Data Protection Monitor · Cross-Jurisdiction Domain Hub
Controller & processor duties
Jurisdiction Readings (167 markets)
29 Confirmed
118 Probable
20 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Amber | The Malabo Convention has been directly criticised in reviewed materials for lacking important implementation detail and for not providing mechanisms to support enforcement of controller/processor… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | The clearest, currently in-force controller duty in Alabama is breach notification under the 2018 Act (45-day consumer/AG notice, 10-day third-party-agent notice). Sector-specific… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Amber | Alaska imposes two concrete controller-side duties: (1) breach notification and secure disposal of records containing personal information under APIPA, AS 45.48; and (2) an… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | PIPA imposes accountability for personal information transferred to third parties for processing, and a mandatory breach-notification duty to the OIPC where a real risk of significant harm (RROSH)… | Profile →Brief |
| Algeria (DZ) | Africa | Amber | Algeria's regime is expected to impose baseline accountability and security obligations on controllers, but specific DPIA triggers, DPO appointment thresholds, ROPA obligations, joint-controller… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No Antigua-specific source located on DPIA triggers, DPO thresholds, ROPA exemptions, joint-controller rules, security-of-processing measures, breach notification timelines/thresholds, or… | Profile →Brief |
| Argentina (AR) | Americas | Amber | The current Act imposes no DPIA or DPO obligation, though AAIP soft-law (a non-binding DPIA Guide and Resolución 47/2018 recommended security measures) fills part of the gap. There is no general… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Arizona imposes concrete breach-notification duties (A.R.S. §18-552) but no general accountability, DPIA, DPO, ROPA, or retention-limit obligations. Security-of-processing is addressed only… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Amber | PIPA imposes reasonable security, breach-notification, and disposal duties on controllers, but Arkansas has no accountability/DPIA principle, DPO-appointment threshold, ROPA obligation, or… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Amber | No bloc-level DPIA triggers, DPO thresholds, ROPA requirements, or retention/disposal rules exist. The Global CBPR/PRP certification system requires organisations' data-protection policies and… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | The Privacy Act does not use a controller/processor construct, does not mandate DPOs, and has no formal DPIA or ROPA filing regime; instead accountability is achieved via the APP 1 'open and… | Profile →Brief |
| Austria (AT) | Europe | Amber | GDPR Articles 5, 25, 28, 30, 32-35 and 37-39 apply directly to Austrian controllers/processors without a general national derogation elevating or lowering thresholds; Austria has not enacted a… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Amber | Secondary guidance confirms the Data Protection Ordinance, 2025 applies to data breach notification in Bangladesh, enforced by the NDGIA. DPIA triggers, DPO appointment thresholds, ROPA requirements… | Profile →Brief |
| Belgium (BE) | Europe | Green | Belgian controllers/processors are subject to the full GDPR accountability toolkit: DPIA (with a Belgian DPA-published mandatory-DPIA list), DPO appointment and registration, ROPA, breach… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced provisions on DPIA triggers, DPO thresholds, ROPA exemptions, joint-controller arrangements, security-measure standards, breach-notification deadlines, or retention/disposal duties under… | Profile →Brief |
| Brazil (BR) | Americas | Amber | Controllers must appoint a DPO (Resolution CD/ANPD 18/2024) unless qualifying as a small-scale controller; ROPA obligations apply with a simplified template for small agents; DPIAs are… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | PIPA imposes an accountability principle requiring organizations to designate an individual accountable for compliance, and requires reasonable security safeguards for personal information in an… | Profile →Brief |
| Bulgaria (BG) | Europe | Green | Bulgaria's controller/processor duties are anchored in GDPR Articles 5, 24-43 and detailed nationally in the Act's DPO-notification (Art. 25b), processor-ROPA (Art. 62(2)), and… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | The draft LPDP would impose GDPR-familiar controller/processor duties — DPIAs, DPO appointment (mandatory and universal, unlike GDPR's risk-based trigger), records of processing, security measures… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | The draft law outlines general accountability principles (purpose limitation, retention limitation, transparency, confidentiality, accessibility, and appropriate technical and organizational security… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | PIPEDA's mandatory breach-reporting regime (in force since 1 November 2018) requires notice to the OPC and affected individuals where a breach poses a 'real risk of significant harm,' plus a… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Green | Accountability (Principle 4.1) requires organizations to designate an individual accountable for compliance and remain responsible for information transferred to third-party processors. Security… | Profile →Brief |
