Support Centre

Laws

Law Jurisdiction Regulator
Law No. 18-07 of 25 Ramadhan 1439 Corresponding to June 10, 2018 Relating to the Protection of Individuals in the Processing of Personal Data Algeria

The Law provides that an independent Algerian data protection authority is established within the office of the President of the Republic of Algeria

Law No. 2009-09 of May 22, 2009 Dealing with the Protection of Personally Identifiable Information Benin

Beninese data protection authority ('APDP')

Law No. 010-2004/AN on the Protection of Personal Data Burkina Faso

Burkina Faso data protection authority ('CIL')

Law 133-V-2001 on the Protection of Personal Data Cape Verde

National Commission of Data Protection ('CNPD')

Resolution No. 151 of 2020 approving the Law on the Protection of Personal Data Egypt

Governing Body for the Protection of Personal Data (not yet operational)

Law No. 1/2.016 of 22 July on Personal Data Protection Equatorial Guinea Equatorial Guinea

Organo Rector de Proteccion de Datos Personales (not yet operational)

Data Protection Act, 2012 Ghana

The Data Protection Commission

Law 2013-450 on the Protection of Personal Data Ivory Coast

The Telecommunications/ICT Regulatory Authority of Côte d'Ivoire ('ARTCI')

The Data Protection Act, 2019 Kenya

Data Protection Commissioner (not yet operational)

Law No 2014 - 038 on the Protection of Personal Data Madagascar

Madagascan information commission ('CMIL') (not yet operational)

Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali Mali

Malian data protection authority ('APDP')

The Data Protection Act 2017 Mauritius

Data Protection Office

Law No. 09-08 on the Protection of Individuals with Regard to Processing of Personal Data Morocco

Moroccan data protection authority ('CNDP')

Draft Data Protection Bill 2020 Nigeria
Nigeria Data Protection Regulation 2019* Nigeria

National Information Technology Development Agency ('NITDA')

Law No. 03/2016 on the Protection of Personal Data São Tomé and Príncipe

National Data Protection Agency ('ANPDP')

Law No 2008-12 of January 25th 2008 Concerning the Personal Data Protection Senegal

The Senegalese data protection authority ('CDP')

Data Protection Act 2002 (Act 9 of 2003) Seychelles

A regulator has not yet been established

Protection of Personal Information Act, 2013 (Act 4 of 2013) South Africa

The Information Regulator

Draft Bill on the Protection of Personal Data Tunisia
Organic Act no 2004-63 of July 27th 2004 on the Protection of Personal Data Tunisia

Tunisian data protection authority ('INPDP')

Data Protection and Privacy Act, 2019 Uganda

The National Information Technology Authority - Uganda ('NITA - U')

Cyber Security and Data Protection Bill, H.B. 18, 2019 Zimbabwe

The Data Protection Authority of Zimbabwe (not yet operational)

Freedom of Information Bill, H.B. 6, 2019 Zimbabwe

Zimbabwe Media Commission

Cybersecurity Law 2016 China

Regulators include the Ministry of Industry and Information Technology ('MIIT') and the Cyberspace Administration of China ('CAC')

Draft Data Security Law China

No Data Protection Authority has been established

The Personal Data (Privacy) Ordinance Hong Kong

Office of the Privacy Commissioner for Personal Data ('PCPD')

The Personal Data Protection Bill, 2019 India

Data Protection Commission (not yet operational)

Draft Personal Data Protection Bill Indonesia

Data Protection Commission (not yet operational)

Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2016) Japan

Personal Information Protection Commission ('PPC')

Personal Data Protection Act (Act 8/2005) Macau

Office for Personal Data Protection ('GPDP')

Personal Data Protection Act 2010 Malaysia

Department of Personal Data Protection ('PDP')

