Data Protection Monitor · Cross-Jurisdiction Domain Hub
Lawful processing & special data
Jurisdiction Readings (167 markets)
34 Confirmed
81 Probable
52 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Red | Neither the Malabo Convention treaty index, the AU status list, nor the Malabo Roadmap (Sept 2022) provided this run with granular continental-level text enumerating lawful processing bases, consent… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Red | Alabama has no enacted, operative lawful-basis or consent framework analogous to GDPR Art. 6/7. The forthcoming PDPA's consent architecture and enumerated lawful bases were not directly retrievable… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Red | Alaska has no GDPR-style enumerated lawful-basis regime, no general consent standard for commercial data processing, and no statutory definition of 'special category'/sensitive data outside of… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | PIPA uses a 'reasonable purpose' standard rather than an enumerated lawful-bases list, and its consent regime centres on knowledgeable, reasonably-understandable notice, with a distinct carve-out for… | Profile →Brief |
| Algeria (DZ) | Africa | Red | Law 18-07 is expected to set out grounds for lawful processing (consent and other statutory grounds) and heightened protection for sensitive categories (health, genetic, religious/philosophical… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No primary or secondary source located setting out lawful bases, consent validity conditions, special-category/criminal-data conditions, or pseudonymisation/anonymisation tests under any Antigua and… | Profile →Brief |
| Argentina (AR) | Americas | Amber | Consent is the near-exclusive lawful basis under the current Act, a point the pending Yeza reform bill explicitly seeks to broaden by introducing six alternative bases (consent, contract performance… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Red | Arizona has no general lawful-basis framework, no statutory consent-quality standard for commercial data processing, and no general special-category regime. The one notable exception is a… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Red | Arkansas has no general lawful-basis or consent-standard regime for personal-data processing outside of sector-specific minors' laws. The Children and Teens' Online Privacy Protection Act (HB1717… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | No bloc-level enumerated lawful bases, consent thresholds, special-category rules, or pseudonymisation/anonymisation standards exist. The Global CBPR Privacy Principles (based on the APEC Privacy… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | The Privacy Act does not use a GDPR-style enumerated 'lawful basis' model; instead APP 6 governs permissible use/disclosure by reference to primary/secondary purpose and consent. Consent must be… | Profile →Brief |
| Austria (AT) | Europe | Green | GDPR Articles 6, 7, and 9 apply directly and without a general Austrian derogation on lawful bases or consent standards; the DSG carries a distinct national safeguard regime for… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Red | Independent academic analysis characterises the Bangladesh Data Protection Ordinance (PDPO) as establishing consent-based and rights-oriented processing mechanisms, but the enumerated lawful bases… | Profile →Brief |
| Belgium (BE) | Europe | Green | Belgium applies the GDPR Article 6 lawful bases and Article 9 special-category regime without a comprehensive derogating statute, though Article 88-based employment rules and Belgian DPA guidance… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced provisions on lawful bases, consent thresholds, special/sensitive-category conditions, or pseudonymisation/anonymisation tests under Belize's Data Protection Act or the 2024 reform Bill… | Profile →Brief |
| Brazil (BR) | Americas | Green | The LGPD provides ten enumerated legal bases (Art. 7 and 11), including consent, legitimate interest, contract necessity and a distinctive 'protection of credit' basis. Sensitive/special-category… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | PIPA operates on a consent-based model (ss. 6-8) coupled with a 'reasonable purpose' appropriateness test (ss. 11 and 14) that must be satisfied regardless of consent. There is no GDPR Art 9-style… | Profile →Brief |
| Bulgaria (BG) | Europe | Green | Bulgaria applies the GDPR Article 6 lawful-basis framework and Article 9 special-category regime directly, illustrated nationally by a Bulgarian-court CJEU referral on prosecutorial data processing… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | The draft LPDP proposes a GDPR-style set of lawful bases and a broad definition of special/sensitive categories, but none of this is currently binding law. No enacted Cambodian statute presently… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | The draft/enacted law defines and appears to regulate special categories such as biometric data and genetic data, and references 'sensitive data' as a defined term. Confirmation of the enumerated… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | PIPEDA uses a consent-based model (Schedule 1, Principle 3) overlaid with an overarching 'reasonable person' appropriateness test (s.5(3)) rather than GDPR-style enumerated lawful bases. Quebec's… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | PIPEDA is built around a consent-centric model (Schedule 1, Principle 4.3) rather than an enumerated multi-basis framework like GDPR Art 6, supplemented by a 'reasonable purposes' test (s.5(3)) and a… | Profile →Brief |
