Bavarian Data Protection Act (BayDSG) of 15 May 2018 (only available in German) | | Data Protection Authority of Bavaria for the Private Sector ('BayLDA') |
Berlin Data Protection Act ('BlnDSG') of 13 June 2018 (only available in German) | | Berlin data protection authority ('Berlin Commissioner') |
Brandenburg Data Protection Act ('BbgDSG') of 8 May 2018 (only available in German) | | State Commissioner for Data Protection and Access to Information Brandenburg ('Brandenburg LDA') |
Bremen Implementation Act to the EU General Data Protection Regulation (BremDSGVOAG) of 8 May 2018 (only available in German) | | Bremen data protection authority ('the Bremen Commissioner') |
Data Protection Law North Rhine-Westphalia (DSG NRW) 2018 (only available in German) | | North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information ('LDI NRW') |
Federal Data Protection Act of 30 June 2017 (implementing the GDPR) | | The Federal Commissioner for Data Protection and Freedom of Information ('BfDI') |
Freedom of Information Act 1992 (No. 76 of 1992) | | Office of the Information Commissioner ('OIC') |
Hamburg Data Protection Act (HmbDSG) of 18 May 2018 (only available in German) | | The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI') |
Hessian Data Protection and Freedom of Information Act (HDSIG) of 3 May 2018 (only available in German) | | Hessen data protection authority ('HBDI') |
Information Privacy Act 2009 | | Office of the Information Commissioner ('OIC') |
Information Privacy Principles Instruction No. 1 of 1989 | | Privacy Committee of South Australia ('PCA') |
Law for the Protection of Personal Data of Citizens (Data Protection Act Saxony-Anhalt - DSG LSA) of 12 March 1992 (GVBl. P. 152) (only available in German) | | Sachsen-Anhalt data protection authority ('LfD Sachsen-Anhalt') |
Lower Saxony Data Protection Act (NDSG) of 16 May 2018 (only available in German) | | Lower Saxony data protection authority ('LfD Niedersachsen') |
Personal Information Protection Act 2004 | | The Office of the Ombudsman ('the Ombudsman') |
Privacy and Data Protection Act 2014 (No. 60 of 2014) | | The Office of the Victorian Information Commissioner ('OVIC') |
Privacy and Personal Information Protection Act 1998 No. 133 | | Information and Privacy Commission ('IPC') |
Saarland Data Protection Act ('SDSG') of 16 May 2018 (only available in German) | | Saarland data protection authority |
Saxon Data Protection Act (SächsDSG) of 25 August 2003, as amended to implement the GDPR (only available in German) | | Saxon data protection authority ('SächsDSB') |
Schleswig-Holstein Law for the Protection of Personal Data (LDSG) of 2 May 2018 (only available in German) | | Schleswig-Holstein data protection authority ('ULD') |
State Data Protection Act (DSG M-V) of 22 May 2018 (only available in German) | | Mecklenburg-Vorpommern data protection authority |
State Data Protection Act (LDSG) of 8 May 2018 (only available in German) | | Rhineland-Palatinate data protection authority ('LfDI Rheinland-Pfalz') |
Thuringian Data Protection and Implementation Act ('ThürDSAnpUG-EU') of 6 June 2018 (only available in German) | | Thuringian data protection authority ('TLfDI') |
Data Protection (Amendment) Regulations 2018 | Abu Dhabi Global Market | ADGM Registration Authority and the Board of Directors of the ADGM |
Data Protection Regulations 2015 | Abu Dhabi Global Market | Office of Data Protection |
Data Protection Regulations 2021 | Abu Dhabi Global Market | Office of Data Protection |
Law on the Protection of Personal Data No. 9887 of 10 March 2008 (as amended) | Albania | Information and Data Protection Commissioner ('IDP') |
Personal Information Protection Act, SA 2003 c P-6.5 | Alberta | Office of the Information and Privacy Commissioner of Alberta ('OIPC') |
Law No. 18-07 of 25 Ramadhan 1439 Corresponding to June 10, 2018 Relating to the Protection of Individuals in the Processing of Personal Data (only available in French) | Algeria | The Law provides that an independent Algerian data protection authority is established within the office of the President of the Republic of Algeria |
Qualified Act 15/2003, of 18 December, of Personal Data Protection | Andorra | Andorran data protection authority ('APDA') |
Law No. 22/11 on the Protection of Personal Data (only available in Portuguese) | Angola | The Ministry of Telecommunications and Information Technology ('MTTI') announced, on 9 October 2019, that the National Database Protection Agency ('APD') had become operational. |
Data Protection Act, 2013 | Antigua and Barbuda | Information Commissioner |
Decree No. 25.326 (only available in Spanish) | Argentina | Argentinian data protection authority ('AAIP') |
Personal Data Protection Act, Act No. 25.326 of 2000 | Argentina | Argentinian data protection authority ('AAIP') |