Law of Mongolia on Personal Secrets 1995 Mongolia

No Data Protection Authority has been established

Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017) 8 March 2017 Myanmar

No Data Protection Authority has been established

Individual Privacy Act 2075 (2018) Nepal

No Data Protection Authority has been established

Privacy Act 1993 New Zealand

The Office of the Privacy Commissioner of New Zealand ('OPCNZ')

Privacy Act 2020 New Zealand

The Office of the Privacy Commissioner of New Zealand ('OPCNZ')

Personal Data Protection Bill 2020 Pakistan

Data Protection Commission (not yet operational)

The Data Privacy Act of 2012 (Republic Act No. 10173) Philippines

National Privacy Commission ('NPC')

Personal Data Protection Act 2012 (No. 26 of 2012) Singapore

Personal Data Protection Commission ('PDPC')

Personal Information Protection Act 2011 South Korea

Personal Information Protection Commission ('PIPC')

Personal Data Protection Act 2010 (as amended in 2015) Taiwan

The National Development Council ('NDC')

The Law on Cyber Information Security No. 86/2015/QH13 Vietnam

The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').

The Law on Cybersecurity No. 24/2018/QH14 dated June 12, 2018 Vietnam

The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC').

Personal Information Protection Act, SA 2003 c P-6.5 Alberta

Office of the Information and Privacy Commissioner of Alberta ('OIPC')

Personal Information Protection Act, SBC 2003 c 63 British Columbia

Office of the Information and Privacy Commissioner for British Columbia ('OIPC')

Personal Information Protection and Electronic Documents Act 2000 Canada Federal

Office of the Privacy Commissioner of Canada ('OPC')

The Personal Information Protection and Identity Theft Prevention Act, CCSM c P33.7 Manitoba

Manitoba Ombudsman

Right to Information and Protection of Privacy Act, SNB 2009 c R-10.6 New Brunswick

Office of the Ombud for New Brunswick

Access to Information and Protection of Privacy Act, SNL 2015 c A-1.2 Newfoundland and Labrador

Office of the Information and Privacy Commissioner for Newfoundland and Labrador

Access to Information and Protection of Privacy Act, SNWT 1994 c 20 Northwest Territories

Office of the Information and Privacy Commissioner Northwest Territories ('OIPC')

Freedom of Information and Protection of Privacy Act, SNS 1993 c 5 Nova Scotia

Office of the Information and Privacy Commissioner of Nova Scotia ('OIPC')

Access to Information and Protection of Privacy Act, SNWT (Nu) 1994 c 20 Nunavut

Office of the Nunavut Information and Privacy Commissioner ('OIPC')

Freedom of Information and Protection of Privacy Act, RSO 1990 c F.31 Ontario

Information and Privacy Commissioner of Ontario

Freedom of Information and Protection of Privacy Act, RSPEI 1988 c F-15.01 Prince Edward Island

Information and Privacy Commissioner of Prince Edward Island ('IPC')

Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 Quebec

Quebec Commission on Access to Information ('CAI')

The Freedom of Information and Protection of Privacy Act, SS 1990-91 c F-22.01 Saskatchewan

The Office of the Saskatchewan Information and Privacy Commissioner ('OIPC')

Access to Information and Protection of Privacy Act, RSY 2002 c 1 Yukon

Yukon Information and Privacy Commissioner ('YIPC')

Data Protection Act, 2013 Antigua and Barbuda

Information Commissioner

Data Protection Bill 2019 Barbados

Data Protection Commissioner (not yet operational)

Personal Information Protection Act 2016 Bermuda

Privacy Commissioner

The Data Protection Law, 2017 (Law 33 of 2017) Cayman Islands

Office of the Ombudsman

The Data Protection Regulations, 2018 (SL 17 of 2019) Cayman Islands

Office of the Ombudsman

Law No. 172-13 on the Comprehensive Protection of Personal Data Contained in Archives, Public Registries, Databases or Other Technical Means of Data Processing Used for Reporting, Whether Public or Private 2013 Dominican Republic

