--- title: "Lawful processing & special data — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/lawful-processing-and-special-data/ source_html: /domains/lawful-processing-and-special-data/index.html description: "Cross-jurisdiction comparison of Lawful processing & special data across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: f5d34542f5e248b28572d51ceacf7641a5e687bc9d32f932d3ab7312e370cea4 generator: "fe-fleet/md-twin@1.0" --- # Lawful processing & special data — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 34 Confirmed 81 Probable 52 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Red Neither the Malabo Convention treaty index, the AU status list, nor the Malabo Roadmap (Sept 2022) provided this run with granular continental-level text enumerating lawful processing bases, consent… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Red Alabama has no enacted, operative lawful-basis or consent framework analogous to GDPR Art. 6/7. The forthcoming PDPA's consent architecture and enumerated lawful bases were not directly retrievable… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red Alaska has no GDPR-style enumerated lawful-basis regime, no general consent standard for commercial data processing, and no statutory definition of 'special category'/sensitive data outside of… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber PIPA uses a 'reasonable purpose' standard rather than an enumerated lawful-bases list, and its consent regime centres on knowledgeable, reasonably-understandable notice, with a distinct carve-out for… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Red Law 18-07 is expected to set out grounds for lawful processing (consent and other statutory grounds) and heightened protection for sensitive categories (health, genetic, religious/philosophical… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No primary or secondary source located setting out lawful bases, consent validity conditions, special-category/criminal-data conditions, or pseudonymisation/anonymisation tests under any Antigua and… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Amber Consent is the near-exclusive lawful basis under the current Act, a point the pending Yeza reform bill explicitly seeks to broaden by introducing six alternative bases (consent, contract performance… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Red Arizona has no general lawful-basis framework, no statutory consent-quality standard for commercial data processing, and no general special-category regime. The one notable exception is a… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Red Arkansas has no general lawful-basis or consent-standard regime for personal-data processing outside of sector-specific minors' laws. The Children and Teens' Online Privacy Protection Act (HB1717… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level enumerated lawful bases, consent thresholds, special-category rules, or pseudonymisation/anonymisation standards exist. The Global CBPR Privacy Principles (based on the APEC Privacy… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber The Privacy Act does not use a GDPR-style enumerated 'lawful basis' model; instead APP 6 governs permissible use/disclosure by reference to primary/secondary purpose and consent. Consent must be… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Green GDPR Articles 6, 7, and 9 apply directly and without a general Austrian derogation on lawful bases or consent standards; the DSG carries a distinct national safeguard regime for… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Red Independent academic analysis characterises the Bangladesh Data Protection Ordinance (PDPO) as establishing consent-based and rights-oriented processing mechanisms, but the enumerated lawful bases… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green Belgium applies the GDPR Article 6 lawful bases and Article 9 special-category regime without a comprehensive derogating statute, though Article 88-based employment rules and Belgian DPA guidance… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced provisions on lawful bases, consent thresholds, special/sensitive-category conditions, or pseudonymisation/anonymisation tests under Belize's Data Protection Act or the 2024 reform Bill… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Green The LGPD provides ten enumerated legal bases (Art. 7 and 11), including consent, legitimate interest, contract necessity and a distinctive 'protection of credit' basis. Sensitive/special-category… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA operates on a consent-based model (ss. 6-8) coupled with a 'reasonable purpose' appropriateness test (ss. 11 and 14) that must be satisfied regardless of consent. There is no GDPR Art 9-style… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Green Bulgaria applies the GDPR Article 6 lawful-basis framework and Article 9 special-category regime directly, illustrated nationally by a Bulgarian-court CJEU referral on prosecutorial data processing… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red The draft LPDP proposes a GDPR-style set of lawful bases and a broad definition of special/sensitive categories, but none of this is currently binding law. No enacted Cambodian statute presently… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber The draft/enacted law defines and appears to regulate special categories such as biometric data and genetic data, and references 'sensitive data' as a defined term. Confirmation of the enumerated… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber PIPEDA uses a consent-based model (Schedule 1, Principle 3) overlaid with an overarching 'reasonable person' appropriateness test (s.5(3)) rather than GDPR-style enumerated lawful bases. Quebec's… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber PIPEDA is built around a