Global Privacy & AI Laws

Amendments to commencement, management programmes, rights-request decisions, automated decisions, restrictions, officers, risk assessments, consultation, international data flow, Authority guidelines, delegated powers, definitions and Schedule VI.

Prevents reliance on superseded wording in the original 2022 attachment. This amendment supplies changes, not the full principal Act or all commencement orders.

Determine which 2022 provisions changed, how commencement is appointed, updated rights procedures and cross-border safeguards.

Amends Act 9/2022; the principal Act’s application, exceptions and remaining provisions still apply. Section 26’s prescribed public-authority restrictions are not a blanket localisation requirement for all controllers.

Section 2 → sections 3-7 with principal rights → sections 8-10 with principal risk/transfer duties → 11-15.

Privacy notices and specified nonaffiliated-third-party disclosures of consumers’ nonpublic personal financial information. The supplied § 313.1(b) limits FTC rulemaking coverage to qualifying motor-vehicle dealers described in 12 U.S.C. 5519, rather than every financial institution.

Avoids confusing the FTC’s notice/sharing rule with its broader financial security rule or another regulator’s implementing regulations. Annual notices and opt-outs have express exceptions.

Research a qualifying motor-vehicle dealer’s privacy notice, financial-information sharing or consumer opt-out arrangements.

The FTC rulemaking-authority motor-vehicle institutions described in § 313.1(b), subject to the statutory dealer exclusions and personal-purpose information test.

§ 313.1(b) → .3 → .4-.9 → .10-.15 → Appendix A where a model notice is used.

Lawful personal-data processing, purpose and proportionality, accuracy, retention, integrity/confidentiality, transparency, management programmes, rights, automated decisions, officers, processors, breaches, risk assessments, transfers and enforcement.

The original Act remains necessary for the provisions not replaced by the 2025 amendment, but its original commencement and cross-border text must not be presented as the amended law.

Research Sri Lankan processing, rights, automated decisions, security, DPIAs, overseas data flows or Authority powers; read the linked amendment alongside it.

Section 2 territorial/offering/monitoring tests, domestic-use exclusion and applicable exceptions; schedules and controller/processor roles must be considered separately.

Act 22/2025 section 2 → Act 9/2022 sections 2-12 → amended 17-20 and 24-26 → section 23 → Authority provisions.

General personal-data protection principles, sensitive and children’s data, data-subject authorisation and rights, notices, consultation/claim procedures, controller and processor duties, SIC oversight, sanctions, database registration and transfers.

The general framework has special-scope exclusions and implementing regulations. It should not be treated as a self-contained consolidation of every Colombian sectoral privacy requirement.

Research Colombian processing authorisation, sensitive data, children, access/correction, complaints, controller/processor duties, sanctions or cross-border disclosures.

Processing registered in databases by public/private entities within article 2, including the specified territorial and international-law connections; statutory exclusions remain subject to the law’s principles where indicated.

Articles 2-4 → 5-13 → 14-18 → 19-26 → 28.

Personal-data protection as a fundamental right, principles, access and correction, challenges to automated evaluations, communication of data, specially protected data, overseas transfers, database obligations, regulatory oversight and habeas data proceedings.

Article 16 directly protects individuals against significant automated evaluations and provides information about evaluation criteria and the programme used. The uploaded annotations must not be mistaken for the untouched 2008 wording.

Research Uruguay’s personal-data rights, automated credit/employment evaluations, sensitive data, transfers, database registration or habeas data.

Public and private personal-data databases and processing within articles 2-4, with domestic-use and other statutory exclusions. Special public/security-sector provisions require separate reading.

Articles 2-4 → 5-17 → 18-23 → 24-36 → 37 onward.

The decree enacts the attached law, delegates executive regulations and repeals specified electronic-transactions privacy provisions. The attached law regulates consent, sensitive data, children, rights, safeguards, records, breaches, officers, marketing, overseas transfers and offences.

Many practical controls and procedures are delegated to regulations. The source alone cannot supply every deadline, permit procedure or transfer condition.

Research Oman personal-data consent, sensitive-data permits, children, security incidents, officers, marketing consent or cross-border transfers.

Processed personal data under article 2, with article 3 exclusions including specified public/security duties, vital interests, research, personal/family use and qualifying public data; these are not blanket exclusions for all commercial processing.

Decree I-IV → law 2-6 → 10-16 → 17-23 → applicable offence provisions.

Processing principles and lawful bases, children and sensitive data, individual rights, international transfers, exemptions, controller/processor registration, accountability, security, breaches, impact assessments, privacy officers and enforcement.

Combines rights, profiling safeguards and operational accountability. The statute’s own scope and exemptions apply; resemblance to GDPR does not make GDPR universally applicable in Barbados.

Research Barbados personal-data processing, automated profiling, portability, overseas transfers, registration, security incidents or privacy-officer duties.

Section 3 application tests and sections 29-49 exemptions must be read before relying on duties; controller and processor obligations are distinct.

Section 3 → 4-9 → 10-28 → applicable exemptions → 50-69 → 90-95 and 100.

Establishes the Data Protection Commission and regulates personal-data processing through minimality, lawful justification, purpose, notice, retention, data quality, security, registration and individual rights. Includes special personal data, direct marketing and automated decision-taking.

This is the enacted Act 843 source, distinct from the library’s proposed 2025 bill. A proposed repeal in a draft does not establish that this Act has been repealed.

Research Ghanaian processing principles, controller registration, access/correction, special personal data, direct marketing, automated decisions or security compromises.

Read section 45’s establishment/equipment connections and exclusions, section 91 on State application and sections 60-74 exemptions. Section 18(2) separately addresses foreign data subjects; this is not simplified into a universal GDPR-style transfer rule.

Sections 45, 91 and exemptions → 17-31 → 32-44 → 46-58 → 75-80 → 99.

Would establish a Data Protection Authority and expand accountability, lawful processing, security, DPIAs, legitimate-interest assessments, rights, registration/DPOs, accreditation and international transfers. Draft clause 53 specifically addresses emerging technologies and clause 65 automated decision-taking.

Supports research into proposed reform, not a statement of existing duties. Its proposed repeal of Act 843 must not be read as an accomplished repeal; draft penalties and institutional powers are not asserted to apply now.

Research Ghana’s proposed reform, potential emerging-technology/AI data safeguards, expanded rights or draft transfer/localisation provisions.

Proposed scope only: read draft clause 1’s domestic, foreign targeting/profiling, equipment/processor and originating-information connections, and clauses 98-112 exemptions.

Draft clauses 1-2 → 37-53 → 54-68 → 84 → 93-97 → 122-125.

Personal-data processing through principles, controller/processor registration, Commissioner oversight, consent and other lawful bases, security, breach notifications, risk assessments, overseas transfers and individual rights. Includes high-risk new technology and solely automated decisions.

Provides Mauritius’s national privacy framework. Its own territorial, transfer and child-consent rules must be read directly rather than assumed to match GDPR wording.

Research processing in Mauritius, controller/processor registration, sensitive or child data, security incidents, international transfers or significant automated decisions.

Controllers and processors within section 3’s automated/filing-system and territorial/equipment tests, including State processing; check section 44 and the domestic-use/transit qualifications.

Sections 3, 14, 44 → 21-26 → 28-31 → 34-40 → 42-43 and 51.

Covered child-directed online services and actual-knowledge situations involving under-13 children’s personal information. Requires notices, verifiable parental consent, parent controls, collection limitation, security, purpose-limited retention and safe-harbour oversight.

The supplied rule includes the 2025 revisions, including biometric identifiers and stronger programme/retention requirements. It is not a universal under-18 privacy rule and does not make every online collection subject to identical consent rules.

Research children’s apps, games, online identifiers, voice/biometric processing, parental consent, third-party disclosure or data retention.

Operators and collections meeting the rule’s child-directed, mixed-audience, actual-knowledge and commercial coverage definitions and relevant exceptions.

§§ 312.2-.5 → .6-.8 → .10 → .11 where a safe harbour is used.

Data-subject rights and processing principles, consent and exceptions, collection, encryption, correction, deletion/de-identification, disclosure, transfers, impact dossiers, notifications, vulnerable persons and sectoral safeguards. Articles 30-32 specifically address AI/big data, location/biometrics and recording/filming.

A national privacy law with express AI-data provisions, not a general AI framework. Transitional recognition of Decree 13 consents and dossiers does not mean the two instruments are duplicates or that every earlier duty is unchanged.

Research Vietnamese personal data, AI/big-data processing, location/biometrics, employee/health/financial data, overseas transfers, impact dossiers or breach notifications.

Article 1 domestic and specified foreign processing connections. Article 38 exceptions concern only named provisions and do not remove general rights, consent, security or sectoral duties.

Articles 1-4 → 7-10 and 19 → 20-23 → relevant sector 24-32 → 38-39.

