Support Centre

Laws

Global Privacy Directory

Review the complete and official text of any of the regulations below

Law Jurisdiction Regulator
Law on the Protection of Personal Data No. 9887 of 10 March 2008 (as amended) Albania

Information and Data Protection Commissioner ('IDP')

Personal Information Protection Act, SA 2003 c P-6.5 Alberta

Office of the Information and Privacy Commissioner of Alberta ('OIPC')

Law No. 18-07 of 25 Ramadhan 1439 Corresponding to June 10, 2018 Relating to the Protection of Individuals in the Processing of Personal Data (only available in French) Algeria

The Law provides that an independent Algerian data protection authority is established within the office of the President of the Republic of Algeria

Qualified Act 15/2003, of 18 December, of Personal Data Protection Andorra

Andorran data protection authority ('APDA')

Law No. 22/11 on the Protection of Personal Data (only available in Portuguese) Angola

The Ministry of Telecommunications and Information Technology ('MTTI') announced, on 9 October 2019, that the National Database Protection Agency ('APD') had become operational.

Data Protection Act, 2013 Antigua and Barbuda

Information Commissioner

Decree No. 25.326 (only available in Spanish) Argentina

Argentinian data protection authority ('AAIP')

Personal Data Protection Act, Act No. 25.326 of 2000 Argentina

Argentinian data protection authority ('AAIP')

Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data Armenia

Personal Data Protection Agency

National Ordinance of May 19, 2011 Laying Down New Rules for the Protection of Privacy in Connection with the Recording and Dissemination of Personal Data (only available in Dutch) Aruba

The Ordinance does not create a regulatory authority.

Information Privacy Act 2014 Australia - Australian Capital Territory

The Office of the Australian Information Commissioner ('OAIC')

Privacy Act 1988 Australia - Federal

The Office of the Australian Information Commissioner ('OAIC')

Privacy and Personal Information Protection Act 1998 No. 133 Australia - New South Wales

Information and Privacy Commission ('IPC')

Information Privacy Act 2009 Australia - Queensland

Office of the Information Commissioner ('OIC')

Information Privacy Principles Instruction No. 1 of 1989 Australia - South Australia

Privacy Committee of South Australia ('PCA')

Personal Information Protection Act 2004 Australia - Tasmania

The Office of the Ombudsman ('the Ombudsman')

Privacy and Data Protection Act 2014 (No. 60 of 2014) Australia - Victoria

The Office of the Victorian Information Commissioner ('OVIC')

Freedom of Information Act 1992 (No. 76 of 1992) Australia - Western Australia

Office of the Information Commissioner ('OIC')

Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (Data Protection Act (DSG) BGBI. I No. 165/1999) (last amended in 2019) Austria

Austrian data protection authority ('DSB')

Law of 11 May 2010 No. 998-IIIQ on Personal Data (only available in Azerbaijani) Azerbaijan

Ministry of Transport, Communications and High Technologies

Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese) Azores

Portuguese data protection authority ('CNPD')

State Data Protection Act (LDSG) 2018 (only available in German) Baden-Württemberg

Baden-Württemberg data protection authority ('LfDI Baden-Württemberg')

Data Protection (Privacy of Personal Information) Act 2003 Bahamas

The Data Protection Commissioner

Law No. (30) of the Year 2018 Issuing a Law on the Protection of Personal Data (only available in Arabic) Bahrain

Ministry of Justice and Islamic Affairs ('MoJ')

Data Protection Bill 2019 Barbados

Data Protection Commissioner (not yet operational)

Draft Law on Personal Data (only available in Russian) Belarus

Data Protection Commission (not yet operational)

Law of 10 November 2008 No. 455-Z on Information, Informatization and Data Protection Belarus

There is no specific state regulator for data protection in Belarus. General governance in the sphere of information protection is performed by the President of the Republic of Belarus and the Council of Ministers of the Republic of Belarus.

