Data Protection Monitor · Cross-Jurisdiction Domain Hub
Sectoral privacy rules
Jurisdiction Readings (167 markets)
4 Confirmed
135 Probable
28 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Red | No continental-level sectoral data-protection overlay (financial, health, telecoms/eprivacy, employment, credit, education, insurance) was found in the Malabo Convention, AU status list, or Roadmap.… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | Alabama layers several sector-specific statutes atop the general breach-notification baseline: the Insurance Data Security Law (Title 27, Ch. 62) for insurance licensees, and general references to… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Amber | Alaska's data-protection landscape is almost entirely sectoral. Financial-sector data is governed by the federal Gramm-Leach-Bliley Act safeguards rule; health data by HIPAA/HITECH; credit/scoring by… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | Alberta's health sector is governed by a distinct Health Information Act (HIA) regime with harm-based breach notification and tiered offence penalties, layered atop PIPA/PIPEDA. PIPA itself carves… | Profile →Brief |
| Algeria (DZ) | Africa | Amber | The most concretely corroborated sectoral signal for Algeria is financial-sector related: Algeria was placed on the EU's AML/CFT high-risk third-country list via Commission Delegated Regulation (EU)… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Amber | The clearest documented Antigua and Barbuda regulatory activity located concerns the financial/virtual-asset sector rather than general data protection: a Digital Assets Business Bill regulating… | Profile →Brief |
| Argentina (AR) | Americas | Amber | Sectoral overlays are most developed in health (telemedicine/digital prescriptions must comply with both the LPDP and the Patient Rights Law 26.529, with sensitive-data confidentiality duties for… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Outside the breach-notification statute, Arizona's data-protection-relevant sectoral activity consists of a direct-to-consumer genetic-testing statute and reliance on federal sectoral overlays (HIPAA… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Amber | Arkansas layers a small number of sector-specific instruments atop the general breach-notification baseline: Act 557 (virtual-currency data-security programs), the Arkansas Consumer Telephone Privacy… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | No bloc-level sectoral overlays (financial, health, telecoms, employment, credit, education, insurance) with binding force exist. ASEAN implementing guidance recommends that member states apply… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | Sector overlays exist for credit reporting (Part IIIA with its own penalty scale), health records (My Health Records Act with its own enforcement regime), and telecommunications/online-safety (Online… | Profile →Brief |
| Austria (AT) | Europe | Amber | Austrian sector-specific overlays interacting with GDPR/DSG were only partly confirmed in this research pass. Telecoms/ePrivacy (TKG 2021) and employment (ArbVG works-council co-determination, GlBG)… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Amber | The clearest confirmed sectoral overlay is telecommunications: the Bangladesh Telecommunication Regulation Act empowers interception of communications on national-security/public-order grounds… | Profile →Brief |
| Belgium (BE) | Europe | Amber | Sectoral overlays confirmed for Belgium are strongest in telecoms/electronic-communications (Belgian Electronic Communications Act, LCE, applied alongside GDPR) and employment (CBA No. 81 governing… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced sectoral overlays (financial-sector/IFSC data rules, health, telecoms/ePrivacy transposition, employment-data provisions, credit, education, insurance, or a data-access/sharing scheme)… | Profile →Brief |
| Brazil (BR) | Americas | Amber | Financial-sector data flows are shaped by BACEN/Monetary Council open-banking (Open Finance) rules layered atop the LGPD, plus bank self-regulation (FEBRABAN's CARB Standard 21/2022). Health-sector… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | BC's DP landscape includes a dedicated health-sector overlay (the E-Health (Personal Health Information Access and Protection of Privacy) Act) administered by the same OIPC BC, and an employment… | Profile →Brief |
| Bulgaria (BG) | Europe | Amber | Confirmed sectoral overlay evidence is limited to the employment-data and telecoms/eprivacy domains, where the Labor Code, Electronic Communications Act, and Constitution intersect with GDPR/the Act.… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | No confirmed Cambodia-specific sectoral overlay (financial, health, telecoms/ePrivacy, employment, credit, education, or insurance) displacing or supplementing a general DP regime was identified… | Profile →Brief |