Education-record privacy at covered educational agencies and institutions receiving funds under programmes administered by the Secretary. Establishes rights, annual notification, inspection/review, amendment/hearing procedures, consent, disclosure exceptions, redisclosure limits and enforcement.

Determines when student-record services and outsourced institutional functions can receive information. The school-official exception requires direct institutional control and legitimate educational interests; it does not authorise unrestricted vendor AI training.

Research student records, parent/eligible-student requests, educational service providers, studies, directory information or emergency disclosures.

Educational agencies/institutions meeting § 99.1 funding and function tests and relevant recipients of education-record information; not every school or education app automatically.

§§ 99.1, .3, .5, .7 → .10 → .30-.37 → .60-.67.

Risk-based administrative, technical and physical protection of customer information through a written security programme, a Qualified Individual, risk assessments, controls, testing, staff training, provider oversight, response and reporting.

Covers FTC-jurisdiction financial institutions, including listed nonbank financial businesses, rather than all banks or businesses. Information held about other institutions’ customers can also be covered.

Research financial-sector security programmes, encryption/MFA, service-provider contracts, incident response or FTC notification events.

Financial institutions within FTC rulemaking/enforcement jurisdiction under the cited GLBA provisions, including customer information possessed on behalf of other institutions.

§ 314.1 → .2 → .3-.4 → .6; inspect the notification-event definition with .4(j).

Breach notifications for unsecured identifiable personal health record information. Covers qualifying foreign and domestic PHR vendors, PHR-related entities and third-party service providers maintaining US citizens’ or residents’ information. Unauthorised disclosures can be breaches, not just hacking.

Provides a distinct notification regime outside HIPAA for services satisfying the PHR and related-entity definitions. Not every health app automatically meets those tests.

Research an unauthorised acquisition or disclosure involving a qualifying health app, personal health record or connected service.

Entities meeting the PHR/vendor/related-entity/service-provider definitions and holding unsecured identifiable PHR health information, with the express HIPAA activity exclusions.

§§ 318.1-.2 → .3-.4 → .5-.6 → .7-.9.

Regulation S-P addresses nonpublic personal financial information, privacy notices, nonaffiliate disclosure/opt-out, safeguards, response and disposal. S-AM controls certain affiliate marketing solicitations. S-ID requires covered-account identity-theft programmes and card-issuer address-change checks.

The three subparts serve different functions and have different scope tests. A service-provider breach notice to a covered institution is not the same as reporting a breach to the SEC.

Research a securities firm’s financial privacy notices, security incident response, affiliate marketing or identity-theft programme.

S-P’s ordinary privacy provisions cover listed brokers, dealers, investment companies and SEC-registered advisers; safeguards/disposal definitions differ. S-ID applies to covered financial institutions or creditors with covered accounts, not automatically every registrant.

§ 248.1 → .3-.15 → .30 including definitions → .101 and .120-.128 → .201-.202 and Subpart C Appendix A.

Implements section 222 of the Communications Act for telecommunications carriers, including interconnected VoIP providers. Covers permitted CPNI uses, approval methods, notices, internal safeguards, customer authentication, account changes and breach reporting.

Distinguishes carrier customer-information duties from general internet privacy and from government access to stored communications. Customers can be individuals or entities, not only household consumers.

Research carrier marketing with call/customer data, CPNI consent, customer account authentication, SIM changes or carrier breaches.

Telecommunications carriers and interconnected VoIP providers handling CPNI, subject to the subpart’s permitted uses and specific exceptions.

§§ 64.2001, 64.2003 → .2005-.2008 → .2009-.2010 (including (h)(9)) → .2011 and its amendment notices.

Protects reasonably linkable consumer health information, including mental and physical health, reproductive care, biometrics, genetics, health-indicative location and health information inferred from other data using algorithms or machine learning. It regulates privacy disclosures, collection and sharing, consumer requests, security, processors, sales and certain health-facility geofences.

Addresses health-data privacy outside the information protected by HIPAA and other listed regimes. Small businesses are covered; information-level exemptions must not be mistaken for blanket exemptions for every record held by a health-care organisation.

Research health apps, health-related advertising, inferred health profiles, consumer health-data sales or location tracking involving Washington residents or data collected in Washington.

Washington residents and individuals whose consumer health data is collected in Washington, subject to the consumer, regulated-entity and small-business definitions and RCW 19.373.100 exclusions.

RCW 19.373.010 → .100 (exemptions) → .020-.040 → .050-.080 → .090.

Personal and sensitive data, prior consent and lawful exceptions, rights including objections to unnecessary or discriminatory profiling, processing standards, transparency, erasure, officers, confidentiality, data exchange, foreign transfers and institutional enforcement.

Consent conditions are in article 5, exceptions in article 6 and pre-processing information in article 9; these provisions must not be conflated. Profiling rights make this privacy law relevant to AI without classifying it as an AI Act.

Research Jordanian consent, profiling, subject rights, controller/processor safeguards, officer appointments or foreign transfers.

Personal-data processing within article 3, subject to the personal-purpose exclusion and article 6 grounds; specific sensitive-data and officer requirements must be assessed separately.

Articles 2-3 → 4-7 → 8-13 → 14-15 → 16 onward.

Subchapter I places on every financial institution a continuing duty to respect customer privacy and protect the security and confidentiality of nonpublic personal information. Institutions must give initial and annual privacy notices, must let consumers opt out before nonpublic personal information is disclosed to non-affiliated third parties, and may not share account numbers for marketing. Agencies make rules and enforce. Subchapter II makes it an offence to obtain customer information from a financial institution by false pretences (pretexting).

It is the federal baseline for privacy and security in US financial services and the source of the Privacy Rule and Safeguards Rule.

Use it for privacy notices, information sharing or security programmes of banks, lenders, insurers and other financial institutions.

Financial institutions and those who receive nonpublic personal information from them.

CURRENT. Enacted 1999 (Public Law 106-102), as amended. Read the official PDF on this page for the operative text.

Section 6809 (definitions) → 6801 → 6802 → 6803 → 6821.

The Act stops federal government authorities from getting access to a customer's financial records held by a financial institution unless the customer authorises it or the authority uses an administrative subpoena or summons, a search warrant, a judicial subpoena or a formal written request. The customer normally gets notice and may challenge the request in court; notice can be delayed in defined cases. Financial institutions must not release records until the authority certifies compliance. Exceptions, use restrictions and civil penalties follow.

It is the main federal limit on government access to bank records and sets the process banks follow when federal agencies seek customer data.

Use it when a US federal agency asks a bank or card issuer for an individual customer's records.

US federal government authorities and financial institutions holding customer records.

CURRENT. Enacted 1978, as amended. Read the official PDF on this page for the operative text.

Section 3401 → 3402 → 3405-3408 → 3409-3410 → 3413 (exceptions).

FISMA 2014 replaces 44 U.S.C. Chapter 35, Subchapter II. OMB oversees federal information security policy; DHS administers its implementation for civilian agencies, including binding operational directives and a federal information security incident center. Each agency head must run an agency-wide security programme based on risk, report major incidents to Congress, and have an annual independent evaluation by its Inspector General.

It is the core law on information security in US federal agencies and drives NIST standards use and federal contractor security requirements.

Use it for security duties of US federal agencies, contractors operating federal systems, or federal incident reporting.

US federal agencies and those operating information systems on their behalf.

CURRENT. Enacted 18 December 2014. Read the official PDF on this page for the operative text.

Section 3552 → 3553 → 3554 → 3555.

The Act authorises private entities to monitor their own information systems, operate defensive measures and share cyber threat indicators and defensive measures with each other and with the federal government, mainly through the DHS capability. It requires removal of personal information not directly related to a threat before sharing, sets privacy and civil liberties guidelines, and gives liability protection, antitrust exemptions and FOIA exemptions for sharing done under the Act.

It is the legal basis for most voluntary private-to-government cyber threat sharing in the United States.

Use it when sharing threat indicators with US agencies or peers, or assessing liability protection for that sharing.

Private entities and federal and non-federal government bodies sharing cyber threat information.

The Act carried a sunset date of 30 September 2025 (section 111); check whether it has been extended before relying on it. The supplied PDF is the whole Consolidated Appropriations Act, 2016; the Act is in Division N, Title I. Read the official PDF on this page for the operative text.

Section 102 → 104 → 105 → 106 → 111.

Section 2710 bars a video tape service provider from knowingly disclosing personally identifiable information about a consumer, meaning information identifying a person as having requested or obtained specific video materials or services. Disclosure is allowed with informed, written consent (which may be electronic), under a warrant or court order, to the consumer, for ordinary course of business, and in limited marketing cases. It requires destruction of old records and gives a civil action with liquidated damages of $2,500.

It is frequently used in US class actions over sharing streaming or video-viewing data, including through website tracking pixels.

