Data Protection Monitor · Cross-Jurisdiction Domain Hub
Enforcement & redress
Jurisdiction Readings (167 markets)
44 Confirmed
106 Probable
17 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Amber | The Malabo Convention has been directly criticised for lacking mechanisms to support its enforcement, and no continental enforcement body exists; NADPA-RAPDP is a cooperation/capacity network without… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Green | Enforcement is centralized in the Alabama Attorney General across all identified instruments. The 2018 breach act carries defined civil penalties ($500,000 per breach for knowing violations… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Amber | Enforcement in Alaska is centered on the Attorney General's Consumer Protection Unit, which can bring actions under APIPA and participates in multistate data-breach settlements (e.g., the multistate… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | The OIPC holds binding order-making powers under PIPA (s.52-equivalent authority), not subject to appeal to an external tribunal (only judicial review), and PIPA creates offences including wilfully… | Profile →Brief |
| Algeria (DZ) | Africa | Amber | Secondary reporting corroborates that ANPDP is operationally active, having issued reminders of obligations under Law 18-07 to companies and recommendations on disclosure practices, and that a… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No source located on data-protection-specific maximum fines, procedural/investigation deadlines, appeal routes, complaint-handling duties, representative/collective-action mechanisms, compensation… | Profile →Brief |
| Argentina (AR) | Americas | Green | AAIP exercises active investigative and sanctioning powers under its Guía de Fiscalización (Resolución 332/2020), including planned and spontaneous inspections and the ability to seek judicial… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | The Arizona Attorney General has demonstrated active, real enforcement capacity against deceptive data practices under the Consumer Fraud Act, most notably the 2022 $85 million Google location-data… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Amber | The Arkansas Attorney General holds sanction and penalty power under PIPA and the Deceptive Trade Practices Act and has been highly active in 2024-2026, bringing or continuing enforcement actions… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Amber | There is no bloc-level statutory enforcement power or maximum-penalty regime; the only enforcement-adjacent mechanism is the voluntary Global Cooperation Arrangement for Privacy Enforcement (CAPE… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Green | The OAIC's enforcement toolkit was substantially strengthened by the December 2022 penalty increase (up to $50M/3x benefit/30% turnover for serious/repeated interferences) and the POLA Act 2024's new… | Profile →Brief |
| Austria (AT) | Europe | Amber | The DSB exercises the full suite of GDPR Article 58 investigative and corrective powers, including Article 83 administrative fines up to EUR 20 million or 4% of global annual turnover; its… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Amber | The NDGIA is confirmed as the body responsible for enforcing the Data Protection Ordinance, 2025, and the framework's most significant recent development is its own legislative progression… | Profile →Brief |
| Belgium (BE) | Europe | Green | The Belgian DPA's Litigation Chamber exercises full GDPR Article 58 investigative and Article 83 sanctioning powers (fines up to €20m or 4% of global turnover), subject to appeal before the Market… | Profile →Brief |
| Belize (BZ) | Americas | Amber | The 2024 reform Bill confirms the Commission's investigatory toolkit (information orders, audits, contravention notices), but no maximum-fine figures, procedural/appeal deadlines, collective-redress… | Profile →Brief |
| Brazil (BR) | Americas | Amber | ANPD has sole administrative sanctioning authority under Article 55-K, with penalties (Art. 52) ranging from warnings to fines of up to 2% of Brazil-derived revenue (capped at BRL 50 million per… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | The OIPC BC holds order-making powers under PIPA s. 52 but, unlike Alberta's Lobbyists Transparency Act model the OIPC also administers, PIPA carries no administrative-monetary-penalty (AMP) regime… | Profile →Brief |
| Bulgaria (BG) | Europe | Green | CPDP exercises GDPR Article 58 corrective powers up to the Article 83 maximum fines and has a track record of significant enforcement, including a BGN 5.1 million fine against Bulgaria's National… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | Because no comprehensive DP statute is in force, there is currently no operative enforcement regime, penalty schedule, enforcement activity, or redress mechanism for general data protection in… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | Secondary reporting confirms legislative activity in H2 2024 (Senate introduction of the draft Data Protection bill, and a subsequent report of the bill's adoption in Parliament), consistent with… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | PIPEDA gives the OPC ombudsman-style investigatory powers but no general order-making/administrative-penalty authority; specific statutory offences (failure to retain access-request records… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | The OPC currently operates largely as an ombudsman: it can investigate complaints, issue non-binding recommendations, enter compliance agreements, and apply to the Federal Court (PIPEDA s.15) for a… | Profile →Brief |
