--- title: "Enforcement & redress — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/enforcement-and-redress/ source_html: /domains/enforcement-and-redress/index.html description: "Cross-jurisdiction comparison of Enforcement & redress across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 511ea3d74553e9aa6bdecbc30895d10407e6805dac8f1b77fb26f0bafe923879 generator: "fe-fleet/md-twin@1.0" --- # Enforcement & redress — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 44 Confirmed 106 Probable 17 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Amber The Malabo Convention has been directly criticised for lacking mechanisms to support its enforcement, and no continental enforcement body exists; NADPA-RAPDP is a cooperation/capacity network without… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Green Enforcement is centralized in the Alabama Attorney General across all identified instruments. The 2018 breach act carries defined civil penalties ($500,000 per breach for knowing violations… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Amber Enforcement in Alaska is centered on the Attorney General's Consumer Protection Unit, which can bring actions under APIPA and participates in multistate data-breach settlements (e.g., the multistate… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber The OIPC holds binding order-making powers under PIPA (s.52-equivalent authority), not subject to appeal to an external tribunal (only judicial review), and PIPA creates offences including wilfully… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Amber Secondary reporting corroborates that ANPDP is operationally active, having issued reminders of obligations under Law 18-07 to companies and recommendations on disclosure practices, and that a… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No source located on data-protection-specific maximum fines, procedural/investigation deadlines, appeal routes, complaint-handling duties, representative/collective-action mechanisms, compensation… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Green AAIP exercises active investigative and sanctioning powers under its Guía de Fiscalización (Resolución 332/2020), including planned and spontaneous inspections and the ability to seek judicial… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber The Arizona Attorney General has demonstrated active, real enforcement capacity against deceptive data practices under the Consumer Fraud Act, most notably the 2022 $85 million Google location-data… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Amber The Arkansas Attorney General holds sanction and penalty power under PIPA and the Deceptive Trade Practices Act and has been highly active in 2024-2026, bringing or continuing enforcement actions… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Amber There is no bloc-level statutory enforcement power or maximum-penalty regime; the only enforcement-adjacent mechanism is the voluntary Global Cooperation Arrangement for Privacy Enforcement (CAPE… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Green The OAIC's enforcement toolkit was substantially strengthened by the December 2022 penalty increase (up to $50M/3x benefit/30% turnover for serious/repeated interferences) and the POLA Act 2024's new… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber The DSB exercises the full suite of GDPR Article 58 investigative and corrective powers, including Article 83 administrative fines up to EUR 20 million or 4% of global annual turnover; its… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Amber The NDGIA is confirmed as the body responsible for enforcing the Data Protection Ordinance, 2025, and the framework's most significant recent development is its own legislative progression… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green The Belgian DPA's Litigation Chamber exercises full GDPR Article 58 investigative and Article 83 sanctioning powers (fines up to €20m or 4% of global turnover), subject to appeal before the Market… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Amber The 2024 reform Bill confirms the Commission's investigatory toolkit (information orders, audits, contravention notices), but no maximum-fine figures, procedural/appeal deadlines, collective-redress… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber ANPD has sole administrative sanctioning authority under Article 55-K, with penalties (Art. 52) ranging from warnings to fines of up to 2% of Brazil-derived revenue (capped at BRL 50 million per… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber The OIPC BC holds order-making powers under PIPA s. 52 but, unlike Alberta's Lobbyists Transparency Act model the OIPC also administers, PIPA carries no administrative-monetary-penalty (AMP) regime… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Green CPDP exercises GDPR Article 58 corrective powers up to the Article 83 maximum fines and has a track record of significant enforcement, including a BGN 5.1 million fine against Bulgaria's National… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red Because no comprehensive DP statute is in force, there is currently no operative enforcement regime, penalty schedule, enforcement activity, or redress mechanism for general data protection in… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber Secondary reporting confirms legislative activity in H2 2024 (Senate introduction of the draft Data Protection bill, and a subsequent report of the bill's adoption in Parliament), consistent with… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber PIPEDA gives the OPC ombudsman-style investigatory powers but no general order-making/administrative-penalty authority; specific statutory offences (failure to retain access-request records… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber The OPC currently operates largely as an ombudsman: it can investigate complaints, issue non-binding recommendations, enter compliance agreements, and apply to the Federal Court (PIPEDA s.15) for a… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Under