| Chile (CL) | Americas | Amber | The current Ley 19.628 recognizes only two lawful bases (legal authorization and express written consent). Ley 21.719 substantially broadens the lawful-basis catalogue and introduces a differentiated… | Profile →Brief |
| China (CN) | Asia-Pacific | Green | PIPL Chapter II sets out non-consent lawful bases (contract performance, HR management, statutory duties, public health emergencies, news reporting, lawfully disclosed information) alongside consent… | Profile →Brief |
| Colombia (CO) | Americas | Amber | Law 1581 and its implementing Decree 1377 establish authorization (consent) as the default lawful basis, with an express carve-out for 'public data,' and elevate biometric and children's data to… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Green | The CPA does not use a GDPR-style enumerated lawful-basis model; instead it relies on an opt-out consent architecture supplemented by mandatory opt-in consent for sensitive/sensitive-inference data… | Profile →Brief |
| Comoros (KM) | Africa | Red | No enumerated lawful-basis framework, consent-validity standard, or special-category/sensitive-data regime was located for the Union of the Comoros. This is the heaviest-weighted gap module and the… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No enumerated lawful-basis regime, consent-validity standard, special-category/sensitive-data rules, or pseudonymisation/anonymisation safe-harbour could be identified for Comoros/Anjouan, consistent… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No statutory lawful-basis framework, consent standard, special-category regime, or pseudonymisation/anonymisation safe-harbour exists in Comorian law; this module is entirely a confirmed gap… | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | CTDPA does not use a GDPR-style enumerated lawful-bases model; instead it relies on an opt-out framework for ordinary processing plus opt-in consent requirements for sensitive data and material… | Profile →Brief |
| Costa Rica (CR) | Americas | Amber | Express, informed consent of the data subject is the central lawful basis under Law No. 8968, reinforced by sector practice requiring individualized, specific, freely-given and (in regulated sectors)… | Profile →Brief |
| Croatia (HR) | Europe | Green | Croatia applies GDPR Articles 6-9 directly. The Implementation Act adds one notable Article 9(2)(a) derogation (genetic data for life-insurance risk calculation) and a biometric-data permission for… | Profile →Brief |
| Curaçao (CW) | Caribbean | Red | No Curaçao-specific text on enumerated lawful bases, consent thresholds, special-category rules, or pseudonymisation/anonymisation safe-harbours was retrieved in this research pass. Professional… | Profile →Brief |
| Cyprus (CY) | Europe | Green | Lawful bases and special-category rules follow GDPR Arts 6 and 9 as transposed by Law 125(I)/2018. The Law's principal derogation is the age of digital consent, fixed at 14 (below the GDPR default of… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | GDPR's Article 6 lawful bases, consent standards, and Article 9 special-category rules apply directly as EU law in Czech Republic; ÚOOÚ has supplemented this with national consent guidance.… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | The DPDPA does not use a GDPR-style enumerated lawful-basis regime (Art. 6 analogue); instead it operates a notice-and-opt-out model built on purpose limitation and data minimization, layering an… | Profile →Brief |
| Denmark (DK) | Europe | Amber | GDPR Arts 6/9 apply directly, but the Danish Act creates notable derogations: a lowered digital age-of-consent (13), a bespoke regime for CPR (social security) numbers and criminal-offence data, and… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Red | The District has no enacted lawful-basis, consent-threshold, or pseudonymisation/anonymisation framework. The only relevant development is the FTC's 2023 biometric-data policy statement, which… | Profile →Brief |
| Dominican Republic (DO) | Americas | Amber | Law 172-13, as a habeas-data-style Latin American statute, embeds consent as the central lawful basis for processing, with heightened protection for sensitive/special categories of data. Detailed… | Profile →Brief |
| Ecuador (EC) | Americas | Green | EUDPR Chapter II mirrors GDPR Arts 5-11: lawfulness of processing (Art 5), conditions for consent (Art 7), special categories (Art 10), and criminal-conviction data (Art 11). Recent EDPB/EDPS… | Profile →Brief |
| Egypt (EG) | Africa | Amber | PDPL centers processing legitimacy on data-subject consent (revocable at any time) and designates an extensive list of sensitive/special categories requiring licensing. The law does not provide a… | Profile →Brief |
