--- title: "Regulator & framework — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/regulator-and-framework/ source_html: /domains/regulator-and-framework/index.html description: "Cross-jurisdiction comparison of Regulator & framework across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 503a35f8186145619dd27c0de8f447c31b393e8d1d23e7cbd804278454006f0e generator: "fe-fleet/md-twin@1.0" --- # Regulator & framework — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 78 Confirmed 68 Probable 21 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Amber The Malabo Convention (adopted 27 June 2014) entered into force on 8 June 2023 following Mauritania's ratification as the 15th state under Article 36, but there is no operational continental… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Alabama currently has no operative comprehensive data-protection statute; the field is governed by the Alabama Data Breach Notification Act of 2018 (in force) plus the newly enacted but… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Amber Alaska has no dedicated data-protection authority. The Alaska Attorney General's Consumer Protection Unit enforces the state's breach-notification and information-security statutes (Personal… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Green Alberta's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SA 2003, c P-6.5, enforced by the Office of the Information and Privacy Commissioner of… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Amber Algeria's comprehensive data-protection regime rests on Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data, which created the Autorité Nationale de… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Amber Secondary-source tracking (IAPP's Global Privacy Law and DPA Directory) lists Antigua and Barbuda as having a named data protection authority and a titled statute, but no primary gazette text… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Green Argentina's data-protection regime is anchored in Ley 25.326 (Personal Data Protection Act, 2000) and its implementing Decreto 1558/2001 (as amended by Decreto 1160/10). The Agencia de Acceso a la… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Arizona has no dedicated data-protection authority and no omnibus consumer-privacy statute. The Arizona Attorney General (AG) is the de facto regulator, exercising authority under the state's general… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Amber Arkansas has no comprehensive consumer data-protection statute. The state's privacy-relevant legal architecture is limited to the Personal Information Protection Act (PIPA, Ark. Code Ann. § 4-110-101… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red APAC as a bloc has no single unified data-protection regulator or comprehensive statute. Two parallel, non-converging voluntary mechanisms exist: the Global CBPR Forum (successor to the APEC CBPR… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Green Australia's data-protection regime is anchored in the Privacy Act 1988 (Cth), a comprehensive omnibus statute containing 13 Australian Privacy Principles (APPs) applied and enforced by the Office of… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Green Austria is an EU Member State operating under the directly-applicable GDPR, supplemented by the national Datenschutzgesetz (DSG, BGBl I No 165/1999 as amended), which establishes the… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Amber Bangladesh's data protection landscape moved from a decade of draft bills (2022 Draft Data Protection Act, 2023 ICT Department drafts) into a live instrument: the Data Protection Ordinance, 2025. The… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green Belgium is an EU Member State operating under the GDPR (Regulation (EU) 2016/679) as the omnibus instrument, implemented domestically through the Act of 3 December 2017 Establishing the Data… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Amber Belize's data protection regime rests on the Data Protection Act, Chapter 43:14 of the Laws of Belize (commercially referenced as the 'Data Protection Act, 2021'), which established a statutory body… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Green Brazil's data protection framework is anchored in the LGPD (Law 13.709/2018, as amended by Law 13.853/2019), enforced by ANPD, which in September 2025 was upgraded from a transitional… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Green British Columbia's private-sector data protection regime is anchored in the Personal Information Protection Act (PIPA), SBC 2003, c. 63, overseen by the Office of the Information and Privacy… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Green Bulgaria is an EU Member State applying the GDPR directly since 25 May 2018, supplemented by the national Protection of Personal Data Act 2002 (last amended 2023), which layers DPO-notification… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red Cambodia has no comprehensive, enacted data protection statute in force. The Ministry of Post and Telecommunications (MPTC) unveiled a draft Law on Personal Data Protection (LPDP) that, if passed… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber Cameroon moved from a sector-adjacent cybersecurity framework (Law No. 2010/012 of 21 December 2010 relating to Cybersecurity and Cybercriminality) to a dedicated data-protection statute. A draft law… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber CA-KAH (Kahnawake Mohawk Territory) presents an unusual compound regulatory picture: there is no single comprehensive 'Kahnawake privacy statute.' The federal Personal Information Protection and… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber Tobique First Nation (a reserve community in New Brunswick) is not subject to a dedicated Indigenous or provincial private-sector data-protection statute. The operative regime is the federal Personal… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Chile is mid-transition from the 1999 Ley N.