Country Directory

Within each listing, if available, there will be links to the DPA, privacy legislation and relevant resources.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Afghanistan.

Additional Resources

• Asia topic page
• Middle East topic page

Data Protection Authority

• The Data Inspectorate on Aland

Privacy Legislation

• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Information and Data Protection Commissioner (IDP)

Privacy Legislation

• Law No. 9887 (2008)
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Algerian Data Protection Authority (ANPDP)

Privacy Legislation

• Law No. 18-07 (2023)

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for American Samoa.

Data Protection Authority

• Andorran Data Protection Authority (APDA)

Privacy Legislation

• Law No. 29/2021
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Agencia de Protecao de Dados (APD)

Privacy Legislation

• Law No. 22/11
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Anguilla.

Data Protection Authority

• The Information Commissioner

Privacy Legislation

• Law No. 10-13

Data Protection Authority

• Argentinean Data Protection Authority (AAIP)

Privacy Legislation

• Act No. 25.326 (2000)
• DPA Regulations Page

Additional Resources

• Latin America topic page

Data Protection Authority

• Personal Data Protection Agency

Privacy Legislation

• Law No. 49-ZR (2015)

Additional Resources

• Europe topic page
• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Aruba.

Data Protection Authority

• Office of the Australian Information Commissioner (OAIC)

Privacy Legislation

• Privacy Act 1988 (Cth) No. 119 1998 and Australian Privacy Principles ("APPs") + sectoral state coverage
• DPA Legislation Page

Additional Resources

• Australia/New Zealand topic page

Data Protection Authority

• Austrian Data Protection Authority (Österreichische Datenschutzbehörde)

Privacy Legislation

• Austria is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministry of Digital Development and Transport

Privacy Legislation

• Law on Personal Information (May 2010)
• Government Legislation Page

Additional Resources

• Europe topic page
• Middle East topic page

Data Protection Authority

• Data Protection Commissioner (DPC)

Privacy Legislation

• Data Protection (Privacy of Personal Information) Act ("DPA") - Link unavailable

Data Protection Authority

• Personal Data Protection Authority

Privacy Legislation

• Law No. 30 of 2018 - Personal Data Protection ("PDPL")

Additional Resources

• Middle East topic page

Data Protection Authority

• Digital Security Agency

Privacy Legislation

• Digital Security Act ("DSA 2018")
• Acts and Rules

Additional Resources

• Asia topic page

Data Protection Authority

• Data Protection Commissioner

Privacy Legislation

• Data Protection Act ("Act")

Data Protection Authority

• National Personal Data Protection Centre (NPDPC)

Privacy Legislation

• Law on Personal Data Protection No. 99-Z (2021)

Additional Resources

• Europe topic page

Data Protection Authority

• Belgian Data Protection Authority

Privacy Legislation

• Belgium is subject to the EU General Data Protection Regulation.
• DPA Publications

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Belize.

Privacy Legislation

• Data Protection Act of 2021 ("Act")

Additional Resources

• Latin America topic page

Data Protection Authority

• Beninese data protection authority (APDP)

Privacy Legislation

• Law No. 2017-20 (2018) on Digital Code and Law No. 2009-09 on Protection of Personally Identifiable Information
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• The Office of the Privacy Commissioner

Privacy Legislation

• PIPA Overview Page

Data Protection Authority

• The Bhutan InfoComm and Media Authority (BICMA)

Privacy Legislation

• ICM Act of Bhutan
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Bolivia.

Additional Resources

• Latin America topic page

Data Protection Authority

• The Commission Supervision Personal Data Protection BES (CBPBES)

Privacy Legislation

• DPA Legislation Page

Data Protection Authority

• Personal Data Protection Agency in Bosnia and Herzegovina

Privacy Legislation

• Law on Protection of Personal Data
• DPA Regulations Page

Additional Resources

• Europe topic page

Data Protection Authority

• Data Protection Commission

Privacy Legislation

• Data Protection Act No. 32 of 2018

Additional Resources

• Africa topic page

Data Protection Authority

• National Data Protection Authority (ANPD)

Privacy Legislation

• Brazilian Data Protection Law ("LGPD"), Federal Law no. 13,709/2018
• DPA Legislation Page

Additional Resources

• Brazil topic page
• Latin America topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for British Virgin Islands.