There is no general data protection regulator

Draft Data Protection Act Jamaica

Jamaica Information Commissioner (not yet operational)

Data Protection Act, 2018 Saint Kitts and Nevis

Information Commissioner (not yet operational)

Data Protection (Amendment) Act 2014 Saint Lucia

Data Protection Commissioner (not yet operational)

Data Protection Act 2011 Saint Lucia

Data Protection Commissioner (not yet operational)

Data Protection Act, 2011 Trinidad and Tobago

Office of the Information Commissioner (not yet operational)

Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data Armenia

Personal Data Protection Agency

Law of 11 May 2010 No. 998-IIIQ on Personal Data Azerbaijan

Ministry of Transport, Communications and High Technologies

Draft Law on Personal Data Belarus

Data Protection Commission (not yet operational)

Law of 10 November 2008 No. 455-Z on Information, Informatization and Data Protection Belarus

There is no specific state regulator for data protection in Belarus. General governance in the sphere of information protection is performed by the President of the Republic of Belarus and the Council of Ministers of the Republic of Belarus.

Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection Kazakhstan

The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.

Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies Kazakhstan

The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data.

Law of the Kyrgyz Republic of 14 April 2008 No. 58 on Personal Information as amended by the Law of the Kyrgyz Republic of 20 July 2017 No. 129 Kyrgyzstan

There is no specific regulator.

Law of 8 July 2011 No. 133 on Personal Data Protection Moldova

National Centre for Personal Data Protection ('NCPDP')

Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) Russian Federation

The Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor')

Law of 3 August 2018 No.1537 on Protection of Personal Data Tajikistan

The Communication Service under the Government of the Republic of Tajikistan

The Law of 1 June 2010 No. 2297-VI on Personal Data Protection (as amended) Ukraine

The Ukraine Parliamentary Commissioner for Human Rights

The Law of the Republic of Uzbekistan On Personal Data No. ___-547 dated 2 July 2019 Uzbekistan

The State Personalisation Centre of Uzbekistan and the Cabinet of Ministers of the Republic of Uzbekistan

Law on the Protection of Personal Data No. 9887 of 10 March 2008 (as amended) Albania

Information and Data Protection Commissioner ('IDP')

Qualified Act 15/2003, of 18 December, of Personal Data Protection Andorra

Andorran data protection authority ('APDA')

Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (Data Protection Act (DSG) BGBI. I No. 165/1999) (last amended in 2019) Austria

Austrian data protection authority ('DSB')

Act of 3 December 2017 Establishing the Data Protection Authority Belgium

Data Protection Authority ('Belgian DPA')

Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data Belgium

Data Protection Authority ('Belgian DPA')

Protection of Personal Data Act 2002 (last amended in 2019) Bulgaria

Commission for Personal Data Protection ('CPDP')

Law on the Implementation of the General Data Protection Regulation 2018 Croatia

Personal Data Protection Agency ('AZOP')

Law 125(I) of 2018 Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data Cyprus

Office of the Commissioner for Personal Data Protection ('the Commissioner')

Act No. 110/2019 Coll. on Personal Data Processing Czech Republic

Office for Personal Data Protection ('UOOU')

Act No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Data Protection Act) Denmark

Danish data protection authority ('Datatilsynet')

Personal Data Protection Act 2018 Estonia

Data Protection Inspectorate ('DPI')

Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) ('ePrivacy Directive') EU

European Data Protection Supervisor ('EDPS')

Directive on Security Network and Information Systems (Directive (EU) 2016/1148) ('NIS Directive') EU

National Member State supervisory authorities

General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) EU

European Data Protection Board ('EDPB')

Proposed Regulation on Privacy and Electronic Communications (2017/0003 (COD)) (10 January 2017) EU

National Member State supervisory authorities

Data Protection Act (1050/2018) Finland

Office of the Data Protection Ombudsman ('the Ombudsman')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) France

French data protection authority ('CNIL')