consent-centric model (Schedule 1, Principle 4.3) rather than an enumerated multi-basis framework like GDPR Art 6, supplemented by a 'reasonable purposes' test (s.5(3)) and a… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber The current Ley 19.628 recognizes only two lawful bases (legal authorization and express written consent). Ley 21.719 substantially broadens the lawful-basis catalogue and introduces a differentiated… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Green PIPL Chapter II sets out non-consent lawful bases (contract performance, HR management, statutory duties, public health emergencies, news reporting, lawfully disclosed information) alongside consent… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Law 1581 and its implementing Decree 1377 establish authorization (consent) as the default lawful basis, with an express carve-out for 'public data,' and elevate biometric and children's data to… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Green The CPA does not use a GDPR-style enumerated lawful-basis model; instead it relies on an opt-out consent architecture supplemented by mandatory opt-in consent for sensitive/sensitive-inference data… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No enumerated lawful-basis framework, consent-validity standard, or special-category/sensitive-data regime was located for the Union of the Comoros. This is the heaviest-weighted gap module and the… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No enumerated lawful-basis regime, consent-validity standard, special-category/sensitive-data rules, or pseudonymisation/anonymisation safe-harbour could be identified for Comoros/Anjouan, consistent… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No statutory lawful-basis framework, consent standard, special-category regime, or pseudonymisation/anonymisation safe-harbour exists in Comorian law; this module is entirely a confirmed gap… [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber CTDPA does not use a GDPR-style enumerated lawful-bases model; instead it relies on an opt-out framework for ordinary processing plus opt-in consent requirements for sensitive data and material… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Amber Express, informed consent of the data subject is the central lawful basis under Law No. 8968, reinforced by sector practice requiring individualized, specific, freely-given and (in regulated sectors)… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Green Croatia applies GDPR Articles 6-9 directly. The Implementation Act adds one notable Article 9(2)(a) derogation (genetic data for life-insurance risk calculation) and a biometric-data permission for… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red No Curaçao-specific text on enumerated lawful bases, consent thresholds, special-category rules, or pseudonymisation/anonymisation safe-harbours was retrieved in this research pass. Professional… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Green Lawful bases and special-category rules follow GDPR Arts 6 and 9 as transposed by Law 125(I)/2018. The Law's principal derogation is the age of digital consent, fixed at 14 (below the GDPR default of… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green GDPR's Article 6 lawful bases, consent standards, and Article 9 special-category rules apply directly as EU law in Czech Republic; ÚOOÚ has supplemented this with national consent guidance.… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber The DPDPA does not use a GDPR-style enumerated lawful-basis regime (Art. 6 analogue); instead it operates a notice-and-opt-out model built on purpose limitation and data minimization, layering an… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber GDPR Arts 6/9 apply directly, but the Danish Act creates notable derogations: a lowered digital age-of-consent (13), a bespoke regime for CPR (social security) numbers and criminal-offence data, and… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Red The District has no enacted lawful-basis, consent-threshold, or pseudonymisation/anonymisation framework. The only relevant development is the FTC's 2023 biometric-data policy statement, which… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Amber Law 172-13, as a habeas-data-style Latin American statute, embeds consent as the central lawful basis for processing, with heightened protection for sensitive/special categories of data. Detailed… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green EUDPR Chapter II mirrors GDPR Arts 5-11: lawfulness of processing (Art 5), conditions for consent (Art 7), special categories (Art 10), and criminal-conviction data (Art 11). Recent EDPB/EDPS… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber PDPL centers processing legitimacy on data-subject consent (revocable at any time) and designates an extensive list of sensitive/special categories requiring licensing. The law does not provide a… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Green Lawful bases and consent standards follow GDPR Art 6/7 directly. AKI enforcement practice shows a strict reading of both consent validity and the contractual-necessity basis, as illustrated in a 2022… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber GDPR Article 6 lawful bases remain unchanged, but their practical application is contested and evolving through enforcement (e.g. the Meta 'contract' basis for behavioural advertising being… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Green Finland relies directly on the GDPR Article 6 lawful bases and Article 9 special-category regime, with the Data Protection Act adding national safeguards (Section 31) for special categories and… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber The FDBR does not adopt a GDPR-style enumerated-lawful-basis model. Processing is generally permitted by default, with opt-out