehensive data protection | In force | Personal Data Protection Commission (PDPC) | High | |
| Singapore | Spam Control Act Spam Control Act 2007 | ePrivacy / marketing | In force | Infocomm Media Development Authority (IMDA) | Medium | |
| Singapore | Cybersecurity Act (Singapore) Cybersecurity Act 2018 | Cybersecurity | In force | Cyber Security Agency of Singapore (CSA) | Medium | |
| Sint Maarten | Lbp Sint Maarten National Ordinance on Personal Data Protection (Landsverordening bescherming persoonsgegevens) | Comprehensive data protection | In force | Personal Data Protection Committee | Medium | |
| Slovakia | Act 18/2018 Act No. 18/2018 Coll. on Personal Data Protection | Comprehensive data protection | In force | Úrad na ochranu osobných údajov Slovenskej republiky | Medium | |
| Slovakia | Act 452/2021 Act No. 452/2021 Coll. on Electronic Communications | ePrivacy / marketing | In force | Regulatory Authority for Electronic Communications and Postal Services (RÚ); Personal Data Protection Office | Low | |
| Slovenia | ZVOP-2 Personal Data Protection Act (Zakon o varstvu osebnih podatkov – ZVOP-2) | Comprehensive data protection | In force | Informacijski pooblaščenec (Information Commissioner, IP RS) | High | |
| Slovenia | ZEKom-2 Electronic Communications Act (Zakon o elektronskih komunikacijah – ZEKom-2) | ePrivacy / marketing | In force | Informacijski pooblaščenec (IP RS) for cookies; AKOS for telecom | Low | |
| Somalia | Somalia DPA Data Protection Act, 2023 (Law No. 005 of 2023) | Comprehensive data protection | In force | Somalia Data Protection Authority (DPA) | Medium | |
| South Africa | POPIA Protection of Personal Information Act 4 of 2013 (POPIA) | Comprehensive data protection | In force | Information Regulator (South Africa) | High | |
| South Africa | ECTA Electronic Communications and Transactions Act 25 of 2002 (ECTA) – section 45 unsolicited commercial communications | ePrivacy / marketing | Partially in force | Department of Communications and Digital Technologies; courts (criminal offence) | Medium | |
| South Australia | SA IPPs Instruction Information Privacy Principles Instruction (Premier and Cabinet Circular PC012) | Comprehensive data protection | In force | Privacy Committee of South Australia | Low | |
| South Carolina | SC breach law South Carolina data breach notification law (S.C. Code § 39-1-90) | Breach notification | In force | South Carolina Department of Consumer Affairs | Medium | |
| South Dakota | SD breach law South Dakota data breach notification law (S.D. Codified Laws §§ 22-40-19 to 22-40-26) | Breach notification | In force | South Dakota Attorney General | Medium | |
| South Korea | PIPA Amendment 2026 Personal Information Protection Act Amendment (March 2026) | Comprehensive data protection | In force | Personal Information Protection Commission (PIPC) | Medium | |
| South Korea | PIPA Personal Information Protection Act (개인정보 보호법) | Comprehensive data protection | In force | Personal Information Protection Commission (PIPC) | High | |
| South Korea | Network Act Act on Promotion of Information and Communications Network Utilization and Information Protection (정보통신망법) | ePrivacy / marketing | In force | Ministry of Science and ICT (MSIT) / Korea Communications Commission (KCC) | Medium | |
| South Korea | Credit Information Act Act on the Use and Protection of Credit Information (신용정보법) | Financial data | In force | Financial Services Commission (FSC) | Low | |
| South Korea | AI Basic Act Framework Act on the Development of Artificial Intelligence and Establishment of a Foundation for Trust (AI Basic Act) | AI / automated decisions | In force | Ministry of Science and ICT (MSIT) | High | |
| Southern African Development Community (SADC) | SADC Model Law SADC Model Law on Data Protection | Comprehensive data protection | In force | None designated (model for national DPAs) | Low | |
| Spain | LOPDGDD Organic Law 3/2018 of 5 December on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD) | Comprehensive data protection | In force | Agencia Española de Protección de Datos (AEPD); regional authorities in Catalonia and Basque Country | High | |
| Spain | LSSI Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE) | ePrivacy / marketing | In force | Agencia Española de Protección de Datos (AEPD) for cookies and spam | Medium | |
