--- title: "Controller & processor duties — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/controller-processor-duties/ source_html: /domains/controller-processor-duties/index.html description: "Cross-jurisdiction comparison of Controller & processor duties across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 4ed5ff5b831959e36da6fbf6d9e2957e26b1ccf08fe10ef769327d869f122828 generator: "fe-fleet/md-twin@1.0" --- # Controller & processor duties — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 29 Confirmed 118 Probable 20 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Amber The Malabo Convention has been directly criticised in reviewed materials for lacking important implementation detail and for not providing mechanisms to support enforcement of controller/processor… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber The clearest, currently in-force controller duty in Alabama is breach notification under the 2018 Act (45-day consumer/AG notice, 10-day third-party-agent notice). Sector-specific… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Amber Alaska imposes two concrete controller-side duties: (1) breach notification and secure disposal of records containing personal information under APIPA, AS 45.48; and (2) an… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber PIPA imposes accountability for personal information transferred to third parties for processing, and a mandatory breach-notification duty to the OIPC where a real risk of significant harm (RROSH)… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Amber Algeria's regime is expected to impose baseline accountability and security obligations on controllers, but specific DPIA triggers, DPO appointment thresholds, ROPA obligations, joint-controller… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No Antigua-specific source located on DPIA triggers, DPO thresholds, ROPA exemptions, joint-controller rules, security-of-processing measures, breach notification timelines/thresholds, or… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Amber The current Act imposes no DPIA or DPO obligation, though AAIP soft-law (a non-binding DPIA Guide and Resolución 47/2018 recommended security measures) fills part of the gap. There is no general… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Arizona imposes concrete breach-notification duties (A.R.S. §18-552) but no general accountability, DPIA, DPO, ROPA, or retention-limit obligations. Security-of-processing is addressed only… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Amber PIPA imposes reasonable security, breach-notification, and disposal duties on controllers, but Arkansas has no accountability/DPIA principle, DPO-appointment threshold, ROPA obligation, or… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Amber No bloc-level DPIA triggers, DPO thresholds, ROPA requirements, or retention/disposal rules exist. The Global CBPR/PRP certification system requires organisations' data-protection policies and… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber The Privacy Act does not use a controller/processor construct, does not mandate DPOs, and has no formal DPIA or ROPA filing regime; instead accountability is achieved via the APP 1 'open and… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber GDPR Articles 5, 25, 28, 30, 32-35 and 37-39 apply directly to Austrian controllers/processors without a general national derogation elevating or lowering thresholds; Austria has not enacted a… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Amber Secondary guidance confirms the Data Protection Ordinance, 2025 applies to data breach notification in Bangladesh, enforced by the NDGIA. DPIA triggers, DPO appointment thresholds, ROPA requirements… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green Belgian controllers/processors are subject to the full GDPR accountability toolkit: DPIA (with a Belgian DPA-published mandatory-DPIA list), DPO appointment and registration, ROPA, breach… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced provisions on DPIA triggers, DPO thresholds, ROPA exemptions, joint-controller arrangements, security-measure standards, breach-notification deadlines, or retention/disposal duties under… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber Controllers must appoint a DPO (Resolution CD/ANPD 18/2024) unless qualifying as a small-scale controller; ROPA obligations apply with a simplified template for small agents; DPIAs are… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA imposes an accountability principle requiring organizations to designate an individual accountable for compliance, and requires reasonable security safeguards for personal information in an… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Green Bulgaria's controller/processor duties are anchored in GDPR Articles 5, 24-43 and detailed nationally in the Act's DPO-notification (Art. 25b), processor-ROPA (Art. 62(2)), and… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red The draft LPDP would impose GDPR-familiar controller/processor duties — DPIAs, DPO appointment (mandatory and universal, unlike GDPR's risk-based trigger), records of processing, security measures… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber The draft law outlines general accountability principles (purpose limitation, retention limitation, transparency, confidentiality, accessibility, and appropriate technical and organizational security… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber PIPEDA's mandatory breach-reporting regime (in force since 1 November 2018) requires notice to the OPC and affected individuals where a breach poses a 'real risk of significant harm,' plus a… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Green Accountability (Principle 4.1) requires organizations to designate an individual accountable for compliance and remain responsible for information transferred to third-party processors. Security… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Ley 21.719 introduces an