| Estonia (EE) | Europe | Green | Lawful bases and consent standards follow GDPR Art 6/7 directly. AKI enforcement practice shows a strict reading of both consent validity and the contractual-necessity basis, as illustrated in a 2022… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | GDPR Article 6 lawful bases remain unchanged, but their practical application is contested and evolving through enforcement (e.g. the Meta 'contract' basis for behavioural advertising being… | Profile →Brief |
| Finland (FI) | Europe | Green | Finland relies directly on the GDPR Article 6 lawful bases and Article 9 special-category regime, with the Data Protection Act adding national safeguards (Section 31) for special categories and… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | The FDBR does not adopt a GDPR-style enumerated-lawful-basis model. Processing is generally permitted by default, with opt-out rights layered on top and opt-in consent required only for narrow… | Profile →Brief |
| France (FR) | Europe | Green | GDPR Article 6 lawful bases apply directly; consent for trackers must be a clear positive act under Article 82 LIL. Health and other special-category data receive enhanced national safeguards… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Red | Georgia has no enumerated lawful-bases regime, no general consent-threshold statute, and no general special-category (sensitive data) regime analogous to GDPR Art 6/9. Coverage of consent and… | Profile →Brief |
| Germany (DE) | Europe | Amber | Lawful processing follows the six GDPR Art 6(1) bases, with Germany exercising the Art 8 opening clause to set the digital-consent age at 16 and the Art 88 opening clause to enact §26 BDSG for… | Profile →Brief |
| Ghana (GH) | Africa | Amber | The Act's foundational provisions on scope, definitions, principles and legal bases for processing are broadly similar to GDPR, including a comparable set of lawful grounds and a similar… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | Gibraltar's lawful-basis and special-category framework is inherited directly from the GDPR structure (Arts 6 and 9) via the Gibraltar GDPR, supplemented by DPA 2004 exemptions guidance issued by GRA… | Profile →Brief |
| Greece (GR) | Europe | Green | GDPR Articles 6, 7 and 9 apply directly, supplemented by Law 4624/2019's specific provisions on the digital consent age (15), employment-context processing, special-category processing for… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | Lawfulness turns on satisfying one of the enumerated conditions in Schedule 2 of the Law, tiered by data category. Consent has a GDPR-equivalent definitional test, and ODPA has issued… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | Lawfulness under the Law is structured around Schedule 2: general processing requires a condition in Part I or II, while special category data requires a condition in Part II or III. The… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Red | Hawaii has no GDPR/CCPA-style enumerated lawful-bases regime, no general consent standard for processing, and no cross-sectoral 'special category' data framework. Sector-specific consent/protection… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | PDPO does not use an enumerated GDPR Art.6-style lawful-basis list; instead, its six Data Protection Principles govern collection and use. There is no statutory special/sensitive-category regime… | Profile →Brief |
| Hungary (HU) | Europe | Amber | GDPR Art 6 lawful bases and Art 9 special-category rules apply directly. The amended Privacy Act layers additional constraints on legal-obligation/public-interest processing and confirms no domestic… | Profile →Brief |
| Iceland (IS) | Europe | Green | Lawful bases, consent standards, and special-category protections apply directly under GDPR Articles 5-9 as incorporated via Act No. 90/2018, with Iceland-specific research derogations under Article… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Red | Idaho has no state-enumerated lawful bases for processing personal data, no statutory consent-threshold standard, and no special/sensitive-category regime analogous to GDPR Art. 9. Where sensitive… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | Illinois has no general lawful-basis or consent-threshold framework analogous to GDPR Art 6/7. Consent and special-category-style protections exist only within BIPA (biometric) and GIPA (genetic)… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | DPDPA is consent-centric but supplements consent with nine statutory 'legitimate uses' grounds. Consent must be free, specific, informed, unconditional and unambiguous. Notably, the Act does not… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Green | The ICDPA follows the Virginia-model consent/purpose-limitation approach rather than a GDPR Art.6-style enumerated lawful-bases list. Opt-in consent is required for sensitive data (with a COPPA… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | The ICDPA lacks a GDPR-style enumerated list of lawful bases, relying instead on a purpose-and-proportionality standard disclosed via privacy notice. Consent must be freely given, specific, informed… | Profile →Brief |