Act of 3 December 2017 Establishing the Data Protection Authority Belgium

Data Protection Authority ('Belgian DPA')

Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data Belgium

Data Protection Authority ('Belgian DPA')

Law No. 2009-09 of May 22, 2009 Dealing with the Protection of Personally Identifiable Information Benin

Beninese data protection authority ('APDP')

Personal Information Protection Act 2016 Bermuda

Privacy Commissioner

Act of May 17, 2010 Containing Rules on the Protection of Personal Data of Bonaire, Sint Eustatius and Saba (only available in Dutch) BES Islands

Commission for the Supervision of Data Protection BES ('CBP BES')

Information Communications and Media Act of Bhutan 2018 Bhutan

No Data Protection Authority has been established

Draft Citizen Law of Privacy and Data Protection in Bolivia (only available in Spanish) Bolivia

Electronic Government Agency and Information and Communication Technologies ('AGETIC')

Law on the Protection of Personal Data No. 49/06 Bosnia & Herzegovina

Agency for Personal Data Protection in Bosnia and Herzegovina ('AZLP')

Data Protection Act, 2018 Botswana

The Information and Data Protection Commission

Law No. 12.965 of 23 April 2014 Marco Civil da Internet (only available in Portuguese) Brazil

The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.

Law No. 13.709 of 14 August 2018, General Personal Data Protection Law ('LGPD') Brazil

The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.

Personal Information Protection Act, SBC 2003 c 63 British Columbia

Office of the Information and Privacy Commissioner for British Columbia ('OIPC')

Protection of Personal Data Act 2002 (last amended in 2019) Bulgaria

Commission for Personal Data Protection ('CPDP')

Law No. 010-2004/AN on the Protection of Personal Data (only available in French) Burkina Faso

Burkina Faso data protection authority ('CIL')

California Consumer Privacy Act of 2018 ('CCPA') California

California Attorney General ('AG')

California Privacy Rights Act of 2020 ('CPRA') California

The California Privacy Protection Agency has not yet been established.

Bill C-11 for An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts Canada Federal

Office of the Privacy Commissioner of Canada ('OPC')

Personal Information Protection and Electronic Documents Act 2000 Canada Federal

Office of the Privacy Commissioner of Canada ('OPC')

Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish) Canary Islands

Spanish data protection authority ('AEPD')

Law 133-V-2001 on the Protection of Personal Data Cape Verde

National Commission of Data Protection ('CNPD')

The Data Protection Law, 2017 (Law 33 of 2017) Cayman Islands

Office of the Ombudsman

The Data Protection Regulations, 2018 (SL 17 of 2019) Cayman Islands

Office of the Ombudsman

Law No. 007/PR/2015 on the Protection of Personal Data (only available in French) Chad

Agence Nationale de Sécurité Informatique et de Certification Électronique ('ANSICE')

Bill No. 11144-07 Regulating the Processing and Protection of Personal Data and Creating the Personal Data Protection Authority (only available in Spanish) Chile

Chilean Transparency Council ('CPLT')

Law No. 19.628 on the Protection of Private Life 1999 (only available in Spanish) Chile

Chilean Transparency Council ('CPLT')

Cybersecurity Law 2016 China

Regulators include the Ministry of Industry and Information Technology ('MIIT') and the Cyberspace Administration of China ('CAC')

Draft Data Security Law (only available in Chinese) China

No Data Protection Authority has been established

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Collectivity of Saint Martin

French data protection authority ('CNIL')

Decree 1377 of 2013 (June 27) Which Partially Regulates Law 1581 of 2012 (only available in Spanish) Colombia

Colombian data protection authority ('SIC')

Statutory Law 1581 of 2012 (October 17) Which Issues General Provisions for the Protection of Personal Data (only available in Spanish) Colombia

Colombian data protection authority ('SIC')

Executive Decree No. 37554-JP of 30 October 2012 Regulating Law No. 8968 (only available in Spanish) Costa Rica

There is no general data protection authority, however the Dominican Telecommunications Institute ('INDOTEL') oversees certain matters such as data breach reporting

Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 of 2011 (only available in Spanish) Costa Rica

Costa Rican data protection authority ('PRODHAB')

Law on the Implementation of the General Data Protection Regulation 2018 (only available in Croatian) Croatia

Personal Data Protection Agency ('AZOP')

Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Data Protection Ordinance) (only available in Dutch) Curaçao