current Ley 19.628, redress is court-based (civil damages actions for patrimonial and moral harm). Ley 21.719 (not yet effective) creates the APDP with instruction, interpretation, supervision… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Green PIPL Article 63 grants supervisory authorities broad investigatory powers (interviews, document review, on-site inspection, equipment seizure/confiscation). A two-tier penalty structure applies… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Green The SIC's sanctioning power under Law 1581 allows fines of up to 2,000 legal monthly minimum wages, a significant penalty by Colombian standards. Enforcement activity in the trailing 12 months… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Amber CPA enforcement rests exclusively with the Colorado Attorney General and District Attorneys; a CPA violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act.… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No maximum-fine schedule, investigative-powers regime, enforcement-activity record, collective-redress mechanism, or private-right-of-action was located for the Union of the Comoros, consistent with… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No statutory maximum fines, investigative/decision deadlines, appeal routes, collective-redress mechanism, private right of action, or recent (180-day) enforcement development could be identified for… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No data-protection regulator exists in Comoros, so no DP-specific investigative powers, maximum fines, enforcement record, collective-redress mechanism, or private right of action could be… [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Green The Attorney General has exclusive enforcement authority; the CTDPA carries civil penalties of up to $5,000 per willful violation under CUTPA, and the statutory 60-day cure period sunset on January… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Green PRODHAB may impose administrative fines and issue precautionary measures (medidas cautelares) to secure the effective outcome of rights-protection proceedings, as demonstrated by the August 2023… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Green AZOP holds full GDPR Article 83 fining powers plus national fine caps for local-law violations (e.g., video-surveillance retention up to HRK 50,000). Enforcement activity is well documented over… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red Because the Data Protection Board provided for under the Ordinance has never been established, there is no dedicated data-protection regulator currently exercising investigative or enforcement powers… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Green The Commissioner holds standard GDPR Art 58 investigative and corrective powers and Art 83 administrative-fining powers, plus Law 125(I)/2018 criminal offences (punishable by imprisonment) for… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green ÚOOÚ has full GDPR investigative and corrective powers, tempered by a national derogation abolishing fines against public authorities. Enforcement activity includes a landmark EUR ~13.9M fine against… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber The Attorney General may seek civil penalties up to $10,000 per violation plus injunctive relief, restitution and/or disgorgement. A mandatory 60-day right-to-cure period applied through December 31… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Denmark presents a jurisdiction-defining enforcement peculiarity confirmed by the CJEU: Danish law does not permit Datatilsynet to impose administrative fines directly (GDPR Recital 151/Art 83(9))… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Amber The D.C. Attorney General enforces the breach-notification statute and general consumer-protection law, frequently acting in coalition with other state AGs and the FTC (e.g., the AshleyMadison… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Amber Law 172-13 does not establish an administrative-fine regime comparable to GDPR; redress is primarily judicial. Data subjects whose rights are violated (including via a data breach) may sue the liable… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green The EDPS has a full investigative/corrective/authorisation power toolkit under Art 58 (audits, orders, suspension of data flows, administrative fines under Art 66 for non-compliance with EDPS… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber Both PDPC administrative processes and the Economic and Ordinary courts may adjudicate PDPL disputes and violations. The most significant recent development is the November 2025 issuance of Executive… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Amber AKI's enforcement toolkit is distinctive within the EU: per GDPR Recital 151, administrative fines are not directly applicable in Estonia; AKI instead relies on precepts/injunctions (often with… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Green GDPR Article 83 empowers DPAs to impose fines up to €20 million or 4% of global annual turnover, whichever is greater. 2026 enforcement activity remains vigorous, evidenced by the Czech SA's €13.9m… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Green The Ombudsman's sanctions board exercises the full GDPR Article 58 investigative/corrective toolkit and Article 83 fining powers, with a sustained and growing enforcement record (Aktia Bank €865,000… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber The AG has exclusive enforcement authority with statutory penalties up to $50,000 per violation (triplable in certain circumstances) and discretionary 45-day cure periods. No private right of action… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Green CNIL enforcement is highly active: 2025 fines totalled €486,839,500 and 2026 has already seen €27m/€15m (Free Mobile/Free), €5m (FRANCE TRAVAIL), €5m (IQVIA) and €1.7m (NEXPUBLICA) sanctions, backed… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Amber The Georgia AG's