--- title: "Data Protection Monitor — Global Privacy & Data Protection Regulatory Intelligence | dataprotection.gi" canonical: https://dataprotection.gi/ source_html: /index.html description: "Primary-source privacy, data-transfer, breach-notification, and supervisory-enforcement intelligence across 170 jurisdictions and 10 standing domains (D1-D10)." generated_at: 2026-11-07T14:58:19Z content_sha256: 0e298374146031b36bda5fce6fa2ab2097c97e9d2a4902cf7f6811dfd2daaf4f generator: "fe-fleet/md-twin@1.0" --- # Data Protection Monitor — Global Privacy & Data Protection Regulatory Intelligence | dataprotection.gi PRIVACY & DATA GOVERNANCE INTELLIGENCE · Updated 4 Nov 2026 · D1–D10 # Primary-source data protection law across 170 jurisdictions Compare supervisory authorities, lawful bases, data subject rights, controller/processor duties, cross-border transfer mechanisms, breach notification SLAs, AI/biometric governance, and enforcement penalties across 10 standing modules — backed by 15,384 claim-traced findings and 6,331 cited sources. Select a DPO / Privacy Counsel workflow to inspect live specimen Interactive Specimen → Regulator & Fee Register (D1) Cross-Border Transfers (D5) Breach Notification SLAs (D6) AI & Biometric Governance (D8) Fines & Enforcement (D10) Start a task: [1. Check cross-border transfers →](/domains/cross-border-and-adequacy/) [2. Compare 3–6 jurisdictions →](/compare/?jids=gi,uk,fr) [3. Build a board or legal report →](/reports/) [4. Inspect 100% open exemplar (Gibraltar) →](/jurisdictions/gi/) [Explore 170 jurisdictions →](/jurisdictions/) [Compare jurisdictions](/compare/?jids=gi,uk,fr) [Plans & licensing](https://a-i.gi/licensing/) 🇬🇧 United Kingdom · 01 Regulator & Framework (Open on Free Tier) CLM-UK-d4e63f54 Source Authority: T1/4 Primary Legislation Confidence: Confirmed Legal Force: In Force · Binding Expert Reviewed: Ramparts (24 Oct 2026) "The Information Commissioner's Office (ICO) maintains a public register of data protection fee payers under the Data Protection (Charges and Information) Regulations 2018 (SI 2018/480), enacted under section 137 of the Data Protection Act 2018; every non-exempt controller must pay an annual tiered charge (£40 Tier 1, £60 Tier 2, £2,900 Tier 3) and renew registration annually." Statutory Instrument [SI 2018/480 · DPA 2018 s.137 & UK GDPR ↗](https://www.legislation.gov.uk/uksi/2018/480/contents/made) Supervisory Authority Information Commissioner's Office (ico.org.uk) Entitlement Scope Module D1 Open Across All 170 Jurisdictions Verification Stamp [legislation.gov.uk ↗](https://www.legislation.gov.uk/uksi/2018/480/contents/made) · Verified 24 Oct 2026 Inspect Evidence Span ▾ Copy Citation [Open UK Dossier →](https://dataprotection.gi/jurisdictions/united-kingdom/#sec-cat-regulator-and-framework) PRIMARY SOURCE PROVENANCE (OPEN EVIDENCE DRAWER) [CLM-UK-d4e63f54 · Tier 1 Primary Source] Data Protection (Charges and Information) Regulations 2018 (SI 2018/480), reg. 2–3 & Schedule; ICO Register of Fee Payers ( https://ico.org.uk/ESDWebPages/Entry/Z1842228 ). Verified against Data (Use and Access) Act 2025 transitional governance provisions. 170 Published Jurisdictions 105 countries · 61 sub-nat · 4 blocs 10 Standing Modules D1 & D3 open free everywhere 15,384 Sourced Findings Verbatim quotes & claim IDs 6,331 Cited Sources Statutes, DPAs & EDPB/ICO 3 Expert-Reviewed EEA, Gibraltar & UK (Ramparts) 4 Nov 2026 Latest Research Check Roundup: 2026-11-01 High-Value DPO Utility · Instant Multi-Jurisdiction Triage ## Cross-border transfer, breach notification SLA & penalty comparator Compare operational compliance thresholds across key reference jurisdictions before drilling into the full 10-module dossier. [Compare All 170 Jurisdictions →](https://dataprotection.gi/jurisdictions/) Jurisdiction Primary Statute & DPA (D1) Breach Notification SLA (D6) Cross-Border Transfer Mechanism (D5) Statutory Fine Ceiling (D10) Review Status 🇬🇮 Gibraltar 100% Free Exemplar Data Protection Act 2004 & Gibraltar GDPR · GRA 72 hours to GRA; without undue delay to data subjects if high risk UK