accountability principle, DPIA-equivalent impact assessments for high-risk processing, a voluntary-but-conditionally-mandatory DPO (delegado de protección de datos)… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber PIPL Chapter V imposes DPIA obligations (Arts 55–56) triggered by sensitive-data processing, automated decision-making, entrusting/sharing/public disclosure of PI, cross-border transfers, and other… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Green Colombia's accountability regime (Decree 1377, Arts 13/23/26/27) requires proportionate compliance programs, a responsible person/group in lieu of a formally titled DPO, RNBD registration functioning… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Amber Controllers must conduct and document data protection assessments (DPAs) for heightened-risk processing, exercise a duty of care over security proportionate to the volume/scope/nature of data, and… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No DPIA, DPO, ROPA, processor-contract, security-of-processing, breach-notification or retention regime was located for the Union of the Comoros. No evidence of a sector-specific breach-notification… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No statutory DPIA trigger list, DPO appointment threshold, ROPA exemption test, processor-contract mandatory-terms rule, security-measures standard, breach-notification duty, or retention/disposal… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No accountability/DPIA, DPO, ROPA, joint-controller, security, breach-notification, or retention/disposal regime is codified for controllers or processors operating in or from Comoros/Mohéli. [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber CTDPA requires Data Protection Assessments (DPAs)/Impact Assessments before processing that presents a heightened risk of harm (targeted advertising, sale, risky profiling, sensitive-data… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Amber Controllers and processors must maintain adequate security safeguards and, following the 2016 reform, are subject to a more precisely delimited registration/accountability duty under Article 21 of… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Green Controller/processor duties follow GDPR Chapter IV directly. Enforcement history shows active AZOP supervision of Article 32 security measures and Article 5(1)(e) storage limitation (Croatian… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Amber Professional legal-research sources are explicit that the Curaçao Ordinance does not set out DPO-appointment requirements or data-breach-notification requirements. Accountability/DPIA, ROPA… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Green Accountability, DPIA, DPO, ROPA, security and breach-notification duties follow GDPR Arts 24-39. Cyprus's national DPIA exemption list (Art 35(5)) has been submitted to and reviewed by the EDPB.… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green GDPR's accountability, DPIA, DPO, security, breach-notification and retention obligations apply directly, supplemented by Act No. 110/2019 Coll.'s Section 10 'legislative DPIA' mechanism (effective 1… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber Controllers must apply data minimization, security, and DPIA obligations for high-risk processing. A long-standing separate breach-notification statute (since 2018) requires consumer notice and… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Denmark enforces GDPR's accountability, security, and breach-notification duties vigorously: Datatilsynet has pursued controllers for inadequate processor supervision (Capio), inadequate technical… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Amber Outside of breach notification and an implicit security-requirements provision introduced by the 2020 amendment, the District imposes no DPIA, DPO, ROPA, joint-controller, or general… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Amber Law 172-13 establishes a general security-of-processing principle for controllers but does not impose a breach-notification obligation to data subjects or authorities; breach notice is… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green EUDPR Chapter IV imposes accountability (Art 4(2)), DPIA obligations (Art 39), mandatory DPO designation with EDPS-consent-gated dismissal (Art 44, reinforced by EDPS Decision 01/2026), ROPA (Art… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber Controllers/processors must appoint an accredited DPO under the Executive Regulations, though the PDPL itself sets no DPO qualification standard. DPIA obligations exist conceptually but their… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Green GDPR Chapter IV duties (accountability, DPIA, DPO, ROPA, joint-controller arrangements, security, breach notification, retention) apply directly in Estonia. AKI has run coordinated EDPB campaigns on… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber Core GDPR accountability duties (DPIA, DPO, ROPA, security, breach notification, retention) remain in force. The Digital Omnibus proposes targeted relief: raising the Article 30(5) ROPA-exemption… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Green GDPR Articles 24-39 apply directly with the Data Protection Act layering national procedural detail for special-category DPIAs. Finnish enforcement demonstrates consistent action on missing DPIAs… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber FDBR imposes data-protection-assessment, security, retention, and processor-contract duties on qualifying controllers; FIPA separately imposes reasonable-security and breach-notification duties on… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Green CNIL's 2026 enforcement wave (FREE MOBILE/FREE, FRANCE TRAVAIL, IQVIA, NEXPUBLICA) evidences active application of accountability/DPIA, DPO, joint-controller, security, breach-notification and… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Amber Georgia's principal controller duty is breach notification