Consumer Protection Division enforces the state's general consumer-protection statute (Fair Business Practices Act) and the breach-notification law, and has participated in major… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Green BfDI and the 17 Land DPAs hold full Art 58 GDPR investigative and corrective powers, including administrative fines up to the Art 83 GDPR maxima. Enforcement activity is materially active: BfDI's… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The DPC has investigative authority and individuals contravened by a controller are entitled to compensation for damage or distress; the DPC has historically published lists of companies failing to… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber The GRA has demonstrated active investigatory and fining powers, evidenced by two separate fines against the Royal Gibraltar Police (£5,000 in 2020 and £10,000 in 2022) for DPA 2004/GDPR breaches… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Amber The HDPA exercises full GDPR Articles 58/83 corrective and sanctioning powers, with fines ranging from €5,000 to €20 million, and Law 4624/2019 caps public-sector fines at €10 million. Enforcement… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber The Law establishes a Part XII enforcement regime (sanctions following breach determination, specific administrative-fine provisions, and statutory limits on administrative fines) and individual… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber ODPA, jointly with the UK ICO, the Jersey Office of the Information Commissioner and the Isle of Man Information Commissioner, launched a coordinated cross-border investigation into the 2025 Prospect… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber The Hawaii Attorney General's Office of Consumer Protection enforces UDAP statutes (HRS chs. 480, 481A) and the breach-notification statute (HRS ch. 487N). The 2026 legislative session shows active… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber The PCPD holds investigative, enforcement-notice, and (post-2021) criminal investigation/prosecution powers for doxxing, with a two-tier anti-doxxing offence carrying fines up to HK$1,000,000 and… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber NAIH exercises GDPR Art 58 corrective powers, including binding compliance orders under Privacy Act §56(1). Enforcement activity is well documented (e.g. a HUF 10 million fine in May 2024). Private… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber Persónuvernd has a sustained multi-year enforcement record (fines from ISK 1.5M to ISK 12.8M across education, health, employment, and public-sector cases) but operates under acknowledged resource… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Green Enforcement in Idaho operates through two channels: the Idaho Attorney General's general consumer-protection powers, and federal FTC Section 5 authority, most visibly demonstrated by the FTC's 2026… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber BIPA's private right of action, sharpened by two Illinois Supreme Court decisions (Cothron v. White Castle on per-scan accrual; Tims v. Black Horse Carriers on the 5-year limitations period) and then… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber The DPBI's penalty framework is monetary-only (no criminal penalties), with fines able to reach INR 250 crore (~USD27M) for 'significant' non-compliance, assessed on… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Amber Enforcement of the ICDPA is exclusively vested in the Attorney General, who must give 30 days' cure notice before suing and is capped at a $7,500 civil penalty per violation; the Act bars any private… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber Enforcement runs exclusively through the Iowa Attorney General with a mandatory 90-day cure period and a per-violation penalty ceiling of $7,500 payable to a consumer education and litigation fund… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Green The DPC is among the most active GDPR enforcers globally, concluding four large-scale cross-border inquiries in 2024 with fines exceeding €652 million, and headline decisions against TikTok (€530m)… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Green The Isle of Man Information Commissioner has a demonstrated enforcement track record: enforcement notices against the Department of Home Affairs (2020) and Manx Care (2021) for access-right failures… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Green The Garante wields full GDPR Art.58 corrective powers (warnings, orders, bans, fines up to EUR 20M/4% global turnover) and delegated internal procedures (Reg. 1/2019) for time-barred/low-impact… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red ARTCI's documented activity (controller reminders, an app-privacy communiqué) indicates it exercises supervisory and public-facing enforcement-adjacent functions, but no specific fines… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber PPC enforcement currently relies predominantly on non-coercive tools (guidance, advice, recommendations) with binding orders and criminal sanctions rare; the PPC itself cannot impose administrative… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Amber The DPAJL 2018 gives the JDPA a broad enforcement toolkit (information notices, enforcement notices, warnings, reprimands, practice recommendations, and penalty notices under Article 26), but public… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Amber Enforcement in Kansas is limited to the Attorney General's Consumer Protection Division acting under the Kansas Consumer Protection Act and breach-notification statute, plus concurrent federal FTC… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Amber Administrative liability for personal-data violations is grounded in the Code of the Republic of Kazakhstan of 5 July 2014 No. 235-V on Administrative Infractions. The most material recent… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Green Enforcement runs exclusively through the AG's Office of Data