Privacy Legislation

• Data Protection Act, 2021

Data Protection Authority

• Authority for Info-communications Technology Industry (AITI)

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Brunei Darussalam.

Additional Resources

• Asia topic page

Data Protection Authority

• Commission for Personal Data Protection (CPDP)

Privacy Legislation

• Bulgaria is subject to the EU General Data Protection Regulation.
• Personal Data Protection Act
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Commission de l'Informatique et des Libertes (CIL)

Privacy Legislation

• Act No. 001-2021/AN of 30 March 2021 ("the 2021 Act")
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Burundi.

Additional Resources

• Africa topic page

Data Protection Authority

• National Data Protection Commission (CNPD)

Privacy Legislation

• Law No. 121/IX/2021 of March 17, 2021 ("the 2021 Amendment")
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Cambodia.

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Cameroon.

Additional Resources

• Africa topic page

Data Protection Authority

• Office of Privacy Commissioner (OPC)

Privacy Legislation

• Personal Information Protection and Electronic Documents Act 2000 ("PIPEDA")
• DPA Legislation Page

Additional Resources

• Canada topic page

Data Protection Authority

• Ombudsman

Privacy Legislation

• Data Protection Act
• DPA Resources

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Central African Republic.

Additional Resources

• Africa topic page

Data Protection Authority

• Agence Nationale de Securite Informatique et de Certification Electronique (ANSICE)

Privacy Legislation

• Law No. 007/PR/2015 on Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Chile.

Privacy Legislation

• Law No. 19.628 on the Protection of Private Life 1999

Additional Resources

• Latin America topic page

Data Protection Authority

• No single authority (sectoral regulation.) The PIPL notes that the Cyberspace Administration of China (CAC) is responsible for planning and coordination of personal information protection and related supervision.

Privacy Legislation

• Personal Information Protection Law, 2021 ("PIPL")

Additional Resources

• China topic page
• Asia topic page

Data Protection Authority

• Superintendent of Industry and Commerce (SIC) and Superintendence of Finance ("SOF")

Privacy Legislation

• Statutory Law 1581 of 2012 ("Personal Data Protection Law")

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Comoros.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Cook Islands.

Data Protection Authority

• Agency for the Protection of Individual's Data (PRODHAB)

Privacy Legislation

• Law No. 7975 the Undisclosed Information Law; Law No. 8968 Protection in the Handling of the Personal Data of Individuals
• DPA Regulations Page

Additional Resources

• Latin America topic page

Data Protection Authority

• Autirite de Regulation des Telecomunications de Côte d’Ivoire (ARTCI)

Privacy Legislation

• Law 20133-450 on the Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Croation Personal Data Protection Agency (AZOP)

Privacy Legislation

• Croatia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministry of Justice (MINJUS)

Privacy Legislation

• Law 149/2022 on Personal Data Protection

Additional Resources

• Latin America topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Curaçao.

Privacy Legislation

• Ordinance No. 84

Additional Resources

• Latin America topic page

Data Protection Authority

• Commissioner for the Protection of Personal Data

Privacy Legislation

• Cyprus is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Office for Personal Data Protection (UOOU)

Privacy Legislation

• Czechia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Democratic People's Republic of Korea.

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Democratic Republic of the Congo.

Additional Resources

• Africa topic page

Data Protection Authority

• Danish Data Protection Agency (Datatilsynet)

Privacy Legislation

• Denmark is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Diego Garcia.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Djibouti.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Dominica.

Additional Resources

• Latin America topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for the Dominican Republic.