| Cameroon (CM) | Africa | Red | No sector-specific overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) for Cameroon were identified in available research. | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | The most consequential sectoral overlay for CA-KAH is the Consumer-Driven Banking Act (open-banking), described as the 'first iteration' of Canada's forthcoming federal data-mobility framework under… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | The single most JID-critical finding is that a First Nation band council, acting in its core governmental functions, is generally treated by the OPC as a 'federal work, undertaking or business'… | Profile →Brief |
| Chile (CL) | Americas | Amber | Financial-sector data flows are governed by the Ley Fintech (Open Finance system) and CMF technical standards (NCG N.º 514), which pre-date and currently sit alongside the incoming general DP law… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | Financial-sector data is subject to PBOC-issued classification guidelines (Financial Data Security — Data Security Classification Guidelines, 2020) and the amended Anti-Money Laundering Law… | Profile →Brief |
| Colombia (CO) | Americas | Amber | The clearest sectoral overlay is the financial/credit-reporting regime under Law 1266 of 2008 (habeas data financiero), enforced through fines such as those against Comfamiliar and Refinancia for… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Amber | The CPA carves out entity-level exemptions for GLBA-regulated financial institutions and data-level exemptions for HIPAA-covered PHI, COPPA-regulated data, and employment-context data (the CPA's… | Profile →Brief |
| Comoros (KM) | Africa | Red | No sector-specific data-access/sharing, financial-sector, health-sector, telecoms/ePrivacy, employment, credit-scoring, education or insurance overlay touching personal data was located for the Union… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No Comoros-specific financial-sector, health-sector, telecoms/ePrivacy, employment-data, credit-scoring, education, insurance, or data-access-sharing overlay regime could be identified. Anjouan is… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No sector-specific data-protection overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance, or horizontal data-access/sharing schemes) were identified for… | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | CTDPA carves out entities/data already regulated by federal sectoral frameworks: HIPAA-covered entities and business associates, GLBA-regulated financial institutions, FCRA data, and the Connecticut… | Profile →Brief |
| Costa Rica (CR) | Americas | Amber | Financial-sector personal data is the best-evidenced sectoral overlay: SUGEF-supervised entities' databases are exempt from PRODHAB's registration duty but remain subject to its general control, as… | Profile →Brief |
| Croatia (HR) | Europe | Amber | Telecoms/ePrivacy is overlaid by the Electronic Communications Act (transposing Directive 2002/58/EC) supervised jointly by HAKOM and AZOP. Insurance and credit/debt-collection sectors show active… | Profile →Brief |
| Curaçao (CW) | Caribbean | Amber | Curaçao is a member of the Caribbean Financial Action Task Force (CFATF) and is viewed by international supervisory bodies as having limited effective AML/tax-enforcement measures, a fact relevant to… | Profile →Brief |
| Cyprus (CY) | Europe | Amber | Sectoral overlays supplementing GDPR/Law 125(I)/2018 include: telecoms/ePrivacy rules under Law 112(I)/2004 (electronic communications and postal services) and the Private Communications Law 92(I)/96… | Profile →Brief |
| Czech Republic (CZ) | Europe | Amber | The main confirmed sectoral overlay is telecoms/e-privacy: the Electronic Communications Act (Act No. 127/2005 Coll.), as amended (Act No. 374/2021 Coll. and consultations transposing the European… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Amber | The DPDPA exempts data governed by GLBA, HIPAA and FCRA and excludes employment-context personal data (e.g., job applicants) from its consumer-rights framework, deferring to those federal sectoral… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Sector overlays in Denmark include the Marketing Practices Act (implementing ePrivacy rules on direct marketing), enhanced HR-data legitimate-interest bases, mandatory Datatilsynet pre-approval for… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Amber | The clearest District-relevant sectoral overlay identified is the FTC's Health Breach Notification Rule (16 CFR Part 318), which by its own terms defines 'State' to include the District of Columbia… | Profile →Brief |
| Dominican Republic (DO) | Americas | Amber | The financial sector is overlaid by Monetary and Financial Law No. 183-02, which establishes the regulatory and institutional framework for the Dominican monetary and financial system including bank… | Profile →Brief |
| Ecuador (EC) | Americas | Green | Because JID=EC covers the Union institutions themselves, 'sectors' map onto specific EUIs/agencies rather than private industry: EU financial-supervision agencies (ESMA, EIOPA, EBA) apply EUDPR with… | Profile →Brief |
| Egypt (EG) | Africa | Amber | The Central Bank of Egypt (CBE) and CBE-supervised entities are exempted from the general PDPL regime (except money-transfer and forex companies, which must follow CBE-established data rules)… | Profile →Brief |