| Ireland (IE) | Europe | Green | Lawful bases follow GDPR Article 6, with the Data Protection Act 2018 setting Ireland's age of digital consent (Article 8 GDPR) at 16 years and adding a bespoke lawful ground permitting… | Profile →Brief |
| Isle of Man (IM) | Europe | Amber | Because the Isle of Man has adopted the full text of the EU GDPR domestically (with adaptations), the Article 6 lawful bases and Article 9 special-category regime are understood to apply as adopted.… | Profile →Brief |
| Italy (IT) | Europe | Green | Lawful bases follow GDPR Art.6 as construed by the Garante (consent, contract, legal obligation, legitimate interest); consent for marketing/telemarketing must be freely given, specific, and… | Profile →Brief |
| Ivory Coast (CI) | Africa | Red | No primary-text confirmation was obtained in this run for Côte d'Ivoire's enumerated lawful bases, consent standards, or special-category rules under Law No. 2013-450. Regional pattern… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | Unlike the GDPR, the APPI does not require an enumerated lawful basis for all processing; instead it relies on purpose specification/notification duties plus consent requirements triggered at… | Profile →Brief |
| Jersey (JE) | Europe | Red | Jersey's DPJL 2018 is described by practitioners as broadly aligned with GDPR's lawful-basis and special-category architecture, confirmed indirectly by a 2021 JDPA enforcement decision referencing an… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Kansas has no state-enumerated lawful-basis framework, no general consent-threshold statute, and no state-level special/sensitive-category regime for commercial data processing. These matters are… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Amber | Lawful-basis and consent standards derive from Law No. 347-VI (2020), which conditions collection/processing on valid consent and legitimate purpose. Draft amendments would further restrict use of… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | The KCDPA does not use a GDPR-style enumerated lawful-basis model; instead it is a consent/opt-out architecture: general processing is permitted by default subject to disclosure and opt-out rights… | Profile →Brief |
| Kenya (KE) | Africa | Green | The Act sets out lawful bases for both ordinary and sensitive personal data broadly comparable to GDPR Art 6/9, and the General Regulations 2021 require that processing rely on a single legal basis… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | The World Bank's gap analysis finds that Laos's electronic data law relies primarily on consent as the near-exclusive lawful basis for processing, without purpose-limitation or data-minimisation… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Amber | Neither bloc instrument enumerates discrete lawful bases analogous to GDPR Art 6; both rely on general fairness/purpose-limitation framing. The 2026 RIPD Standards materially advance… | Profile →Brief |
| Latvia (LV) | Europe | Amber | Lawful bases and consent standards follow GDPR Articles 6 and 7 directly, with no confirmed Latvia-specific derogation identified for general lawful bases. Special-category processing has been the… | Profile →Brief |
| Liechtenstein (LI) | Europe | Green | Lawful bases, consent standards, and special-category rules follow GDPR Articles 6, 7 and 9 directly as incorporated via the EEA Agreement, with DSS guidance addressing practical application (e.g.… | Profile →Brief |
| Lithuania (LT) | Europe | Green | Lawful bases and consent standards follow GDPR Art. 6/7 directly. VDAI has issued sector guidance on special-category data (biometric, criminal-record) reflecting active supervisory focus on Art.… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | The LDPA imposes consent requirements for sensitive-data processing (health, biometric, genetic, children's data) rather than a GDPR-style enumerated lawful-basis structure. <cite… | Profile →Brief |
| Luxembourg (LU) | Europe | Green | GDPR Articles 6, 7 and 9 apply directly in Luxembourg. Lawful bases, consent standards and special-category prohibitions/exceptions are governed by the EU text with no LU-specific derogation… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Red | Maine lacks a general lawful-basis or sensitive-data framework analogous to GDPR Arts 6/9. The only codified consent standard is the opt-in requirement in the broadband-ISP privacy law.… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The PDPA operates on a consent-centric lawfulness model rather than a GDPR-style multi-basis Article 6 structure: general personal data requires data-subject consent (with limited… | Profile →Brief |