under its data-breach statute, which requires notice to affected residents in the most expedient time possible and without unreasonable… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Green Germany layers national specifics onto the GDPR accountability regime: BDSG §38 sets a national DPO-appointment headcount threshold (20 persons regularly engaged in automated processing) in addition… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The Act requires technical and organisational security measures and breach notification to both the DPC and data subjects, mandates a registration/notification regime that functions as a quasi-ROPA… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Controller/processor duties (accountability, DPIA, ROPA, security, breach notification, retention) are set out across the DPA 2004 and Gibraltar GDPR and are actively enforced — the GRA's fines… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Green HDPA has issued a DPIA-trigger list, actively enforces security-of-processing and breach obligations (Cosmote/OTE €9.25M combined 2022; Vodafone 2025; Hellenic Post/ELTA ransomware fine), and pursued… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber Controllers must comply with seven principles including accountability, and face a 72-hour regulator breach-notification duty plus a conditional data-subject notification duty. DPO appointment is a… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber Section 42 requires controllers to notify ODPA of a personal data breach 'as soon as practicable' and in any event no later than 72 hours after becoming aware, unless the breach is unlikely to result… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber Hawaii's principal controller obligation is breach notification under HRS ch. 487N (notice to affected residents; narrow personal-information definition; paper-record coverage). No state-law DPIA… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Red PDPO imposes a general security principle (DPP4) and post-2012 processor-supervision duties, retention limitation (DPP2(2)/s.26), but does not mandate DPIAs, DPO appointments, general records of… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber Accountability, joint-controller and breach-notification duties are well evidenced via NAIH's Art 26 enforcement decision and its Art 97 self-report citing breach-notification volumes. DPO duties are… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber Accountability, DPIA, DPO, ROPA, security, breach-notification, and retention duties under GDPR Arts. 24-35 apply directly via Act No. 90/2018, with a substantial and growing Persónuvernd enforcement… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Amber Idaho imposes no general accountability, DPIA, DPO, ROPA, or joint-controller obligations. The breach-notification statute is the sole binding controller duty, requiring notification upon breach of… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber No general accountability/DPIA/DPO/ROPA regime exists. Concrete duties are: PIPA reasonable-security and breach-notification obligations, and BIPA's storage/retention/destruction and reasonable-care… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber Data fiduciaries bear the core compliance burden (processors are lightly regulated). Significant Data Fiduciaries (SDFs) — a government-designated class — face heightened duties: DPIAs every 12… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Amber Controllers must run and document DPIAs for higher-risk processing (targeted advertising, sale, risky profiling, sensitive data), maintain reasonable administrative/technical/physical security, bind… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber The ICDPA omits data protection impact assessments, DPO appointment, and formal records-of-processing obligations entirely -- a notable divergence from Colorado, Connecticut, Virginia and Indiana. It… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber GDPR accountability, DPO, security and breach-notification duties are in force and actively enforced, illustrated by the DPC's inquiry into City of Dublin Education and Training Board (CDETB) for… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Green Security-of-processing and breach-notification obligations are demonstrably live and enforced in the Isle of Man: the Commissioner is currently (as of late 2025) engaged in a joint… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Amber Accountability, DPIA, DPO, security and breach-notification duties (GDPR Arts.24-25, 30, 32-34, 35, 37-39) are heavily litigated in Italy. The 2026 Poste Italiane/PostePay decision (EUR 12.5M)… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Amber ARTCI has publicly reminded data controllers of compliance obligations, indicating an active accountability/enforcement posture, but granular DPIA, DPO, ROPA, joint-controller, security… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber The APPI does not draw a GDPR-style controller/processor distinction, nor does it mandate a DPO or a formal DPIA process; accountability instead flows through security-control-measures obligations… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Amber Breach-notification and security-of-processing obligations are confirmed (72-hour notification mirroring GDPR Art 33; an Art 8(1)(f) integrity-and-confidentiality principle enforced in a 2021… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas imposes no general accountability, DPIA, DPO, ROPA, or joint-controller framework. The only affirmative duty at state level is breach notification under K.S.A. §50-7a01 et seq.; broader… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Red Retention is partially addressed via a 2013 government decree limiting data holdings to what is necessary and sufficient for the operator's task. Draft amendments propose new security-measure… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber Controllers/processors face DPIA obligations (narrowed by HB473, effective