Use it when a business shares what video content users watched, for consent wording, or for VPPA litigation risk.

Businesses delivering prerecorded video material, including online streaming services.

CURRENT. The text is in the supplied 18 U.S.C. Chapter 121 PDF (section 2710). Read the official PDF on this page for the operative text.

Section 2710(a) → (b) → (c).

The Act defines regulated user-to-user and search services, including services outside the UK with links to the UK. Part 3 imposes duties of care: illegal content risk assessments and safety duties, children's risk assessments and safety duties, content reporting and complaints, freedom of expression and privacy duties, and extra duties for categorised services. It covers pornography providers' age-assurance duties, Ofcom's codes of practice, information powers, fees and enforcement, and creates offences such as false and threatening communications, cyberflashing and sharing intimate images.

It is the UK's main platform-regulation law, with fines up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Use it for duties of online platforms or search services with UK users, age assurance, children's online safety or the online communications offences.

Providers of user-to-user, search and pornography services with links to the UK.

CURRENT. Royal Assent 26 October 2023; duties apply in phases as Ofcom codes come into force. Read the official PDF on this page for the operative text.

Sections 1-5 → Part 3 Chapter 2 (user-to-user duties) → Part 5 → Part 7.

The Act applies to persons doing business in Texas or producing products or services consumed by Texans that process or sell personal data and are not small businesses (small businesses still need consent before selling sensitive data). Consumers may confirm, access, correct, delete and port data and opt out of targeted advertising, sale and profiling. Controllers need consent for sensitive data, must give privacy notices, disclose sale of sensitive or biometric data, and conduct data protection assessments. Processors work under contract. The Attorney General enforces exclusively after a 30-day cure period, with civil penalties up to $7,500 per violation.

It is the privacy law of one of the largest US State economies and applies without a revenue or volume threshold.

Use it when processing personal data of Texas consumers.

Businesses processing personal data of Texas consumers, other than small businesses (except for sensitive data sales).

CURRENT. In force from 1 July 2024. Read the official PDF on this page for the operative text.

Section 541.001 → 541.002 → Subchapter B → Subchapter C → Subchapter E.

Chapter 121 makes it an offence to access a facility providing electronic communication service without authorisation and obtain stored communications. It limits providers' voluntary disclosure of the contents of communications and customer records, sets the process for government to compel disclosure (warrant, court order under section 2703(d) or subpoena), provides for backup preservation and delayed notice, and gives a civil action. Section 2713 (CLOUD Act) requires providers to preserve and disclose data within their control regardless of where it is stored.

It is the main US law on government and private access to emails and other stored electronic communications.

Use it for law-enforcement requests to US providers, disclosure of customer communications, or access to data stored abroad by US providers.

Providers of electronic communication and remote computing services, and US government entities.

CURRENT. The supplied copy is the 2024 edition of the United States Code. Read the official PDF on this page for the operative text.

Section 2711 (definitions) → 2701 → 2702 → 2703 → 2713.

The Act applies to persons doing business in Delaware that control or process personal data of at least 35,000 consumers, or of 10,000 consumers while deriving over 20 percent of gross revenue from selling personal data. Consumers may confirm, access, correct, delete and port data, obtain a list of third parties, and opt out of targeted advertising, sale and profiling with significant effects. Controllers need consent for sensitive data, must recognise universal opt-out signals, publish a privacy notice and carry out data protection assessments. The Department of Justice enforces.

It has some of the lowest applicability thresholds among US State privacy laws and broad sensitive data rules.

Use it when processing personal data of Delaware consumers.

Controllers and processors meeting the Delaware thresholds.

CURRENT. In force from 1 January 2025. Read the official PDF on this page for the operative text.

§ 12D-102 → 12D-103 → 12D-104 → 12D-106 → 12D-111.

The chapter applies to persons doing business in Iowa that control or process personal data of at least 100,000 consumers, or of 25,000 consumers while deriving over half of gross revenue from selling personal data. Consumers may confirm processing, access, delete and obtain a copy of their data and opt out of sale. Controllers must limit processing, keep security practices, give notice before processing sensitive data and offer an opt-out, and publish a privacy notice. Processors work under contract. The Attorney General enforces exclusively, after a 90-day cure period, with civil penalties up to $7,500 per violation.

It is Iowa's comprehensive consumer privacy law, among the more business-friendly US State models.

Use it when processing personal data of Iowa consumers above the thresholds.

Controllers and processors meeting the Iowa thresholds.

CURRENT. In force from 1 January 2025. Read the official PDF on this page for the operative text.

715D.1 → 715D.2 → 715D.3 → 715D.4 → 715D.8.

Section 14-3501 defines business, encrypted, personal information and related terms. The subtitle requires businesses to take reasonable steps when destroying records, to implement reasonable security procedures, to require service providers to do the same, and after discovering a breach of the security of a system to investigate and notify affected Maryland residents and the Attorney General. Violations are unfair or deceptive trade practices.

It is Maryland's data security and breach notification law for any business holding residents' personal information.

Use it for a security incident or security programme involving personal information of Maryland residents.

Businesses that own, license or maintain personal information of Maryland residents.

CURRENT. As amended. Read the official PDF on this page for the operative text.

Section 14-3501 → 14-3503 → 14-3504. The supplied PDF contains section 14-3501 only; read the remaining sections in the full subtitle.

The Act defines critical infrastructure assets across sectors including energy, communications, data storage and processing, financial services, water, health, transport and food. It creates the Register of Critical Infrastructure Assets, critical infrastructure risk management programs, mandatory cyber security incident reporting, enhanced cyber security obligations for systems of national significance, ministerial directions, and last-resort government assistance powers.

It is Australia's main critical-infrastructure security law, with strict deadlines for reporting significant cyber incidents.

Use it when an entity may own or operate a critical infrastructure asset in Australia, or for cyber incident reporting duties.

Owners and operators of critical infrastructure assets in Australia.

CURRENT. The supplied copy is Compilation No. 9 (4 June 2026). Read the official PDF on this page for the operative text.

Part 1 definitions → Part 2B → Part 2A → Part 2.

The Act is Australia's core telecommunications statute. It covers carrier licensing and carriage service providers, industry codes and standards, consumer safeguards, and Part 13, which restricts the use and disclosure of information and communications by carriers and service providers, with permitted exceptions. Part 14 covers national interest matters and security obligations, and Part 15 sets the industry assistance framework (technical assistance requests and notices).

Part 13 is a key confidentiality rule for telecoms data in Australia; Parts 14 and 15 set security and law-enforcement assistance duties.

Use it for disclosure of telecoms customer information, security duties of carriers, or agency requests for technical assistance.

Carriers, carriage service providers and others in the Australian telecoms industry.

CURRENT. The supplied copy is Compilation No. 117 (4 June 2026), in 3 volumes. Read the official PDF on this page for the operative text.

Part 1 → Part 13 → Part 14 → Part 15.

The Act sets up the eSafety Commissioner and complaint-based removal schemes for cyber-bullying material targeted at Australian children, cyber-abuse material targeted at Australian adults, and non-consensual sharing of intimate images. It includes the online content scheme for class 1 and class 2 material, blocking of abhorrent violent conduct material, Basic Online Safety Expectations with reporting requirements, industry codes and standards, and the social media minimum age obligations.

It is Australia's central online-safety law and the basis of eSafety's removal notices and the under-16 social media restriction.

Use it for platform takedown notices in Australia, cyber-abuse complaints, image-based abuse, or age restrictions on social media.

Social media, messaging, hosting and other online service providers with Australian end-users.

CURRENT. The supplied copy is Compilation No. 4, in force on 12 September 2026. Read the official PDF on this page for the operative text.

Part 1 definitions → Part 4A → Parts 3 and 5-7 → Part 4.

The Act prohibits sending, or causing to be sent, unsolicited commercial electronic messages (email, SMS, MMS and instant messages) that have an Australian link. Messages need the recipient's consent, accurate sender identification and contact details, and a working unsubscribe facility honoured within five working days. It bans supplying, acquiring or using address-harvesting software and harvested lists, and provides civil penalties, injunctions and enforceable undertakings.

It is Australia's main electronic marketing law, applying alongside the Privacy Act 1988.

Use it for email or SMS marketing to Australians, consent for commercial messages or unsubscribe rules.

Anyone sending commercial electronic messages with an Australian link.

CURRENT. The supplied copy is Compilation No. 10 (10 March 2016); check later amendments. Read the official PDF on this page for the operative text.

Section 6 (definitions) → sections 16-18 → Schedule 2 (consent) → Part 4.

Part 1 gives ministers power to specify security requirements for relevant connectable products made available to UK consumers, and sets duties for manufacturers, importers and distributors: complying with the requirements, statements of compliance, investigating and acting on compliance failures, and keeping records. It provides enforcement notices, recall notices and monetary penalties. Part 2 amends the Electronic Communications Code and related law on the installation and sharing of telecommunications infrastructure.

