Laws and regulatorsWorldData protection
Data protection: a world tour of the laws
From France’s CNIL in 1978 to the GDPR in 2018 and 172 countries with a law by 2025: the world map of data protection laws and regulators, and what it means for your data transfers.
Published 29 October 2026 · 8 min read · The Clairancy editorial team
Bodies cited
Logos shown for information only; these bodies have no affiliation with Clairancy. Emblème de l’Union européenne.
Key points
- By March 2025, 172 countries had a data protection law, compared with one in 1973, Sweden, according to Graham Greenleaf’s count published by Privacy Laws & Business.
- As of 29 October 2026, the European Commission recognises 17 adequate destinations: 16 countries or territories and the European Patent Organisation; the most recent decision, a mutual one, covers Brazil (26 January 2026).
- The United States has no general federal data protection law; twenty-three states have adopted a general law of their own, nineteen of them in force (IAPP, September 2026).
On 6 January 1978, France adopted its Data Processing, Files and Freedoms Act (France · Law 78-17). It entrusted enforcement to an independent administrative authority: the National Commission on Informatics and Liberty (France · CNIL). Forty years later, on 25 May 2018, the General Data Protection Regulation (EU · GDPR) became applicable across the Union. In the meantime, the idea travelled the world. In 1973, only one country had a national law: Sweden. By March 2025, 172 countries had one, according to the count kept by Australian legal scholar Graham Greenleaf (United Kingdom · Privacy Laws & Business).
Having a law has therefore become the norm. For any company or public body moving data between continents, the question is no longer “does this country have a law?” but “can my data go there, and come back?” This world tour, as of 29 October 2026, is designed to answer it country by country.
What is already settled
- Convention 108 (Europe · Council of Europe): opened for signature on 28 January 1981, it is the first binding international treaty on personal data, and it is open to non-European states. Its modernised version, known as “108+”, had 34 of the 38 ratifications needed to enter into force as of September 2026.
- Adequacy decisions (EU · European Commission): as of 29 October 2026, they cover 17 destinations, namely 16 countries or territories and one international organisation, the European Patent Organisation (international · EPO, July 2025). The United Kingdom’s decisions were renewed on 19 December 2025; Brazil was recognised on 26 January 2026, through mutual decisions.
- Malabo Convention (Africa · African Union): adopted on 27 June 2014, it covers cybersecurity and personal data. It entered into force on 8 June 2023, after the fifteenth ratification.
- PIPL (China · National People’s Congress): the Personal Information Protection Law, adopted on 20 August 2021, has applied since 1 November 2021, coordinated by the cyberspace regulator (China · CAC).
- DPDP Act (India · MeitY): enacted on 11 August 2023, the law is coming into force in stages. Its authority, the Data Protection Board, was legally established on 13 November 2025; most obligations will apply from 13 May 2027.
- Acceleration (United Kingdom · Privacy Laws & Business): since 1973, an average of 3.3 countries a year have adopted their first law; since 2020, the pace has risen to 5.4 new laws a year.
199countries and territories tracked
69 %Law in force · 137
16 %Law in preparation · 31
16 %No general law · 31
- Africa35/54
- Americas20/35
- Asia34/50
- Europe45/46
- Oceania3/14
Clairancy database, updated on 29 Oct 2026Download the full database (CSV)
Our database, checked country by country as of 29 October 2026, covers 199 countries and territories. It counts as “in force” only general laws that actually apply, which is why it shows fewer countries than the international census, which also includes laws passed but not yet applicable. The tables can be downloaded as CSV.
Countries with a law
The table below lists the countries with a general data protection law in force, with their supervisory authority and the date of the text. Models vary: an independent authority on the CNIL pattern, or a body attached to government, as in China.
| Country | Continent | Law (official text) | Regulator | In force since |
|---|---|---|---|---|
| South Africa | Africa | Protection of Personal Information Act 4 of 2013 (POPIA)Most of POPIA has applied since 1 July 2020; the Information Regulator issues administrative fines. | Information Regulator | 1 Jul 2020 |
| Algeria | Africa | Loi n° 18-07 du 10 juin 2018 relative à la protection des personnes physiques dans le traitement des données à caractère personnelAmended by Law No. 25-11 of 24 July 2025 (mandatory DPO and records of processing); the ANPDP has been operational since August 2023. | ANPDP | 10 Jun 2018 |
| Angola | Africa | Lei n.º 22/11, de 17 de Junho — Lei da Protecção de Dados PessoaisA draft revision of the law went to public consultation in March-April 2025 and has not been adopted. | APD | 17 Jun 2011 |
| Benin | Africa | Loi n° 2017-20 du 20 avril 2018 portant code du numérique en République du BéninData protection is governed by Book V of the Digital Code; Law No. 2020-35 of 6 January 2021 reshaped the APDP's membership. | APDP | 20 Apr 2018 |
| Botswana(to be verified) | Africa | Data Protection Act, 2024 (Act No. 18 of 2024)The 2024 Act repeals the 2018 Act and keeps the IDPC, headed by a commissioner since 2022; it has been in force since 14 January 2025. | IDPC | 14 Jan 2025 |
| Burkina Faso(to be verified) | Africa | Loi n° 037-2026/ALP relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnelNew law adopted on 3 August 2026, replacing Law No. 001-2021/AN; the CIL is to merge with the media regulator CSC into ARCOD (Organic Law No. 038-2026/ALP), not yet set up. | CIL | 2026 |
| Cabo Verde | Africa | Lei n.º 133/V/2001, de 22 de janeiro (regime jurídico geral de proteção de dados pessoais das pessoas singulares)Amended in 2013 and 2021 (DPO, impact assessments, 72-hour breach notification); the country has been party to Council of Europe Convention 108 since 2018. | CNPD | 2001 |
| Republic of the Congo(to be verified) | Africa | Loi n° 29-2019 du 10 octobre 2019 portant protection des données à caractère personnelThe CNPD, created by Law No. 5-2025, had its members appointed on 31 December 2025 but shows no visible public activity yet. | CNPD | 7 Nov 2019 |
| Côte d'Ivoire | Africa | Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnelARTCI acts as the data protection authority and adopted new simplified filing standards in November 2025. | ARTCI | 19 Jun 2013 |