| Chile (CL) | Americas | Amber | Under current Ley 19.628, redress is court-based (civil damages actions for patrimonial and moral harm). Ley 21.719 (not yet effective) creates the APDP with instruction, interpretation, supervision… | Profile →Brief |
| China (CN) | Asia-Pacific | Green | PIPL Article 63 grants supervisory authorities broad investigatory powers (interviews, document review, on-site inspection, equipment seizure/confiscation). A two-tier penalty structure applies… | Profile →Brief |
| Colombia (CO) | Americas | Green | The SIC's sanctioning power under Law 1581 allows fines of up to 2,000 legal monthly minimum wages, a significant penalty by Colombian standards. Enforcement activity in the trailing 12 months… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Amber | CPA enforcement rests exclusively with the Colorado Attorney General and District Attorneys; a CPA violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act.… | Profile →Brief |
| Comoros (KM) | Africa | Red | No maximum-fine schedule, investigative-powers regime, enforcement-activity record, collective-redress mechanism, or private-right-of-action was located for the Union of the Comoros, consistent with… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No statutory maximum fines, investigative/decision deadlines, appeal routes, collective-redress mechanism, private right of action, or recent (180-day) enforcement development could be identified for… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No data-protection regulator exists in Comoros, so no DP-specific investigative powers, maximum fines, enforcement record, collective-redress mechanism, or private right of action could be… | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Green | The Attorney General has exclusive enforcement authority; the CTDPA carries civil penalties of up to $5,000 per willful violation under CUTPA, and the statutory 60-day cure period sunset on January… | Profile →Brief |
| Costa Rica (CR) | Americas | Green | PRODHAB may impose administrative fines and issue precautionary measures (medidas cautelares) to secure the effective outcome of rights-protection proceedings, as demonstrated by the August 2023… | Profile →Brief |
| Croatia (HR) | Europe | Green | AZOP holds full GDPR Article 83 fining powers plus national fine caps for local-law violations (e.g., video-surveillance retention up to HRK 50,000). Enforcement activity is well documented over… | Profile →Brief |
| Curaçao (CW) | Caribbean | Red | Because the Data Protection Board provided for under the Ordinance has never been established, there is no dedicated data-protection regulator currently exercising investigative or enforcement powers… | Profile →Brief |
| Cyprus (CY) | Europe | Green | The Commissioner holds standard GDPR Art 58 investigative and corrective powers and Art 83 administrative-fining powers, plus Law 125(I)/2018 criminal offences (punishable by imprisonment) for… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | ÚOOÚ has full GDPR investigative and corrective powers, tempered by a national derogation abolishing fines against public authorities. Enforcement activity includes a landmark EUR ~13.9M fine against… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | The Attorney General may seek civil penalties up to $10,000 per violation plus injunctive relief, restitution and/or disgorgement. A mandatory 60-day right-to-cure period applied through December 31… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Denmark presents a jurisdiction-defining enforcement peculiarity confirmed by the CJEU: Danish law does not permit Datatilsynet to impose administrative fines directly (GDPR Recital 151/Art 83(9))… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Amber | The D.C. Attorney General enforces the breach-notification statute and general consumer-protection law, frequently acting in coalition with other state AGs and the FTC (e.g., the AshleyMadison… | Profile →Brief |
| Dominican Republic (DO) | Americas | Amber | Law 172-13 does not establish an administrative-fine regime comparable to GDPR; redress is primarily judicial. Data subjects whose rights are violated (including via a data breach) may sue the liable… | Profile →Brief |
| Ecuador (EC) | Americas | Green | The EDPS has a full investigative/corrective/authorisation power toolkit under Art 58 (audits, orders, suspension of data flows, administrative fines under Art 66 for non-compliance with EDPS… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Both PDPC administrative processes and the Economic and Ordinary courts may adjudicate PDPL disputes and violations. The most significant recent development is the November 2025 issuance of Executive… | Profile →Brief |
