Privacy laws by country
Last checked 28 October 2026
The same rights for everyone
Wherever you live, CV Atlas gives you the same rights over your data, even where the local law asks for less:
- See and download everything your account stores, with “Download my data” on your dashboard.
- Correct your details at any time in the builder and the dashboard.
- Delete your account and everything in it, with “Delete my account”.
- Say no: we use no analytics, advertising or tracking cookies, and we never sell your data or use it to train AI. There is nothing to opt out of.
- Complain: email hello@aounzia.com, or contact the data protection authority where you live (listed below).
How we handle your data is set out in the privacy policy.
Below is the main general data protection law in each of 200 countries and territories, for information only. It is not legal advice, laws change, and some countries also have rules for particular sectors that are not listed here. Each entry links to the source we used. CV Atlas is not affiliated with any authority named on this page.
Europe
Albania
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Andorra
In force: Qualified Law 29/2021 of 28 October on Personal Data Protection
Authority: Andorran Data Protection Agency (APDA)
Austria
In force: EU General Data Protection Regulation (GDPR)
Also: Data Protection Act 2018 (Datenschutzgesetz, DSG)
Authority: Austrian Data Protection Authority
Belarus
In force: Law No. 99-Z on Personal Data Protection 2021
Authority: National Personal Data Protection Centre
Belgium
In force: EU General Data Protection Regulation (GDPR)
Also: Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data
Authority: Belgian Data Protection Authority
Bosnia and Herzegovina
In force: Law on Personal Data Protection 2025
Authority: Personal Data Protection Agency
Bulgaria
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Protection Act (amended 2019)
Authority: Personal Data Protection Commission
Croatia
In force: EU General Data Protection Regulation (GDPR)
Also: Act on the Implementation of the General Data Protection Regulation (2018)
Cyprus
In force: EU General Data Protection Regulation (GDPR)
Also: Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data
Authority: Commissioner for the Protection of Personal Data
Czechia
In force: EU General Data Protection Regulation (GDPR)
Also: Act No. 110/2019 Coll. on Personal Data Processing
Authority: Office for Personal Data Protection (UOOU)
Denmark
In force: EU General Data Protection Regulation (GDPR)
Also: Danish Act on Data Protection (2018)
Authority: Danish Data Protection Agency (Datatilsynet)
Estonia
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Protection Act 2018
Authority: Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Finland
In force: EU General Data Protection Regulation (GDPR)
Also: Data Protection Act (Tietosuojalaki), in force 1 January 2019
Authority: Office of the Data Protection Ombudsman
France
In force: EU General Data Protection Regulation (GDPR)
Also: Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as updated by Law No. 2018-493
Authority: National Commission for Informatics and Liberty (CNIL)
Germany
In force: EU General Data Protection Regulation (GDPR)
Also: Federal Data Protection Act 2018 (Bundesdatenschutzgesetz, BDSG)
Authority: Federal Commissioner for Data Protection and Freedom of Information
The German states also have their own supervisory authorities.
Greece
In force: EU General Data Protection Regulation (GDPR)
Also: Law 4624/2019
Authority: Hellenic Data Protection Authority
Hungary
In force: EU General Data Protection Regulation (GDPR)
Also: Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information
Authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Iceland
In force: EU General Data Protection Regulation (GDPR)
Also: Act No. 90/2018 on Data Protection and the Processing of Personal Data
Authority: Persónuvernd (Icelandic Data Protection Authority)
Iceland is an EEA member, so the GDPR applies there.
Ireland
In force: EU General Data Protection Regulation (GDPR)
Also: Data Protection Act 2018
Authority: Data Protection Commission
Italy
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Protection Code (Legislative Decree No. 196/2003), as amended by Legislative Decree No. 101/2018
Authority: Garante per la protezione dei dati personali
Kosovo
In force: Law No. 06/L-082 on Protection of Personal Data 2019
Authority: Information and Privacy Agency
Latvia
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Processing Law 2018
Liechtenstein
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Lithuania
In force: EU General Data Protection Regulation (GDPR)
Also: Law on Legal Protection of Personal Data 2018
Authority: State Data Protection Inspectorate
Luxembourg
In force: EU General Data Protection Regulation (GDPR)
Also: Law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework
Authority: National Data Protection Commission (CNPD)
Malta
In force: EU General Data Protection Regulation (GDPR)
Also: Data Protection Act 2018 (Chapter 586 of the Laws of Malta)
Authority: Information and Data Protection Commissioner
Moldova
In force: Law No. 133 on Personal Data Protection 2011
Authority: National Centre for Personal Data Protection
Monaco
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Montenegro
In force: Law on Protection of Personal Data 2008 (amended 2024)
Authority: Agency for Protection of Personal Data and Free Access to Information
Netherlands
In force: EU General Data Protection Regulation (GDPR)
Also: General Data Protection Regulation Implementation Act (Uitvoeringswet AVG)
Authority: Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
North Macedonia
In force: Law on Personal Data Protection 2020
Authority: Personal Data Protection Agency
Norway
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Act 2018 (LOV-2018-06-15-38)
Authority: Norwegian Data Protection Authority (Datatilsynet)
Norway is an EEA member, so the GDPR applies there.