Adequacy bridge + Gibraltar IDTA / Standard Contractual Clauses £17.5m or 4% global annual turnover [Expert Reviewed (Ramparts†) →](https://dataprotection.gi/jurisdictions/gibraltar/) 🇬🇧 United Kingdom Free Reference UK GDPR, DPA 2018 & DUAA 2025 · ICO 72 hours to ICO (Art. 33 UK GDPR) UK Adequacy Regs + UK IDTA / EU SCC Addendum £17.5m or 4% global annual turnover [Expert Reviewed (Ramparts†) →](https://dataprotection.gi/jurisdictions/united-kingdom/) 🇪🇺 European Economic Area Free Reference Regulation (EU) 2016/679 (GDPR) · EDPB & 30 NCAs 72 hours to lead/competent supervisory authority (Art. 33) Art. 45 Adequacy, 2021 EU SCCs + TIA, BCRs (Art. 46) €20m or 4% global annual turnover [Expert Reviewed (Ramparts†) →](https://dataprotection.gi/jurisdictions/european-economic-area-bloc/) 🇺🇸 United States (Federal / CA) Free Reference FTC Act s.5, COPPA, GLBA, HIPAA + CCPA/CPRA (CPPA) & 20 state laws State-specific (CA: without unreasonable delay; SEC 4 business days; CIRCIA 72h) No general outbound restriction; DOJ Bulk Sensitive Data Rule (EO 14117) $2,500–$7,500 per violation (CPPA) / FTC consent decrees [AI-Monitored · Cited →](https://dataprotection.gi/jurisdictions/united-states/) 🇨🇳 China Free Reference PIPL (2021), Data Security Law & Cybersecurity Law · CAC Immediate remedial action & notification to CAC (critical: 1–4 hours) CAC Security Assessment, Standard Contract (SCCs) or Certification + मार्च 2024 volume exemptions RMB 50m or 5% prior-year annual turnover + personal liability [AI-Monitored · Cited →](https://dataprotection.gi/jurisdictions/china/) 10 -Module Standing Schema ## Every jurisdiction structured across 10 comparable modules Modules 01 Regulator & Framework and 03 Data Subject Rights are open free across all 170 jurisdictions on the Explore tier so practitioners can verify statutory baselines anywhere. Inspect module in: 🇬🇮 Gibraltar (100% Open Exemplar) 🇬🇧 United Kingdom 🇪🇺 EEA 🇫🇷 France 🌐 Cross-Jurisdiction Domain Hub ( 170 jurisdictions) Group A · Core Legal Foundation ### Perimeter, Lawful Basis & Rights - 01 Regulator & Framework Open on All 170 JIDs — Primary statutes, supervisory authority powers, territorial scope, and registration/fee duties. - 02 Lawful Processing & Special Data — Consent standards, legitimate interest assessments, biometric/health/genetic data rules. - 03 Data Subject Rights Open on All 170 JIDs — DSAR response SLAs, erasure, portability, and automated decision objection rights. Group B · Operational Compliance ### Governance, Transfers & Sectoral Rules - 04 Controller & Processor Duties — DPO appointment thresholds, RoPA, DPIAs, and Art. 28 processor contract clauses. - 05 Cross-Border Transfers & Adequacy — Adequacy lists, SCCs/IDTAs, Transfer Impact Assessments, and data localisation mandates. - 06 Sectoral Watch & Breach Notification — Mandatory breach notification windows (24h/72h) and financial/telecom/health overlays. Group C · Commercial, AI & Enforcement ### AdTech, AI Privacy, Children & Fines - 07 AdTech & Commercial Privacy — ePrivacy/cookie consent, direct marketing opt-ins, and data broker registries (e.g. CA Delete Act). - 08 Algorithmic, Biometric & AI Privacy — Automated profiling, AI model training lawful bases, and facial recognition bans. - 09 Children & Vulnerable Groups — Age-of-consent thresholds (13–16), age-assurance mandates, and children's design codes. - 10 Enforcement & Redress — Administrative fine ceilings, criminal offences, and collective/class action standing. Regulatory Roundup ## Recent supervisory actions & statutory changes (Week of 1 November 2026) Recent supervisory decisions, cross-border transfer rulings, and statutory updates from our weekly roundup. [Open Full Roundup Archive →](https://dataprotection.gi/roundup/) - 24 Oct 2026[United Kingdom](/jurisdictions/united-kingdom/): Data (Use and Access) Act 2025 Royal Assent implementation milestones, ICO governance reform, and updated controller accountability guidance. [Open UK dossier →](/jurisdictions/united-kingdom/) - 23 Oct 2026[European Economic Area](/jurisdictions/european-economic-area-bloc/): EDPB