Privacy Legislation

• Law No. 172-13 on the Comprehensive Protection of Personal Data

Additional Resources

• Latin America topic page

Data Protection Authority

• Superintendencia de Economia Popular y Solidaria (Superintendency)

Privacy Legislation

• Ley Organica de Proteccion de Datos Personales ("Personal Data Protection Law")

Additional Resources

• Latin America topic page

Data Protection Authority

• Data Protection Centre (DPC) - Law not yet operational

Privacy Legislation

• Law 151/2020 on the Protection of Personal Data

Additional Resources

• Africa topic page
• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for El Salvador.

Additional Resources

• Latin America topic page

Data Protection Authority

• Governing Body for the Protection of Personal Data (Law not yet operational)

Privacy Legislation

• Law No. 1/2016 on the Protection of Personal Data (Law not yet operational)

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Eritrea.

Additional Resources

• Africa topic page

Data Protection Authority

• Data Protection Inspectorate (DPI)

Privacy Legislation

• Estonia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Eswatini Communications Commission

Privacy Legislation

• Data Protection Act No. 5 of 2022
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Ethiopia.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• Member-states of the European Union are subject to the EU General Data Protection Regulation.

• Europe topic page
• GDPR topic page

Data Protection Authority

• The Data Protection Authority

Privacy Legislation

• Data Protection Act

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Fiji.

Additional Resources

• Asia topic page

Data Protection Authority

• Office of Data Protection Ombudsman (Ombudsman)

Privacy Legislation

• Finland is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Comission nationale de l'informatique et des libertes (CNIL)

Privacy Legislation

• France is subject to the EU General Data Protection Regulation.
• DPA Official Texts Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for French Guiana.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for French Polynesia.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the French Southern Territories.

Data Protection Authority

• National Commission for the Protection of Personal Data (CNPDCP)

Privacy Legislation

• Law No. 001/2011 on the Protection of Personal Data

Additional Resources

• Africa topic page

Data Protection Authority

• Gambia Public Utilities Regulatory Authority (PURA)

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Gambia (Republic of The).

Additional Resources

• Africa topic page

Data Protection Authority

• Personal Data Protection Service

Privacy Legislation

• Law of Georgia on Personal Data Protection
• DPA Legislation Page

Additional Resources

• Europe topic page
• Middle East topic page

Data Protection Authority

• Federal Commissioner for Data Protection and Freedom of Information (BfDI)

Privacy Legislation

• Germany is subject to the EU General Data Protection Regulation.

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Data Protection Commission (DPC)

Privacy Legislation

• Data Protection Act of 2012
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Gibraltar Regulatory Authority

Privacy Legislation

• Data Protection Act 2004
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Hellenic Data Protection Authority (HDPA)

Privacy Legislation

• Greece is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Datatilsynet (Danish DPA)

Privacy Legislation

• DPA Legislation Page

Data Protection Authority

• Information Commission (not yet established)

Privacy Legislation

• Grenada Data Protection Act, No. 1 of 2023 ("GDPA")

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guadeloupe.

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guam.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guatemala.

Additional Resources

• Latin America topic page

Data Protection Authority

• Office of the Data Protection Authority

Privacy Legislation

• The Data Protection (Bailiwick of Guernsey) Law, 2017
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Guinea.

Privacy Legislation

• Law No. L/2016/037/AN on Cybersecurity and Personal Data Protection
• Regulations Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guinea-Bissau.

Additional Resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Guyana.

Privacy Legislation

• Data Protection Act No. 18/2023

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Haiti.

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Heard Island and McDonald Islands.

Data Protection Authority

• The IAPP is unaware of a data protection authority for Honduras.

Privacy Legislation

• Draft Law on the Protection of Personal Data

Additional Resources

• Latin America topic page

Data Protection Authority

• Office of the Privacy Commissioner for Personal Data

Privacy Legislation

• The Personal Data (Privacy) Ordinance
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• National Authority for Data Protection and Freedom of Information (NAIH)

Privacy Legislation

• Hungary is subject to the EU General Data Protection Regulation.

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Icelandic Data Protection Authority (Personuvernd)

Privacy Legislation

• Iceland is subject to the EU General Data Protection Regulation.
• Act 90/2018 on Privacy and Processing of Personal Data (GDPR implementation)
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Data Protection Board of India (yet to be established.)