Law of the Republic of Armenia of 13 June 2015 No. 49-ZR on the Protection of Personal Data | Armenia | Personal Data Protection Agency |
National Ordinance of May 19, 2011 Laying Down New Rules for the Protection of Privacy in Connection with the Recording and Dissemination of Personal Data (only available in Dutch) | Aruba | The Ordinance does not create a regulatory authority. |
Privacy Act 1988 | Australia - Federal | The Office of the Australian Information Commissioner ('OAIC') |
Information Privacy Act 2014 | Australian Capital Territory | The Office of the Australian Information Commissioner ('OAIC') |
Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (Data Protection Act (DSG) BGBI. I No. 165/1999) (last amended in 2019) | Austria | Austrian data protection authority ('DSB') |
Law of 11 May 2010 No. 998-IIIQ on Personal Data (only available in Azerbaijani) | Azerbaijan | Ministry of Transport, Communications and High Technologies |
Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese) | Azores | Portuguese data protection authority ('CNPD') |
State Data Protection Act (LDSG) 2018 (only available in German) | Baden-Württemberg | Baden-Württemberg data protection authority ('LfDI Baden-Württemberg') |
Data Protection (Privacy of Personal Information) Act 2003 | Bahamas | The Data Protection Commissioner |
Law No. (30) of the Year 2018 Issuing a Law on the Protection of Personal Data (only available in Arabic) | Bahrain | Ministry of Justice and Islamic Affairs ('MoJ') |
Data Protection Bill 2019 | Barbados | Data Protection Commissioner (not yet operational) |
Law of 10 November 2008 No. 455-Z on Information, Informatization and Data Protection | Belarus | There is no specific state regulator for data protection in Belarus. General governance in the sphere of information protection is performed by the President of the Republic of Belarus and the Council of Ministers of the Republic of Belarus. |
Law on Personal Data (only available in Russian) | Belarus | Data Protection Commission (not yet operational) |
Act of 3 December 2017 Establishing the Data Protection Authority | Belgium | Data Protection Authority ('Belgian DPA') |
Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data | Belgium | Data Protection Authority ('Belgian DPA') |
Law No. 2009-09 of May 22, 2009 Dealing with the Protection of Personally Identifiable Information | Benin | Beninese data protection authority ('APDP') |
Personal Information Protection Act 2016 | Bermuda | Privacy Commissioner |
Act of May 17, 2010 Containing Rules on the Protection of Personal Data of Bonaire, Sint Eustatius and Saba (only available in Dutch) | BES Islands | Commission for the Supervision of Data Protection BES ('CBP BES') |
Information Communications and Media Act of Bhutan 2018 | Bhutan | No Data Protection Authority has been established |
Draft Citizen Law of Privacy and Data Protection in Bolivia (only available in Spanish) | Bolivia | Electronic Government Agency and Information and Communication Technologies ('AGETIC') |
Law on the Protection of Personal Data No. 49/06 | Bosnia & Herzegovina | Agency for Personal Data Protection in Bosnia and Herzegovina ('AZLP') |
Data Protection Act, 2018 | Botswana | The Information and Data Protection Commission |
Law No. 12.965 of 23 April 2014 Marco Civil da Internet (only available in Portuguese) | Brazil | The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette. |
Law No. 13.709 of 14 August 2018, General Personal Data Protection Law ('LGPD') | Brazil | The structure of the Brazilian data protection authority ('ANPD') was created by Presidential Decree No. 10,474 of 26 August 2020 (only available in Portuguese here) ('the Decree'). The Decree will come into force on the date of publication of the appointment of the ANPD's executive director in the Federal Official Gazette. |
Personal Information Protection Act, SBC 2003 c 63 | British Columbia | Office of the Information and Privacy Commissioner for British Columbia ('OIPC') |
Protection of Personal Data Act 2002 (last amended in 2019) | Bulgaria | Commission for Personal Data Protection ('CPDP') |
Law No. 010-2004/AN on the Protection of Personal Data (only available in French) | Burkina Faso | Burkina Faso data protection authority ('CIL') |
California Consumer Privacy Act of 2018 ('CCPA') | California | California Attorney General ('AG') |
California Privacy Rights Act of 2020 ('CPRA') | California | The California Privacy Protection Agency has not yet been established. |
Bill C-11 for An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts | Canada Federal | Office of the Privacy Commissioner of Canada ('OPC') |
Personal Information Protection and Electronic Documents Act 2000 | Canada Federal | Office of the Privacy Commissioner of Canada ('OPC') |
Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish) | Canary Islands | Spanish data protection authority ('AEPD') |
Law 133-V-2001 on the Protection of Personal Data | Cape Verde | National Commission of Data Protection ('CNPD') |
The Data Protection Law, 2017 (Law 33 of 2017) | Cayman Islands | Office of the Ombudsman |
The Data Protection Regulations, 2018 (SL 17 of 2019) | Cayman Islands | Office of the Ombudsman |
Law No. 007/PR/2015 on the Protection of Personal Data (only available in French) | Chad | Agence Nationale de Sécurité Informatique et de Certification Électronique ('ANSICE') |
Bill No. 11144-07 Regulating the Processing and Protection of Personal Data and Creating the Personal Data Protection Authority (only available in Spanish) | Chile | Chilean Transparency Council ('CPLT') |
Law No. 19.628 on the Protection of Private Life 1999 (only available in Spanish) | Chile | Chilean Transparency Council ('CPLT') |
Cybersecurity Law 2016 | China - Federal | Regulators include the Ministry of Industry and Information Technology ('MIIT') and the Cyberspace Administration of China ('CAC') |
Data Security Law | China - Federal | No Data Protection Authority has been established |
Personal Information Protection Law of the People's Republic of China | China - Federal | The Cyberspace Administration of China ('CAC') |
Shenzhen Special Economic Zone Data Interim Regulation (Draft) (only available in Chinese) | China - Federal | No Data Protection Authority has been established |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Collectivity of Saint Martin | French data protection authority ('CNIL') |
Decree 1377 of 2013 (June 27) Which Partially Regulates Law 1581 of 2012 (only available in Spanish) | Colombia | Colombian data protection authority ('SIC') |
Statutory Law 1581 of 2012 (October 17) Which Issues General Provisions for the Protection of Personal Data (only available in Spanish) | Colombia | Colombian data protection authority ('SIC') |
Senate Bill 21-190 for the Colorado Privacy Act ('CPA') | Colorado | Attorney General of Colorado ('AG') |
Law 29-2019 on the Protection of Personal Data | Congo | The Law provides that the Commission responsible for the protection of personal data will be established by a law of the Republic of Congo in order to ensure the compliance with the Law. |
Connecticut Act Concerning Personal Data Privacy and Online Monitoring | Connecticut | Connecticut Attorney General |
Executive Decree No. 37554-JP of 30 October 2012 Regulating Law No. 8968 (only available in Spanish) | Costa Rica | There is no general data protection authority, however the Dominican Telecommunications Institute ('INDOTEL') oversees certain matters such as data breach reporting |
Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 of 2011 (only available in Spanish) | Costa Rica | Costa Rican data protection authority ('PRODHAB') |
Law on the Implementation of the General Data Protection Regulation 2018 (only available in Croatian) | Croatia | Personal Data Protection Agency ('AZOP') |
Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Data Protection Ordinance) (only available in Dutch) | Curaçao | The Data Protection Board (not yet operational) |
Law 125(I) of 2018 Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data | Cyprus | Office of the Commissioner for Personal Data Protection ('the Commissioner') |
Act No. 110/2019 Coll. on Personal Data Processing | Czechia | Office for Personal Data Protection ('UOOU') |
Act No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Data Protection Act) | Denmark | Danish data protection authority ('Datatilsynet') |
Law No. 172-13 on the Comprehensive Protection of Personal Data Contained in Archives, Public Registries, Databases or Other Technical Means of Data Processing Used for Reporting, Whether Public or Private 2013 (only available in Spanish) | Dominican Republic | There is no general data protection regulator |
Data Protection Regulations 2020 | Dubai International Financial Centre | The Commissioner of Data Protection |
DIFC Data Protection Law No. 5 of 2020 | Dubai International Financial Centre | The Commissioner of Data Protection |
Organic Law on the Protection of Personal Data (only available in Spanish) | Ecuador | National Directorate of the Public Data Registry ('DINARDAP') |
Resolution No. 151 of 2020 approving the Law on the Protection of Personal Data (only available in Arabic) | Egypt | Governing Body for the Protection of Personal Data (not yet operational) |
Consumer Protection Law as amended in 2018 (only available in Spanish) | El Salvador | A regulator has not yet been established |
Law No. 1/2.016 of 22 July on Personal Data Protection Equatorial Guinea | Equatorial Guinea | Organo Rector de Proteccion de Datos Personales (not yet operational) |