| Estonia (EE) | Europe | Amber | AKI's enforcement toolkit is distinctive within the EU: per GDPR Recital 151, administrative fines are not directly applicable in Estonia; AKI instead relies on precepts/injunctions (often with… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Green | GDPR Article 83 empowers DPAs to impose fines up to €20 million or 4% of global annual turnover, whichever is greater. 2026 enforcement activity remains vigorous, evidenced by the Czech SA's €13.9m… | Profile →Brief |
| Finland (FI) | Europe | Green | The Ombudsman's sanctions board exercises the full GDPR Article 58 investigative/corrective toolkit and Article 83 fining powers, with a sustained and growing enforcement record (Aktia Bank €865,000… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | The AG has exclusive enforcement authority with statutory penalties up to $50,000 per violation (triplable in certain circumstances) and discretionary 45-day cure periods. No private right of action… | Profile →Brief |
| France (FR) | Europe | Green | CNIL enforcement is highly active: 2025 fines totalled €486,839,500 and 2026 has already seen €27m/€15m (Free Mobile/Free), €5m (FRANCE TRAVAIL), €5m (IQVIA) and €1.7m (NEXPUBLICA) sanctions, backed… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Amber | The Georgia AG's Consumer Protection Division enforces the state's general consumer-protection statute (Fair Business Practices Act) and the breach-notification law, and has participated in major… | Profile →Brief |
| Germany (DE) | Europe | Green | BfDI and the 17 Land DPAs hold full Art 58 GDPR investigative and corrective powers, including administrative fines up to the Art 83 GDPR maxima. Enforcement activity is materially active: BfDI's… | Profile →Brief |
| Ghana (GH) | Africa | Amber | The DPC has investigative authority and individuals contravened by a controller are entitled to compensation for damage or distress; the DPC has historically published lists of companies failing to… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | The GRA has demonstrated active investigatory and fining powers, evidenced by two separate fines against the Royal Gibraltar Police (£5,000 in 2020 and £10,000 in 2022) for DPA 2004/GDPR breaches… | Profile →Brief |
| Greece (GR) | Europe | Amber | The HDPA exercises full GDPR Articles 58/83 corrective and sanctioning powers, with fines ranging from €5,000 to €20 million, and Law 4624/2019 caps public-sector fines at €10 million. Enforcement… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | The Law establishes a Part XII enforcement regime (sanctions following breach determination, specific administrative-fine provisions, and statutory limits on administrative fines) and individual… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | ODPA, jointly with the UK ICO, the Jersey Office of the Information Commissioner and the Isle of Man Information Commissioner, launched a coordinated cross-border investigation into the 2025 Prospect… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | The Hawaii Attorney General's Office of Consumer Protection enforces UDAP statutes (HRS chs. 480, 481A) and the breach-notification statute (HRS ch. 487N). The 2026 legislative session shows active… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | The PCPD holds investigative, enforcement-notice, and (post-2021) criminal investigation/prosecution powers for doxxing, with a two-tier anti-doxxing offence carrying fines up to HK$1,000,000 and… | Profile →Brief |
| Hungary (HU) | Europe | Amber | NAIH exercises GDPR Art 58 corrective powers, including binding compliance orders under Privacy Act §56(1). Enforcement activity is well documented (e.g. a HUF 10 million fine in May 2024). Private… | Profile →Brief |
| Iceland (IS) | Europe | Amber | Persónuvernd has a sustained multi-year enforcement record (fines from ISK 1.5M to ISK 12.8M across education, health, employment, and public-sector cases) but operates under acknowledged resource… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Green | Enforcement in Idaho operates through two channels: the Idaho Attorney General's general consumer-protection powers, and federal FTC Section 5 authority, most visibly demonstrated by the FTC's 2026… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | BIPA's private right of action, sharpened by two Illinois Supreme Court decisions (Cothron v. White Castle on per-scan accrual; Tims v. Black Horse Carriers on the 5-year limitations period) and then… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | The DPBI's penalty framework is monetary-only (no criminal penalties), with fines able to reach INR 250 crore (~USD27M) for 'significant' non-compliance, assessed on… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Amber | Enforcement of the ICDPA is exclusively vested in the Attorney General, who must give 30 days' cure notice before suing and is capped at a $7,500 civil penalty per violation; the Act bars any private… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | Enforcement runs exclusively through the Iowa Attorney General with a mandatory 90-day cure period and a per-violation penalty ceiling of $7,500 payable to a consumer education and litigation fund… | Profile →Brief |