Privacy Legislation

• Digital Personal Data Protection Act

Additional Resources

• Asia topic page
• India topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Indonesia.

Privacy Legislation

• Law No. 27 of 2022 regarding Personal Data Protection ("PDPL")

Additional Resources

• Asia topic page

Data Protection Authority

• Regulator - The Ministry of Communications and Information Technology (MICEX)

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Iran (Islamic Republic of).

Additional Resources

• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Iraq.

Additional Resources

• Middle East topic page

Data Protection Authority

• Data Protection Commission (DPC)

Privacy Legislation

• Ireland is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Isle of Man Information Commissioner

Privacy Legislation

• Government Data Protection Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Privacy Protection Authority (PPA)

Privacy Legislation

• Protection of Privacy Law, 5741-1981
• DPA Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority

• Garante per la protezione dei dati personali (GDPD)

Privacy Legislation

• Italy is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Information Commissioner

Privacy Legislation

• Data Protection Act, 2020

Data Protection Authority

• Personal Information Protection Commission (PPC)

Privacy Legislation

• Act on the Protection of Personal Information, No. 57 of 2003, as amended in 2020 ("APPI")
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• Office of the Information Commissioner

Privacy Legislation

• Data Protection (Jersey) Law 2018
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Directorate of Personal Data Protection

Privacy Legislation

• Law No. 24 of 2023 Personal Data Protection Law
• DPA Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority

• Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan ("MDAI")

Privacy Legislation

• Law No. 94-V on Personal Data and its Protection of 21 May 2013

Additional Resources

• Asia topic page

Data Protection Authority

• Office of the Data Protection Commissioner (ODPC)

Privacy Legislation

• Data Protection Act of 2019

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Kiribati.

Data Protection Authority

• Information and Privacy Agency (AIP)

Privacy Legislation

• Law No. 06/L-082 on Personal Data Protection
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• The Communication and Information Technology Regulatory Authority (CITRA)

Privacy Legislation

• DPA Regulations and Decisions

Additional Resources

• Middle East topic page

Data Protection Authority

• State Agency for Protection of Personal Data

Privacy Legislation

• Law of the Kyrgyz Republic "On Personal Information"
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• Ministry of Technology and Communications (MTC)

Privacy Legislation

• The Electronic Data Protection Act 2017
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• Data State Inspectorate (DVI)

Privacy Legislation

• Latvia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Lebanon.

Privacy Legislation

• Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data

Additional Resources

• Middle East topic page

Data Protection Authority

• The Data Protection Commission (yet to be established.)

Privacy Legislation

• Data Protection Act (2011)

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Liberia.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Libya.

Additional Resources

• Africa topic page

Data Protection Authority

• Liechtensteiner Data Protection Authority

Privacy Legislation

• Liechtenstein is subject to the EU General Data Protection Regulation.
• National Laws Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• State Data Protection Inspectorate

Privacy Legislation

• Lithuania is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• National Commission for Data Protection

Privacy Legislation

• Luxembourg is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Personal Data Protection Bureau

Privacy Legislation

• Personal Data Protection Act
• DPA Legislation Page

Additional Resources

• Asia topic page
• China topic page

Data Protection Authority

• The Madagascan Information Commission (yet to be established.)

Privacy Legislation

• Law No. 2014-038 on the Protection of Personal Data

Additional Resources

• Africa topic page

Data Protection Authority

• Malawi Communications Regulatory Authority (MACRA)

Privacy Legislation

• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Jabatan Perlindungan Data Peribadi

Privacy Legislation

• Personal Data Protection Act 2010
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Maldives.

Data Protection Authority

• L’autorite de Protection des Donnees a Caractere Personnel (APDP)

Privacy Legislation

• Law No. 2013-015
• DPA Texts and Decisions

Additional Resources

• Africa topic page

Data Protection Authority

• Office of the Information and Data Protection Commissioner

Privacy Legislation

• Malta is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Marshall Islands.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Martinique.