| Malta (MT) | Europe | Green | GDPR Articles 6, 7 and 9 apply directly in Malta with no material derogation; national subsidiary legislation carves out specific special-category derogations, notably permitting processing of health… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No lawful-basis regime, consent-validity standard, special-category rules, or pseudonymisation/anonymisation safe-harbour exists in RMI law, as there is no general processing statute to carry them.… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | MODPA departs from the GDPR/CCPA-style enumerated-lawful-basis model, instead imposing a substantive data-minimization standard ('reasonably necessary and proportionate') for ordinary personal data… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Red | Massachusetts has no general lawful-basis, consent, or special-category regime akin to GDPR Art. 6/7/9. Coverage is limited to sector contexts: HIPAA governs health information at the federal level… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico's private-sector regime recognizes a privacy-notice-and-consent-centred model with enumerated exceptions to consent (public sources, legal mandate, prior dissociation, contractual necessity)… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Red | Michigan has no GDPR-style enumerated lawful-bases regime, no general consent standard, and no state-defined special-category rules. Consent-type obligations exist only in narrow federal sectoral… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | The MCDPA does not adopt a GDPR-style enumerated multi-basis lawful-processing model; instead it relies on collection/purpose-limitation duties plus consent gates for sensitive data. Sensitive data… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Red | Mississippi has no statutory lawful-basis framework, no defined consent-threshold standard, no special/sensitive-category regime, and no pseudonymisation/anonymisation safe-harbour comparable to GDPR… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Red | Missouri has no statutory enumeration of lawful processing bases, no general consent standard, and no special/sensitive-category regime, with the narrow exception of House Bill 1584's biometric-data… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | MTCDPA does not use a GDPR-style enumerated list of lawful bases. Instead, processing is generally permitted subject to a data-minimization/purpose-limitation rule, with consent required for… | Profile →Brief |
| Morocco (MA) | Africa | Amber | Law 09-08's general processing principles were found broadly convergent with GDPR principles, but the same gap analysis identified material divergences: no detailed consent-validity conditions, and… | Profile →Brief |
| Mozambique (MZ) | Africa | Red | No enacted lawful-basis framework, consent standard, special-category regime, or pseudonymisation/anonymisation safe-harbour exists. The pending draft Personal Data Protection Law (6th version, Nov… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | No enumerated lawful-basis framework, consent-standard regime, special/sensitive-category classification, or statutory pseudonymisation/anonymisation safe-harbour was identified for Myanmar. This… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | The NDPA follows the WPA-model consent/notice-based approach rather than a GDPR-style enumerated legal-bases regime. Processing must be reasonably necessary and proportionate to disclosed purposes… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No enumerated lawful-basis framework analogous to GDPR Art. 6, no codified consent-threshold standard, no special/sensitive-category regime, and no pseudonymisation/anonymisation safe-harbour was… | Profile →Brief |
| Netherlands (NL) | Europe | Green | Lawful bases and consent standards follow GDPR Articles 6 and 7 directly. The Netherlands set the child consent age threshold for information-society-service consent at 16 (the GDPR default, not… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Nevada has no general enumerated lawful-basis framework for ordinary commercial data processing. The only codified consent/sensitive-data regime is SB 370's treatment of 'consumer health data'… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Amber | PIPEDA's Schedule 1 sets out ten fair information principles functioning as NB's private-sector lawful-processing framework, with a 2015 (Digital Privacy Act) amendment clarifying the standard for… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Amber | The NHDPA does not adopt a GDPR-style enumerated lawful-bases model; instead it operates a notice-and-opt-out default for most processing, reserving consent (opt-in) for sensitive data and for known… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | NJDPL does not adopt a GDPR-style enumerated set of lawful bases; instead it relies on an opt-out model for ordinary processing (sale, targeted advertising, certain profiling) combined with an opt-in… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | New Mexico has no general statutory scheme of enumerated lawful processing bases or consent standards analogous to GDPR Art 6/7. The one sectoral carve-out is the Genetic Information Privacy Act… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Amber | New Zealand's regime does not use a GDPR-style enumerated 'lawful basis' menu or treat consent as a central organising principle. Collection is instead governed by necessity/purpose principles… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | The NDPA (Part V, Sections 24-33) establishes principles and lawful bases for processing including consent, contract, legal obligation, vital interest and public interest. Consent must be freely… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Red | North Carolina has no general lawful-basis, consent-standard, or special-category regime akin to GDPR Art. 6/9. Sensitive-data protections and consent requirements exist only through federal sectoral… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Red | North Dakota has no general statute enumerating lawful bases for processing, consent standards, or special/sensitive-category rules comparable to GDPR Art 6/7/9. The only consent/opt-out-adjacent… | Profile →Brief |