Personal Data Protection Act 2018 | Estonia | Data Protection Inspectorate ('DPI') |
The Data Protection Act, 2022 | Eswatini | Eswatini Electronic Communications Commission |
Directive on Privacy and Electronic Communications (2002/58/EC) (as amended) ('ePrivacy Directive') | EU | European Data Protection Supervisor ('EDPS') |
Directive on Security Network and Information Systems (Directive (EU) 2016/1148) ('NIS Directive') | EU | National Member State supervisory authorities |
General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) | EU | European Data Protection Board ('EDPB') |
Proposed Regulation on Privacy and Electronic Communications (2017/0003 (COD)) (10 January 2017) | EU | National Member State supervisory authorities |
Data Protection Act (1050/2018) | Finland | Office of the Data Protection Ombudsman ('the Ombudsman') |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | France | French data protection authority ('CNIL') |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties | French Polynesia | French data protection authority ('CNIL') |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties | French Southern and Antarctic Lands | French data protection authority ('CNIL') |
Law No. 001/2011 on the Protection of Personal Data (only available in French) | Gabon | Gabon data protection authority ('CNPDCP') |
Law of Georgia on Personal Data Protection of 28 December 2011 No. 5669 | Georgia | Office of the Personal Data Protection Inspector ('PDP') |
Data Protection Act, 2012 | Ghana | The Data Protection Commission |
Data Protection Act 2004 (as amended in 2018) | Gibraltar | The Gibraltar Regulatory Authority ('GRA') |
Law 3471/2006 on the Protection of Personal Data and Privacy in the Electronic Telecommunications Sector and Amendment of Law 2472/1997 | Greece | The Hellenic Data Protection Authority ('HDPA') |
Law No. 4624/2019 on the Personal Data Protection Authority, Implementing the GDPR and Transposing into National Law Data Protection Directive with Respect to Law Enforcement and Other Provisions | Greece | The Hellenic Data Protection Authority ('HDPA') |
Personal Data Protection Act 2016 (only available in Danish) | Greenland | Danish data protection authority ('Datatilsynet') |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Guadeloupe | French data protection authority ('CNIL') |
Bill No. 4090 of 20 August 2009 for the Approval of the of the Personal Data Protection Law (only available in Spanish) | Guatemala | A regulator has not yet been established |
The Data Protection (Bailiwick of Guernsey) Law, 2017 | Guernsey | The Office of the Data Protection Authority ('ODPA') |
The Data Protection (Commencement, Amendment and Transitional) (Bailiwick of Guernsey) Ordinance, 2018 | Guernsey | The Office of the Data Protection Authority ('ODPA') |
Law L-2016-037-AN Relating to Cybersecurity and the Protection of Personal Data (only available in French) | Guinea | The Personal Data Protection Authority has not yet been established |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Guyana | French data protection authority ('CNIL') |
Draft Law on the Protection of Personal Data (only available in Spanish) | Honduras | There is no general data protection regulator |
The Personal Data (Privacy) Ordinance | Hong Kong | Office of the Privacy Commissioner for Personal Data ('PCPD') |
Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information as amended by Act XXXVIII of 2018 | Hungary | National Authority for Data Protection and Freedom of Information ('NAIH') |
Act 90/2018 on Privacy and Processing of Personal Data | Iceland | Icelandic data protection authority ('Persónuvernd') |
The Personal Data Protection Bill, 2019 | India | Data Protection Commission (not yet operational) |
Draft Personal Data Protection Bill (only available in Indonesian) | Indonesia | Data Protection Commission (not yet operational) |
Draft Protection of Personal Data Law (only available in Persian) | Iran | The Ministry of Communications and Information Technology ('MICEX') |
Data Protection Act 2018 | Ireland | Data Protection Commission ('DPC') |
Data Protection (Application of the GDPR) Order 2018 | Isle of Man | Information Commissioner ('the Commissioner') |
Data Protection Act 2018 | Isle of Man | Information Commissioner ('the Commissioner') |
The GDPR and LED Implementing (Amendment) Regulations 2018 | Isle of Man | Information Commissioner |
The GDPR and LED Implementing Regulations 2018 | Isle of Man | Information Commissioner |
Protection of Privacy Law, 5741 - 1981 (unofficial translation) | Israel | Privacy Protection Authority ('PPA') |
Protection of Privacy Regulations (Data Security) 5777-2017 | Israel | Privacy Protection Authority ('PPA') |
Personal Data Protection Code, Legislative Decree No. 196/2003 | Italy | Italian data protection authority ('Garante') |