| Ireland (IE) | Europe | Green | The DPC is among the most active GDPR enforcers globally, concluding four large-scale cross-border inquiries in 2024 with fines exceeding €652 million, and headline decisions against TikTok (€530m)… | Profile →Brief |
| Isle of Man (IM) | Europe | Green | The Isle of Man Information Commissioner has a demonstrated enforcement track record: enforcement notices against the Department of Home Affairs (2020) and Manx Care (2021) for access-right failures… | Profile →Brief |
| Italy (IT) | Europe | Green | The Garante wields full GDPR Art.58 corrective powers (warnings, orders, bans, fines up to EUR 20M/4% global turnover) and delegated internal procedures (Reg. 1/2019) for time-barred/low-impact… | Profile →Brief |
| Ivory Coast (CI) | Africa | Red | ARTCI's documented activity (controller reminders, an app-privacy communiqué) indicates it exercises supervisory and public-facing enforcement-adjacent functions, but no specific fines… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | PPC enforcement currently relies predominantly on non-coercive tools (guidance, advice, recommendations) with binding orders and criminal sanctions rare; the PPC itself cannot impose administrative… | Profile →Brief |
| Jersey (JE) | Europe | Amber | The DPAJL 2018 gives the JDPA a broad enforcement toolkit (information notices, enforcement notices, warnings, reprimands, practice recommendations, and penalty notices under Article 26), but public… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Amber | Enforcement in Kansas is limited to the Attorney General's Consumer Protection Division acting under the Kansas Consumer Protection Act and breach-notification statute, plus concurrent federal FTC… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Amber | Administrative liability for personal-data violations is grounded in the Code of the Republic of Kazakhstan of 5 July 2014 No. 235-V on Administrative Infractions. The most material recent… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Green | Enforcement runs exclusively through the AG's Office of Data Privacy, with a non-sunsetting 30-day cure period and civil penalties up to $7,500 per uncured violation; there is no private right of… | Profile →Brief |
| Kenya (KE) | Africa | Amber | The ODPC has broad investigative and administrative-fine powers under the Act and Compliance and Enforcement Regulations 2021, including own-initiative or complaint-based investigations… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | Laos has no independent DPA; MTC both implements and coordinates enforcement of the electronic data law, which the World Bank characterizes as creating no separation between rule-setter… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Amber | No bloc-wide investigative powers, penalty schedule, or collective-redress/private-right-of-action mechanism exists; these remain matters for individual national DPA statutes. RIPD Standards do… | Profile →Brief |
| Latvia (LV) | Europe | Green | DVI exercises GDPR Article 58 investigative and corrective powers and Article 83 fining powers, evidenced by a 2019 €7,000 fine (erasure/non-cooperation), a December 2020 €15,000 fine against HH… | Profile →Brief |
| Liechtenstein (LI) | Europe | Amber | The DSS holds full GDPR Article 58 investigative and corrective powers, including the Article 83 administrative-fine framework (up to the higher of a fixed sum or a percentage of worldwide turnover)… | Profile →Brief |
| Lithuania (LT) | Europe | Green | VDAI actively exercises GDPR Art. 83 fining powers, with a notable escalation to a €2.38M fine against Vinted in 2024 alongside multiple smaller fines (Vilnius Municipality, State Enterprise Centre… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | The LDPA (effective 2027-01-01) grants exclusive enforcement authority to the Louisiana Attorney General, treats violations as unfair-or-deceptive trade practices, and includes a sunsetting 30-day… | Profile →Brief |
| Luxembourg (LU) | Europe | Green | CNPD's headline enforcement action is the 16 July 2021 €746 million fine against Amazon Europe Core — among the largest GDPR fines issued to date — originating from a collective complaint lodged with… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | The Maine Attorney General enforces the state's data-breach and consumer-protection statutes but lacks a defined civil-penalty schedule specific to data privacy comparable to omnibus-state laws; the… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The Amendment Act materially strengthens the Commissioner's enforcement toolkit: fines for violations rise to up to MYR1 million, imprisonment terms extend to up to three years, and the Commissioner… | Profile →Brief |