| Estonia (EE) | Europe | Amber | Estonia has no distinct sectoral DP statutes displacing GDPR, but sectoral overlays are visible in practice: the Estonian Financial Intelligence Unit's (Rahapesu Andmebüroo) AML data processing is… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | GDPR applies horizontally with sector overlays; identified 2026 activity centres on health data (CNIL's €5m fine against IQVIA) and telecoms/eprivacy (Digital Omnibus proposed ePrivacy Directive… | Profile →Brief |
| Finland (FI) | Europe | Amber | Finland layers sector-specific overlays atop the GDPR baseline: FIN-FSA (Finanssivalvonta) oversight of financial-sector cyber resilience intersects with DP security duties (as in the Aktia Bank… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Amber | Florida's earlier competing comprehensive-privacy bills (HB 969 / SB 1734, 2021) proposed GLBA and HIPAA entity/data exemptions; whether the enacted FDBR (SB 262, 2023) preserves materially identical… | Profile →Brief |
| France (FR) | Europe | Amber | Financial (banks/insurers), telecoms/ePrivacy and employment/public-sector data processing carry distinct overlays evidenced by CNIL DPO guidance and 2026 enforcement (FRANCE TRAVAIL). Credit-scoring… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Amber | Georgia relies entirely on federal sectoral overlays for privacy-adjacent obligations: GLBA (and its FTC Safeguards Rule) for financial institutions, COPPA for children's online data, and HIPAA for… | Profile →Brief |
| Germany (DE) | Europe | Amber | Telecoms/telemedia is the most developed sectoral overlay: TTDSG (as amended into the TDDDG) supplies a lex specialis cookie/tracking consent regime and a Consent Management Ordinance (effective 1… | Profile →Brief |
| Ghana (GH) | Africa | Red | No sector-specific overlays (financial, health, employment, credit-scoring, education, insurance) displacing or supplementing the general Data Protection Act were independently confirmed in this… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | Sectoral overlays identified include health (Gibraltar Health Authority as controller for contact tracing under GRA COVID guidance), telecoms/eprivacy (Communications (Personal Data and Privacy)… | Profile →Brief |
| Greece (GR) | Europe | Amber | Sector-specific enforcement is evidenced in telecoms (Law 3471/2006, ADAE oversight), employment (Law 4624/2019 employment provisions), health (patient-data access-abuse fines), financial services… | Profile →Brief |
| Guernsey (GG) | Europe | Amber | Evidence of sectoral overlay in Guernsey is limited to indications of GFSC/financial-services coordination and specific Schedule 8 exemptions for tax/crime information and certain… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Amber | Alderney has its own historical ePrivacy transposition, the European Communities (Implementation of Council Directive on Privacy and Electronic Communications) (Alderney) Ordinance, 2009, distinct… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | Hawaii's data-protection landscape is defined by sectoral overlays rather than a general regime: federal HIPAA and HRS §622-57 for health data; federal GLBA and the Hawaii Insurance Code for… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Amber | Hong Kong has no standalone sectoral data-privacy statutes; instead, sector regulators (HKMA, Insurance Authority, SFC) issue circulars and guidelines overlaying the PDPO for regulated entities'… | Profile →Brief |
| Hungary (HU) | Europe | Amber | Telecoms/e-commerce direct-marketing complaints are carved out to the media regulator NMHH rather than NAIH. Employment-data processing has generated concrete NAIH enforcement on IT-monitoring… | Profile →Brief |
| Iceland (IS) | Europe | Amber | The clearest sectoral overlay evidenced is education (repeated ed-tech/cloud-services fines) and health/genetic research (COVID-19 sample processing); financial, telecoms/ePrivacy, credit-scoring… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Amber | In the absence of an omnibus statute, Idaho residents' data receives protection principally through federal sectoral overlays: HIPAA (health), GLBA (financial), FCRA (credit/scoring), and COPPA… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | Federal sectoral overlays (HIPAA, GLBA, COPPA — properly attributed to the US-federal JID) apply in Illinois as elsewhere. Illinois-specific sectoral rules include GIPA's insurer-underwriting… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | The clearest sectoral overlay identified is financial services: RBI Master Directions on cyber resilience/payment-data localisation and SEBI cloud-adoption rules mandate in-India storage of specified… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Amber | The ICDPA exempts data and entities already covered by GLBA, HIPAA, FCRA, FERPA, the Driver's Privacy Protection Act, and human-subjects research standards, deferring sectoral privacy governance in… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | The ICDPA carves out broad sectoral exemptions rather than layering sector-specific overlays: GLBA-covered financial institutions, HIPAA/HITECH-covered entities and health records, FERPA-covered… | Profile →Brief |
