Every primary data protection instrument on the register, indexed by jurisdiction.
A B C D E F G H I J K L M N O P Q R S T U V Z
A
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇦🇱 Albania | Law No. 124/2024 on Personal Data Protection | 2024 | In force |
| 🇩🇿 Algeria | Law No. 18-07 on Personal Data Protection | 2018 | In force |
| 🇦🇩 Andorra | Qualified Law 29/2021 on Personal Data Protection | 2021 | In force |
| 🇦🇴 Angola | Law 22/11 on Personal Data Protection | 2011 | In force |
| 🇦🇬 Antigua and Barbuda | Data Protection Act 2013 | 2013 | Adopted |
| 🇦🇷 Argentina | Personal Data Protection Law 25.326 | 2000 | In force |
| 🇦🇲 Armenia | Law on Protection of Personal Data | 2015 | In force |
| 🇦🇺 Australia | Privacy Act 1988 + Australian Privacy Principles, amended 2024 | 1988 | In force |
| 🇦🇹 Austria | GDPR + Datenschutzgesetz (DSG) | 2018 | In force |
| 🇦🇿 Azerbaijan | Law on Personal Data | 2010 | In force |
B
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇧🇸 Bahamas | Data Protection (Privacy of Personal Information) Act 2003 | 2003 | In force |
| 🇧🇭 Bahrain | Personal Data Protection Law (Law No. 30 of 2018) | 2018 | In force |
| 🇧🇩 Bangladesh | Personal Data Protection Act, 2026 (Act No. 63 of 2026) | 2026 | Adopted |
| 🇧🇧 Barbados | Data Protection Act 2019 | 2019 | In force |
| 🇧🇾 Belarus | Law No. 99-Z on Personal Data Protection | 2021 | In force |
| 🇧🇪 Belgium | GDPR + Data Protection Act of 30 July 2018 | 2018 | In force |
| 🇧🇿 Belize | Data Protection Act 2021 | 2021 | In force |
| 🇧🇯 Benin | Digital Code (Law 2017-20), Book on Personal Data | 2017 | In force |
| 🇧🇹 Bhutan | Information, Communications and Media Act 2018 (data provisions) | 2018 | Sectoral |
| 🇧🇦 Bosnia and Herzegovina | Law on Protection of Personal Data | 2006 | In force |
| 🇧🇼 Botswana | Data Protection Act (2018 regime, refreshed by the 2024 Act) | 2018 | In force |
| 🇧🇷 Brazil | Lei Geral de Proteção de Dados (LGPD) | 2018 | In force |
| 🇧🇳 Brunei | Personal Data Protection Order, 2025 | 2025 | In force |
| 🇧🇬 Bulgaria | GDPR + Personal Data Protection Act | 2018 | In force |
| 🇧🇫 Burkina Faso | Law 001-2021 on Personal Data Protection | 2021 | In force |
| 🇧🇮 Burundi | Law No. 1/03 of 10 March 2026 on the Protection of Personal Data | 2026 | Adopted |
C
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇨🇻 Cabo Verde | Law 133/V/2001 as amended (2013, 2021) | 2001 | In force |
| 🇰🇭 Cambodia | Draft personal data protection law (pending); e-commerce and consumer protection laws carry data duties | Bill pending | |
| 🇨🇲 Cameroon | Law No. 2024/017 of 23 December 2024 on Personal Data Protection | 2024 | Adopted |
| 🇨🇦 Canada | PIPEDA + CASL + Quebec Law 25 (provincial) | 2000 | In force |
| 🇨🇫 Central African Republic | Law No. 24.001 on the Protection of Personal Data | 2024 | Adopted |
| 🇹🇩 Chad | Law 007/PR/2015 on Personal Data Protection | 2015 | In force |
| 🇨🇱 Chile | Law 21.719 (2024), replacing Law 19.628 (1999) | 2024 | Adopted |
| 🇨🇳 China | Personal Information Protection Law (PIPL) + Data Security Law + Cybersecurity Law | 2021 | In force |
| 🇨🇴 Colombia | Law 1581 of 2012 (habeas data) | 2012 | In force |
| 🇰🇲 Comoros | Law on the Protection of Personal Data (adopted by the Assembly, June 2014) | 2014 | Adopted |
