Data Protection Monitor · Cross-Jurisdiction Domain Hub
Regulator & framework
Jurisdiction Readings (167 markets)
78 Confirmed
68 Probable
21 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Amber | The Malabo Convention (adopted 27 June 2014) entered into force on 8 June 2023 following Mauritania's ratification as the 15th state under Article 36, but there is no operational continental… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | Alabama currently has no operative comprehensive data-protection statute; the field is governed by the Alabama Data Breach Notification Act of 2018 (in force) plus the newly enacted but… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Amber | Alaska has no dedicated data-protection authority. The Alaska Attorney General's Consumer Protection Unit enforces the state's breach-notification and information-security statutes (Personal… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Green | Alberta's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SA 2003, c P-6.5, enforced by the Office of the Information and Privacy Commissioner of… | Profile →Brief |
| Algeria (DZ) | Africa | Amber | Algeria's comprehensive data-protection regime rests on Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data, which created the Autorité Nationale de… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Amber | Secondary-source tracking (IAPP's Global Privacy Law and DPA Directory) lists Antigua and Barbuda as having a named data protection authority and a titled statute, but no primary gazette text… | Profile →Brief |
| Argentina (AR) | Americas | Green | Argentina's data-protection regime is anchored in Ley 25.326 (Personal Data Protection Act, 2000) and its implementing Decreto 1558/2001 (as amended by Decreto 1160/10). The Agencia de Acceso a la… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Arizona has no dedicated data-protection authority and no omnibus consumer-privacy statute. The Arizona Attorney General (AG) is the de facto regulator, exercising authority under the state's general… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Amber | Arkansas has no comprehensive consumer data-protection statute. The state's privacy-relevant legal architecture is limited to the Personal Information Protection Act (PIPA, Ark. Code Ann. § 4-110-101… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | APAC as a bloc has no single unified data-protection regulator or comprehensive statute. Two parallel, non-converging voluntary mechanisms exist: the Global CBPR Forum (successor to the APEC CBPR… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Green | Australia's data-protection regime is anchored in the Privacy Act 1988 (Cth), a comprehensive omnibus statute containing 13 Australian Privacy Principles (APPs) applied and enforced by the Office of… | Profile →Brief |
| Austria (AT) | Europe | Green | Austria is an EU Member State operating under the directly-applicable GDPR, supplemented by the national Datenschutzgesetz (DSG, BGBl I No 165/1999 as amended), which establishes the… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Amber | Bangladesh's data protection landscape moved from a decade of draft bills (2022 Draft Data Protection Act, 2023 ICT Department drafts) into a live instrument: the Data Protection Ordinance, 2025. The… | Profile →Brief |
| Belgium (BE) | Europe | Green | Belgium is an EU Member State operating under the GDPR (Regulation (EU) 2016/679) as the omnibus instrument, implemented domestically through the Act of 3 December 2017 Establishing the Data… | Profile →Brief |
| Belize (BZ) | Americas | Amber | Belize's data protection regime rests on the Data Protection Act, Chapter 43:14 of the Laws of Belize (commercially referenced as the 'Data Protection Act, 2021'), which established a statutory body… | Profile →Brief |
| Brazil (BR) | Americas | Green | Brazil's data protection framework is anchored in the LGPD (Law 13.709/2018, as amended by Law 13.853/2019), enforced by ANPD, which in September 2025 was upgraded from a transitional… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Green | British Columbia's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SBC 2003, c. 63, overseen by the Office of the Information and Privacy… | Profile →Brief |
| Bulgaria (BG) | Europe | Green | Bulgaria is an EU Member State applying the GDPR directly since 25 May 2018, supplemented by the national Protection of Personal Data Act 2002 (last amended 2023), which layers DPO-notification… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | Cambodia has no comprehensive, enacted data protection statute in force. The Ministry of Post and Telecommunications (MPTC) unveiled a draft Law on Personal Data Protection (LPDP) that, if passed… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | Cameroon moved from a sector-adjacent cybersecurity framework (Law No. 2010/012 of 21 December 2010 relating to Cybersecurity and Cybercriminality) to a dedicated data-protection statute. A draft law… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | CA-KAH (Kahnawake Mohawk Territory) presents an unusual compound regulatory picture: there is no single comprehensive 'Kahnawake privacy statute.' The federal Personal Information Protection and… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | Tobique First Nation (a reserve community in New Brunswick) is not subject to a dedicated Indigenous or provincial private-sector data-protection statute. The operative regime is the federal Personal… | Profile →Brief |
