# Digital Privacy Regulations: all jurisdictions (updated 2026-10-02)
# Format: Name | Region | Status | Consent model | Primary law (year) | Authority | Penalties | URL

Afghanistan | Asia-Pacific | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/afghanistan.html
Albania | Europe | In force | Opt-in | Law No. 124/2024 on Personal Data Protection (2024) | Information and Data Protection Commissioner (IDP) | The 2024 law substantially increased fines. | https://digitalprivacyregs.com/albania.html
Algeria | Middle East & North Africa | In force | Opt-in | Law No. 18-07 on Personal Data Protection (2018) | ANPDP | Violations can bring fines and imprisonment. | https://digitalprivacyregs.com/algeria.html
Andorra | Europe | In force | Opt-in | Qualified Law 29/2021 on Personal Data Protection (2021) | APDA | Fines reach EUR 100,000 per infringement. | https://digitalprivacyregs.com/andorra.html
Angola | Sub-Saharan Africa | In force | Opt-in | Law 22/11 on Personal Data Protection (2011) | APD (operational since 2019) | Fines scale with the company's revenue band. | https://digitalprivacyregs.com/angola.html
Antigua and Barbuda | Americas | Adopted | Opt-in | Data Protection Act 2013 (2013) | Information Commissioner (limited operation) | The Act provides for fines. | https://digitalprivacyregs.com/antigua-and-barbuda.html
Argentina | Americas | In force | Opt-in | Personal Data Protection Law 25.326 (2000) | AAIP | Administrative fines updated by the AAIP; modest by global standards. | https://digitalprivacyregs.com/argentina.html
Armenia | Europe | In force | Opt-in | Law on Protection of Personal Data (2015) | Personal Data Protection Agency (Ministry of Justice) | The authority can impose administrative fines. | https://digitalprivacyregs.com/armenia.html
Australia | Oceania | In force | Hybrid | Privacy Act 1988 + Australian Privacy Principles, amended 2024 (1988) | Office of the Australian Information Commissioner (OAIC) | For serious interferences: the greater of AUD 50M, three times the benefit, or 30% of adjusted turnover; a mid-2020s penalty overhaul with tiers for lesser breaches. | https://digitalprivacyregs.com/australia.html
Austria | Europe | In force | Opt-in | GDPR + Datenschutzgesetz (DSG) (2018) | Datenschutzbehörde (DSB) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/austria.html
Azerbaijan | Europe | In force | Opt-in | Law on Personal Data (2010) | Ministry of Digital Development and Transport (supervision) | The authority can impose administrative fines. | https://digitalprivacyregs.com/azerbaijan.html
Bahamas | Americas | In force | Opt-in | Data Protection (Privacy of Personal Information) Act 2003 (2003) | Data Protection Commissioner | Fines are modest. | https://digitalprivacyregs.com/bahamas.html
Bahrain | Middle East & North Africa | In force | Opt-in | Personal Data Protection Law (Law No. 30 of 2018) (2018) | Personal Data Protection Authority (under the Ministry of Justice) | Criminal penalties including fines and imprisonment, plus administrative orders. | https://digitalprivacyregs.com/bahrain.html
Bangladesh | Asia-Pacific | Adopted | Opt-in | Personal Data Protection Act, 2026 (Act No. 63 of 2026) (2026) | National Data Management Authority (created by the National Data Management Act, 2026; being set up) | Administrative fines and compensation provisions are deferred until the government notifies them, no earlier than October 2027. | https://digitalprivacyregs.com/bangladesh.html
Barbados | Americas | In force | Opt-in | Data Protection Act 2019 (2019) | Data Protection Commissioner | The Act provides for fines and imprisonment. | https://digitalprivacyregs.com/barbados.html
Belarus | Europe | In force | Opt-in | Law No. 99-Z on Personal Data Protection (2021) | National Personal Data Protection Center (NPDPC) | Violations carry administrative and criminal liability. | https://digitalprivacyregs.com/belarus.html
Belgium | Europe | In force | Opt-in | GDPR + Data Protection Act of 30 July 2018 (2018) | Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/belgium.html
Belize | Americas | In force | Opt-in | Data Protection Act 2021 (2021) | Data Protection Officer / Commissioner under the Act | The Act provides for fines. | https://digitalprivacyregs.com/belize.html