| Sri Lanka | PDPA Personal Data Protection Act, No. 9 of 2022 (as amended by Act No. 22 of 2025) | Comprehensive data protection | Partially in force | Data Protection Authority of Sri Lanka | Medium | |
| Sweden | Dataskyddslagen Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation (Dataskyddslagen) | Comprehensive data protection | In force | Integritetsskyddsmyndigheten (IMY) | Medium | |
| Sweden | LEK Electronic Communications Act (Lag (2022:482) om elektronisk kommunikation) | ePrivacy / marketing | In force | Post- och telestyrelsen (PTS) for cookies; IMY for personal data | Low | |
| Sweden | MFL Marketing Practices Act (Marknadsföringslag 2008:486), §19 unsolicited communications | ePrivacy / marketing | In force | Konsumentverket / Consumer Ombudsman (KO) | Low | |
| Switzerland | FADP / nDSG Federal Act on Data Protection of 25 September 2020 (revised FADP; Datenschutzgesetz, nDSG / LPD) | Comprehensive data protection | In force | Federal Data Protection and Information Commissioner (FDPIC / EDÖB) | High | |
| Switzerland | DPO / DSV Ordinance on Data Protection of 31 August 2022 (Datenschutzverordnung, DSV / OPDo) | Comprehensive data protection | In force | Federal Data Protection and Information Commissioner (FDPIC / EDÖB) | High | |
| Switzerland | Swiss–US DPF Swiss–US Data Privacy Framework (adequacy recognition via amendment of Annex 1 of the Data Protection Ordinance) | Data localisation / cross-border | In force | FDPIC; US Department of Commerce (certification) | High | |
| Taiwan | PDPA (Taiwan) Personal Data Protection Act (個人資料保護法) | Comprehensive data protection | In force | Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer | Medium | |
| Taiwan | PDPA Amendment 2025 Personal Data Protection Act Amendment (2025) | Comprehensive data protection | Enacted – not yet in force | Personal Data Protection Commission (Preparatory Office); sector competent authorities pending transfer | Medium | |
| Tajikistan | PDPL Law of the Republic of Tajikistan No. 1537 'On Personal Data Protection' | Comprehensive data protection | In force | Main Department for the Protection of State Secrets / Communication Service under the Government (sources inconsistent) | Low | |
| Tanzania | PDPA Personal Data Protection Act, 2022 (Act No. 11 of 2022) | Comprehensive data protection | In force | Personal Data Protection Commission (PDPC) | High | |
| Tasmania | PIP Act (Tas) Personal Information Protection Act 2004 (Tas) | Comprehensive data protection | In force | Ombudsman Tasmania | Medium | |
| Tennessee | TIPA Tennessee Information Protection Act (Tenn. Code § 47-18-3201 et seq.) | Comprehensive data protection | In force | Tennessee Attorney General | Medium | |
| Tennessee | TN breach law Tennessee data breach notification law (Tenn. Code § 47-18-2107) | Breach notification | In force | Tennessee Attorney General / Division of Consumer Affairs | Medium | |
| Texas | TDPSA Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541) | Comprehensive data protection | In force | Texas Attorney General | Medium | |
| Texas | TX breach law Texas data breach notification law (Tex. Bus. & Com. Code §§ 521.002, 521.053, 521.151) | Breach notification | In force | Texas Attorney General | High | |
| Texas | CUBI Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001) | Biometric | In force | Texas Attorney General | Medium | |
| Texas | TRAIGA Texas Responsible Artificial Intelligence Governance Act (HB 149, 2025) | AI / automated decisions | In force | Texas Attorney General | High | |
| Texas | Texas data broker law Texas data broker law (Tex. Bus. & Com. Code ch. 509) | Data access / sharing | In force | Texas Secretary of State (registry); Texas Attorney General | Low | |
| Thailand | PDPA (Thailand) Personal Data Protection Act B.E. 2562 (2019) | Comprehensive data protection | In force | Personal Data Protection Committee / Office of the PDPC (PDPC) | High | |
| The Gambia | PDPP Act Personal Data Protection and Privacy Act, 2025 | Comprehensive data protection | In force | Information Commission (The Gambia) | Medium | |
| Timor-Leste | Constitution Art. 38 Constitution of the Democratic Republic of Timor-Leste, Article 38 (Protection of Personal Data) | Human rights / constitutional | In force | None designated | Medium | |