Privacy, with a non-sunsetting 30-day cure period and civil penalties up to $7,500 per uncured violation; there is no private right of… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber The ODPC has broad investigative and administrative-fine powers under the Act and Compliance and Enforcement Regulations 2021, including own-initiative or complaint-based investigations… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red Laos has no independent DPA; MTC both implements and coordinates enforcement of the electronic data law, which the World Bank characterizes as creating no separation between rule-setter… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber No bloc-wide investigative powers, penalty schedule, or collective-redress/private-right-of-action mechanism exists; these remain matters for individual national DPA statutes. RIPD Standards do… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Green DVI exercises GDPR Article 58 investigative and corrective powers and Article 83 fining powers, evidenced by a 2019 €7,000 fine (erasure/non-cooperation), a December 2020 €15,000 fine against HH… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Amber The DSS holds full GDPR Article 58 investigative and corrective powers, including the Article 83 administrative-fine framework (up to the higher of a fixed sum or a percentage of worldwide turnover)… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Green VDAI actively exercises GDPR Art. 83 fining powers, with a notable escalation to a €2.38M fine against Vinted in 2024 alongside multiple smaller fines (Vilnius Municipality, State Enterprise Centre… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber The LDPA (effective 2027-01-01) grants exclusive enforcement authority to the Louisiana Attorney General, treats violations as unfair-or-deceptive trade practices, and includes a sunsetting 30-day… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Green CNPD's headline enforcement action is the 16 July 2021 €746 million fine against Amazon Europe Core — among the largest GDPR fines issued to date — originating from a collective complaint lodged with… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Amber The Maine Attorney General enforces the state's data-breach and consumer-protection statutes but lacks a defined civil-penalty schedule specific to data privacy comparable to omnibus-state laws; the… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Amber The Amendment Act materially strengthens the Commissioner's enforcement toolkit: fines for violations rise to up to MYR1 million, imprisonment terms extend to up to three years, and the Commissioner… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Amber The IDPC has GDPR Chapter VI/VII investigative and corrective powers, backed by Article 21 Act administrative fines, up to the GDPR Article 83 maximum (4% global turnover / €20m). Enforcement… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red No general data-protection regulator exists, so no Art 83/84-style administrative fine tier, cross-border procedural rule, or representative/class-action mechanism for data-protection complaints… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber The Maryland AG has exclusive MODPA enforcement authority operating through the state Consumer Protection Act framework, including a discretionary 60-day cure period sunsetting in 2027, and no… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Amber Enforcement touching Massachusetts data practices is bifurcated: the state AG enforces the Consumer Protection Act (Chapter 93A) and the Data Breach Law (Chapter 93H) through a dedicated Data Privacy… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Amber Enforcement authority has migrated from the dissolved, formerly autonomous INAI to the Secretaría Anticorrupción y Buen Gobierno; judicial review of regulator decisions shifted from nullity trials to… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Amber The FTC's Section 5 authority provides the principal enforcement lever nationally, with recent 2026 actions (RentGrow, Amazon, Kochava, Illuminate Education) demonstrating ongoing activity relevant… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Amber The AGO holds exclusive investigative and enforcement authority, able to seek injunctive relief, litigation expenses, and civil penalties up to $7,500 per violation; the Act carries no private right… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Amber Enforcement in Mississippi runs through two parallel tracks: (1) the Mississippi Attorney General's authority under the Mississippi Consumer Protection Act, which permits injunctive relief and civil… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Amber The Missouri Attorney General holds exclusive statutory authority to bring actions for willful and knowing violations of §407.1500, seeking actual damages; the statute does not appear to create a… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Amber The Montana Attorney General has exclusive enforcement authority, can compel disclosure of DPIAs relevant to an investigation (which remain confidential/FOIA-exempt), and evaluate compliance. SB 297… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Amber The Morocco-EU gap analysis identified limits on the powers granted to CNDP as a divergence from the GDPR enforcement framework. CNDP nonetheless reached a January 2019 agreement with Morocco's… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Amber No dedicated data-protection regulator exists, so there are no data-protection-specific investigative/enforcement powers, fine schedules, or enforcement-activity index. Sanctions for privacy-related… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red Enforcement is criminal/administrative and sector-specific rather than centralised in a data protection authority. The Privacy Law imposes imprisonment and fines for violations of its… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber Enforcement of the NDPA and related privacy statutes runs exclusively through