Benin | Sub-Saharan Africa | In force | Opt-in | Digital Code (Law 2017-20), Book on Personal Data (2017) | APDP | Fines up to substantial ceilings plus publication sanctions. | https://digitalprivacyregs.com/benin.html
Bhutan | Asia-Pacific | Sectoral | None | Information, Communications and Media Act 2018 (data provisions) (2018) | BICMA (media and ICT regulator) | Only sector-specific penalties apply. | https://digitalprivacyregs.com/bhutan.html
Bolivia | Americas | No law | None | None; constitutional habeas data only | None | None under a general privacy law. | https://digitalprivacyregs.com/bolivia.html
Bosnia and Herzegovina | Europe | In force | Opt-in | Law on Protection of Personal Data (2006) | Personal Data Protection Agency (AZLP) | Administrative fines are modest. | https://digitalprivacyregs.com/bosnia-and-herzegovina.html
Botswana | Sub-Saharan Africa | In force | Opt-in | Data Protection Act (2018 regime, refreshed by the 2024 Act) (2018) | Information and Data Protection Commission | Violations can bring fines and imprisonment. | https://digitalprivacyregs.com/botswana.html
Brazil | Americas | In force | Opt-in | Lei Geral de Proteção de Dados (LGPD) (2018) | ANPD (Agência Nacional de Proteção de Dados), a regulatory agency since Law 15.352/2026 | Up to 2% of Brazil revenue, capped at R$50M per violation; daily fines and processing bans available. | https://digitalprivacyregs.com/brazil.html
Brunei | Asia-Pacific | In force | Opt-in | Personal Data Protection Order, 2025 (2025) | AITI (Authority for Info-communications Technology Industry) | Financial penalties up to 10% of local turnover or BND 1M for larger firms. | https://digitalprivacyregs.com/brunei.html
Bulgaria | Europe | In force | Opt-in | GDPR + Personal Data Protection Act (2018) | Commission for Personal Data Protection (CPDP) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/bulgaria.html
Burkina Faso | Sub-Saharan Africa | In force | Opt-in | Law 001-2021 on Personal Data Protection (2021) | CIL | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/burkina-faso.html
Burundi | Sub-Saharan Africa | Adopted | Opt-in | Law No. 1/03 of 10 March 2026 on the Protection of Personal Data (2026) | Personal Data Protection Agency (created by the law; implementing decree and appointments pending) | The law provides for sanctions, but no agency is yet in place to impose them. | https://digitalprivacyregs.com/burundi.html
Cabo Verde | Sub-Saharan Africa | In force | Opt-in | Law 133/V/2001 as amended (2013, 2021) (2001) | CNPD | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/cabo-verde.html
Cambodia | Asia-Pacific | Bill pending | None | Draft personal data protection law (pending); e-commerce and consumer protection laws carry data duties | None yet (Ministry of Post and Telecommunications drafting) | Only sector-specific penalties apply. | https://digitalprivacyregs.com/cambodia.html
Cameroon | Sub-Saharan Africa | Adopted | Opt-in | Law No. 2024/017 of 23 December 2024 on Personal Data Protection (2024) | Personal Data Protection Authority (requires a presidential decree; not yet established) | The law provides for sanctions, but no authority is yet in place to impose them. | https://digitalprivacyregs.com/cameroon.html
Canada | Americas | In force | Opt-in | PIPEDA + CASL + Quebec Law 25 (provincial) (2000) | Office of the Privacy Commissioner (OPC); provincial commissioners in QC, BC, AB | CASL penalties reach CAD 10M per violation; Quebec Law 25 fines reach CAD 25M or 4% of worldwide turnover. PIPEDA itself still lacks direct fining power after Bill C-27 died in January 2025. | https://digitalprivacyregs.com/canada.html
Central African Republic | Sub-Saharan Africa | Adopted | Opt-in | Law No. 24.001 on the Protection of Personal Data (2024) | Data protection agency provided by law, not yet created; the Ministry of Digital Economy supervises in the interim | The law provides for sanctions, but the agency meant to impose them does not yet exist. | https://digitalprivacyregs.com/central-african-republic.html