Law of Georgia on Personal Data Protection of 28 December 2011 No. 5669 Georgia

Office of the Personal Data Protection Inspector ('PDP')

Data Protection Act 2004 (as amended in 2018) Gibraltar

The Gibraltar Regulatory Authority ('GRA')

Law 3471/2006 on the Protection of Personal Data and Privacy in the Electronic Telecommunications Sector and Amendment of Law 2472/1997 Greece

The Hellenic Data Protection Authority ('HDPA')

Law No. 4624/2019 on the Personal Data Protection Authority, Implementing the General Data Protection Regulation (Regulation (EU) 2016/679) and Transposing into National Law Data Protection Directive with Respect to Law Enforcement (Directive (EU) 2016/680) and Other Provisions Greece

The Hellenic Data Protection Authority ('HDPA')

Personal Data Protection Act 2016 Greenland

Danish data protection authority ('Datatilsynet')

The Data Protection (Bailiwick of Guernsey) Law, 2017 Guernsey

The Office of the Data Protection Authority ('ODPA')

The Data Protection (Commencement, Amendment and Transitional) (Bailiwick of Guernsey) Ordinance, 2018 Guernsey

The Office of the Data Protection Authority ('ODPA')

Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information as amended by Act XXXVIII of 2018 Hungary

National Authority for Data Protection and Freedom of Information ('NAIH')

Act 90/2018 on Privacy and Processing of Personal Data Iceland

Icelandic data protection authority ('Persónuvernd')

Data Protection Act 2018 Ireland

Data Protection Commission ('DPC')

Data Protection (Application of the GDPR) Order 2018 Isle of Man

Information Commissioner ('the Commissioner')

Data Protection Act 2018 Isle of Man

Information Commissioner ('the Commissioner')

The GDPR and LED Implementing (Amendment) Regulations 2018 Isle of Man

Information Commissioner ('the Commissioner')

The GDPR and LED Implementing Regulations 2018 Isle of Man

Information Commissioner ('the Commissioner')

Personal Data Protection Code, Legislative Decree No. 196/2003 Italy

Italian data protection authority ('Garante')

Data Protection (Jersey) Law 2018 Jersey

Jersey Office of the Information Commissioner ('JOIC')

Data Protection Authority (Jersey) Law 2018 Jersey

Jersey Office of the Information Commissioner ('JOIC')

Law No. 06/L-082 on Personal Data Protection Kosovo

Information and Privacy Agency ('AIP')

Personal Data Processing Law of 21 June 2018 Latvia

Data State Inspectorate ('DVI')

Data Protection Act (DSG) of 4 October 2018 Liechtenstein

Liechtensteiner data protection authority ('DSS')

Data Protection Ordinance (DSV) of 11 December 2018 Liechtenstein

Liechtensteiner data protection authority ('DSS')

Law No XIII-1426 of 30 June 2018 amending Law No I-1374 Lithuania

State Data Protection Inspectorate ('VDAI')

Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR Luxembourg

National Commission for Data Protection ('CNPD')

Law on Personal Data Protection 2005, as amended Republic of North Macedonia

Personal Data Protection Agency ('DZLP')

Data Protection Act (Act XX 2018) Malta

Office of the Information and Data Protection Commissioner ('IDPC')

Act No. 1.165 on the Protection of Personal Data (23 December 1993) Monaco

Monegasque data protection authority ('CCIN')

Personal Data Protection Law 79/08 and 70/09 Montenegro

Agency for Personal Data Protection and Free Access to Information ('AZLP')

Act Implementing the General Data Protection Regulation Netherlands

Dutch data protection authority ('AP')

Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018 Norway

Norwegian data protection authority ('Datatilsynet')

Act of 10 May 2018 on the Protection of Personal Data Poland

Polish data protection authority ('UODO')

Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the General Data Protection Regulation (Regulation (EU) 2016/679) on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data Portugal

Portuguese data protection authority ('CNPD')