| Chile (CL) | Americas | Amber | Chile is mid-transition from the 1999 Ley N.º 19.628 sobre Protección de la Vida Privada (a minimal, civil-court-enforced regime with no dedicated regulator) to a GDPR-influenced omnibus regime under… | Profile →Brief |
| China (CN) | Asia-Pacific | Green | China's data protection regime rests on three interlocking national laws — the Cybersecurity Law (CSL, 2017, amended 2025), the Data Security Law (DSL, 2021) and the Personal Information Protection… | Profile →Brief |
| Colombia (CO) | Americas | Green | Colombia operates a dual-statute omnibus regime: Statutory Law 1581 of 2012 (general personal data protection) and Statutory Law 1266 of 2008 (habeas data financiero / credit reporting), both… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Green | Colorado is governed by the Colorado Privacy Act (CPA), a comprehensive consumer-privacy statute enforced exclusively by the Colorado Attorney General (with District Attorney co-enforcement… | Profile →Brief |
| Comoros (KM) | Africa | Red | Extensive searching across cross-jurisdictional legal trackers (OneTrust DataGuidance jurisdiction/African Bodies pages, IAPP Global Privacy Law and DPA Directory commentary, UNCTAD-referenced… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No dedicated data-protection supervisory authority or comprehensive data-protection statute could be located for the Union of the Comoros, of which Anjouan (Nzwani) is an autonomous island. Global… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No data protection authority and no comprehensive data-protection statute exist for the Union of the Comoros, of which Mohéli (Mwali) is one of three constituent islands under a unitary national… | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | Connecticut's comprehensive consumer privacy regime is the Connecticut Data Privacy Act (CTDPA), Public Act No. 22-15 (Conn. Gen. Stat. § 42-515 et seq.), signed May 10, 2022 and effective July 1… | Profile →Brief |
| Costa Rica (CR) | Americas | Green | Costa Rica operates a comprehensive omnibus data-protection regime under Law No. 8968 of 2011, enforced by PRODHAB, a decentralized body attached to the Ministry of Justice and Peace. <cite… | Profile →Brief |
| Croatia (HR) | Europe | Green | Croatia is an EU Member State applying the GDPR directly, supplemented by the national Act on the Implementation of the General Data Protection Regulation (Narodne novine No. 42/2018). The Croatian… | Profile →Brief |
| Curaçao (CW) | Caribbean | Amber | Curaçao's data protection regime rests on a single omnibus-style statute — Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data — but the supervisory authority… | Profile →Brief |
| Cyprus (CY) | Europe | Green | Cyprus operates a GDPR-omnibus regime. The GDPR applies directly as an EU Regulation and is supplemented by Law 125(I) of 2018, the national implementing act, which entered into force on 31 July 2018… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | Czech Republic is an EU Member State operating under the direct-effect GDPR, implemented and supplemented nationally by Act No. 110/2019 Coll. on Personal Data Processing, which establishes the… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Green | Delaware's comprehensive consumer-privacy regime is the Delaware Personal Data Privacy Act (DPDPA), 6 Del. C. § 12D-101 et seq., signed September 11, 2023 and in force since January 1, 2025, enforced… | Profile →Brief |
| Denmark (DK) | Europe | Green | Denmark implements the GDPR through the Danish Data Protection Act (Databeskyttelsesloven, 2018), enforced by Datatilsynet (the Danish Data Protection Agency), which retains its pre-existing… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Amber | The District of Columbia has no comprehensive omnibus consumer-privacy statute. The operative regime is a patchwork: (1) the federal FTC Act Section 5 general unfair/deceptive-practices authority… | Profile →Brief |
| Dominican Republic (DO) | Americas | Amber | The Dominican Republic's data-protection regime rests on Law No. 172-13 (2013), a comprehensive statute covering personal data held in archives, public registries, databases and other technical… | Profile →Brief |
| Ecuador (EC) | Americas | Green | JID=EC covers the data-protection regime applicable to the EU institutions, bodies, offices and agencies (EUIs) themselves — i.e. the European Commission, Parliament, Council, agencies, EU IT-systems… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Egypt's omnibus regime rests on Law No. 151 of 2020 on the Protection of Personal Data (PDPL), which entered into force on 15 October 2020, with the Personal Data Protection Center (PDPC) as… | Profile →Brief |
