--- title: "Laos Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/laos-data-protection-privacy-regulation/ source_html: /jurisdictions/laos/index.html description: "Laos data protection and privacy regulation: 10 categories, 73 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: c9f745d6f311ba83d90fb4016290c9cab56139edc847c7ad2bb368744bd61d29 generator: "fe-fleet/md-twin@1.0" --- # Laos Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Laos Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/laos/), [World Payments](https://payments.gi/jurisdictions/laos/) Last updated 2026-11-04 · 10 categories · 73 claims · 21 sources in the cumulative register Download report (PDF) Expand all Laos is understood to have no independent data-protection authority, with the Ministry of Technology and Communications combining rule-setting, business-facilitation and enforcement functions under the electronic data protection law. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (5 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=LAOS)[Build Report](/reports/?j=LAOS)[Compare](/compare/?j=LAOS) Framework posture Unregulated gap 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Ministry of Technology and Communications (MTC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 8 Probable · 1 Uncertain · 1 Not yet assessed 10 Categories 8 Red categories 57 Sub-modules 73 Claims 5 Tier-1 sources Traffic-light mix 8 red 1 amber 1 n/a (sums to 10 rendered categories; click to filter) 8 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 820 Full executive summary 545 ###### Latest update · 25 October 2026 #### Lead Signal Laos has brought a new Law on Cybersecurity, numbered 87/NA, into force, with gazettal recorded on 20 March 2026 and an effective date understood to reach back to 1 September 2025. The instrument sits alongside the existing Law on Electronic Data Protection No. 25/NA rather than replacing it, and the two now operate as parallel regimes covering overlapping ground without a single authority positioned to reconcile them. The Ministry of Technology and Communications, which already carried responsibility for the 2017 data-protection law, continues as the body overseeing compliance and enforcement, and Laos still has no independent data-protection authority separate from that ministry. The new law is understood to introduce a Critical National Information Infrastructure designation, identifying sectors -- reporting places finance and banking among them -- subject to heightened obligations. It is also understood to establish a National Cybersecurity Operations System that combines expert personnel with big-data analytics and artificial intelligence for continuous, around-the-clock monitoring and response. The law's text is silent on whether that monitoring system is already operational and on how it relates to the country's existing computer emergency response function, leaving the practical reach of the new monitoring capability unclear for now. #### Other Developments Beyond the cybersecurity law, standing features of the Lao framework continue unaltered. The Ministry of Technology and Communications retains a dual role: it both sets and implements rules under the 2017 data-protection law and is also the body coordinating enforcement, with no structural separation between rule-setter, business-facilitator and enforcer. Analysis drawing on World Bank material frames this concentration as a structural weakness bearing on how effectively any obligation -- old or new -- can be independently enforced against regulated entities, including the state itself. #### Cross-Monitor Connections The Critical National Information Infrastructure designation is understood to reach the finance and banking sector specifically, a point of relevance to monitoring of financial-sector regulatory obligations; readers tracking financial-integrity developments in Laos should note that heightened security-measures duties may now attach to institutions in that sector under the new cybersecurity law, independent of any existing financial-regulatory requirements. #### Outlook The near-term question is less whether these obligations exist on paper than how they will be operationalised given the absence of an independent enforcer. Whether the National Cybersecurity Operations System becomes a functioning monitoring capability, and how its relationship to existing cyber-incident response arrangements is clarified, will shape how the designation and security-measures duties are felt in practice. Entities falling within the named critical-infrastructure sectors, including finance and banking, face the more immediate question of how the risk-assessment, encryption, access-screening, backup and system-monitoring duties under the new law are expected to interact with obligations already running under the 2017 data-protection law, given that neither instrument is positioned to override the other and no single body has been identified as responsible for resolving conflicts between them. 1 earlier update not shown here. ###### Standing brief · as of 22 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Laos is understood to have no independent data-protection authority, with the Ministry of Technology and Communications combining rule-setting, business-facilitation and enforcement functions under the electronic data protection law. This finding is carried forward this cycle at a corrected, more conservative confidence level following an internal review of single-source claims. #### Other Developments Several further findings from this cycle's baseline research into the Lao framework merit attention. Reports suggest the core statutory instrument's