Law No. 190 of 18 July 2018 on the Implementation of the General Data Protection Regulation (Regulation (EU) 2016/679) Romania

National Supervisory Authority for Personal Data Processing ('ANSPDCP')

Law 21 December 2018 No. 171, Protection of Individuals with Regard to the Processing of Personal Data San Marino

Guarantor for the Protection of Personal Data ('Guarantor')

Law on Protection of Personal Data 2018 (Official Gazette of the Republic of Serbia, No. 87/2018) Serbia

Commissioner for Information of Public Importance and Personal Data Protection ('Poverenik')

Act No. 18/2018 Coll. on Protection of Personal Data and on Amendments to certain Acts Slovakia

Office for Personal Data Protection of the Slovak Republic ('ÚOOÚ')

Draft Personal Data Protection Act Slovenia

Information Commissioner ('the Commissioner')

Personal Data Protection Act 2004 Slovenia

Information Commissioner ('the Commissioner')

Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights Spain

Spanish data protection authority ('AEPD')

Law 2018:218 with Additional Provisions to the General Data Protection Regulation Sweden

Swedish data protection authority ('Datainspektionen')

Ordinance with Supplementary Provisions to the GDPR (SFS 2018:219) Sweden

Swedish data protection authority ('Datainspektionen')

Federal Act on Data Protection 1992 Switzerland

Federal Data Protection and Information Commissioner ('FDPIC')

Law on Protection of Personal Data No. 6698 Turkey

Personal Data Protection Authority ('KVKK')

Data Protection Act 2018 UK

The Information Commissioner's Office ('ICO')

Decree No. 25.326 Argentina

Argentinian data protection authority ('AAIP')

Personal Data Protection Act, Act No. 25.326 of 2000 Argentina

Argentinian data protection authority ('AAIP')

Draft Citizen Law of Privacy and Data Protection in Bolivia Bolivia

Electronic Government Agency and Information and Communication Technologies ('AGETIC')

Law No. 12.965 of 23 April 2014 Marco Civil da Internet Brazil

The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.

Bill No. 11144-07 Regulating the Processing and Protection of Personal Data and Creating the Personal Data Protection Authority Chile

Chilean Transparency Council ('CPLT')

Law No. 19.628 on the Protection of Private Life 1999 Chile

Chilean Transparency Council ('CPLT')

Decree 1377 of 2013 (June 27) Which Partially Regulates Law 1581 of 2012 Colombia

Colombian data protection authority ('SIC')

Statutory Law 1581 of 2012 (October 17) Which Issues General Provisions for the Protection of Personal Data Colombia

Colombian data protection authority ('SIC')

Executive Decree No. 37554-JP of 30 October 2012 Regulating Law No. 8968 Costa Rica

There is no general data protection authority, however the Dominican Telecommunications Institute ('INDOTEL') oversees certain matters such as data breach reporting

Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 of 2011 Costa Rica

Costa Rican data protection authority ('PRODHAB')

Draft Law for the Protection of Personal Data Ecuador

National Directorate of the Public Data Registry ('DINARDAP')

Consumer Protection Law as amended in 2018 El Salvador
Bill No. 4090 of 20 August 2009 for the Approval of the of the Personal Data Protection Law Guatemala
Draft Law on the Protection of Personal Data Honduras

There is no general data protection regulator

Federal Law on the Protection of Personal Data Held by Private Parties 2010 Mexico

National Institute for Access to Information and Protection of Personal Data ('INAI')

Regulations to the Federal Law on Protection of Personal Data Held by Private Parties Mexico

National Institute for Access to Information and Protection of Personal Data ('INAI')

Law on Personal Data Protection No. 787 of 21 March 2012 Nicaragua

The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)

Regulation of Law No. 787, Decree No. 36-2012 of 17 October 2012 Nicaragua

The Nicaraguan data protection authority ('DIPRODAP') (not yet operational)

Law No. 81 on Personal Data Protection 2019 Panama

National Authority for Transparency and Access to Information ('ANTAI')

Law No. 1682 Which Regulates Private Information 2001 Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 1969 of 2002 Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 5543 of 2015 Paraguay

Consumer Protection Secretariat (not yet operational)

Law No. 29.733 on the Protection of Personal Data 2011 Peru

Peruvian data protection authority ('APDP')

Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 Peru

Peruvian data protection authority ('APDP')

Decree No. 414/009 Regulating Law 18.331 Relating to the Protection of Personal Data Uruguay

The Uruguayan data protection authority ('URCDP')

Decree No. 64/020 on the Regulation of Articles 37-40 of Law No. 19.670 of 15 October 2018 Uruguay

The Uruguayan data protection authority ('URCDP')

Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008 Uruguay

The Uruguayan data protection authority ('URCDP')

Law No. (30) of the Year 2018 Issuing a Law on the Protection of Personal Data Bahrain

Ministry of Justice and Islamic Affairs ('MoJ')

Draft Protection of Personal Data Law Iran

The Ministry of Communications and Information Technology ('MICEX')

Protection of Privacy Law, 5741 - 1981 (unofficial translation) Israel

Privacy Protection Authority ('PPA')

Protection of Privacy Regulations (Data Security) 5777-2017 Israel

Privacy Protection Authority ('PPA')

Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data Qatar

Ministry of Transport and Communications

Children's Online Privacy Protection Act of 1998 ('COPPA') USA Federal

Federal Trade Commission ('FTC')

Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ('CAN-SPAM') USA Federal

Federal Trade Commission ('FTC')

Electronic Communications Privacy Act of 1986 ('ECPA') USA Federal

U.S. Department of Justice ('DOJ')

Fair and Accurate Credit Transactions Act of 2003 ('FACTA') USA Federal

Consumer Financial Protection Bureau ('CFPB')

Fair Credit Reporting Act of 1970 ('FCRA') USA Federal

Federal Trade Commission ('FTC')

Federal Trade Commission Act of 1914 ('FTC Act') USA Federal

Federal Trade Commission ('FTC')

Gramm-Leach-Bliley Act of 1999 ('GLBA') USA Federal

Federal Trade Commission ('FTC')

Health Information Technology for Economic and Clinical Health Act of 2009 ('HITECH') USA Federal

Department of Health and Human Services ('HHS')

Health Insurance Portability and Accountability Act of 1996 ('HIPAA') USA Federal

Department of Health and Human Services ('HHS') Office for Civil Rights ('OCR')

Privacy Act of 1974 USA Federal

U.S. Department of Justice ('DOJ')

Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994 USA Federal

Federal Trade Commission ('FTC')

Telephone Consumer Protection Act of 1991 ('TCPA') USA Federal

Federal Communications Commission ('FCC')

Video Privacy Protection Act of 1988 ('VPPA') USA Federal

Federal Trade Commission ('FTC')

Data Protection (Privacy of Personal Information) Act 2003 Bahamas

The Data Protection Commissioner

Law No. 22/11 on the Protection of Personal Data Angola

The Ministry of Telecommunications and Information Technology ('MTTI') announced, on 9 October 2019, that the National Database Protection Agency ('APD') had become operational.

Data Protection Act, 2018 Botswana

The Information and Data Protection Commission

Law No. 001/2011 on the Protection of Personal Data Gabon

Gabon data protection authority ('CNPDCP')

Law L-2016-037-AN Relating to Cybersecurity and the Protection of Personal Data Guinea

The Personal Data Protection Authority has not yet been established

Data Protection Act, 2011 Lesotho

The Data Protection Commission (not yet operational)

Privacy and Personal Information Protection Act 1998 No. 133 Australia - New South Wales

Information and Privacy Commission ('IPC')

Information Privacy Act 2009 Australia - Queensland

Office of the Information Commissioner ('OIC')

