--- title: "Sectoral privacy rules — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/sectoral-watch/ source_html: /domains/sectoral-watch/index.html description: "Cross-jurisdiction comparison of Sectoral privacy rules across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 421c6c7a19468a5a6d85e90ba89c9fc46ba4e8c17d9615d4b2404f5c88a00be0 generator: "fe-fleet/md-twin@1.0" --- # Sectoral privacy rules — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 4 Confirmed 135 Probable 28 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Red No continental-level sectoral data-protection overlay (financial, health, telecoms/eprivacy, employment, credit, education, insurance) was found in the Malabo Convention, AU status list, or Roadmap.… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Alabama layers several sector-specific statutes atop the general breach-notification baseline: the Insurance Data Security Law (Title 27, Ch. 62) for insurance licensees, and general references to… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Amber Alaska's data-protection landscape is almost entirely sectoral. Financial-sector data is governed by the federal Gramm-Leach-Bliley Act safeguards rule; health data by HIPAA/HITECH; credit/scoring by… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber Alberta's health sector is governed by a distinct Health Information Act (HIA) regime with harm-based breach notification and tiered offence penalties, layered atop PIPA/PIPEDA. PIPA itself carves… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Amber The most concretely corroborated sectoral signal for Algeria is financial-sector related: Algeria was placed on the EU's AML/CFT high-risk third-country list via Commission Delegated Regulation (EU)… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Amber The clearest documented Antigua and Barbuda regulatory activity located concerns the financial/virtual-asset sector rather than general data protection: a Digital Assets Business Bill regulating… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Amber Sectoral overlays are most developed in health (telemedicine/digital prescriptions must comply with both the LPDP and the Patient Rights Law 26.529, with sensitive-data confidentiality duties for… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Outside the breach-notification statute, Arizona's data-protection-relevant sectoral activity consists of a direct-to-consumer genetic-testing statute and reliance on federal sectoral overlays (HIPAA… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Amber Arkansas layers a small number of sector-specific instruments atop the general breach-notification baseline: Act 557 (virtual-currency data-security programs), the Arkansas Consumer Telephone Privacy… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level sectoral overlays (financial, health, telecoms, employment, credit, education, insurance) with binding force exist. ASEAN implementing guidance recommends that member states apply… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber Sector overlays exist for credit reporting (Part IIIA with its own penalty scale), health records (My Health Records Act with its own enforcement regime), and telecommunications/online-safety (Online… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber Austrian sector-specific overlays interacting with GDPR/DSG were only partly confirmed in this research pass. Telecoms/ePrivacy (TKG 2021) and employment (ArbVG works-council co-determination, GlBG)… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Amber The clearest confirmed sectoral overlay is telecommunications: the Bangladesh Telecommunication Regulation Act empowers interception of communications on national-security/public-order grounds… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Amber Sectoral overlays confirmed for Belgium are strongest in telecoms/electronic-communications (Belgian Electronic Communications Act, LCE, applied alongside GDPR) and employment (CBA No. 81 governing… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced sectoral overlays (financial-sector/IFSC data rules, health, telecoms/ePrivacy transposition, employment-data provisions, credit, education, insurance, or a data-access/sharing scheme)… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber Financial-sector data flows are shaped by BACEN/Monetary Council open-banking (Open Finance) rules layered atop the LGPD, plus bank self-regulation (FEBRABAN's CARB Standard 21/2022). Health-sector… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber BC's DP landscape includes a dedicated health-sector overlay (the E-Health (Personal Health Information Access and Protection of Privacy) Act) administered by the same OIPC BC, and an employment… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Amber Confirmed sectoral overlay evidence is limited to the employment-data and telecoms/eprivacy domains, where the Labor Code, Electronic Communications Act, and Constitution intersect with GDPR/the Act.… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red No confirmed Cambodia-specific sectoral overlay (financial, health, telecoms/ePrivacy, employment, credit, education, or insurance) displacing or supplementing a general DP regime was identified… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Red No sector-specific overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) for Cameroon were identified in available research. [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber The most consequential sectoral overlay for CA-KAH is the Consumer-Driven Banking Act (open-banking), described as the 'first iteration' of Canada's forthcoming federal data-mobility framework under… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber The single most JID-critical finding is that a First Nation band council, acting in its core governmental functions, is generally treated by the OPC as a 'federal work, undertaking or business'… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Financial-sector data flows are governed by the Ley Fintech (Open Finance system) and CMF technical standards (NCG N.