| Ireland (IE) | Europe | Amber | Sectoral overlays in Ireland include the ePrivacy Regulations (S.I. No. 336/2011) for telecoms/electronic communications, a DPA 2018 insurance-specific health-data ground, and education-sector… | Profile →Brief |
| Isle of Man (IM) | Europe | Amber | Direct sectoral evidence located in this pass is limited to the health/social-care sector (Manx Care, the publicly-owned health and social care provider, subject to Applied GDPR access-right… | Profile →Brief |
| Italy (IT) | Europe | Amber | Sector overlays include: healthcare (frequent Garante sanctions and guidance on health data and telemedicine); telecoms/eprivacy (Art.122 Codice cookie rules, Registro Pubblico delle Opposizioni for… | Profile →Brief |
| Ivory Coast (CI) | Africa | Red | No CI-specific sectoral overlay evidence (banking/BCEAO-UEMOA financial data rules, health-sector rules, telecoms/ePrivacy, employment, credit-scoring, education, or insurance) was retrieved in this… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Amber | Sector-specific overlays supplement the general APPI framework: the Financial Services Agency (FSA) issues financial-industry personal-information guidelines; METI issues credit-card-industry and… | Profile →Brief |
| Jersey (JE) | Europe | Amber | The only concretely evidenced sectoral development is a 2026 Population-Register data-sharing initiative between the Government of Jersey and UK credit reference agencies, enabled by a States… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Amber | Sectoral overlays in Kansas are exclusively federal: GLBA (financial), HIPAA (health), FCRA (credit/scoring), FERPA/COPPA/PPRA (education). No Kansas-specific comprehensive sectoral privacy statute… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Red | Only a telecoms/online-identification overlay is confirmed: website and telecommunications operators face user-identification obligations under the Informatisation Law regime. Financial, health… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | The KCDPA layers onto pre-existing Kentucky sectoral regimes. It exempts HIPAA-regulated health data (narrowed further by HB473 from June 1, 2026); financial institutions subject to GLBA are, per the… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Telecoms are regulated under the Kenya Information and Communications Act (KICA) and its Consumer Protection/SIM-Card Registration Regulations, overlaying the DPA for licensed providers. Financial… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Amber | Laos has sector-specific instruments that intersect with data flows: an Anti-Money-Laundering and Counter-Financing of Terrorism law governing financial-sector data sharing, a 2017 Law on Payment… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Red | Neither the OAS Principles nor the RIPD Standards establish sector-specific overlays (finance, health, telecoms, employment, credit-scoring, education, insurance) comparable to GDPR-adjacent sectoral… | Profile →Brief |
| Latvia (LV) | Europe | Amber | Sectoral overlays confirmed for Latvia are concentrated in telecoms/eprivacy (Law on Information Society Services 2004, as amended, applied alongside GDPR to cookie practices) and employment data… | Profile →Brief |
| Liechtenstein (LI) | Europe | Amber | Liechtenstein's financial-sector data processing (a core feature of its economy as a private-banking/trust hub) interacts with GDPR through DSS-published sector guidance; other sector overlays… | Profile →Brief |
| Lithuania (LT) | Europe | Amber | Sectoral overlays are thin in Lithuania beyond GDPR: telecoms/eprivacy is transposed via the Law on Electronic Communications; VDAI has issued employment and health-sector guidance; a fintech… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | Financial and health data in Louisiana are governed by federal GLBA and HIPAA respectively, per the seed disambiguation: <cite index="1-1">Louisiana requires notification of breaches pursuant to… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | The financial sector carries a distinct professional-secrecy/cooperation overlay under the Law of 5 April 1993 on the financial sector (as amended), administered by the CSSF, which interacts with but… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | Maine's most developed data-protection rules are sectoral: broadband-ISP privacy (Title 35-A §9301) and insurance data security (Maine IDSA). Health and financial data are governed primarily by… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The PDPA is the general commercial-transactions statute, and PDP is empowered to designate industry classes for registration and to approve sector-specific Codes of Practice (including for the… | Profile →Brief |