Data Protection Authority

• Personal Data Protection Authority (yet to be established.)

Privacy Legislation

• Law No. 2017-020

Additional Resources

• Africa topic page

Data Protection Authority

• Data Protection Office

Privacy Legislation

• The Data Protection Act 2017

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Mayotte.

Additional Resources

• Africa topic page

Data Protection Authority

• Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales

Privacy Legislation

• Federal Law on Protection of Personal Data Held by Private Parties
• General Law on Protection of Personal Data in Possession of Obligated Subjects
• DPA Regulations Page

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Micronesia (Federated States of).

Data Protection Authority

• Commission de Contrôle des Informations Nominatives (CCIN)

Privacy Legislation

• Act No. 1.165 on the Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Ministry of Digital Development and Communications

Privacy Legislation

• Law of Mongolia on Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• Agency for Personal Data Protection and Free Access to Information

Privacy Legislation

• Personal Data Protection Law 79/08 and 70/09
• DPA Regulations Page

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Montserrat.

Data Protection Authority

• Moroccan Data Protection Authority (CNDP)

Privacy Legislation

• Law No. 09-08

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Mozambique.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Myanmar.

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Namibia.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Nauru.

Data Protection Authority

• The IAPP is unaware of a data protection authority for Nepal.

Privacy Legislation

• The Privacy Act, 2075 (2018)

Additional Resources

• Asia topic page

Data Protection Authority

• Autoriteit Persoonsgegevens

Privacy Legislation

• The Netherlands (Kingdom of the) is subject to the EU General Data Protection Regulation.

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for New Caledonia.

Data Protection Authority

• Office of the Privacy Commissioner of New Zealand (OPC)

Privacy Legislation

• Privacy Act 2020

Additional Resources

• Australia/New Zealand topic page

Data Protection Authority

• Nicaraguan data protection authority (DIPRODAP) (yet to be established.)

Privacy Legislation

• Law on Personal Data Protection No. 787

Additional Resources

• Latin America topic page

Data Protection Authority

• High Authority for the Protection of Personal Data (HAPDP)

Privacy Legislation

• Law No. 2017-28 of 3 May 2017 on the Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Nigeria Data Protection Commission

Privacy Legislation

• Nigeria Data Protection Act
• DPA Legislation and Resources Page

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Niue.

Data Protection Authority

• Personal Data Protection Agency

Privacy Legislation

• Law on Personal Data Protection 2020
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Northern Mariana Islands.

Data Protection Authority

• Datatilsynet

Privacy Legislation

• Norway is subject to the EU General Data Protection Regulation.
• DPA Regulations Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministry of Transport, Communications and Information Technology

Privacy Legislation

• Royal Decree No. 6 of 2022 Promulgating the Personal Data Protection Law
• DPA Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Pakistan.

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Palau.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Palestinian Territories.

Additional Resources

• Middle East topic page

Data Protection Authority

• Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI)

Privacy Legislation

• Law No. 81 on Personal Data Protection 2019
• DPA Legislation Page

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Papua New Guinea.

Additional Resources

• Australia/New Zealand topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Paraguay.

Privacy Legislation

• Law No. 1682 Regulates Private Information 2001

Additional Resources

• Latin America topic page

Data Protection Authority

• Autoridad Nacional de Protección de Datos Personales (ANDP)

Privacy Legislation

• Law No. 29.733 on the Protection of Personal Data 2011
• DPA Legislation Page

Additional Resources

• Latin America topic page

Data Protection Authority

• National Privacy Commission

Privacy Legislation

• Data Privacy Act

Additional Resources

• Asia topic page

Data Protection Authority

• Uzrad Ochrony Danych Osobowych

Privacy Legislation

• Poland is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Comissão Nacional de Proteção de Dados

Privacy Legislation

• Portugal is subject to the EU General Data Protection Regulation.

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Regulator - Department of Consumer Affairs ('DACO')

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Puerto Rico.

