Data Protection Monitor
Global Privacy & Data Protection Intelligence
170 jurisdictions · 15,384 findings · 6,331 sources · latest research check 4 Nov 2026
Coverage & Data·Benchmarks (a-i.gi)·Signal (/app/ →)
Jurisdictions (170) Modules Global Map Compare Calendar Dashboard Reports Roundup Methodology Hero Specimen Plans & Licensing
PRIVACY & DATA GOVERNANCE INTELLIGENCE · Updated 4 Nov 2026 · D1–D10

Primary-source data protection law across 170 jurisdictions

Compare supervisory authorities, lawful bases, data subject rights, controller/processor duties, cross-border transfer mechanisms, breach notification SLAs, AI/biometric governance, and enforcement penalties across 10 standing modules — backed by 15,384 claim-traced findings and 6,331 cited sources.

Select a DPO / Privacy Counsel workflow to inspect live specimen Interactive Specimen →
Explore 170 jurisdictions → Compare jurisdictions Plans & licensing
🇬🇧 United Kingdom · 01 Regulator & Framework (Open on Free Tier)
CLM-UK-d4e63f54
Source Authority: T1/4 Primary Legislation Confidence: Confirmed Legal Force: In Force · Binding Expert Reviewed: Ramparts (24 Oct 2026)

"The Information Commissioner's Office (ICO) maintains a public register of data protection fee payers under the Data Protection (Charges and Information) Regulations 2018 (SI 2018/480), enacted under section 137 of the Data Protection Act 2018; every non-exempt controller must pay an annual tiered charge (£40 Tier 1, £60 Tier 2, £2,900 Tier 3) and renew registration annually."

Statutory Instrument SI 2018/480 · DPA 2018 s.137 & UK GDPR ↗
Supervisory Authority Information Commissioner's Office (ico.org.uk)
Entitlement Scope Module D1 Open Across All 170 Jurisdictions
Verification Stamp legislation.gov.uk ↗ · Verified 24 Oct 2026
Open UK Dossier →
PRIMARY SOURCE PROVENANCE (OPEN EVIDENCE DRAWER)
[CLM-UK-d4e63f54 · Tier 1 Primary Source] Data Protection (Charges and Information) Regulations 2018 (SI 2018/480), reg. 2–3 & Schedule; ICO Register of Fee Payers (https://ico.org.uk/ESDWebPages/Entry/Z1842228). Verified against Data (Use and Access) Act 2025 transitional governance provisions.
170
Published Jurisdictions
105 countries · 61 sub-nat · 4 blocs
10
Standing Modules
D1 & D3 open free everywhere
15,384
Sourced Findings
Verbatim quotes & claim IDs
6,331
Cited Sources
Statutes, DPAs & EDPB/ICO
3
Expert-Reviewed
EEA, Gibraltar & UK (Ramparts)
4 Nov 2026
Latest Research Check
Roundup: 2026-11-01
High-Value DPO Utility · Instant Multi-Jurisdiction Triage

Cross-border transfer, breach notification SLA & penalty comparator

Compare operational compliance thresholds across key reference jurisdictions before drilling into the full 10-module dossier.

Compare All 170 Jurisdictions →
Jurisdiction Primary Statute & DPA (D1) Breach Notification SLA (D6) Cross-Border Transfer Mechanism (D5) Statutory Fine Ceiling (D10) Review Status
🇬🇮 Gibraltar 100% Free Exemplar Data Protection Act 2004 & Gibraltar GDPR · GRA 72 hours to GRA; without undue delay to data subjects if high risk UK Adequacy bridge + Gibraltar IDTA / Standard Contractual Clauses £17.5m or 4% global annual turnover Expert Reviewed (Ramparts†) →
🇬🇧 United Kingdom Free Reference UK GDPR, DPA 2018 & DUAA 2025 · ICO 72 hours to ICO (Art. 33 UK GDPR) UK Adequacy Regs + UK IDTA / EU SCC Addendum £17.5m or 4% global annual turnover Expert Reviewed (Ramparts†) →
🇪🇺 European Economic Area Free Reference Regulation (EU) 2016/679 (GDPR) · EDPB & 30 NCAs 72 hours to lead/competent supervisory authority (Art. 33) Art. 45 Adequacy, 2021 EU SCCs + TIA, BCRs (Art. 46) €20m or 4% global annual turnover Expert Reviewed (Ramparts†) →
🇺🇸 United States (Federal / CA) Free Reference FTC Act s.5, COPPA, GLBA, HIPAA + CCPA/CPRA (CPPA) & 20 state laws State-specific (CA: without unreasonable delay; SEC 4 business days; CIRCIA 72h) No general outbound restriction; DOJ Bulk Sensitive Data Rule (EO 14117) $2,500–$7,500 per violation (CPPA) / FTC consent decrees AI-Monitored · Cited →
🇨🇳 China Free Reference PIPL (2021), Data Security Law & Cybersecurity Law · CAC Immediate remedial action & notification to CAC (critical: 1–4 hours) CAC Security Assessment, Standard Contract (SCCs) or Certification + मार्च 2024 volume exemptions RMB 50m or 5% prior-year annual turnover + personal liability AI-Monitored · Cited →
10-Module Standing Schema

Every jurisdiction structured across 10 comparable modules

Modules 01 Regulator & Framework and 03 Data Subject Rights are open free across all 170 jurisdictions on the Explore tier so practitioners can verify statutory baselines anywhere.