rights layered on top and opt-in consent required only for narrow… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Green GDPR Article 6 lawful bases apply directly; consent for trackers must be a clear positive act under Article 82 LIL. Health and other special-category data receive enhanced national safeguards… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Red Georgia has no enumerated lawful-bases regime, no general consent-threshold statute, and no general special-category (sensitive data) regime analogous to GDPR Art 6/9. Coverage of consent and… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Amber Lawful processing follows the six GDPR Art 6(1) bases, with Germany exercising the Art 8 opening clause to set the digital-consent age at 16 and the Art 88 opening clause to enact §26 BDSG for… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The Act's foundational provisions on scope, definitions, principles and legal bases for processing are broadly similar to GDPR, including a comparable set of lawful grounds and a similar… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Gibraltar's lawful-basis and special-category framework is inherited directly from the GDPR structure (Arts 6 and 9) via the Gibraltar GDPR, supplemented by DPA 2004 exemptions guidance issued by GRA… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Green GDPR Articles 6, 7 and 9 apply directly, supplemented by Law 4624/2019's specific provisions on the digital consent age (15), employment-context processing, special-category processing for… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber Lawfulness turns on satisfying one of the enumerated conditions in Schedule 2 of the Law, tiered by data category. Consent has a GDPR-equivalent definitional test, and ODPA has issued… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber Lawfulness under the Law is structured around Schedule 2: general processing requires a condition in Part I or II, while special category data requires a condition in Part II or III. The… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Red Hawaii has no GDPR/CCPA-style enumerated lawful-bases regime, no general consent standard for processing, and no cross-sectoral 'special category' data framework. Sector-specific consent/protection… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber PDPO does not use an enumerated GDPR Art.6-style lawful-basis list; instead, its six Data Protection Principles govern collection and use. There is no statutory special/sensitive-category regime… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber GDPR Art 6 lawful bases and Art 9 special-category rules apply directly. The amended Privacy Act layers additional constraints on legal-obligation/public-interest processing and confirms no domestic… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Green Lawful bases, consent standards, and special-category protections apply directly under GDPR Articles 5-9 as incorporated via Act No. 90/2018, with Iceland-specific research derogations under Article… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Red Idaho has no state-enumerated lawful bases for processing personal data, no statutory consent-threshold standard, and no special/sensitive-category regime analogous to GDPR Art. 9. Where sensitive… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber Illinois has no general lawful-basis or consent-threshold framework analogous to GDPR Art 6/7. Consent and special-category-style protections exist only within BIPA (biometric) and GIPA (genetic)… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber DPDPA is consent-centric but supplements consent with nine statutory 'legitimate uses' grounds. Consent must be free, specific, informed, unconditional and unambiguous. Notably, the Act does not… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Green The ICDPA follows the Virginia-model consent/purpose-limitation approach rather than a GDPR Art.6-style enumerated lawful-bases list. Opt-in consent is required for sensitive data (with a COPPA… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber The ICDPA lacks a GDPR-style enumerated list of lawful bases, relying instead on a purpose-and-proportionality standard disclosed via privacy notice. Consent must be freely given, specific, informed… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Green Lawful bases follow GDPR Article 6, with the Data Protection Act 2018 setting Ireland's age of digital consent (Article 8 GDPR) at 16 years and adding a bespoke lawful ground permitting… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Amber Because the Isle of Man has adopted the full text of the EU GDPR domestically (with adaptations), the Article 6 lawful bases and Article 9 special-category regime are understood to apply as adopted.… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Green Lawful bases follow GDPR Art.6 as construed by the Garante (consent, contract, legal obligation, legitimate interest); consent for marketing/telemarketing must be freely given, specific, and… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red No primary-text confirmation was obtained in this run for Côte d'Ivoire's enumerated lawful bases, consent standards, or special-category rules under Law No. 2013-450. Regional pattern… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber Unlike the GDPR, the APPI does not require an enumerated lawful basis for all processing; instead it relies on purpose specification/notification duties plus consent requirements triggered at… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Red Jersey's DPJL 2018 is described by practitioners as broadly aligned with GDPR's lawful-basis and special-category architecture, confirmed indirectly by a 2021 JDPA enforcement decision referencing an… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas has no state-enumerated lawful-basis