| Chile (CL) | Americas | Amber | Ley 21.719 introduces an accountability principle, DPIA-equivalent impact assessments for high-risk processing, a voluntary-but-conditionally-mandatory DPO (delegado de protección de datos)… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | PIPL Chapter V imposes DPIA obligations (Arts 55–56) triggered by sensitive-data processing, automated decision-making, entrusting/sharing/public disclosure of PI, cross-border transfers, and other… | Profile →Brief |
| Colombia (CO) | Americas | Green | Colombia's accountability regime (Decree 1377, Arts 13/23/26/27) requires proportionate compliance programs, a responsible person/group in lieu of a formally titled DPO, RNBD registration functioning… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Amber | Controllers must conduct and document data protection assessments (DPAs) for heightened-risk processing, exercise a duty of care over security proportionate to the volume/scope/nature of data, and… | Profile →Brief |
| Comoros (KM) | Africa | Red | No DPIA, DPO, ROPA, processor-contract, security-of-processing, breach-notification or retention regime was located for the Union of the Comoros. No evidence of a sector-specific breach-notification… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No statutory DPIA trigger list, DPO appointment threshold, ROPA exemption test, processor-contract mandatory-terms rule, security-measures standard, breach-notification duty, or retention/disposal… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No accountability/DPIA, DPO, ROPA, joint-controller, security, breach-notification, or retention/disposal regime is codified for controllers or processors operating in or from Comoros/Mohéli. | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | CTDPA requires Data Protection Assessments (DPAs)/Impact Assessments before processing that presents a heightened risk of harm (targeted advertising, sale, risky profiling, sensitive-data… | Profile →Brief |
| Costa Rica (CR) | Americas | Amber | Controllers and processors must maintain adequate security safeguards and, following the 2016 reform, are subject to a more precisely delimited registration/accountability duty under Article 21 of… | Profile →Brief |
| Croatia (HR) | Europe | Green | Controller/processor duties follow GDPR Chapter IV directly. Enforcement history shows active AZOP supervision of Article 32 security measures and Article 5(1)(e) storage limitation (Croatian… | Profile →Brief |
| Curaçao (CW) | Caribbean | Amber | Professional legal-research sources are explicit that the Curaçao Ordinance does not set out DPO-appointment requirements or data-breach-notification requirements. Accountability/DPIA, ROPA… | Profile →Brief |
| Cyprus (CY) | Europe | Green | Accountability, DPIA, DPO, ROPA, security and breach-notification duties follow GDPR Arts 24-39. Cyprus's national DPIA exemption list (Art 35(5)) has been submitted to and reviewed by the EDPB.… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | GDPR's accountability, DPIA, DPO, security, breach-notification and retention obligations apply directly, supplemented by Act No. 110/2019 Coll.'s Section 10 'legislative DPIA' mechanism (effective 1… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | Controllers must apply data minimization, security, and DPIA obligations for high-risk processing. A long-standing separate breach-notification statute (since 2018) requires consumer notice and… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Denmark enforces GDPR's accountability, security, and breach-notification duties vigorously: Datatilsynet has pursued controllers for inadequate processor supervision (Capio), inadequate technical… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Amber | Outside of breach notification and an implicit security-requirements provision introduced by the 2020 amendment, the District imposes no DPIA, DPO, ROPA, joint-controller, or general… | Profile →Brief |
| Dominican Republic (DO) | Americas | Amber | Law 172-13 establishes a general security-of-processing principle for controllers but does not impose a breach-notification obligation to data subjects or authorities; breach notice is… | Profile →Brief |
| Ecuador (EC) | Americas | Green | EUDPR Chapter IV imposes accountability (Art 4(2)), DPIA obligations (Art 39), mandatory DPO designation with EDPS-consent-gated dismissal (Art 44, reinforced by EDPS Decision 01/2026), ROPA (Art… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Controllers/processors must appoint an accredited DPO under the Executive Regulations, though the PDPL itself sets no DPO qualification standard. DPIA obligations exist conceptually but their… | Profile →Brief |