| Togo | Law 2019-014 Law No. 2019-014 of 29 October 2019 on the protection of personal data | Comprehensive data protection | In force | Instance de Protection des Données à Caractère Personnel (IPDCP) | Medium | |
| Trinidad and Tobago | T&T DPA Data Protection Act, 2011 (Act No. 13 of 2011, Chap. 22:04) | Comprehensive data protection | Partially in force | Office of the Information Commissioner (not established in practice) | Medium | |
| Tunisia | Organic Law 2004-63 Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data | Comprehensive data protection | In force | Instance Nationale de Protection des Données Personnelles (INPDP) | High | |
| Turkey | KVKK Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu) | Comprehensive data protection | In force | Personal Data Protection Authority (KVKK) / Personal Data Protection Board | Medium | |
| Turkmenistan | Data Protection Law Law of Turkmenistan No. 519-V 'On Information about Private Life and its Protection' | Comprehensive data protection | In force | None designated (General Prosecutor's Office for general oversight) | Low | |
| Uganda | DPPA Data Protection and Privacy Act, 2019 (Cap. 97) | Comprehensive data protection | In force | Personal Data Protection Office (PDPO), under NITA-U | Medium | |
| Ukraine | Law 2297-VI Law of Ukraine No. 2297-VI 'On Personal Data Protection' | Comprehensive data protection | In force | Ukrainian Parliament Commissioner for Human Rights (Ombudsman) | Medium | |
| Ukraine | Draft Law 8153 Draft Law No. 8153 'On Personal Data Protection' (new version) | Comprehensive data protection | Bill/proposed | Proposed: National Commission for Personal Data Protection and Access to Public Information | Low | |
| United Arab Emirates | Data Office Law Federal Decree-Law No. 44 of 2021 on the Establishment of the UAE Data Office | Comprehensive data protection | In force | UAE Data Office | Medium | |
| United Arab Emirates | UAE PDPL Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data | Comprehensive data protection | In force | UAE Data Office | Medium | |
| United Arab Emirates | Consumer Protection Law Federal Law No. 15 of 2020 on Consumer Protection | ePrivacy / marketing | In force | Ministry of Economy | Medium | |
| United Arab Emirates | ICT Health Law Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields | Health data | In force | Ministry of Health and Prevention (MOHAP) and emirate health authorities (DOH Abu Dhabi, DHA) | High | |
| United Arab Emirates | Cybercrime Law Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes | Cybersecurity | In force | Public Prosecution / Police (criminal enforcement) | High | |
| United Kingdom | UK GDPR United Kingdom General Data Protection Regulation (UK GDPR) – retained Regulation (EU) 2016/679 as amended | Comprehensive data protection | In force | Information Commissioner's Office (ICO) | High | |
| United Kingdom | DPA 2018 Data Protection Act 2018 | Comprehensive data protection | In force | Information Commissioner's Office (ICO) | High | |
| United Kingdom | PECR Privacy and Electronic Communications (EC Directive) Regulations 2003 | ePrivacy / marketing | In force | Information Commissioner's Office (ICO) | High | |
| United Kingdom | AADC / Children's Code Age Appropriate Design Code (Children's Code) – statutory code of practice under s.123 Data Protection Act 2018 | Children's privacy | In force | Information Commissioner's Office (ICO) | Medium | |
| United Kingdom | OSA Online Safety Act 2023 | Children's privacy | Partially in force | Ofcom | Medium | |
| United Kingdom | NIS Regulations Network and Information Systems Regulations 2018 | Cybersecurity | In force | Sector competent authorities; ICO for relevant digital service providers (online marketplaces, search engines, cloud computing services) | Medium | |
| United Kingdom | CS&R Bill Cyber Security and Resilience Bill | Cybersecurity | Bill/proposed | Sector regulators; ICO (digital services); DSIT | Medium | |
| United Kingdom | UK–US Data Bridge Data Protection (Adequacy) (United States of America) Regulations 2023 – UK Extension to the EU–US Data Privacy Framework ('UK–US Data Bridge') | Data localisation / cross-border | In force | Information Commissioner's Office (ICO); DSIT | Medium | |