identity is itself contested, cited variously as Law No. 25/NA of 12 May 2017 or a presidential-decree Law No. 117/PO of 23 June 2017. The framework is understood to rely on consent as the near-exclusive lawful basis for processing, without purpose-limitation or data-minimisation safeguards. It is also understood to lack any defined special category of personal data, such as health, biometric or criminal-history information. Breach-type responsibilities are understood to fall on a 'data owner' concept rather than on a clearly identified controller or processor. This cycle's challenger review is understood to have reversed an earlier finding of a wholesale absence of data subject rights, with convergent secondary sourcing indicating that access, rectification, erasure and objection rights are granted under Law No. 25/NA. The framework is understood to lack a cross-border-transfer regime comparable to international good practice, with no identified adequacy decisions, standard contractual clauses or binding corporate rules. #### Cross-Monitor Connections Two sectoral overlays identified this cycle fall outside this monitor's remit. The Law on Anti-Money-Laundering and Counter-Financing of Terrorism (No. 50/NA) is understood to govern financial-sector data-sharing relevant to AML compliance, a dimension routed to the financial-integrity monitor. The Bank of Lao PDR is understood to oversee national payment-system regulation under the Law on Payment Systems, a dimension routed to the world-payments monitor. #### Outlook This is a first baseline cycle for Laos, and core statutory identity, effective dates and rights-enforcement mechanics all await primary-source verification before this framework can be assessed with higher confidence. Read full brief · 820 words ###### Latest update · 25 October 2026 #### Regulatory Status Laos now operates two parallel instruments touching personal and official data: the 2017 Law on Electronic Data Protection No. 25/NA, built around consent-based processing and overseen by the Ministry of Technology and Communications, and the newly in-force Law on Cybersecurity No. 87/NA, gazetted 20 March 2026 and understood to have taken effect from 1 September 2025. The ministry remains the sole body overseeing compliance and enforcement across the framework; Laos has no independent data-protection authority. The cybersecurity law introduces a Critical National Information Infrastructure designation covering named sectors including finance and banking, and imposes baseline security duties -- routine risk assessment, encryption, access screening and multi-location backup -- on all legal entities, with additional physical-access-control, system-monitoring and third-party-oversight duties on designated infrastructure operators. It also establishes a National Cybersecurity Operations System pairing personnel with big-data analytics and artificial intelligence for continuous monitoring and response, though the law is silent on whether that system is operational and how it relates to the country's existing computer emergency response arrangements. Separately, cross-border transfer of personal or official data out of Laos continues to require the consent of the Information Owner or Data Administrator under the 2017 law, and must not contravene Lao law or national interests. World Bank analysis has flagged that the Ministry of Technology and Communications' combined role as implementer and enforcer of the data-protection law leaves no structural separation between rule-setter, business-facilitator and enforcer, a concern that now extends to its administration of the cybersecurity law as well. #### Outlook The near-term trajectory is one of tightening: a second major instrument has entered into force layering security and monitoring duties onto an already consent-centric regime, without a reconciling authority or clarified operational scope for the new monitoring system. How the Critical National Information Infrastructure designation is applied in practice, particularly to finance and banking entities, and whether the National Cybersecurity Operations System becomes visibly active, are the two developments most likely to determine how this tightening is felt by regulated entities and individuals in Laos. ###### Standing brief · as of 22 September 2026 #### Regulatory Status Laos is understood to have no independent data-protection authority, with the Ministry of Technology and Communications combining rule-setting, business-facilitation and enforcement functions under the electronic data protection law. Reports suggest the instrument's identity remains contested, cited as either Law No. 25/NA of 12 May 2017 or a presidential-decree Law No. 117/PO of 23 June 2017, alongside an implementing Guideline No. 2128 of 2018. The Law on Electronic Data Protection No. 25/NA is understood to grant data subject rights including access, rectification, erasure and objection to processing, with portability and restriction additionally noted by a single secondary source; practical enforcement mechanisms and statutory response deadlines remain unclear. The framework is understood to lack a cross-border-transfer regime comparable to international good practice, with no identified adequacy decisions, standard contractual clauses or binding corporate rules. The Law on Anti-Money-Laundering and Counter-Financing of Terrorism (No. 50/NA) is understood to govern financial-sector data-sharing obligations relevant to AML compliance. #### Outlook As a first baseline cycle, Laos carries a HIGH risk rating pending primary-source verification of its core statutory instrument, effective dates, and rights-enforcement mechanics. Read