framework, no general consent-threshold statute, and no state-level special/sensitive-category regime for commercial data processing. These matters are… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Amber Lawful-basis and consent standards derive from Law No. 347-VI (2020), which conditions collection/processing on valid consent and legitimate purpose. Draft amendments would further restrict use of… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber The KCDPA does not use a GDPR-style enumerated lawful-basis model; instead it is a consent/opt-out architecture: general processing is permitted by default subject to disclosure and opt-out rights… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Green The Act sets out lawful bases for both ordinary and sensitive personal data broadly comparable to GDPR Art 6/9, and the General Regulations 2021 require that processing rely on a single legal basis… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red The World Bank's gap analysis finds that Laos's electronic data law relies primarily on consent as the near-exclusive lawful basis for processing, without purpose-limitation or data-minimisation… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber Neither bloc instrument enumerates discrete lawful bases analogous to GDPR Art 6; both rely on general fairness/purpose-limitation framing. The 2026 RIPD Standards materially advance… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber Lawful bases and consent standards follow GDPR Articles 6 and 7 directly, with no confirmed Latvia-specific derogation identified for general lawful bases. Special-category processing has been the… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Green Lawful bases, consent standards, and special-category rules follow GDPR Articles 6, 7 and 9 directly as incorporated via the EEA Agreement, with DSS guidance addressing practical application (e.g.… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Green Lawful bases and consent standards follow GDPR Art. 6/7 directly. VDAI has issued sector guidance on special-category data (biometric, criminal-record) reflecting active supervisory focus on Art.… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber The LDPA imposes consent requirements for sensitive-data processing (health, biometric, genetic, children's data) rather than a GDPR-style enumerated lawful-basis structure. Consent is not required under the PDPA if the data processing falls within the purview of the Section… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Green Slovakia applies the GDPR Art. 6 lawful-basis enumeration and Art. 9 special-category regime directly, with Act 18/2018 providing localized procedural detail. Consent must be an unambiguous… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Green GDPR Articles 6-11 apply directly in Slovenia. ZVOP-2 supplements the GDPR special-categories regime (Article 9) with dedicated national rules on biometric data processing. The specific national… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber POPIA's lawful-processing architecture is built on eight 'conditions for lawful processing' (accountability through data subject participation) rather than a discrete Article 6-style list, with… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Red South Carolina has no general lawful-basis or consent framework for commercial data processing. Consent-like mechanisms exist only within H.3431 (default opt-out of personalized recommendations for… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber South Dakota has not enacted a general lawful-basis, consent-threshold, or special-category framework of the GDPR/CCPA type. The one notable 2026 development is state legislation addressing genetic… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber PIPA recognises consent alongside other legal bases for processing, but the statute does not itself define 'consent,' leaving interpretive gaps filled by Supreme Court rulings and PIPC guidance.… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Green Spain applies GDPR Art 6 lawful bases directly, supplemented by LOPDGDD presumptions (e.g. legitimate interest for professional contact data). Age of digital consent is set at 14 (LOPDGDD Art 7)… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA sets out an enumerated set of lawful bases in Schedule I (Section 5), a defined consent standard elaborated in Schedule III, and enhanced conditions for special/sensitive categories in… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Green GDPR Art 6 lawful bases and Art 9 special-category rules apply directly, supplemented by SFS 2018:218 grounds for public-interest processing. Sweden exercised the Art 8 Member State derogation to set… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber Unlike the GDPR's positive lawful-basis requirement, Swiss law does not require a specified legal basis for processing to be lawful per se; processing is only unlawful if it breaches personality… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber The PDPA provides lawful bases for processing broadly analogous to GDPR Art 6, and affords enhanced protection to a defined set of sensitive categories (medical records, healthcare, genetics, sex… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Red No English-language secondary source retrieved in this run set out Tanzania's enumerated lawful bases, consent standards, special-category rules, or pseudonymisation/anonymisation safe-harbours in… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber TIPA does not adopt a GDPR-style enumerated lawful-bases model; instead it follows the US 'notice-and-choice plus opt-out' structure common to Virginia-lineage state laws, layering an opt-in consent… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber TDPSA does not enumerate GDPR-style Art. 6 lawful bases; it instead follows the Virginia-model notice-and-consent architecture, requiring opt-in consent specifically for sensitive data.… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Green The PDPA's Chapter 2 provisions parallel GDPR Articles 6, 7 and 9. Both texts have similar provisions regarding the legal basis of processing, as both list consent, performance of a… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red The DPA 2011's general privacy principles embed a consent-and-purpose-identification standard, and Part IV (not yet in force) defines 'sensitive personal information'. No GDPR-style enumerated… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red Organic Law 2004-63 is understood to establish lawful-basis, consent, and special-category rules analogous to other first-generation omnibus regimes, but the specific enumerated lawful bases… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Unknown The LPPD's Article 5 sets out lawful-processing grounds broadly analogous to GDPR Art 6, while Article 6 enumerates special/sensitive categories (race, ethnicity, political opinion, philosophical… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber The Act sets consent as a central lawful-processing principle (Section 7) with statutory exceptions, and imposes specific conditions on consent for children and other special categories. Definitions… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber The 2010 Law enumerates six legal grounds for processing, broadly paralleling GDPR Art 6 in structure but with divergent detail; consent is disproportionately relied upon in practice. A 2014… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber The federal PDPL centers processing lawfulness on consent, with statutory exceptions; the DIFC and ADGM free-zone laws mirror GDPR-style lawful bases and special-category definitions, with ADGM… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber UK GDPR retains the six lawful bases from EU GDPR Article 6 but the DUAA 2025 inserts a new 'recognised legitimate interest' basis for a closed list of public-interest purposes, and clarifies that… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber US federal law has no GDPR-style enumerated 'lawful basis' regime; the operative model is notice-plus-choice/opt-out at the state level and sector-specific opt-in consent requirements (chiefly COPPA… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber The CCPA/CPRA does not adopt a GDPR-style enumerated lawful-basis framework; instead it relies on a notice-plus-choice model (opt-out of 'sale'/'share', opt-in consent for minors and for use of… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Red New York has no general lawful-basis framework analogous to GDPR Art. 6, nor a codified 'special category' regime. Consent standards appear only in narrow, purpose-specific statutes: the Child Data… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Amber The LPD's 2008 text already incorporated EU-style consent standards, and the 2018/2020 reforms layered on accountability-driven controls around sensitive data and de-identification. Search coverage… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA does not adopt a GDPR-style enumerated lawful-basis regime; it instead relies on notice-and-opt-out mechanics for targeted advertising, sale, and sensitive-data processing, reserving opt-in… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red Secondary commentary confirms the Act provides ... rules relating to processing of personal data, including special category data, but the enumerated lawful bases (consent… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red There is no enumerated lawful-basis framework analogous to GDPR Article 6. TSJ jurisprudence has articulated general principles applicable to data processing—consent (revocable, prior, informed)… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber S.71 does not adopt a GDPR Article-6-style enumerated lawful-basis list; it instead gates obligations on consumer consent plus quantitative thresholds. Vermont's Genetic Information Privacy Act… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber The PDPL tightens consent standards relative to Decree 13 and imposes materially heavier obligations for sensitive personal data. A full GDPR Art.6-style enumeration of lawful bases distinct from… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber The VCDPA does not use a GDPR Article-6-style enumerated lawful-basis model; general processing proceeds by default subject to purpose- and data-minimization limits, while affirmative opt-in consent… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber Washington has no general enumerated set of lawful bases for processing personal data akin to GDPR Art 6. Instead, the My Health My Data Act imposes a consent-or-necessity standard specific to… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red West Virginia has no general lawful-basis regime, consent standard, or special-category framework analogous to GDPR Articles 6, 7 and 9. Consent and sensitive-data rules apply only through federal… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Red Wisconsin has no codified lawful-basis, consent-standard, or special-category regime analogous to GDPR Articles 6/7/9. The only quasi-special-category treatment arises indirectly through the… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Red Wyoming has no general lawful-basis or consent framework for commercial data processing. The narrow exception is the Wyoming Genetic Data Privacy Act, which imposes consent requirements on… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Red Beyond the general statement that the Act regulates 'the collection and processing of personal data,' no T1/T2 primary text enumerating lawful bases, consent standards, special-category rules, or… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)