º 514), which pre-date and currently sit alongside the incoming general DP law… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber Financial-sector data is subject to PBOC-issued classification guidelines (Financial Data Security — Data Security Classification Guidelines, 2020) and the amended Anti-Money Laundering Law… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber The clearest sectoral overlay is the financial/credit-reporting regime under Law 1266 of 2008 (habeas data financiero), enforced through fines such as those against Comfamiliar and Refinancia for… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Amber The CPA carves out entity-level exemptions for GLBA-regulated financial institutions and data-level exemptions for HIPAA-covered PHI, COPPA-regulated data, and employment-context data (the CPA's… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No sector-specific data-access/sharing, financial-sector, health-sector, telecoms/ePrivacy, employment, credit-scoring, education or insurance overlay touching personal data was located for the Union… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No Comoros-specific financial-sector, health-sector, telecoms/ePrivacy, employment-data, credit-scoring, education, insurance, or data-access-sharing overlay regime could be identified. Anjouan is… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No sector-specific data-protection overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance, or horizontal data-access/sharing schemes) were identified for… [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber CTDPA carves out entities/data already regulated by federal sectoral frameworks: HIPAA-covered entities and business associates, GLBA-regulated financial institutions, FCRA data, and the Connecticut… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Amber Financial-sector personal data is the best-evidenced sectoral overlay: SUGEF-supervised entities' databases are exempt from PRODHAB's registration duty but remain subject to its general control, as… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Amber Telecoms/ePrivacy is overlaid by the Electronic Communications Act (transposing Directive 2002/58/EC) supervised jointly by HAKOM and AZOP. Insurance and credit/debt-collection sectors show active… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Amber Curaçao is a member of the Caribbean Financial Action Task Force (CFATF) and is viewed by international supervisory bodies as having limited effective AML/tax-enforcement measures, a fact relevant to… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Amber Sectoral overlays supplementing GDPR/Law 125(I)/2018 include: telecoms/ePrivacy rules under Law 112(I)/2004 (electronic communications and postal services) and the Private Communications Law 92(I)/96… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Amber The main confirmed sectoral overlay is telecoms/e-privacy: the Electronic Communications Act (Act No. 127/2005 Coll.), as amended (Act No. 374/2021 Coll. and consultations transposing the European… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Amber The DPDPA exempts data governed by GLBA, HIPAA and FCRA and excludes employment-context personal data (e.g., job applicants) from its consumer-rights framework, deferring to those federal sectoral… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Sector overlays in Denmark include the Marketing Practices Act (implementing ePrivacy rules on direct marketing), enhanced HR-data legitimate-interest bases, mandatory Datatilsynet pre-approval for… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Amber The clearest District-relevant sectoral overlay identified is the FTC's Health Breach Notification Rule (16 CFR Part 318), which by its own terms defines 'State' to include the District of Columbia… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Amber The financial sector is overlaid by Monetary and Financial Law No. 183-02, which establishes the regulatory and institutional framework for the Dominican monetary and financial system including bank… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Green Because JID=EC covers the Union institutions themselves, 'sectors' map onto specific EUIs/agencies rather than private industry: EU financial-supervision agencies (ESMA, EIOPA, EBA) apply EUDPR with… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber The Central Bank of Egypt (CBE) and CBE-supervised entities are exempted from the general PDPL regime (except money-transfer and forex companies, which must follow CBE-established data rules)… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Amber Estonia has no distinct sectoral DP statutes displacing GDPR, but sectoral overlays are visible in practice: the Estonian Financial Intelligence Unit's (Rahapesu Andmebüroo) AML data processing is… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber GDPR applies horizontally with sector overlays; identified 2026 activity centres on health data (CNIL's €5m fine against IQVIA) and telecoms/eprivacy (Digital Omnibus proposed ePrivacy Directive… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Amber Finland layers sector-specific overlays atop the GDPR baseline: FIN-FSA (Finanssivalvonta) oversight of financial-sector cyber resilience intersects with DP security duties (as in the Aktia Bank… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Amber Florida's earlier competing comprehensive-privacy bills (HB 969 / SB 1734, 2021) proposed GLBA and HIPAA entity/data exemptions; whether the enacted FDBR (SB 262, 2023) preserves materially identical… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Amber Financial (banks/insurers), telecoms/ePrivacy and employment/public-sector data processing carry distinct overlays evidenced by CNIL DPO guidance and 2026 enforcement (FRANCE TRAVAIL). Credit-scoring… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Amber Georgia relies entirely on federal