| Malta (MT) | Europe | Amber | The IDPC has GDPR Chapter VI/VII investigative and corrective powers, backed by Article 21 Act administrative fines, up to the GDPR Article 83 maximum (4% global turnover / €20m). Enforcement… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No general data-protection regulator exists, so no Art 83/84-style administrative fine tier, cross-border procedural rule, or representative/class-action mechanism for data-protection complaints… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | The Maryland AG has exclusive MODPA enforcement authority operating through the state Consumer Protection Act framework, including a discretionary 60-day cure period sunsetting in 2027, and no… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | Enforcement touching Massachusetts data practices is bifurcated: the state AG enforces the Consumer Protection Act (Chapter 93A) and the Data Breach Law (Chapter 93H) through a dedicated Data Privacy… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Enforcement authority has migrated from the dissolved, formerly autonomous INAI to the Secretaría Anticorrupción y Buen Gobierno; judicial review of regulator decisions shifted from nullity trials to… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | The FTC's Section 5 authority provides the principal enforcement lever nationally, with recent 2026 actions (RentGrow, Amazon, Kochava, Illuminate Education) demonstrating ongoing activity relevant… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | The AGO holds exclusive investigative and enforcement authority, able to seek injunctive relief, litigation expenses, and civil penalties up to $7,500 per violation; the Act carries no private right… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Amber | Enforcement in Mississippi runs through two parallel tracks: (1) the Mississippi Attorney General's authority under the Mississippi Consumer Protection Act, which permits injunctive relief and civil… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | The Missouri Attorney General holds exclusive statutory authority to bring actions for willful and knowing violations of §407.1500, seeking actual damages; the statute does not appear to create a… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | The Montana Attorney General has exclusive enforcement authority, can compel disclosure of DPIAs relevant to an investigation (which remain confidential/FOIA-exempt), and evaluate compliance. SB 297… | Profile →Brief |
| Morocco (MA) | Africa | Amber | The Morocco-EU gap analysis identified limits on the powers granted to CNDP as a divergence from the GDPR enforcement framework. CNDP nonetheless reached a January 2019 agreement with Morocco's… | Profile →Brief |
| Mozambique (MZ) | Africa | Amber | No dedicated data-protection regulator exists, so there are no data-protection-specific investigative/enforcement powers, fine schedules, or enforcement-activity index. Sanctions for privacy-related… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | Enforcement is criminal/administrative and sector-specific rather than centralised in a data protection authority. The Privacy Law imposes imprisonment and fines for violations of its… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | Enforcement of the NDPA and related privacy statutes runs exclusively through the Nebraska Attorney General (currently Mike Hilgers, in office since 2022); the NDPA lacks a private right of action… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | In the absence of a designated data-protection authority, no DP-specific investigative/enforcement powers, penalty schedule, enforcement-activity record, regulator funding signal, collective-redress… | Profile →Brief |
| Netherlands (NL) | Europe | Green | The AP exercises the full GDPR Article 58 investigative and corrective toolkit and has published a four-tier fining structure ranging up to €1,000,000 per category (with higher fines possible where… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | The Nevada Attorney General holds exclusive enforcement authority across NRS 603A, SB 220, and SB 370, with civil penalties of up to $5,000 per violation and access to injunctive relief in district… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Green | Enforcement architecture is well documented: the OPC cannot itself levy fines or prosecute PIPEDA offences, instead referring matters to the Attorney General of Canada, while knowing violations of… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Green | The AG holds exclusive NHDPA enforcement authority with civil penalties up to $10,000 per violation and criminal penalties up to $100,000 per violation for purposeful non-compliance; the NHDPA itself… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | Enforcement authority rests exclusively with the New Jersey Attorney General/Division of Consumer Affairs; the NJDPL carries no private right of action. A statutory notice-and-cure period applied… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Amber | Enforcement in New Mexico proceeds through the Attorney General's general consumer-protection authority (Unfair Practices Act) and the Data Breach Notification Act, supplemented by FTC Section 5… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Amber | The OPC can issue compliance notices and binding/enforceable access directions, and can investigate complaints, but criminal offences under the Act (e.g., failure to notify a serious breach… | Profile →Brief |