| United Kingdom | IDTA / UK Addendum International Data Transfer Agreement (IDTA) and International Data Transfer Addendum to the EU Standard Contractual Clauses | Data localisation / cross-border | In force | Information Commissioner's Office (ICO) | Medium | |
| United Kingdom | DUAA Data (Use and Access) Act 2025 | Data access / sharing | Partially in force | Information Commissioner's Office (ICO); Department for Science, Innovation and Technology (smart data, DVS) | Medium | |
| United Kingdom | IPA Investigatory Powers Act 2016 (as amended by the Investigatory Powers (Amendment) Act 2024) | Surveillance / law enforcement access | In force | Investigatory Powers Commissioner's Office (IPCO); Investigatory Powers Tribunal | Medium | |
| United Nations | UN Cybercrime Convention United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes | Surveillance / law enforcement access | Signed – not ratified | UNODC (secretariat); Conference of the States Parties once in force | Medium | |
| United Nations | Right to privacy in the digital age UN General Assembly resolutions on the right to privacy in the digital age (series) | Human rights / constitutional | In force | Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy | Medium | |
| United Nations | ICCPR Art 17 International Covenant on Civil and Political Rights, Article 17 | Human rights / constitutional | In force | UN Human Rights Committee (treaty body) | High | |
| United Nations | UDHR Art 12 Universal Declaration of Human Rights, Article 12 | Human rights / constitutional | In force | None designated | High | |
| United Nations | UN Guidelines 1990 Guidelines for the Regulation of Computerized Personal Data Files | Treaty / framework | In force | None designated | Medium | |
| United States | FTC Act s5 Federal Trade Commission Act, Section 5 (15 U.S.C. § 45) – unfair or deceptive acts or practices | Comprehensive data protection | In force | Federal Trade Commission (FTC) | High | |
| United States | TAKE IT DOWN Act Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act) | Sectoral privacy | In force | Federal Trade Commission (FTC) (platform duties); DOJ (criminal) | High | |
| United States | DPPA Driver's Privacy Protection Act of 1994 (18 U.S.C. §§ 2721–2725) | Sectoral privacy | In force | US Department of Justice; private litigants | Medium | |
| United States | VPPA Video Privacy Protection Act of 1988 (18 U.S.C. § 2710) | Sectoral privacy | In force | Private litigants (courts) | Medium | |
| United States | Privacy Act Privacy Act of 1974 (5 U.S.C. § 552a) | Sectoral privacy | In force | Federal agencies; DOJ Office of Privacy and Civil Liberties (guidance); OMB | High | |
| United States | FERPA Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99) | Sectoral privacy | In force | US Department of Education, Student Privacy Policy Office (SPPO) | Medium | |
| United States | CAN-SPAM Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (15 U.S.C. §§ 7701–7713) | ePrivacy / marketing | In force | Federal Trade Commission (FTC) | Medium | |
| United States | TCPA Telephone Consumer Protection Act of 1991 (47 U.S.C. § 227) | ePrivacy / marketing | In force | Federal Communications Commission (FCC); state AGs; private litigants | Medium | |
| United States | HBNR FTC Health Breach Notification Rule (16 C.F.R. Part 318) | Breach notification | In force | Federal Trade Commission (FTC) | Medium | |
| United States | HIPAA Breach Rule / HITECH HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) under the HITECH Act | Breach notification | In force | HHS Office for Civil Rights (OCR) | Medium | |
| United States | Amended COPPA Rule Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (2025 amendments) | Children's privacy | In force | Federal Trade Commission (FTC) | High | |
| United States | COPPA Children's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506) | Children's privacy | In force | Federal Trade Commission (FTC) and state Attorneys General | High | |
| United States | HIPAA Security Rule HIPAA Security Rule (45 C.F.R. Part 164 Subpart C) | Health data | In force | HHS Office for Civil Rights (OCR) | High | |
| United States | HIPAA Privacy Rule HIPAA Privacy Rule (45 C.F.R. Part 160 and Part 164 Subparts A and E) | Health data | In force | HHS Office for Civil Rights (OCR) | Medium | |