| Malta (MT) | Europe | Amber | Malta's general GDPR/Act regime is overlaid by sector-specific instruments: an ePrivacy transposition for electronic communications, insurance-sector health-data derogations, employment guidance… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Amber | Outside the general-DP gap, RMI maintains fragmented sector-specific confidentiality provisions in banking and tax law and customer-information provisions in its AML regulations. No health… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | MODPA carves out several federally-regulated sectors: GLBA-covered financial institutions, HIPAA-covered health data, FCRA-covered consumer-reporting activity, and FERPA-covered education records are… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | Federal sectoral statutes are the dominant source of enforceable duties touching Massachusetts data practices: GLBA/Safeguards Rule for financial institutions, HIPAA for health data, FCRA for… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico layers sector-specific rules atop the general private-sector data protection statute, most notably in financial services (credit-reporting carve-out, CNBV incident-notification duties for… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | Michigan-based entities are subject to multiple federal sectoral overlays (GLBA for financial institutions, HIPAA/FTC Health Breach Notification Rule for health data, FCRA for credit… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Amber | The MCDPA does not fully exempt GLBA-covered financial institutions or HIPAA-covered health entities, instead layering targeted (data-level) exemptions on top of those federal regimes. Certain… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Amber | Federal sectoral overlays apply fully in Mississippi in the absence of a state omnibus law: HIPAA (health data, non-preemptive of stricter state law, though Mississippi has none stricter in this… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | Federal sectoral overlays supply the substantive privacy content Missouri's own statute book lacks: GLBA for financial institutions, HIPAA for covered health entities, FERPA/COPPA for education and… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | MTCDPA carves out significant sectoral exemptions: GLBA-regulated data remains exempt though SB 297 removed the blanket GLBA financial-institution entity exemption (replacing it with explicit… | Profile →Brief |
| Morocco (MA) | Africa | Red | Sourced sectoral evidence is limited to CNDP recommendations on genomic/genetic data processing (health sector). No sourced overlays were found for financial services, telecoms/ePrivacy, employment… | Profile →Brief |
| Mozambique (MZ) | Africa | Amber | The financial and telecommunications sectors reportedly maintain their own legal frameworks for safeguarding sector data, though specific instruments were not independently verified. The Electronic… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Amber | Sectoral overlays are the primary source of enforceable data-protection-adjacent duties in Myanmar: the Financial Institutions Law 2016 for banking customer information, the Telecommunications Law… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | GLBA-regulated financial institutions and HIPAA-covered entities/business associates benefit from entity-level exemptions under the NDPA and a compliance safe-harbour under the 2006 breach law. The… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No sector-specific data-protection overlays (financial, health, telecoms/eprivacy, employment, credit-scoring, education, insurance) were confirmed for Nepal in available sources. Per the seed… | Profile →Brief |
| Netherlands (NL) | Europe | Amber | Telecommunications and electronic-communications processing is governed by the Telecommunicatiewet, transposing the ePrivacy Directive, including the cookie-consent rule and a July 2021 shift to… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Amber | Two sectoral overlays are confirmed for Nevada: (i) a financial-sector carve-out under SB 220, which excludes GLBA-regulated financial institutions and their affiliates/third parties from the… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Amber | Multiple sector overlays intersect with PIPEDA in NB: the federal Bank Act regulates federally-regulated financial institutions' handling of personal financial information; PHIPAA displaces PIPEDA… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Amber | The NHDPA carves out several federally-regulated sectors from its scope rather than layering additional NH-specific sectoral rules on top. Financial data covered by the Farm Credit Act, health data… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | The NJDPL carves out several federally regulated sectors entirely: HIPAA-covered health information, FCRA-covered consumer-reporting data, and data collected by certain financial and insurance… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Amber | Sectoral coverage in New Mexico is dominated by federal overlays: GLBA for financial-sector personal data, HIPAA for health data, and FCRA for credit-related consumer-report rights, all displacing… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Amber | Sector-specific overlays operate via OPC-issued binding codes of practice that adapt the IPPs to particular data classes or industries. The Health Information Privacy Code (HIPC) governs… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | The NDPA operates alongside sector regulators; NDPC explicitly recognises complementary instruments including the Central Bank of Nigeria's Consumer Protection Regulation and the Nigerian… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Amber | North Carolina relies entirely on federal sectoral overlays for financial, health, telecoms, employment, credit, education, and insurance data: GLBA for financial institutions, HIPAA for health data… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Amber | Sectoral overlays are the dominant source of enforceable privacy obligation in North Dakota. Financial institutions are governed by GLBA and North Dakota's financial-institution data-security act… | Profile →Brief |