sectoral overlays for privacy-adjacent obligations: GLBA (and its FTC Safeguards Rule) for financial institutions, COPPA for children's online data, and HIPAA for… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Amber Telecoms/telemedia is the most developed sectoral overlay: TTDSG (as amended into the TDDDG) supplies a lex specialis cookie/tracking consent regime and a Consent Management Ordinance (effective 1… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Red No sector-specific overlays (financial, health, employment, credit-scoring, education, insurance) displacing or supplementing the general Data Protection Act were independently confirmed in this… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Sectoral overlays identified include health (Gibraltar Health Authority as controller for contact tracing under GRA COVID guidance), telecoms/eprivacy (Communications (Personal Data and Privacy)… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Amber Sector-specific enforcement is evidenced in telecoms (Law 3471/2006, ADAE oversight), employment (Law 4624/2019 employment provisions), health (patient-data access-abuse fines), financial services… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Amber Evidence of sectoral overlay in Guernsey is limited to indications of GFSC/financial-services coordination and specific Schedule 8 exemptions for tax/crime information and certain… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Amber Alderney has its own historical ePrivacy transposition, the European Communities (Implementation of Council Directive on Privacy and Electronic Communications) (Alderney) Ordinance, 2009, distinct… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber Hawaii's data-protection landscape is defined by sectoral overlays rather than a general regime: federal HIPAA and HRS §622-57 for health data; federal GLBA and the Hawaii Insurance Code for… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Amber Hong Kong has no standalone sectoral data-privacy statutes; instead, sector regulators (HKMA, Insurance Authority, SFC) issue circulars and guidelines overlaying the PDPO for regulated entities'… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber Telecoms/e-commerce direct-marketing complaints are carved out to the media regulator NMHH rather than NAIH. Employment-data processing has generated concrete NAIH enforcement on IT-monitoring… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber The clearest sectoral overlay evidenced is education (repeated ed-tech/cloud-services fines) and health/genetic research (COVID-19 sample processing); financial, telecoms/ePrivacy, credit-scoring… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Amber In the absence of an omnibus statute, Idaho residents' data receives protection principally through federal sectoral overlays: HIPAA (health), GLBA (financial), FCRA (credit/scoring), and COPPA… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber Federal sectoral overlays (HIPAA, GLBA, COPPA — properly attributed to the US-federal JID) apply in Illinois as elsewhere. Illinois-specific sectoral rules include GIPA's insurer-underwriting… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber The clearest sectoral overlay identified is financial services: RBI Master Directions on cyber resilience/payment-data localisation and SEBI cloud-adoption rules mandate in-India storage of specified… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Amber The ICDPA exempts data and entities already covered by GLBA, HIPAA, FCRA, FERPA, the Driver's Privacy Protection Act, and human-subjects research standards, deferring sectoral privacy governance in… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber The ICDPA carves out broad sectoral exemptions rather than layering sector-specific overlays: GLBA-covered financial institutions, HIPAA/HITECH-covered entities and health records, FERPA-covered… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber Sectoral overlays in Ireland include the ePrivacy Regulations (S.I. No. 336/2011) for telecoms/electronic communications, a DPA 2018 insurance-specific health-data ground, and education-sector… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Amber Direct sectoral evidence located in this pass is limited to the health/social-care sector (Manx Care, the publicly-owned health and social care provider, subject to Applied GDPR access-right… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Amber Sector overlays include: healthcare (frequent Garante sanctions and guidance on health data and telemedicine); telecoms/eprivacy (Art.122 Codice cookie rules, Registro Pubblico delle Opposizioni for… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red No CI-specific sectoral overlay evidence (banking/BCEAO-UEMOA financial data rules, health-sector rules, telecoms/ePrivacy, employment, credit-scoring, education, or insurance) was retrieved in this… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Amber Sector-specific overlays supplement the general APPI framework: the Financial Services Agency (FSA) issues financial-industry personal-information guidelines; METI issues credit-card-industry and… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Amber The only concretely evidenced sectoral development is a 2026 Population-Register data-sharing initiative between the Government of Jersey and UK credit reference agencies, enabled by a States… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Amber Sectoral overlays in Kansas are exclusively federal: GLBA (financial), HIPAA (health), FCRA (credit/scoring), FERPA/COPPA/PPRA (education). No Kansas-specific comprehensive sectoral privacy statute… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Red Only a telecoms/online-identification overlay is confirmed: website and telecommunications operators face user-identification obligations under the Informatisation Law regime. Financial, health… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber The KCDPA layers onto pre-existing Kentucky sectoral