| United States | GLBA Gramm-Leach-Bliley Act, Title V Subtitle A (15 U.S.C. §§ 6801–6809) and Regulation P (12 C.F.R. Part 1016) | Financial data | In force | CFPB; FTC; federal banking regulators; state insurance regulators | Medium | |
| United States | FCRA Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) | Financial data | In force | CFPB and FTC; state Attorneys General | Medium | |
| United States | SEC cyber disclosure rules SEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05; Regulation S-K Item 106) | Cybersecurity | In force | US Securities and Exchange Commission (SEC) | Medium | |
| United States | GLBA Safeguards Rule FTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 C.F.R. Part 314 | Cybersecurity | In force | Federal Trade Commission (FTC) | Medium | |
| United States | CIRCIA Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) | Cybersecurity | Enacted – not yet in force | Cybersecurity and Infrastructure Security Agency (CISA) | Medium | |
| United States | DOJ Data Security Program Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (28 C.F.R. Part 202), implementing Executive Order 14117 | Data localisation / cross-border | In force | US Department of Justice, National Security Division (NSD) | Medium | |
| United States | PADFA Protecting Americans' Data from Foreign Adversaries Act of 2024 (15 U.S.C. § 9901) | Data localisation / cross-border | In force | Federal Trade Commission (FTC) | Medium | |
| United States | EO 14086 Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence Activities | Surveillance / law enforcement access | In force | ODNI Civil Liberties Protection Officer; Data Protection Review Court; PCLOB | Medium | |
| United States | CLOUD Act Clarifying Lawful Overseas Use of Data Act (CLOUD Act) | Surveillance / law enforcement access | In force | US Department of Justice | Medium | |
| United States | Wiretap Act Electronic Communications Privacy Act, Title I – Wiretap Act (18 U.S.C. §§ 2510–2523) | Surveillance / law enforcement access | In force | US Department of Justice; private litigants | Medium | |
| United States | SCA Electronic Communications Privacy Act, Title II – Stored Communications Act (18 U.S.C. §§ 2701–2713) | Surveillance / law enforcement access | In force | US Department of Justice; courts | Medium | |
| United States | FISA 702 Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. § 1881a) | Surveillance / law enforcement access | Repealed/superseded | Foreign Intelligence Surveillance Court; ODNI; DOJ; PCLOB | Medium | |
| United States | Fourth Amendment United States Constitution, Fourth Amendment | Human rights / constitutional | In force | Federal and state courts (no regulator) | High | |
| Uruguay | Law 18.331 Law No. 18,331 on Personal Data Protection and Habeas Data Action (Ley de Protección de Datos Personales y Acción de Habeas Data) | Comprehensive data protection | In force | Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC | Medium | |
| Uruguay | Decree 64/020 Decree No. 64/020 regulating Articles 37-40 of Law 19,670 | Breach notification | In force | Unidad Reguladora y de Control de Datos Personales (URCDP), within AGESIC | Medium | |
| US Virgin Islands | VI breach law US Virgin Islands data breach notification law (14 V.I.C. §§ 2208 (government), 2209 (private) (Identity Theft Prevention Act)) | Breach notification | In force | US Virgin Islands Department of Justice (Attorney General) | Low | |
| Utah | UCPA Utah Consumer Privacy Act (Utah Code § 13-61-101 et seq.) | Comprehensive data protection | In force | Utah Division of Consumer Protection and Utah Attorney General | Medium | |
| Utah | UT breach law Utah data breach notification law (Utah Code §§ 13-44-101 et seq. (Protection of Personal Information Act)) | Breach notification | In force | Utah Attorney General and Utah Cyber Center | High | |
| Utah | Utah AI Policy Act Utah Artificial Intelligence Policy Act (SB 149, 2024; Utah Code § 13-72) | AI / automated decisions | In force | Utah Division of Consumer Protection; Office of Artificial Intelligence Policy | Medium | |
| Uzbekistan | ZRU-547 Law of the Republic of Uzbekistan No. ZRU-547 'On Personal Data' | Comprehensive data protection | In force | Personalization Agency under the Ministry of Justice (formerly State Personalization Centre); State Inspection on Informatization and Telecommunications (Uzcomnazorat) | Medium | |