The Data Protection Board (not yet operational)

Law 125(I) of 2018 Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data Cyprus

Office of the Commissioner for Personal Data Protection ('the Commissioner')

Act No. 110/2019 Coll. on Personal Data Processing Czech Republic

Office for Personal Data Protection ('UOOU')

Act No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Data Protection Act) Denmark

Danish data protection authority ('Datatilsynet')

Law No. 172-13 on the Comprehensive Protection of Personal Data Contained in Archives, Public Registries, Databases or Other Technical Means of Data Processing Used for Reporting, Whether Public or Private 2013 (only available in Spanish) Dominican Republic

There is no general data protection regulator

Draft Law for the Protection of Personal Data (only available in Spanish) Ecuador

National Directorate of the Public Data Registry ('DINARDAP')

Resolution No. 151 of 2020 approving the Law on the Protection of Personal Data (only available in Arabic) Egypt

Governing Body for the Protection of Personal Data (not yet operational)

Consumer Protection Law as amended in 2018 (only available in Spanish) El Salvador

A regulator has not yet been established

Law No. 1/2.016 of 22 July on Personal Data Protection Equatorial Guinea Equatorial Guinea

Organo Rector de Proteccion de Datos Personales (not yet operational)

Personal Data Protection Act 2018 Estonia

Data Protection Inspectorate ('DPI')

Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) ('ePrivacy Directive') EU

European Data Protection Supervisor ('EDPS')

Directive on Security Network and Information Systems (Directive (EU) 2016/1148) ('NIS Directive') EU

National Member State supervisory authorities

General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) EU

European Data Protection Board ('EDPB')

Proposed Regulation on Privacy and Electronic Communications (2017/0003 (COD)) (10 January 2017) EU

National Member State supervisory authorities

Data Protection Act (1050/2018) Finland

Office of the Data Protection Ombudsman ('the Ombudsman')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) France

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties French Polynesia

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties French Southern and Antarctic Lands

French data protection authority ('CNIL')

Law No. 001/2011 on the Protection of Personal Data (only available in French) Gabon

Gabon data protection authority ('CNPDCP')

Law of Georgia on Personal Data Protection of 28 December 2011 No. 5669 Georgia

Office of the Personal Data Protection Inspector ('PDP')

Bavarian Data Protection Act (BayDSG) of 15 May 2018 (only available in German) Germany - Bavaria

Data Protection Authority of Bavaria for the Private Sector ('BayLDA')

Berlin Data Protection Act ('BlnDSG') of 13 June 2018 (only available in German) Germany - Berlin

Berlin data protection authority ('Berlin Commissioner')

Brandenburg Data Protection Act ('BbgDSG') of 8 May 2018 (only available in German) Germany - Brandenburg

State Commissioner for Data Protection and Access to Information Brandenburg ('Brandenburg LDA')

Bremen Implementation Act to the EU General Data Protection Regulation (BremDSGVOAG) of 8 May 2018 (only available in German) Germany - Bremen

Bremen data protection authority ('the Bremen Commissioner')

Federal Data Protection Act of 30 June 2017 (implementing the GDPR) Germany - Federal

The Federal Commissioner for Data Protection and Freedom of Information ('BfDI')

Hamburg Data Protection Act (HmbDSG) of 18 May 2018 (only available in German) Germany - Hamburg

The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI')

Hessian Data Protection and Freedom of Information Act (HDSIG) of 3 May 2018 (only available in German) Germany - Hesse

Hessen data protection authority ('HBDI')

Lower Saxony Data Protection Act (NDSG) of 16 May 2018 (only available in German) Germany - Lower Saxony

Lower Saxony data protection authority ('LfD Niedersachsen')

State Data Protection Act (DSG M-V) of 22 May 2018 (only available in German) Germany - Mecklenburg-Vorpommern

Mecklenburg-Vorpommern data protection authority

Data Protection Law North Rhine-Westphalia (DSG NRW) 2018 (only available in German) Germany - North Rhine-Westphalia

North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information ('LDI NRW')

State Data Protection Act (LDSG) of 8 May 2018 (only available in German) Germany - Rhineland-Palatinate