| Norway (NO) | Europe | Amber | The research pass located limited Norway-specific sectoral overlay evidence beyond the general GDPR framework. Datatilsynet acts as the cross-sectoral regulator; case evidence (Telenor - telecoms… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Amber | In the absence of an Ohio omnibus statute, sectoral federal overlays do the substantive work: GLBA Title V governs financial-institution nonpublic personal information (enforced by the FTC, federal… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Green | Federal sectoral overlays are the dominant operative source of data-protection obligation for Oklahoma entities today: HIPAA governs health-care covered entities/business associates; GLBA (Privacy… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | Ontario's sectoral overlays are concentrated in health (PHIPA, with a mature IPC administrative-monetary-penalty regime now in active use) and public-sector/child-welfare (FIPPA, CYFSA), while… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Amber | OCPA carves out several sectoral overlaps rather than displacing them: GLBA, HIPAA, and FCRA-covered data/entities are exempted, as are employment records and certain insurance entities. | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Amber | In the absence of a general data-protection statute, sectoral overlays provide the only in-force, data-adjacent obligations. The State Bank of Pakistan (SBP) has issued a draft digital-banking… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No sector-specific data-access/data-sharing, financial, health, telecoms/ePrivacy, employment, credit-scoring, education or insurance data overlay could be confirmed for Palau from available sources… | Profile →Brief |
| Panama (PA) | Americas | Amber | ANTAI resolutions confirm that Law 81 functions as the general framework and minimum compliance standard applicable to any sector-specific law addressing personal data protection in Panama. No… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Amber | Sectoral overlays exist for insurance/financial data and telemarketing, with employment and education-sector bills pending. The Privacy of Consumer Financial Information Law and Standards for… | Profile →Brief |
| Peru (PE) | Americas | Amber | Financial-sector personal data used for credit-risk purposes is separately regulated by Ley N° 27489 governing Centrales Privadas de Información de Riesgos (CEPIRS/credit bureaus), with SBS retaining… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | Sector-specific overlays interact with the general DP regime particularly in financial services (bank-secrecy and credit-information statutes referenced alongside the Act; NPC Circular 20-01 for… | Profile →Brief |
| Poland (PL) | Europe | Amber | Sectoral overlays in Poland are led by UODO for GDPR compliance, with parallel competences held by UOKiK (competition/consumer protection, including dark-pattern detection) and the Office of… | Profile →Brief |
| Portugal (PT) | Europe | Amber | Sectoral overlays confirmed in research center on health data (statutory notification duties, historic hospital enforcement) and employment data (disapplied consent provision). Telecoms/cyber overlay… | Profile →Brief |
| Qatar (QA) | Middle East | Red | The QFC itself functions as Qatar's principal financial-sector data-protection overlay, operating a GDPR-aligned regime distinct from mainland Law 13/2016 for firms licensed within the free zone. The… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | A dedicated health-and-social-services overlay (LRSSS) is confirmed in force since July 2024. CAI has issued recruitment/AI-hiring guidance touching employment data. No Quebec-specific… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA's 'customer' definition excludes individuals acting in a commercial or employment context, effectively carving employment data out of the consumer-privacy regime. Federal sectoral overlays… | Profile →Brief |
| Romania (RO) | Europe | Amber | Sectoral overlays identified in Romania include financial-sector consumer-credit processing (Hora Credit IFN, an IFN/non-bank lender, sanctioned under GDPR for loan-processing data handling) and… | Profile →Brief |
| Russia (RU) | Europe | Amber | Sectoral overlays are unevenly documented. Financial-sector biometric-collection rules for credit institutions were in draft/amendment stage as of 2022. Telecoms carry a distinctive dual overlay… | Profile →Brief |