Law 2013-450 on the Protection of Personal Data | Ivory Coast | The Telecommunications/ICT Regulatory Authority of Côte d'Ivoire ('ARTCI') |
Draft Data Protection Act | Jamaica | Jamaica Information Commissioner (not yet operational) |
Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2016) | Japan | Personal Information Protection Commission ('PPC') |
Data Protection (Jersey) Law 2018 | Jersey | Jersey Office of the Information Commissioner ('JOIC') |
Data Protection Authority (Jersey) Law 2018 | Jersey | Jersey Office of the Information Commissioner ('JOIC') |
Law of the Republic of Kazakhstan of 21 May 2013 No. 94-V on Personal Data and its Protection | Kazakhstan | The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data. |
Law on Amendments and Additions to Some Legislative Acts of the Republic of Kazakhstan on the Regulation of Digital Technologies (only available in Kazakh) | Kazakhstan | The Government of the Republic of Kazakhstan and state bodies, notably the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan, have specific competence in the area of personal data. |
The Data Protection Act, 2019 | Kenya | Data Protection Commissioner (not yet operational) |
Law No. 06/L-082 on Personal Data Protection | Kosovo | Information and Privacy Agency ('AIP') |
Law of the Kyrgyz Republic of 14 April 2008 No. 58 on Personal Information as amended by the Law of the Kyrgyz Republic of 20 July 2017 No. 129 (only available in Russian) | Kyrgyzstan | There is no specific regulator. |
Law on Electronic Data Protection 25/NA, Date 12 May 2017 | Lao PDR | Data Protection Commission (not yet operational) |
Personal Data Processing Law of 21 June 2018 | Latvia | Data State Inspectorate ('DVI') |
Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data (only available in Arabic) | Lebanon | There is no general data protection authority, the Ministry of Economy and Trade handles data processing registration/notification. |
Data Protection Act, 2011 | Lesotho | The Data Protection Commission (not yet operational) |
Data Protection Act (DSG) of 4 October 2018 (only available in German) | Liechtenstein | Liechtensteiner data protection authority ('DSS') |
Data Protection Ordinance (DSV) of 11 December 2018 (only available in German) | Liechtenstein | Liechtensteiner data protection authority ('DSS') |
Law No XIII-1426 of 30 June 2018 amending Law No I-1374 (only available in Lithuanian) | Lithuania | State Data Protection Inspectorate ('VDAI') |
Act of 1 August 2018 on the Organisation of the National Commission for Data Protection and Implementing the GDPR | Luxembourg | National Commission for Data Protection ('CNPD') |
Personal Data Protection Act (Act 8/2005) | Macau | Office for Personal Data Protection ('GPDP') |
Law No 2014 - 038 on the Protection of Personal Data (only available in French) | Madagascar | Madagascan information commission ('CMIL') (not yet operational) |
Personal Data Protection Act 2010 | Malaysia | Department of Personal Data Protection ('PDP') |
Right to Information Act 2014 | Maldives | No Data Protection Authority has been established |
Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali (only available in French) | Mali | Malian data protection authority ('APDP') |
Data Protection Act (Act XX 2018) | Malta | Office of the Information and Data Protection Commissioner ('IDPC') |
The Personal Information Protection and Identity Theft Prevention Act, CCSM c P33.7 | Manitoba | Manitoba Ombudsman |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Martinique | French data protection authority ('CNIL') |
Draft Law No. 2017 - 020 on the protection of the personal data (only available in French) | Mauritania | Personal Data Protection Authority (not yet operational) |
The Data Protection Act 2017 | Mauritius | Data Protection Office |
Federal Law on the Protection of Personal Data Held by Private Parties 2010 | Mexico | National Institute for Access to Information and Protection of Personal Data ('INAI') |
Regulations to the Federal Law on Protection of Personal Data Held by Private Parties | Mexico | National Institute for Access to Information and Protection of Personal Data ('INAI') |
Law of 8 July 2011 No. 133 on Personal Data Protection (only available in Romanian) | Moldova | National Centre for Personal Data Protection ('NCPDP') |
Act No. 1.165 on the Protection of Personal Data (23 December 1993) | Monaco | Monegasque data protection authority ('CCIN') |
Law of Mongolia on Personal Secrets 1995 (only available in Mongolian) | Mongolia | No Data Protection Authority has been established |
Personal Data Protection Law 79/08 and 70/09 | Montenegro | Agency for Personal Data Protection and Free Access to Information ('AZLP') |