| Estonia (EE) | Europe | Green | Estonia's data-protection regime is anchored in the GDPR, which applies directly as EU law, and the national Personal Data Protection Act (Isikuandmete kaitse seadus, PDPA), which entered into force… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Green | The EEA (EU-27 plus Iceland, Liechtenstein and Norway) is governed by Regulation (EU) 2016/679 (GDPR) as the comprehensive omnibus instrument, incorporated into Annex XI of the EEA Agreement and… | Profile →Brief |
| Finland (FI) | Europe | Green | Finland is an EU Member State operating under the directly-applicable GDPR, nationally supplemented by the Data Protection Act (1050/2018), which entered into force 1 January 2019 and repealed the… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | Florida operates a hybrid regime: a narrow-scope comprehensive statute (the Florida Digital Bill of Rights, enacted as SB 262, consumer-data provisions effective 1 July 2024) layered on top of the… | Profile →Brief |
| France (FR) | Europe | Green | France applies the GDPR directly alongside the national Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés), as substantially rewritten by the Law of 20 June 2018, Ordonnance n° 2018-1125… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Red | US-GA (the U.S. state of Georgia) has no dedicated data-protection authority and no comprehensive consumer-privacy statute. The Georgia Attorney General enforces general consumer-protection law (Fair… | Profile →Brief |
| Germany (DE) | Europe | Green | Germany applies the GDPR directly, supplemented by the federal Bundesdatenschutzgesetz (BDSG-neu) which is subsidiary and applies only where the GDPR permits national derogation or leaves gaps.… | Profile →Brief |
| Ghana (GH) | Africa | Green | Ghana operates a comprehensive omnibus data protection regime under the Data Protection Act, 2012 (Act 843), supervised by the Data Protection Commission (DPC), which is a functioning, currently-led… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Green | Gibraltar operates a GDPR-style comprehensive regime supervised by the Gibraltar Regulatory Authority (GRA), which acts as the Information Commissioner's function under the Data Protection Act 2004… | Profile →Brief |
| Greece (GR) | Europe | Green | Greece operates a mature, GDPR-aligned omnibus regime. The Hellenic Data Protection Authority (HDPA) is the primary supervisory authority, re-established and empowered by Law 4624/2019, which… | Profile →Brief |
| Guernsey (GG) | Europe | Green | Guernsey operates a GDPR-equivalent omnibus regime under the Data Protection (Bailiwick of Guernsey) Law, 2017, supervised by the Office of the Data Protection Authority (ODPA). <cite index="4-4">The… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Green | Alderney (as part of the Bailiwick of Guernsey) is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, a single omnibus statute applied across Guernsey, Alderney and Sark. The Office… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | Hawaii has no comprehensive state consumer-privacy statute or dedicated data-protection authority. The Hawaii Attorney General's Office of Consumer Protection is the principal state-level enforcer… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | Hong Kong's data protection regime is anchored in the Personal Data (Privacy) Ordinance (Cap. 486), a comprehensive omnibus statute enforced by the Privacy Commissioner for Personal Data (PCPD). The… | Profile →Brief |
| Hungary (HU) | Europe | Green | Hungary is an EU Member State applying the GDPR directly, supplemented by the national Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the 'Privacy… | Profile →Brief |
| Iceland (IS) | Europe | Green | Iceland is an EEA/EFTA state that has incorporated the GDPR into its domestic legal order via Act No. 90/2018 on Data Protection and the Processing of Personal Data, giving Persónuvernd (the… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Amber | Idaho has no dedicated data-protection regulator or comprehensive privacy statute. Enforcement authority rests with the Idaho Attorney General under general consumer-protection powers, layered under… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | Illinois has no comprehensive omnibus consumer-privacy statute. The regulatory landscape is a sectoral patchwork: the Biometric Information Privacy Act (BIPA, 740 ILCS 14), the Personal Information… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | India's Digital Personal Data Protection Act, 2023 (DPDPA) was enacted August 2023 but remained non-operational until the Ministry of Electronics and Information Technology (MeitY) notified the… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Green | Indiana's data-protection regime is anchored in the Indiana Consumer Data Protection Act (ICDPA), IC 24-15, enacted as P.L.94-2023 (Senate Bill 5) and now in force as of January 1, 2026. Enforcement… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Green | Iowa's data-protection regime is anchored in the Iowa Consumer Data Protection Act (ICDPA, Senate File 262), a comprehensive consumer-privacy statute enforced exclusively by the Iowa Attorney… | Profile →Brief |