full brief · 545 words Key regulatory facts for Laos Regulatory Dimension Laos Standing Position Jurisdiction Laos (LA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 73 sourced findings) Regulator & Framework No independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive. Lawful Processing & Special Data Absence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding. Data Subject Rights No sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted. Controller/Processor Duties Explicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure. Primary Instruments Cited World Bank, Council of Europe, Lao Trade Portal, Lao Trade Portal, Asia IP Law Last Confirmed / Updated 2026-11-04 (21 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Laos: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017), also cited as Law on Protection of Electronic Data No. 117/PO (23 June 2017), with implementing Guideline No. 2128 (2018) Supervisory authority [Ministry of Technology and Communications (MTC)](https://www.laotradeportal.gov.la/en-gb/site/display/1718) Traffic-light rationale — Red No independent regulator; core instrument identity/number is contested across otherwise authoritative sources; World Bank explicitly characterizes the framework as non-comprehensive. #### Sub-modules (5) #### Regulator And AuthorityRed MTC is the implementing ministry for electronic data protection; there is no independent DPA equivalent to GDPR-style supervisory authorities. Claims (6): - The Ministry of Technology and Communications is the implementing authority for Laos's electronic data protection law, and Laos has no independent data-protection authority separating rule-setting, business-facilitation and enforcement functions. - Ministry of Technology and Communications (MTC) is sole implementing and enforcing authority: MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists. - Ministry of Technology and Communications (MTC) — The Law on Electronic Data Protection, with no independent data-protection authority in Laos. - Ministry of Technology and Communications (MTC) — implements and enforces data protection law with no independent authority: true - Ministry of Technology and Communications (MTC) — MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists - Ministry of Technology and Communications (MTC) — MTC oversees compliance and enforcement of Law 25/NA; Laos has no independent data-protection authority. #### Act And InstrumentsAmber The core instrument is the Law on Electronic Data Protection, subject to a two-number discrepancy (No. 25/NA vs No. 117/PO) plus an implementing 2018 guideline. Claims (8): - The Law on the Protection of Electronic Data (No. 25/NA) was enacted in 2017. - A discrepancy exists across otherwise authoritative sources as to the instrument's reference number and date: National Assembly Law No. 25/NA dated 12 May 2017 (Lao Trade Portal, Council of Europe) versus presidential-decree No. 117/PO dated 23 June 2017 (World Bank), both apparently referring to the same underlying statute, alongside an implementing Guideline No. 2128 of 2018. - Law on Cybersecurity No. 87/NA was gazetted on: Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation. - Law on Cybersecurity No. 87/NA revises definition of: Revisits the definition of personal data to align it more closely with international standards. - Law on Electronic Data Protection No.25/NA — 12 May 2017, supplemented by a 2018 Implementing Guideline (No.2128). - Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026 and entered into force from 1 September 2025. - Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation - Law on Cybersecurity No. 87/NA — Revisits the definition of personal data to align it more closely with international standards #### Material ScopeAmber Scope extends to 'general' and 'specific' categories of electronic data across public and private sectors, broader than a narrow personal-data definition. Claims (3): - Laos's electronic data protection law is broader-than-typical in scope, covering 'general' and 'specific' electronic data rather than personal data alone. - Law on Electronic Data Protection No. 25/NA covers scope of: 'General' and 'specific' (sensitive) electronic data, broader than personal data alone. - Law on Electronic Data Protection No. 25/NA — 'General' and 'specific' (sensitive) electronic data, broader than personal data alone #### Territorial ScopeRed No explicit extraterritorial-application clause for non-established controllers was identified in available secondary sources. Claims (3): - Law on Electronic Data Protection No. 25/NA applies territorially to: Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence. - Law 25/NA — extends territorial scope to foreign entities without physical presence: true - Law on Electronic Data Protection No. 25/NA — Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence #### Regulator Registration And FilingRed No controller registration or filing regime with a data-protection authority was identified; MTC-administered licensing (e.g., software/internet-content-center licensing) exists for related ICT services but is not a DP filing obligation. Claims (1): - Related ICT-sector licensing (e.g., Software Business and Internet Content Center licensing under Decision No. 143/MPT) requires operators to respect and protect personal data of service users, including a general prohibition on disclosure except at the request of relevant government authorities, but this is a sector licensing condition rather than a DPA filing/registration regime. Laos has no independent data-protection authority. The Ministry of Technology and Communications (MTC) implements the Law on