Poland
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Protection Act of 10 May 2018
Authority: President of the Personal Data Protection Office (UODO)
Portugal
In force: EU General Data Protection Regulation (GDPR)
Also: Law No. 58/2019 of 8 August
Authority: National Commission for the Protection of Data (CNPD)
Romania
In force: EU General Data Protection Regulation (GDPR)
Also: Law No. 190/2018 on measures implementing the GDPR
Authority: National Supervisory Authority for Personal Data Processing (ANSPDCP)
Russia
In force: Federal Law No. 152-FZ On Personal Data of 27 July 2006
Authority: Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor)
San Marino
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Serbia
In force: Law on Personal Data Protection 2018
Authority: Commissioner for Information of Public Importance and Protection of Personal Data
Official Gazette 87/2018, in force since 21 August 2019.
Slovakia
In force: EU General Data Protection Regulation (GDPR)
Also: Act No. 18/2018 Coll. on the Protection of Personal Data
Slovenia
In force: EU General Data Protection Regulation (GDPR)
Also: Personal Data Protection Act (ZVOP-2), in force 26 January 2023
Authority: Information Commissioner (Informacijski pooblaščenec)
Spain
In force: EU General Data Protection Regulation (GDPR)
Also: Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights
Authority: Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD)
Sweden
In force: EU General Data Protection Regulation (GDPR)
Also: Data Protection Act 2018 (SFS 2018:218)
Switzerland
In force: Federal Act on Data Protection 2020
Authority: Federal Data Protection and Information Commissioner (FDPIC)
Took effect on 1 September 2023.
Ukraine
In force: Law of Ukraine On Personal Data Protection 2010 (No. 2297-VI)
Authority: Ukrainian Parliament Commissioner for Human Rights
Widely seen as outdated; a replacement bill (No. 8153) is pending in parliament.
United Kingdom
In force: Data Protection Act 2018
Also: UK General Data Protection Regulation (UK GDPR)
Authority: Information Commissioner's Office
Vatican City
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Middle East
Bahrain
In force: Personal Data Protection Law (Law No. 30 of 2018)
Authority: Personal Data Protection Authority
The Ministry of Justice, Islamic Affairs and Endowments temporarily performs the Authority's functions under Decree No. 78 of 2019.
Iran
No general data protection law found
Iraq
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Israel
In force: Protection of Privacy Law, 5741-1981
Also: Privacy Protection (Amendment No. 13) Law, 5784-2024
Authority: Israel Privacy Authority
Amendment No. 13 was scheduled to take effect on 14 August 2025.
Jordan
In force: Personal Data Protection Law No. 24 of 2023
Authority: Ministry of Digital Economy and Entrepreneurship (personal data protection unit)
Kuwait
No general data protection law found
No dedicated general law; CITRA's Data Privacy Protection Regulation (Resolution No. 26 of 2024) applies only to CITRA-licensed telecom and related providers.
Lebanon
In force: Law No. 81/2018 on Electronic Transactions and Personal Data
Lebanon has no national data protection authority.
Oman
In force: Personal Data Protection Law (Royal Decree 6/2022)
Authority: Ministry of Transport, Communications and Information Technology
Palestine
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Qatar
In force: Law No. 13 of 2016 Concerning Personal Data Protection
Authority: National Cyber Governance and Assurance Affairs of the National Cyber Security Agency
Saudi Arabia
In force: Personal Data Protection Law (Royal Decree M/19 of 2021)
Authority: Saudi Authority for Data and Artificial Intelligence (SDAIA)
Syria
In force: Law No. 12 of 2024 on Electronic Personal Data
Türkiye
In force: Law No. 6698 on the Protection of Personal Data of 7 April 2016
Authority: Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu)
United Arab Emirates
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Yemen
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Africa
Algeria
In force: Law No. 18-07 of 10 June 2018 on the Protection of Natural Persons in the Processing of Personal Data
Also: Law No. 25-11 of 24 July 2025 (amending Law 18-07)
Authority: National Data Protection Authority
Angola
In force: Data Protection Law (Law No. 22/11) 2011
Authority: Data Protection Agency (Agência de Proteção de Dados, APD)
The law is the main data protection statute, enacted in 2011.