º 19.628 sobre Protección de la Vida Privada (a minimal, civil-court-enforced regime with no dedicated regulator) to a GDPR-influenced omnibus regime under… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Green China's data protection regime rests on three interlocking national laws — the Cybersecurity Law (CSL, 2017, amended 2025), the Data Security Law (DSL, 2021) and the Personal Information Protection… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Green Colombia operates a dual-statute omnibus regime: Statutory Law 1581 of 2012 (general personal data protection) and Statutory Law 1266 of 2008 (habeas data financiero / credit reporting), both… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Green Colorado is governed by the Colorado Privacy Act (CPA), a comprehensive consumer-privacy statute enforced exclusively by the Colorado Attorney General (with District Attorney co-enforcement… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red Extensive searching across cross-jurisdictional legal trackers (OneTrust DataGuidance jurisdiction/African Bodies pages, IAPP Global Privacy Law and DPA Directory commentary, UNCTAD-referenced… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No dedicated data-protection supervisory authority or comprehensive data-protection statute could be located for the Union of the Comoros, of which Anjouan (Nzwani) is an autonomous island. Global… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No data protection authority and no comprehensive data-protection statute exist for the Union of the Comoros, of which Mohéli (Mwali) is one of three constituent islands under a unitary national… [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber Connecticut's comprehensive consumer privacy regime is the Connecticut Data Privacy Act (CTDPA), Public Act No. 22-15 (Conn. Gen. Stat. § 42-515 et seq.), signed May 10, 2022 and effective July 1… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Green Costa Rica operates a comprehensive omnibus data-protection regime under Law No. 8968 of 2011, enforced by PRODHAB, a decentralized body attached to the Ministry of Justice and Peace. The… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Green Alderney (as part of the Bailiwick of Guernsey) is governed by the Data Protection (Bailiwick of Guernsey) Law, 2017, a single omnibus statute applied across Guernsey, Alderney and Sark. The Office… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber Hawaii has no comprehensive state consumer-privacy statute or dedicated data-protection authority. The Hawaii Attorney General's Office of Consumer Protection is the principal state-level enforcer… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber Hong Kong's data protection regime is anchored in the Personal Data (Privacy) Ordinance (Cap. 486), a comprehensive omnibus statute enforced by the Privacy Commissioner for Personal Data (PCPD). The… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Green Hungary is an EU Member State applying the GDPR directly, supplemented by the national Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the 'Privacy… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Green Iceland is an EEA/EFTA state that has incorporated the GDPR into its domestic legal order via Act No. 90/2018 on Data Protection and the Processing of Personal Data, giving Persónuvernd (the… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Amber Idaho has no dedicated data-protection regulator or comprehensive privacy statute. Enforcement authority rests with the Idaho Attorney General under general consumer-protection powers, layered under… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber Illinois has no comprehensive omnibus consumer-privacy statute. The regulatory landscape is a sectoral patchwork: the Biometric Information Privacy Act (BIPA, 740 ILCS 14), the Personal Information… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber India's Digital Personal Data Protection Act, 2023 (DPDPA) was enacted August 2023 but remained non-operational until the Ministry of Electronics and Information Technology (MeitY) notified the… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Green Indiana's data-protection regime is anchored in the Indiana Consumer Data Protection Act (ICDPA), IC 24-15, enacted as P.L.94-2023 (Senate Bill 5) and now in force as of January 1, 2026. Enforcement… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Green Iowa's data-protection regime is anchored in the Iowa Consumer Data Protection Act (ICDPA, Senate File 262), a comprehensive consumer-privacy statute enforced exclusively by the Iowa Attorney… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Green Ireland's data protection regime is the EU's GDPR (Regulation (EU) 2016/679) as given further effect domestically by the Data Protection Act 2018, which commenced 25 May 2018 and established the Data… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Green The Isle of Man (a self-governing British Crown Dependency, not part of the UK or EU) operates a GDPR-equivalent omnibus regime. It has chosen to adopt the EU GDPR and the Law Enforcement Directive… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Green Italy is an EU Member State applying GDPR directly, supervised by the Garante per la protezione dei dati personali, seated in Rome, operating under the Codice Privacy (D.Lgs. 196/2003 as amended by… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Amber Côte d'Ivoire's personal data regime rests on Law No. 2013-450 of 19 June 2013 on the Protection of Personal Data, a comprehensive omnibus statute. The Autorité de Régulation des… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Green Japan operates a comprehensive omnibus data protection regime centred on the Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, as substantially amended in 2015, 2020 and 2021)… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Amber Jersey operates a GDPR-aligned omnibus regime built on two companion statutes: the Data Protection (Jersey) Law 2018 (DPJL 2018), the substantive code, and