| Norway (NO) | Europe | Green | Norway applies GDPR Arts 6-9 directly (via EEA incorporation) with no material derogation identified in the sources reviewed. Datatilsynet enforcement (Meta, SATS) confirms orthodox application of… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Red | Ohio has no GDPR-style enumerated lawful-basis regime. Processing is governed by sector-specific notice-and-consent/opt-out models (e.g., GLBA opt-out for financial nonpublic personal information)… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Red | No general enumerated lawful-basis or consent-threshold framework is currently in force in Oklahoma. SB 546 (effective 2027-01-01) is modeled on the Virginia CDPA, which uses an opt-out (not opt-in)… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | PIPEDA is a consent-centric regime: unlike the GDPR's multiple lawful bases, consent (express or implied, calibrated to sensitivity) is the near-exclusive gateway to collection, use and disclosure… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Amber | OCPA follows the opt-out/permissive-processing model typical of the 2023-24 wave of US state privacy laws rather than a GDPR-style enumerated lawful-bases test; consent is required specifically for… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted lawful-basis, consent, or special-category regime exists. Draft bills (2021, May 2023) propose consent-centric processing grounds, per-purpose consent requirements, and additional… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No lawful-basis regime, consent-validity standard, special-category rules, or pseudonymisation/anonymisation safe-harbour could be located for Palau. Searches for a Palau Data Protection Act, privacy… | Profile →Brief |
| Panama (PA) | Americas | Amber | Law 81 requires consent as the general lawful basis for processing, subject to statutory exceptions in Article 8, and mandates that consent be prior, informed and unequivocal. The law also defines… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Red | Pennsylvania has no enacted lawful-basis, consent-threshold, or special-category regime analogous to GDPR Art 6/7/9. House Bill 78 (Consumer Data Privacy Act) would introduce such a framework but… | Profile →Brief |
| Peru (PE) | Americas | Amber | Consent is the default lawful basis, defined as free, express, unequivocal, prior and informed, with statutory exceptions (contract performance, public-source data, health emergencies, international… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | The Act adopts a prohibition-with-exceptions model for sensitive personal information and defines an expansive category of 'sensitive personal information'. Neither the Act nor the IRR provide… | Profile →Brief |
| Poland (PL) | Europe | Green | Lawful bases, consent standards and special-category rules in Poland follow GDPR Articles 6, 7 and 9 directly, given the Act's non-derogating approach. UODO enforcement (e.g. the ClickQuickNow… | Profile →Brief |
| Portugal (PT) | Europe | Green | Lawful processing follows GDPR Art 6 with Portugal-specific elaborations on consent age and special-category (health/genetic) data, some of which the CNPD itself has disapplied where conflicting with… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | Mainland Law 13/2016 establishes consent as the principal lawful basis, with a withdrawal right and specific notification requirements for sensitive/special-nature data. The QFC Regulations set out… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Green | Quebec requires purpose-limited collection, clear/free/informed consent (express for sensitive data), and defines de-identification/anonymisation with a legitimacy-and-best-practices standard. There… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA does not adopt a GDPR-style enumerated lawful-bases framework; instead it relies on a notice-plus-opt-out model for ordinary processing (targeted advertising, sale, profiling), and an opt-in… | Profile →Brief |
| Romania (RO) | Europe | Green | Romania applies the GDPR's Article 6 lawful bases and Article 9 special-category regime directly, with Law 190/2018 not materially derogating from the EU baseline on consent standards. National case… | Profile →Brief |
| Russia (RU) | Europe | Amber | Russian law recognises consent, contractual necessity and legal-obligation compliance as lawful bases, paralleling GDPR Article 6. Consent standards are reinforced by Federal Antimonopoly Service… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | Chapter II of the law provides general rules for collecting and processing personal data, anchored on a dedicated consent article and specific grounds/safeguards for sensitive personal data and… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | The PDPL originally made consent the primary lawful basis, with the 2023 amendments introducing a legitimate-interest basis (excluded for sensitive data). Special categories include health, genetic… | Profile →Brief |