coordinated enforcement action on controller transparency and cross-border adequacy review milestones. [Open EEA dossier →](/jurisdictions/european-economic-area-bloc/) - 18 Oct 2026[Regulatory Roundup — Week of 18 October 2026](/roundup/): Full ranked cross-jurisdiction edition with cited primary sources across all published jurisdictions. [Edition permalink (2026-10-18) →](/roundup/2026-10-18/) Coverage & Verification Summary ## Coverage ledger & open reference dossiers Verified coverage across all monitored jurisdictions, statutory sources, and open reference dossiers. Jurisdictions tracked & published 170 of 170 Every published dossier follows the same standing module grammar. Standing modules per record 10 Fixed cross-jurisdiction schema so any two markets can be compared module for module. Sourced regulatory findings 15,384 Each finding carries a source authority tier (T1–T4) and confidence grade. Cited primary & secondary sources 6,331 Direct links to statutory instruments, supervisory guidance, and enforcement orders. Verification & review status 3 expert-reviewed · 170 source-tier verified Automated source-tier & confidence-cap gate on every build; human counsel sign-off badged separately. Free-tier open records 7 full dossiers Unrestricted access to EEA, US, CA, CN, NG, UK, and GI — no registration required. Latest research check 4 Nov 2026 Date of the most recent source collection and verification pass across the corpus. [🇪🇺 European Economic Area (Bloc)EEA](/jurisdictions/european-economic-area-bloc/) [🇺🇸 United StatesUS](/jurisdictions/united-states/)[🇨🇦 CanadaCA](/jurisdictions/canada/)[🇨🇳 ChinaCN](/jurisdictions/china/)[🇳🇬 NigeriaNG](/jurisdictions/nigeria/)[🇬🇧 United KingdomUK](/jurisdictions/united-kingdom/)[🇬🇮 GibraltarGI](/jurisdictions/gibraltar/) Plans & Licensing ## Simple, predictable licensing for privacy teams & law firms [Full Union Licensing Page →](https://a-i.gi/licensing/) 1. Explore (Free Tier) £0 Open baseline & verification - Decision Layer + Executive Brief across all 170 jurisdictions - 2 Core Modules Open Everywhere: 01 Regulator & Framework & 03 Data Subject Rights - 100% Open Exemplars: Gibraltar (GI) + 6 full reference dossiers (UK, EEA, US, CA, CN, NG) - Open Evidence Drawer on all visible claims - 3 Full-Record Passes/mo + 1 trial report/mo with work email [Open Gibraltar Exemplar](https://dataprotection.gi/jurisdictions/gibraltar/) 2. Pro (Individual DPO / Counsel) Partner & early-access terms — enquire → Single-Monitor Subscription (1–3 monitors) · Portfolio Subscription (at 4× single-monitor rate) - All 10 standing modules (D1–D10) across all 170 jurisdictions (including US states & Canadian provinces) - Full Cross-Border Transfer (D5), Breach SLA (D6), AdTech (D7) & AI Privacy (D8) records - Roundup alerts & 5 PDF dossier exports/mo - Portfolio Subscription (4x single-monitor rate): Includes Data Protection + AI Governance + Payments + Crypto + Sentinel + Advennt [Start Pro or All-Access Pass](https://a-i.gi/licensing/#pro) 3. Firm (Privacy Practice & Team) Partner & early-access terms — enquire → Single-Monitor Subscription (up to 8 seats) · Portfolio Subscription (at 4× single-monitor rate) - Up to 8 named seats for law firms, DPO-as-a-Service providers & global privacy teams - Client Advisory Rights: Attach multi-country transfer impact & breach SLA tables in client deliverables - Bulk CSV/XLSX comparator exports & priority review escalation [Select Firm Licence](https://a-i.gi/licensing/#firm) +1. Enterprise Data & AI Partner & early-access terms — enquire → Scope 1 — Internal Systems & RAG · Scope 2 — External Product, OEM & AI Grounding - Scope 1 — Internal Systems & RAG: Structured JSON feeds of all 15,384 privacy findings for internal GRC/privacy automation - Scope 2 — External Product, OEM & AI Grounding: Customer-facing privacy SaaS & AI co-pilot grounding rights [Request Enterprise Feed](https://a-i.gi/licensing/#enterprise) Research last banked: 2026-11-01 · This site last published: 2026-11-04 15,384 claims across 6,331 primary & official sources