Law No. 09-08 on the Protection of Individuals with Regard to Processing of Personal Data (only available in French) | Morocco | Moroccan data protection authority ('CNDP') |
Law Protecting the Privacy and Security of Citizens (Union Parliament Law 5/2017) 8 March 2017 | Myanmar | No Data Protection Authority has been established |
Individual Privacy Act 2075 (2018) | Nepal | No Data Protection Authority has been established |
Act Implementing the General Data Protection Regulation | Netherlands | Dutch data protection authority ('AP') |
Right to Information and Protection of Privacy Act, SNB 2009 c R-10.6 | New Brunswick | Office of the Ombud for New Brunswick |
Privacy Act 1993 | New Zealand | The Office of the Privacy Commissioner ('OPC') |
Privacy Act 2020 | New Zealand | The Office of the Privacy Commissioner ('OPC') |
Access to Information and Protection of Privacy Act, SNL 2015 c A-1.2 | Newfoundland and Labrador | Office of the Information and Privacy Commissioner for Newfoundland and Labrador |
Law on Personal Data Protection No. 787 of 21 March 2012 (only available in Spanish) | Nicaragua | The Nicaraguan data protection authority ('DIPRODAP') (not yet operational) |
Regulation of Law No. 787, Decree No. 36-2012 of 17 October 2012 (only available in Spanish) | Nicaragua | The Nicaraguan data protection authority ('DIPRODAP') (not yet operational) |
Law No 2017-28 of 3 May 2017 (only available in French) | Niger | The Data Protection Authority (not yet operational) |
Draft Data Protection Bill 2020 | Nigeria | The bill would establish a new regulatory authority. |
Nigeria Data Protection Regulation 2019 | Nigeria | National Information Technology Development Agency ('NITDA') |
Law on Personal Data Protection 2005, as amended (only available in Macedonian) | North Macedonia | Personal Data Protection Agency ('DZLP') |
Information Act 2002 | Northern Territory | Office of the Information Commissioner Northern Territory ('OICNT') |
Access to Information and Protection of Privacy Act, SNWT 1994 c 20 | Northwest Territories | Office of the Information and Privacy Commissioner Northwest Territories ('OIPC') |
Law on the Processing of Personal Data (Personal Data Act) of 15 June 2018 (only available in Norwegian) | Norway | Norwegian data protection authority ('Datatilsynet') |
Freedom of Information and Protection of Privacy Act, SNS 1993 c 5 | Nova Scotia | Office of the Information and Privacy Commissioner of Nova Scotia ('OIPC') |
Access to Information and Protection of Privacy Act, SNWT (Nu) 1994 c 20 | Nunavut | Office of the Nunavut Information and Privacy Commissioner ('OIPC') |
Royal Decree No. 6 of 2022 promulgating the law on the protection of personal data dated 9 February 2022 ('the Law') (only available in Arabic) | Oman | The Ministry of Transport, Communications and Information Technology ('MTCI') |
Freedom of Information and Protection of Privacy Act, RSO 1990 c F.31 | Ontario | Information and Privacy Commissioner of Ontario |
Personal Data Protection Bill 2021 | Pakistan | Data Protection Commission (not yet operational) |
Law No. 81 on Personal Data Protection 2019 (only available in Spanish) | Panama | National Authority for Transparency and Access to Information ('ANTAI') |
Law No. 1682 Which Regulates Private Information 2001 (only available in Spanish) | Paraguay | Consumer Protection Secretariat (not yet operational) |
Law No. 1969 of 2002 (only available in spanish) | Paraguay | Consumer Protection Secretariat (not yet operational) |
Law No. 5543 of 2015 (only available in Spanish) | Paraguay | Consumer Protection Secretariat (not yet operational) |
Law No. 29.733 on the Protection of Personal Data 2011 (only available in Spanish) | Peru | National Authority for the Protection of Personal Data ('ANPD') |
Supreme Decree No. 003-2013-JUS which Approves the Regulation of Law No. 29733 (only available in Spanish) | Peru | National Authority for the Protection of Personal Data ('ANPD') |
The Data Privacy Act of 2012 (Republic Act No. 10173) | Philippines | National Privacy Commission ('NPC') |
Act of 10 May 2018 on the Protection of Personal Data | Poland | Polish data protection authority ('UODO') |
Law No. 58/2019, which Ensures the Implementation in the National Legal Order of the GDPR on the Protection of Individuals with Regards the Processing of Personal Data and the Free Movement of Such Data (only available in Portuguese) | Portugal | Portuguese data protection authority ('CNPD') |
Freedom of Information and Protection of Privacy Act, RSPEI 1988 c F-15.01 | Prince Edward Island | Information and Privacy Commissioner of Prince Edward Island ('IPC') |
Law No. 13 of 2016 Concerning Privacy and Protection of Personal Data (only available in Arabic) | Qatar | Ministry of Transport and Communications |
Data Protection Rules 2005 | Qatar Financial Centre | Qatar Financial Centre Authority ('QFC Regulatory Authority') |