| Rwanda (RW) | Africa | Red | No sector-specific data-protection overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) distinct from the general omnibus regime were located for Rwanda… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | Financial-sector data processing is overlaid by SAMA's IT Governance and Cybersecurity Frameworks applying to banks, insurers, financing companies and credit bureaus; health and credit data receive… | Profile →Brief |
| Senegal (SN) | Africa | Amber | The CDP has issued sectoral deliberations covering workplace CCTV/employee monitoring and engaged actively with the health sector during the COVID-19 pandemic; it has also taken formal enforcement… | Profile →Brief |
| Serbia (RS) | Europe | Red | Sector-specific overlays remain thin: the Commissioner has opined that employers may not rely on employee consent alone to justify disproportionate biometric processing (e.g., fingerprint-based… | Profile →Brief |
| Seychelles (SC) | Africa | Red | No sector-specific data-protection overlays (financial/banking-secrecy, health, telecoms/eProvacy traffic-data retention, employment-specific, credit-scoring, education, insurance) or a horizontal… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | Financial services carry a substantive MAS overlay: <cite index="91-2,91-3,91-4">the Monetary Authority of Singapore issued Guidelines on Outsourcing Risk Management on 27 July 2016, including under… | Profile →Brief |
| Slovakia (SK) | Europe | Red | No Slovakia-specific sectoral overlay documentation (banking-secrecy interaction, health-sector rules, telecoms/ePrivacy transposition specifics, employment-code provisions, credit-scoring rules… | Profile →Brief |
| Slovenia (SI) | Europe | Amber | Direct sectoral-overlay evidence was limited in this research pass to the employment/education sectors. ZVOP-2 imposes a stricter-than-GDPR-default ultima ratio standard for employee video… | Profile →Brief |
| South Africa (ZA) | Africa | Red | No sector-specific overlay (financial, health beyond the 2026 health-information regulation, telecoms/ePrivacy, employment, credit-scoring, education, or insurance) was substantively confirmed from… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | South Carolina's data-protection landscape is dominated by sectoral overlays: federal HIPAA, GLBA, and COPPA apply nationally in the absence of a state omnibus law; the state's own Insurance Data… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Amber | Federal sectoral statutes (HIPAA, GLBA, COPPA) apply to covered entities operating in South Dakota but are federal-level frameworks properly attributed to the US federal JID rather than this state… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | Beyond PIPA, South Korea maintains sector-specific overlays: the Credit Information Use and Protection Act (Credit Act) governs personal credit information used in credit ratings and is enforced by… | Profile →Brief |
| Spain (ES) | Europe | Amber | GDPR/LOPDGDD apply horizontally, with sector overlays: Ley 34/2002 LSSI for electronic communications/cookies, DPO-mandatory designation for schools and sports federations processing minors' data… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | Sri Lanka does not appear to have distinct sector-specific data-protection statutes (health, credit, education, insurance) separate from the PDPA; instead, the 2023 budget speech committed the… | Profile →Brief |
| Sweden (SE) | Europe | Amber | IMY overlays sector-specific supervision on top of GDPR for credit information (Credit Information Act), law enforcement (Criminal Data Act), telecoms/ePrivacy (Electronic Communications Act, LEK)… | Profile →Brief |
| Switzerland (CH) | Europe | Amber | Switzerland lacks dedicated omnibus sectoral data-protection statutes, but sector-specific instruments layer additional obligations onto the FADP baseline: FINMA maintains an ordinance on data… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | Financial and health sectors carry the clearest overlays on the general PDPA regime: financial institutions face outsourcing/approval constraints and heightened cybersecurity expectations from the… | Profile →Brief |
| Tanzania (TZ) | Africa | Amber | Sectoral overlays are confirmed for the financial sector (Bank of Tanzania (Credit Reference Bureau) Regulations, 2012) and telecoms (Electronic and Postal Communications Act, 2010 (EPOCA), enforced… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Amber | As with peer Virginia-lineage state laws, TIPA is expected to carry standard sectoral carve-outs (GLBA-regulated financial data, HIPAA-regulated health data, FERPA-regulated education data… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | TDPSA carves out broad sectoral exemptions rather than layering additional obligations: financial institutions/data under GLBA, HIPAA covered entities/business associates and HIPAA-regulated data… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Amber | Financial services carry an independent overlay: <cite index="72-2,72-3">the Bank of Thailand (BoT) requires financial institutions to follow specific data-protection and privacy procedures under the… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Amber | Trinidad and Tobago has a criminal-law overlay (Computer Misuse (Amendment) Act 2022) touching unauthorised interception/sharing of personal data and malicious/unsolicited electronic communications… | Profile →Brief |