It is the UK's baseline security law for consumer smart and internet-connected products, backed by regulations that ban universal default passwords and require vulnerability-reporting and security-update information.

Use it when making, importing or selling connectable consumer products in the UK, or for rights over telecoms infrastructure on land.

Manufacturers, importers and distributors of consumer connectable products in the UK; telecoms operators and landowners for Part 2.

CURRENT. Royal Assent 6 December 2022; the product security regime applies from 29 April 2024. Read the official PDF on this page for the operative text.

Sections 1-3 (security requirements) → duties of manufacturers → enforcement → Part 2.

The first part applies to data collectors holding personal information of Nevada residents: secure destruction of records, reasonable security measures, encryption for data collectors that accept payment cards or move personal information outside their secure system, and notice to residents after a breach of the security of the system data. A later part applies to operators of internet websites and online services: they must post a notice of the covered information collected and must not sell covered information of a consumer who has opted out. The Attorney General enforces.

It combines one of the earliest US encryption mandates with Nevada's online privacy notice and opt-out-of-sale rules.

Use it for security, encryption, breach notice or online privacy notices involving Nevada residents.

Data collectors and online operators handling personal or covered information of Nevada residents.

CURRENT. As amended. Read the official PDF on this page for the operative text.

NRS 603A.010-.040 → .210 → .215 → .220 → .340-.345.

Section 2 amends section 223 of the Communications Act to make it an offence to knowingly publish, using an interactive computer service, an intimate visual depiction of an identifiable individual without consent, including a digital forgery, with separate rules for minors and for threats. Section 3 requires covered platforms to set up a process for an identifiable individual to request removal and to remove the depiction, and known identical copies, within 48 hours of a valid request. Failure to comply is treated as an unfair or deceptive practice enforced by the FTC.

It is the first federal law aimed directly at AI-generated intimate deepfakes and places removal duties on platforms.

Use it for nonconsensual intimate images or deepfakes, or for a platform's removal process in the US.

Anyone publishing intimate depictions; covered platforms hosting user-generated content.

CURRENT. Enacted 19 May 2025; platforms had one year from enactment to set up the removal process. Read the official PDF on this page for the operative text.

Section 4 (definitions) → Section 2 → Section 3.

A State department of motor vehicles may not knowingly disclose personal information from a motor vehicle record except for the permissible uses listed in section 2721(b), such as government functions, vehicle safety, legal proceedings and insurance. Highly restricted personal information such as photographs and medical information needs express consent. Resale and redisclosure are limited, false representations to obtain records are unlawful, and there are criminal fines and a civil action with liquidated damages.

It limits use of driver records for marketing, data brokerage and locating individuals.

Use it when obtaining, using or reselling information from US State driver or vehicle records.

State motor vehicle departments and anyone who obtains or uses motor vehicle record information.

CURRENT. Enacted 1994, as amended. Read the official PDF on this page for the operative text.

Section 2725 → 2721 → 2722 → 2724.

The Act sets out when public authorities may interfere with privacy to obtain communications. Part 1 sets general privacy duties and offences of unlawful interception and unlawful obtaining of communications data. Later Parts regulate targeted interception, communications data acquisition and retention notices, equipment interference, bulk interception, bulk acquisition, bulk equipment interference and bulk personal datasets, with a double-lock of Secretary of State and Judicial Commissioner approval, oversight by the Investigatory Powers Commissioner and duties on telecommunications operators.

It is the UK's central surveillance law and directly affects telecom operators and online services that may receive warrants, retention notices or technical capability notices.

Use it for UK lawful interception, communications-data requests and retention, technical capability notices, or how surveillance interacts with privacy rights.

UK intelligence and law-enforcement bodies, and telecommunications and postal operators subject to warrants and notices.

IN FORCE. The supplied copy is the Act as enacted and does not include later amendments, such as those made by the Investigatory Powers (Amendment) Act 2024; check the current revised text. Read the official PDF on this page for the operative text.

Section 1 (overview) → section 2 (privacy duties) → Part 1 offences → Part 2 interception → Parts 3–4 communications data → Part 8 oversight.

Georgia's comprehensive data-protection law, closely modelled on the GDPR. It applies to automated processing and filing-system processing in Georgia, and to controllers not established in Georgia that use technical means in Georgia (other than for transit). It sets processing principles and legal grounds, special-category data rules, data-subject rights, controller and processor duties, incident notification, transfers abroad, the powers of the Personal Data Protection Service, and administrative fines.

It replaced Georgia's 2011 law with a modern GDPR-style regime, relevant to anyone processing data in Georgia or using technical means there.

Use it for processing personal data in Georgia, data-subject requests, incident notification, transfers out of Georgia or fines imposed by the Personal Data Protection Service.

Controllers and processors in Georgia, and non-established controllers using technical means in Georgia.

CURRENT / IN FORCE. The supplied copy is a consolidated version for 02/04/2025–13/05/2025 and notes it is not the latest edition; amendments of 5 September 2024 and 6 February 2025 are listed. Read the official PDF on this page for the operative text.

Article 2 (scope) → definitions and principles → data-subject rights → controller duties and incidents → sanctions → Article 90.

The Act creates offences relating to cybercrime (unlawful access, interception of data, interference with data and systems, cyber fraud, forgery, extortion and malicious communications), criminalises disclosure of harmful data messages including intimate images, and provides for protection orders, jurisdiction, search, access and seizure powers, expedited preservation of data, mutual assistance, a 24/7 point of contact, and duties on electronic communications service providers and financial institutions to report and preserve information.

It is South Africa's main cybercrime statute, sitting alongside POPIA, and imposes reporting duties on service providers and financial institutions.

Use it for cyber incidents and offences in South Africa, harmful data messages, police powers to obtain data, or reporting duties of electronic communications service providers and financial institutions.

All persons in South Africa, with extraterritorial jurisdiction rules, plus specific duties on service providers and financial institutions.

IN FORCE BY PROCLAMATION. The supplied Gazette copy does not show which sections have been proclaimed; check the commencement proclamation for each provision. Read the official PDF on this page for the operative text.

Definitions → Chapter 1 offences → Chapter 2 malicious communications → investigation powers → reporting obligations.

CASL regulates commercial electronic messages (email, text and similar). Sending one requires consent (express or implied), sender identification and a working unsubscribe mechanism. It also prohibits altering transmission data and installing computer programs on another person's device without consent, and amends the CRTC Act, the Competition Act, PIPEDA and the Telecommunications Act to address false or misleading electronic messages and address harvesting.

It is one of the strictest anti-spam regimes in the world and applies to messages sent to or accessed from computers in Canada, with large administrative monetary penalties.

Use it for email or SMS marketing to Canadians, consent and unsubscribe design, software installation consent or CRTC enforcement.

Anyone sending commercial electronic messages to, or installing programs on, computer systems in Canada.

CURRENT / IN FORCE. Some amendments listed in the consolidation were not in force on 21 September 2026; they appear under "Amendments Not in Force". Read the official PDF on this page for the operative text.

Section 1 (definitions) → section 6 → section 10 (consent) → sections 7–8 → penalties.

The Act aims to deter, prevent and reduce harm caused by digital communications and to give victims quick and efficient redress. It sets ten communication principles, establishes an Approved Agency to receive and resolve complaints, lets the District Court make orders (such as take-down orders) against harmful digital communications, gives online content hosts a safe-harbour process, and creates offences including causing harm by posting a digital communication.

It is New Zealand's main law on online harassment, intimate image abuse and harmful posts, and sets notice-and-takedown duties for online content hosts.

Use it for online harassment or harmful posts in New Zealand, take-down requests, content-host liability or the criminal offence of posting harmful digital communications.

Individuals posting digital communications, online content hosts and victims of harmful communications in New Zealand.

CURRENT / IN FORCE. The supplied version is as at 9 March 2022; check for later amendments. Read the official PDF on this page for the operative text.

Section 3 (purpose) → section 6 (principles) → Approved Agency → court orders → section 22 → content-host safe harbour.

The Act creates the UK's core computer offences: unauthorised access to computer material (section 1), unauthorised access with intent to commit or facilitate further offences (section 2) and unauthorised modification of computer material (section 3). It sets territorial scope and significant links with domestic jurisdiction, rules for inchoate offences, proceedings, search warrants, extradition, application to Scotland and Northern Ireland, and interpretation.

It is the foundation of UK cybercrime law, used against hacking and malware, and is relevant to security testing and incident response.

Use it for UK hacking or unauthorised-access offences, assessing whether security research or access is authorised, or jurisdiction over cross-border computer crime.

Any person committing computer-misuse offences with a significant link to the UK.