| Nigeria (NG) | Africa | Green | The NDPC has express complaint-investigation powers (Section 46), compliance-order powers (Section 47), and enforcement-order/penalty powers (Section 48) under the NDPA. Penalties for DCPMI… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Amber | Enforcement in North Carolina is bifurcated between the state Attorney General (breach-notification and general consumer-protection actions) and the FTC (Section 5 deceptive-practices actions). North… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Amber | The North Dakota Attorney General enforces the breach-notification statute and general consumer-protection law; the FTC exercises concurrent federal Section 5 authority nationally. No ND-specific… | Profile →Brief |
| Norway (NO) | Europe | Green | Datatilsynet is a demonstrably active enforcer, with a track record of significant fines (Storting EUR 200k/2022, SATS NOK 10m/2023, Kristiansand NOK 250k/2025, six-website tracking-pixel case… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Amber | Enforcement in Ohio is carried out principally by the Ohio Attorney General under general consumer-protection authority and by the FTC under Section 5, rather than under a dedicated… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Amber | Under SB 546, enforcement will be exclusive to the Oklahoma Attorney General, with a non-sunsetting 30-day cure period and no private right of action. Current in-force enforcement relies on FTC… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | Enforcement is bifurcated: the federal OPC operates largely as an ombudsman under PIPEDA with no direct order-making or fining power — it can investigate, issue findings, refer offences to the… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Green | The Oregon AG holds exclusive OCPA enforcement authority, with civil penalties up to $7,500 per violation plus injunctive relief, restitution and disgorgement; there is no private right of action.… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted enforcement regime, regulator powers/penalties, collective-redress mechanism, or private right of action specific to data protection exists, because no comprehensive statute is in force.… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | Because no dedicated data-protection authority or statute could be located for Palau, no maximum-fine tier, investigation/decision deadline, complaint-handling duty, representative/collective-action… | Profile →Brief |
| Panama (PA) | Americas | Amber | ANTAI's Dirección de Protección de Datos Personales holds investigative and sanctioning powers over natural and legal persons violating Law 81, with fines ranging from B/.1,000 to B/.10,000 and… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Amber | The UTPCPL gives the Pennsylvania AG power to bring enforcement actions against companies for large data breaches attributable to inadequate cybersecurity practices, and creates a private cause of… | Profile →Brief |
| Peru (PE) | Americas | Green | ANPD's sanctioning powers are graded into leve (0.5-5 UIT), grave and muy grave (up to 50-100 UIT for the most serious infractions, e.g. unlawful-source data collection or mishandling sensitive data)… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | The NPC has corrective and investigative powers comparable to GDPR authorities. Administrative fines are capped at 5,000,000 pesos per controller/processor regardless of the number of violations… | Profile →Brief |
| Poland (PL) | Europe | Green | UODO has broad GDPR Article 58 corrective powers, including administrative fines, which it has used extensively across public and private sector controllers since 2019. Recent 12-month enforcement… | Profile →Brief |
| Portugal (PT) | Europe | Green | The CNPD holds full GDPR Art 58 investigative/corrective powers and Art 83 fining authority (up to €20M / 4% global turnover for the most serious offences, per the national implementing law).… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | The QFC Data Protection Office holds investigative and enforcement powers under Article 33, with general penalty conditions set at Article 36 and a maximum fine of USD 1.5 million; Article 34 grants… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Green | CAI holds the only administrative-monetary-penalty (AMP) power among Canadian privacy regulators (up to CAD $25M/4% global turnover for organizations), plus notice-of-noncompliance powers, alongside… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | The Rhode Island Attorney General holds exclusive RIDTPPA enforcement authority; RIDTPPA explicitly forecloses any private right of action. Notably, RIDTPPA also omits a statutory right-to-cure… | Profile →Brief |
| Romania (RO) | Europe | Amber | ANSPDCP actively exercises GDPR Article 58 investigative and corrective powers and Article 83 fining powers; recent 2026 decisions include fines against an individual website operator (RON 50,890)… | Profile →Brief |
| Russia (RU) | Europe | Amber | Roskomnadzor holds broad investigative and remedial powers (rectify/block/destroy orders, processing-suspension orders, court referral, and website-blocking), with the maximum single administrative… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | Chapter IX of the law (Articles 64-72) grants the NCSA administrative-sanction powers and creates criminal offences with monetary fines (e.g., 5,000,000-10,000,000 RWF for unlawful… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | SDAIA enforcement matured markedly in 2025-2026: specialized quasi-judicial committees issued 48 decisions in the year preceding a February 2026 report, covering unlawful processing, insufficient… | Profile →Brief |