Data Protection Authority

• National Cyber Security Agency and Qatar Financial Centre Regulatory Authority

Privacy Legislation

• Law No. (13) of 2016 Concerning Personal Data Protection
• DPA Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority

• Personal Information Protection Commission (PIPC)

Privacy Legislation

• Personal Information Protection Act (2011) ("PIPA")
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• National Center for Personal Data Protection of the Republic of Moldova (NCPDP)

Privacy Legislation

• Law No. 182-XVI of 10 July 2008 regarding the Approval of the National Center for Personal Data Protection Regulation, Structure, Staff-limit and its Financial Arrangements
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Republic of the Congo.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Réunion.

Data Protection Authority

• Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal

Privacy Legislation

• Romania is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Roskomnadzor

Privacy Legislation

• Federal Law of 27 July 2006 No. 152-FZ on Personal Data

Additional Resources

• Russia topic page
• Asia topic page
• Europe topic page

Data Protection Authority

• Data Protection Office

Privacy Legislation

• Law No 058/2021 - Protection of Personal Data and Privacy Law

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Barthélemy.

Data Protection Authority

• Information Commissioner (yet to be established.)

Privacy Legislation

• Data Protection Act 2018 (not yet in force.)

Data Protection Authority

• Data Protection Commissioner (link unavailable.)

Privacy Legislation

• Privacy and Data Protection Act

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Martin.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Pierre and Miquelon.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Vincent and the Grenadines.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Samoa.

Data Protection Authority

• Guarantor for the Protection of Personal Data

Privacy Legislation

• Law No. 171 of 21 December 2018, Protection of Natural Persons with Regard to the Processing of Personal Data
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Agência Nacional de Protecção de Dados Pessoais (ANPDP)

Privacy Legislation

• Law No. 03/2016
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Saudi Data & Artificial Intelligence Authority

Privacy Legislation

• Personal Data Protection Law
• DPA Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority

• Commission de Protection de Donnees Personelles (CDP)

Privacy Legislation

• Law No 2008-12
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)

Privacy Legislation

• Law on Protection of Personal Data
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority

• Information Commission of Seychelles

Privacy Legislation

• Data Protection Act 2002

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Sierra Leone.

Additional Resources

• Africa topic page

Data Protection Authority

• Personal Data Protection Commission

Privacy Legislation

• Personal Data Protection Act 2012 (No. 26 of 2012)
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority

• Personal Data Protection Supervisory Committee (link unavailable.)

Privacy Legislation

• National Ordinance for the Protection of Personal Data

Data Protection Authority

• Office for Personal Data Protection of the Slovak Republic (ÚOOÚ)

Privacy Legislation

• Slovakia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Informacijski pooblaščenec

Privacy Legislation

• Slovenia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Solomon Islands.

Data Protection Authority

• Somali Data Protection Authority (DPA)

Privacy Legislation

• Law No. 005 of 2023 Data Protection Act

Additional Resources

• Africa topic page

Data Protection Authority

• Information Regulator

Privacy Legislation

• The Protection of Personal Information Act, (Act 4 of 2013)

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for South Georgia and the South Sandwich Islands.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for South Sudan.

Additional Resources

• Africa topic page

Data Protection Authority

• Agencia Española de Protección de Datos (AEPD)

Privacy Legislation

• Spain is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• The Data Protection Authority of Sri Lanka (yet to be established.)

Privacy Legislation

• Personal Data Protection Act No. 9 of 2022

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Sudan.

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Suriname.

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Svalbard and Jan Mayen.

Data Protection Authority

• The Swedish Authority for Privacy Protection (IMY)

Privacy Legislation

• Sweden is subject to the EU General Data Protection Regulation.

Additional Resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Federal Data Protection and Information Commissioner

Privacy Legislation

• Ordinance on the Federal Act on Data Protection
• DPA Legislation Page

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Syria.