| 🇨🇷 Costa Rica | Law 8968 on Protection of the Person Regarding Processing of Personal Data | 2011 | In force |
| 🇨🇮 Cote d'Ivoire | Law 2013-450 on Personal Data Protection | 2013 | In force |
| 🇭🇷 Croatia | GDPR + Act on the Implementation of the GDPR | 2018 | In force |
| 🇨🇺 Cuba | Law 149 of 2022 on Personal Data Protection | 2022 | In force |
| 🇨🇾 Cyprus | GDPR + Law 125(I)/2018 | 2018 | In force |
| 🇨🇿 Czechia | GDPR + Act No. 110/2019 on Personal Data Processing | 2019 | In force |
D
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇨🇩 Democratic Republic of the Congo | Digital Code (Ordonnance-loi 23/010 of 2023), personal data provisions | 2023 | In force |
| 🇩🇰 Denmark | GDPR + Danish Data Protection Act | 2018 | In force |
| 🇩🇯 Djibouti | Digital Code (Law No. 019/AN/23/9ème L), Book I on personal data protection | 2025 | Adopted |
| 🇩🇴 Dominican Republic | Law 172-13 on Personal Data Protection | 2013 | In force |
E
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇪🇨 Ecuador | Organic Law on Personal Data Protection (LOPDP) | 2021 | In force |
| 🇪🇬 Egypt | Personal Data Protection Law No. 151 of 2020 | 2020 | Adopted |
| 🇸🇻 El Salvador | Personal Data Protection Law (2024) | 2024 | In force |
| 🇬🇶 Equatorial Guinea | Law 1/2016 on Personal Data Protection | 2016 | In force |
| 🇪🇪 Estonia | GDPR + Personal Data Protection Act | 2019 | In force |
| 🇸🇿 Eswatini | Data Protection Act 2022 | 2022 | In force |
| 🇪🇹 Ethiopia | Personal Data Protection Proclamation No. 1321/2024 | 2024 | In force |
| 🇪🇺 European Union | GDPR + ePrivacy Directive | 2018 | In force |
F
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇫🇯 Fiji | Personal data protection bill (in development); constitutional privacy right | Bill pending | |
| 🇫🇮 Finland | GDPR + Data Protection Act (1050/2018) | 2018 | In force |
| 🇫🇷 France | GDPR + Loi Informatique et Libertés (1978, as amended) | 2018 | In force |
G
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇬🇦 Gabon | Law 001/2011 on Personal Data Protection (amended 2023) | 2011 | In force |
| 🇬🇲 Gambia | Personal Data Protection and Privacy Act, 2025 (Act No. 11 of 2025) | 2025 | Adopted |
| 🇬🇪 Georgia | Law on Personal Data Protection (2023) | 2023 | In force |
| 🇩🇪 Germany | GDPR + BDSG + TDDDG (cookies and terminal equipment) | 2018 | In force |
| 🇬🇭 Ghana | Data Protection Act 2012 (Act 843) | 2012 | In force |
| 🇬🇷 Greece | GDPR + Law 4624/2019 | 2019 | In force |
| 🇬🇩 Grenada | Data Protection Act 2023 | 2023 | Adopted |
| 🇬🇹 Guatemala | Data protection bills (pending); access-to-information law covers state data | Bill pending | |
| 🇬🇳 Guinea | Law L/2016/037 (cybersecurity and personal data provisions) | 2016 | In force |
| 🇬🇾 Guyana | Data Protection Act 2023 | 2023 | Adopted |
H
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇭🇳 Honduras | Data protection bill (pending); constitutional habeas data | Bill pending | |
| 🇭🇰 Hong Kong | Personal Data (Privacy) Ordinance (PDPO) | 1996 | In force |
| 🇭🇺 Hungary | GDPR + Act CXII of 2011 (Info Act) | 2018 | In force |
I
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇮🇸 Iceland | GDPR (via EEA) + Act 90/2018 | 2018 | In force |