Electronic Data Protection, creating no separation between rule-setter, business-facilitator and enforcer. The primary instrument is variously cited as Law on Electronic Data Protection No. 25/NA (12 May 2017) per the Lao Trade Portal and Council of Europe, and as Law on Protection of Electronic Data No. 117/PO (23 June 2017) per the World Bank, with an implementing Guideline No. 2128 of 2018; both are treated as referring to the same underlying instrument pending clarification. The law covers both 'general' and 'specific' electronic data — a broader scope than typical personal-data statutes — but the World Bank's own assessment finds it falls short of a general-purpose, GDPR-comparable regime. Periodic update · new data 2026-11-04 #### Regulator & Framework Laos has no independent data-protection authority. The Ministry of Technology and Communications itself implements and coordinates enforcement of the country's electronic data protection law, a structure a 2022 World Bank assessment confirms remains the operative arrangement. The foundational instrument, the Law on Electronic Data Protection (No. 25/NA), was enacted on 12 May 2017 and continues to apply without a dedicated regulator sitting apart from the Ministry's general remit. Its territorial scope is understood to extend to foreign entities without a physical presence in Laos that engage in activities subject to the law's provisions, a reading corroborated across more than one secondary source. A new instrument layers onto this base: the Law on Cybersecurity (No. 87/NA), published in the Official Gazette on 20 March 2026, introduces a concept of Critical National Information Infrastructure spanning five designated sectors. This is a structural addition to the regulatory architecture rather than a replacement of the 2017 data-protection law, and it brings incident-reporting and infrastructure-protection obligations into the framework alongside the existing consent-centred data-protection regime. #### Outlook The absence of an independent supervisory authority remains the central structural feature of the Lao framework as at this record. The newly gazetted Cybersecurity Law adds a further compliance layer without resolving that gap, and a separate unresolved question records two differing official reference numbers for the 2017 statute itself, leaving which citation is operative unsettled. 2 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Laos's Law on Cybersecurity No. 87/NA was gazetted on 20 March 2026 and is understood to have entered into force from 1 September 2025. The Ministry of Technology and Communications oversees compliance and enforcement of the 2017 Law on Electronic Data Protection No. 25/NA, and Laos has no independent data-protection authority standing apart from the ministry itself. The arrival of the cybersecurity law changes the shape of the framework without replacing any part of it: the two instruments now stand side by side, the older one built around consent and the newer one built around security duties and a national monitoring capacity, with no single body named as responsible for reconciling them where they touch the same ground. World Bank analysis of Laos's digital readiness has identified the concentration of rule-setting, implementation and enforcement functions inside the same ministry as a structural weakness in how obligations of this kind can be made to bite. That finding predates the new cybersecurity law but applies with at least equal force to it, since the same ministry is positioned to administer both instruments. #### Outlook What remains open is whether the two instruments will be formally harmonised or left to operate in parallel, and whether the ministry's dual position as both implementer and enforcer will be revisited as the new law's obligations come into practical effect. Periodic update · new data 2026-10-11 #### Regulator & Framework Laos's data-protection and data-security architecture rests on two statutes whose relationship to one another is, as at this cycle, unresolved. The base instrument is the Law on Electronic Data Protection No. 25/NA, dated 12 May 2017, which covers both general electronic data and a specific category of sensitive data, a scope broader than personal data alone. Implementation and enforcement coordination for this law sits with the Ministry of Technology and Communications, which functions as the sole body with this role; Laos has no independent data protection authority, a fact confirmed by the World Bank's own 2022 digital-economy gap analysis of the country. Into this existing framework, the Lao Official Gazette published on 20 March 2026 a new Law on Cybersecurity, No. 87/NA. This is, per secondary legal commentary reviewed this cycle, the first Lao statute to define the terms "cybersecurity" and "critical national information infrastructure," positioning the law as part of the country's broader digital-transformation agenda. The same commentary states that the 2026 law also revisits the definition of personal data, in a manner intended to bring it more closely into line with international standards. What is not established by the sources reviewed is whether this revision amends the 2017 law's treatment of personal and sensitive data directly, whether the Cybersecurity Law operates as a free-standing parallel regime, or whether the two instruments are meant to be read together without either formally superseding the other. No primary gazette text establishing an explicit amendment, repeal, or consolidation relationship was retrieved this cycle, and this is recorded as an open gap rather than resolved by inference. This is a structural development rather than an incremental