| Ireland (IE) | Europe | Green | Ireland's data protection regime is the EU's GDPR (Regulation (EU) 2016/679) as given further effect domestically by the Data Protection Act 2018, which commenced 25 May 2018 and established the Data… | Profile →Brief |
| Isle of Man (IM) | Europe | Green | The Isle of Man (a self-governing British Crown Dependency, not part of the UK or EU) operates a GDPR-equivalent omnibus regime. It has chosen to adopt the EU GDPR and the Law Enforcement Directive… | Profile →Brief |
| Italy (IT) | Europe | Green | Italy is an EU Member State applying GDPR directly, supervised by the Garante per la protezione dei dati personali, seated in Rome, operating under the Codice Privacy (D.Lgs. 196/2003 as amended by… | Profile →Brief |
| Ivory Coast (CI) | Africa | Amber | Côte d'Ivoire's personal data regime rests on Law No. 2013-450 of 19 June 2013 on the Protection of Personal Data, a comprehensive omnibus statute. The Autorité de Régulation des… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Green | Japan operates a comprehensive omnibus data protection regime centred on the Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, as substantially amended in 2015, 2020 and 2021)… | Profile →Brief |
| Jersey (JE) | Europe | Amber | Jersey operates a GDPR-aligned omnibus regime built on two companion statutes: the Data Protection (Jersey) Law 2018 (DPJL 2018), the substantive code, and the Data Protection Authority (Jersey) Law… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Kansas has no comprehensive omnibus consumer-privacy statute. The operative regime is (a) federal FTC Act Section 5 unfair/deceptive-practices authority applied nationally, (b) the Kansas Consumer… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Amber | Kazakhstan's data-protection regime rests on the omnibus Law No. 94-V of 21 May 2013 On Personal Data and its Protection, amended and operationalised by the Law of 25 June 2020 No. 347-VI. <cite… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Green | Kentucky's comprehensive consumer-privacy regime is the Kentucky Consumer Data Protection Act (KCDPA), enacted as House Bill 15 (signed April 4, 2024) and codified at KRS 367.3611–367.3629, which… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Kenya's Data Protection Act, 2019 (DPA) is the primary omnibus instrument, enacted to give effect to the constitutional right to privacy under Article 31(c) and (d) of the Constitution. It closely… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | Laos has no independent data-protection authority. The Ministry of Technology and Communications (MTC) implements the Law on Electronic Data Protection, creating no separation between rule-setter… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Red | There is no bloc-wide, binding LATAM regulator or omnibus statute. The operative Americas-wide layer is the OAS 'Updated Principles on Privacy and Personal Data Protection' (2021) — expressly… | Profile →Brief |
| Latvia (LV) | Europe | Green | Latvia's data-protection regime is anchored on the GDPR as directly-applicable EU law, implemented and supplemented domestically by the Personal Data Processing Law of 21 June 2018 (Fizisko personu… | Profile →Brief |
| Liechtenstein (LI) | Europe | Green | Liechtenstein is an EEA-EFTA state that has incorporated the GDPR directly via EEA Joint Committee Decision No. 154/2018, giving the Regulation direct legal effect. The domestic implementing… | Profile →Brief |
| Lithuania (LT) | Europe | Green | Lithuania is an EU Member State fully subject to the GDPR, supervised by the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, 'VDAI'), and implementing GDPR via a national… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | Louisiana's data-protection posture materially changed on 2026-05-29: Governor signed SB 386, the Louisiana Data Privacy Act (LDPA), creating a new Chapter 20-B of Title 51 of the Louisiana Revised… | Profile →Brief |
| Luxembourg (LU) | Europe | Green | Luxembourg is an EU Member State subject to the directly-applicable GDPR, given national institutional effect via the Loi du 1er août 2018 portant organisation de la Commission nationale pour la… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | Maine has no comprehensive omnibus consumer-privacy statute. The Maine Attorney General enforces a patchwork of the state's own sector-specific statutes (broadband-ISP privacy law, insurance… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Green | Malaysia's data-protection regime is anchored in the Personal Data Protection Act 2010 (Act 709, 'PDPA'), administered by the Personal Data Protection Commissioner supported by the Department of… | Profile →Brief |
| Malta (MT) | Europe | Green | Malta is an EU Member State in which the GDPR applies with direct effect; the Data Protection Act (Chapter 586 of the Laws of Malta) transposes the Member-State-discretion elements of the GDPR and… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | The Republic of the Marshall Islands (RMI) has no comprehensive/omnibus data-protection statute and no dedicated data-protection authority. Privacy-adjacent protection exists only as: (i) a… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | Maryland's data-protection landscape is anchored by the Maryland Online Data Privacy Act (MODPA), enacted May 9, 2024 and effective October 1, 2025, enforced exclusively by the Maryland Attorney… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Red | Massachusetts has no comprehensive consumer-privacy statute analogous to GDPR/CCPA. The operative regime is a patchwork: (1) the Massachusetts Attorney General's general consumer-protection authority… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico's private-sector data protection regime underwent a foundational institutional rupture between Nov 2024 and mid-2025. The Senate approved a constitutional 'organic simplification' reform… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | Michigan has no comprehensive omnibus consumer-privacy statute. Data-protection matters in Michigan are governed by a patchwork: (1) the federal FTC Act Section 5 unfair/deceptive-practices… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Green | Minnesota's data-protection landscape is anchored by the Minnesota Consumer Data Privacy Act (MCDPA), codified at Minnesota Statutes chapter 325M, which took effect July 31, 2025 and is enforced… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Amber | Mississippi has no comprehensive, GDPR/CCPA-style consumer-privacy statute. The operative legal architecture is (a) the federal FTC Act Section 5 general unfair/deceptive-practices authority… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | Missouri has no comprehensive consumer-privacy statute. The operative state instrument is the data-breach notification law at Mo. Rev. Stat. §407.1500 (Chapter 407, Title XXVI), enforced exclusively… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Green | Montana's comprehensive consumer privacy regime is the Montana Consumer Data Privacy Act (MTCDPA), enacted 2023 and effective October 1, 2024, amended by SB 297 effective October 1, 2025. Enforcement… | Profile →Brief |
| Morocco (MA) | Africa | Amber | Morocco's data protection regime rests on Law n° 09-08 of 18 February 2009 and its Implementing Decree n° 2-09-165 of 21 May 2009, supervised by the CNDP. A 2018 Morocco-EU gap-analysis study found… | Profile →Brief |
| Mozambique (MZ) | Africa | Amber | Mozambique has no comprehensive data protection statute and no independent dedicated data protection authority. The framework rests on Article 71 of the Constitution (general basis only), sectoral… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | Myanmar has no omnibus data protection statute and no dedicated general data protection authority. Privacy-related obligations instead arise from a patchwork of the 2008 Constitution, the Law… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | Nebraska has no dedicated data-protection authority. The Nebraska Data Privacy Act (NDPA, LB 1074), a WPA-model comprehensive consumer privacy statute, is enforced exclusively by the Nebraska… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | Nepal has no independent, dedicated data-protection authority. <cite index="6-4">The Act does not provide for a data protection authority or regulatory authority.</cite> Adjacent regulatory… | Profile →Brief |
| Netherlands (NL) | Europe | Green | The Netherlands is an EU Member State operating under the GDPR as the omnibus instrument, implemented and supplemented domestically by the Uitvoeringswet Algemene verordening gegevensbescherming… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Nevada has no comprehensive omnibus consumer-privacy statute equivalent to the GDPR or the CCPA. The state's data-protection footprint is a narrow sectoral patchwork built on NRS Chapter 603A… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Green | New Brunswick's data-protection position is a layered federal/provincial construct rather than a single provincial omnibus statute. The federal Personal Information Protection and Electronic… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Green | New Hampshire's data-protection regime is anchored in RSA 507-H, the New Hampshire Data Privacy Act (NHDPA), which took effect January 1, 2025 and is enforced exclusively by a dedicated Data Privacy… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Green | New Jersey's comprehensive consumer privacy regime is the New Jersey Data Privacy Law (NJDPL), P.L.2023, c.266, enforced exclusively by the New Jersey Attorney General acting through the Division of… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | New Mexico has no comprehensive omnibus consumer-privacy statute. The operative framework is (a) the federal FTC Act Section 5 unfair/deceptive-practices baseline enforced nationally, (b) New… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Green | New Zealand's data-protection regime is anchored in the Privacy Act 2020, which repealed and replaced the Privacy Act 1993 and entered into force 1 December 2020, overseen by the Office of the… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | Nigeria's regime is anchored on the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) as a statutory independent authority, elevating the prior… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Red | North Carolina has no dedicated data-protection authority and no comprehensive consumer-privacy statute. The state operates within the US federal sectoral patchwork: the FTC enforces general… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Amber | North Dakota has no dedicated comprehensive data-protection regulator or statute. Enforcement authority sits with the North Dakota Attorney General under general state consumer-protection powers… | Profile →Brief |
| Norway (NO) | Europe | Green | Norway is not an EU Member State but implements the GDPR in full via the EEA Agreement. Datatilsynet is the competent supervisory authority. The Personal Data Act (Act of 15 June 2018 no. 38) is the… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Amber | Ohio has no dedicated data-protection regulator or comprehensive privacy statute. The governing framework is a composite of (a) the FTC's general Section 5 unfair/deceptive-practices authority, which… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Amber | As of the 2026-08-06 dispatch date, Oklahoma has no comprehensive consumer-privacy statute IN FORCE. The operative regime is sectoral/reactive: the federal FTC Act Section 5… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | CA-ON sits inside Canada's federated privacy architecture: the federal Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA as the general private-sector omnibus statute across Ontario… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Green | Oregon's comprehensive consumer privacy regime is the Oregon Consumer Privacy Act (OCPA), <cite index="1-20">The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589, was signed into law by… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | Pakistan has no independent dedicated data protection authority. The Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence and has circulated multiple drafts of a… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No comprehensive data-protection or privacy statute, and no dedicated data-protection authority, has been identified for the Republic of Palau. Secondary jurisdiction trackers (OneTrust DataGuidance)… | Profile →Brief |
| Panama (PA) | Americas | Green | Panama's omnibus regime is Law No. 81 of 26 March 2019 on the Protection of Personal Data, supervised by the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Amber | Pennsylvania has no comprehensive consumer-privacy statute. The Pennsylvania Attorney General (Bureau of Consumer Protection) is the primary regulator, acting under the general Unfair Trade Practices… | Profile →Brief |
| Peru (PE) | Americas | Green | Peru operates a comprehensive omnibus data-protection regime anchored on Ley N° 29733 (2011), Ley de Protección de Datos Personales, as substantially reformed by Decreto Legislativo N° 1353 (2017)… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Green | The Philippines operates a comprehensive omnibus data protection regime under the Data Privacy Act of 2012 (Republic Act No. 10173, 'the Act'), enforced by the National Privacy Commission (NPC). The… | Profile →Brief |
| Poland (PL) | Europe | Green | Poland's data protection regime is a GDPR-implementation jurisdiction. The Act of 10 May 2018 on the Protection of Personal Data establishes the Prezes Urzędu Ochrony Danych Osobowych (President of… | Profile →Brief |
| Portugal (PT) | Europe | Green | Portugal operates a GDPR-aligned omnibus regime. The CNPD (Comissão Nacional de Proteção de Dados) is the sole national supervisory authority, and Law No. 58/2019 (the GDPR Implementation Law) sits… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | Qatar operates two entirely separate data-protection perimeters. Mainland Qatar is governed by Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data, supervised by the National Cyber… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Green | Quebec operates a comprehensive, GDPR-influenced private-sector data protection regime under the Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | Rhode Island's data-protection regime is anchored in the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), R.I. Gen. Laws Title 6, Ch. 48.1, enacted 25 June 2024 via gubernatorial… | Profile →Brief |
| Romania (RO) | Europe | Green | Romania implements the GDPR through Law No. 190/2018 Implementing the General Data Protection Regulation, with the National Supervisory Authority for Personal Data Processing (ANSPDCP) as the… | Profile →Brief |
| Russia (RU) | Europe | Green | Russia's data-protection regime is anchored in Federal Law No. 152-FZ 'On Personal Data' (27 July 2006, as amended), supervised by Roskomnadzor (the Federal Service for Supervision of Communications… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | Rwanda's data-protection regime is anchored in Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy, a comprehensive GDPR-influenced statute supervised by the… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Green | Saudi Arabia's Personal Data Protection Law (PDPL), enacted by Royal Decree M/19 and amended in March 2023, is a GDPR-style omnibus statute administered by the Saudi Data and Artificial Intelligence… | Profile →Brief |
| Senegal (SN) | Africa | Green | Senegal operates a comprehensive omnibus data-protection regime under Law No. 2008-12 of 25 January 2008 Concerning Personal Data Protection, implemented by Decree No. 2008-721 of 30 June 2008. The… | Profile →Brief |
| Serbia (RS) | Europe | Green | Serbia's data-protection regime is anchored in the Law on Personal Data Protection ('Official Gazette of RS' No. 87/2018, 'LPDP'), adopted as part of Serbia's EU-candidacy harmonization obligations… | Profile →Brief |
| Seychelles (SC) | Africa | Green | Seychelles' comprehensive data-protection framework is the Data Protection Act, 2023, which repealed and replaced the Data Protection Act, 2003. The Act was gazetted and entered into force on 22… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Green | Singapore's omnibus regime is the Personal Data Protection Act 2012 (No. 26 of 2012, 'PDPA'), administered by the Personal Data Protection Commission (PDPC). <cite index="58-1">The PDPC is empowered… | Profile →Brief |
| Slovakia (SK) | Europe | Green | Slovakia is an EU Member State operating under direct application of the GDPR, supplemented by national implementing Act No. 18/2018 Coll. The competent supervisory authority is the Úrad na ochranu… | Profile →Brief |
| Slovenia (SI) | Europe | Green | Slovenia is an EU Member State operating under the GDPR as directly-applicable EU law, implemented and supplemented nationally by the Personal Data Protection Act (ZVOP-2), adopted 15 December 2022… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | South Africa's omnibus regime is the Protection of Personal Information Act, 2013 (POPIA), supervised by the Information Regulator. POPIA was promulgated in 2013 but commenced in stages; most… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | South Carolina has no dedicated data-protection authority. Enforcement is split between the South Carolina Attorney General (general consumer protection and, since 2026, the new minors'… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | South Dakota has no comprehensive state consumer-privacy statute and no dedicated state data-protection authority. The operative framework is (a) the federal FTC Act Section 5… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Green | South Korea's Personal Information Protection Act (PIPA), enacted 2011 and substantially rewritten since, is enforced by the Personal Information Protection Commission (PIPC), which received… | Profile →Brief |
| Spain (ES) | Europe | Green | Spain operates a fully-implemented GDPR omnibus regime. The Agencia Española de Protección de Datos (AEPD) is the national supervisory authority, operating under Ley Orgánica 3/2018 (LOPDGDD)… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) is the first comprehensive data-protection statute in the jurisdiction, establishing the Data Protection Authority of Sri Lanka.… | Profile →Brief |
| Sweden (SE) | Europe | Green | Sweden is an EU Member State and applies the GDPR directly, supplemented nationally by the Act with Supplementary Provisions to the GDPR (SFS 2018:218). The Swedish Authority for Privacy Protection… | Profile →Brief |
| Switzerland (CH) | Europe | Green | Switzerland's data protection regime is governed by the revised Federal Act on Data Protection (revFADP, FADP 2020), which entered into force on 1 September 2023 alongside its implementing Ordinance… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | Taiwan's data protection regime rests on the Personal Data Protection Act (PDPA) 2010, as amended in 2015 and further amended in 2023 and 2025-2026, plus its Enforcement Rules. Historically, the… | Profile →Brief |
| Tanzania (TZ) | Africa | Green | Tanzania's comprehensive data protection regime is anchored in the Personal Data Protection Act, Act No. 11 of 2022 (PDPA), which established the Personal Data Protection Commission (PDPC) as… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | CRITICAL CORRECTION TO INJECTED SEED: the seed's disambiguation stating Tennessee has NO comprehensive consumer-privacy statute is STALE. Research confirms the Tennessee Information Protection Act… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Green | Texas has no dedicated data-protection authority; enforcement of the state's comprehensive privacy statute and adjacent biometric/breach laws sits with the Office of the Attorney General (OAG)… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Green | Thailand's data-protection regime is anchored in the Personal Data Protection Act B.E. 2562 (2019) (PDPA), a GDPR-influenced omnibus statute. <cite index="2-1,2-2">The Personal Data Protection Act… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | Trinidad and Tobago's Data Protection Act, 2011 (Cap. 22:04) is a partially-proclaimed omnibus statute. Section 1(2) requires commencement by Presidential Proclamation, and only Part I (general… | Profile →Brief |