Rhineland-Palatinate data protection authority ('LfDI Rheinland-Pfalz')

Saarland Data Protection Act ('SDSG') of 16 May 2018 (only available in German) Germany - Saarland

Saarland data protection authority

Saxon Data Protection Act (SächsDSG) of 25 August 2003, as amended to implement the GDPR (only available in German) Germany - Saxony

Saxon data protection authority ('SächsDSB')

Law for the Protection of Personal Data of Citizens (Data Protection Act Saxony-Anhalt - DSG LSA) of 12 March 1992 (GVBl. P. 152) (only available in German) Germany - Saxony-Anhalt

Sachsen-Anhalt data protection authority ('LfD Sachsen-Anhalt')

Schleswig-Holstein Law for the Protection of Personal Data (LDSG) of 2 May 2018 (only available in German) Germany - Schleswig-Holstein

Schleswig-Holstein data protection authority ('ULD')

Thuringian Data Protection and Implementation Act ('ThürDSAnpUG-EU') of 6 June 2018 (only available in German) Germany - Thuringia

Thuringian data protection authority ('TLfDI')

Data Protection Act, 2012 Ghana

The Data Protection Commission

Data Protection Act 2004 (as amended in 2018) Gibraltar

The Gibraltar Regulatory Authority ('GRA')

Law 3471/2006 on the Protection of Personal Data and Privacy in the Electronic Telecommunications Sector and Amendment of Law 2472/1997 Greece

The Hellenic Data Protection Authority ('HDPA')

Law No. 4624/2019 on the Personal Data Protection Authority, Implementing the GDPR and Transposing into National Law Data Protection Directive with Respect to Law Enforcement and Other Provisions (only available in Greek) Greece

The Hellenic Data Protection Authority ('HDPA')

Personal Data Protection Act 2016 (only available in Danish) Greenland

Danish data protection authority ('Datatilsynet')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Guadeloupe

French data protection authority ('CNIL')

Bill No. 4090 of 20 August 2009 for the Approval of the of the Personal Data Protection Law (only available in Spanish) Guatemala

A regulator has not yet been established

The Data Protection (Bailiwick of Guernsey) Law, 2017 Guernsey

The Office of the Data Protection Authority ('ODPA')

The Data Protection (Commencement, Amendment and Transitional) (Bailiwick of Guernsey) Ordinance, 2018 Guernsey

The Office of the Data Protection Authority ('ODPA')

Law L-2016-037-AN Relating to Cybersecurity and the Protection of Personal Data (only available in French) Guinea

The Personal Data Protection Authority has not yet been established

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Guyana

French data protection authority ('CNIL')

Draft Law on the Protection of Personal Data (only available in Spanish) Honduras

There is no general data protection regulator

The Personal Data (Privacy) Ordinance Hong Kong

Office of the Privacy Commissioner for Personal Data ('PCPD')

Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information as amended by Act XXXVIII of 2018 Hungary

National Authority for Data Protection and Freedom of Information ('NAIH')

Act 90/2018 on Privacy and Processing of Personal Data Iceland

Icelandic data protection authority ('Persónuvernd')

The Personal Data Protection Bill, 2019 India

Data Protection Commission (not yet operational)

Draft Personal Data Protection Bill (only available in Indonesian) Indonesia

Data Protection Commission (not yet operational)

Draft Protection of Personal Data Law (only available in Persian) Iran

The Ministry of Communications and Information Technology ('MICEX')

Data Protection Act 2018 Ireland

Data Protection Commission ('DPC')

Data Protection (Application of the GDPR) Order 2018 Isle of Man

Information Commissioner ('the Commissioner')

Data Protection Act 2018 Isle of Man

Information Commissioner ('the Commissioner')

The GDPR and LED Implementing (Amendment) Regulations 2018 Isle of Man

Information Commissioner

The GDPR and LED Implementing Regulations 2018 Isle of Man

Information Commissioner

Protection of Privacy Law, 5741 - 1981 (unofficial translation) Israel

Privacy Protection Authority ('PPA')

Protection of Privacy Regulations (Data Security) 5777-2017 Israel

Privacy Protection Authority ('PPA')

Personal Data Protection Code, Legislative Decree No. 196/2003 Italy

Italian data protection authority ('Garante')

Law 2013-450 on the Protection of Personal Data Ivory Coast

The Telecommunications/ICT Regulatory Authority of Côte d'Ivoire ('ARTCI')

Draft Data Protection Act Jamaica

Jamaica Information Commissioner (not yet operational)

Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2016) Japan

Personal Information Protection Commission ('PPC')

Data Protection (Jersey) Law 2018 Jersey

Jersey Office of the Information Commissioner ('JOIC')

Data Protection Authority (Jersey) Law 2018 Jersey

Jersey Office of the Information Commissioner ('JOIC')

Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection Kazakhstan

The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.

Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh) Kazakhstan

The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.

The Data Protection Act, 2019 Kenya

Data Protection Commissioner (not yet operational)

Law No. 06/L-082 on Personal Data Protection Kosovo

Information and Privacy Agency ('AIP')

Law of the Kyrgyz Republic of 14 April 2008 No. 58 on Personal Information as amended by the Law of the Kyrgyz Republic of 20 July 2017 No. 129 (only available in Russian) Kyrgyzstan

There is no specific regulator.

Law on Electronic Data Protection 25/NA, Date 12 May 2017 Lao PDR

Data Protection Commission (not yet operational)

Personal Data Processing Law of 21 June 2018 Latvia

Data State Inspectorate ('DVI')

Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data (only available in Arabic) Lebanon

There is no general data protection authority, the Ministry of Economy and Trade handles data processing registration/notification.

Data Protection Act, 2011 Lesotho

The Data Protection Commission (not yet operational)

Data Protection Act (DSG) of 4 October 2018 (only available in German) Liechtenstein

Liechtensteiner data protection authority ('DSS')

Data Protection Ordinance (DSV) of 11 December 2018 (only available in German) Liechtenstein

Liechtensteiner data protection authority ('DSS')

Law No XIII-1426 of 30 June 2018 amending Law No I-1374 (only available in Lithuanian) Lithuania

State Data Protection Inspectorate ('VDAI')

Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR Luxembourg

National Commission for Data Protection ('CNPD')

Personal Data Protection Act (Act 8/2005) Macau

Office for Personal Data Protection ('GPDP')

Law No 2014 - 038 on the Protection of Personal Data (only available in French) Madagascar

Madagascan information commission ('CMIL') (not yet operational)

Personal Data Protection Act 2010 Malaysia

Department of Personal Data Protection ('PDP')

Right to Information Act 2014 Maldives

No Data Protection Authority has been established

Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali (only available in French) Mali

Malian data protection authority ('APDP')

Data Protection Act (Act XX 2018) Malta

Office of the Information and Data Protection Commissioner ('IDPC')

The Personal Information Protection and Identity Theft Prevention Act, CCSM c P33.7 Manitoba

Manitoba Ombudsman

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Martinique

French data protection authority ('CNIL')

Draft Law No. 2017 - 020 on the protection of the personal data (only available in French) Mauritania

Personal Data Protection Authority (not yet operational)

The Data Protection Act 2017 Mauritius

Data Protection Office

Federal Law on the Protection of Personal Data Held by Private Parties 2010 Mexico

National Institute for Access to Information and Protection of Personal Data ('INAI')

Regulations to the Federal Law on Protection of Personal Data Held by Private Parties Mexico

National Institute for Access to Information and Protection of Personal Data ('INAI')

Law of 8 July 2011 No. 133 on Personal Data Protection (only available in Romanian) Moldova

National Centre for Personal Data Protection ('NCPDP')

Act No. 1.165 on the Protection of Personal Data (23 December 1993) Monaco

Monegasque data protection authority ('CCIN')

Law of Mongolia on Personal Secrets 1995 (only available in Mongolian) Mongolia

No Data Protection Authority has been established

Personal Data Protection Law 79/08 and 70/09 Montenegro

Agency for Personal Data Protection and Free Access to Information ('AZLP')

Law No. 09-08 on the Protection of Individuals with Regard to Processing of Personal Data (only available in French) Morocco

Moroccan data protection authority ('CNDP')

Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017) 8 March 2017 Myanmar

No Data Protection Authority has been established

Individual Privacy Act 2075 (2018) Nepal

No Data Protection Authority has been established

Act Implementing the General Data Protection Regulation Netherlands

Dutch data protection authority ('AP')

Right to Information and Protection of Privacy Act, SNB 2009 c R-10.6 New Brunswick

Office of the Ombud for New Brunswick

Privacy Act 1993 New Zealand

The Office of the Privacy Commissioner ('OPC')

Privacy Act 2020 New Zealand

The Office of the Privacy Commissioner ('OPC')

Access to Information and Protection of Privacy Act, SNL 2015 c A-1.2 Newfoundland and Labrador

Office of the Information and Privacy Commissioner for Newfoundland and Labrador

Law on Personal Data Protection No. 787 of 21 March 2012 (only available in Spanish) Nicaragua

The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)

Regulation of Law No. 787, Decree No. 36-2012 of 17 October 2012 (only available in Spanish) Nicaragua

The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)

Law No 2017-28 of 3 May 2017 (only available in French) Niger

The Data Protection Authority (not yet operational)

Draft Data Protection Bill 2020 Nigeria
Nigeria Data Protection Regulation 2019 Nigeria

National Information Technology Development Agency ('NITDA')

Information Act 2002 Northern Territory

Office of the Information Commissioner Northern Territory ('OICNT')

Access to Information and Protection of Privacy Act, SNWT 1994 c 20 Northwest Territories

Office of the Information and Privacy Commissioner Northwest Territories ('OIPC')

Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018 (only available in Norwegian) Norway

Norwegian data protection authority ('Datatilsynet')

Freedom of Information and Protection of Privacy Act, SNS 1993 c 5 Nova Scotia

Office of the Information and Privacy Commissioner of Nova Scotia ('OIPC')

Access to Information and Protection of Privacy Act, SNWT (Nu) 1994 c 20 Nunavut

Office of the Nunavut Information and Privacy Commissioner ('OIPC')

Freedom of Information and Protection of Privacy Act, RSO 1990 c F.31 Ontario

Information and Privacy Commissioner of Ontario

Personal Data Protection Bill 2020 Pakistan

Data Protection Commission (not yet operational)

Law No. 81 on Personal Data Protection 2019 (only available in Spanish) Panama

National Authority for Transparency and Access to Information ('ANTAI')

Law No. 1682 Which Regulates Private Information 2001 (only available in Spanish) Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 1969 of 2002 (only available in spanish) Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 5543 of 2015 (only available in Spanish) Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 29.733 on the Protection of Personal Data 2011 (only available in Spanish) Peru

Peruvian data protection authority ('APDP')

Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 (only available in Spanish) Peru

Peruvian data protection authority ('APDP')

The Data Privacy Act of 2012 (Republic Act No. 10173) Philippines

National Privacy Commission ('NPC')

Act of 10 May 2018 on the Protection of Personal Data Poland

Polish data protection authority ('UODO')

Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese) Portugal

Portuguese data protection authority ('CNPD')

Freedom of Information and Protection of Privacy Act, RSPEI 1988 c F-15.01 Prince Edward Island

Information and Privacy Commissioner of Prince Edward Island ('IPC')

Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data (only available in Arabic) Qatar

Ministry of Transport and Communications

Data Protection Rules 2005 Qatar - QFC
QFC Data Protection Regulations 2005 Qatar - QFC

Qatar Financial Centre Authority

Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 Quebec

Quebec Commission on Access to Information ('CAI')

Law 29-2019 on the Protection of Personal Data Republic of Congo

The Law provides that the Commission responsible for the protection of personal data will be established by a law of the Republic of Congo in order to ensure the compliance with the Law.