| Egypt | Africa | Law No. 151 of 2020 promulgating the Personal Data Protection LawExecutive Regulations issued in November 2025 (Ministerial Decree No. 816/2025); the one-year grace period ends in early November 2026 and the PDPC now issues licences and permits. | PDPC | 16 Oct 2020 |
| Eswatini | Africa | Data Protection Act, 2022 (Act No. 5 of 2022)The Eswatini Communications Commission is the designated authority and operates as the EDPA. | ESCCOM (EDPA) | 4 Mar 2022 |
| Ethiopia | Africa | Personal Data Protection Proclamation No. 1321/2024The ECA is the designated data protection authority; several implementing directives are still being prepared. | ECA | 24 Jul 2024 |
| Gabon | Africa | Loi n° 025/2023 du 12 juillet 2023 portant modification de la loi n° 001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnelThe 2023 law (221 articles) overhauls the 2011 law and replaces the CNPDCP with the APDPVP. | APDPVP | 15 Jul 2023 |
| Gambia(to be verified) | Africa | Personal Data Protection and Privacy Act, 2025 (Act No. 11 of 2025)First general law, passed on 29 September 2025 and assented on 7 November 2025; the Information Commission, set up in 2021 for access to information, is the supervisory authority. | Information Commission | 13 Nov 2025 |
| Ghana | Africa | Data Protection Act, 2012 (Act 843)A Data Protection Bill 2025, put to consultation by the DPC, would repeal Act 843 and create a Data Protection Authority; it has not been enacted. | DPC | 16 Oct 2012 |
| Kenya | Africa | Data Protection Act, 2019 (No. 24 of 2019)The ODPC can fine up to KES 5 million or 1% of turnover; the first Data Commissioner's term ends in late 2026. | ODPC | 25 Nov 2019 |
| Madagascar(to be verified) | Africa | Loi n° 2014-038 du 9 janvier 2015 sur la protection des données à caractère personnelThe CMIL, set up by decree in December 2023, had its members sworn in in August 2025; it has no website yet. | CMIL | 9 Jun 2015 |
| Malawi | Africa | Data Protection Act, 2024 (Act No. 3 of 2024)MACRA is the designated authority; implementing regulations were still in draft in 2025-2026. | MACRA | 3 Jun 2024 |
| Mali | Africa | Loi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du MaliThe APDP, operational since 2015, enforces the amended 2013 law. | APDP | 21 May 2013 |
| Morocco | Africa | Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnelSupplemented by Decree No. 2-09-165 of 21 May 2009; the overhaul announced by the CNDP since 2019 has still not been adopted. | CNDP | 23 Feb 2009 |
| Mauritius | Africa | Data Protection Act 2017 (Act No. 20 of 2017)GDPR-aligned Act (EU) replacing the 2004 Act; DPO regulations will apply from 1 January 2027. | DPO | 15 Jan 2018 |
| Mauritania | Africa | Loi n° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnelThe APD, set up by decree in 2022, is active, with 2025 decisions on cross-border transfers and foreign cloud services. | APD | 2017 |
| Nigeria | Africa | Nigeria Data Protection Act, 2023 (Act No. 37)The NDPC's GAID directive, applicable since 19 September 2025, details the Act and replaces the 2019 NDPR. | NDPC | 12 Jun 2023 |
| Uganda | Africa | Data Protection and Privacy Act, 2019 (Act 9 of 2019, now Cap. 97)Implementing Regulations 2021; the PDPO, part of NITA-U, secured its first criminal conviction in July 2025. | PDPO | 3 May 2019 |
| Rwanda | Africa | Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacyThe NCSA runs mandatory controller registration and authorises storing data outside the country; the transition period ended in October 2023. | NCSA | 15 Oct 2021 |
| Sao Tome and Principe | Africa | Lei n.º 03/2016 — Protecção de Dados PessoaisPublished in the Diário da República on 10 May 2016; the ANPDP belongs to NADPA-RAPDP and to the Lusophone data protection network (2024). | ANPDP | 2016 |
| Senegal | Africa | Loi n° 2008-12 du 25 janvier 2008 portant sur la protection des données à caractère personnelOne of the continent's earliest laws; the overhaul bill launched in 2017 had still not been adopted as of October 2026. | CDP | 25 Jan 2008 |
| Seychelles | Africa | Data Protection Act, 2023 (Act 24 of 2023)The 2023 Act replaces the never-implemented 2003 Act; its 18-month transition ended in June 2025. | InfoCom | 22 Dec 2023 |
| Somalia | Africa | Data Protection Act (Law No. 005 of 2023)The DPA, launched in February 2024, had its implementing Regulations approved in January 2026. | DPA | 2023 |
| Tanzania | Africa | Personal Data Protection Act, 2022 (Act No. 11 of 2022, Cap. 44)The PDPC, operational since 2024, has fully enforced the Act since April 2026 and has run inspections since 31 August 2026. | PDPC | 1 May 2023 |
| Chad | Africa | Loi n° 007/PR/2015 du 10 février 2015 portant protection des données à caractère personnelOversight lies with ANSICE, a cybersecurity agency, rather than a dedicated independent authority (implementing Decree No. 075/PR/2019). | ANSICE | 2015 |
| Togo | Africa | Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnelThe IPDCP, organised by decree in December 2020, only began operating on 28 March 2025. | IPDCP | 29 Oct 2019 |
| Tunisia(to be verified) | Africa | Loi organique n° 2004-63 du 27 juillet 2004 portant sur la protection des données à caractère personnelThe GDPR-aligned draft organic law tabled in Parliament in 2018 has still not been passed; the INPDP website was unreachable in October 2026. | INPDP | 2004 |
| Zambia | Africa | Data Protection Act No. 3 of 2021The ODPC, operational since 2025, requires controllers and processors to register. | ODPC | 1 Apr 2021 |
| Zimbabwe | Africa | Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021)SI 155 of 2024 requires controllers to be licensed; POTRAZ announced inspections from September 2026. | POTRAZ | 3 Dec 2021 |
| Antigua and Barbuda(to be verified) | Americas | Data Protection Act, 2013 (No. 10 of 2013)Covers public and private bodies, published in the Gazette on 7 November 2013; enforcement lies with the Information Commissioner (2004 Freedom of Information Act), who has no dedicated website and little documented activity. | Information Commissioner | 7 Nov 2013 |
| Argentina | Americas | Ley 25.326 de Protección de los Datos PersonalesRecognised as adequate by the European Commission (EU) since 2003 and party to Council of Europe Convention 108; the 2000 law still awaits its overhaul. | AAIP | 2 Nov 2000 |
| Bahamas(to be verified) | Americas | Data Protection (Privacy of Personal Information) Act, 2003 (Ch. 324A)The GDPR-inspired Data Protection Act 2025 (No. 74 of 2025, assented on 9 December 2025) will repeal the 2003 Act on a date still to be set by the Minister. | ODPC | 2 Apr 2007 |