| 🇮🇳 India | Digital Personal Data Protection Act, 2023 + DPDP Rules, 2025 | 2023 | Adopted |
| 🇮🇩 Indonesia | Personal Data Protection Law (Law 27/2022) | 2022 | In force |
| 🇮🇷 Iran | Personal Data Protection and Safeguarding Bill (pending); e-commerce law has limited data rules | Bill pending | |
| 🇮🇪 Ireland | GDPR + Data Protection Act 2018 | 2018 | In force |
| 🇮🇱 Israel | Protection of Privacy Law 1981, transformed by Amendment 13 (2024) | 1981 | In force |
| 🇮🇹 Italy | GDPR + Privacy Code (D.Lgs. 196/2003, as amended) | 2018 | In force |
J
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇯🇲 Jamaica | Data Protection Act 2020 | 2020 | In force |
| 🇯🇵 Japan | Act on the Protection of Personal Information (APPI) | 2003 | In force |
| 🇯🇴 Jordan | Personal Data Protection Law No. 24 of 2023 | 2023 | In force |
K
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇰🇿 Kazakhstan | Law on Personal Data and its Protection | 2013 | In force |
| 🇰🇪 Kenya | Data Protection Act 2019 | 2019 | In force |
| 🇰🇮 Kiribati | Data Protection Bill 2025 (first reading April 2025); no law confirmed in force | Bill pending | |
| 🇰🇼 Kuwait | CITRA Data Privacy Protection Regulation (2021, updated 2024); no standalone statute | 2021 | Sectoral |
| 🇰🇬 Kyrgyzstan | Law on Personal Information (2008, amended 2021) | 2008 | In force |
L
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇱🇦 Laos | Law on Electronic Data Protection (2017) | 2017 | Sectoral |
| 🇱🇻 Latvia | GDPR + Personal Data Processing Law | 2018 | In force |
| 🇱🇧 Lebanon | Law No. 81/2018 on Electronic Transactions and Personal Data | 2018 | In force |
| 🇱🇸 Lesotho | Data Protection Act 2011 | 2011 | Adopted |
| 🇱🇷 Liberia | Data Protection Act (2026) | 2026 | Adopted |
| 🇱🇮 Liechtenstein | GDPR (via EEA) + Data Protection Act 2018 | 2018 | In force |
| 🇱🇹 Lithuania | GDPR + Law on Legal Protection of Personal Data | 2018 | In force |
| 🇱🇺 Luxembourg | GDPR + Law of 1 August 2018 | 2018 | In force |
M
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇲🇴 Macau | Personal Data Protection Act (Law 8/2005) | 2005 | In force |
| 🇲🇬 Madagascar | Law 2014-038 on Personal Data Protection | 2014 | Adopted |
| 🇲🇼 Malawi | Data Protection Act 2024 | 2024 | In force |
| 🇲🇾 Malaysia | Personal Data Protection Act 2010, amended 2024 | 2010 | In force |
| 🇲🇻 Maldives | Data protection bill pending; constitutional privacy right | Bill pending | |
| 🇲🇱 Mali | Law 2013-015 on Personal Data Protection | 2013 | In force |
| 🇲🇹 Malta | GDPR + Data Protection Act (Cap. 586) | 2018 | In force |
| 🇲🇭 Marshall Islands | Personal Data Protection Act 2025 (P.L. 2025-43), public sector only | 2025 | Sectoral |
| 🇲🇷 Mauritania | Law 2017-020 on Personal Data Protection | 2017 | In force |
| 🇲🇺 Mauritius | Data Protection Act 2017 | 2017 | In force |
| 🇲🇽 Mexico | Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP 2025) | 2025 | In force |
| 🇲🇩 Moldova | Law No. 133/2011 on Personal Data Protection | 2011 | In force |
| 🇲🇨 Monaco | Law No. 1.565 on Personal Data Protection | 2024 | In force |
| 🇲🇳 Mongolia | Law on Personal Data Protection | 2021 | In force |
| 🇲🇪 Montenegro | Law on Personal Data Protection (2008, as amended); GDPR-aligned replacement adopted on the EU accession track | 2008 | In force |