the Data Protection Authority (Jersey) Law… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Kansas has no comprehensive omnibus consumer-privacy statute. The operative regime is (a) federal FTC Act Section 5 unfair/deceptive-practices authority applied nationally, (b) the Kansas Consumer… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Amber Kazakhstan's data-protection regime rests on the omnibus Law No. 94-V of 21 May 2013 On Personal Data and its Protection, amended and operationalised by the Law of 25 June 2020 No. 347-VI. The Act does not provide for a data protection authority or regulatory authority. Adjacent regulatory… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green The Netherlands is an EU Member State operating under the GDPR as the omnibus instrument, implemented and supplemented domestically by the Uitvoeringswet Algemene verordening gegevensbescherming… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber Nevada has no comprehensive omnibus consumer-privacy statute equivalent to the GDPR or the CCPA. The state's data-protection footprint is a narrow sectoral patchwork built on NRS Chapter 603A… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Green New Brunswick's data-protection position is a layered federal/provincial construct rather than a single provincial omnibus statute. The federal Personal Information Protection and Electronic… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Green New Hampshire's data-protection regime is anchored in RSA 507-H, the New Hampshire Data Privacy Act (NHDPA), which took effect January 1, 2025 and is enforced exclusively by a dedicated Data Privacy… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Green New Jersey's comprehensive consumer privacy regime is the New Jersey Data Privacy Law (NJDPL), P.L.2023, c.266, enforced exclusively by the New Jersey Attorney General acting through the Division of… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Red New Mexico has no comprehensive omnibus consumer-privacy statute. The operative framework is (a) the federal FTC Act Section 5 unfair/deceptive-practices baseline enforced nationally, (b) New… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Green New Zealand's data-protection regime is anchored in the Privacy Act 2020, which repealed and replaced the Privacy Act 1993 and entered into force 1 December 2020, overseen by the Office of the… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Amber Nigeria's regime is anchored on the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) as a statutory independent authority, elevating the prior… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Red North Carolina has no dedicated data-protection authority and no comprehensive consumer-privacy statute. The state operates within the US federal sectoral patchwork: the FTC enforces general… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Amber North Dakota has no dedicated comprehensive data-protection regulator or statute. Enforcement authority sits with the North Dakota Attorney General under general state consumer-protection powers… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green Norway is not an EU Member State but implements the GDPR in full via the EEA Agreement. Datatilsynet is the competent supervisory authority. The Personal Data Act (Act of 15 June 2018 no. 38) is the… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Amber Ohio has no dedicated data-protection regulator or comprehensive privacy statute. The governing framework is a composite of (a) the FTC's general Section 5 unfair/deceptive-practices authority, which… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber As of the 2026-08-06 dispatch date, Oklahoma has no comprehensive consumer-privacy statute IN FORCE. The operative regime is sectoral/reactive: the federal FTC Act Section 5… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber CA-ON sits inside Canada's federated privacy architecture: the federal Office of the Privacy Commissioner of Canada (OPC) enforces PIPEDA as the general private-sector omnibus statute across Ontario… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Green Oregon's comprehensive consumer privacy regime is the Oregon Consumer Privacy Act (OCPA), The Oregon Consumer Privacy Act (OCPA), ORS 646A.570-646A.589, was signed into law by… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red Pakistan has no independent dedicated data protection authority. The Ministry of Information Technology and Telecommunication (MoITT) holds adjacent competence and has circulated multiple drafts of a… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No comprehensive data-protection or privacy statute, and no dedicated data-protection authority, has been identified for the Republic of Palau. Secondary jurisdiction trackers (OneTrust DataGuidance)… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Green Panama's omnibus regime is Law No. 81 of 26 March 2019 on the Protection of Personal Data, supervised by the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI) through its… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Amber Pennsylvania has no comprehensive consumer-privacy statute. The Pennsylvania Attorney General (Bureau of Consumer Protection) is the primary regulator, acting under the general Unfair Trade Practices… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Green Peru operates a comprehensive omnibus data-protection regime anchored on Ley N° 29733 (2011), Ley de Protección de Datos Personales, as substantially reformed by Decreto Legislativo N° 1353 (2017)… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Green The Philippines operates a comprehensive omnibus data protection regime under the Data Privacy Act of 2012 (Republic Act No. 10173, 'the Act'), enforced by the National Privacy Commission (NPC). The… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Green Poland's data protection regime is a GDPR-implementation jurisdiction. The Act of 10 May 2018 on the Protection of Personal Data establishes the Prezes Urzędu Ochrony Danych Osobowych (President of… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Green Portugal operates a GDPR-aligned omnibus regime. The CNPD (Comissão Nacional de Proteção de Dados) is the sole national supervisory authority, and Law No. 58/2019 (the GDPR Implementation Law) sits… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Amber Qatar operates two entirely separate data-protection perimeters. Mainland Qatar is governed by Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data, supervised by the National Cyber… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Green Quebec operates a comprehensive, GDPR-influenced private-sector data protection regime under the Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber Rhode Island's data-protection regime is anchored in the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), R.I. Gen. Laws Title 6, Ch. 48.1, enacted 25 June 2024 via gubernatorial… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Green Romania implements the GDPR through Law No. 190/2018 Implementing the General Data Protection Regulation, with the National Supervisory Authority for Personal Data Processing (ANSPDCP) as the… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Green Russia's data-protection regime is anchored in Federal Law No. 152-FZ 'On Personal Data' (27 July 2006, as amended), supervised by Roskomnadzor (the Federal Service for Supervision of Communications… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Amber Rwanda's data-protection regime is anchored in Law N°058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy, a comprehensive GDPR-influenced statute supervised by the… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Green Saudi Arabia's Personal Data Protection Law (PDPL), enacted by Royal Decree M/19 and amended in March 2023, is a GDPR-style omnibus statute administered by the Saudi Data and Artificial Intelligence… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Green Senegal operates a comprehensive omnibus data-protection regime under Law No. 2008-12 of 25 January 2008 Concerning Personal Data Protection, implemented by Decree No. 2008-721 of 30 June 2008. The… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Green Serbia's data-protection regime is anchored in the Law on Personal Data Protection ('Official Gazette of RS' No. 87/2018, 'LPDP'), adopted as part of Serbia's EU-candidacy harmonization obligations… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Green Seychelles' comprehensive data-protection framework is the Data Protection Act, 2023, which repealed and replaced the Data Protection Act, 2003. The Act was gazetted and entered into force on 22… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Green Singapore's omnibus regime is the Personal Data Protection Act 2012 (No. 26 of 2012, 'PDPA'), administered by the Personal Data Protection Commission (PDPC). The PDPC is empowered… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Green Slovakia is an EU Member State operating under direct application of the GDPR, supplemented by national implementing Act No. 18/2018 Coll. The competent supervisory authority is the Úrad na ochranu… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Green Slovenia is an EU Member State operating under the GDPR as directly-applicable EU law, implemented and supplemented nationally by the Personal Data Protection Act (ZVOP-2), adopted 15 December 2022… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber South Africa's omnibus regime is the Protection of Personal Information Act, 2013 (POPIA), supervised by the Information Regulator. POPIA was promulgated in 2013 but commenced in stages; most… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber South Carolina has no dedicated data-protection authority. Enforcement is split between the South Carolina Attorney General (general consumer protection and, since 2026, the new minors'… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber South Dakota has no comprehensive state consumer-privacy statute and no dedicated state data-protection authority. The operative framework is (a) the federal FTC Act Section 5… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Green South Korea's Personal Information Protection Act (PIPA), enacted 2011 and substantially rewritten since, is enforced by the Personal Information Protection Commission (PIPC), which received… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Green Spain operates a fully-implemented GDPR omnibus regime. The Agencia Española de Protección de Datos (AEPD) is the national supervisory authority, operating under Ley Orgánica 3/2018 (LOPDGDD)… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA) is the first comprehensive data-protection statute in the jurisdiction, establishing the Data Protection Authority of Sri Lanka.… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Green Sweden is an EU Member State and applies the GDPR directly, supplemented nationally by the Act with Supplementary Provisions to the GDPR (SFS 2018:218). The Swedish Authority for Privacy Protection… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Green Switzerland's data protection regime is governed by the revised Federal Act on Data Protection (revFADP, FADP 2020), which entered into force on 1 September 2023 alongside its implementing Ordinance… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber Taiwan's data protection regime rests on the Personal Data Protection Act (PDPA) 2010, as amended in 2015 and further amended in 2023 and 2025-2026, plus its Enforcement Rules. Historically, the… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Green Tanzania's comprehensive data protection regime is anchored in the Personal Data Protection Act, Act No. 11 of 2022 (PDPA), which established the Personal Data Protection Commission (PDPC) as… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber CRITICAL CORRECTION TO INJECTED SEED: the seed's disambiguation stating Tennessee has NO comprehensive consumer-privacy statute is STALE. Research confirms the Tennessee Information Protection Act… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Green Texas has no dedicated data-protection authority; enforcement of the state's comprehensive privacy statute and adjacent biometric/breach laws sits with the Office of the Attorney General (OAG)… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Green Thailand's data-protection regime is anchored in the Personal Data Protection Act B.E. 2562 (2019) (PDPA), a GDPR-influenced omnibus statute. The Personal Data Protection Act… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red Trinidad and Tobago's Data Protection Act, 2011 (Cap. 22:04) is a partially-proclaimed omnibus statute. Section 1(2) requires commencement by Presidential Proclamation, and only Part I (general… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Amber Tunisia's data-protection regime rests on Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data, a cross-sectoral statute enforced by the Instance Nationale de Protection des… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Green Turkey operates a comprehensive omnibus regime under Law No. 6698 on the Protection of Personal Data (LPPD/KVKK Law), enforced by the Personal Data Protection Authority (KVKK/Kurul). The law was… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Green Uganda operates a comprehensive omnibus regime under the Data Protection and Privacy Act, 2019 (DPPA), supplemented by the Data Protection and Privacy Regulations, 2021. The Regulations establish the… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber Ukraine's data protection regime rests on the Law of 1 June 2010 No. 2297-VI 'On Personal Data Protection' (as amended), enforced by the Verkhovna Rada Commissioner for Human Rights (Ombudsman)… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber The UAE federal regime rests on Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), enforced by the newly established Emirates Data Office (UAE Data Office). Layered on top… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber The UK's data protection regime is anchored in UK GDPR, the Data Protection Act 2018 (DPA 2018) and PECR 2003, all substantially amended by the Data (Use and Access) Act 2025 (DUAA), which received… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber At the US federal level there is no single omnibus data-protection statute or single supervisory authority. The Federal Trade Commission (FTC) acts as the de facto general privacy regulator, using… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber California operates a hybrid regime: the California Consumer Privacy Act of 2018 (CCPA), as substantially amended and expanded by the 2020 ballot initiative CPRA (Proposition 24), is administered by… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber New York has no single comprehensive data-protection statute. The New York Attorney General (Bureau of Internet & Technology) is the primary consumer-privacy enforcer, operating under the Stop Hacks… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Green Uruguay's data protection regime is anchored in Law No. 18.331 of 11 August 2008 (the LPD/Habeas Data Act), regulated by Decree No. 414/009 of 31 August 2009, and substantially reformed by Law No.… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Green Utah's data-protection landscape is anchored by the Utah Consumer Privacy Act (UCPA, SB 227), a comprehensive but business-friendly consumer-privacy statute enacted 24 March 2022 and effective 31… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Amber Vanuatu's comprehensive data-protection statute is the Data Protection and Privacy Act No. 13 of 2024. Law: Data Protection and Privacy Act No. 13 of 2024 (the Data Protection… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red Venezuela has no comprehensive data-protection statute and no dedicated data-protection authority. Constitutional habeas data (Article 28) and Article 60's privacy/digital-information-limitation… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber The injected seed's disambiguation (no comprehensive VT statute) is now materially STALE: on 16 June 2026 Governor Phil Scott signed the Vermont Data Privacy and Online Surveillance Act (S.71)… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber Vietnam's data-protection regime was fundamentally superseded during the seed-anchor window: the injected seed anchored on Decree 13/2023/ND-CP (PDPD), but research confirms Vietnam's National… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber Virginia's data-protection regime is anchored in the Virginia Consumer Data Protection Act (VCDPA), Va. Code §§59.1-575 et seq., effective January 1, 2023, enforced exclusively by the Virginia… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber Washington State has no dedicated data-protection regulator and no comprehensive omnibus consumer-privacy statute. The Washington State Attorney General enforces sectoral privacy laws — principally… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red West Virginia has no dedicated data-protection authority. Privacy-adjacent enforcement rests with the West Virginia Attorney General's Consumer Protection function acting under general state… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Amber Wisconsin has no dedicated data-protection authority and no comprehensive consumer-privacy statute. The operative state-level instrument is the general data-breach-notification statute (Wis. Stat. §… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Red Wyoming has no dedicated data-protection regulator or comprehensive privacy statute. The Consumer Protection Unit of the Wyoming Attorney General enforces the state's general Consumer Protection Act… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Amber Zambia's principal data-protection instrument is the Data Protection Act, 2021 (Act No. 3 of 2021), which succeeded the Data Protection Bill, 2020 submitted to the National Assembly in December 2020.… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)