| Barbados | Americas | Data Protection Act, 2019 (2019-29)GDPR-style Act in force since 31 March 2021; a Data Protection Commissioner has been in office since July 2021, but public enforcement remains rare. | DPC | 31 Mar 2021 |
| Brazil | Americas | Lei Geral de Proteção de Dados (LGPD), loi n° 13.709/2018Recognised as adequate by the European Commission (EU) on 26 January 2026, mirrored by an ANPD decision recognising the EU; the ANPD is now a regulatory agency. | ANPD | 18 Sept 2020 |
| Canada | Americas | Loi sur la protection des renseignements personnels et les documents électroniques (LPRPDE / PIPEDA), L.C. 2000, ch. 5Partial EU adequacy (commercial organisations) recognised by the European Commission; Bill C-36, tabled on 15 June 2026, would replace Part 1 of PIPEDA and move oversight to a new Digital Safety and Data Protection Commission, but has only passed first reading. | CPVP (OPC) | 1 Jan 2001 |
| Chile | Americas | Ley 19.628 sobre protección de la vida privada (réformée par la Ley 21.719)Law 21.719 (published 13 December 2024), modelled on the GDPR, is due to apply from 1 December 2026 and create a Data Protection Agency whose board is not yet appointed; a bill postponing it to December 2027 is before the Senate. | — | 28 Aug 1999 |
| Colombia | Americas | Ley Estatutaria 1581 de 2012The SIC, also the competition and consumer authority, oversees personal data and regularly issues sanctions. | SIC | 18 Oct 2012 |
| Costa Rica | Americas | Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales2011 law overseen by PRODHAB; a GDPR-inspired overhaul has been tabled in the Legislative Assembly. | PRODHAB | 5 Sept 2011 |
| Cuba | Americas | Ley 149/2022 de Protección de Datos PersonalesIn force 180 days after publication (25 August 2022); oversight lies with the Ministry of Justice, with no independent authority. | MINJUS | 21 Feb 2023 |
| Ecuador | Americas | Ley Orgánica de Protección de Datos Personales (LOPDP)GDPR-inspired law with sanctions applicable since May 2023; since 2025 the Superintendency has issued implementing rules (transfers, DPOs, legitimate interest). | SPDP | 26 May 2021 |
| Jamaica | Americas | Data Protection Act, 2020GDPR-inspired Act fully applicable since 1 December 2023; controller registration is governed by 2024 regulations. | OIC | 1 Dec 2023 |
| Mexico | Americas | Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP 2025)The 2025 law replaces the 2010 one; the autonomous INAI was abolished and private-sector oversight moved to the SABG, a federal government ministry. | SABG | 21 Mar 2025 |
| Nicaragua | Americas | Ley 787 de Protección de Datos PersonalesIn force since its 2012 publication, but the Data Protection Directorate planned within the Finance Ministry was never set up, leaving the law largely unenforced. | — | 29 Mar 2012 |
| Panama | Americas | Ley 81 de 2019 sobre Protección de Datos PersonalesIn force two years after enactment; ANTAI, the transparency authority, oversees it. | ANTAI | 29 Mar 2021 |
| Peru | Americas | Ley N° 29733, Ley de Protección de Datos PersonalesA new implementing regulation (Supreme Decree 016-2024-JUS), in force since 30 March 2025, brings the regime closer to the GDPR (DPOs, breach notification). | ANPD | 4 Jul 2011 |
| Dominican Republic | Americas | Ley 172-13 sobre Protección de Datos de Carácter PersonalNo general supervisory authority (the Superintendency of Banks oversees credit bureaus); a reform creating a national authority is being debated in Congress. | — | 13 Dec 2013 |
| Saint Lucia | Americas | Data Protection Act (No. 11 of 2011)Partly in force since 31 January 2023 (principles and controller obligations); the provisions creating the Data Protection Commissioner have not commenced. | — | 31 Jan 2023 |
| El Salvador | Americas | Ley para la Protección de Datos Personales (Decreto Legislativo N° 144)Passed on 12 November 2024 and in force eight days after publication (15 November); oversight lies with the State Cybersecurity Agency, whose director is appointed by the President. | ACE | 23 Nov 2024 |
| Uruguay | Americas | Ley 18.331 de Protección de Datos Personales y Acción de Habeas DataRecognised as adequate by the European Commission (EU) since 2012; first non-European State to accede to Council of Europe Convention 108 (2013). | URCDP | 18 Aug 2008 |
| Saudi Arabia | Asia | Loi sur la protection des données personnelles (PDPL, décret royal M/19 de 1443 H)PDPL amended in March 2023, in force on 14 September 2023 with a one-year compliance period to 14 September 2024; implementing and transfer regulations adopted; enforced by SDAIA. | SDAIA | 14 Sept 2023 |
| Armenia | Asia | Loi sur la protection des données personnelles (HO-49-N)Supervised by the Personal Data Protection Agency of the Ministry of Justice; law amended in December 2025 and May 2026; list of countries with adequate protection set by the Agency in 2024. | PDPA | 1 Jul 2015 |
| Azerbaijan(to be verified) | Asia | Loi n° 998-IIIQ sur les données personnellesLaw of 11 May 2010; no independent authority: oversight lies mainly with the Ministry of Digital Development and Transport, which also licenses personal data information resources. | MDDT | 6 Jun 2010 |
| Bahrain | Asia | Loi n° 30 de 2018 sur la protection des données personnelles (PDPL)Ten implementing resolutions issued in 2022; the Authority’s functions are exercised on an interim basis by the Ministry of Justice, Islamic Affairs and Waqf (Decree No. 78 of 2019). | PDPA | 1 Aug 2019 |
| Bangladesh(to be verified) | Asia | Loi de 2026 sur la protection des données personnelles (loi n° 63 de 2026)Act of 10 April 2026 replacing the 2025 ordinance, deemed in force from 6 November 2025; complaints, fines and compensation (ss. 31-35) will apply by notification, at the earliest 18 months later. | National Data Management Authority | 6 Nov 2025 |
| Brunei | Asia | Ordonnance de 2025 sur la protection des données personnelles (PDPO)Order enacted on 8 January 2025, with substantive obligations applying since 1 January 2026; covers the private sector, not government agencies; AITI administers and enforces it. | AITI | 1 Jan 2026 |
| China | Asia | Loi sur la protection des informations personnelles (PIPL)The PIPL works alongside the Cybersecurity Law (amended from 1 January 2026) and the Data Security Law; transfer certification since 2026. It does not apply in Hong Kong or Macao. | CAC | 1 Nov 2021 |
| South Korea | Asia | Loi sur la protection des informations personnelles (PIPA)EU · European Commission adequacy decision of 17 December 2021; March 2026 reform, in force on 11 September 2026, raises the maximum fine to 10% of revenue in some cases. | PIPC | 30 Sept 2011 |