June 1, 2026), mandatory controller-processor contract terms, general security and breach-notification duties (KRS 365.732… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber Kenya's General Regulations 2021 operationalise accountability via privacy-by-design/default obligations, mandatory DPIAs for high-risk processing (including biometric/genetic data and… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red The World Bank's gap analysis specifically flags that the Lao framework misallocates breach-type responsibilities onto the 'data owner' rather than onto a controller/processor distinction, and that… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber The 2026 RIPD Standards contain the bloc's most concrete controller/processor content: an accountability duty, minimum contractual clauses for controller-processor relationships, security-measure… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber Controller/processor accountability obligations follow GDPR Articles 24-39. DVI's draft list of processing operations exempt from the DPIA requirement (Article 35(5)) was reviewed by the EDPB in… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Green Accountability, DPIA, DPO, ROPA, security, breach-notification and retention duties follow GDPR Articles 24-39 directly via EEA incorporation. The DSS has published a detailed DPIA 'blacklist'… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Green Accountability, DPIA, DPO, ROPA, joint-controller, security and breach-notification duties follow GDPR directly. VDAI has published a national DPIA 'blacklist' under Art. 35(4), and has fined… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber Breach notification is the only fully in-force duty today: 2018 alone saw eight states change their notification timelines, defining that organizations have: 60 days to notify… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber Accountability (Art 6(1) legal-basis documentation) and DPO independence are evidenced via CNPD's Amazon decision and Decision No. 23FR/2021 respectively. ROPA, joint-controller arrangements… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Amber No general accountability/DPIA, DPO, ROPA, or joint-controller framework exists in Maine. Security-of-processing and breach-notification duties exist through the general breach-notification statute… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Amber The Amendment Act materially expands controller/processor duties: mandatory DPO appointment, mandatory 72-hour breach notification to the Commissioner, and extension of the security principle… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Green Accountability, DPIA, DPO, ROPA, security and breach-notification obligations apply under GDPR Articles 5, 24-39 with direct effect; the IDPC actively enforces security-of-processing (Article 32) and… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red No accountability/DPIA regime, DPO threshold, ROPA duty, processor-contract mandatory-terms rule, or data-protection breach-notification duty exists in RMI law. Searched for an RMI… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber MODPA imposes DPIA, confidentiality, and processor-contract obligations on controllers, while the separate PIPA statute governs breach notification. No DPO-appointment requirement or explicit… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Amber This is the module with the strongest binding MA-specific content. 201 CMR 17.00 requires covered entities owning or licensing personal information of MA residents to maintain a written information… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Amber Mexico's regime imposes accountability, security and (limited) breach-related duties on controllers, but critically diverges from GDPR by not requiring a formal Data Protection Officer… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Amber No general accountability, DPIA, DPO, ROPA, or joint-controller framework exists in Michigan law. Sector-specific security and breach-notification duties do exist: the Identity Theft Protection Act… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Amber Controllers must run data protection/privacy assessments, limit collection and retention to disclosed necessary purposes, and maintain risk-appropriate security. Processor contracts must impose… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Amber The only genuinely Mississippi-specific controller duty of note is the state's breach-notification statute, which requires notice to affected Mississippi residents following discovery of a security… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Amber The only substantive controller duty under Missouri state law is breach notification under §407.1500. There is no statutory DPIA, DPO, ROPA, joint-controller, general security-measures, or… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Amber Controllers must maintain reasonable administrative, technical and physical security practices, conduct data protection assessments (DPIAs) for processing presenting a heightened risk of harm… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Amber CNDP has published a decision setting criteria for DPIA-type assessments and has issued reminders to controllers on data-breach handling procedures, notwithstanding the gap analysis finding that Law… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Amber Law 34/2014 imposes a confidentiality duty on public entities holding personal data, with fines and potential criminal prosecution for unauthorised disclosure, but there is no general accountability… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red Outside a sector-specific customer-information-protection duty under the Financial Institutions Law 2016, Myanmar has no general accountability principle, DPIA trigger, DPO-appointment threshold… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber NDPA controllers must implement reasonable administrative, technical and physical safeguards and conduct data protection