| Estonia (EE) | Europe | Green | GDPR Chapter IV duties (accountability, DPIA, DPO, ROPA, joint-controller arrangements, security, breach notification, retention) apply directly in Estonia. AKI has run coordinated EDPB campaigns on… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | Core GDPR accountability duties (DPIA, DPO, ROPA, security, breach notification, retention) remain in force. The Digital Omnibus proposes targeted relief: raising the Article 30(5) ROPA-exemption… | Profile →Brief |
| Finland (FI) | Europe | Green | GDPR Articles 24-39 apply directly with the Data Protection Act layering national procedural detail for special-category DPIAs. Finnish enforcement demonstrates consistent action on missing DPIAs… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | FDBR imposes data-protection-assessment, security, retention, and processor-contract duties on qualifying controllers; FIPA separately imposes reasonable-security and breach-notification duties on… | Profile →Brief |
| France (FR) | Europe | Green | CNIL's 2026 enforcement wave (FREE MOBILE/FREE, FRANCE TRAVAIL, IQVIA, NEXPUBLICA) evidences active application of accountability/DPIA, DPO, joint-controller, security, breach-notification and… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Amber | Georgia's principal controller duty is breach notification under its data-breach statute, which requires notice to affected residents in the most expedient time possible and without unreasonable… | Profile →Brief |
| Germany (DE) | Europe | Green | Germany layers national specifics onto the GDPR accountability regime: BDSG §38 sets a national DPO-appointment headcount threshold (20 persons regularly engaged in automated processing) in addition… | Profile →Brief |
| Ghana (GH) | Africa | Amber | The Act requires technical and organisational security measures and breach notification to both the DPC and data subjects, mandates a registration/notification regime that functions as a quasi-ROPA… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | Controller/processor duties (accountability, DPIA, ROPA, security, breach notification, retention) are set out across the DPA 2004 and Gibraltar GDPR and are actively enforced — the GRA's fines… | Profile →Brief |
| Greece (GR) | Europe | Green | HDPA has issued a DPIA-trigger list, actively enforces security-of-processing and breach obligations (Cosmote/OTE €9.25M combined 2022; Vodafone 2025; Hellenic Post/ELTA ransomware fine), and pursued… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | Controllers must comply with seven principles including accountability, and face a 72-hour regulator breach-notification duty plus a conditional data-subject notification duty. DPO appointment is a… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | Section 42 requires controllers to notify ODPA of a personal data breach 'as soon as practicable' and in any event no later than 72 hours after becoming aware, unless the breach is unlikely to result… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | Hawaii's principal controller obligation is breach notification under HRS ch. 487N (notice to affected residents; narrow personal-information definition; paper-record coverage). No state-law DPIA… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Red | PDPO imposes a general security principle (DPP4) and post-2012 processor-supervision duties, retention limitation (DPP2(2)/s.26), but does not mandate DPIAs, DPO appointments, general records of… | Profile →Brief |
| Hungary (HU) | Europe | Amber | Accountability, joint-controller and breach-notification duties are well evidenced via NAIH's Art 26 enforcement decision and its Art 97 self-report citing breach-notification volumes. DPO duties are… | Profile →Brief |
| Iceland (IS) | Europe | Amber | Accountability, DPIA, DPO, ROPA, security, breach-notification, and retention duties under GDPR Arts. 24-35 apply directly via Act No. 90/2018, with a substantial and growing Persónuvernd enforcement… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Amber | Idaho imposes no general accountability, DPIA, DPO, ROPA, or joint-controller obligations. The breach-notification statute is the sole binding controller duty, requiring notification upon breach of… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | No general accountability/DPIA/DPO/ROPA regime exists. Concrete duties are: PIPA reasonable-security and breach-notification obligations, and BIPA's storage/retention/destruction and reasonable-care… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | Data fiduciaries bear the core compliance burden (processors are lightly regulated). Significant Data Fiduciaries (SDFs) — a government-designated class — face heightened duties: DPIAs every 12… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Amber | Controllers must run and document DPIAs for higher-risk processing (targeted advertising, sale, risky profiling, sensitive data), maintain reasonable administrative/technical/physical security, bind… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | The ICDPA omits data protection impact assessments, DPO appointment, and formal records-of-processing obligations entirely -- a notable divergence from Colorado, Connecticut, Virginia and Indiana. It… | Profile →Brief |