| United Arab Emirates | Asia | Décret-loi fédéral n° 45 de 2021 sur la protection des données personnelles (PDPL)Executive regulations still pending at end-2025; free zones have their own regimes: DIFC (Law No. 5 of 2020), ADGM (2021 Regulations) and DHCC, each with its own authority. | UAE Data Office | 2 Jan 2022 |
| Georgia | Asia | Loi du 14 juin 2023 sur la protection des données personnellesGDPR-inspired law; since 2 March 2026 supervision lies with the State Audit Office, which replaced the Personal Data Protection Service (Law No. 1289 of 17 December 2025). | SAO | 1 Mar 2024 |
| Hong Kong | Asia | Ordonnance sur les données personnelles (vie privée) (PDPO, Cap. 486)Own regime of the Special Administrative Region, separate from mainland China; doxxing offence added in 2021; the announced reform (breach notification, fines) has not been enacted. | PCPD | 20 Dec 1996 |
| Indonesia | Asia | Loi n° 27 de 2022 sur la protection des données personnelles (UU PDP)Fully applicable since 17 October 2024; implementing Government Regulation No. 33/2026 signed on 16 July 2026, applicable mid-January 2027; the planned agency does not exist yet, Komdigi acts in the interim. | Komdigi | 17 Oct 2022 |
| Israel(to be verified) | Asia | Loi sur la protection de la vie privée 5741-1981Amendment No. 13 in force on 14 August 2025 (stronger enforcement powers for the authority); EU · European Commission adequacy decision of 2011, confirmed in January 2024. | PPA | 1981 |
| Japan | Asia | Loi sur la protection des informations personnelles (APPI, loi n° 57 de 2003)Mutual adequacy with the EU · European Commission since 2019; triennial-review reform passed on 10 July 2026 and promulgated on 17 July, application dates to be set. | PPC | 1 Apr 2005 |
| Jordan(to be verified) | Asia | Loi n° 24 de 2023 sur la protection des données personnellesLaw in force six months after publication in the Official Gazette (September 2023); a Personal Data Protection Council and a directorate of the Ministry of Digital Economy oversee it. | MoDEE | 17 Mar 2024 |
| Kazakhstan(to be verified) | Asia | Loi n° 94-V sur les données personnelles et leur protectionLaw No. 326-VIII of 24 June 2026: breach notification, registers, limits on automated decisions and higher fines, mostly in force since 25 August 2026; the 2026 Digital Code does not replace the law. | Information Security Committee | 26 Nov 2013 |
| Kyrgyzstan | Asia | Code numérique de la République kirghize (n° 178)The Digital Code (No. 178 of 31 July 2025) replaced the 2008 Law No. 58 on Personal Information on 5 February 2026; fines under the Code of Offences apply since November 2025. | State Agency for Personal Data Protection | 5 Feb 2026 |
| Laos(to be verified) | Asia | Loi n° 25/NA sur la protection des données électroniques2017 law limited to data in electronic form, supplemented by a 2018 implementing instruction; overseen by the Ministry of Technology and Communications. | MTC | 2017 |
| Lebanon(to be verified) | Asia | Loi n° 81 du 10 octobre 2018 sur les transactions électroniques et les données à caractère personnelNo independent authority: the Ministry of Economy and Trade handles notifications and permit requests; enforcement goes through the courts. | MoET | January 2019 |
| Macao | Asia | Loi n° 8/2005 sur la protection des données personnellesOwn regime of the Special Administrative Region, separate from mainland China, modelled on Portugal’s 1998 law; the authority became a full bureau in 2023 (Administrative Regulation No. 42/2023). | DSPDP | February 2006 |
| Malaysia | Asia | Loi de 2010 sur la protection des données personnelles (PDPA, Act 709)2024 Amendment Act phased in during 2025: data protection officer, breach notification, portability, revised transfer rules; covers commercial processing by the private sector. | JPDP | 15 Nov 2013 |
| Mongolia | Asia | Loi sur la protection des données personnelles (2021)Law of 17 December 2021; oversight by the National Human Rights Commission and the digital ministry; in 2026 the UN · Special Rapporteur on privacy recommended an independent authority. | NHRCM | 1 May 2022 |
| Nepal(to be verified) | Asia | Loi de 2075 (2018) sur la vie privée individuelle (Individual Privacy Act)2018 Act supplemented by 2020 regulations; no dedicated supervisory authority; 2025 directives on data centres and cloud services add to the framework. | — | 18 Sept 2018 |
| Oman | Asia | Loi sur la protection des données personnelles (décret royal n° 6/2022)Decree published on 13 February 2022, in force one year later; executive regulation adopted in 2024; overseen by the Ministry of Transport, Communications and Information Technology. | MTCIT | 13 Feb 2023 |
| Uzbekistan | Asia | Loi n° ZRU-547 sur les données personnellesLaw ZRU-1125 of 26 March 2026 limits localisation to biometric, genetic and telecom subscriber data; a list of 49 adequate countries followed (Resolution No. 415 of 29 July 2026). | Migration and Personalization Department | 1 Oct 2019 |
| Philippines | Asia | Loi de 2012 sur la confidentialité des données (Data Privacy Act, RA 10173)The National Privacy Commission, set up in 2016 with the implementing rules, supervises and enforces; several amendment bills are pending in Congress. | NPC | 8 Sept 2012 |
| Qatar(to be verified) | Asia | Loi n° 13 de 2016 sur la protection de la vie privée et des données personnellesFirst general data protection law in the Gulf, supplemented by National Cyber Security Agency guidelines; the Qatar Financial Centre (QFC) has its own regulations and authority. | NCSA | 2016 |
| Singapore | Asia | Loi de 2012 sur la protection des données personnelles (PDPA)Obligations in force since 2 July 2014; 2020 reform: breach notification, fines up to 10% of local turnover; the public sector follows separate rules. | PDPC | 2 Jul 2014 |
| Tajikistan(to be verified) | Asia | Loi n° 1537 sur la protection des données personnellesLaw No. 1537 of 3 August 2018; no independent authority: oversight lies with a government body, the Communications Service under the Government. | Communications Service | 2018 |
| Taiwan | Asia | Loi sur la protection des données personnelles (PDPA)Own regime, separate from mainland China; reform promulgated on 11 November 2025, not yet in force, will make the Commission (still being set up) the sole authority; meanwhile sector ministries supervise. | PDPC | 1 Oct 2012 |
| Thailand(to be verified) | Asia | Loi B.E. 2562 (2019) sur la protection des données personnelles (PDPA)Enacted on 28 May 2019, postponed twice and fully applicable since 1 June 2022; the Committee, under the Ministry of Digital Economy and Society, has imposed fines since 2024. | PDPC | 1 Jun 2022 |
| Turkmenistan(to be verified) | Asia | Loi n° 519-V sur l’information relative à la vie privée et sa protectionLaw No. 519-V of 20 March 2017; no dedicated authority: general oversight rests with the Prosecutor General’s Office, and data subjects may go directly to court. | — | 1 Jul 2017 |
| Türkiye | Asia | Loi n° 6698 sur la protection des données personnelles (KVKK)Law No. 7499 of March 2024 recast international transfers on the GDPR model (adequacy, standard clauses, BCRs), in force since 1 June 2024; no adequacy decision from the EU · European Commission. | KVKK | 7 Apr 2016 |
| Vietnam(to be verified) | Asia | Loi n° 91/2025/QH15 sur la protection des données personnellesLaw passed on 26 June 2025, replacing Decree No. 13/2023 (in force since 1 July 2023); implementing Decree No. 356/2025; overseen by the Ministry of Public Security (A05). | A05 | 1 Jan 2026 |
| Albania | Europe | Loi n° 124/2024 sur la protection des données personnelles (Ligji nr. 124/2024 « Për mbrojtjen e të dhënave personale »)New GDPR-aligned law in force since February 2025 (some obligations from 17 January 2027); replaces the 2008 law. | IDP | 1 Feb 2025 |
| Germany | Europe | RGPD et Bundesdatenschutzgesetz (BDSG) du 30 juin 2017Pioneer: Hesse passed the world’s first data protection law in 1970; oversight is shared between the BfDI and the Länder authorities. | BfDI | 25 May 2018 |
| Andorra | Europe | Llei 29/2021, du 28 octobre, qualificada de protecció de dades personals (LQPD)GDPR-aligned law replacing the 2003 act; European Commission adequacy decision since 2010. | APDA | 17 May 2022 |
| Austria | Europe | RGPD et Datenschutzgesetz (DSG), modifiée par le Datenschutz-Anpassungsgesetz 2018First law in 1978; data protection is a constitutional-rank fundamental right (s. 1 DSG). | DSB | 25 May 2018 |
| Belgium | Europe | RGPD et loi du 30 juillet 2018 relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnelFirst law in 1992; since 2018 the APD has replaced the former Privacy Commission. | APD / GBA | 5 Sept 2018 |
| Belarus | Europe | Loi n° 99-Z du 7 mai 2021 « Sur la protection des données personnelles »First comprehensive law, in force since 15 November 2021; the country is not a Council of Europe member. | NPDPC | 15 Nov 2021 |
| Bosnia and Herzegovina(to be verified) | Europe | Loi sur la protection des données personnelles (Zakon o zaštiti ličnih podataka, Službeni glasnik BiH n° 12/25)New GDPR-aligned law applicable since October 2025 (210 days after entry into force); replaces the 2006 law. | AZLP | 4 Oct 2025 |
| Bulgaria | Europe | RGPD et loi sur la protection des données personnelles (Закон за защита на личните данни), modifiée en 2019First law in 2002; amended in 2019 to implement the GDPR. | CPDP | 2 Mar 2019 |
| Cyprus | Europe | RGPD et loi 125(I)/2018 sur la protection des personnes physiques à l’égard du traitement des données à caractère personnelFirst law in 2001; Law 125(I)/2018 implements the GDPR. | Commissioner | 31 Jul 2018 |
| Croatia | Europe | RGPD et Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/2018)First law in 2003; GDPR implementing act applicable since 25 May 2018. | AZOP | 25 May 2018 |
| Denmark | Europe | RGPD et Databeskyttelsesloven (lov nr. 502 du 23 mai 2018)Among Europe’s first laws (1978); the Data Protection Act has supplemented the GDPR since 2018. | Datatilsynet | 25 May 2018 |
| Spain | Europe | RGPD et Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD)First law in 1992 (LORTAD); the 2018 LOPDGDD adds “digital rights”. | AEPD | 7 Dec 2018 |
| Estonia | Europe | RGPD et Isikuandmete kaitse seadus (loi de 2018 sur la protection des données personnelles)First law in 1996; the 2018 act has supplemented the GDPR since January 2019. | AKI | 15 Jan 2019 |
| Finland | Europe | RGPD et Tietosuojalaki (1050/2018)First law in 1987; the Data Protection Act has supplemented the GDPR since 1 January 2019. | Tietosuojavaltuutettu | 1 Jan 2019 |
| France | Europe | RGPD (règlement (UE) 2016/679) et loi n° 78-17 du 6 janvier 1978 « Informatique et libertés »National law since 1978; GDPR applicable since 2018. | CNIL | 25 May 2018 |
| Greece | Europe | RGPD et loi 4624/2019First law in 1997; Law 4624/2019 implements the GDPR. | HDPA | 29 Aug 2019 |
| Hungary | Europe | RGPD et loi CXII de 2011 sur l’autodétermination informationnelle et la liberté de l’information (Infotv.)First law in 1992; the 2011 Info Act, adapted to the GDPR in 2018, also covers freedom of information. | NAIH | 26 Jul 2018 |
| Ireland | Europe | RGPD et Data Protection Act 2018First law in 1988; the DPC is lead authority for many large digital platforms. | DPC | 25 May 2018 |
| Iceland | Europe | RGPD (via l’accord EEE) et loi n° 90/2018 sur la protection des données (Lög um persónuvernd og vinnslu persónuupplýsinga)EEA member: the GDPR applies through the EEA Agreement, implemented by Act 90/2018. | Persónuvernd | 15 Jul 2018 |
| Italy | Europe | RGPD et Codice in materia di protezione dei dati personali (D.Lgs. 196/2003), modifié par le D.Lgs. 101/2018First law in 1996; the 2003 Code was adapted to the GDPR in 2018. | Garante | 19 Sept 2018 |
| Kosovo | Europe | Loi n° 06/L-082 sur la protection des données personnelles2019 GDPR-inspired law replacing the 2010 act; the AIP also oversees access to public documents. | AIP | 12 Mar 2019 |
| Latvia | Europe | RGPD et Fizisko personu datu apstrādes likums (loi de 2018 sur le traitement des données personnelles)First law in 2000; the 2018 act supplements the GDPR. | DVI | 5 Jul 2018 |
| Liechtenstein | Europe | RGPD (via l’accord EEE) et Datenschutzgesetz (DSG) du 4 octobre 2018EEA member: the GDPR applies through the EEA Agreement, supplemented by the 2018 DSG. | DSS | 1 Jan 2019 |
| Lithuania | Europe | RGPD et Asmens duomenų teisinės apsaugos įstatymas (loi sur la protection juridique des données personnelles, refondue en 2018)First law in 1996; recast in 2018 to implement the GDPR. | VDAI | 16 Jul 2018 |
| Luxembourg | Europe | RGPD et loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des donnéesFirst law in 1979; the 2018 act reorganises the CNPD and implements the GDPR. | CNPD | 20 Aug 2018 |
| North Macedonia | Europe | Loi sur la protection des données personnelles (Journal officiel n° 42/2020, modifiée)GDPR-aligned law adopted in 2020, fully applicable since August 2021; first law in 2005. | AZLP | 24 Aug 2021 |
| Malta | Europe | RGPD et Data Protection Act (Cap. 586)First law in 2001; the Data Protection Act (Cap. 586) implements the GDPR. | IDPC | 28 May 2018 |