| Senegal (SN) | Africa | Amber | The CDP holds meaningful administrative sanction powers (authorisation withdrawal, fines from XOF 1,000,000 to XOF 100,000,000, processing prohibitions) plus judicial-track sanctions and an… | Profile →Brief |
| Serbia (RS) | Europe | Green | Serbia's DPA can issue warnings, order correction/deletion of unlawfully processed data, and directly fine controllers/processors for certain misdemeanors (850 euros), while the Court of Offences… | Profile →Brief |
| Seychelles (SC) | Africa | Amber | The Information Commission has the power to enforce and implement the Act, including imposing fines, and the Act provides data subjects a right to compensation. Maximum fine tiers/turnover… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Green | Financial penalties were substantially increased in 2022: <cite index="20-2">the financial penalty cap which may be imposed on organisations for breaches under the PDPA has increased from the… | Profile →Brief |
| Slovakia (SK) | Europe | Amber | GDPR Arts. 58 and 83 grant the ÚOOÚ SR investigative, corrective and administrative-fining powers (up to the higher of €20 million or 4% of global annual turnover for the most serious infringements)… | Profile →Brief |
| Slovenia (SI) | Europe | Green | The Information Commissioner holds full GDPR Article 58/83 investigative and corrective powers, including fines up to the GDPR maxima. Enforcement activity in the reporting window includes the 2024… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | The Information Regulator has enforcement powers including a Section 50 Enforcement Committee (established 2022) and investigative/complaint-handling processes under Sections 89-93; POPIA also… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | The South Carolina Attorney General enforces H.3431 with severe statutory penalties and, for dark-pattern violations, a private right of action via the state's general consumer-protection statute.… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | The FTC holds broad federal investigative and enforcement powers under Section 5 reaching South Dakota-based conduct, while the South Dakota Attorney General enforces the state's breach-notification… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | The PIPC has demonstrated sustained, aggressive enforcement, including a KRW 252 million fine against Apple (July 23, 2026) over unauthorized Siri voice-data collection and the KRW 8.3 billion Kakao… | Profile →Brief |
| Spain (ES) | Europe | Amber | AEPD holds full Art 58 GDPR corrective powers (reprimand, order, ban, fine) exercised via LOPDGDD-specific sanctioning procedure (Art 63-65), with decisions appealable to the Audiencia Nacional. 2025… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA gives the Authority power to impose financial penalties (payable into the Consolidated Fund) enforceable through the Magistrate Court of Colombo for non-payment, and other regulatory… | Profile →Brief |
| Sweden (SE) | Europe | Amber | IMY can issue warnings, reprimands, cease-processing orders and administrative fines, with a public-authority-specific cap (SEK 5m/10m). Its decisions are appealable. 2025-2026 enforcement activity… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | The FDPIC can open investigations ex officio or on complaint against controllers and processors and, since the revFADP, may issue binding orders at the conclusion of an investigation — a marked… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | Regulators (historically the NDC-coordinated Competent Regulators, transitioning to the PDPC) hold corrective and investigatory powers, including fines, corrective orders, and on-site inspections.… | Profile →Brief |
| Tanzania (TZ) | Africa | Green | The PDPC has moved from a legislative/regulatory-publication phase into active enforcement, beginning registration of data collectors and processors and announcing that mandatory registration will be… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | TIPA enforcement is vested exclusively in the Tennessee Attorney General, who must afford covered entities a nonsunsetting 60-day cure period before initiating an action; the statute offers an… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Green | TDPSA vests exclusive enforcement in the Texas AG, capped at $7,500 per violation with a 30-day cure period, and creates no private right of action; TRAIGA similarly is AG-exclusive with much larger… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Green | <cite index="25-8">The Expert Committee is authorized to consider complaints, investigate and impose punitive measures for PDPA violations.</cite> <cite index="5-14">Violations of the PDPA can… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | The DPA 2011 contemplates fines and criminal liability once fully proclaimed, and the 2024 Bill proposes continuation of an Appeals Tribunal, but no enforcement regime is currently operative given… | Profile →Brief |