IN FORCE, AS AMENDED. The supplied copy is the original 1990 text; later Acts added offences (for example sections 3ZA and 3A) and changed penalties, so check the current revised text. Read the official PDF on this page for the operative text.

Section 1 → section 3 → section 17 (interpretation) → sections 4–5 (jurisdiction).

Armenia's general data-protection law. It regulates how state and local bodies, organisations and natural persons process personal data, sets the main concepts (personal data, processing, transfer to third parties), processing principles and legal grounds, special-category and biometric data, data-subject rights of access, rectification and blocking, transfers to third parties and to other countries, and the powers of the authorised body.

It is the primary privacy law for Armenia and the basis for supervision by Armenia's Personal Data Protection Agency.

Use it for processing personal data in Armenia, responding to data-subject requests (with five-day response duties in some cases), or transferring data outside Armenia.

State and local bodies, organisations and natural persons processing personal data in Armenia.

CURRENT / IN FORCE. The supplied copy is taken from the legislation portal and does not state its consolidation date; check for later amendments. Read the official PDF on this page for the operative text.

Article 1 (scope) → Article 3 (concepts) → principles and legal grounds → data-subject rights → Article 26 (transfers).

Albania's new data-protection law, stated to be fully aligned with the GDPR and with Directive (EU) 2016/680 on law-enforcement processing. It applies to controllers and processors established in Albania and to non-established controllers offering goods or services to, or monitoring, people in Albania. It covers principles, legal bases, data-subject rights, controller and processor duties, transfers, supervision, sanctions and a part on processing by competent authorities for criminal-law purposes.

It replaces Law No. 9887 of 2008 and brings Albania's regime into line with EU law ahead of EU accession, relevant to businesses serving people in Albania.

Use it for GDPR-equivalent compliance in Albania, extraterritorial reach, law-enforcement processing, or the staged entry into force of specific articles.

Controllers and processors established in Albania, and non-established controllers targeting or monitoring people in Albania; competent authorities for criminal-law processing.

CURRENT / IN FORCE. The supplied English text does not state the Official Gazette publication date, so the two-year date for the delayed articles should be checked. Read the official PDF on this page for the operative text.

Articles 3–4 (scope) → definitions and principles → rights → controller duties → transfers → Article 101.

A dual-subject law. It gives legal effect to electronic writing, documents and signatures, regulates certification and electronic-service providers, e-commerce, electronic payments and bank cards, the .lb domain and intermediary liability. Its personal-data part (Articles 85 onward) sets principles for processing personal data, data-subject rights, declaration or licensing of processing with the Ministry of Economy and Trade, and penalties.

It is Lebanon's only general law containing personal-data protection rules.

Use it for electronic contracts and signatures in Lebanon, e-commerce, or any processing of personal data in Lebanon.

Persons and entities conducting electronic transactions or processing personal data in Lebanon.

CURRENT. Signed 10 October 2018; the law states it enters into force three months after publication in the Official Gazette. Read the official PDF on this page for the operative text.

Article 1 (definitions) → electronic writing and signature provisions → Part V personal data (Articles 85 onward) → penalties.

An Act to provide for the protection of personal privacy and information. It sets general privacy principles, establishes an Information Commissioner, regulates the collection, use and disclosure of personal information by public bodies and by private organisations, covers sensitive personal information and transfers outside Trinidad and Tobago, and amends the Freedom of Information Act.

It is Trinidad and Tobago's data-protection statute, but much of it depends on proclamation, so its operative reach must be checked.

Use it when handling personal information in Trinidad and Tobago, after confirming which Parts have been proclaimed.

Public bodies and private organisations in Trinidad and Tobago, to the extent the relevant Parts are proclaimed.

PARTLY IN FORCE. Commencement is by Proclamation; the supplied 2011 text does not show which Parts have been proclaimed. Confirm before relying on specific obligations. Read the official PDF on this page for the operative text.

Section 1 (commencement) → Section 2 (definitions) → Section 6 (privacy principles) → Information Commissioner → public bodies → private organisations.

Guyana's comprehensive data-protection statute. It regulates the processing of personal data by data controllers and processors, sets data-protection principles, special rules for sensitive personal data, data-subject rights including access, rectification, erasure and objection, security and breach obligations, transfers outside Guyana, and supervision and enforcement by a Data Protection Commissioner.

It gives Guyana a modern GDPR-style data-protection framework.

Use it for processing personal data in Guyana, data-subject requests, breaches and international transfers.

Data controllers and processors processing personal data in Guyana.

ENACTED. Published 16 August 2023; commencement depends on a ministerial order, which the supplied Gazette does not show. The PDF here is a compressed copy of the Gazette. Read the official PDF on this page for the operative text.

Section 1 (commencement) → definitions → principles → data-subject rights → controller and processor duties → transfers → Commissioner and enforcement.

Jamaica's comprehensive data-protection statute. It sets eight data-protection standards for data controllers, gives data subjects rights of access, to prevent processing, to object to direct marketing and in relation to automated decisions, requires controllers to register with the Information Commissioner and in some cases appoint a data protection officer, regulates transfers outside Jamaica and security breaches, and provides for enforcement notices, assessments and offences.

It is a GDPR-influenced regime applying to controllers in Jamaica and to some controllers outside Jamaica that process data there.

Use it for processing personal data in Jamaica, registration with the Information Commissioner, data-subject requests, breaches or direct marketing.

Data controllers established in Jamaica, or using equipment in Jamaica to process personal data.

CURRENT. Commencement was phased by order; check the Office of the Information Commissioner for the dates of individual provisions. The supplied PDF is a scanned copy. Read the official PDF on this page for the operative text.

Preliminary and definitions → data-protection standards → data-subject rights → registration → Information Commissioner and enforcement.

A combined data-protection and cybersecurity statute. It designates POTRAZ as Data Protection Authority and provides for a Cyber Security Centre; sets rules on data quality and processing of sensitive, genetic, biometric and health data; imposes controller and processor duties including security and breach notification; gives data subjects rights including protection against decisions based solely on automated processing; regulates transborder flows; and amends the Criminal Law Code to create cybercrime offences and the Criminal Procedure and Evidence Act for electronic evidence.

It is Zimbabwe's only general data-protection law and its main cybercrime statute.

Use it for processing personal data in Zimbabwe, cross-border transfers, breaches, automated decisions or cybercrime and electronic evidence.

Data controllers and processors, public and private, processing personal data in Zimbabwe.

CURRENT. The PDF is the ZimLII / Laws.Africa consolidated text as at 11 March 2022, not the original Gazette; later amendments or regulations may exist. Read the official PDF on this page for the operative text.

Part I (ss. 1–4) → Part II Authority → Part IV processing rules → Part V duties and breach notification → Part VI rights and automated decisions → Part VII transborder flows → Part XI cybercrime amendments.

A sectoral privacy regulation for service providers licensed by CITRA, including telecommunications and IT providers. It covers lawful collection and processing of users' personal data, consent, users' rights, data security, appointment of a data protection officer, disclosure to third parties, and notification of personal-data breaches to CITRA within 72 hours.

Kuwait has no general data-protection statute; this regulation is the main binding privacy framework for the telecom and ICT sector.

Use it for telecom or ICT providers in Kuwait handling customer data, designing consent, appointing a DPO or responding to a breach.

CITRA-regulated telecommunications and IT service providers in Kuwait; not a general law for all sectors.

ISSUED. The supplied version (V1.8) does not state its issue or effective date; check CITRA for the current version. Read the official PDF on this page for the operative text.

Scope and definitions → lawful processing and consent → users' rights → security and DPO → breach notification.

The Act sets the legal framework for electronic commerce: legal recognition of data messages, originators and addressees, secure information systems and methods, simple and secure electronic signatures, certification service providers, consumer protection in distance contracts, protection of personal (private) data messages, intellectual property in electronic form, and offences and penalties.

It is the main Iranian statute containing rules on protecting personal data in electronic form.

Use it for electronic contracts, e-signatures, online consumer contracts or handling personal data messages in Iran.

Electronic commerce and data-message transactions in Iran.

CURRENT. The supplied English translation does not show its approval date; it is listed here under 2004. Read the official PDF on this page for the operative text.

Article 1 (scope) → Article 2 (definitions) → electronic signature provisions → consumer protection → personal data protection → offences.

The Order has 65 sections and six schedules. It governs how organisations collect, use and disclose personal data: consent and deemed consent, purpose limitation, notification of purposes, access and correction, accuracy, protection, retention limits, transfer outside Brunei, data-breach assessment and notification, data portability, and a Do-Not-Call style framework for specified messages, with enforcement by AITI.

It is Brunei's first general personal-data law for the private sector, closely modelled on Singapore's PDPA approach.

Use it when an organisation in Brunei collects or uses personal data, transfers it abroad, suffers a data breach, or sends marketing messages.