| Moldova(to be verified) | Europe | Loi n° 195/2024 sur la protection des données à caractère personnel (Legea nr. 195/2024 privind protecția datelor cu caracter personal)New GDPR-aligned law applicable since 23 August 2026; replaces Law No. 133/2011. | CNPDCP | 23 Aug 2026 |
| Monaco | Europe | Loi n° 1.565 du 3 décembre 2024 relative à la protection des données personnellesNew GDPR-aligned law replacing the 1993 act; the APDP succeeds the CCIN. | APDP | 14 Dec 2024 |
| Montenegro | Europe | Loi sur la protection des données personnelles de 2008 (Zakon o zaštiti podataka o ličnosti, Službeni list CG n° 79/08, modifiée)2008 law still applicable; a new GDPR-aligned law (Official Gazette No. 133/26) will apply from 19 March 2027. | AZLP | 31 Dec 2008 |
| Norway | Europe | RGPD (via l’accord EEE) et Personopplysningsloven (LOV-2018-06-15-38)First law in 1978; as an EEA member, the GDPR applies through the 2018 act. | Datatilsynet | 20 Jul 2018 |
| Netherlands | Europe | RGPD et Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)First law in 1988; the UAVG has implemented the GDPR since 25 May 2018. | AP | 25 May 2018 |
| Poland | Europe | RGPD et Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowychFirst law in 1997; the 2018 act implements the GDPR and creates the UODO. | UODO | 25 May 2018 |
| Portugal | Europe | RGPD et Lei n.º 58/2019, de 8 de agostoThe 1976 Constitution already protects personal data (art. 35); first law in 1991. | CNPD | 9 Aug 2019 |
| Romania | Europe | RGPD et Legea nr. 190/2018First law in 2001; Law 190/2018 implements the GDPR. | ANSPDCP | 31 Jul 2018 |
| United Kingdom | Europe | UK GDPR et Data Protection Act 2018, modifiés par le Data (Use and Access) Act 2025First law in 1984; the ICO became the Information Commission on 30 September 2026; EU adequacy renewed until 2031. | ICO | 25 May 2018 |
| Russia | Europe | Loi fédérale n° 152-FZ du 27 juillet 2006 « Sur les données personnelles »2006 law tightened many times, with mandatory localisation of Russian citizens’ data since 2015. | Roskomnadzor | 26 Jan 2007 |
| San Marino(to be verified) | Europe | Legge 21 dicembre 2018 n. 171 sur la protection des personnes physiques à l’égard du traitement des données personnelles2018 GDPR-aligned law replacing the 1995 act; ratification of Convention 108+ approved in 2023. | Garante | 5 Jan 2019 |
| Serbia | Europe | Zakon o zaštiti podataka o ličnosti (Službeni glasnik RS n° 87/2018)GDPR-aligned law applicable since August 2019; a draft new law went to public consultation in 2026. | Poverenik | 21 Aug 2019 |
| Slovakia | Europe | RGPD et Zákon č. 18/2018 Z. z. o ochrane osobných údajovFirst law in 1998; Act 18/2018 supplements the GDPR. | ÚOOÚ SR | 25 May 2018 |
| Slovenia | Europe | RGPD et Zakon o varstvu osebnih podatkov (ZVOP-2)ZVOP-2, in force since 2023, finally supplements the GDPR and replaces the 2004 ZVOP-1. | IP | 26 Jan 2023 |
| Sweden | Europe | RGPD et Dataskyddslagen (SFS 2018:218)World’s first national data protection law (Datalag, 1973); the Data Protection Act has supplemented the GDPR since 2018. | IMY | 25 May 2018 |
| Switzerland | Europe | Loi fédérale du 25 septembre 2020 sur la protection des données (LPD)Revised act in force since 1 September 2023 (first federal act in 1992); European Commission adequacy decision since 2000. | PFPDT | 1 Sept 2023 |
| Czechia | Europe | RGPD et Zákon č. 110/2019 Sb., o zpracování osobních údajůAct 110/2019 supplements the GDPR and replaces Act 101/2000. | ÚOOÚ | 24 Apr 2019 |
| Ukraine | Europe | Loi n° 2297-VI du 1er juin 2010 « Sur la protection des données personnelles »2010 law in force; a GDPR-aligned bill (No. 8153), passed at first reading in 2024, awaits its second reading. | Ombudsman | 1 Jan 2011 |
| Australia | Oceania | Privacy Act 1988 (Cth)A first reform (Privacy and Other Legislation Amendment Act 2024) created a statutory tort for serious invasions of privacy and mandated a children's code; a second tranche is still pending. | OAIC | 1 Jan 1989 |
| New Zealand | Oceania | Privacy Act 2020Recognised as adequate by the European Commission (EU) since 2012; since 1 May 2026 the Privacy Amendment Act 2025 requires notifying people whose data is collected indirectly. | OPC | 1 Dec 2020 |
| Vanuatu(to be verified) | Oceania | Data Protection and Privacy Act No. 13 of 2024In force since 2 January 2025; oversight lies with a Deputy Commissioner of the Digital Safety Authority (Act No. 15 of 2024), which is not yet operational. | — | 2 Jan 2025 |
Countries where a law is being prepared
In these countries, a bill has been tabled, passed but not yet promulgated, or is awaiting its implementing rules. For businesses, this is the category to watch: a contract signed today will be performed tomorrow under a law that does not exist yet.
| Country | Continent | Law (official text) | Regulator | In force since |
|---|---|---|---|---|
| Burundi | Africa | Loi n° 1/03 du 10 mars 2026 portant protection des données à caractère personnelFirst general law, in force since its promulgation on 10 March 2026, but the data protection agency still awaits its establishing decree. | — | 10 Mar 2026 |
| Cameroon | Africa | Loi n° 2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au CamerounLaw of 23 December 2024 applicable since 23 June 2026 (end of the 18-month transition), but the APDP still awaits its organisational decree. | — | 23 Jun 2026 |
| Comoros(to be verified) | Africa | Loi n° 14-029/AU du 26 juin 2014 portant protection des données à caractère personnelLaw adopted on 26 June 2014 with no confirmed promulgation, and the planned supervisory commission has never been set up. | — | 26 Jun 2014 |
| Djibouti(to be verified) | Africa | Loi n° 019/AN/23/9ème L portant Code numérique (Livre premier : protection des données à caractère personnel)Digital Code promulgated on 6 July 2025 and published in the Official Journal on 18 September 2025; the CNDP it creates has not yet been set up. | — | 18 Sept 2025 |
| Guinea | Africa | Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel en République de GuinéeLaw in force since 2016, but the data protection authority it provides for has never been set up. | — | 28 Jul 2016 |
| Equatorial Guinea(to be verified) | Africa | Ley Núm. 1/2016, de 22 de julio, de Protección de Datos Personales2016 law, but the supervisory body (Órgano Rector) it provides for has never been set up. | — | 2016 |
| Lesotho | Africa | Data Protection Act, 2011 (Act No. 5 of 2012)Act in force since 2012, but the Data Protection Commission it provides for has never been set up (confirmed by the ministry in April 2026). | — | 22 Feb 2012 |