| Tunisia (TN) | Africa | Red | INPDP's investigative/enforcement powers, maximum penalty levels, and enforcement-activity record over the last 12 months could not be confirmed from accessible sources. Weak secondary signals… | Profile →Brief |
| Turkey (TR) | Europe | Amber | KVKK has broad investigative and sanctioning powers under Article 18 of the LPPD, with four fine tiers (failure to inform; data-security failures; non-compliance with Board decisions; VERBIS… | Profile →Brief |
| Uganda (UG) | Africa | Green | The PDPO/NITA-U has become progressively active: it can investigate complaints and assign compensation (Section 31), and the Act criminalises unlawful obtaining/disclosure and sale of personal data… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | The Ombudsman may conduct compliance audits and issue administrative protocols enforceable in court under Article 188 of the Code of Administrative Offences; a documented 2020 enforcement action… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | The DIFC Commissioner has clear, exercised administrative-fine, investigation, and complaint/mediation powers, with 88 fines reported issued since late-2020 regulations took effect. Broader UAE… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Green | The ICO can issue fines of up to £17.5m or 4% of global annual turnover for UK GDPR/DPA 2018 breaches, with the DUAA also raising PECR fines to the same ceiling. 2026 enforcement activity has been… | Profile →Brief |
| United States (US) | Americas | Amber | US enforcement is multi-layered and increasingly coordinated: the FTC uses Section 5, COPPA, PADFAA, and sectoral rules against national targets (Kochava, Match/OkCupid, data brokers), while… | Profile →Brief |
| United States — California (US-CA) | Americas | Green | The CPPA and Attorney General share dual civil/administrative enforcement authority, with a maximum administrative fine of $2,500 per violation ($7,500 per intentional violation, with enhanced… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | The NY AG has robust civil-penalty and injunctive powers under the SHIELD Act ($5,000 per security violation; $20 per failed-notification instance capped at $250,000) but SHIELD expressly excludes a… | Profile →Brief |
| Uruguay (UY) | Americas | Amber | URCDP holds a graduated sanctioning power ranging from observations and warnings through database closure and fines, set out in implementing decree provisions. Data subjects retain a private right of… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The Utah Attorney General holds exclusive UCPA enforcement authority, subject to a mandatory 30-day cure period, with penalties capped at $7,500 per violation plus actual damages and available… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | A regulator (Deputy Commissioner of Data Protection and Privacy) exists under the Act, implying some enforcement function, but maximum-fine tiers, investigation/decision deadlines, appeal routes… | Profile →Brief |
| Venezuela (VE) | Americas | Red | There is no regulator with investigative or enforcement powers over data-protection matters, and consequently no penalty schedule, no tracked enforcement activity, and no dedicated regulator… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | Current enforcement rests on Data Broker Act penalties and general Consumer Protection Act unfair/deceptive authority, evidenced by the ongoing Clearview AI suit and a $264,000 breach-notification… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | The PDPL sets tiered administrative/criminal penalties (up to 10x illicit gains for unlawful data trading; up to 5% of prior-year revenue for cross-border violations; up to VND 3 billion for other… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | Enforcement is vested exclusively in the Virginia Attorney General with a 30-day cure period, penalties up to $7,500 per violation plus injunctive relief, and no private right of action or… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | The My Health My Data Act's most consequential enforcement feature is its broad private right of action, enforceable under Washington's Consumer Protection Act, which dispenses with the CPA's usual… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Amber | Enforcement of West Virginia's breach-notification statute rests with the state Attorney General; the FTC provides the federal enforcement backstop under Section 5. No comprehensive-privacy-law… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Amber | Enforcement in Wisconsin is federally driven: the FTC exercises civil investigative demand and penalty-offense authority (civil penalties up to USD50,120 per violation) under Section 5, and has taken… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Amber | Enforcement in Wyoming rests with the AG's Consumer Protection Unit (breach notification, UDAP) and the FTC (Section 5, GLBA, COPPA). No private right of action was confirmed under the Wyoming breach… | Profile →Brief |
| Zambia (ZM) | Africa | Amber | The Data Protection Commissioner holds a confirmed registration/licensing power under SI 58/2021. Beyond this, maximum-penalty figures, enforcement-activity history, regulator funding/capacity… | Profile →Brief |