| Ireland (IE) | Europe | Amber | GDPR accountability, DPO, security and breach-notification duties are in force and actively enforced, illustrated by the DPC's inquiry into City of Dublin Education and Training Board (CDETB) for… | Profile →Brief |
| Isle of Man (IM) | Europe | Green | Security-of-processing and breach-notification obligations are demonstrably live and enforced in the Isle of Man: the Commissioner is currently (as of late 2025) engaged in a joint… | Profile →Brief |
| Italy (IT) | Europe | Amber | Accountability, DPIA, DPO, security and breach-notification duties (GDPR Arts.24-25, 30, 32-34, 35, 37-39) are heavily litigated in Italy. The 2026 Poste Italiane/PostePay decision (EUR 12.5M)… | Profile →Brief |
| Ivory Coast (CI) | Africa | Amber | ARTCI has publicly reminded data controllers of compliance obligations, indicating an active accountability/enforcement posture, but granular DPIA, DPO, ROPA, joint-controller, security… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | The APPI does not draw a GDPR-style controller/processor distinction, nor does it mandate a DPO or a formal DPIA process; accountability instead flows through security-control-measures obligations… | Profile →Brief |
| Jersey (JE) | Europe | Amber | Breach-notification and security-of-processing obligations are confirmed (72-hour notification mirroring GDPR Art 33; an Art 8(1)(f) integrity-and-confidentiality principle enforced in a 2021… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Kansas imposes no general accountability, DPIA, DPO, ROPA, or joint-controller framework. The only affirmative duty at state level is breach notification under K.S.A. §50-7a01 et seq.; broader… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Red | Retention is partially addressed via a 2013 government decree limiting data holdings to what is necessary and sufficient for the operator's task. Draft amendments propose new security-measure… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | Controllers/processors face DPIA obligations (narrowed by HB473, effective June 1, 2026), mandatory controller-processor contract terms, general security and breach-notification duties (KRS 365.732… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Kenya's General Regulations 2021 operationalise accountability via privacy-by-design/default obligations, mandatory DPIAs for high-risk processing (including biometric/genetic data and… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | The World Bank's gap analysis specifically flags that the Lao framework misallocates breach-type responsibilities onto the 'data owner' rather than onto a controller/processor distinction, and that… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Amber | The 2026 RIPD Standards contain the bloc's most concrete controller/processor content: an accountability duty, minimum contractual clauses for controller-processor relationships, security-measure… | Profile →Brief |
| Latvia (LV) | Europe | Amber | Controller/processor accountability obligations follow GDPR Articles 24-39. DVI's draft list of processing operations exempt from the DPIA requirement (Article 35(5)) was reviewed by the EDPB in… | Profile →Brief |
| Liechtenstein (LI) | Europe | Green | Accountability, DPIA, DPO, ROPA, security, breach-notification and retention duties follow GDPR Articles 24-39 directly via EEA incorporation. The DSS has published a detailed DPIA 'blacklist'… | Profile →Brief |
| Lithuania (LT) | Europe | Green | Accountability, DPIA, DPO, ROPA, joint-controller, security and breach-notification duties follow GDPR directly. VDAI has published a national DPIA 'blacklist' under Art. 35(4), and has fined… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | Breach notification is the only fully in-force duty today: <cite index="42-5">2018 alone saw eight states change their notification timelines, defining that organizations have: 60 days to notify… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | Accountability (Art 6(1) legal-basis documentation) and DPO independence are evidenced via CNPD's Amazon decision and Decision No. 23FR/2021 respectively. ROPA, joint-controller arrangements… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | No general accountability/DPIA, DPO, ROPA, or joint-controller framework exists in Maine. Security-of-processing and breach-notification duties exist through the general breach-notification statute… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The Amendment Act materially expands controller/processor duties: mandatory DPO appointment, mandatory 72-hour breach notification to the Commissioner, and extension of the security principle… | Profile →Brief |