QFC Data Protection Regulations 2005 | Qatar Financial Centre | Qatar Financial Centre Authority |
Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1 | Quebec | Quebec Commission on Access to Information ('CAI') |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties | Réunion | French data protection authority ('CNIL') |
Law No. 190 of 18 July 2018 on the Implementation of the General Data Protection Regulation (Regulation (EU) 2016/679) | Romania | National Supervisory Authority for Personal Data Processing ('ANSPDCP') |
Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) | Russia | The Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor') |
Law No. 058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy | Rwanda | The National Cyber Security Authority |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Saint Barthélemy | French data protection authority ('CNIL') |
Data Protection Act, 2018 | Saint Kitts and Nevis | Information Commissioner (not yet operational) |
Data Protection (Amendment) Act 2014 | Saint Lucia | Data Protection Commissioner (not yet operational) |
Data Protection Act 2011 | Saint Lucia | Data Protection Commissioner (not yet operational) |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (as amended to implement the GDPR) | Saint Pierre and Miquelon | French data protection authority ('CNIL') |
Law 21 December 2018 No. 171, Protection of Individuals with Regard to the Processing of Personal Data | San Marino | Guarantor for the Protection of Personal Data ('Guarantor') |
Law No. 03/2016 on the Protection of Personal Data | São Tomé and Príncipe | National Data Protection Agency ('ANPDP') |
The Freedom of Information and Protection of Privacy Act, SS 1990-91 c F-22.01 | Saskatchewan | The Office of the Saskatchewan Information and Privacy Commissioner ('OIPC') |
Personal Data Protection Law 2021 (only available in Arabic) | Saudi Arabia | Saudi Data & Artificial Intelligence Authority ('SDAIA') |
Law No 2008-12 of January 25th 2008 Concerning the Personal Data Protection | Senegal | The Senegalese data protection authority ('CDP') |
Law on Protection of Personal Data 2018 (Official Gazette of the Republic of Serbia, No. 87/2018) (only available to download in Serbian) | Serbia | Commissioner for Information of Public Importance and Personal Data Protection ('Poverenik') |
Personal Data Protection (Amendment) Bill 2020 | Singapore | Personal Data Protection Commission ('PDPC') |
Personal Data Protection Act 2012 (No. 26 of 2012) | Singapore | Personal Data Protection Commission ('PDPC') |
National Ordinance on Personal Data Protection 2010 | Sint Maarten | Commission for the Supervision of Data Protection (not yet operational) |
Act No. 18/2018 Coll. on Protection of Personal Data and on Amendments to certain Acts | Slovakia | Office for Personal Data Protection of the Slovak Republic ('ÚOOÚ') |
Draft Personal Data Protection Act (only available in Slovene) | Slovenia | Information Commissioner ('the Commissioner') |
Personal Data Protection Act 2004 | Slovenia | Information Commissioner ('the Commissioner') |
Law No. 005 the Data Protection Act | Somalia | Data Protection Authority |
Protection of Personal Information Act, 2013 (Act 4 of 2013) | South Africa | The Information Regulator |
Personal Information Protection Act 2011 (as amended in 2020) | South Korea | Personal Information Protection Commission ('PIPC') |
Organic Law 3/2018, of 5 December 2018, on the Protection of Personal Data and Guarantee of Digital Rights (only available in Spanish) | Spain | Spanish data protection authority ('AEPD') |
Personal Data Protection Act, No. 9 of 2022 ('PDPA') | Sri Lanka | The Data Protection Authority of Sri Lanka (not yet operational) |
Law 2018:218 with Additional Provisions to the General Data Protection Regulation | Sweden | Swedish data protection authority ('Datainspektionen') |
Ordinance with Supplementary Provisions to the GDPR (SFS 2018:219) | Sweden | Swedish data protection authority ('Datainspektionen') |
Federal Act on Data Protection 1992 | Switzerland | Federal Data Protection and Information Commissioner ('FDPIC') |
Personal Data Protection Act 2010 (as amended in 2015) | Taiwan | The National Development Council ('NDC') |
Law of 3 August 2018 No.1537 on Protection of Personal Data (only available in Russian) | Tajikistan | The Communication Service under the Government of the Republic of Tajikistan |
Personal Data Protection Act 2019 ('PDPA') | Thailand | Data Protection Commission (not yet operational) |
Information and Communications Act, 2009 | The Gambia | Gambia Public Utilities Regulatory Authority ('PURA') |
Law No 2019-014 of October 29, 2019 on the Protection of Personal Data (only available in French) | Togo | Togolese data protection authority ('IPDCP') (not yet operational) |