Information Privacy Principles Instruction No. 1 of 1989 Australia - South Australia

Privacy Committee of South Australia ('PCA')

Personal Information Protection Act 2004 Australia - Tasmania

The Office of the Ombudsman ('the Ombudsman')

Privacy and Data Protection Act 2014 (No. 60 of 2014) Australia - Victoria

The Office of the Victorian Information Commissioner ('OVIC')

Freedom of Information Act 1992 (No. 76 of 1992) Australia - Western Australia

Office of the Information Commissioner ('OIC')

Information Communications and Media Act of Bhutan 2018 Bhutan

No Data Protection Authority has been established

Law on Electronic Data Protection 25/NA, Date 12 May 2017 Lao PDR

Data Protection Commission (not yet operational)

Right to Information Act 2014 Maldives

No Data Protection Authority has been established

An Act to Provide for the Regulation of Processing of Personal Data (2019) Sri Lanka

Data Protection Commission (not yet operational)

National Ordinance of May 19, 2011 Laying Down New Rules for the Protection of Privacy in Connection with the Recording and Dissemination of Personal Data Aruba

The Ordinance does not create a regulatory authority.

Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Data Protection Ordinance) Curaçao

The Data Protection Board (not yet operational)

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Guyana

French data protection authority ('CNIL')

National Ordinance on Personal Data Protection 2010 Sint Maarten

Commission for the Supervision of Data Protection (not yet operational)

Act of May 17, 2010 Containing Rules on the Protection of Personal Data of Bonaire, Sint Eustatius and Saba BES Islands

Commission for the Supervision of Data Protection BES ('CBP BES')

The Law of Turkmenistan of 20 March 2017 on Information on Private Life and its Protection No. 519-V Turkmenistan

Cabinet of Ministers of Turkmenistan

Data Protection Rules 2005 Qatar - QFC
QFC Data Protection Regulations 2005 Qatar - QFC

Qatar Financial Centre Authority

Law No 2019-014 of October 29, 2019 on the Protection of Personal Data Togo

Togolese data protection authority ('IPDCP') (not yet operational)

Data Protection (Amendment) Regulations 2018 UAE - ADGM

ADGM Registration Authority and the Board of Directors of the ADGM

Data Protection Regulations 2015 UAE - ADGM

Office of Data Protection

Data Protection Regulations 2020 UAE - DIFC

The Commissioner of Data Protection

DIFC Data Protection Law No. 5 of 2020 UAE - DIFC

The Commissioner of Data Protection

Privacy Act 1988 Australia - Federal

The Office of the Australian Information Commissioner ('OAIC')

Information and Communications Act, 2009 The Gambia

Gambia Public Utilities Regulatory Authority ('PURA')

Draft Law No. 2017 - 020 on the protection of the personal data Mauritania

Personal Data Protection Authority (not yet operational)

Law on the Protection of Personal Data No. 49/06 Bosnia & Herzegovina

Agency for Personal Data Protection in Bosnia and Herzegovina ('AZLP')

Information Privacy Act 2014 Australia - Australian Capital Territory

The Office of the Australian Information Commissioner ('OAIC')

Information Act 2002 Northern Territory

Office of the Information Commissioner Northern Territory ('OICNT')

Law No 2017-28 of 3 May 2017 Niger

The Data Protection Authority (not yet operational)

Law No. 007/PR/2015 on the Protection of Personal Data Chad

Agence Nationale de Sécurité Informatique et de Certification Électronique ('ANSICE')

Law 29-2019 on the Protection of Personal Data Republic of Congo

The Law provides that the Commission responsible for the protection of personal data will be established by a law of the Republic of Congo in order to ensure the compliance with the Law.