Benin
In force: Law No. 2009-09 on the Protection of Personal Data 2009
Also: Digital Code, Book V (Law No. 2017-20, as amended by Law No. 2020-35)
Authority: Personal Data Protection Authority (Autorité de Protection des Données Personnelles, APDP)
The Digital Code was amended by Law No. 2020-35.
Botswana
In force: Data Protection Act 2024 (Act No. 18 of 2024)
Authority: Information and Data Protection Commission
Replaced the Data Protection Act 2018.
Burkina Faso
In force: Law No. 001-2021/AN on the Protection of Persons with regard to the Processing of Personal Data 2021
Authority: Commission for Information Technology and Civil Liberties (Commission de l'Informatique et des Libertés, CIL)
The law is dated 30 March 2021.
Burundi
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Cabo Verde
In force: Law No. 133/V/2001 on Personal Data Protection 2001
Also: Law No. 41/VIII/2013; Law No. 121/IX/2021 (amendments)
Authority: National Data Protection Commission (Comissão Nacional de Proteção de Dados Pessoais, CNPD)
The law was amended in 2013 and 2021.
Cameroon
Passed, not yet in force: Law No. 2024/017 on the Protection of Personal Data 2024
Authority: Personal Data Protection Authority (Autorité de protection des données à caractère personnel, ADCP)
The implementing decree had not been adopted.
Central African Republic
In force: Law No. 24.001 on the Protection of Personal Data 2024
The data protection authority has not been appointed.
Chad
In force: Act No. 007/PR/2015 on Personal Data Protection 2015
Authority: National Agency for Information Security and Electronic Certification (ANSICE)
The Act is implemented by Decree No. 075/PR/2019.
Comoros
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Côte d’Ivoire
In force: Law No. 2013-450 on the Protection of Personal Data 2013
Authority: Telecommunications/ICT Regulatory Authority of Côte d'Ivoire (ARTCI)
The law is dated 19 June 2013.
Djibouti
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
DR Congo
In force: Digital Code 2023 (Ordinance-Law No. 23/010 of 13 March 2023), Title III
The Data Protection Authority is not yet formally established; ARPTIC acts as de facto interlocutor.
Egypt
In force: Personal Data Protection Law No. 151 of 2020
Authority: Personal Data Protection Centre
Equatorial Guinea
In force: Personal Data Protection Law No. 1/2016 2016
Authority: Governing Body for the Protection of Personal Data (Órgano Rector de Protección de Datos Personales)
The law is dated 22 July 2016.
Eritrea
No general data protection law found
Eswatini
In force: Data Protection Act 2022
The Act was published in the Government Gazette in March 2022.
Ethiopia
In force: Personal Data Protection Proclamation No. 1321/2024
Authority: Ethiopian Communications Authority
Gabon
In force: Law No. 001/2011 on the Protection of Personal Data 2011, as amended by Law No. 025/2023 (2023)
Authority: Authority for the Protection of Personal Data and Privacy (Autorité de Protection des Données à Caractère Personnel et de la Vie Privée, APDPVP)
The 2023 amendment replaced the CNPDCP with the APDPVP.
Gambia
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Ghana
In force: Data Protection Act, 2012 (Act 843)
Authority: Data Protection Commission
Guinea
In force: Law L/2016/037/AN on Cybersecurity and Personal Data Protection 2016
The data protection authority provided for by the law is not yet operational.
Guinea-Bissau
No general data protection law found
Guinea-Bissau has no general data protection law.
Kenya
In force: Data Protection Act, 2019
Authority: Office of the Data Protection Commissioner
Lesotho
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Liberia
No general data protection law found
Liberia has no dedicated data protection law.
Libya
No general data protection law found
Madagascar
In force: Law No. 2014-038 relating to the protection of personal data 2014
Authority: Commission Malagasy sur l'Informatique et des Libertés (CMIL)
Malawi
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Mali
In force: Law No. 2013-015 on the Protection of Personal Data 2013
Authority: Personal Data Protection Authority (Autorité de Protection des Données à caractère Personnel, APDP)
The Personal Data Protection Authority was launched in 2016.