one: a second national statute now touches the definition of personal data and related obligations in a jurisdiction that previously had a single governing instrument on the subject. Until primary text resolving the relationship between the two laws becomes available, any assessment of Laos's data-protection perimeter must treat the 2017 law's definitions and the 2026 law's definitions as potentially divergent sources of obligation, administered by the same ministry but without a dedicated oversight body positioned to reconcile them. The absence of an independent regulator is itself a notable structural feature here: in jurisdictions with an active, independent supervisory authority, exactly this kind of definitional overlap between two statutes would typically be resolved or at least publicly flagged by that authority's own guidance. In Laos, no such clarifying voice exists, and the practical reading of the regime is left to secondary commentary from law firms and multilateral institutions rather than to the regulator itself. A secondary but related open question concerns the base law's own citation. Sources reviewed this cycle show a discrepancy between "Law on Electronic Data Protection No. 25/NA, 12 May 2017" and an alternative citation of "No. 117/PO, 23 June 2017" appearing elsewhere; this discrepancy was not resolved from the sources available and is carried forward as an open gap rather than silently reconciled. #### Outlook The question of how the Law on Cybersecurity No. 87/NA interacts with the Law on Electronic Data Protection No. 25/NA is the single most consequential open item for the Lao framework going into the next quarter. If, as stated in the Ministry's own regulatory horizon tracking, this relationship is clarified in the final quarter of 2026, it is likely to come either through an implementing decree under the new Cybersecurity Law or through further Ministry of Technology and Communications guidance. Until such clarification, any compliance assessment of Laos's data-protection regime should treat the two instruments as running in parallel, with the 2017 law's consent-centred processing rules and the 2026 law's security and critical-infrastructure provisions both potentially applicable. No change to the absence of an independent data protection authority has been identified, and the Ministry of Technology and Communications remains the sole implementing body for the foreseeable period covered by this cycle's research. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (21) - [World Bank](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — The Ministry of Technology and Communications is the implementing authority for Laos's electronic data protection law, and Laos has no independent data-protection authority separating rule-setting, business-facilitation and enforcement functions. - [Council of Europe](https://www.coe.int/en/web/octopus/-/lao-people-s-democratic-republic) — The Law on the Protection of Electronic Data (No. 25/NA) was enacted in 2017. - [Lao Trade Portal](https://www.laotradeportal.gov.la/en-gb/site/display/1718) — A discrepancy exists across otherwise authoritative sources as to the instrument's reference number and date: National Assembly Law No. 25/NA dated 12 May 2017 (Lao Trade Portal, Council of Europe) versus presidential-decree No. 117/PO dated 23 June 2017 (World Bank), both apparently referring to the same underlying statute, alongside an implementing Guideline No. 2128 of 2018. - [World Bank](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — Laos's electronic data protection law is broader-than-typical in scope, covering 'general' and 'specific' electronic data rather than personal data alone. - [Lao Trade Portal](https://www.laotradeportal.gov.la/en-gb/site/display/1159) — Related ICT-sector licensing (e.g., Software Business and Internet Content Center licensing under Decision No. 143/MPT) requires operators to respect and protect personal data of service users, including a general prohibition on disclosure except at the request of relevant government authorities, but this is a sector licensing condition rather than a DPA filing/registration regime. - [World Bank](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — Ministry of Technology and Communications (MTC) is sole implementing and enforcing authority: MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists. - [Asia IP Law](https://asiaiplaw.com/section/news-analysis/laos-publishes-new-law-on-cybersecurity) — Law on Cybersecurity No. 87/NA was gazetted on: Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation. - [iLaw Asia](https://ilawasia.com/blogs/laos-cybersecurity-law-a-pillar-of-digital-transformation) — Law on Cybersecurity No. 87/NA revises definition of: Revisits the definition of personal data to align it more closely with international standards. - [Lao Trade Portal](https://www.laotradeportal.gov.la/en-gb/site/display/1718) — Law on Electronic Data Protection No. 25/NA covers scope of: 'General' and 'specific' (sensitive) electronic data, broader than personal data alone. - [Digwatch](https://dig.watch/resource/laos-law-on-electronic-data-protection-no-25-na) — Law on Electronic Data Protection No. 25/NA applies territorially to: Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence. - [Lao Trade Portal](https://www.laotradeportal.gov.la/en-gb/site/display/1718) — Ministry of Technology and Communications (MTC) — The Law on Electronic Data Protection, with no independent data-protection authority in Laos. - [World Bank](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — Law on Electronic Data Protection No.25/NA — 12 May 2017, supplemented by a 2018 Implementing Guideline (No.2128). - [World Bank](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — Ministry of Technology and Communications (MTC) — implements and enforces data protection law with no independent authority: true - [CaseGuard](https://caseguard.com/articles/data-protection-in-laos-new-regulations-for-privacy/) — Law 25/NA — extends territorial scope to foreign entities without physical presence: true - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=breach-notification&c=LA) — Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026 and entered into force from 1 September 2025. - [https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf](https://thedocs.worldbank.org/en/doc/c01714a0bc2ca257bdfe8f3f75a64adc-0070062022/original/Positioning-The-Lao-PDR-for-a-Digital-Future-11-10-22.pdf) — Ministry of Technology and Communications (MTC) — MTC both implements and coordinates enforcement of the Law on Electronic Data Protection; no independent DPA exists - [Asia IP Law](https://asiaiplaw.com/section/news-analysis/laos-publishes-new-law-on-cybersecurity) — Law on Cybersecurity No. 87/NA — Published in the Lao Official Gazette on 20 March 2026, for the first time defining 'cybersecurity' and 'critical national information infrastructure' (CNII) in Lao legislation - [iLaw Asia](https://ilawasia.com/blogs/laos-cybersecurity-law-a-pillar-of-digital-transformation) — Law on Cybersecurity No. 87/NA — Revisits the definition of personal data to align it more closely with international standards - [https://www.laotradeportal.gov.la/en-gb/site/display/1718](https://www.laotradeportal.gov.la/en-gb/site/display/1718) — Law on Electronic Data Protection No. 25/NA — 'General' and 'specific' (sensitive) electronic data, broader than personal data alone - [Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Laos.aspx) — Law on Electronic Data Protection No. 25/NA — Domestic and foreign entities operating within Laos; does not extend on a pure targeting basis to entities with no Lao presence - [https://www.clym.io/regulations/e-data-protection-law-no-25na-laos](https://www.clym.io/regulations/e-data-protection-law-no-25na-laos) — Ministry of Technology and Communications (MTC) — MTC oversees compliance and enforcement of Law 25/NA; Laos has no independent data-protection authority. ### Laos: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Absence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017) Supervisory authority [Ministry of Technology and Communications (MTC)](https://www.laotradeportal.gov.la/en-gb/site/display/1718) Traffic-light rationale — Red Absence of special-category protections and of purpose-limitation/minimisation principles is an explicit, sourced gap finding. D2 · Lawful Processing — Full Module Record 4 sub-modules · 51 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017) Traffic-light rationale — Red No sourced evidence of an operative subject-rights regime; treated as an explicit gap rather than silently omitted. #### Sub-modules (5) #### Access RightRed No statutory subject-access-request mechanism identified. Claims (4): - Law on Electronic Data Protection No. 25/NA recognises rights of: Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text. - Law on Electronic Data Protection No.25/NA — Individuals may request access to, rectification of, and deletion of electronic data no longer necessary for its original purpose. - Individuals under Law 25/NA — have right to access personal data: true - Law on Electronic Data Protection No. 25/NA — Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text #### Rectification And ErasureRed No statutory right to rectification or erasure identified. #### Restriction And ObjectionRed No statutory restriction or objection right identified. #### Data PortabilityRed No portability right identified. #### Deadlines And Response WindowsRed No statutory controller response deadlines identified. No comprehensive, GDPR-analogue data-subject-rights framework (access, rectification/erasure, restriction/objection, portability, statutory response deadlines) was identified for Laos in available Tier-1/Tier-2 secondary sources. This is consistent with the World Bank's characterization of the statute as falling short of general-application data-protection good practice. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (4) - [Multilaw](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Laos.aspx) — Law on Electronic Data Protection No. 25/NA recognises rights of: Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text. - [Digwatch](https://dig.watch/resource/laos-law-on-electronic-data-protection-no-25-na) — Law on Electronic Data Protection No.25/NA — Individuals may request access to, rectification of, and deletion of electronic data no longer necessary for its original purpose. - [Digwatch](https://dig.watch/resource/laos-law-on-electronic-data-protection-no-25-na) — Individuals under Law 25/NA — have right to access personal data: true - [https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Laos.aspx](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Laos.aspx) — Law on Electronic Data Protection No. 25/NA — Access, rectification, erasure, portability and objection, per secondary commentary, without a statutory response deadline, extension test or fee rule located in primary text ### Laos: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Explicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017); Decision on Software and Data Center Business No. 143/MPT (2017) Supervisory authority [Ministry of Technology and Communications (MTC)](https://www.laotradeportal.gov.la/en-gb/site/display/1718) Traffic-light rationale — Red Explicit, sourced World Bank