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Guadeloupe

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Martinique

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Collectivity of Saint Martin

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Saint Pierre and Miquelon

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) Saint Barthélemy

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties Wallis and Futuna

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties French Polynesia

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties French Southern and Antarctic Lands

French data protection authority ('CNIL')

Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties Réunion

French data protection authority ('CNIL')

Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights Canary Islands

Spanish data protection authority ('AEPD')

Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the General Data Protection Regulation (Regulation (EU) 2016/679) on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data Azores

Portuguese data protection authority ('CNPD')

California Consumer Privacy Act of 2018 ('CCPA') California

California Attorney General ('AG')

Federal Data Protection Act of 30 June 2017 (implementing the GDPR) Germany - Federal

The Federal Commissioner for Data Protection and Freedom of Information ('BfDI')

State Data Protection Act (LDSG) 2018 Baden-Württemberg

Baden-Württemberg data protection authority ('LfDI Baden-Württemberg')

Bavarian Data Protection Act (BayDSG) of 15 May 2018 Germany - Bavaria

Data Protection Authority of Bavaria for the Private Sector ('BayLDA')

Berlin Data Protection Act ('BlnDSG') of 13 June 2018 Germany - Berlin

Berlin data protection authority ('Berlin Commissioner')

Brandenburg Data Protection Act ('BbgDSG') of 8 May 2018 Germany - Brandenburg

State Commissioner for Data Protection and Access to Information Brandenburg ('Brandenburg LDA')

Bremen Implementation Act to the EU General Data Protection Regulation (BremDSGVOAG) of 8 May 2018 Germany - Bremen

Bremen data protection authority ('the Bremen Commissioner')

Hamburg Data Protection Act (HmbDSG) of 18 May 2018 Germany - Hamburg

The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI')

Hessian Data Protection and Freedom of Information Act (HDSIG) of 3 May 2018 Germany - Hesse

Hessen data protection authority ('HBDI')

Lower Saxony Data Protection Act (NDSG) of 16 May 2018 Germany - Lower Saxony

Lower Saxony data protection authority ('LfD Niedersachsen')

State Data Protection Act (DSG M-V) of 22 May 2018 Germany - Mecklenburg-Vorpommern

Mecklenburg-Vorpommern data protection authority

Data Protection Law North Rhine-Westphalia (DSG NRW) 2018 Germany - North Rhine-Westphalia

North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information ('LDI NRW')

State Data Protection Act (LDSG) of 8 May 2018 Germany - Rhineland-Palatinate

Rhineland-Palatinate data protection authority ('LfDI Rheinland-Pfalz')

Saarland Data Protection Act ('SDSG') of 16 May 2018 Germany - Saarland

Saarland data protection authority

Saxon Data Protection Act (SächsDSG) of 25 August 2003, as amended to implement the GDPR Germany - Saxony

Saxon data protection authority ('SächsDSB')

Law for the Protection of Personal Data of Citizens (Data Protection Act Saxony-Anhalt - DSG LSA) of 12 March 1992 (GVBl. P. 152) Germany - Saxony-Anhalt

Sachsen-Anhalt data protection authority ('LfD Sachsen-Anhalt')

Schleswig-Holstein Law for the Protection of Personal Data (LDSG) of 2 May 2018 Germany - Schleswig-Holstein

Schleswig-Holstein data protection authority ('ULD')

Thuringian Data Protection and Implementation Act ('ThürDSAnpUG-EU') of 6 June 2018 Germany - Thuringia

Thuringian data protection authority ('TLfDI')

Law No. 13.709 of 14 August 2018, General Personal Data Protection Law ('LGPD') Brazil

The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette.

Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data Lebanon

There is no general data protection authority, the Ministry of Economy and Trade handles data processing registration/notification.

Federal Law No. 2 of 2019 UAE - DHCC

Ministry of Health and Prevention ('MOHAP')

Health Data Protection Regulation 2013 (DHCC Regulation No. 7 of 2013) UAE - DHCC

Dubai Healthcare City Authority – Regulatory ('DHCR')

Personal Data Protection Act 2019 ('PDPA') Thailand

Data Protection Commission (not yet operational)