Private-sector organisations collecting, using or disclosing personal data in Brunei Darussalam.

ENACTED. Commencement depends on a Gazette notification; the supplied Gazette does not itself show the commencement date. Confirm current commencement with AITI before relying on specific obligations. Read the official PDF on this page for the operative text.

Section 1 (commencement) → interpretation → consent obligations → protection and retention → transfer limitation → breach notification → enforcement.

The Act (published in Bengali) is Bangladesh's comprehensive data-protection law. It replaces the 2025 Personal Data Protection Ordinance and its 2026 amendment. It applies to citizens, residents and visitors in Bangladesh, to processing inside Bangladesh, and to processing outside Bangladesh connected with offering goods or services to, or monitoring, people in Bangladesh. It uses the terms data fiduciary (data trustee) and processor, defines categories such as financial data, and regulates lawful processing, data-principal rights, cross-border transfers and penalties.

It brings Bangladesh into the group of jurisdictions with an extraterritorial, GDPR-style data-protection statute, relevant to any business serving or monitoring people in Bangladesh.

Use it when processing personal data of people in Bangladesh, offering services into Bangladesh, transferring ID, biometric, genetic or criminal-record data abroad, or assessing penalties and the staged commencement of enforcement provisions.

Data fiduciaries and processors processing personal data in Bangladesh or about people in Bangladesh, including from abroad.

CURRENT. Deemed in force from 6 November 2025; complaints and penalty sections (ss. 23, 31–35) await Government notification. The supplied text is in Bengali. Read the official PDF on this page for the operative text.

Section 1 (scope and commencement) → Section 2 (definitions) → processing and rights provisions → cross-border transfer rules → penalties (ss. 31–35).

Law 25,326 is Argentina's foundational general personal-data protection statute. Its stated purpose is the comprehensive protection of personal data contained in files, records, databases and other technical means of processing, whether public or private databases intended to provide information. It protects the rights of individuals concerning their personal information and expressly connects the regime to the constitutional right of habeas data under Article 43 of the Argentine Constitution. (Infoleg)

The law covers both automated and non-automated processing and defines personal data broadly. It also defines sensitive data, including racial/ethnic origin, political opinions, religious/philosophical convictions, trade-union affiliation, and health or sexual-life information. (Infoleg)

The statute is structured around:

Although enacted in 2000, it remains the foundational Argentine privacy instrument. Its structure is important for understanding Argentina's approach to:

• purpose limitation

• data quality

Use this law when researching:

• whether collection of personal data is permissible

• sensitive-data processing

The law applies to the covered public and private databases and personal-data processing within its scope.

It also has dedicated rules concerning international transfers and database users/controllers.

CURRENT AND OPERATIVE.

The official Argentine legal database continues to maintain an updated version of Law 25,326 and its implementing framework. (Infoleg)

Article 1 → Article 2 → Article 4 → Articles 5–9 → Articles 13–16 → Articles 21–27 → Articles 31–32 → habeas data provisions.

The Norwegian Personal Data Act is fundamentally a GDPR-plus-national-law instrument.

Section 1 incorporates the EU GDPR into Norwegian law with the adaptations arising from the EEA Agreement. Therefore, most Norwegian privacy questions cannot be answered by reading the Norwegian Act alone: the GDPR and the Personal Data Act operate together. (Lovdata)

The Norwegian Act contains national provisions concerning:

It is the principal instrument for understanding how GDPR operates inside Norway.

Norway is in the EEA rather than the EU, so its legal relationship with GDPR is mediated through the EEA Agreement. Section 1 makes GDPR applicable as Norwegian law, while national provisions supplement it where permitted. (Lovdata)

• Applying GDPR to a Norwegian organisation

• determining Norwegian national derogations

• employment-data processing

The Act and GDPR cover processing by Norwegian establishments and certain non-EEA controllers/processors targeting or monitoring individuals in Norway. (Lovdata)

CURRENT AND IN FORCE.

Lovdata identifies entry into force as 20 July 2018 and provides the consolidated Act. The English translation itself is expressly described as unofficial; the Norwegian text is legally authoritative. (Lovdata)

Section 1 → Sections 2–4 → Sections 5–13 → Chapter 4 → Chapter 5 → GDPR Articles 5–6, 9, 22, 25, 32 and 35.

Bill C-27 was a proposed federal Canadian digital-regulation package comprising three major components:

1. Consumer Privacy Protection Act

2. Personal Information and Data Protection Tribunal Act

It is important because it represented a proposed transformation of Canada's federal privacy framework and an attempted introduction of federal AI legislation.

However:

It is not Canadian law.

• Researching Canadian privacy-law reform

• studying the proposed replacement for PIPEDA

• researching AIDA

No current statutory applicability.

NOT ENACTED.

The relevant current Canadian privacy law should instead be researched separately, particularly PIPEDA and applicable provincial legislation.

Bill structure → proposed CPPA → proposed Tribunal → AIDA → high-impact AI → risk mitigation → monitoring → enforcement.

The VCDPA regulates covered businesses that control/process personal data of Virginia consumers and establishes:

• consumer rights

• controller duties

Virginia was one of the first US state privacy statutes to combine a GDPR-influenced controller/processor model with specific consumer rights and a right to opt out of certain profiling.

The current §59.1-576 applies to persons that:

• conduct business in Virginia or target Virginia residents; and

• process at least 100,000 consumers' personal data; or

CURRENT: CODE VERSION CHECKED 20 SEPTEMBER 2026. (law.lis.virginia.gov)

§59.1-576 → §59.1-577 → §59.1-578 → §59.1-579 → §59.1-580 → profiling/sensitive-data provisions.

The CPA creates a comprehensive consumer privacy framework covering:

• access

• correction

Colorado's law is particularly notable for three features:

1. universal opt-out mechanisms;

2. risk-based data-protection assessments;

The CPA generally applies to controllers doing business in Colorado or targeting Colorado residents and satisfying statutory processing thresholds/exclusions.

The statute defines a consumer as a Colorado resident acting in an individual or household context. Employment data is generally outside this consumer definition. (Colorado Attorney General)

CURRENT: supplemented by CPA Rules.

§6-1-1303 → §6-1-1304 → §6-1-1306 → §6-1-1308 → profiling → §6-1-1311 → §6-1-1313.

The Act regulates:

• collection

• maintenance

It is one of the foundational federal information-privacy statutes in the United States and remains particularly important for government AI/data systems.

• A federal agency holds personal records

• determining whether information is part of a system of records

• accessing/amending federal records

Federal agencies and covered federal systems of records.

CURRENT FEDERAL LAW.

§552a(a) → (b) → (c) → (d) → (e) → (g) → (o)–(p).

Taiwan's PDPA governs:

• collection

• processing

The Act is broad and technology-neutral. It applies to both government and non-government agencies and regulates both automated and non-automated data files.

• Processing Taiwanese personal data

• sensitive-data processing

• employee data

Government and non-government agencies subject to the Act, with specific territorial rules.

CURRENT, but the 11 November 2025 amendment has provisions whose effective date remains to be determined. (PDPC Law)

Articles 1–3 → Article 6 → Articles 8–13 → Articles 19–21 → Article 27 → 2025 amendment/commencement status.

Federal Law No. 152-FZ is Russia's principal general personal-data statute.

It regulates:

• personal-data operators

Russian data protection differs from GDPR-style frameworks in several important areas, particularly:

• the concept of the personal-data operator

• data-localisation requirements

• Processing Russian citizens' personal data

• operating a website/service accessible to Russian users

• analysing localisation

Russian operators and specified foreign organisations processing Russian personal data within the law's territorial scope.

CURRENT / AMENDED.

The operative version is the latest consolidated text, not the original 2006 text.

Articles 5–12 → Article 18.1 → Article 19 → Article 22 → localisation/cross-border provisions.

Law No. 29733 is Peru's principal general personal-data protection statute. Its purpose is to guarantee the fundamental right to protection of personal data recognised under Article 2(6) of the Peruvian Constitution through appropriate processing of personal data. The law applies to public and private processing and establishes principles, lawful processing requirements, individual rights, database regulation, security obligations, international transfers and enforcement. The Peruvian government continues to identify it as the principal privacy statute, while Supreme Decree No. 016-2024-JUS provides its current implementing regulation. (Gob.pe)

The current regulatory framework should therefore be read as:

Law No. 29733 + Supreme Decree No. 016-2024-JUS

Peru's framework is particularly relevant because it combines traditional data-protection principles with provisions concerning automated decisions, security, proportionality and data-subject rights.

The law is also important for Latin-American comparative research because Peru's framework has developed alongside the GDPR-influenced modernization of data-protection laws throughout the region.

Use this law when researching:

• lawful processing of personal data

• consent

Public and private entities that process personal data within the territorial scope of Peruvian law.

CURRENT.