| Malta (MT) | Europe | Green | Accountability, DPIA, DPO, ROPA, security and breach-notification obligations apply under GDPR Articles 5, 24-39 with direct effect; the IDPC actively enforces security-of-processing (Article 32) and… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No accountability/DPIA regime, DPO threshold, ROPA duty, processor-contract mandatory-terms rule, or data-protection breach-notification duty exists in RMI law. Searched for an RMI… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | MODPA imposes DPIA, confidentiality, and processor-contract obligations on controllers, while the separate PIPA statute governs breach notification. No DPO-appointment requirement or explicit… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | This is the module with the strongest binding MA-specific content. 201 CMR 17.00 requires covered entities owning or licensing personal information of MA residents to maintain a written information… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico's regime imposes accountability, security and (limited) breach-related duties on controllers, but critically diverges from GDPR by not requiring a formal Data Protection Officer… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | No general accountability, DPIA, DPO, ROPA, or joint-controller framework exists in Michigan law. Sector-specific security and breach-notification duties do exist: the Identity Theft Protection Act… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | Controllers must run data protection/privacy assessments, limit collection and retention to disclosed necessary purposes, and maintain risk-appropriate security. Processor contracts must impose… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Amber | The only genuinely Mississippi-specific controller duty of note is the state's breach-notification statute, which requires notice to affected Mississippi residents following discovery of a security… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | The only substantive controller duty under Missouri state law is breach notification under §407.1500. There is no statutory DPIA, DPO, ROPA, joint-controller, general security-measures, or… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | Controllers must maintain reasonable administrative, technical and physical security practices, conduct data protection assessments (DPIAs) for processing presenting a heightened risk of harm… | Profile →Brief |
| Morocco (MA) | Africa | Amber | CNDP has published a decision setting criteria for DPIA-type assessments and has issued reminders to controllers on data-breach handling procedures, notwithstanding the gap analysis finding that Law… | Profile →Brief |
| Mozambique (MZ) | Africa | Amber | Law 34/2014 imposes a confidentiality duty on public entities holding personal data, with fines and potential criminal prosecution for unauthorised disclosure, but there is no general accountability… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | Outside a sector-specific customer-information-protection duty under the Financial Institutions Law 2016, Myanmar has no general accountability principle, DPIA trigger, DPO-appointment threshold… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | NDPA controllers must implement reasonable administrative, technical and physical safeguards and conduct data protection assessments for higher-risk processing (targeted advertising, sale, certain… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No accountability/DPIA regime, no DPO appointment requirement, no ROPA obligation, no joint-controller framework, and no codified breach-notification duty were located; the strongest confirmed… | Profile →Brief |
| Netherlands (NL) | Europe | Green | Controllers and processors are subject to the full GDPR accountability toolkit. The AP has published a binding national DPIA 'blacklist' identifying processing types requiring a mandatory DPIA… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Nevada imposes statutory duties centred on data security and breach notification (NRS Chapter 603A) rather than a full accountability/DPIA/DPO/ROPA framework. There is a records-destruction… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Amber | Breach notification is the best-evidenced duty in this module: PIPEDA requires reporting to the OPC and notifying affected individuals where a breach poses a 'real risk of significant harm' (RROSH)… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Amber | Controllers must conduct and document data protection assessments (DPIA-equivalent) for processing presenting a heightened risk of harm (targeted advertising, certain profiling, sensitive data), for… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | Controllers must complete and document a data protection assessment ('DPA') before processing that presents a heightened risk of harm (including all sensitive-data processing, and processing for… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | New Mexico imposes no general accountability, DPIA, DPO, ROPA, or joint-controller framework. The sole controller-facing duties in force relate to breach notification under the Data Breach… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Amber | Agencies must appoint one or more privacy officers (internal or external) and maintain reasonable security safeguards (IPP5) and retention limits (IPP9). Part 6 of the Act creates a mandatory… | Profile →Brief |