Inspect module in:
Group A · Core Legal Foundation

Perimeter, Lawful Basis & Rights

  • 01 Regulator & Framework Open on All 170 JIDs — Primary statutes, supervisory authority powers, territorial scope, and registration/fee duties.
  • 02 Lawful Processing & Special Data — Consent standards, legitimate interest assessments, biometric/health/genetic data rules.
  • 03 Data Subject Rights Open on All 170 JIDs — DSAR response SLAs, erasure, portability, and automated decision objection rights.
Group B · Operational Compliance

Governance, Transfers & Sectoral Rules

  • 04 Controller & Processor Duties — DPO appointment thresholds, RoPA, DPIAs, and Art. 28 processor contract clauses.
  • 05 Cross-Border Transfers & Adequacy — Adequacy lists, SCCs/IDTAs, Transfer Impact Assessments, and data localisation mandates.
  • 06 Sectoral Watch & Breach Notification — Mandatory breach notification windows (24h/72h) and financial/telecom/health overlays.
Group C · Commercial, AI & Enforcement

AdTech, AI Privacy, Children & Fines

  • 07 AdTech & Commercial Privacy — ePrivacy/cookie consent, direct marketing opt-ins, and data broker registries (e.g. CA Delete Act).
  • 08 Algorithmic, Biometric & AI Privacy — Automated profiling, AI model training lawful bases, and facial recognition bans.
  • 09 Children & Vulnerable Groups — Age-of-consent thresholds (13–16), age-assurance mandates, and children's design codes.
  • 10 Enforcement & Redress — Administrative fine ceilings, criminal offences, and collective/class action standing.
Regulatory Roundup

Recent supervisory actions & statutory changes (Week of 1 November 2026)

Recent supervisory decisions, cross-border transfer rulings, and statutory updates from our weekly roundup.

Open Full Roundup Archive →
Coverage & Verification Summary

Coverage ledger & open reference dossiers

Verified coverage across all monitored jurisdictions, statutory sources, and open reference dossiers.

Jurisdictions tracked & published
170 of 170

Every published dossier follows the same standing module grammar.

Standing modules per record
10

Fixed cross-jurisdiction schema so any two markets can be compared module for module.

Sourced regulatory findings
15,384

Each finding carries a source authority tier (T1–T4) and confidence grade.

Cited primary & secondary sources
6,331

Direct links to statutory instruments, supervisory guidance, and enforcement orders.

Verification & review status
3 expert-reviewed · 170 source-tier verified

Automated source-tier & confidence-cap gate on every build; human counsel sign-off badged separately.

Free-tier open records
7 full dossiers

Unrestricted access to EEA, US, CA, CN, NG, UK, and GI — no registration required.

Latest research check
4 Nov 2026

Date of the most recent source collection and verification pass across the corpus.

Plans & Licensing

Simple, predictable licensing for privacy teams & law firms

Full Union Licensing Page →
1. Explore (Free Tier)
£0
Open baseline & verification
  • Decision Layer + Executive Brief across all 170 jurisdictions
  • 2 Core Modules Open Everywhere: 01 Regulator & Framework & 03 Data Subject Rights
  • 100% Open Exemplars: Gibraltar (GI) + 6 full reference dossiers (UK, EEA, US, CA, CN, NG)
  • Open Evidence Drawer on all visible claims
  • 3 Full-Record Passes/mo + 1 trial report/mo with work email
Open Gibraltar Exemplar
2. Pro (Individual DPO / Counsel)
Partner & early-access terms — enquire →
Single-Monitor Subscription (1–3 monitors) · Portfolio Subscription (at 4× single-monitor rate)
  • All 10 standing modules (D1–D10) across all 170 jurisdictions (including US states & Canadian provinces)
  • Full Cross-Border Transfer (D5), Breach SLA (D6), AdTech (D7) & AI Privacy (D8) records
  • Roundup alerts & 5 PDF dossier exports/mo
  • Portfolio Subscription (4x single-monitor rate): Includes Data Protection + AI Governance + Payments + Crypto + Sentinel + Advennt
Start Pro or All-Access Pass
3. Firm (Privacy Practice & Team)
Partner & early-access terms — enquire →
Single-Monitor Subscription (up to 8 seats) · Portfolio Subscription (at 4× single-monitor rate)
  • Up to 8 named seats for law firms, DPO-as-a-Service providers & global privacy teams
  • Client Advisory Rights: Attach multi-country transfer impact & breach SLA tables in client deliverables
  • Bulk CSV/XLSX comparator exports & priority review escalation
Select Firm Licence
+1. Enterprise Data & AI
Partner & early-access terms — enquire →
Scope 1 — Internal Systems & RAG · Scope 2 — External Product, OEM & AI Grounding
  • Scope 1 — Internal Systems & RAG: Structured JSON feeds of all 15,384 privacy findings for internal GRC/privacy automation
  • Scope 2 — External Product, OEM & AI Grounding: Customer-facing privacy SaaS & AI co-pilot grounding rights
Request Enterprise Feed
Research last banked: 2026-11-01 · This site last published: 2026-11-04
15,384 claims across 6,331 primary & official sources