| Senegal (SN) | Africa | Amber | The Law enumerates sensitive/special categories of data and imposes a data-quality (accuracy) obligation and consent requirements for identifiable publication of data processed for… | Profile →Brief |
| Serbia (RS) | Europe | Amber | The LPDP's provisions on legal basis for processing, consent, and special-category data mirror the normative provisions of the GDPR, though the absence of GDPR-style recitals makes some provisions… | Profile →Brief |
| Seychelles (SC) | Africa | Amber | The Act lays down lawful bases and processing principles analogous to a GDPR-style regime, but the enumerated list of lawful bases, the consent-validity conditions, any national conditions for… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | The PDPA is consent-centric but carves out very broad exemptions. <cite index="49-14,49-15,49-16">Consent is not required under the PDPA if the data processing falls within the purview of the Section… | Profile →Brief |
| Slovakia (SK) | Europe | Green | Slovakia applies the GDPR Art. 6 lawful-basis enumeration and Art. 9 special-category regime directly, with Act 18/2018 providing localized procedural detail. Consent must be an unambiguous… | Profile →Brief |
| Slovenia (SI) | Europe | Green | GDPR Articles 6-11 apply directly in Slovenia. ZVOP-2 supplements the GDPR special-categories regime (Article 9) with dedicated national rules on biometric data processing. The specific national… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | POPIA's lawful-processing architecture is built on eight 'conditions for lawful processing' (accountability through data subject participation) rather than a discrete Article 6-style list, with… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Red | South Carolina has no general lawful-basis or consent framework for commercial data processing. Consent-like mechanisms exist only within H.3431 (default opt-out of personalized recommendations for… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | South Dakota has not enacted a general lawful-basis, consent-threshold, or special-category framework of the GDPR/CCPA type. The one notable 2026 development is state legislation addressing genetic… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | PIPA recognises consent alongside other legal bases for processing, but the statute does not itself define 'consent,' leaving interpretive gaps filled by Supreme Court rulings and PIPC guidance.… | Profile →Brief |
| Spain (ES) | Europe | Green | Spain applies GDPR Art 6 lawful bases directly, supplemented by LOPDGDD presumptions (e.g. legitimate interest for professional contact data). Age of digital consent is set at 14 (LOPDGDD Art 7)… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA sets out an enumerated set of lawful bases in Schedule I (Section 5), a defined consent standard elaborated in Schedule III, and enhanced conditions for special/sensitive categories in… | Profile →Brief |
| Sweden (SE) | Europe | Green | GDPR Art 6 lawful bases and Art 9 special-category rules apply directly, supplemented by SFS 2018:218 grounds for public-interest processing. Sweden exercised the Art 8 Member State derogation to set… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | Unlike the GDPR's positive lawful-basis requirement, Swiss law does not require a specified legal basis for processing to be lawful per se; processing is only unlawful if it breaches personality… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | The PDPA provides lawful bases for processing broadly analogous to GDPR Art 6, and affords enhanced protection to a defined set of sensitive categories (medical records, healthcare, genetics, sex… | Profile →Brief |
| Tanzania (TZ) | Africa | Red | No English-language secondary source retrieved in this run set out Tanzania's enumerated lawful bases, consent standards, special-category rules, or pseudonymisation/anonymisation safe-harbours in… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | TIPA does not adopt a GDPR-style enumerated lawful-bases model; instead it follows the US 'notice-and-choice plus opt-out' structure common to Virginia-lineage state laws, layering an opt-in consent… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | TDPSA does not enumerate GDPR-style Art. 6 lawful bases; it instead follows the Virginia-model notice-and-consent architecture, requiring opt-in consent specifically for sensitive data.… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Green | The PDPA's Chapter 2 provisions parallel GDPR Articles 6, 7 and 9. <cite index="5-9">Both texts have similar provisions regarding the legal basis of processing, as both list consent, performance of a… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | The DPA 2011's general privacy principles embed a consent-and-purpose-identification standard, and Part IV (not yet in force) defines 'sensitive personal information'. No GDPR-style enumerated… | Profile →Brief |