Law on Personal Data Protection 2005, as amended (only available in Macedonian) Republic of North Macedonia

Personal Data Protection Agency ('DZLP')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties Réunion

French data protection authority ('CNIL')

Law No. 190 of 18 July 2018 on the Implementation of the General Data Protection Regulation (Regulation (EU) 2016/679) Romania

National Supervisory Authority for Personal Data Processing ('ANSPDCP')

Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) Russian Federation

The Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor')

Draft Data Protection and Privacy Law 2020 Rwanda

A regulator has not yet been established

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Saint Barthélemy

French data protection authority ('CNIL')

Data Protection Act, 2018 Saint Kitts and Nevis

Information Commissioner (not yet operational)

Data Protection (Amendment) Act 2014 Saint Lucia

Data Protection Commissioner (not yet operational)

Data Protection Act 2011 Saint Lucia

Data Protection Commissioner (not yet operational)

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Saint Pierre and Miquelon

French data protection authority ('CNIL')

Law 21 December 2018 No. 171, Protection of Individuals with Regard to the Processing of Personal Data San Marino

Guarantor for the Protection of Personal Data ('Guarantor')

Law No. 03/2016 on the Protection of Personal Data São Tomé and Príncipe

National Data Protection Agency ('ANPDP')

The Freedom of Information and Protection of Privacy Act, SS 1990-91 c F-22.01 Saskatchewan

The Office of the Saskatchewan Information and Privacy Commissioner ('OIPC')

Law No 2008-12 of January 25th 2008 Concerning the Personal Data Protection Senegal

The Senegalese data protection authority ('CDP')

Law on Protection of Personal Data 2018 (Official Gazette of the Republic of Serbia, No. 87/2018) (only available to download in Serbian) Serbia

Commissioner for Information of Public Importance and Personal Data Protection ('Poverenik')

Personal Data Protection (Amendment) Bill 2020 Singapore

Personal Data Protection Commission ('PDPC')

Personal Data Protection Act 2012 (No. 26 of 2012) Singapore

Personal Data Protection Commission ('PDPC')

National Ordinance on Personal Data Protection 2010 Sint Maarten

Commission for the Supervision of Data Protection (not yet operational)

Act No. 18/2018 Coll. on Protection of Personal Data and on Amendments to certain Acts Slovakia

Office for Personal Data Protection of the Slovak Republic ('ÚOOÚ')

Draft Personal Data Protection Act (only available in Slovene) Slovenia

Information Commissioner ('the Commissioner')

Personal Data Protection Act 2004 Slovenia

Information Commissioner ('the Commissioner')

Protection of Personal Information Act, 2013 (Act 4 of 2013) South Africa

The Information Regulator

Personal Information Protection Act 2011 (as amended in 2020) South Korea

Personal Information Protection Commission ('PIPC')

Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish) Spain

Spanish data protection authority ('AEPD')

An Act to Provide for the Regulation of Processing of Personal Data (2019) Sri Lanka

Data Protection Commission (not yet operational)

Law 2018:218 with Additional Provisions to the General Data Protection Regulation Sweden

Swedish data protection authority ('Datainspektionen')

Ordinance with Supplementary Provisions to the GDPR (SFS 2018:219) Sweden

Swedish data protection authority ('Datainspektionen')

Federal Act on Data Protection 1992 Switzerland

Federal Data Protection and Information Commissioner ('FDPIC')

Personal Data Protection Act 2010 (as amended in 2015) Taiwan

The National Development Council ('NDC')

Law of 3 August 2018 No.1537 on Protection of Personal Data (only available in Russian) Tajikistan

The Communication Service under the Government of the Republic of Tajikistan

Personal Data Protection Act 2019 ('PDPA') Thailand

Data Protection Commission (not yet operational)

Information and Communications Act, 2009 The Gambia

Gambia Public Utilities Regulatory Authority ('PURA')

Law No 2019-014 of October 29, 2019 on the Protection of Personal Data (only available in French) Togo

Togolese data protection authority ('IPDCP') (not yet operational)

Data Protection Act, 2011 Trinidad and Tobago

Office of the Information Commissioner (not yet operational)

Draft Bill on the Protection of Personal Data (only available in French) Tunisia

There is no established regulator yet

Organic Act no 2004-63 of July 27th 2004 on the Protection of Personal Data (only available in French) Tunisia

Tunisian data protection authority ('INPDP')

Law on Protection of Personal Data No. 6698 Turkey

Personal Data Protection Authority ('KVKK')