| Liberia(to be verified) | Africa | Data Protection Act (2026)The signing of the Data Protection Act was announced on 19 August 2026 by the Posts and Telecommunications Minister, but the text is unpublished, its commencement unknown and no authority set up. | — | 19 Aug 2026 |
| Mozambique | Africa | Proposta de Lei de Protecção de Dados PessoaisNo general law: the bill approved by the Council of Ministers on 3 March 2026 is on the Assembly of the Republic's agenda and would give oversight to the ICT regulator (INTIC). | — | 3 Mar 2026 |
| Namibia | Africa | —No general law: the Data Protection Bill, with consultations closed, awaits Cabinet review and has not been tabled in Parliament. | — | 27 Jan 2026 |
| Niger | Africa | Loi n° 2022-59 du 16 décembre 2022 relative à la protection des données à caractère personnelThe 2022 law (repealing the 2017 law) remains in force, but the HAPDP was dissolved on 8 June 2026 (Decree No. 2026-310/PRN/PM) and its duties handed to the Justice and Interior ministries. | — | 8 Jun 2026 |
| Central African Republic | Africa | Loi n° 24.001 du 25 janvier 2024 portant protection des données à caractère personnelLaw in force on promulgation, but the planned protection agency has not been created; the digital economy ministry acts in the interim. | — | 25 Jan 2024 |
| Democratic Republic of the Congo | Africa | Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numériqueDigital Code in force since 13 March 2023, but the APD has not been created; telecom regulator ARPTC acts in the interim (decision of 11 September 2025). | — | 11 Sept 2025 |
| Sierra Leone | Africa | Data Protection and Right to Access Information Bill, 2025No general law: on 21 April 2026 Cabinet approved a national policy and a bill that would make the RAIC the data protection authority. | — | 21 Apr 2026 |
| Belize(to be verified) | Americas | Data Protection Act, 2021 (Act No. 45 of 2021)GDPR-inspired Act gazetted on 30 November 2021 but never brought into force: no ministerial commencement order and no Data Protection Commissioner to date. | — | 30 Nov 2021 |
| Bolivia(to be verified) | Americas | Proyecto de Ley de Protección de Datos Personales (PL 538/2025-2026)No general law, only the constitutional privacy protection action applies; a bill (PL 538/2025-2026) is under consideration in the Chamber of Deputies. | — | 2026 |
| Grenada(to be verified) | Americas | Data Protection Act, 2023 (No. 1 of 2023)Assented in May 2023, but commencement depends on a Prime Minister's order not found to date; the planned Information Commission is not in place. | — | 10 May 2023 |
| Guatemala | Americas | Iniciativa 6464 (protección de datos personales y derechos digitales)No general law (only the 2008 Access to Information Act protects data held by the State); Initiative 6464 is under committee review in Congress. | — | 16 Jul 2026 |
| Guyana(to be verified) | Americas | Data Protection Act 2023 (Act No. 18 of 2023)Assented on 16 August 2023; a Data Protection Commissioner was appointed in early 2026, but the commencement order has yet to be issued. | — | 2026 |
| Honduras(to be verified) | Americas | Anteproyecto de Ley de Protección de Datos Personales (IAIP)No general law, only constitutional habeas data applies; the Institute for Access to Public Information (IAIP) presented a draft bill to lawmakers in 2024, still not voted on. | — | 25 Sept 2024 |
| Paraguay | Americas | Ley N° 7593/2025 de Protección de Datos PersonalesFirst general law, enacted on 27 November 2025 and applicable 24 months after publication (late November 2027); it creates a National Data Protection Agency attached to MITIC. | — | 27 Nov 2025 |
| Saint Kitts and Nevis(to be verified) | Americas | Data Protection Act, 2018 (No. 5 of 2018)Published in June 2018 but never brought into force for lack of a ministerial order; oversight would fall to the Information Commissioner. | — | 7 Jun 2018 |
| Suriname(to be verified) | Americas | Ontwerp Wet Bescherming Privacy en PersoonsgegevensNo general law; a GDPR-inspired bill creating an independent commissioner has been on the National Assembly website since 2020, with no known adoption. | — | 2020 |
| Trinidad and Tobago(to be verified) | Americas | Data Protection Act, 2011 (Chap. 22:04)Only partly proclaimed (2012, 2021): controller obligations and penalties are not in force and no Information Commissioner has been appointed. | — | 23 Aug 2021 |
| Cambodia(to be verified) | Asia | Projet de loi sur la protection des données personnellesDraft by the Ministry of Post and Telecommunications, last consulted in July 2025, not enacted as of early 2026; only a 2021 sub-decree covers Interior Ministry identification data. | — | July 2025 |
| India(to be verified) | Asia | Loi de 2023 sur la protection des données personnelles numériques (DPDP Act)Act of 11 August 2023; Rules notified on 13 November 2025: Data Protection Board set up at once (members still being appointed in 2026), consent managers from 13 November 2026, core obligations from 13 May 2027. | DPBI | 13 Nov 2025 |
| Pakistan(to be verified) | Asia | Projet de loi sur la protection des données personnelles (2023)Bill from the Ministry of IT and Telecommunication, still not enacted in early 2026; the 2016 Prevention of Electronic Crimes Act (PECA), amended in 2025, penalises some misuse. | — | 2023 |
| Sri Lanka | Asia | Loi n° 9 de 2022 sur la protection des données personnelles, modifiée par la loi n° 22 de 2025 (PDPA)Only the provisions on the Authority are in force; the October 2025 amendment removed the timetable: core obligations await a ministerial order, not issued as of early 2026. | DPA | 31 Oct 2025 |
| Kiribati(to be verified) | Oceania | Data Protection Act 2025Act passed in 2025, the country's first of its kind; it takes effect on a date set by the Minister, not yet confirmed, and gives oversight to the Digital Transformation Office. | — | 2025 |
| Papua New Guinea | Oceania | Data Governance and Data Protection Bill 2026 (projet)No general law; a data governance and data protection bill, stemming from the 2024 national policy, is under public consultation in 2026. | — | 2026 |
| Tonga(to be verified) | Oceania | Privacy Act 2025 (Act 34 of 2025)Passed on 6 August 2025 and assented on 16 December 2025; it will take effect on a date proclaimed by Cabinet and create a Privacy Commission, not yet established. | — | 16 Dec 2025 |
Countries without a general law
These countries have no general personal data law, although sector rules (health, banking, telecoms) may apply. The best-known case is the United States: no general federal law, but twenty-three states with a general law of their own, nineteen of them in force, according to the IAPP’s September 2026 count (international · IAPP).