| 🇲🇦 Morocco | Law No. 09-08 on Personal Data Protection | 2009 | In force |
| 🇲🇿 Mozambique | Draft data protection law (pending); constitutional and sectoral protections | Bill pending | |
| 🇲🇲 Myanmar | Cybersecurity Law (2025) data provisions; Law Protecting Privacy and Security of Citizens (2017, partly suspended) | 2025 | Sectoral |
N
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇳🇦 Namibia | Data Protection Bill (long pending) | Bill pending | |
| 🇳🇵 Nepal | Individual Privacy Act, 2075 (2018) | 2018 | In force |
| 🇳🇱 Netherlands | GDPR + GDPR Implementation Act (UAVG) | 2018 | In force |
| 🇳🇿 New Zealand | Privacy Act 2020 | 2020 | In force |
| 🇳🇮 Nicaragua | Law 787 on Personal Data Protection | 2012 | Adopted |
| 🇳🇪 Niger | Law 2017-28 on Personal Data Protection (amended 2022) | 2017 | In force |
| 🇳🇬 Nigeria | Nigeria Data Protection Act (NDPA) 2023 + GAID 2025 | 2023 | In force |
| 🇲🇰 North Macedonia | Law on Personal Data Protection | 2020 | In force |
| 🇳🇴 Norway | GDPR (via EEA) + Personal Data Act 2018 | 2018 | In force |
O
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇴🇲 Oman | Personal Data Protection Law (Royal Decree 6/2022) | 2022 | In force |
P
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇵🇰 Pakistan | Personal Data Protection Bill (pending); PECA 2016 covers cyber offenses | Bill pending | |
| 🇵🇦 Panama | Law 81 of 2019 on Personal Data Protection | 2019 | In force |
| 🇵🇾 Paraguay | Law No. 7593/2025 on Personal Data Protection | 2025 | Adopted |
| 🇵🇪 Peru | Law 29733 on Personal Data Protection + 2024 Regulation | 2011 | In force |
| 🇵🇭 Philippines | Data Privacy Act of 2012 (RA 10173) | 2012 | In force |
| 🇵🇱 Poland | GDPR + Personal Data Protection Act 2018 | 2018 | In force |
| 🇵🇹 Portugal | GDPR + Law 58/2019 | 2019 | In force |
Q
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇶🇦 Qatar | Law No. 13 of 2016 on Personal Data Privacy Protection | 2016 | In force |
R
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇨🇬 Republic of the Congo | Law 29-2019 on Personal Data Protection | 2019 | In force |
| 🇷🇴 Romania | GDPR + Law 190/2018 | 2018 | In force |
| 🇷🇺 Russia | Federal Law No. 152-FZ on Personal Data | 2006 | In force |
| 🇷🇼 Rwanda | Law No. 058/2021 on Personal Data Protection and Privacy | 2021 | In force |
S
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇰🇳 Saint Kitts and Nevis | Data Protection Act 2018 | 2018 | Adopted |
| 🇱🇨 Saint Lucia | Data Protection Act 2011 | 2011 | In force |
| 🇸🇲 San Marino | Law No. 171/2018 on Personal Data Protection | 2018 | In force |
| 🇸🇹 Sao Tome and Principe | Law 3/2016 on Personal Data Protection | 2016 | In force |
| 🇸🇦 Saudi Arabia | Personal Data Protection Law (PDPL), amended 2023 | 2021 | In force |
| 🇸🇳 Senegal | Law 2008-12 on Personal Data Protection | 2008 | In force |
| 🇷🇸 Serbia | Law on Personal Data Protection | 2018 | In force |
| 🇸🇨 Seychelles | Data Protection Act 2023 | 2023 | In force |
| 🇸🇱 Sierra Leone | Data Protection Bill (pending); cybersecurity law 2021 | Bill pending | |
| 🇸🇬 Singapore | Personal Data Protection Act (PDPA) 2012, amended 2020 | 2012 | In force |