Data Protection Act, 2011 | Trinidad and Tobago | Office of the Information Commissioner (not yet operational) |
Draft Bill on the Protection of Personal Data (only available in French) | Tunisia | There is no established regulator yet |
Organic Act no 2004-63 of July 27th 2004 on the Protection of Personal Data (only available in French) | Tunisia | Tunisian data protection authority ('INPDP') |
Law on Protection of Personal Data No. 6698 | Turkey | Personal Data Protection Authority ('KVKK') |
The Law of Turkmenistan of 20 March 2017 on Information on Private Life and its Protection No. 519-V (only available in Russian) | Turkmenistan | Cabinet of Ministers of Turkmenistan |
Federal Law No. 2 of 2019 | UAE - DHCC | Ministry of Health and Prevention ('MOHAP') |
Health Data Protection Regulation 2013 (DHCC Regulation No. 7 of 2013) | UAE - DHCC | Dubai Healthcare City Authority ('DHCR') |
Data Protection and Privacy Act, 2019 | Uganda | The National Information Technology Authority - Uganda ('NITA - U') |
Data Protection Act 2018 | UK | The Information Commissioner's Office ('ICO') |
The Law of 1 June 2010 No. 2297-VI on Personal Data Protection (as amended) (only available in Ukranian) | Ukraine | The Ukraine Parliamentary Commissioner for Human Rights |
Decree No. 414/009 Regulating Law 18.331 Relating to the Protection of Personal Data (only available in Spanish) | Uruguay | The Uruguayan data protection authority ('URCDP') |
Decree No. 64/020 on the Regulation of Articles 37-40 of Law No. 19.670 of 15 October 2018 | Uruguay | The Uruguayan data protection authority ('URCDP') |
Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008 (only available in Spanish) | Uruguay | The Uruguayan data protection authority ('URCDP') |
Children's Online Privacy Protection Act of 1998 ('COPPA') | USA Federal | Federal Trade Commission ('FTC') |
Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ('CAN-SPAM') | USA Federal | Federal Trade Commission ('FTC') |
Electronic Communications Privacy Act of 1986 ('ECPA') | USA Federal | U.S. Department of Justice ('DOJ') |
Fair and Accurate Credit Transactions Act of 2003 ('FACTA') | USA Federal | Consumer Financial Protection Bureau ('CFPB') |
Fair Credit Reporting Act of 1970 ('FCRA') | USA Federal | Federal Trade Commission ('FTC') |
Federal Trade Commission Act of 1914 ('FTC Act') | USA Federal | Federal Trade Commission ('FTC') |
Gramm-Leach-Bliley Act of 1999 ('GLBA') | USA Federal | Federal Trade Commission ('FTC') |
Health Information Technology for Economic and Clinical Health Act of 2009 ('HITECH') | USA Federal | Department of Health and Human Services ('HHS') |
Health Insurance Portability and Accountability Act of 1996 ('HIPAA') | USA Federal | Department of Health and Human Services ('HHS') Office for Civil Rights ('OCR') |
Privacy Act of 1974 | USA Federal | U.S. Department of Justice ('DOJ') |
Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994 | USA Federal | Federal Trade Commission ('FTC') |
Telephone Consumer Protection Act of 1991 ('TCPA') | USA Federal | Federal Communications Commission ('FCC') |
Video Privacy Protection Act of 1988 ('VPPA') | USA Federal | Federal Trade Commission ('FTC') |
Utah Consumer Privacy Act ('UCPA') | Utah | Utah Attorney General |
Law of Uzbekistan on Personal Data No. ЗРУ-547 dated 2 July 2019 (only available in Russian and Uzbek) | Uzbekistan | The State Personalisation Centre of Uzbekistan and the Cabinet of Ministers of the Republic of Uzbekistan |
Draft Decree on Personal Data Protection (only available in Vietnamese) | Vietnam | No Data Protection Authority has been established |
The Law on Cyber Information Security No. 86/2015/QH13 | Vietnam | The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC'). |
The Law on Cybersecurity No. 24/2018/QH14 dated June 12, 2018 | Vietnam | The primary regulatory authorities are the Ministry of Public Security ('MPS') and the Ministry of Information and Communication ('MIC'). |
Consumer Data Protection Act ('CDPA') | Virginia | Virgnia Attorney General |
Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties (only available in French) | Wallis and Futuna | French data protection authority ('CNIL') |
Access to Information and Protection of Privacy Act, RSY 2002 c 1 | Yukon | Yukon Information and Privacy Commissioner ('YIPC') |
The Data Protection Bill, 2020 | Zambia | The Office of the Data Protection Commissioner (not yet operational) |
Cyber Security and Data Protection Bill, H.B. 18, 2019 | Zimbabwe | The Data Protection Authority of Zimbabwe (not yet operational) |
Data Protection Act | Zimbabwe | Postal and Telecommunications Regulatory Authority of Zimbabwe ('POTRAZ') |
Freedom of Information Bill, H.B. 6, 2019 | Zimbabwe | Zimbabwe Media Commission |