| Tunisia (TN) | Africa | Red | No sector-specific personal-data overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) applicable in Tunisia could be confirmed from accessible sources in… | Profile →Brief |
| Turkey (TR) | Europe | Red | Direct sector-specific overlay statutes (banking secrecy, health-sector regulation, telecoms/ePrivacy, credit scoring, education, insurance) were not substantively retrieved this run beyond general… | Profile →Brief |
| Uganda (UG) | Africa | Amber | Sectoral overlays are thin but emerging: Uganda's Ministry of Health has mandated health-facility compliance including DPO appointment and security measures; the PDPO's first criminal conviction… | Profile →Brief |
| Ukraine (UA) | Europe | Red | Confirmed sectoral evidence was limited to employment data (notification/ROPA/security duties under Ombudsman orders) and a general health-data note (children's medical data treated under general… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | Telecommunications and healthcare are the most clearly documented sectoral overlays: the TRA derives customer-data jurisdiction from the Law Regulating the Telecommunications Sector, health data is… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | PECR functions as the UK's ePrivacy overlay on cookies, direct marketing and electronic communications, with DUAA-driven reforms including new cookie-consent exemptions and a charity soft opt-in.… | Profile →Brief |
| United States (US) | Americas | Amber | US data protection is fundamentally sectoral: GLBA (financial), HIPAA plus the FTC Health Breach Notification Rule (health/health-adjacent), FCRA (credit and background-screening, with a deep body of… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | California layers sectoral carve-outs and overlay statutes onto the CCPA/CPRA baseline: GLBA-regulated financial data receives a partial data-level exemption; HIPAA/CMIA-regulated health data… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | New York's data-protection landscape is fundamentally sectoral. NYDFS's 23 NYCRR Part 500 governs financial-services cybersecurity; health information outside HIPAA is targeted by a pending New York… | Profile →Brief |
| Uruguay (UY) | Americas | Red | No sector-specific overlays (banking secrecy, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) displacing or supplementing the general LPD regime were independently… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Green | The UCPA's material scope carves out the principal U.S. federal sectoral regimes — GLBA for financial data, HIPAA/HITECH for health data, FCRA for credit-reporting data, and FERPA for education… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | No sector-specific overlay findings (financial, health, telecoms, employment, credit, education, insurance, or horizontal data-access/sharing schemes) could be sourced for Vanuatu. Searches run… | Profile →Brief |
| Venezuela (VE) | Americas | Red | Sectoral provisions are described in the injected seed as the most concrete source of obligations, particularly banking (SUDEBAN) and telecommunications (CONATEL) confidentiality/retention rules, but… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | Vermont sectoral overlays: financial (Financial Privacy Act, Title 8) and health (Title 18) statutes operate alongside federal GLBA/HIPAA; education sector overlaid by original 2020 student-data… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | Confirmed sectoral overlays: (i) financial sector -- SBV Circular 77/2025/TT-NHNN imposing mobile-banking anti-tampering and biometric-matching (PAD/ISO 30107 Level 2) standards on credit… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | The VCDPA carves out 14 categories of exempted data/entities, including information governed by GLBA, HIPAA, FCRA, the Driver's Privacy Protection Act, the Farm Credit Act, and FERPA, and excludes… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Amber | The My Health My Data Act is Washington's flagship sectoral overlay, enacted specifically to close gaps left by HIPAA for non-covered health-data collectors (apps, wearables, websites). No… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Amber | West Virginia's data-protection landscape is dominated by federal sectoral overlays: GLBA for financial institutions, HIPAA for health entities, FCRA for credit reporting/scoring, and FERPA for… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Green | Wisconsin's data-protection posture is dominated by federal sectoral overlays: GLBA (financial), HIPAA (health), FCRA (credit/scoring), and FERPA/COPPA (education/children), all applicable nationwide… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Amber | Sectoral federal overlays are the dominant source of data-protection obligation in Wyoming: GLBA for financial institutions, HIPAA for covered health entities, and FERPA for education records. No… | Profile →Brief |
| Zambia (ZM) | Africa | Red | A separate Cyber Security and Cyber Crimes Act, 2021 (Act No. 2 of 2021) exists in Zambia alongside the Data Protection Act, but only title-level secondary metadata was retrievable, with no citable… | Profile →Brief |