| 🇸🇰 Slovakia | GDPR + Act No. 18/2018 | 2018 | In force |
| 🇸🇮 Slovenia | GDPR + ZVOP-2 (2023) | 2023 | In force |
| 🇸🇴 Somalia | Data Protection Act 2023 | 2023 | In force |
| 🇿🇦 South Africa | Protection of Personal Information Act (POPIA) | 2013 | In force |
| 🇰🇷 South Korea | Personal Information Protection Act (PIPA), overhauled 2023 | 2011 | In force |
| 🇸🇸 South Sudan | Draft Data Protection Bill (validated at a 2026 workshop); no law in force | Bill pending | |
| 🇪🇸 Spain | GDPR + LOPDGDD (Organic Law 3/2018) + LSSI | 2018 | In force |
| 🇱🇰 Sri Lanka | Personal Data Protection Act No. 9 of 2022, amended by Act No. 22 of 2025 | 2022 | Adopted |
| 🇸🇷 Suriname | Draft Privacy and Personal Data Protection Act (pending in the National Assembly) | Bill pending | |
| 🇸🇪 Sweden | GDPR + Data Protection Act (2018:218) | 2018 | In force |
| 🇨🇭 Switzerland | Federal Act on Data Protection (revFADP) | 2023 | In force |
| 🇸🇾 Syria | Law No. 12 of 2024 on the Protection of Electronic Personal Data | 2024 | Adopted |
T
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇹🇼 Taiwan | Personal Data Protection Act (PDPA) | 2010 | In force |
| 🇹🇯 Tajikistan | Law on Personal Data Protection | 2018 | In force |
| 🇹🇿 Tanzania | Personal Data Protection Act 2022 | 2022 | In force |
| 🇹🇭 Thailand | Personal Data Protection Act (PDPA) | 2019 | In force |
| 🇹🇬 Togo | Law 2019-014 on Personal Data Protection | 2019 | In force |
| 🇹🇴 Tonga | Privacy Act 2025 (Act 34 of 2025) | 2025 | Adopted |
| 🇹🇹 Trinidad and Tobago | Data Protection Act 2011 (partially proclaimed) | 2011 | Adopted |
| 🇹🇳 Tunisia | Organic Law 2004-63 on Personal Data Protection | 2004 | In force |
| 🇹🇷 Turkey | Law No. 6698 on Protection of Personal Data (KVKK), amended 2024 | 2016 | In force |
| 🇹🇲 Turkmenistan | Law on Information about Private Life and its Protection | 2017 | In force |
U
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇺🇬 Uganda | Data Protection and Privacy Act 2019 | 2019 | In force |
| 🇺🇦 Ukraine | Law No. 2297-VI on Personal Data Protection | 2010 | In force |
| 🇦🇪 United Arab Emirates | Federal Decree-Law No. 45/2021 (PDPL); DIFC and ADGM run separate GDPR-style regimes | 2021 | Adopted |
| 🇬🇧 United Kingdom | UK GDPR + Data Protection Act 2018 + PECR, amended by the Data (Use and Access) Act 2025 | 2018 | In force |
| 🇺🇸 United States | No federal comprehensive law; 24 state comprehensive laws (20 in effect) + sectoral statutes (COPPA, HIPAA, GLBA, FCRA, TCPA, CAN-SPAM) | 2020 | In force |
| 🇺🇾 Uruguay | Law 18.331 on Personal Data Protection | 2008 | In force |
| 🇺🇿 Uzbekistan | Law on Personal Data (2019, amended 2021) | 2019 | In force |
V
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇻🇺 Vanuatu | Data Protection and Privacy Act No. 13 of 2024 | 2024 | Adopted |
| 🇻🇳 Vietnam | Law on Personal Data Protection (Law 91/2025/QH15) + Decree 356/2025 | 2025 | In force |
Z
| Jurisdiction | Primary instrument | Year | Status |
|---|---|---|---|
| 🇿🇲 Zambia | Data Protection Act 2021 | 2021 | In force |
| 🇿🇼 Zimbabwe | Data Protection Act 2021 (Cyber and Data Protection Act) | 2021 | In force |
Cite this page: "Index of Data Privacy Laws A to Z." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/laws.html. Accessed [date].