regimes. It exempts HIPAA-regulated health data (narrowed further by HB473 from June 1, 2026); financial institutions subject to GLBA are, per the… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber Telecoms are regulated under the Kenya Information and Communications Act (KICA) and its Consumer Protection/SIM-Card Registration Regulations, overlaying the DPA for licensed providers. Financial… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Amber Laos has sector-specific instruments that intersect with data flows: an Anti-Money-Laundering and Counter-Financing of Terrorism law governing financial-sector data sharing, a 2017 Law on Payment… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Red Neither the OAS Principles nor the RIPD Standards establish sector-specific overlays (finance, health, telecoms, employment, credit-scoring, education, insurance) comparable to GDPR-adjacent sectoral… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber Sectoral overlays confirmed for Latvia are concentrated in telecoms/eprivacy (Law on Information Society Services 2004, as amended, applied alongside GDPR to cookie practices) and employment data… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Amber Liechtenstein's financial-sector data processing (a core feature of its economy as a private-banking/trust hub) interacts with GDPR through DSS-published sector guidance; other sector overlays… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Amber Sectoral overlays are thin in Lithuania beyond GDPR: telecoms/eprivacy is transposed via the Law on Electronic Communications; VDAI has issued employment and health-sector guidance; a fintech… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber Financial and health data in Louisiana are governed by federal GLBA and HIPAA respectively, per the seed disambiguation: Louisiana requires notification of breaches pursuant to… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber The financial sector carries a distinct professional-secrecy/cooperation overlay under the Law of 5 April 1993 on the financial sector (as amended), administered by the CSSF, which interacts with but… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Amber Maine's most developed data-protection rules are sectoral: broadband-ISP privacy (Title 35-A §9301) and insurance data security (Maine IDSA). Health and financial data are governed primarily by… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Amber The PDPA is the general commercial-transactions statute, and PDP is empowered to designate industry classes for registration and to approve sector-specific Codes of Practice (including for the… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Amber Malta's general GDPR/Act regime is overlaid by sector-specific instruments: an ePrivacy transposition for electronic communications, insurance-sector health-data derogations, employment guidance… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Amber Outside the general-DP gap, RMI maintains fragmented sector-specific confidentiality provisions in banking and tax law and customer-information provisions in its AML regulations. No health… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber MODPA carves out several federally-regulated sectors: GLBA-covered financial institutions, HIPAA-covered health data, FCRA-covered consumer-reporting activity, and FERPA-covered education records are… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Amber Federal sectoral statutes are the dominant source of enforceable duties touching Massachusetts data practices: GLBA/Safeguards Rule for financial institutions, HIPAA for health data, FCRA for… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Amber Mexico layers sector-specific rules atop the general private-sector data protection statute, most notably in financial services (credit-reporting carve-out, CNBV incident-notification duties for… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Amber Michigan-based entities are subject to multiple federal sectoral overlays (GLBA for financial institutions, HIPAA/FTC Health Breach Notification Rule for health data, FCRA for credit… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Amber The MCDPA does not fully exempt GLBA-covered financial institutions or HIPAA-covered health entities, instead layering targeted (data-level) exemptions on top of those federal regimes. Certain… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Amber Federal sectoral overlays apply fully in Mississippi in the absence of a state omnibus law: HIPAA (health data, non-preemptive of stricter state law, though Mississippi has none stricter in this… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Amber Federal sectoral overlays supply the substantive privacy content Missouri's own statute book lacks: GLBA for financial institutions, HIPAA for covered health entities, FERPA/COPPA for education and… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Amber MTCDPA carves out significant sectoral exemptions: GLBA-regulated data remains exempt though SB 297 removed the blanket GLBA financial-institution entity exemption (replacing it with explicit… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Red Sourced sectoral evidence is limited to CNDP recommendations on genomic/genetic data processing (health sector). No sourced overlays were found for financial services, telecoms/ePrivacy, employment… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Amber The financial and telecommunications sectors reportedly maintain their own legal frameworks for safeguarding sector data, though specific instruments were not independently verified. The Electronic… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Amber Sectoral overlays are the primary source of enforceable data-protection-adjacent duties in Myanmar: the Financial Institutions Law 2016 for banking customer information, the Telecommunications Law… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber GLBA-regulated financial institutions and HIPAA-covered entities/business associates benefit from entity-level exemptions under the NDPA and a compliance safe-harbour under the 2006 breach law. The… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No sector-specific data-protection overlays (financial, health, telecoms/eprivacy, employment, credit-scoring, education, insurance) were confirmed for Nepal in available sources. Per the seed… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Amber Telecommunications and electronic-communications processing is governed by the Telecommunicatiewet, transposing the ePrivacy Directive, including the cookie-consent rule and a July 2021 shift to… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Amber Two sectoral overlays are confirmed for Nevada: (i) a financial-sector carve-out under SB 220, which excludes GLBA-regulated financial institutions and their affiliates/third parties from the… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Amber Multiple sector overlays intersect with PIPEDA in NB: the federal Bank Act regulates federally-regulated financial institutions' handling of personal financial information; PHIPAA displaces PIPEDA… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Amber The NHDPA carves out several federally-regulated sectors from its scope rather than layering additional NH-specific sectoral rules on top. Financial data covered by the Farm Credit Act, health data… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Amber The NJDPL carves out several federally regulated sectors entirely: HIPAA-covered health information, FCRA-covered consumer-reporting data, and data collected by certain financial and insurance… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Amber Sectoral coverage in New Mexico is dominated by federal overlays: GLBA for financial-sector personal data, HIPAA for health data, and FCRA for credit-related consumer-report rights, all displacing… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Amber Sector-specific overlays operate via OPC-issued binding codes of practice that adapt the IPPs to particular data classes or industries. The Health Information Privacy Code (HIPC) governs… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Amber The NDPA operates alongside sector regulators; NDPC explicitly recognises complementary instruments including the Central Bank of Nigeria's Consumer Protection Regulation and the Nigerian… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Amber North Carolina relies entirely on federal sectoral overlays for financial, health, telecoms, employment, credit, education, and insurance data: GLBA for financial institutions, HIPAA for health data… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Amber Sectoral overlays are the dominant source of enforceable privacy obligation in North Dakota. Financial institutions are governed by GLBA and North Dakota's financial-institution data-security act… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Amber The research pass located limited Norway-specific sectoral overlay evidence beyond the general GDPR framework. Datatilsynet acts as the cross-sectoral regulator; case evidence (Telenor - telecoms… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Amber In the absence of an Ohio omnibus statute, sectoral federal overlays do the substantive work: GLBA Title V governs financial-institution nonpublic personal information (enforced by the FTC, federal… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Green Federal sectoral overlays are the dominant operative source of data-protection obligation for Oklahoma entities today: HIPAA governs health-care covered entities/business associates; GLBA (Privacy… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber Ontario's sectoral overlays are concentrated in health (PHIPA, with a mature IPC administrative-monetary-penalty regime now in active use) and public-sector/child-welfare (FIPPA, CYFSA), while… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Amber OCPA carves out several sectoral overlaps rather than displacing them: GLBA, HIPAA, and FCRA-covered data/entities are exempted, as are employment records and certain insurance entities. [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Amber In the absence of a general data-protection statute, sectoral overlays provide the only in-force, data-adjacent obligations. The State Bank of Pakistan (SBP) has issued a draft digital-banking… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No sector-specific data-access/data-sharing, financial, health, telecoms/ePrivacy, employment, credit-scoring, education or insurance data overlay could be confirmed for Palau from available sources… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Amber ANTAI resolutions confirm that Law 81 functions as the general framework and minimum compliance standard applicable to any sector-specific law addressing personal data protection in Panama. No… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Amber Sectoral overlays exist for insurance/financial data and telemarketing, with employment and education-sector bills pending. The Privacy of Consumer Financial Information Law and Standards for… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Amber Financial-sector personal data used for credit-risk purposes is separately regulated by Ley N° 27489 governing Centrales Privadas de Información de Riesgos (CEPIRS/credit bureaus), with SBS retaining… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber Sector-specific overlays interact with the general DP regime particularly in financial services (bank-secrecy and credit-information statutes referenced alongside the Act; NPC Circular 20-01 for… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Amber Sectoral overlays in Poland are led by UODO for GDPR compliance, with parallel competences held by UOKiK (competition/consumer protection, including dark-pattern detection) and the Office of… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Amber Sectoral overlays confirmed in research center on health data (statutory notification duties, historic hospital enforcement) and employment data (disapplied consent provision). Telecoms/cyber overlay… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Red The QFC itself functions as Qatar's principal financial-sector data-protection overlay, operating a GDPR-aligned regime distinct from mainland Law 13/2016 for firms licensed within the free zone. The… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Amber A dedicated health-and-social-services overlay (LRSSS) is confirmed in force since July 2024. CAI has issued recruitment/AI-hiring guidance touching employment data. No Quebec-specific… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber RIDTPPA's 'customer' definition excludes individuals acting in a commercial or employment context, effectively carving employment data out of the consumer-privacy regime. Federal sectoral overlays… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Amber Sectoral overlays identified in Romania include financial-sector consumer-credit processing (Hora Credit IFN, an IFN/non-bank lender, sanctioned under GDPR for loan-processing data handling) and… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Amber Sectoral overlays are unevenly documented. Financial-sector biometric-collection rules for credit institutions were in draft/amendment stage as of 2022. Telecoms carry a distinctive dual overlay… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Red No sector-specific data-protection overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) distinct from the general omnibus regime were located for Rwanda… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber Financial-sector data processing is overlaid by SAMA's IT Governance and Cybersecurity Frameworks applying to banks, insurers, financing companies and credit bureaus; health and credit data receive… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Amber The CDP has issued sectoral deliberations covering workplace CCTV/employee monitoring and engaged actively with the health sector during the COVID-19 pandemic; it has also taken formal enforcement… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Red Sector-specific overlays remain thin: the Commissioner has opined that employers may not rely on employee consent alone to justify disproportionate biometric processing (e.g., fingerprint-based… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Red No sector-specific data-protection overlays (financial/banking-secrecy, health, telecoms/eProvacy traffic-data retention, employment-specific, credit-scoring, education, insurance) or a horizontal… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Amber Financial services carry a substantive MAS overlay: the Monetary Authority of Singapore issued Guidelines on Outsourcing Risk Management on 27 July 2016, including under… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Red No Slovakia-specific sectoral overlay documentation (banking-secrecy interaction, health-sector rules, telecoms/ePrivacy transposition specifics, employment-code provisions, credit-scoring rules… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Amber Direct sectoral-overlay evidence was limited in this research pass to the employment/education sectors. ZVOP-2 imposes a stricter-than-GDPR-default ultima ratio standard for employee video… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Red No sector-specific overlay (financial, health beyond the 2026 health-information regulation, telecoms/ePrivacy, employment, credit-scoring, education, or insurance) was substantively confirmed from… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber South Carolina's data-protection landscape is dominated by sectoral overlays: federal HIPAA, GLBA, and COPPA apply nationally in the absence of a state omnibus law; the state's own Insurance Data… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Amber Federal sectoral statutes (HIPAA, GLBA, COPPA) apply to covered entities operating in South Dakota but are federal-level frameworks properly attributed to the US federal JID rather than this state… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber Beyond PIPA, South Korea maintains sector-specific overlays: the Credit Information Use and Protection Act (Credit Act) governs personal credit information used in credit ratings and is enforced by… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Amber GDPR/LOPDGDD apply horizontally, with sector overlays: Ley 34/2002 LSSI for electronic communications/cookies, DPO-mandatory designation for schools and sports federations processing minors' data… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber Sri Lanka does not appear to have distinct sector-specific data-protection statutes (health, credit, education, insurance) separate from the PDPA; instead, the 2023 budget speech committed the… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber IMY overlays sector-specific supervision on top of GDPR for credit information (Credit Information Act), law enforcement (Criminal Data Act), telecoms/ePrivacy (Electronic Communications Act, LEK)… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Amber Switzerland lacks dedicated omnibus sectoral data-protection statutes, but sector-specific instruments layer additional obligations onto the FADP baseline: FINMA maintains an ordinance on data… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber Financial and health sectors carry the clearest overlays on the general PDPA regime: financial institutions face outsourcing/approval constraints and heightened cybersecurity expectations from the… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Amber Sectoral overlays are confirmed for the financial sector (Bank of Tanzania (Credit Reference Bureau) Regulations, 2012) and telecoms (Electronic and Postal Communications Act, 2010 (EPOCA), enforced… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Amber As with peer Virginia-lineage state laws, TIPA is expected to carry standard sectoral carve-outs (GLBA-regulated financial data, HIPAA-regulated health