Mauritania
Passed, not yet in force: Law No. 2017-020 on Personal Data Protection 2017
Mauritius
In force: Data Protection Act 2017
Authority: Data Protection Office
In force from 15 January 2018.
Morocco
In force: Law No. 09-08 on the Protection of Individuals with regard to the Processing of Personal Data of 18 February 2009
Also: Decree No. 2-09-165 of 21 May 2009
Authority: National Commission for the Protection of Personal Data (CNDP)
Mozambique
No general data protection law found
Namibia
Draft law only: Data Protection Bill, 2021 (draft)
Niger
In force: Law No. 2022-59 on the Protection of Personal Data 2022
Also: Law No. 2023-31 (amendment, 2023)
Authority: High Authority for the Protection of Personal Data (Haute Autorité de Protection des Données à caractère Personnel, HAPDP)
Law No. 2022-59 was amended by Law No. 2023-31.
Nigeria
In force: Nigeria Data Protection Act 2023
Also: General Application and Implementation Directive 2025
Authority: Nigeria Data Protection Commission
Republic of the Congo
In force: Law No. 29-2019 on the Protection of Personal Data 2019
Also: Law No. 5-2025 of 29 March 2025 creating the national commission (reported by ILO NATLEX; DLA says the commission law is not yet adopted)
Authority: National Commission for Personal Data Protection (Commission de Protection des Données à Caractère Personnel)
Rwanda
In force: Law No. 058/2021 Relating to the Protection of Personal Data and Privacy 2021
Authority: National Cyber Security Authority
São Tomé and Príncipe
In force: Law No. 03/2016 on the Protection of Personal Data 2016
Authority: National Data Protection Agency (ANPDP)
The National Data Protection Agency is operational.
Senegal
In force: Act No. 2008-12 Concerning Personal Data Protection 2008
Authority: Personal Data Protection Commission (Commission de Données Personnelles, CDP)
The Act is dated 25 January 2008.
Seychelles
In force: Data Protection Act 2023 (Act 24 of 2023)
Authority: Information Commission Seychelles
Came into force on 22 December 2023.
Sierra Leone
No general data protection law found
Sierra Leone has no general data protection law.
Somalia
In force: Data Protection Act 2023 (Law No. 005 of 2023)
Authority: Somalia Data Protection Authority
South Africa
In force: Protection of Personal Information Act 4 of 2013 (POPIA)
Authority: Information Regulator
South Sudan
Draft law only: Data Protection Bill (draft, not yet tabled)
Sudan
No general data protection law found
Tanzania
In force: Personal Data Protection Act, 2022
Authority: Personal Data Protection Commission
Togo
In force: Law No. 2019-014 on the Protection of Personal Data 2019
The data protection authority provided for by the law has not been set up.
Tunisia
In force: Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data
Authority: National Authority for the Protection of Personal Data (INPDP)
Uganda
In force: Data Protection and Privacy Act, 2019
Also: Data Protection and Privacy Regulations, 2021
Authority: Personal Data Protection Office (within the National Information Technology Authority, Uganda)
Zambia
In force: Data Protection Act No. 3 of 2021
Also: Data Protection (Registration and Licensing) Regulations, 2021
Authority: Office of the Data Protection Commissioner
Zimbabwe
In force: Cyber and Data Protection Act [Chapter 12:07]
Also: Cyber and Data Protection (Licensing of Data Controllers and Appointment of Data Protection Officers) Regulations, 2024
Authority: Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ)
Asia
Afghanistan
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Armenia
In force: Law on Personal Data Protection 2015 (HO-49-N)
Authority: Personal Data Protection Agency of the Ministry of Justice
Azerbaijan
In force: Law on Personal Data (No. 998-IIIQ, 2010)
Authority: Ministry of Digital Development and Transport
Bangladesh
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Bhutan
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Brunei
In force: Personal Data Protection Order 2025
Enacted 8 January 2025; most provisions in force from 1 January 2026. Responsible authority not yet established, expected to be AITI.
Cambodia
Draft law only
China
In force: Personal Information Protection Law 2021
Authority: Cyberspace Administration of China
Georgia
In force: Law of Georgia on Personal Data Protection (No. 3144/2023)
Authority: State Audit Office of Georgia
Hong Kong
In force: Personal Data (Privacy) Ordinance 1995 (Cap. 486)
Authority: Office of the Privacy Commissioner for Personal Data
India
In force: Digital Personal Data Protection Act 2023
Also: Digital Personal Data Protection Rules 2025
Authority: Data Protection Board of India
Partly in force: Board provisions took effect 13 November 2025; substantive provisions are due by 13 May 2027.