the Nebraska Attorney General (currently Mike Hilgers, in office since 2022); the NDPA lacks a private right of action… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red In the absence of a designated data-protection authority, no DP-specific investigative/enforcement powers, penalty schedule, enforcement-activity record, regulator funding signal, collective-redress… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green The AP exercises the full GDPR Article 58 investigative and corrective toolkit and has published a four-tier fining structure ranging up to €1,000,000 per category (with higher fines possible where… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber The Nevada Attorney General holds exclusive enforcement authority across NRS 603A, SB 220, and SB 370, with civil penalties of up to $5,000 per violation and access to injunctive relief in district… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Green Enforcement architecture is well documented: the OPC cannot itself levy fines or prosecute PIPEDA offences, instead referring matters to the Attorney General of Canada, while knowing violations of… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Green The AG holds exclusive NHDPA enforcement authority with civil penalties up to $10,000 per violation and criminal penalties up to $100,000 per violation for purposeful non-compliance; the NHDPA itself… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Amber Enforcement authority rests exclusively with the New Jersey Attorney General/Division of Consumer Affairs; the NJDPL carries no private right of action. A statutory notice-and-cure period applied… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Amber Enforcement in New Mexico proceeds through the Attorney General's general consumer-protection authority (Unfair Practices Act) and the Data Breach Notification Act, supplemented by FTC Section 5… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Amber The OPC can issue compliance notices and binding/enforceable access directions, and can investigate complaints, but criminal offences under the Act (e.g., failure to notify a serious breach… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Green The NDPC has express complaint-investigation powers (Section 46), compliance-order powers (Section 47), and enforcement-order/penalty powers (Section 48) under the NDPA. Penalties for DCPMI… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Amber Enforcement in North Carolina is bifurcated between the state Attorney General (breach-notification and general consumer-protection actions) and the FTC (Section 5 deceptive-practices actions). North… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Amber The North Dakota Attorney General enforces the breach-notification statute and general consumer-protection law; the FTC exercises concurrent federal Section 5 authority nationally. No ND-specific… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green Datatilsynet is a demonstrably active enforcer, with a track record of significant fines (Storting EUR 200k/2022, SATS NOK 10m/2023, Kristiansand NOK 250k/2025, six-website tracking-pixel case… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Amber Enforcement in Ohio is carried out principally by the Ohio Attorney General under general consumer-protection authority and by the FTC under Section 5, rather than under a dedicated… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber Under SB 546, enforcement will be exclusive to the Oklahoma Attorney General, with a non-sunsetting 30-day cure period and no private right of action. Current in-force enforcement relies on FTC… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber Enforcement is bifurcated: the federal OPC operates largely as an ombudsman under PIPEDA with no direct order-making or fining power — it can investigate, issue findings, refer offences to the… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Green The Oregon AG holds exclusive OCPA enforcement authority, with civil penalties up to $7,500 per violation plus injunctive relief, restitution and disgorgement; there is no private right of action.… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No enacted enforcement regime, regulator powers/penalties, collective-redress mechanism, or private right of action specific to data protection exists, because no comprehensive statute is in force.… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red Because no dedicated data-protection authority or statute could be located for Palau, no maximum-fine tier, investigation/decision deadline, complaint-handling duty, representative/collective-action… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Amber ANTAI's Dirección de Protección de Datos Personales holds investigative and sanctioning powers over natural and legal persons violating Law 81, with fines ranging from B/.1,000 to B/.10,000 and… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Amber The UTPCPL gives the Pennsylvania AG power to bring enforcement actions against companies for large data breaches attributable to inadequate cybersecurity practices, and creates a private cause of… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Green ANPD's sanctioning powers are graded into leve (0.5-5 UIT), grave and muy grave (up to 50-100 UIT for the most serious infractions, e.g. unlawful-source data collection or mishandling sensitive data)… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber The NPC has corrective and investigative powers comparable to GDPR authorities. Administrative fines are capped at 5,000,000 pesos per controller/processor regardless of the number of violations… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Green UODO has broad GDPR Article 58 corrective powers, including administrative fines, which it has used extensively across public and private sector controllers since 2019. Recent 12-month enforcement… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Green The CNPD holds full GDPR Art 58 investigative/corrective powers and Art 83 fining authority (up to €20M / 4% global turnover for the most serious offences, per the national implementing law).… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Amber The QFC Data Protection Office holds investigative and enforcement powers under Article 33, with general penalty conditions set at Article 36 and a maximum fine of USD 1.5 million; Article 34 grants… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Green CAI holds the only administrative-monetary-penalty (AMP) power among Canadian privacy regulators (up to CAD $25M/4% global turnover for organizations), plus notice-of-noncompliance powers, alongside… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber The Rhode Island Attorney General holds exclusive RIDTPPA enforcement authority; RIDTPPA explicitly forecloses any private right of action. Notably, RIDTPPA also omits a statutory right-to-cure… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Amber ANSPDCP actively exercises GDPR Article 58 investigative and corrective powers and Article 83 fining powers; recent 2026 decisions include fines against an individual website operator (RON 50,890)… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Amber Roskomnadzor holds broad investigative and remedial powers (rectify/block/destroy orders, processing-suspension orders, court referral, and website-blocking), with the maximum single administrative… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Amber Chapter IX of the law (Articles 64-72) grants the NCSA administrative-sanction powers and creates criminal offences with monetary fines (e.g., 5,000,000-10,000,000 RWF for unlawful… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber SDAIA enforcement matured markedly in 2025-2026: specialized quasi-judicial committees issued 48 decisions in the year preceding a February 2026 report, covering unlawful processing, insufficient… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Amber The CDP holds meaningful administrative sanction powers (authorisation withdrawal, fines from XOF 1,000,000 to XOF 100,000,000, processing prohibitions) plus judicial-track sanctions and an… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Green Serbia's DPA can issue warnings, order correction/deletion of unlawfully processed data, and directly fine controllers/processors for certain misdemeanors (850 euros), while the Court of Offences… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Amber The Information Commission has the power to enforce and implement the Act, including imposing fines, and the Act provides data subjects a right to compensation. Maximum fine tiers/turnover… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Green Financial penalties were substantially increased in 2022: the financial penalty cap which may be imposed on organisations for breaches under the PDPA has increased from the… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Amber GDPR Arts. 58 and 83 grant the ÚOOÚ SR investigative, corrective and administrative-fining powers (up to the higher of €20 million or 4% of global annual turnover for the most serious infringements)… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Green The Information Commissioner holds full GDPR Article 58/83 investigative and corrective powers, including fines up to the GDPR maxima. Enforcement activity in the reporting window includes the 2024… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber The Information Regulator has enforcement powers including a Section 50 Enforcement Committee (established 2022) and investigative/complaint-handling processes under Sections 89-93; POPIA also… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber The South Carolina Attorney General enforces H.3431 with severe statutory penalties and, for dark-pattern violations, a private right of action via the state's general consumer-protection statute.… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber The FTC holds broad federal investigative and enforcement powers under Section 5 reaching South Dakota-based conduct, while the South Dakota Attorney General enforces the state's breach-notification… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber The PIPC has demonstrated sustained, aggressive enforcement, including a KRW 252 million fine against Apple (July 23, 2026) over unauthorized Siri voice-data collection and the KRW 8.3 billion Kakao… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Amber AEPD holds full Art 58 GDPR corrective powers (reprimand, order, ban, fine) exercised via LOPDGDD-specific sanctioning procedure (Art 63-65), with decisions appealable to the Audiencia Nacional. 2025… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA gives the Authority power to impose financial penalties (payable into the Consolidated Fund) enforceable through the Magistrate Court of Colombo for non-payment, and other regulatory… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber IMY can issue warnings, reprimands, cease-processing orders and administrative fines, with a public-authority-specific cap (SEK 5m/10m). Its decisions are appealable. 2025-2026 enforcement activity… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber The FDPIC can open investigations ex officio or on complaint against controllers and processors and, since the revFADP, may issue binding orders at the conclusion of an investigation — a marked… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber Regulators (historically the NDC-coordinated Competent Regulators, transitioning to the PDPC) hold corrective and investigatory powers, including fines, corrective orders, and on-site inspections.… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Green The PDPC has moved from a legislative/regulatory-publication phase into active enforcement, beginning registration of data collectors and processors and announcing that mandatory registration will be… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber TIPA enforcement is vested exclusively in the Tennessee Attorney General, who must afford covered entities a nonsunsetting 60-day cure period before initiating an action; the statute offers an… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Green TDPSA vests exclusive enforcement in the Texas AG, capped at $7,500 per violation with a 30-day cure period, and creates no private right of action; TRAIGA similarly is AG-exclusive with much larger… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Green The Expert Committee is authorized to consider complaints, investigate and impose punitive measures for PDPA violations. Violations of the PDPA can… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red The DPA 2011 contemplates fines and criminal liability once fully proclaimed, and the 2024 Bill proposes continuation of an Appeals Tribunal, but no enforcement regime is currently operative given… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red INPDP's investigative/enforcement powers, maximum penalty levels, and enforcement-activity record over the last 12 months could not be confirmed from accessible sources. Weak secondary signals… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Amber KVKK has broad investigative and sanctioning powers under Article 18 of the LPPD, with four fine tiers (failure to inform; data-security failures; non-compliance with Board decisions; VERBIS… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Green The PDPO/NITA-U has become progressively active: it can investigate complaints and assign compensation (Section 31), and the Act criminalises unlawful obtaining/disclosure and sale of personal data… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber The Ombudsman may conduct compliance audits and issue administrative protocols enforceable in court under Article 188 of the Code of Administrative Offences; a documented 2020 enforcement action… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber The DIFC Commissioner has clear, exercised administrative-fine, investigation, and complaint/mediation powers, with 88 fines reported issued since late-2020 regulations took effect. Broader UAE… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Green The ICO can issue fines of up to £17.5m or 4% of global annual turnover for UK GDPR/DPA 2018 breaches, with the DUAA also raising PECR fines to the same ceiling. 2026 enforcement activity has been… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber US enforcement is multi-layered and increasingly coordinated: the FTC uses Section 5, COPPA, PADFAA, and sectoral rules against national targets (Kochava, Match/OkCupid, data brokers), while… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Green The CPPA and Attorney General share dual civil/administrative enforcement authority, with a maximum administrative fine of $2,500 per violation ($7,500 per intentional violation, with enhanced… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber The NY AG has robust civil-penalty and injunctive powers under the SHIELD Act ($5,000 per security violation; $20 per failed-notification instance capped at $250,000) but SHIELD expressly excludes a… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Amber URCDP holds a graduated sanctioning power ranging from observations and warnings through database closure and fines, set out in implementing decree provisions. Data subjects retain a private right of… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The Utah Attorney General holds exclusive UCPA enforcement authority, subject to a mandatory 30-day cure period, with penalties capped at $7,500 per violation plus actual damages and available… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red A regulator (Deputy Commissioner of Data Protection and Privacy) exists under the Act, implying some enforcement function, but maximum-fine tiers, investigation/decision deadlines, appeal routes… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red There is no regulator with investigative or enforcement powers over data-protection matters, and consequently no penalty schedule, no tracked enforcement activity, and no dedicated regulator… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber Current enforcement rests on Data Broker Act penalties and general Consumer Protection Act unfair/deceptive authority, evidenced by the ongoing Clearview AI suit and a $264,000 breach-notification… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber The PDPL sets tiered administrative/criminal penalties (up to 10x illicit gains for unlawful data trading; up to 5% of prior-year revenue for cross-border violations; up to VND 3 billion for other… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber Enforcement is vested exclusively in the Virginia Attorney General with a 30-day cure period, penalties up to $7,500 per violation plus injunctive relief, and no private right of action or… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber The My Health My Data Act's most consequential enforcement feature is its broad private right of action, enforceable under Washington's Consumer Protection Act, which dispenses with the CPA's usual… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Amber Enforcement of West Virginia's breach-notification statute rests with the state Attorney General; the FTC provides the federal enforcement backstop under Section 5. No comprehensive-privacy-law… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Amber Enforcement in Wisconsin is federally driven: the FTC exercises civil investigative demand and penalty-offense authority (civil penalties up to USD50,120 per violation) under Section 5, and has taken… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Amber Enforcement in Wyoming rests with the AG's Consumer Protection Unit (breach notification, UDAP) and the FTC (Section 5, GLBA, COPPA). No private right of action was confirmed under the Wyoming breach… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Amber The Data Protection Commissioner holds a confirmed registration/licensing power under SI 58/2021. Beyond this, maximum-penalty figures, enforcement-activity history, regulator funding/capacity… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)