assessments for higher-risk processing (targeted advertising, sale, certain… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No accountability/DPIA regime, no DPO appointment requirement, no ROPA obligation, no joint-controller framework, and no codified breach-notification duty were located; the strongest confirmed… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green Controllers and processors are subject to the full GDPR accountability toolkit. The AP has published a binding national DPIA 'blacklist' identifying processing types requiring a mandatory DPIA… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber Nevada imposes statutory duties centred on data security and breach notification (NRS Chapter 603A) rather than a full accountability/DPIA/DPO/ROPA framework. There is a records-destruction… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Amber Breach notification is the best-evidenced duty in this module: PIPEDA requires reporting to the OPC and notifying affected individuals where a breach poses a 'real risk of significant harm' (RROSH)… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Amber Controllers must conduct and document data protection assessments (DPIA-equivalent) for processing presenting a heightened risk of harm (targeted advertising, certain profiling, sensitive data), for… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Amber Controllers must complete and document a data protection assessment ('DPA') before processing that presents a heightened risk of harm (including all sensitive-data processing, and processing for… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Red New Mexico imposes no general accountability, DPIA, DPO, ROPA, or joint-controller framework. The sole controller-facing duties in force relate to breach notification under the Data Breach… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Amber Agencies must appoint one or more privacy officers (internal or external) and maintain reasonable security safeguards (IPP5) and retention limits (IPP9). Part 6 of the Act creates a mandatory… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Green The NDPA imposes accountability obligations including DPIAs (Section 28; GAID Article 28), DPO appointment (Section 32), and a 72-hour breach notification duty to the Commission for controllers… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Amber North Carolina imposes no DPIA, DPO, ROPA, or joint-controller framework. Security-of-processing and breach-notification duties exist under the Identity Theft Protection Act, including a… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Amber ND imposes no general accountability principle, DPIA trigger, DPO threshold, or ROPA requirement. Its principal controller duty is breach-related: the 2015-amended Chapter 51-30 requires disclosure… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green Datatilsynet actively enforces accountability obligations: it maintains a mandatory DPIA trigger-list, has issued binding decisions on DPO independence/designation (Telenor), on ROPA completeness… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Amber Ohio imposes no general accountability, DPIA, DPO, ROPA, or joint-controller regime. The one operative Ohio-specific instrument is the Data Protection Act's voluntary cybersecurity safe harbor, which… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber SB 546 will require data protection assessments (DPIAs) for a range of processing activities from 2027. Current in-force accountability obligations are sectoral: GLBA Safeguards Rule imposes… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber Accountability is a foundational PIPEDA principle: organizations remain responsible for personal information transferred to third-party processors and must ensure comparable protection contractually.… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Green OCPA imposes Data Protection Assessment obligations for heightened-risk processing, mandates processor contracts, and requires reasonable security safeguards; breach notification runs through the… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No enacted accountability, DPIA, DPO, ROPA, joint-controller, security, breach-notification, or retention regime exists generally. The May 2023 draft proposes chapters on security requirements… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No DPIA trigger list, DPO threshold, ROPA exemption test, processor-contract mandatory terms, security-of-processing standard, breach-notification deadline, or retention/disposal duty could be… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Amber Executive Decree 285 (2021) creates a Data Protection Officer figure, holds both the data controller ('responsable del tratamiento') and database custodian accountable for compliance under Articles… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Amber General accountability, DPIA, DPO, ROPA and joint-controller obligations of the GDPR type are absent from Pennsylvania law. Two enforceable duties exist in sectoral form: (1) the Insurance Data… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Amber Controllers must adopt technical, organisational and legal security measures; the 2024 Reglamento adds documented, dated security-policy and access-control obligations. A mandatory 'Oficial de Datos… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Green Controllers must implement privacy and security programs, appoint DPOs/compliance officers, execute reviewable data-sharing agreements, and comply with a 72-hour concurrent breach-notification… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Green UODO enforcement demonstrates active application of accountability, ROPA, breach notification, security and retention obligations. Notable cases include a fine on a municipal mayor for lacking… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Green Controller/processor duties track GDPR Arts 24-39. Enforcement history (INE Census 2021, Hospital do Barreiro) shows the CNPD actively pursuing DPIA, security-measures, and accountability failures.… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Amber The QFC Data Protection Regulations 2021 impose accountability duties including data protection by design/default (Article 26), DPIA obligations (Article 27), processor obligations (Article 28)… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Amber Law 25 imposes accountability via mandatory PIAs, a designated (default CEO) accountable person, breach-notification and incident-register duties, and destruction/anonymisation on retention expiry.… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber RIDTPPA imposes a security-of-processing duty and requires data protection assessments (DPIAs) for heightened-risk processing (targeted advertising, sale of data, certain profiling, and… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Amber Accountability, DPIA, security-of-processing, breach notification and retention duties in Romania follow GDPR Articles 5, 24-25, 30, 32-35 directly. ANSPDCP's enforcement docket (Hora Credit IFN… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Amber Operators must designate a 'person responsible for the processing of personal data' (functionally analogous to a DPO), who may face personal administrative liability. Since September 2022, immediate… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Amber The law imposes security-of-processing and prior security-check obligations, a two-stage breach notification/communication regime, and dedicated retention/destruction provisions. Explicit DPIA… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber Controllers face DPIA obligations across nine defined scenarios, DPO appointment rules for public entities and certain processing profiles, ROPA maintenance, periodic processor-compliance… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Amber The Law imposes processor-contract requirements (confidentiality clause, controller-instruction-only processing under Article 39), a data-quality/retention obligation, and CDP-maintained public… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Amber The Commissioner has issued a Data Protection Impact Assessment 'blacklist' of processing activities requiring a DPIA under LPDP Articles 54-55, evidencing active accountability tooling. DPO… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Amber Controllers must carry out a Data Protection Impact Assessment where processing is likely to result in high risk to individuals' rights and freedoms, and must, under certain (unspecified)… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Amber Accountability is explicit: while the principle of accountability is currently implied in Sections 11 and 12 of the PDPA, the amendments include an explicit reference to the term… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Green GDPR's accountability regime (Art. 5(2), 24), DPIA regime (Art. 35, with Act 18/2018 Sections 42-43 providing national procedural detail), DPO regime (Art. 37-39), processor rules (Art. 28), security… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Green GDPR accountability, DPIA, DPO, ROPA, security, and breach-notification duties apply directly in Slovenia, supplemented by ZVOP-2's stricter national employment-CCTV standard. Recent enforcement… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber POPIA imposes accountability duties on 'responsible parties' but has no explicit privacy-by-design or DPIA obligation comparable to GDPR Articles 25/35 (best-practice only). Every organisation… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber General accountability, DPIA, DPO, ROPA, and retention obligations do not exist outside the insurance sector. The Insurance Data Security Act imposes security-program, risk-assessment, training, and… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber Outside of breach notification, South Dakota imposes no general statutory duties on controllers or processors regarding DPIAs, DPO appointment, records of processing, joint-controller arrangements… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber PIPA currently mandates DPIAs only for public organisations. A June 2026 draft Enforcement Decree amendment would require board-approved CPO appointment/removal notifications for large processors… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Green GDPR accountability principle applies directly (Art 5(2)), operationalised through ROPA (Art 30), DPIA where risk criteria are met, DPO appointment where GDPR Art 37 / LOPDGDD Art 34 thresholds… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA imposes an accountability framework requiring a Data Protection Management Programme, DPIAs for higher-risk processing, DPO appointment (narrowed by the October 2025 amendment), processor… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber GDPR Arts 5, 24-43 apply directly with SFS 2018:218 Chapter 1 Section 8 supplementing Art 37-39 DPO rules. Enforcement history (Sportadmin, Apoteket/Apohem) shows IMY treats Art 32… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber The revFADP introduces mandatory DPIAs for high-risk processing (Arts 22-23), strengthened security-of-processing obligations (Art 7 FADP baseline), an explicit purpose-limitation-driven… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber Historically, the PDPA imposed lighter controller/processor obligations than the GDPR: no defined DPIA, no DPO concept (only a requirement to assign 'dedicated personnel' for security under Art 18)… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Amber The PDPA is confirmed to impose data-security obligations on controllers/processors, but DPIA triggers, DPO appointment thresholds, ROPA requirements, joint-controller rules, breach-notification… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber TIPA imposes accountability obligations including mandatory Data Protection Assessments (DPAs), a general data-security duty on controllers, and contractual constraints on processors, plus