Indonesia
In force: Personal Data Protection Law 2022 (Law No. 27 of 2022)
Authority: Ministry of Communication and Digital (KOMDIGI)
The ministry is the authority until the separate PDP Agency is formed, and the Agency is not yet operational.
Japan
In force: Act on the Protection of Personal Information 2003 (Act No. 57 of 2003)
Authority: Personal Information Protection Commission
Kazakhstan
In force: On Personal Data and their Protection (Law No. 94-V, 2013)
Authority: Ministry of Digital Development, Innovation and Aerospace Industry
Kyrgyzstan
In force: On Personal Data (Law No. 58, 2008)
Authority: State Agency for Personal Data Protection
Laos
In force: Law on Electronic Data Protection 2017 (No. 25/NA)
Authority: Ministry of Technology and Communication
Macau
In force: Personal Data Protection Act (Law 8/2005)
Authority: Office for Personal Data Protection
Malaysia
In force: Personal Data Protection Act 2010
Authority: Personal Data Protection Commissioner
Maldives
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Mongolia
In force: Law on Personal Data Protection 2021
Myanmar
No general data protection law found
Nepal
In force: Individual Privacy Act 2018 (2075)
Also: Individual Privacy Regulation 2020
No data protection authority has been designated.
North Korea
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Pakistan
Draft law only
The Personal Data Protection Bill 2023 has not been enacted; the nearest law is the Prevention of Electronic Crimes Act 2016.
Philippines
In force: Data Privacy Act of 2012 (Republic Act No. 10173)
Authority: National Privacy Commission
Singapore
In force: Personal Data Protection Act 2012
Authority: Personal Data Protection Commission
South Korea
In force: Personal Information Protection Act 2011
Authority: Personal Information Protection Commission
Sri Lanka
Passed, not yet in force: Personal Data Protection Act No. 9 of 2022
Also: Personal Data Protection (Amendment) Act No. 22 of 2025
Authority: Data Protection Authority of Sri Lanka
The regulator provisions are in force since 2023; the substantive provisions await a date set by Gazette order.
Taiwan
In force: Personal Data Protection Act 2010
Authority: Personal Data Protection Commission (not yet officially established)
Tajikistan
In force: Personal Data Protection Law (No. 1537, 2018)
Thailand
In force: Personal Data Protection Act B.E. 2562 (2019)
Authority: Personal Data Protection Committee
Timor-Leste
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Turkmenistan
In force: On Information about Private Life and its Protection (Law No. 519-V, 2017)
Uzbekistan
In force: On Personal Data (Law No. ZRU-547, 2019)
Authority: Personalization Agency under the Ministry of Justice
Vietnam
In force: Law on Personal Data Protection 2025 (Law No. 91/2025/QH15)
Authority: Ministry of Public Security
In force 1 January 2026. Authority is the Department for Cybersecurity and High-tech Crime Prevention and Fighting (A05).
Americas
Antigua and Barbuda
In force: Data Protection Act 2013 (No. 10 of 2013)
Authority: Information Commissioner
The Data Protection Act 2013 took effect on 1 January 2013.
Argentina
In force: Personal Data Protection Act 2000 (Law 25.326)
Also: Decree 1558 of 2001
Authority: Agency for Access to Public Information (Agencia de Acceso a la Información Pública)
Bahamas
In force: Data Protection (Privacy of Personal Information) Act 2003
Authority: Office of the Data Protection Commissioner
Barbados
In force: Data Protection Act 2019
Authority: Data Protection Commissioner
In force since March 2021, but some provisions have not yet been proclaimed.
Belize
Passed, not yet in force: Data Protection Act 2021 (Act No. 45 of 2021)
Bolivia
No general data protection law found
Brazil
In force: General Data Protection Law 2018 (Law 13.709/2018, LGPD)
Also: Law 13.853 of 2019 (amendment)
Authority: National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD)
Canada
In force: Personal Information Protection and Electronic Documents Act (PIPEDA)
Authority: Office of the Privacy Commissioner of Canada
Some provinces have their own private sector laws, for example Quebec, Alberta and British Columbia.