| Nigeria (NG) | Africa | Green | The NDPA imposes accountability obligations including DPIAs (Section 28; GAID Article 28), DPO appointment (Section 32), and a 72-hour breach notification duty to the Commission for controllers… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Amber | North Carolina imposes no DPIA, DPO, ROPA, or joint-controller framework. Security-of-processing and breach-notification duties exist under the Identity Theft Protection Act, including a… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Amber | ND imposes no general accountability principle, DPIA trigger, DPO threshold, or ROPA requirement. Its principal controller duty is breach-related: the 2015-amended Chapter 51-30 requires disclosure… | Profile →Brief |
| Norway (NO) | Europe | Green | Datatilsynet actively enforces accountability obligations: it maintains a mandatory DPIA trigger-list, has issued binding decisions on DPO independence/designation (Telenor), on ROPA completeness… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Amber | Ohio imposes no general accountability, DPIA, DPO, ROPA, or joint-controller regime. The one operative Ohio-specific instrument is the Data Protection Act's voluntary cybersecurity safe harbor, which… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Amber | SB 546 will require data protection assessments (DPIAs) for a range of processing activities from 2027. Current in-force accountability obligations are sectoral: GLBA Safeguards Rule imposes… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | Accountability is a foundational PIPEDA principle: organizations remain responsible for personal information transferred to third-party processors and must ensure comparable protection contractually.… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Green | OCPA imposes Data Protection Assessment obligations for heightened-risk processing, mandates processor contracts, and requires reasonable security safeguards; breach notification runs through the… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted accountability, DPIA, DPO, ROPA, joint-controller, security, breach-notification, or retention regime exists generally. The May 2023 draft proposes chapters on security requirements… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No DPIA trigger list, DPO threshold, ROPA exemption test, processor-contract mandatory terms, security-of-processing standard, breach-notification deadline, or retention/disposal duty could be… | Profile →Brief |
| Panama (PA) | Americas | Amber | Executive Decree 285 (2021) creates a Data Protection Officer figure, holds both the data controller ('responsable del tratamiento') and database custodian accountable for compliance under Articles… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Amber | General accountability, DPIA, DPO, ROPA and joint-controller obligations of the GDPR type are absent from Pennsylvania law. Two enforceable duties exist in sectoral form: (1) the Insurance Data… | Profile →Brief |
| Peru (PE) | Americas | Amber | Controllers must adopt technical, organisational and legal security measures; the 2024 Reglamento adds documented, dated security-policy and access-control obligations. A mandatory 'Oficial de Datos… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Green | Controllers must implement privacy and security programs, appoint DPOs/compliance officers, execute reviewable data-sharing agreements, and comply with a 72-hour concurrent breach-notification… | Profile →Brief |
| Poland (PL) | Europe | Green | UODO enforcement demonstrates active application of accountability, ROPA, breach notification, security and retention obligations. Notable cases include a fine on a municipal mayor for lacking… | Profile →Brief |
| Portugal (PT) | Europe | Green | Controller/processor duties track GDPR Arts 24-39. Enforcement history (INE Census 2021, Hospital do Barreiro) shows the CNPD actively pursuing DPIA, security-measures, and accountability failures.… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | The QFC Data Protection Regulations 2021 impose accountability duties including data protection by design/default (Article 26), DPIA obligations (Article 27), processor obligations (Article 28)… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | Law 25 imposes accountability via mandatory PIAs, a designated (default CEO) accountable person, breach-notification and incident-register duties, and destruction/anonymisation on retention expiry.… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA imposes a security-of-processing duty and requires data protection assessments (DPIAs) for heightened-risk processing (targeted advertising, sale of data, certain profiling, and… | Profile →Brief |
| Romania (RO) | Europe | Amber | Accountability, DPIA, security-of-processing, breach notification and retention duties in Romania follow GDPR Articles 5, 24-25, 30, 32-35 directly. ANSPDCP's enforcement docket (Hora Credit IFN… | Profile →Brief |
| Russia (RU) | Europe | Amber | Operators must designate a 'person responsible for the processing of personal data' (functionally analogous to a DPO), who may face personal administrative liability. Since September 2022, immediate… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | The law imposes security-of-processing and prior security-check obligations, a two-stage breach notification/communication regime, and dedicated retention/destruction provisions. Explicit DPIA… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | Controllers face DPIA obligations across nine defined scenarios, DPO appointment rules for public entities and certain processing profiles, ROPA maintenance, periodic processor-compliance… | Profile →Brief |