| Tunisia (TN) | Africa | Red | Organic Law 2004-63 is understood to establish lawful-basis, consent, and special-category rules analogous to other first-generation omnibus regimes, but the specific enumerated lawful bases… | Profile →Brief |
| Turkey (TR) | Europe | Unknown | The LPPD's Article 5 sets out lawful-processing grounds broadly analogous to GDPR Art 6, while Article 6 enumerates special/sensitive categories (race, ethnicity, political opinion, philosophical… | Profile →Brief |
| Uganda (UG) | Africa | Amber | The Act sets consent as a central lawful-processing principle (Section 7) with statutory exceptions, and imposes specific conditions on consent for children and other special categories. Definitions… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | The 2010 Law enumerates six legal grounds for processing, broadly paralleling GDPR Art 6 in structure but with divergent detail; consent is disproportionately relied upon in practice. A 2014… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | The federal PDPL centers processing lawfulness on consent, with statutory exceptions; the DIFC and ADGM free-zone laws mirror GDPR-style lawful bases and special-category definitions, with ADGM… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | UK GDPR retains the six lawful bases from EU GDPR Article 6 but the DUAA 2025 inserts a new 'recognised legitimate interest' basis for a closed list of public-interest purposes, and clarifies that… | Profile →Brief |
| United States (US) | Americas | Amber | US federal law has no GDPR-style enumerated 'lawful basis' regime; the operative model is notice-plus-choice/opt-out at the state level and sector-specific opt-in consent requirements (chiefly COPPA… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | The CCPA/CPRA does not adopt a GDPR-style enumerated lawful-basis framework; instead it relies on a notice-plus-choice model (opt-out of 'sale'/'share', opt-in consent for minors and for use of… | Profile →Brief |
| United States — New York (US-NY) | Americas | Red | New York has no general lawful-basis framework analogous to GDPR Art. 6, nor a codified 'special category' regime. Consent standards appear only in narrow, purpose-specific statutes: the Child Data… | Profile →Brief |
| Uruguay (UY) | Americas | Amber | The LPD's 2008 text already incorporated EU-style consent standards, and the 2018/2020 reforms layered on accountability-driven controls around sensitive data and de-identification. Search coverage… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The UCPA does not adopt a GDPR-style enumerated lawful-basis regime; it instead relies on notice-and-opt-out mechanics for targeted advertising, sale, and sensitive-data processing, reserving opt-in… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | Secondary commentary confirms the Act <cite index="1-6">provides ... rules relating to processing of personal data, including special category data</cite>, but the enumerated lawful bases (consent… | Profile →Brief |
| Venezuela (VE) | Americas | Red | There is no enumerated lawful-basis framework analogous to GDPR Article 6. TSJ jurisprudence has articulated general principles applicable to data processing—consent (revocable, prior, informed)… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | S.71 does not adopt a GDPR Article-6-style enumerated lawful-basis list; it instead gates obligations on consumer consent plus quantitative thresholds. Vermont's Genetic Information Privacy Act… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | The PDPL tightens consent standards relative to Decree 13 and imposes materially heavier obligations for sensitive personal data. A full GDPR Art.6-style enumeration of lawful bases distinct from… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | The VCDPA does not use a GDPR Article-6-style enumerated lawful-basis model; general processing proceeds by default subject to purpose- and data-minimization limits, while affirmative opt-in consent… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | Washington has no general enumerated set of lawful bases for processing personal data akin to GDPR Art 6. Instead, the My Health My Data Act imposes a consent-or-necessity standard specific to… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Red | West Virginia has no general lawful-basis regime, consent standard, or special-category framework analogous to GDPR Articles 6, 7 and 9. Consent and sensitive-data rules apply only through federal… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Red | Wisconsin has no codified lawful-basis, consent-standard, or special-category regime analogous to GDPR Articles 6/7/9. The only quasi-special-category treatment arises indirectly through the… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Red | Wyoming has no general lawful-basis or consent framework for commercial data processing. The narrow exception is the Wyoming Genetic Data Privacy Act, which imposes consent requirements on… | Profile →Brief |
| Zambia (ZM) | Africa | Red | Beyond the general statement that the Act regulates 'the collection and processing of personal data,' no T1/T2 primary text enumerating lawful bases, consent standards, special-category rules, or… | Profile →Brief |