Chile
Passed, not yet in force: Personal Data Protection Law 2024 (Law 21.719, amending Law 19.628)
Also: Law 19.628 on the Protection of Private Life 1999
Authority: Agency for the Protection of Personal Data (Agencia de Protección de Datos Personales)
Colombia
In force: Statutory Law 1581 of 2012 (Personal Data Protection Law)
Also: Decree 1377 of 2013
Authority: Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio)
Costa Rica
In force: Law No. 8968 on the Protection of Individuals in the Handling of Personal Data (2011)
Authority: Agency for the Protection of Individual's Data (PRODHAB)
Cuba
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Dominica
No general data protection law found
Dominica has not enacted comprehensive data protection legislation.
Dominican Republic
In force: Law No. 172-13 on the Comprehensive Protection of Personal Data (2013)
The Superintendency of Banks supervises credit bureau databases under the law.
Ecuador
In force: Organic Law on Personal Data Protection 2021
Also: Regulation to the Organic Law on Personal Data Protection 2023
Authority: Superintendence of Personal Data Protection (Superintendencia de Protección de Datos Personales)
El Salvador
In force: Personal Data Protection Law 2024 (Decreto Legislativo No. 144)
Grenada
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Guatemala
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Guyana
Passed, not yet in force: Data Protection Act 2023 (Act No. 18 of 2023)
Not yet in force.
Haiti
In force: Decree setting rules on the protection of personal data (2018)
A 2018 decree sets personal data rules, and no data protection authority exists yet.
Honduras
Draft law only
Jamaica
In force: Data Protection Act 2020 (Act No. 7 of 2020)
Authority: Office of the Information Commissioner
Mexico
In force: Federal Law for the Protection of Personal Data in Possession of Private Parties 2025
Authority: Ministry of Anticorruption and Good Governance
Nicaragua
In force: Law on Personal Data Protection (Law No. 787, 2012)
Also: Regulation Decree 36-2012
Authority: Personal Data Protection Directorate (DIPRODAP)
Panama
In force: Law No. 81 of 2019 on Personal Data Protection
Also: Executive Decree No. 285 of 2021
Authority: National Authority of Transparency and Access to Information (ANTAI)
Paraguay
Passed, not yet in force: Personal Data Protection Law 2025 (Law 7593/2025)
Also: Law 6534/2020 on Personal Credit Data Protection (in force)
Peru
In force: Personal Data Protection Law 2011 (Law 29733)
Also: Supreme Decree 016-2024-JUS (Regulation, in force since 30 March 2025)
Authority: Directorate for the Protection of Personal Data (Dirección de Protección de Datos Personales)
The authority sits within the Ministry of Justice and Human Rights.
Puerto Rico
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Saint Kitts and Nevis
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Saint Lucia
In force: Data Protection Act 2011
Also: Data Protection (Amendment) Act 2015
Authority: Data Protection Commissioner
Saint Vincent and the Grenadines
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Suriname
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Trinidad and Tobago
In force: Data Protection Act 2011 (Act No. 13 of 2011)
Authority: Office of the Information Commissioner
Only parts are in force (Legal Notice 2 of 2012), with no timetable set for the rest.
United States
No general federal law, state laws apply
Also: California Consumer Privacy Act 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA)
Authority: California Privacy Protection Agency
There is no general federal privacy law. Several states have their own, and California is shown here as an example.
Uruguay
In force: Personal Data Protection and Habeas Data Action Law 2008 (Law 18.331)
Also: Decree 414/009 of 2009
Authority: Regulatory and Control Unit of Personal Data (Unidad Reguladora y de Control de Datos Personales, URCDP)
Venezuela
No general data protection law found
Oceania
Australia
In force: Privacy Act 1988
Also: Privacy and Other Legislation Amendment Act 2024
Authority: Office of the Australian Information Commissioner (OAIC)
Fiji
No general data protection law found
Kiribati
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Marshall Islands
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Micronesia
Draft law only
A Personal Data Protection Act 2025 bill is before Congress and has not been enacted.
Nauru
No general data protection law found
Nauru has no comprehensive national data protection or privacy law.
New Zealand
In force: Privacy Act 2020
Authority: Office of the Privacy Commissioner
Palau
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Papua New Guinea
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Samoa
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Solomon Islands
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Tonga
We could not confirm this country’s law from a reliable source yet. Check with the local data protection authority.
Tuvalu
In force: Data Protection and Privacy Act 2020
Authority: Tuvalu Data Protection Authority
The Data Protection and Privacy Act 2020 is in force.
Vanuatu
In force: Data Protection and Privacy Act No. 13 of 2024