| Tunisia (TN) | Africa | Amber | Tunisia's data-protection regime rests on Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data, a cross-sectoral statute enforced by the Instance Nationale de Protection des… | Profile →Brief |
| Turkey (TR) | Europe | Green | Turkey operates a comprehensive omnibus regime under Law No. 6698 on the Protection of Personal Data (LPPD/KVKK Law), enforced by the Personal Data Protection Authority (KVKK/Kurul). The law was… | Profile →Brief |
| Uganda (UG) | Africa | Green | Uganda operates a comprehensive omnibus regime under the Data Protection and Privacy Act, 2019 (DPPA), supplemented by the Data Protection and Privacy Regulations, 2021. The Regulations establish the… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | Ukraine's data protection regime rests on the Law of 1 June 2010 No. 2297-VI 'On Personal Data Protection' (as amended), enforced by the Verkhovna Rada Commissioner for Human Rights (Ombudsman)… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | The UAE federal regime rests on Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), enforced by the newly established Emirates Data Office (UAE Data Office). Layered on top… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | The UK's data protection regime is anchored in UK GDPR, the Data Protection Act 2018 (DPA 2018) and PECR 2003, all substantially amended by the Data (Use and Access) Act 2025 (DUAA), which received… | Profile →Brief |
| United States (US) | Americas | Amber | At the US federal level there is no single omnibus data-protection statute or single supervisory authority. The Federal Trade Commission (FTC) acts as the de facto general privacy regulator, using… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | California operates a hybrid regime: the California Consumer Privacy Act of 2018 (CCPA), as substantially amended and expanded by the 2020 ballot initiative CPRA (Proposition 24), is administered by… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | New York has no single comprehensive data-protection statute. The New York Attorney General (Bureau of Internet & Technology) is the primary consumer-privacy enforcer, operating under the Stop Hacks… | Profile →Brief |
| Uruguay (UY) | Americas | Green | Uruguay's data protection regime is anchored in Law No. 18.331 of 11 August 2008 (the LPD/Habeas Data Act), regulated by Decree No. 414/009 of 31 August 2009, and substantially reformed by Law No.… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Green | Utah's data-protection landscape is anchored by the Utah Consumer Privacy Act (UCPA, SB 227), a comprehensive but business-friendly consumer-privacy statute enacted 24 March 2022 and effective 31… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Amber | Vanuatu's comprehensive data-protection statute is the Data Protection and Privacy Act No. 13 of 2024. <cite index="1-4,1-5">Law: Data Protection and Privacy Act No. 13 of 2024 (the Data Protection… | Profile →Brief |
| Venezuela (VE) | Americas | Red | Venezuela has no comprehensive data-protection statute and no dedicated data-protection authority. Constitutional habeas data (Article 28) and Article 60's privacy/digital-information-limitation… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | The injected seed's disambiguation (no comprehensive VT statute) is now materially STALE: on 16 June 2026 Governor Phil Scott signed the Vermont Data Privacy and Online Surveillance Act (S.71)… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | Vietnam's data-protection regime was fundamentally superseded during the seed-anchor window: the injected seed anchored on Decree 13/2023/ND-CP (PDPD), but research confirms Vietnam's National… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | Virginia's data-protection regime is anchored in the Virginia Consumer Data Protection Act (VCDPA), Va. Code §§59.1-575 et seq., effective January 1, 2023, enforced exclusively by the Virginia… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | Washington State has no dedicated data-protection regulator and no comprehensive omnibus consumer-privacy statute. The Washington State Attorney General enforces sectoral privacy laws — principally… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Red | West Virginia has no dedicated data-protection authority. Privacy-adjacent enforcement rests with the West Virginia Attorney General's Consumer Protection function acting under general state… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Amber | Wisconsin has no dedicated data-protection authority and no comprehensive consumer-privacy statute. The operative state-level instrument is the general data-breach-notification statute (Wis. Stat. §… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Red | Wyoming has no dedicated data-protection regulator or comprehensive privacy statute. The Consumer Protection Unit of the Wyoming Attorney General enforces the state's general Consumer Protection Act… | Profile →Brief |
| Zambia (ZM) | Africa | Amber | Zambia's principal data-protection instrument is the Data Protection Act, 2021 (Act No. 3 of 2021), which succeeded the Data Protection Bill, 2020 submitted to the National Assembly in December 2020.… | Profile →Brief |