| Venezuela | CRBV Art. 28 Constitution of the Bolivarian Republic of Venezuela, Articles 28 and 60 (habeas data and privacy) | Human rights / constitutional | In force | None designated (courts) | Medium | |
| Vermont | Vermont privacy law Vermont Data Privacy and Online Surveillance Act (S.71, 2026) | Comprehensive data protection | Enacted – not yet in force | Vermont Attorney General | High | |
| Vermont | VT breach law Vermont data breach notification law (9 V.S.A. §§ 2430, 2435 (Security Breach Notice Act)) | Breach notification | In force | Vermont Attorney General | Medium | |
| Vermont | Vermont data broker law Vermont data broker registration and security law (9 V.S.A. §§ 2430, 2446–2447) | Data access / sharing | In force | Vermont Secretary of State (registry); Vermont Attorney General (enforcement) | Low | |
| Victoria | PDP Act (Vic) Privacy and Data Protection Act 2014 (Vic) | Comprehensive data protection | In force | Office of the Victorian Information Commissioner (OVIC) | Medium | |
| Victoria | Health Records Act (Vic) Health Records Act 2001 (Vic) | Health data | In force | Health Complaints Commissioner (Vic) | Medium | |
| Vietnam | Decree 356 Decree No. 356/2025/ND-CP detailing the Law on Personal Data Protection | Comprehensive data protection | In force | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | High | |
| Vietnam | PDPL (Vietnam) Law on Personal Data Protection (Law No. 91/2025/QH15) | Comprehensive data protection | In force | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | High | |
| Vietnam | Decree 13 Decree No. 13/2023/ND-CP on Personal Data Protection | Comprehensive data protection | Repealed/superseded | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | High | |
| Vietnam | Cybersecurity Law 2025 (Vietnam) Law on Cybersecurity (Law No. 116/2025/QH15) | Cybersecurity | In force | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | Medium | |
| Vietnam | Cybersecurity Law 2018 (Vietnam) Law on Cybersecurity (Law No. 24/2018/QH14) | Cybersecurity | Repealed/superseded | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | Medium | |
| Vietnam | Data Law (Vietnam) Law on Data (Law No. 60/2024/QH15) | Data localisation / cross-border | In force | Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05) | Medium | |
| Virginia | VCDPA Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) | Comprehensive data protection | In force | Virginia Attorney General | Medium | |
| Virginia | VA breach law Virginia data breach notification law (Va. Code §§ 18.2-186.6, 32.1-127.1:05) | Breach notification | In force | Virginia Attorney General | Medium | |
| Washington | WA breach law Washington data breach notification law (Wash. Rev. Code § 19.255.010 et seq.; § 42.56.590) | Breach notification | In force | Washington Attorney General | High | |
| Washington | MHMDA Washington My Health My Data Act (RCW 19.373) | Health data | In force | Washington Attorney General; private litigants | Medium | |
| Washington | WA biometric law Washington biometric identifiers law (RCW 19.375) | Biometric | In force | Washington Attorney General | Medium | |
| West Virginia | WV breach law West Virginia data breach notification law (W. Va. Code § 46A-2A-101 et seq.) | Breach notification | In force | West Virginia Attorney General | Medium | |
| Western Australia | PRIS Act Privacy and Responsible Information Sharing Act 2024 (WA) | Comprehensive data protection | In force | Information Commissioner (WA) with Privacy Deputy Commissioner; Chief Data Officer | Medium | |
| Wisconsin | WI breach law Wisconsin data breach notification law (Wis. Stat. § 134.98) | Breach notification | In force | Wisconsin Department of Agriculture, Trade and Consumer Protection | Medium | |
| Wyoming | WY breach law Wyoming data breach notification law (Wyo. Stat. §§ 40-12-501 to 40-12-502) | Breach notification | In force | Wyoming Attorney General | Medium | |
| Zambia | Zambia DPA Data Protection Act, 2021 (Act No. 3 of 2021) | Comprehensive data protection | In force | Office of the Data Protection Commissioner (Data Protection Commission) | High | |
| Zimbabwe | CDPA Cyber and Data Protection Act [Chapter 12:07] (Act 5 of 2021) | Comprehensive data protection | In force | Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ) as Data Protection Authority | Medium |