The Law of Turkmenistan of 20 March 2017 on Information on Private Life and its Protection No. 519-V (only available in Russian) Turkmenistan

Cabinet of Ministers of Turkmenistan

Data Protection (Amendment) Regulations 2018 UAE - ADGM

ADGM Registration Authority and the Board of Directors of the ADGM

Data Protection Regulations 2015 UAE - ADGM

Office of Data Protection

Federal Law No. 2 of 2019 UAE - DHCC

Ministry of Health and Prevention ('MOHAP')

Health Data Protection Regulation 2013 (DHCC Regulation No. 7 of 2013) UAE - DHCC

Dubai Healthcare City Authority ('DHCR')

Data Protection Regulations 2020 UAE - DIFC

The Commissioner of Data Protection

DIFC Data Protection Law No. 5 of 2020 UAE - DIFC

The Commissioner of Data Protection

Data Protection and Privacy Act, 2019 Uganda

The National Information Technology Authority - Uganda ('NITA - U')

Data Protection Act 2018 UK

The Information Commissioner's Office ('ICO')

The Law of 1 June 2010 No. 2297-VI on Personal Data Protection (as amended) (only available in Ukranian) Ukraine

The Ukraine Parliamentary Commissioner for Human Rights

Decree No. 414/009 Regulating Law 18.331 Relating to the Protection of Personal Data (only available in Spanish) Uruguay

The Uruguayan data protection authority ('URCDP')

Decree No. 64/020 on the Regulation of Articles 37-40 of Law No. 19.670 of 15 October 2018 Uruguay

The Uruguayan data protection authority ('URCDP')

Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008 (only available in Spanish) Uruguay

The Uruguayan data protection authority ('URCDP')

Children's Online Privacy Protection Act of 1998 ('COPPA') USA Federal

Federal Trade Commission ('FTC')

Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ('CAN-SPAM') USA Federal

Federal Trade Commission ('FTC')

Electronic Communications Privacy Act of 1986 ('ECPA') USA Federal

U.S. Department of Justice ('DOJ')

Fair and Accurate Credit Transactions Act of 2003 ('FACTA') USA Federal

Consumer Financial Protection Bureau ('CFPB')

Fair Credit Reporting Act of 1970 ('FCRA') USA Federal

Federal Trade Commission ('FTC')

Federal Trade Commission Act of 1914 ('FTC Act') USA Federal

Federal Trade Commission ('FTC')

Gramm-Leach-Bliley Act of 1999 ('GLBA') USA Federal

Federal Trade Commission ('FTC')

Health Information Technology for Economic and Clinical Health Act of 2009 ('HITECH') USA Federal

Department of Health and Human Services ('HHS')

Health Insurance Portability and Accountability Act of 1996 ('HIPAA') USA Federal

Department of Health and Human Services ('HHS') Office for Civil Rights ('OCR')

Privacy Act of 1974 USA Federal

U.S. Department of Justice ('DOJ')

Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994 USA Federal

Federal Trade Commission ('FTC')

Telephone Consumer Protection Act of 1991 ('TCPA') USA Federal

Federal Communications Commission ('FCC')

Video Privacy Protection Act of 1988 ('VPPA') USA Federal

Federal Trade Commission ('FTC')

Law of Uzbekistan on Personal Data No. ЗРУ-547 dated 2 July 2019 (only available in Russian and Uzbek) Uzbekistan

The State Personalisation Centre of Uzbekistan and the Cabinet of Ministers of the Republic of Uzbekistan

The Law on Cyber Information Security No. 86/2015/QH13 Vietnam

The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').

The Law on Cybersecurity No. 24/2018/QH14 dated June 12, 2018 Vietnam

The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (only available in French) Wallis and Futuna

French data protection authority ('CNIL')

Access to Information and Protection of Privacy Act, RSY 2002 c 1 Yukon

Yukon Information and Privacy Commissioner ('YIPC')

Cyber Security and Data Protection Bill, H.B. 18, 2019 Zimbabwe

The Data Protection Authority of Zimbabwe (not yet operational)

Freedom of Information Bill, H.B. 6, 2019 Zimbabwe

Zimbabwe Media Commission