| Senegal (SN) | Africa | Amber | The Law imposes processor-contract requirements (confidentiality clause, controller-instruction-only processing under Article 39), a data-quality/retention obligation, and CDP-maintained public… | Profile →Brief |
| Serbia (RS) | Europe | Amber | The Commissioner has issued a Data Protection Impact Assessment 'blacklist' of processing activities requiring a DPIA under LPDP Articles 54-55, evidencing active accountability tooling. DPO… | Profile →Brief |
| Seychelles (SC) | Africa | Amber | Controllers must carry out a Data Protection Impact Assessment where processing is likely to result in high risk to individuals' rights and freedoms, and must, under certain (unspecified)… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | Accountability is explicit: <cite index="8-15">while the principle of accountability is currently implied in Sections 11 and 12 of the PDPA, the amendments include an explicit reference to the term… | Profile →Brief |
| Slovakia (SK) | Europe | Green | GDPR's accountability regime (Art. 5(2), 24), DPIA regime (Art. 35, with Act 18/2018 Sections 42-43 providing national procedural detail), DPO regime (Art. 37-39), processor rules (Art. 28), security… | Profile →Brief |
| Slovenia (SI) | Europe | Green | GDPR accountability, DPIA, DPO, ROPA, security, and breach-notification duties apply directly in Slovenia, supplemented by ZVOP-2's stricter national employment-CCTV standard. Recent enforcement… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | POPIA imposes accountability duties on 'responsible parties' but has no explicit privacy-by-design or DPIA obligation comparable to GDPR Articles 25/35 (best-practice only). Every organisation… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | General accountability, DPIA, DPO, ROPA, and retention obligations do not exist outside the insurance sector. The Insurance Data Security Act imposes security-program, risk-assessment, training, and… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | Outside of breach notification, South Dakota imposes no general statutory duties on controllers or processors regarding DPIAs, DPO appointment, records of processing, joint-controller arrangements… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | PIPA currently mandates DPIAs only for public organisations. A June 2026 draft Enforcement Decree amendment would require board-approved CPO appointment/removal notifications for large processors… | Profile →Brief |
| Spain (ES) | Europe | Green | GDPR accountability principle applies directly (Art 5(2)), operationalised through ROPA (Art 30), DPIA where risk criteria are met, DPO appointment where GDPR Art 37 / LOPDGDD Art 34 thresholds… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA imposes an accountability framework requiring a Data Protection Management Programme, DPIAs for higher-risk processing, DPO appointment (narrowed by the October 2025 amendment), processor… | Profile →Brief |
| Sweden (SE) | Europe | Amber | GDPR Arts 5, 24-43 apply directly with SFS 2018:218 Chapter 1 Section 8 supplementing Art 37-39 DPO rules. Enforcement history (Sportadmin, Apoteket/Apohem) shows IMY treats Art 32… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | The revFADP introduces mandatory DPIAs for high-risk processing (Arts 22-23), strengthened security-of-processing obligations (Art 7 FADP baseline), an explicit purpose-limitation-driven… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | Historically, the PDPA imposed lighter controller/processor obligations than the GDPR: no defined DPIA, no DPO concept (only a requirement to assign 'dedicated personnel' for security under Art 18)… | Profile →Brief |
| Tanzania (TZ) | Africa | Amber | The PDPA is confirmed to impose data-security obligations on controllers/processors, but DPIA triggers, DPO appointment thresholds, ROPA requirements, joint-controller rules, breach-notification… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | TIPA imposes accountability obligations including mandatory Data Protection Assessments (DPAs), a general data-security duty on controllers, and contractual constraints on processors, plus separate… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | TDPSA mandates data-protection (risk) assessments in specified high-risk circumstances. TITEPA, as amended by HB 4390, sets a 60-day breach-disclosure deadline and AG-notification duties for breaches… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Green | PDIA-equivalent accountability is indirect: <cite index="54-32,54-33">while the GDPR specifically provides for DPIAs, the PDPA outlines that data controllers have a duty to provide appropriate… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | No enforceable accountability, DPIA, DPO, ROPA, security, breach-notification or retention regime is currently operative. The Data Protection Bill, 2024 proposes accountability (clause 25)… | Profile →Brief |