data, FERPA-regulated education data… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber TDPSA carves out broad sectoral exemptions rather than layering additional obligations: financial institutions/data under GLBA, HIPAA covered entities/business associates and HIPAA-regulated data… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Amber Financial services carry an independent overlay: the Bank of Thailand (BoT) requires financial institutions to follow specific data-protection and privacy procedures under the… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Amber Trinidad and Tobago has a criminal-law overlay (Computer Misuse (Amendment) Act 2022) touching unauthorised interception/sharing of personal data and malicious/unsolicited electronic communications… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red No sector-specific personal-data overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) applicable in Tunisia could be confirmed from accessible sources in… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Red Direct sector-specific overlay statutes (banking secrecy, health-sector regulation, telecoms/ePrivacy, credit scoring, education, insurance) were not substantively retrieved this run beyond general… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber Sectoral overlays are thin but emerging: Uganda's Ministry of Health has mandated health-facility compliance including DPO appointment and security measures; the PDPO's first criminal conviction… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Red Confirmed sectoral evidence was limited to employment data (notification/ROPA/security duties under Ombudsman orders) and a general health-data note (children's medical data treated under general… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber Telecommunications and healthcare are the most clearly documented sectoral overlays: the TRA derives customer-data jurisdiction from the Law Regulating the Telecommunications Sector, health data is… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber PECR functions as the UK's ePrivacy overlay on cookies, direct marketing and electronic communications, with DUAA-driven reforms including new cookie-consent exemptions and a charity soft opt-in.… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber US data protection is fundamentally sectoral: GLBA (financial), HIPAA plus the FTC Health Breach Notification Rule (health/health-adjacent), FCRA (credit and background-screening, with a deep body of… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber California layers sectoral carve-outs and overlay statutes onto the CCPA/CPRA baseline: GLBA-regulated financial data receives a partial data-level exemption; HIPAA/CMIA-regulated health data… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber New York's data-protection landscape is fundamentally sectoral. NYDFS's 23 NYCRR Part 500 governs financial-services cybersecurity; health information outside HIPAA is targeted by a pending New York… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Red No sector-specific overlays (banking secrecy, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance) displacing or supplementing the general LPD regime were independently… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Green The UCPA's material scope carves out the principal U.S. federal sectoral regimes — GLBA for financial data, HIPAA/HITECH for health data, FCRA for credit-reporting data, and FERPA for education… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red No sector-specific overlay findings (financial, health, telecoms, employment, credit, education, insurance, or horizontal data-access/sharing schemes) could be sourced for Vanuatu. Searches run… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red Sectoral provisions are described in the injected seed as the most concrete source of obligations, particularly banking (SUDEBAN) and telecommunications (CONATEL) confidentiality/retention rules, but… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber Vermont sectoral overlays: financial (Financial Privacy Act, Title 8) and health (Title 18) statutes operate alongside federal GLBA/HIPAA; education sector overlaid by original 2020 student-data… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber Confirmed sectoral overlays: (i) financial sector -- SBV Circular 77/2025/TT-NHNN imposing mobile-banking anti-tampering and biometric-matching (PAD/ISO 30107 Level 2) standards on credit… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber The VCDPA carves out 14 categories of exempted data/entities, including information governed by GLBA, HIPAA, FCRA, the Driver's Privacy Protection Act, the Farm Credit Act, and FERPA, and excludes… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Amber The My Health My Data Act is Washington's flagship sectoral overlay, enacted specifically to close gaps left by HIPAA for non-covered health-data collectors (apps, wearables, websites). No… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Amber West Virginia's data-protection landscape is dominated by federal sectoral overlays: GLBA for financial institutions, HIPAA for health entities, FCRA for credit reporting/scoring, and FERPA for… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Green Wisconsin's data-protection posture is dominated by federal sectoral overlays: GLBA (financial), HIPAA (health), FCRA (credit/scoring), and FERPA/COPPA (education/children), all applicable nationwide… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Amber Sectoral federal overlays are the dominant source of data-protection obligation in Wyoming: GLBA for financial institutions, HIPAA for covered health entities, and FERPA for education records. No… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Red A separate Cyber Security and Cyber Crimes Act, 2021 (Act No. 2 of 2021) exists in Zambia alongside the Data Protection Act, but only title-level secondary metadata was retrievable, with no citable… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)