separate… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber TDPSA mandates data-protection (risk) assessments in specified high-risk circumstances. TITEPA, as amended by HB 4390, sets a 60-day breach-disclosure deadline and AG-notification duties for breaches… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Green PDIA-equivalent accountability is indirect: while the GDPR specifically provides for DPIAs, the PDPA outlines that data controllers have a duty to provide appropriate… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red No enforceable accountability, DPIA, DPO, ROPA, security, breach-notification or retention regime is currently operative. The Data Protection Bill, 2024 proposes accountability (clause 25)… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red General accountability, DPO, ROPA, joint-controller, security, breach-notification and retention obligations under Organic Law 2004-63 could not be confirmed with specificity from accessible sources… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Amber The LPPD imposes accountability-adjacent duties (VERBIS registration/inventory, security-of-processing obligations, breach notification) but -- unlike the GDPR -- contains no express DPIA… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber Part 4 of the Act requires reasonable technical/organisational security measures; the Regulations add DPIA obligations for high-risk processing, DPO appointment/qualification detail, registration… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber Controllers handling 'high-risk' data face DPO-appointment, ROPA, and security-measure obligations issued via Ombudsman order. DPIA and breach-notification requirements comparable to GDPR Articles… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber DIFC Law 2020 provides the most detailed accountability, DPIA, DPO, ROPA, breach-notification and privacy-program requirements among the UAE's data protection instruments; ADGM imposes parallel… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber Controllers must demonstrate accountability (Article 5(2)), conduct DPIAs for high-risk processing, appoint DPOs where required, maintain records of processing, secure personal data (Article 32), and… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber Accountability obligations are sector- and state-specific. California's 2026 CCPA regulations introduce risk assessments, automated-decision-making-technology (ADMT) rules, and cybersecurity audit… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber The CPRA introduced accountability-style obligations new to the U.S. state landscape: mandatory risk assessments, cybersecurity audits for higher-risk processing, and contractual flow-down duties on… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber New York imposes concrete security-program and breach-notification duties via the SHIELD Act and, for financial-services entities, the far more detailed NYDFS Cybersecurity Regulation (23 NYCRR Part… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Green The 2018 reform (Law 19.670) introduced an accountability/proactive-responsibility principle requiring controllers and processors to adopt, document, periodically review and evaluate the… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA imposes a general security-practices obligation but expressly omits DPIA/privacy-impact-assessment, DPO-appointment, and ROPA requirements that are standard in Colorado, Connecticut and… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red No findings. Searches run: 'Vanuatu Data Protection and Privacy Act DPO requirements', 'Vanuatu data protection breach notification', 'Vanuatu DPIA ROPA' and the primary Act/gazette text — none… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red No accountability/DPIA regime, DPO requirement, ROPA requirement, or joint-controller framework exists. Security-of-processing obligations are limited to information-security functions under the Ley… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber DPIA, security, and breach-notification duties are split between the not-yet-effective S.71 (DPIAs, processor contracts) and the currently in-force Data Broker security program and Security Breach… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber Decree 356 prescribes DPIA procedures with a five-year opt-in grace period for small businesses/start-ups/micro-enterprises, enhanced reporting/audit tooling consistent with a ROPA-style obligation… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber Controllers must conduct data protection assessments for higher-risk processing (targeted advertising, sale, certain profiling, sensitive data), and processor relationships must be governed by… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber There is no general accountability/DPIA, DPO, ROPA, joint-controller, or security-measures regime in Washington law outside sector-specific requirements. Washington's general data-breach notification… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Amber West Virginia's only enacted controller duty of general applicability is breach notification under W. Va. Code Chapter 46A, Article 2A. Security-of-processing obligations exist only through sectoral… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Amber General controller/processor accountability obligations (DPIA, DPO, ROPA, joint-controller rules, retention limits) are absent in Wisconsin outside the insurance sector. The general… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Amber Wyoming's principal controller/processor duty is breach notification under Wyo. Stat. §40-12-501 et seq. Sectoral federal overlays (GLBA Safeguards Rule for financial institutions; HIPAA Security… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Amber The clearest verified controller/processor duty is the data-auditor licensing requirement under the Registration and Licensing Regulations, 2021. Accountability/DPIA triggers, DPO appointment… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)