| Tunisia (TN) | Africa | Red | General accountability, DPO, ROPA, joint-controller, security, breach-notification and retention obligations under Organic Law 2004-63 could not be confirmed with specificity from accessible sources… | Profile →Brief |
| Turkey (TR) | Europe | Amber | The LPPD imposes accountability-adjacent duties (VERBIS registration/inventory, security-of-processing obligations, breach notification) but -- unlike the GDPR -- contains no express DPIA… | Profile →Brief |
| Uganda (UG) | Africa | Amber | Part 4 of the Act requires reasonable technical/organisational security measures; the Regulations add DPIA obligations for high-risk processing, DPO appointment/qualification detail, registration… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | Controllers handling 'high-risk' data face DPO-appointment, ROPA, and security-measure obligations issued via Ombudsman order. DPIA and breach-notification requirements comparable to GDPR Articles… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | DIFC Law 2020 provides the most detailed accountability, DPIA, DPO, ROPA, breach-notification and privacy-program requirements among the UAE's data protection instruments; ADGM imposes parallel… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | Controllers must demonstrate accountability (Article 5(2)), conduct DPIAs for high-risk processing, appoint DPOs where required, maintain records of processing, secure personal data (Article 32), and… | Profile →Brief |
| United States (US) | Americas | Amber | Accountability obligations are sector- and state-specific. California's 2026 CCPA regulations introduce risk assessments, automated-decision-making-technology (ADMT) rules, and cybersecurity audit… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | The CPRA introduced accountability-style obligations new to the U.S. state landscape: mandatory risk assessments, cybersecurity audits for higher-risk processing, and contractual flow-down duties on… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | New York imposes concrete security-program and breach-notification duties via the SHIELD Act and, for financial-services entities, the far more detailed NYDFS Cybersecurity Regulation (23 NYCRR Part… | Profile →Brief |
| Uruguay (UY) | Americas | Green | The 2018 reform (Law 19.670) introduced an accountability/proactive-responsibility principle requiring controllers and processors to adopt, document, periodically review and evaluate the… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The UCPA imposes a general security-practices obligation but expressly omits DPIA/privacy-impact-assessment, DPO-appointment, and ROPA requirements that are standard in Colorado, Connecticut and… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | No findings. Searches run: 'Vanuatu Data Protection and Privacy Act DPO requirements', 'Vanuatu data protection breach notification', 'Vanuatu DPIA ROPA' and the primary Act/gazette text — none… | Profile →Brief |
| Venezuela (VE) | Americas | Red | No accountability/DPIA regime, DPO requirement, ROPA requirement, or joint-controller framework exists. Security-of-processing obligations are limited to information-security functions under the Ley… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | DPIA, security, and breach-notification duties are split between the not-yet-effective S.71 (DPIAs, processor contracts) and the currently in-force Data Broker security program and Security Breach… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | Decree 356 prescribes DPIA procedures with a five-year opt-in grace period for small businesses/start-ups/micro-enterprises, enhanced reporting/audit tooling consistent with a ROPA-style obligation… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | Controllers must conduct data protection assessments for higher-risk processing (targeted advertising, sale, certain profiling, sensitive data), and processor relationships must be governed by… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | There is no general accountability/DPIA, DPO, ROPA, joint-controller, or security-measures regime in Washington law outside sector-specific requirements. Washington's general data-breach notification… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Amber | West Virginia's only enacted controller duty of general applicability is breach notification under W. Va. Code Chapter 46A, Article 2A. Security-of-processing obligations exist only through sectoral… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Amber | General controller/processor accountability obligations (DPIA, DPO, ROPA, joint-controller rules, retention limits) are absent in Wisconsin outside the insurance sector. The general… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Amber | Wyoming's principal controller/processor duty is breach notification under Wyo. Stat. §40-12-501 et seq. Sectoral federal overlays (GLBA Safeguards Rule for financial institutions; HIPAA Security… | Profile →Brief |
| Zambia (ZM) | Africa | Amber | The clearest verified controller/processor duty is the data-auditor licensing requirement under the Registration and Licensing Regulations, 2021. Accountability/DPIA triggers, DPO appointment… | Profile →Brief |