The current framework comprises both:

Law No. 29733

Articles 4–10 → Articles 18–25 → security → international transfers → Supreme Decree No. 016-2024-JUS.

Bahrain's PDPL provides a comprehensive framework for personal-data processing, including:

• definitions

• processing principles

It is Bahrain's principal comprehensive personal-data protection framework.

Its structure is significant because it addresses both:

substantive privacy

• Assessing Bahrain personal-data processing

• sensitive-data processing

• controller/processor governance

The law applies to covered automated and non-automated processing forming part of or intended to form part of a filing system.

The exact territorial/application rules should be assessed against the statutory scope and applicable implementing decisions rather than assuming every Bahrain-related data flow is automatically covered.

CURRENT AND OPERATIVE.

The Bahrain Government continues to publish the law as the governing Personal Data Protection Law. The official English version itself notes that the Arabic text prevails in case of discrepancy (Bahrain)

Article 1 → processing principles → controller/processor obligations → security → Data Protection Guardian/register → Article 12 → Article 13 → rights/enforcement.

The law governs personal data processed:

• electronically

• where collected/extracted for electronic processing

It establishes a relatively concise but broad national privacy framework covering:

• consent

• lawful purposes

Covered electronic and mixed processing within the law's scope, including website operators and organisations processing personal information.

CURRENT / IN APPLICATION. (Al Meezan)

Articles 2–6 → Articles 8–13 → Article 16 → international transfer provisions → exemptions/enforcement.

The CPRA strengthened California's consumer privacy framework by adding or expanding:

• consumer rights

• sensitive personal information controls

The CPRA created the California Privacy Protection Agency (CPPA) and transferred major regulatory/enforcement responsibilities to that agency (California Privacy Protection Agency)

The modern California framework therefore has three layers:

CCPA 2018

Coverage depends on the CCPA's statutory thresholds, definitions and exclusions.

The CPPA's current materials describe thresholds based, among other things, on:

• qualifying annual revenue

CURRENT: CCPA AS AMENDED BY CPRA AND CURRENT CPPA REGULATIONS.

CCPA core rights → CPRA amendments → sensitive personal information → sale/sharing → ADMT → risk assessment → cybersecurity audit → CPPA enforcement.

Israel's Protection of Privacy Law is the principal national law governing privacy and databases.

It regulates:

• personal information

Amendment No. 13 was a major structural reform.

The Privacy Protection Authority describes it as expanding the definition of personal information, establishing stronger administrative enforcement powers, introducing significant administrative fines and creating new DPO and database-management obligations (Gov.il)

• Database governance

• information security

• biometric processing

Public and private organisations operating databases/processing personal information within the Israeli framework.

CURRENT: AS AMENDED BY AMENDMENT NO. 13.

The current Knesset record marks the law as valid, with Amendment 13 as the latest direct amendment (Knesset)

Definitions → database controller/holder → processing → security → DPO → registration/notification → enforcement → Amendment 13.

The PDPO is Hong Kong's principal personal-data privacy law and applies across the public/private data-user environment.

The PCPD characterises it as a principle-based regime centred on six Data Protection Principles in Schedule 1 (PCPD)

The six principles cover:

Its architecture is distinctly principle-based rather than being a long list of prescriptive processing bases.

The six DPPs are designed to govern the personal-data lifecycle from collection through destruction (PCPD)

The Ordinance also operates with:

• Employee data

• customer data

• biometrics

The Ordinance applies to personal data and covered data users in Hong Kong.

It operates alongside sectoral rules and PCPD codes/guidance.

CURRENT.

The Ordinance has undergone substantial amendments, including the 2012 privacy amendments and later anti-doxxing reforms.

Schedule 1 DPP1–DPP6 → security/DPP4 → access/correction → direct marketing → Section 33 status → enforcement.

HIPAA regulates Protected Health Information (PHI) and, under the Security Rule, electronic PHI (ePHI).

Not every health-data company is covered.

HIPAA applies only to covered entities and their business associates.

HHS continues to identify the existing Security Rule as the currently effective rule, while proposed strengthening amendments remain a separate regulatory proposal. (HHS.gov)

Privacy Rule → Security Rule → Business Associate Rule/BAA → Breach Notification Rule → 45 CFR §§164.308, 310, 312, 400–414.

The PDP Law regulates:

• personal-data principles

• categories of personal data

It is Indonesia's first comprehensive, dedicated national personal-data statute and replaces the previous fragmented framework.

It is especially important for digital businesses, technology companies, financial services, health systems and organisations operating large-scale personal-data ecosystems.

Definitions/data categories → data-subject rights → lawful processing → controller/processor duties → impact assessment → security/breach → transfers → sanctions.

The UK's data-protection framework is composed principally of:

1. UK GDPR

2. Data Protection Act 2018

The UK framework is particularly important for AI because of:

• Article 22 automated decisionmaking

• transparency

The UK GDPR/DPA framework applies to UK-established controllers/processors and has specified extraterritorial reach for certain third-country processing. The DUAA explanatory material confirms its data-protection amendments extend across the UK, subject to specified exceptions. (Legislation.gov.uk)

CURRENT: AS AMENDED BY DUAA 2025.

UK GDPR Articles 5–9 → Articles 12–22 → Article 22 → Article 25 → Article 32 → Articles 33–35 → Articles 44–49 → DPA 2018 Parts 2–4 → DUAA 2025 amendments/commencement.

The Act regulates:

• processing

• controllers/processors

Public/private controllers and processors within the Act's territorial scope.

CURRENT AND IN FORCE.

Section 25 → rights → controller/processor → Section 31 DPIA → security → Section 43 breach → transfer provisions → 2021 Regulations.

The NDPA establishes:

• lawful processing

• data-subject rights

Controllers/processors subject to the NDPA's territorial and processing conditions.

CURRENT.

The NDPC continues to list the NDPA as its principal regulatory source. (Nigeria Data Protection Commission)

Sections 24–30 → Sections 34–38 → Section 37 → Sections 39–40 → Sections 41–43 → 2025 GAID.

The Act regulates personal information processing by:

• government

• private-sector organisations

Government and private-sector organisations within the statutory scope.

CURRENT AND OPERATIVE.

The NPC continues to publish the Act and implementing framework as the principal Philippine privacy regime. (National Privacy Commission)

Sections 11–13 → Sections 16–17 → Section 20 → NPC IRR → automated decisionmaking guidance → breach/security guidance → penalties.

The amendments materially change:

• terminology

• controller/processor accountability

CURRENT: FULLY COMMENCED BY 1 JUNE 2025. (PDP)

Act 709 → 2024 amendments → biometric data → Section 12A DPO → Section 12B breach → Section 43A portability → current transfer regime.

The Thai PDPA governs:

• collection

• use

The Act has territorial reach, including specified processing by organisations outside Thailand when they offer goods/services to Thai residents or monitor behaviour in Thailand.

CURRENT.

Sections 19–26 → Sections 28–29 → Sections 30–36 → Sections 37–41 → enforcement.

The federal PDPL governs:

• personal-data processing

• sensitive personal data

Covered processing inside the UAE and specified external processing connected with UAE activities, subject to statutory exclusions and sector-specific regimes.

CURRENT: IN FORCE SINCE 2 JANUARY 2022. (UAE Legislation)

Articles 1, 5–6 → Article 11 → Article 18 → Article 20 → Article 21 → Articles 22–23.

The Act governs personal information through:

• 13 Information Privacy Principles

• access/correction rights

The Act applies broadly to New Zealand agencies, including public/private organisations, with specific rules for overseas agencies.

CURRENT. Check the consolidation date of the text you rely on.

The official site expressly states that some amendments from 2026 have not yet been incorporated into the 1 May 2026 version. (Legislation New Zealand)

IPP1–13 → Sections 39–67 → Sections 112–118 → Part 7 information sharing/matching → Sections 192–200.

POPIA regulates processing by:

• public bodies

• private bodies

POPIA is particularly useful for AI research because it has a dedicated provision concerning automated decisionmaking.

Public/private bodies processing personal information subject to the Act.

CURRENT / FULLY IN FORCE.

Conditions 1–8 → Section 19 → Section 22 → Section 69 → Section 71 → Section 72.

KVKK regulates:

• personal-data processing

• general principles

The 2024 amendment fundamentally changed two areas:

1. Article 6: special-category personal data

2. Article 9: international transfers

CURRENT: 2024 AMENDED FRAMEWORK.

The pre-2024 version of Articles 6 and 9 is no longer the current text. The authority confirms the 2024 amendment and subsequent transfer regulations/standard contracts. (KVKK)

Articles 4–6 → Article 9 → Articles 10–12 → Article 18 → 2024 transfer regulation/standard contracts.