Additional Resources

• Middle East topic page

Data Protection Authority

• Regulator - National Development Council

Privacy Legislation

• Personal Data Protection Act

Additional Resources

• Asia topic page
• China topic page

Data Protection Authority

• Communication Service under the Government of the Republic of Tajikistan

Privacy Legislation

• Law of 3 August 2018 No.1537 on Protection of Personal Data

Additional Resources

• Asia topic page

Data Protection Authority

• Personal Data Protection Committee

Privacy Legislation

• Personal Data Protection Act 2019
• DPA Legislation Page

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Timor-Leste.

Additional Resources

• Asia topic page

Data Protection Authority

• Togolese Data Protection Authority (IPDCP)

Privacy Legislation

• Law No. 2019-014

Additional Resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Tonga.

Data Protection Authority

• Office of the Information Commissioner (yet to be established.)

Privacy Legislation

• Data Protection Act, 2011

Additional Resources

• Latin America topic page

Data Protection Authority

• Instance Nationale De Protection Des Données Personnelles (INPDP)

Privacy Legislation

• Organic Act No. 2004-63
• DPA Legislation Page

Additional Resources

• Africa topic page

Data Protection Authority

• Personal Data Protection Authority

Privacy Legislation

• Law on Protection of Personal Data No. 6698

Additional Resources

• Asia topic page
• Europe topic page
• Middle East topic page

Data Protection Authority

• Regulator - The Cabinet of Ministers of Turkmenistan

Privacy Legislation

• Law of Turkmenistan No.519-V ‘On Information about Private Life and its Protection’ (the ‘Data Protection Law’)

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Turks and Caicos Islands.

Data Protection Authority

• National Information Technology Authority - Uganda (NITA-U)

Privacy Legislation

• Data Protection and Privacy Act 2019

Additional Resources

• Africa topic page

Data Protection Authority

• The Ukraine Parliamentary Commissioner for Human Rights

Privacy Legislation

• Personal Data Protection Law

Additional Resources

• Europe topic page

Data Protection Authority

• UAE Data Office (yet to be established.)

Privacy Legislation

• Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data
• Government Privacy Legislation Page

Additional Resources

• Middle East topic page

Data Protection Authority

• Information Commissioner's Office

Privacy Legislation

• Data Protection Act 2018
• UK GDPR
• ICO's UK GDPR guidance and resources

Additional Resources

• United Kingdom topic page
• Europe topic page

Data Protection Authority

• The Personal Data Protection Commission (PDPC) (link unavailable.)

Privacy Legislation

• The Personal Data Protection Act, 2022

Additional Resources

• Africa topic page

Data Protection Authority

• Federal Trade Commission

Privacy Legislation

• No general federal privacy regulation, although there are many sectoral laws.
• US Federal Privacy Legislation Tracker
• US State Privacy Legislation Tracker

Additional Resources

• US Federal Privacy topic page
• US State Privacy topic page

Data Protection Authority

• Unidad Reguladora y de Control de Datos Personales

Privacy Legislation

• Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008

Additional Resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the US Virgin Islands.

Data Protection Authority

• State Personalisation Centre of Uzbekistan

Privacy Legislation

• Law of Uzbekistan of 2 July 2019 No. ЗРУ-547 on Personal Data

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Vanuatu.

Data Protection Authority

• The Pontifical Commission

Privacy Legislation

• Regolamento Generale sulla protezione dei Dati personali

Additional Resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Venezuela.

Additional Resources

• Latin America topic page

Data Protection Authority

• Ministry of Public Security

Privacy Legislation

• Decree No. 13/2023/ND-CP on the Protection of Personal Data

Additional Resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Wallis and Futuna.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Western Sahara.

Additional Resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Yemen.

Privacy Legislation

• Law No. (13) of 2012 regarding the right to information

Additional Resources

• Middle East topic page

Data Protection Authority

• Office of the Data Protection Commissioner (yet to be established.)

Privacy Legislation

• The Data Protection Act, 2021

Additional Resources

• Africa topic page

Data Protection Authority

• Postal and Telecommunications Regulatory Authority of Zimbabwe

Privacy Legislation

• Data Protection Act 5 of 2021
• DPA Legislation Page

Additional Resources

• Africa topic page