finding of misallocated breach responsibility and absent accountability infrastructure. Periodic update · new data 2026-10-25 #### Controller/Processor Duties The Law on Cybersecurity requires all legal entities to carry out routine risk assessments, apply data encryption, screen access and maintain multi-location data backup. Entities designated as Critical National Information Infrastructure across five named sectors face additional duties covering physical access control, system monitoring and oversight of third parties. These duties sit alongside, rather than inside, the obligations already running under the 2017 data-protection law, so an entity operating critical infrastructure in Laos is now working from two instruments rather than one. #### Outlook The practical weight of the new security-measures duties will depend on how the Critical National Information Infrastructure designation is applied sector by sector, and on what, if any, guidance follows to clarify how the screening, monitoring and backup requirements are to be evidenced. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Controllers and processors operating in Laos now face obligations drawn from at least three distinct sources, each with different scope, different triggers, and different consequences for non-compliance. The longest-standing of these is Article 26 of the Law on Electronic Data Protection No. 25/NA, which requires notification to LaoCERT in the event of an intrusion or electronic data breach. This notification duty is oriented primarily toward obtaining technical assistance rather than toward informing affected individuals; the law as reviewed does not establish a mandatory individual-notification duty, nor does it state a sanction for a failure to notify LaoCERT. Sitting alongside Article 26 is a sector-specific decree applicable to financial service providers, which requires those providers to notify affected customers immediately upon a breach and to report the breach to the Bank of the Lao PDR where it has an "important adverse impact" or is "large scale." Neither of these two qualifying terms is defined in the decree, and no sanction attaches to a failure to report. This leaves financial institutions operating under a notification duty whose triggering threshold is, in practical terms, a matter of judgment rather than a bright-line test, and whose enforceability is correspondingly uncertain. The most significant recent addition to this landscape is the Law on Cybersecurity No. 87/NA, gazetted 20 March 2026, which imposes duties of risk assessment, encryption, access screening, and multi-location backup on all legal entities, not merely financial-sector participants or entities handling sensitive data. This is a materially broader and more prescriptive set of security obligations than anything previously identified in the Lao framework, and it applies on a general basis rather than being confined to a particular sector or a particular category of data. Because the relationship between this new law and the 2017 base law remains unresolved in the sources reviewed, it is not yet clear whether these Cybersecurity Law duties operate as an overlay on top of the Article 26 breach-notification regime, replace it for certain categories of entity, or exist as a wholly separate compliance track. Two further duties are referenced only in secondary commentary and were not confirmed against primary legal text this cycle: an impact-assessment-like obligation for high-risk processing (without a located DPIA trigger list), and a requirement to maintain a team or employee supervising the protection of sensitive data, which falls well short of a GDPR-style Data Protection Officer in that it carries no defined duties, rights, scope, or registration requirement. Both of these should be treated as unconfirmed pending retrieval of primary text, rather than as settled features of the regime. Taken together, these developments point to an accountability framework that is accreting breadth, particularly through the new Cybersecurity Law's general security-measures duty, while remaining comparatively shallow in its enforcement architecture: none of the three notification-and-security regimes identified this cycle carries a clearly stated penalty for non-compliance, and the Ministry of Technology and Communications' role as sole implementing authority means there is no independent body positioned to issue clarifying guidance on how the regimes interact. #### Outlook Entities with a Lao presence should expect the practical compliance burden to increase as the Cybersecurity Law's risk-assessment, encryption, access-screening and backup duties come into effect across all legal entities, regardless of sector. Clarification of how this new general duty interacts with the sector-specific financial-services breach decree and with the narrower Article 26 LaoCERT notification channel is the key item to watch; absent such clarification, entities face the practical choice of complying with the most conservative reading across all three regimes. No change to the absence of a defined DPIA trigger list or to the under-specified sensitive-data-supervision role has been identified this cycle. D4 · Controller & Processor — Full Module Record 7 sub-modules · 64 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Sourced confirmation of absence of a clear transfer-mechanism regime, notwithstanding a general cross-border/encryption reference in the underlying law. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017) Supervisory authority [Ministry of Technology and Communications (MTC)](https://www.laotradeportal.gov.la/en-gb/site/display/1718) Traffic-light rationale — Red Sourced confirmation of absence of a clear transfer-mechanism regime, notwithstanding a general cross-border/encryption reference in the underlying law. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 56 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and telecoms sectoral instruments are sourced; health/employment/credit/education/insurance overlays are an explicit, sourced gap. Primary framework Law on Anti-Money Laundering and Counter-Financing of Terrorism No. 50/NA; Law on Payment Systems (2017); Law on Telecommunications (Amended) No. 09/NA (2021) Supervisory authority Bank of Lao PDR (BoL) / Telecommunications Regulatory Authority (TRA) Traffic-light rationale — Amber Financial and telecoms sectoral instruments are sourced; health/employment/credit/education/insurance overlays are an explicit, sourced gap. Periodic update · new data 2026-11-04 #### Sectoral Watch The Law on Cybersecurity (No. 87/NA), gazetted on 20 March 2026, designates finance and banking as one of five Critical National Information Infrastructure sectors, alongside national defence and public security, technology and communications, energy, and commerce, transport and logistics. This is a newly surfaced sectoral overlay: entities operating within the finance and banking sector now sit within a designated infrastructure-protection category under the Cybersecurity Law, layered on top of whatever obligations already attach to them under the 2017 electronic data protection framework. This development is distinct from, and additional to, the data-protection law's general consent-based processing rules; it is a national-security and infrastructure-resilience designation rather than a personal-data-specific obligation, though its reach into the finance and banking sector gives it direct relevance for any organisation processing personal data within that sector's systems. #### Outlook As at 20 March 2026, the finance-sector designation is in force under the Cybersecurity Law. No further sector-specific guidance or implementing regulation detailing the practical content of the finance-sector overlay has been located in this record. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 65 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Comprehensive absence of an adtech/commercial-privacy regime; explicit gap finding rather than silent omission. Traffic-light rationale — Red Comprehensive absence of an adtech/commercial-privacy regime; explicit gap finding rather than silent omission. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 27 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No profiling/ADM/biometric/genetic regime found; only a narrow, sourced state-surveillance carve-out exists, without independent oversight limits. Primary framework Law on Prevention and Combating Cyber Crime No. 61/NA (2015) Supervisory authority Ministry of Public Security / LaoCERT Traffic-light rationale — Red No profiling/ADM/biometric/genetic regime found; only a narrow, sourced state-surveillance carve-out exists, without independent oversight limits. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The Law on Cybersecurity establishes a National Cybersecurity Operations System combining expert personnel with big-data analytics and artificial intelligence, intended to provide continuous, round-the-clock monitoring and response. The law does not state whether the system is already operational, and its relationship to the country's existing computer emergency response function is not addressed in the text. This is the first instrument in Laos to place artificial intelligence and large-scale data analytics explicitly inside a state monitoring function, rather than leaving such activity to unwritten practice. #### Outlook Whether the monitoring system becomes operationally distinct from, or absorbed into, existing incident-response arrangements will determine how visible its activity becomes to entities and individuals affected by it. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 66 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Laos: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ Comprehensive absence of a children/vulnerable-groups data protection regime; explicit gap finding. Traffic-light rationale — Not assessed Comprehensive absence of a children/vulnerable-groups data protection regime; explicit gap finding. #### Sub-modules (5) #### Age VerificationRed No age-verification requirement identified. #### Parental ConsentRed No parental-consent mechanism identified. #### Minor Profiling BansRed No minor-profiling ban identified. #### Education SettingsRed No education-settings-specific data rule identified. #### Dependent AdultsRed No dependent-adults data protection provision identified. No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection specific to electronic/personal data processing was identified for Laos in available secondary sources. ### Laos: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No independent enforcement body, no sourced penalty/redress framework, and no recent developments identified — an explicit, sourced gap. Primary framework Law on Electronic Data Protection No. 25/NA (12 May 2017) / No. 117/PO (23 June 2017) Supervisory authority [Ministry of Technology and Communications (MTC)](https://www.laotradeportal.gov.la/en-gb/site/display/1718) Traffic-light rationale — Red No independent enforcement body, no sourced penalty/redress framework, and no recent developments identified — an explicit, sourced gap. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 69 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (43 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties