Laws

Crucial Information sorted for you by regulation

Portals

Your central location for news, insights, guidance notes, and relevant resources related to a privacy law or topic

Global Privacy Directory

Review the complete and official text of any of the regulations below

Law	Jurisdiction	Regulator
Data Protection (Amendment) Regulations 2018	Abu Dhabi Global Market	ADGM Registration Authority and the Board of Directors of the ADGM
Data Protection Regulations 2015	Abu Dhabi Global Market	Office of Data Protection
Data Protection Regulations 2021	Abu Dhabi Global Market	Office of Data Protection
Law on the Protection of Personal Data No. 9887 of 10 March 2008 (as amended)	Albania	Information and Data Protection Commissioner ('IDP')
Personal Information Protection Act, SA 2003 c P-6.5	Alberta	Office of the Information and Privacy Commissioner of Alberta ('OIPC')
Law No. 18-07 of 25 Ramadhan 1439 Corresponding to June 10, 2018 Relating to the Protection of Individuals in the Processing of Personal Data (only available in French)	Algeria	The Law provides that an independent Algerian data protection authority is established within the office of the President of the Republic of Algeria
Qualified Act 15/2003, of 18 December, of Personal Data Protection	Andorra	Andorran data protection authority ('APDA')
Law No. 22/11 on the Protection of Personal Data (only available in Portuguese)	Angola	The Ministry of Telecommunications and Information Technology ('MTTI') announced, on 9 October 2019, that the National Database Protection Agency ('APD') had become operational.
Data Protection Act, 2013	Antigua and Barbuda	Information Commissioner
Decree No. 25.326 (only available in Spanish)	Argentina	Argentinian data protection authority ('AAIP')
Personal Data Protection Act, Act No. 25.326 of 2000	Argentina	Argentinian data protection authority ('AAIP')
Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data	Armenia	Personal Data Protection Agency
National Ordinance of May 19, 2011 Laying Down New Rules for the Protection of Privacy in Connection with the Recording and Dissemination of Personal Data (only available in Dutch)	Aruba	The Ordinance does not create a regulatory authority.
Privacy Act 1988	Australia - Federal	The Office of the Australian Information Commissioner ('OAIC')
Privacy and Personal Information Protection Act 1998 No. 133	Australia - New South Wales	Information and Privacy Commission ('IPC')
Information Privacy Act 2009	Australia - Queensland	Office of the Information Commissioner ('OIC')
Information Privacy Principles Instruction No. 1 of 1989	Australia - South Australia	Privacy Committee of South Australia ('PCA')
Personal Information Protection Act 2004	Australia - Tasmania	The Office of the Ombudsman ('the Ombudsman')
Privacy and Data Protection Act 2014 (No. 60 of 2014)	Australia - Victoria	The Office of the Victorian Information Commissioner ('OVIC')
Freedom of Information Act 1992 (No. 76 of 1992)	Australia - Western Australia	Office of the Information Commissioner ('OIC')
Information Privacy Act 2014	Australian Capital Territory	The Office of the Australian Information Commissioner ('OAIC')
Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (Data Protection Act (DSG) BGBI. I No. 165/1999) (last amended in 2019)	Austria	Austrian data protection authority ('DSB')
Law of 11 May 2010 No. 998-IIIQ on Personal Data (only available in Azerbaijani)	Azerbaijan	Ministry of Transport, Communications and High Technologies
Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese)	Azores	Portuguese data protection authority ('CNPD')
State Data Protection Act (LDSG) 2018 (only available in German)	Baden-Württemberg	Baden-Wü rttemberg data protection authority ('LfDI Baden-Württemberg')
Data Protection (Privacy of Personal Information) Act 2003	Bahamas	The Data Protection Commissioner
Law No. (30) of the Year 2018 Issuing a Law on the Protection of Personal Data (only available in Arabic)	Bahrain	Ministry of Justice and Islamic Affairs ('MoJ')
Data Protection Bill 2019	Barbados	Data Protection Commissioner (not yet operational)
Law of 10 November 2008 No. 455-Z on Information, Informatization and Data Protection	Belarus	There is no specific state regulator for data protection in Belarus. General governance in the sphere of information protection is performed by the President of the Republic of Belarus and the Council of Ministers of the Republic of Belarus.
Law on Personal Data (only available in Russian)	Belarus	Data Protection Commission (not yet operational)
Act of 3 December 2017 Establishing the Data Protection Authority	Belgium	Data Protection Authority ('Belgian DPA')
Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data	Belgium	Data Protection Authority ('Belgian DPA')
Law No. 2009-09 of May 22, 2009 Dealing with the Protection of Personally Identifiable Information	Benin	Beninese data protection authority ('APDP')
Personal Information Protection Act 2016	Bermuda	Privacy Commissioner
Act of May 17, 2010 Containing Rules on the Protection of Personal Data of Bonaire, Sint Eustatius and Saba (only available in Dutch)	BES Islands	Commission for the Supervision of Data Protection BES ('CBP BES')
Information Communications and Media Act of Bhutan 2018	Bhutan	No Data Protection Authority has been established
Draft Citizen Law of Privacy and Data Protection in Bolivia (only available in Spanish)	Bolivia	Electronic Government Agency and Information and Communication Technologies ('AGETIC')
Law on the Protection of Personal Data No. 49/06	Bosnia & Herzegovina	Agency for Personal Data Protection in Bosnia and Herzegovina ('AZLP')
Data Protection Act, 2018	Botswana	The Information and Data Protection Commission
Law No. 12.965 of 23 April 2014 Marco Civil da Internet (only available in Portuguese)	Brazil	The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.
Law No. 13.709 of 14 August 2018, General Personal Data Protection Law ('LGPD')	Brazil	The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.
Personal Information Protection Act, SBC 2003 c 63	British Columbia	Office of the Information and Privacy Commissioner for British Columbia ('OIPC')
Protection of Personal Data Act 2002 (last amended in 2019)	Bulgaria	Commission for Personal Data Protection ('CPDP')
Law No. 010-2004/AN on the Protection of Personal Data (only available in French)	Burkina Faso	Burkina Faso data protection authority ('CIL')
California Consumer Privacy Act of 2018 ('CCPA')	California	California Attorney General ('AG')
California Privacy Rights Act of 2020 ('CPRA')	California	The California Privacy Protection Agency has not yet been established.
Bill C-11 for An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts	Canada Federal	Office of the Privacy Commissioner of Canada ('OPC')
Personal Information Protection and Electronic Documents Act 2000	Canada Federal	Office of the Privacy Commissioner of Canada ('OPC')
Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish)	Canary Islands	Spanish data protection authority ('AEPD')
Law 133-V-2001 on the Protection of Personal Data	Cape Verde	National Commission of Data Protection ('CNPD')
The Data Protection Law, 2017 (Law 33 of 2017)	Cayman Islands	Office of the Ombudsman
The Data Protection Regulations, 2018 (SL 17 of 2019)	Cayman Islands	Office of the Ombudsman
Law No. 007/PR/2015 on the Protection of Personal Data (only available in French)	Chad	Agence Nationale de Sécurité Informatique et de Certification Électronique ('ANSICE')
Bill No. 11144-07 Regulating the Processing and Protection of Personal Data and Creating the Personal Data Protection Authority (only available in Spanish)	Chile	Chilean Transparency Council ('CPLT')
Law No. 19.628 on the Protection of Private Life 1999 (only available in Spanish)	Chile	Chilean Transparency Council ('CPLT')
Cybersecurity Law 2016	China - Federal	Regulators include the Ministry of Industry and Information Technology ('MIIT') and the Cyberspace Administration of China ('CAC')
Data Security Law	China - Federal	No Data Protection Authority has been established
Personal Information Protection Law of the People's Republic of China	China - Federal	The Cyberspace Administration of China ('CAC')
Shenzhen Special Economic Zone Data Interim Regulation (Draft) (only available in Chinese)	China - Federal	No Data Protection Authority has been established
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Collectivity of Saint Martin	French data protection authority ('CNIL')
Decree 1377 of 2013 (June 27) Which Partially Regulates Law 1581 of 2012 (only available in Spanish)	Colombia	Colombian data protection authority ('SIC')
Statutory Law 1581 of 2012 (October 17) Which Issues General Provisions for the Protection of Personal Data (only available in Spanish)	Colombia	Colombian data protection authority ('SIC')
Senate Bill 21-190 for the Colorado Privacy Act ('CPA')	Colorado	Attorney General of Colorado ('AG')
Law 29-2019 on the Protection of Personal Data	Congo	The Law provides that the Commission responsible for the protection of personal data will be established by a law of the Republic of Congo in order to ensure the compliance with the Law.
Connecticut Act Concerning Personal Data Privacy and Online Monitoring	Connecticut	Connecticut Attorney General
Executive Decree No. 37554-JP of 30 October 2012 Regulating Law No. 8968 (only available in Spanish)	Costa Rica	There is no general data protection authority, however the Dominican Telecommunications Institute ('INDOTEL') oversees certain matters such as data breach reporting
Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 of 2011 (only available in Spanish)	Costa Rica	Costa Rican data protection authority ('PRODHAB')
Law on the Implementation of the General Data Protection Regulation 2018 (only available in Croatian)	Croatia	Personal Data Protection Agency ('AZOP')
Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Data Protection Ordinance) (only available in Dutch)	Curaçao	The Data Protection Board (not yet operational)
Law 125(I) of 2018 Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data	Cyprus	Office of the Commissioner for Personal Data Protection ('the Commissioner')
Act No. 110/2019 Coll. on Personal Data Processing	Czechia	Office for Personal Data Protection ('UOOU')
Act No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Data Protection Act)	Denmark	Danish data protection authority ('Datatilsynet')
Law No. 172-13 on the Comprehensive Protection of Personal Data Contained in Archives, Public Registries, Databases or Other Technical Means of Data Processing Used for Reporting, Whether Public or Private 2013 (only available in Spanish)	Dominican Republic	There is no general data protection regulator
Data Protection Regulations 2020	Dubai International Financial Centre	The Commissioner of Data Protection
DIFC Data Protection Law No. 5 of 2020	Dubai International Financial Centre	The Commissioner of Data Protection
Organic Law on the Protection of Personal Data (only available in Spanish)	Ecuador	National Directorate of the Public Data Registry ('DINARDAP')
Resolution No. 151 of 2020 approving the Law on the Protection of Personal Data (only available in Arabic)	Egypt	Governing Body for the Protection of Personal Data (not yet operational)
Consumer Protection Law as amended in 2018 (only available in Spanish)	El Salvador	A regulator has not yet been established
Law No. 1/2.016 of 22 July on Personal Data Protection Equatorial Guinea	Equatorial Guinea	Organo Rector de Proteccion de Datos Personales (not yet operational)
Personal Data Protection Act 2018	Estonia	Data Protection Inspectorate ('DPI')
The Data Protection Act, 2022	Eswatini	Eswatini Electronic Communications Commission
Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) ('ePrivacy Directive')	EU	European Data Protection Supervisor ('EDPS')
Directive on Security Network and Information Systems (Directive (EU) 2016/1148) ('NIS Directive')	EU	National Member State supervisory authorities
General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR)	EU	European Data Protection Board ('EDPB')
Proposed Regulation on Privacy and Electronic Communications (2017/0003 (COD)) (10 January 2017)	EU	National Member State supervisory authorities
Data Protection Act (1050/2018)	Finland	Office of the Data Protection Ombudsman ('the Ombudsman')
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	France	French data protection authority ('CNIL')
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties	French Polynesia	French data protection authority ('CNIL')
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties	French Southern and Antarctic Lands	French data protection authority ('CNIL')
Law No. 001/2011 on the Protection of Personal Data (only available in French)	Gabon	Gabon data protection authority ('CNPDCP')
Law of Georgia on Personal Data Protection of 28 December 2011 No. 5669	Georgia	Office of the Personal Data Protection Inspector ('PDP')
Bavarian Data Protection Act (BayDSG) of 15 May 2018 (only available in German)	Germany - Bavaria	Data Protection Authority of Bavaria for the Private Sector ('BayLDA')
Berlin Data Protection Act ('BlnDSG') of 13 June 2018 (only available in German)	Germany - Berlin	Berlin data protection authority ('Berlin Commissioner')
Brandenburg Data Protection Act ('BbgDSG') of 8 May 2018 (only available in German)	Germany - Brandenburg	State Commissioner for Data Protection and Access to Information Brandenburg ('Brandenburg LDA')
Bremen Implementation Act to the EU General Data Protection Regulation (BremDSGVOAG) of 8 May 2018 (only available in German)	Germany - Bremen	Bremen data protection authority ('the Bremen Commissioner')
Federal Data Protection Act of 30 June 2017 (implementing the GDPR)	Germany - Federal	The Federal Commissioner for Data Protection and Freedom of Information ('BfDI')
Hamburg Data Protection Act (HmbDSG) of 18 May 2018 (only available in German)	Germany - Hamburg	The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI')
Hessian Data Protection and Freedom of Information Act (HDSIG) of 3 May 2018 (only available in German)	Germany - Hesse	Hessen data protection authority ('HBDI')
Lower Saxony Data Protection Act (NDSG) of 16 May 2018 (only available in German)	Germany - Lower Saxony	Lower Saxony data protection authority ('LfD Niedersachsen')
State Data Protection Act (DSG M-V) of 22 May 2018 (only available in German)	Germany - Mecklenburg-Vorpommern	Mecklenburg-Vorpommern data protection authority
Data Protection Law North Rhine-Westphalia (DSG NRW) 2018 (only available in German)	Germany - North Rhine-Westphalia	North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information ('LDI NRW')
State Data Protection Act (LDSG) of 8 May 2018 (only available in German)	Germany - Rhineland-Palatinate	Rhineland-Palatinate data protection authority ('LfDI Rheinland-Pfalz')
Saarland Data Protection Act ('SDSG') of 16 May 2018 (only available in German)	Germany - Saarland	Saarland data protection authority
Saxon Data Protection Act (SächsDSG) of 25 August 2003, as amended to implement the GDPR (only available in German)	Germany - Saxony	Saxon data protection authority ('SächsDSB')
Law for the Protection of Personal Data of Citizens (Data Protection Act Saxony-Anhalt - DSG LSA) of 12 March 1992 (GVBl. P. 152) (only available in German)	Germany - Saxony-Anhalt	Sachsen-Anhalt data protection authority ('LfD Sachsen-Anhalt')
Schleswig-Holstein Law for the Protection of Personal Data (LDSG) of 2 May 2018 (only available in German)	Germany - Schleswig-Holstein	Schleswig-Holstein data protection authority ('ULD')
Thuringian Data Protection and Implementation Act ('ThürDSAnpUG-EU') of 6 June 2018 (only available in German)	Germany - Thuringia	Thuringian data protection authority ('TLfDI')
Data Protection Act, 2012	Ghana	The Data Protection Commission
Data Protection Act 2004 (as amended in 2018)	Gibraltar	The Gibraltar Regulatory Authority ('GRA')
Law 3471/2006 on the Protection of Personal Data and Privacy in the Electronic Telecommunications Sector and Amendment of Law 2472/1997	Greece	The Hellenic Data Protection Authority ('HDPA')
Law No. 4624/2019 on the Personal Data Protection Authority, Implementing the GDPR and Transposing into National Law Data Protection Directive with Respect to Law Enforcement and Other Provisions	Greece	The Hellenic Data Protection Authority ('HDPA')
Personal Data Protection Act 2016 (only available in Danish)	Greenland	Danish data protection authority ('Datatilsynet')
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Guadeloupe	French data protection authority ('CNIL')
Bill No. 4090 of 20 August 2009 for the Approval of the of the Personal Data Protection Law (only available in Spanish)	Guatemala	A regulator has not yet been established
The Data Protection (Bailiwick of Guernsey) Law, 2017	Guernsey	The Office of the Data Protection Authority ('ODPA')
The Data Protection (Commencement, Amendment and Transitional) (Bailiwick of Guernsey) Ordinance, 2018	Guernsey	The Office of the Data Protection Authority ('ODPA')
Law L-2016-037-AN Relating to Cybersecurity and the Protection of Personal Data (only available in French)	Guinea	The Personal Data Protection Authority has not yet been established
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Guyana	French data protection authority ('CNIL')
Draft Law on the Protection of Personal Data (only available in Spanish)	Honduras	There is no general data protection regulator
The Personal Data (Privacy) Ordinance	Hong Kong	Office of the Privacy Commissioner for Personal Data ('PCPD')
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information as amended by Act XXXVIII of 2018	Hungary	National Authority for Data Protection and Freedom of Information ('NAIH')
Act 90/2018 on Privacy and Processing of Personal Data	Iceland	Icelandic data protection authority ('Persónuvernd')
The Personal Data Protection Bill, 2019	India	Data Protection Commission (not yet operational)
Draft Personal Data Protection Bill (only available in Indonesian)	Indonesia	Data Protection Commission (not yet operational)
Draft Protection of Personal Data Law (only available in Persian)	Iran	The Ministry of Communications and Information Technology ('MICEX')
Data Protection Act 2018	Ireland	Data Protection Commission ('DPC')
Data Protection (Application of the GDPR) Order 2018	Isle of Man	Information Commissioner ('the Commissioner')
Data Protection Act 2018	Isle of Man	Information Commissioner ('the Commissioner')
The GDPR and LED Implementing (Amendment) Regulations 2018	Isle of Man	Information Commissioner
The GDPR and LED Implementing Regulations 2018	Isle of Man	Information Commissioner
Protection of Privacy Law, 5741 - 1981 (unofficial translation)	Israel	Privacy Protection Authority ('PPA')
Protection of Privacy Regulations (Data Security) 5777-2017	Israel	Privacy Protection Authority ('PPA')
Personal Data Protection Code, Legislative Decree No. 196/2003	Italy	Italian data protection authority ('Garante')
Law 2013-450 on the Protection of Personal Data	Ivory Coast	The Telecommunications/ICT Regulatory Authority of Côte d'Ivoire ('ARTCI')
Draft Data Protection Act	Jamaica	Jamaica Information Commissioner (not yet operational)
Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2016)	Japan	Personal Information Protection Commission ('PPC')
Data Protection (Jersey) Law 2018	Jersey	Jersey Office of the Information Commissioner ('JOIC')
Data Protection Authority (Jersey) Law 2018	Jersey	Jersey Office of the Information Commissioner ('JOIC')
Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection	Kazakhstan	The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.
Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh)	Kazakhstan	The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.
The Data Protection Act, 2019	Kenya	Data Protection Commissioner (not yet operational)
Law No. 06/L-082 on Personal Data Protection	Kosovo	Information and Privacy Agency ('AIP')
Law of the Kyrgyz Republic of 14 April 2008 No. 58 on Personal Information as amended by the Law of the Kyrgyz Republic of 20 July 2017 No. 129 (only available in Russian)	Kyrgyzstan	There is no specific regulator.
Law on Electronic Data Protection 25/NA, Date 12 May 2017	Lao PDR	Data Protection Commission (not yet operational)
Personal Data Processing Law of 21 June 2018	Latvia	Data State Inspectorate ('DVI')
Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data (only available in Arabic)	Lebanon	There is no general data protection authority, the Ministry of Economy and Trade handles data processing registration/notification.
Data Protection Act, 2011	Lesotho	The Data Protection Commission (not yet operational)
Data Protection Act (DSG) of 4 October 2018 (only available in German)	Liechtenstein	Liechtensteiner data protection authority ('DSS')
Data Protection Ordinance (DSV) of 11 December 2018 (only available in German)	Liechtenstein	Liechtensteiner data protection authority ('DSS')
Law No XIII-1426 of 30 June 2018 amending Law No I-1374 (only available in Lithuanian)	Lithuania	State Data Protection Inspectorate ('VDAI')
Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR	Luxembourg	National Commission for Data Protection ('CNPD')
Personal Data Protection Act (Act 8/2005)	Macau	Office for Personal Data Protection ('GPDP')
Law No 2014 - 038 on the Protection of Personal Data (only available in French)	Madagascar	Madagascan information commission ('CMIL') (not yet operational)
Personal Data Protection Act 2010	Malaysia	Department of Personal Data Protection ('PDP')
Right to Information Act 2014	Maldives	No Data Protection Authority has been established
Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali (only available in French)	Mali	Malian data protection authority ('APDP')
Data Protection Act (Act XX 2018)	Malta	Office of the Information and Data Protection Commissioner ('IDPC')
The Personal Information Protection and Identity Theft Prevention Act, CCSM c P33.7	Manitoba	Manitoba Ombudsman
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Martinique	French data protection authority ('CNIL')
Draft Law No. 2017 - 020 on the protection of the personal data (only available in French)	Mauritania	Personal Data Protection Authority (not yet operational)
The Data Protection Act 2017	Mauritius	Data Protection Office
Federal Law on the Protection of Personal Data Held by Private Parties 2010	Mexico	National Institute for Access to Information and Protection of Personal Data ('INAI')
Regulations to the Federal Law on Protection of Personal Data Held by Private Parties	Mexico	National Institute for Access to Information and Protection of Personal Data ('INAI')
Law of 8 July 2011 No. 133 on Personal Data Protection (only available in Romanian)	Moldova	National Centre for Personal Data Protection ('NCPDP')
Act No. 1.165 on the Protection of Personal Data (23 December 1993)	Monaco	Monegasque data protection authority ('CCIN')
Law of Mongolia on Personal Secrets 1995 (only available in Mongolian)	Mongolia	No Data Protection Authority has been established
Personal Data Protection Law 79/08 and 70/09	Montenegro	Agency for Personal Data Protection and Free Access to Information ('AZLP')
Law No. 09-08 on the Protection of Individuals with Regard to Processing of Personal Data (only available in French)	Morocco	Moroccan data protection authority ('CNDP')
Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017) 8 March 2017	Myanmar	No Data Protection Authority has been established
Individual Privacy Act 2075 (2018)	Nepal	No Data Protection Authority has been established
Act Implementing the General Data Protection Regulation	Netherlands	Dutch data protection authority ('AP')
Right to Information and Protection of Privacy Act, SNB 2009 c R-10.6	New Brunswick	Office of the Ombud for New Brunswick
Privacy Act 1993	New Zealand	The Office of the Privacy Commissioner ('OPC')
Privacy Act 2020	New Zealand	The Office of the Privacy Commissioner ('OPC')
Access to Information and Protection of Privacy Act, SNL 2015 c A-1.2	Newfoundland and Labrador	Office of the Information and Privacy Commissioner for Newfoundland and Labrador
Law on Personal Data Protection No. 787 of 21 March 2012 (only available in Spanish)	Nicaragua	The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)
Regulation of Law No. 787, Decree No. 36-2012 of 17 October 2012 (only available in Spanish)	Nicaragua	The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)
Law No 2017-28 of 3 May 2017 (only available in French)	Niger	The Data Protection Authority (not yet operational)
Draft Data Protection Bill 2020	Nigeria	The bill would establish a new regulatory authority.
Nigeria Data Protection Regulation 2019	Nigeria	National Information Technology Development Agency ('NITDA')
Law on Personal Data Protection 2005, as amended (only available in Macedonian)	North Macedonia	Personal Data Protection Agency ('DZLP')
Information Act 2002	Northern Territory	Office of the Information Commissioner Northern Territory ('OICNT')
Access to Information and Protection of Privacy Act, SNWT 1994 c 20	Northwest Territories	Office of the Information and Privacy Commissioner Northwest Territories ('OIPC')
Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018 (only available in Norwegian)	Norway	Norwegian data protection authority ('Datatilsynet')
Freedom of Information and Protection of Privacy Act, SNS 1993 c 5	Nova Scotia	Office of the Information and Privacy Commissioner of Nova Scotia ('OIPC')
Access to Information and Protection of Privacy Act, SNWT (Nu) 1994 c 20	Nunavut	Office of the Nunavut Information and Privacy Commissioner ('OIPC')
Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022 ('the Law') (only available in Arabic)	Oman	The Ministry of Transport, Communications and Information Technology ('MTCI')
Freedom of Information and Protection of Privacy Act, RSO 1990 c F.31	Ontario	Information and Privacy Commissioner of Ontario
Personal Data Protection Bill 2021	Pakistan	Data Protection Commission (not yet operational)
Law No. 81 on Personal Data Protection 2019 (only available in Spanish)	Panama	National Authority for Transparency and Access to Information ('ANTAI')
Law No. 1682 Which Regulates Private Information 2001 (only available in Spanish)	Paraguay	Consumer Protection Secretariat (not yet operational)
Law No. 1969 of 2002 (only available in spanish)	Paraguay	Consumer Protection Secretariat (not yet operational)
Law No. 5543 of 2015 (only available in Spanish)	Paraguay	Consumer Protection Secretariat (not yet operational)
Law No. 29.733 on the Protection of Personal Data 2011 (only available in Spanish)	Peru	National Authority for the Protection of Personal Data ('ANPD')
Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 (only available in Spanish)	Peru	National Authority for the Protection of Personal Data ('ANPD')
The Data Privacy Act of 2012 (Republic Act No. 10173)	Philippines	National Privacy Commission ('NPC')
Act of 10 May 2018 on the Protection of Personal Data	Poland	Polish data protection authority ('UODO')
Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese)	Portugal	Portuguese data protection authority ('CNPD')
Freedom of Information and Protection of Privacy Act, RSPEI 1988 c F-15.01	Prince Edward Island	Information and Privacy Commissioner of Prince Edward Island ('IPC')
Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data (only available in Arabic)	Qatar	Ministry of Transport and Communications
Data Protection Rules 2005	Qatar Financial Centre	Qatar Financial Centre Authority ('QFC Regulatory Authority')
QFC Data Protection Regulations 2005	Qatar Financial Centre	Qatar Financial Centre Authority
Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1	Quebec	Quebec Commission on Access to Information ('CAI')
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties	Réunion	French data protection authority ('CNIL')
Law No. 190 of 18 July 2018 on the Implementation of the General Data Protection Regulation (Regulation (EU) 2016/679)	Romania	National Supervisory Authority for Personal Data Processing ('ANSPDCP')
Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended)	Russia	The Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor')
Law No. 058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy	Rwanda	The National Cyber Security Authority
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Saint Barthélemy	French data protection authority ('CNIL')
Data Protection Act, 2018	Saint Kitts and Nevis	Information Commissioner (not yet operational)
Data Protection (Amendment) Act 2014	Saint Lucia	Data Protection Commissioner (not yet operational)