The revised FADP regulates:

• personal data of natural persons

• processing

The revised FADP is particularly relevant to AI because Switzerland expressly regulates automated individual decisions and the FDPIC has expressly stated that the FADP applies directly to AI-supported processing. (edoeb.admin.ch)

Private controllers and processors and federal bodies within the FADP's territorial scope.

Foreign organisations may also fall within the FADP where their processing has effects in Switzerland.

CURRENT REVISED FADP: IN FORCE SINCE 1 SEPTEMBER 2023.

The 1992 FADP has been repealed and replaced.

Articles 5–7 → Article 12 → Articles 19–22 → Article 24 → Articles 25–32 → Data Protection Ordinance.

The APPI is Japan's principal comprehensive personal-information law. It regulates the handling of personal information by business operators and establishes rules covering purpose specification, use, acquisition, security, third-party provision, overseas transfers, rights of individuals and enforcement.

The current framework also contains Japan-specific rules for information that has been anonymised, pseudonymised, or otherwise handled differently from ordinary personal data.

Applies principally to entities handling personal information under the APPI framework, subject to statutory exclusions and sector-specific rules.

CURRENT

Articles 15–17 → Articles 19–23 → Articles 25–28 → PPC security and international-transfer guidelines.

The Act implements major reforms across:

• privacy protections

• children's privacy

CURRENT AMENDING LEGISLATION: PHASED COMMENCEMENT

Schedule 1 → Parts 4–7 → Part 15: Automated Decisions and Privacy Policies → Schedule 2: Serious Invasions of Privacy → Schedule 3: Doxxing.

PIPEDA establishes Canada's federal private-sector framework for handling personal information in commercial activities.

Its core privacy framework incorporates the 10 principles in Schedule 1, including:

• accountability

PIPEDA generally applies to:

• private-sector organisations engaged in commercial activities

• federally regulated businesses

CURRENT

Section 3 → Section 4 → Schedule 1 → Sections 5–10 → Section 10.1 → Sections 11–18.

The PIPL is China's comprehensive personal-information protection statute.

Its structure covers:

• general principles

CURRENT: effective 1 November 2021

Articles 3–9 → Articles 13–24 → Articles 28–31 → Articles 37–43 → Articles 51–59 → Articles 66 onward.

The California Consumer Privacy Act of 2018 (CCPA) is a comprehensive privacy law that grants California consumers rights over their personal information and imposes obligations on businesses that collect, use, disclose, or sell personal data. The CCPA provides consumers with rights including access, deletion, correction, opt-out of sale or sharing of personal information, and protection against discrimination for exercising privacy rights. The law establishes transparency, notice, accountability, and data governance requirements for covered businesses and is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.

Coverage is threshold-based and includes statutory exclusions.

CURRENT: 2026 framework

§§1798.100, 105, 106, 110, 115, 120, 121, 140 → current CCPA Regulations → Risk Assessment rules → Cybersecurity Audit rules → ADMT rules.

The PDPA provides Singapore's baseline general personal-data protection framework.

It regulates:

• collection

CURRENT

Sections 11–18 → Sections 21–26 → Sections 26A–26D → enforcement provisions.

A short information page on Uzbekistan's Unified Interactive Government Services Portal. It defines artificial intelligence, AI technologies, AI systems, ethical guidelines and participants in AI; explains that the portal's "AI Assistant" chatbot gives advisory answers only; lists the principles participants must follow; and sets out the rights and obligations of AI users, by reference to the ethical rules approved by Order No. 3787.

It is a concise official statement of Uzbekistan's AI ethics principles and a clear example of a government disclosing that AI answers are advisory, not official decisions.

Use it for Uzbekistan's AI ethics principles, user rights when AI is used in public services, or wording on AI-generated answers being advisory.

Individuals and legal entities developing, implementing or using AI in Uzbekistan, and users of the government services portal.

Definitions → principles → user rights → user obligations.

The strategy builds on Egypt's first National AI Strategy launched in May 2021. It sets a mission to create an AI industry supported by governance, talent and infrastructure, benchmarks other countries, analyses Egypt's position (including a SWOT analysis) and organises action under six pillars: Governance, Technology, Data, ICT and AI Infrastructure, Ecosystem, and Talent. It also covers an implementation roadmap, capacity assessment and expected results.

It is Egypt's top-level AI policy document and signals the direction of future AI regulation, data governance and public-sector AI adoption in Egypt.

Use it to understand Egypt's AI policy priorities, planned governance and regulatory steps, data-governance plans, or the context for AI investment and public-sector AI projects in Egypt.

Government bodies, the AI ecosystem and investors in Egypt; a policy document, not a source of legal obligations.

CURRENT. Strategy period 2025-2030; it is policy, not law. Read the official PDF on this page for the operative text.

Strategy overview → Governance pillar → Data pillar → Implementation roadmap.

Iran's national AI strategy. It sets a vision and goals for AI, establishes governance through a national AI organisation and steering structures, and sets priorities for research, talent, data and computing infrastructure, private-sector and industrial use, international cooperation and AI regulation, framed around Iranian-Islamic values. It refers to security and privacy as principles but does not create enforceable data-protection rules.

It is the foundational statement of Iranian AI policy and governance structures.

Use it for Iran's AI policy direction, institutional responsibility for AI and planned AI regulation.

Iranian state bodies and the AI ecosystem; a policy document, not binding legislation on private parties.

CURRENT. Approved by the Supreme Council of the Cultural Revolution and notified for implementation. Read the official PDF on this page for the operative text.

Introduction and values → vision and goals → governance structure → strategies and priorities.

This document operationalises Canada's voluntary approach to generative-AI governance for critical infrastructure. It recognises that AI may enter infrastructure intentionally or through existing IT and operational-technology products, where failure may affect public safety, essential services, communications, transportation, energy, financial systems, digital infrastructure and national resilience. It uses the NIST-style GOVERN, MAP, MEASURE and MANAGE structure and is broad and non-prescriptive rather than a mandatory checklist.

It connects AI governance with the heightened safety, security and resilience consequences of critical-infrastructure environments.

Use it for critical-infrastructure AI governance, organisational accountability, use-case and dependency mapping, risk measurement, continuous mitigation, incident response, operational technology, supply-chain controls and resilience.

Canadian critical-infrastructure owners, operators and related stakeholders, including suppliers of AI-enabled products or services into critical-infrastructure environments.

CURRENT VOLUNTARY GUIDANCE.

Introduction & Purpose → AI Risk Governance Framework → GOVERN → MAP → MEASURE → MANAGE → AI Incident/Risk Controls → Critical-Infrastructure Application.

AIDA was Part 3 of Bill C-27, a proposed federal package comprising the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act. It proposed regulation of certain private-sector AI systems in interprovincial and international trade, focusing on high-impact systems, risk assessment, mitigation, monitoring, recordkeeping and reporting. Committee consideration was not completed before the 44th Parliament ended on 6 January 2025.

It remains important legislative history for comparative research, but it never became operative Canadian law and must not be presented as a current compliance requirement.

Use it for historical research on Canada's proposed high-impact-AI regime, Bill C-27, combined privacy and AI reform, risk mitigation, monitoring, audits and proposed enforcement.

NO CURRENT STATUTORY APPLICABILITY. AIDA was proposed but not enacted.

HISTORICAL: PROPOSED BILL, NOT ENACTED. AIDA is not operative Canadian law.

Part 3 → Sections 1–5 → Section 7 → Section 8 → Section 9 → Sections 10–12 → Sections 13–19 → Sections 29–40.

The strategy is intended to position the UAE as a global AI leader and integrate AI into government services, infrastructure and priority economic sectors.

The official strategy materials identify objectives including:

• establishing the UAE as an AI destination

It is directed primarily toward national strategy and government/sectoral implementation, not direct statutory compliance by every private organisation.

CURRENT NATIONAL STRATEGY / POLICY

Strategic objectives → priority sectors → AI infrastructure/data → talent/research → governance → implementation initiatives.

Japan's AI Act is a promotion-plus-governance statute. It promotes AI research, development and utilisation while establishing national strategy and government-wide coordination. It emphasises innovation, stakeholder responsibilities, transparency, fairness, safety and international cooperation rather than the EU AI Act's risk tiers, conformity regime and penalty structure. It establishes an AI Strategic Headquarters chaired by the Prime Minister and requires an AI Basic Plan.

It is Japan's current national AI statute and institutional foundation, not merely voluntary guidance.

Use it for Japan's national AI policy, stakeholder responsibilities, AI Basic Plan, R&D promotion, government coordination, safety, trust and international cooperation.

Responsibilities and policy mechanisms for Japanese government institutions and AI-related stakeholders, including specified foreign activity targeting Japanese businesses or citizens.

CURRENT: FULLY IN FORCE SINCE 1 SEPTEMBER 2025.

Article 1 → Article 2 → Articles 3–10 → Articles 11–17 → Article 18 → Articles 19–28 → AI Basic Plan → Government Guidelines.