| Country | Continent | Law (official text) | Regulator | In force since |
|---|---|---|---|---|
| Eritrea | Africa | —No data protection law or authority. | — | — |
| Guinea-Bissau | Africa | —No general law or authority; a bill creating a data protection agency is being prepared. | — | — |
| Libya | Africa | —No general law or authority; only Law No. 6 of 2022 on electronic transactions partly covers personal data. | — | — |
| Sudan | Africa | —No general law or authority; only sectoral texts (2007 electronic transactions, cybercrime) touch on personal data. | — | — |
| South Sudan | Africa | —No general law or authority; a first bill was announced in December 2025 for 2026. | — | — |
| Dominica | Americas | —No general data protection law; a harmonised framework is being studied within the Organisation of Eastern Caribbean States (OECS). | — | — |
| United States | Americas | —No general federal law: according to the IAPP (8 September 2026), 23 states have passed a comprehensive law, 19 of them in force on 29 October 2026, while federal rules remain sectoral (HIPAA for health, COPPA for children, GLBA for finance). The FTC is not a data protection authority: it polices unfair or deceptive practices and enforces COPPA; EU transfers rely on the Data Privacy Framework (adequacy of 10 July 2023). | FTC | — |
| Haiti(to be verified) | Americas | —No general law or authority: a 2018 decree sets rules on personal data, and the 2020 Penal Code, whose entry into force remains uncertain, criminalises some breaches. | — | — |
| Saint Vincent and the Grenadines(to be verified) | Americas | —No general law: the Privacy Act 2003, limited to public authorities, has never been brought into force for lack of a ministerial order. | — | — |
| Venezuela | Americas | —No general law or authority: the 1999 Constitution enshrines habeas data and a few sectoral laws (computer crime, telecommunications) protect some data. | — | — |
| Afghanistan | Asia | —No general data protection law or supervisory authority identified. | — | — |
| Bhutan | Asia | —No general law; some privacy and data provisions in the Information, Communications and Media Act 2018 and the National Digital Identity Act 2023. | — | — |
| Myanmar | Asia | —No general law or authority; scattered protections in the 2017 Law Protecting the Privacy and Security of Citizens, the Telecommunications Law and the 2025 Cybersecurity Law. | — | — |
| North Korea | Asia | —No general data protection law or supervisory authority; the Constitution only guarantees inviolability of the home and privacy of correspondence. | — | — |
| Iraq | Asia | —No general data protection law or dedicated authority; the 2005 Constitution protects privacy and sector rules apply. | — | — |
| Iran | Asia | —No general law; a 2018 draft data protection bill has not been enacted; scattered provisions (e-commerce, cybercrime). | — | — |
| Kuwait | Asia | —No general law; the CITRA Data Privacy Protection Regulation (Decision No. 26 of 2024) binds telecom and ICT service providers. | — | — |
| Maldives(to be verified) | Asia | —No general data protection law or dedicated authority according to France · CNIL’s map (February 2026); privacy rests on the Constitution and sector rules. | — | — |
| Palestine | Asia | —No general data protection law or authority; Decree-Law No. 10 of 2018 on cybercrime includes privacy provisions. | — | — |
| Syria(to be verified) | Asia | —No general law or dedicated authority identified; France · CNIL’s map nonetheless lists the country as having a law: to be confirmed. | — | — |
| Timor-Leste | Asia | —No general data protection law or dedicated authority; the country joined ASEAN in October 2025. | — | — |
| Yemen | Asia | —No general data protection law or supervisory authority identified. | — | — |
| Holy See(to be verified) | Europe | —No general law: a 2024 regulation (ad experimentum for three years) covers only the Governorate’s processing, with no independent supervisory authority. | — | — |
| Fiji | Oceania | —No general law; a national data protection policy adopted in 2025 is meant to lead to legislation, prepared with Council of Europe support. | — | — |
| Marshall Islands | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Solomon Islands | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Micronesia (Federated States of) | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Nauru | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Palau | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Samoa | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
| Tuvalu | Oceania | —No general data protection law or supervisory authority; only scattered sectoral provisions apply. | — | — |
The real issue: data flows, not texts
Laws adopted since 2018 often reuse the same building blocks as the GDPR: a legal basis for each processing operation, rights for individuals, a supervisory authority, rules on transfers. The convergence of texts is real. It does not, however, create free movement.
For the European Union, only an adequacy decision allows data to be transferred to a third country without any further authorisation or safeguard. Yet out of the roughly 140 countries with a law outside the European Economic Area, only 16 countries or territories are recognised as adequate, two of them partially (Canada and the United States). In other words, outside Europe, barely more than one country in ten with a law offers a direct route. Everywhere else, transfers need standard contractual clauses, binding corporate rules or a derogation, with an analysis of the destination country’s law.
The movement now runs both ways. Brazil recognised the Union as adequate on the very day the Commission recognised Brazil (Brazil · ANPD). China governs outbound data through the routes set out in the PIPL: a security assessment by the regulator, certification or a standard contract. Adequacy is becoming a two-way agreement, and each country sets its own conditions for data leaving its territory.
Three points to watch
1. A law is not a regulator. A text can exist without an authority in place, without resources or without implementing decrees. Before treating a country as “covered”, check that an authority has been appointed, that it publishes decisions and that it imposes sanctions.
2. Timelines are phased. In India, most obligations will only apply from 13 May 2027. Convention 108+ still needs four more ratifications. A law “in force” may only be partly applicable: record the date of each obligation, not just the date of the text.
3. Adequacy can fall. Decisions are reviewed: the United Kingdom’s had to be renewed in 2025, and South Korea’s passed its first review in July 2026. For the United States, the two previous frameworks were struck down by the Court of Justice (EU · CJEU), in 2015 and again in 2020. Any flow based on adequacy should keep a fallback ready.
What your transfer map must contain
For each personal data flow leaving a country, one table row is enough, provided it fills seven columns:
- The countries involved, including those of sub-processors and remote access (support, maintenance), not only hosting locations.
- The status of each country: law in force, law in preparation or no law, with the date it was checked.
- The competent authority in each country, so you know whom to notify in the event of a data breach.
- The transfer basis: adequacy, standard contractual clauses, binding corporate rules or a derogation, with the reference of the signed document.
- The exit rules of the country of origin: prior assessment, authorisation or declaration required by local law, in China or Côte d’Ivoire for example.
- Deadlines over the next twenty-four months: entry into application, end of a transition period, review of an adequacy decision.
- A fallback plan for each critical flow: back-up clauses, alternative hosting and the time needed to switch.
Having a law is no longer enough: what matters is where your data is allowed to go.
The question to ask on Monday morning
To your data protection officer and your CIO: “For every country where our data is hosted or accessed, do we know which law applies, which authority is competent, and on what basis we transfer it there?”
Frequently asked questions
How many countries have a data protection law?
172 countries by March 2025, according to Graham Greenleaf’s count published by Privacy Laws & Business. The pace is accelerating: an average of 5.4 new laws a year since 2020, against 3.3 since 1973.
Which countries does the European Union recognise as adequate?
Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, the United States (companies in the Data Privacy Framework) and Uruguay, plus the European Patent Organisation. Data can flow to these destinations without further safeguards.
Does the United States have an equivalent of the GDPR?
No. There is no general federal data protection law. Twenty-three states, including California, have adopted a general law of their own, nineteen of them in force (IAPP, September 2026).
Sources
- France · CNIL — Loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés (texte consolidé)
- UE · Commission européenne — Adequacy decisions (liste à jour, juillet 2026)
- Europe · Conseil de l’Europe — Comité de la Convention 108, rapport abrégé de la 66e réunion du Bureau (septembre 2026)
- Afrique · Union africaine — Convention sur la cybersécurité et la protection des données à caractère personnel (Malabo, 2014)
- Chine · Assemblée populaire nationale — Loi sur la protection des informations personnelles, 2021 (traduction DigiChina, Stanford)
- Inde · MeitY — Digital Personal Data Protection Act 2023 et règles de 2025
- Royaume-Uni · Privacy Laws & Business — G. Greenleaf, « 172 Countries with Data Privacy Laws – Year by Year 1973-2025 » (juin 2025)
- International · IAPP — US State Privacy Legislation Tracker (mise à jour du 8 septembre 2026)
KeywordsData protectionGDPRCNILAdequacyInternational transfers
Analysis article; it is neither legal advice nor an investment recommendation.