Data Protection Act 2011	Saint Lucia	Data Protection Commissioner (not yet operational)
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR)	Saint Pierre and Miquelon	French data protection authority ('CNIL')
Law 21 December 2018 No. 171, Protection of Individuals with Regard to the Processing of Personal Data	San Marino	Guarantor for the Protection of Personal Data ('Guarantor')
Law No. 03/2016 on the Protection of Personal Data	São Tomé and Príncipe	National Data Protection Agency ('ANPDP')
The Freedom of Information and Protection of Privacy Act, SS 1990-91 c F-22.01	Saskatchewan	The Office of the Saskatchewan Information and Privacy Commissioner ('OIPC')
Personal Data Protection Law 2021 (only available in Arabic)	Saudi Arabia	Saudi Data & Artificial Intelligence Authority ('SDAIA')
Law No 2008-12 of January 25th 2008 Concerning the Personal Data Protection	Senegal	The Senegalese data protection authority ('CDP')
Law on Protection of Personal Data 2018 (Official Gazette of the Republic of Serbia, No. 87/2018) (only available to download in Serbian)	Serbia	Commissioner for Information of Public Importance and Personal Data Protection ('Poverenik')
Personal Data Protection (Amendment) Bill 2020	Singapore	Personal Data Protection Commission ('PDPC')
Personal Data Protection Act 2012 (No. 26 of 2012)	Singapore	Personal Data Protection Commission ('PDPC')
National Ordinance on Personal Data Protection 2010	Sint Maarten	Commission for the Supervision of Data Protection (not yet operational)
Act No. 18/2018 Coll. on Protection of Personal Data and on Amendments to certain Acts	Slovakia	Office for Personal Data Protection of the Slovak Republic ('ÚOOÚ')
Draft Personal Data Protection Act (only available in Slovene)	Slovenia	Information Commissioner ('the Commissioner')
Personal Data Protection Act 2004	Slovenia	Information Commissioner ('the Commissioner')
Law No. 005 the Data Protection Act	Somalia	Data Protection Authority
Protection of Personal Information Act, 2013 (Act 4 of 2013)	South Africa	The Information Regulator
Personal Information Protection Act 2011 (as amended in 2020)	South Korea	Personal Information Protection Commission ('PIPC')
Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish)	Spain	Spanish data protection authority ('AEPD')
Personal Data Protection Act, No. 9 of 2022 ('PDPA')	Sri Lanka	The Data Protection Authority of Sri Lanka (not yet operational)
Law 2018:218 with Additional Provisions to the General Data Protection Regulation	Sweden	Swedish data protection authority ('Datainspektionen')
Ordinance with Supplementary Provisions to the GDPR (SFS 2018:219)	Sweden	Swedish data protection authority ('Datainspektionen')
Federal Act on Data Protection 1992	Switzerland	Federal Data Protection and Information Commissioner ('FDPIC')
Personal Data Protection Act 2010 (as amended in 2015)	Taiwan	The National Development Council ('NDC')
Law of 3 August 2018 No.1537 on Protection of Personal Data (only available in Russian)	Tajikistan	The Communication Service under the Government of the Republic of Tajikistan
Personal Data Protection Act 2019 ('PDPA')	Thailand	Data Protection Commission (not yet operational)
Information and Communications Act, 2009	The Gambia	Gambia Public Utilities Regulatory Authority ('PURA')
Law No 2019-014 of October 29, 2019 on the Protection of Personal Data (only available in French)	Togo	Togolese data protection authority ('IPDCP') (not yet operational)
Data Protection Act, 2011	Trinidad and Tobago	Office of the Information Commissioner (not yet operational)
Draft Bill on the Protection of Personal Data (only available in French)	Tunisia	There is no established regulator yet
Organic Act no 2004-63 of July 27th 2004 on the Protection of Personal Data (only available in French)	Tunisia	Tunisian data protection authority ('INPDP')
Law on Protection of Personal Data No. 6698	Turkey	Personal Data Protection Authority ('KVKK')
The Law of Turkmenistan of 20 March 2017 on Information on Private Life and its Protection No. 519-V (only available in Russian)	Turkmenistan	Cabinet of Ministers of Turkmenistan
Federal Law No. 2 of 2019	UAE - DHCC	Ministry of Health and Prevention ('MOHAP')
Health Data Protection Regulation 2013 (DHCC Regulation No. 7 of 2013)	UAE - DHCC	Dubai Healthcare City Authority ('DHCR')
Data Protection and Privacy Act, 2019	Uganda	The National Information Technology Authority - Uganda ('NITA - U')
Data Protection Act 2018	UK	The Information Commissioner's Office ('ICO')
The Law of 1 June 2010 No. 2297-VI on Personal Data Protection (as amended) (only available in Ukranian)	Ukraine	The Ukraine Parliamentary Commissioner for Human Rights
Decree No. 414/009 Regulating Law 18.331 Relating to the Protection of Personal Data (only available in Spanish)	Uruguay	The Uruguayan data protection authority ('URCDP')
Decree No. 64/020 on the Regulation of Articles 37-40 of Law No. 19.670 of 15 October 2018	Uruguay	The Uruguayan data protection authority ('URCDP')
Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008 (only available in Spanish)	Uruguay	The Uruguayan data protection authority ('URCDP')
Children's Online Privacy Protection Act of 1998 ('COPPA')	USA Federal	Federal Trade Commission ('FTC')
Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ('CAN-SPAM')	USA Federal	Federal Trade Commission ('FTC')
Electronic Communications Privacy Act of 1986 ('ECPA')	USA Federal	U.S. Department of Justice ('DOJ')
Fair and Accurate Credit Transactions Act of 2003 ('FACTA')	USA Federal	Consumer Financial Protection Bureau ('CFPB')
Fair Credit Reporting Act of 1970 ('FCRA')	USA Federal	Federal Trade Commission ('FTC')
Federal Trade Commission Act of 1914 ('FTC Act')	USA Federal	Federal Trade Commission ('FTC')
Gramm-Leach-Bliley Act of 1999 ('GLBA')	USA Federal	Federal Trade Commission ('FTC')
Health Information Technology for Economic and Clinical Health Act of 2009 ('HITECH')	USA Federal	Department of Health and Human Services ('HHS')
Health Insurance Portability and Accountability Act of 1996 ('HIPAA')	USA Federal	Department of Health and Human Services ('HHS') Office for Civil Rights ('OCR')
Privacy Act of 1974	USA Federal	U.S. Department of Justice ('DOJ')
Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994	USA Federal	Federal Trade Commission ('FTC')
Telephone Consumer Protection Act of 1991 ('TCPA')	USA Federal	Federal Communications Commission ('FCC')
Video Privacy Protection Act of 1988 ('VPPA')	USA Federal	Federal Trade Commission ('FTC')
Utah Consumer Privacy Act ('UCPA')	Utah	Utah Attorney General
Law of Uzbekistan on Personal Data No. ЗРУ-547 dated 2 July 2019 (only available in Russian and Uzbek)	Uzbekistan	The State Personalisation Centre of Uzbekistan and the Cabinet of Ministers of the Republic of Uzbekistan
Draft Decree on Personal Data Protection (only available in Vietnamese)	Vietnam	No Data Protection Authority has been established
The Law on Cyber Information Security No. 86/2015/QH13	Vietnam	The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').
The Law on Cybersecurity No. 24/2018/QH14 dated June 12, 2018	Vietnam	The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').
Consumer Data Protection Act ('CDPA')	Virginia	Virgnia Attorney General
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (only available in French)	Wallis and Futuna	French data protection authority ('CNIL')
Access to Information and Protection of Privacy Act, RSY 2002 c 1	Yukon	Yukon Information and Privacy Commissioner ('YIPC')
The Data Protection Bill, 2020	Zambia	The Office of the Data Protection Commissioner (not yet operational)
Cyber Security and Data Protection Bill, H.B. 18, 2019	Zimbabwe	The Data Protection Authority of Zimbabwe (not yet operational)
Data Protection Act	Zimbabwe	Postal and Telecommunications Regulatory Authority of Zimbabwe ('POTRAZ')
Freedom of Information Bill, H.B. 6, 2019	Zimbabwe	Zimbabwe Media Commission

Portals

Global Privacy Directory

Get the Latest News

Thanks for signing up!

Company

Our Policies

Your Rights

Follow us