Chad | Sub-Saharan Africa | In force | Opt-in | Law 007/PR/2015 on Personal Data Protection (2015) | ANSICE | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/chad.html
Chile | Americas | Adopted | Opt-in | Law 21.719 (2024), replacing Law 19.628 (1999) (2024) | Agencia de Protección de Datos Personales (board not yet appointed) | Up to UTM-denominated fines reaching roughly USD 1.5M, and up to 4% of annual revenue for repeated grave violations. | https://digitalprivacyregs.com/chile.html
China | Asia-Pacific | In force | Opt-in | Personal Information Protection Law (PIPL) + Data Security Law + Cybersecurity Law (2021) | Cyberspace Administration of China (CAC) | Up to RMB 50M or 5% of the prior year's turnover, plus personal liability for responsible individuals and business suspension. | https://digitalprivacyregs.com/china.html
Colombia | Americas | In force | Opt-in | Law 1581 of 2012 (habeas data) (2012) | Superintendence of Industry and Commerce (SIC) | Fines up to about 2,000 monthly minimum wages per violation; the SIC fines frequently. | https://digitalprivacyregs.com/colombia.html
Comoros | Sub-Saharan Africa | Adopted | Opt-in | Law on the Protection of Personal Data (adopted by the Assembly, June 2014) (2014) | National commission provided by law; never constituted | The law provides for sanctions that no operating body can impose. | https://digitalprivacyregs.com/comoros.html
Costa Rica | Americas | In force | Opt-in | Law 8968 on Protection of the Person Regarding Processing of Personal Data (2011) | PRODHAB | Fines reach about USD 20,000, plus registry sanctions. | https://digitalprivacyregs.com/costa-rica.html
Cote d'Ivoire | Sub-Saharan Africa | In force | Opt-in | Law 2013-450 on Personal Data Protection (2013) | ARTCI | Fines apply, and the authority can act against licences. | https://digitalprivacyregs.com/cote-divoire.html
Croatia | Europe | In force | Opt-in | GDPR + Act on the Implementation of the GDPR (2018) | AZOP | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/croatia.html
Cuba | Americas | In force | Opt-in | Law 149 of 2022 on Personal Data Protection (2022) | State supervision; no independent DPA | Enforcement runs through administrative measures. | https://digitalprivacyregs.com/cuba.html
Cyprus | Europe | In force | Opt-in | GDPR + Law 125(I)/2018 (2018) | Commissioner for Personal Data Protection | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/cyprus.html
Czechia | Europe | In force | Opt-in | GDPR + Act No. 110/2019 on Personal Data Processing (2019) | UOOU | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/czechia.html
Democratic Republic of the Congo | Sub-Saharan Africa | In force | Opt-in | Digital Code (Ordonnance-loi 23/010 of 2023), personal data provisions (2023) | Data protection authority provided by the Digital Code (being established) | The Code provides for fines. | https://digitalprivacyregs.com/democratic-republic-of-the-congo.html
Denmark | Europe | In force | Opt-in | GDPR + Danish Data Protection Act (2018) | Datatilsynet | The DPA cannot fine directly; it refers cases to the police, and the courts set fines within GDPR maximums. | https://digitalprivacyregs.com/denmark.html
Djibouti | Sub-Saharan Africa | Adopted | Opt-in | Digital Code (Law No. 019/AN/23/9ème L), Book I on personal data protection (2025) | National Commission for the Protection of Personal Data (provided by the Code; not yet established) | The Code provides for sanctions, but no commission is yet in place to impose them. | https://digitalprivacyregs.com/djibouti.html
Dominica | Americas | No law | None | None in force | None | None. | https://digitalprivacyregs.com/dominica.html
Dominican Republic | Americas | In force | Opt-in | Law 172-13 on Personal Data Protection (2013) | Superintendence of Banks (credit data); no general DPA | Fines apply, mostly in the credit-reporting context. | https://digitalprivacyregs.com/dominican-republic.html
Ecuador | Americas | In force | Opt-in | Organic Law on Personal Data Protection (LOPDP) (2021) | Superintendence of Personal Data Protection (SPDP), the authority since April 2024 | Serious violations bring fines up to 1% of prior-year revenue. | https://digitalprivacyregs.com/ecuador.html
Egypt | Middle East & North Africa | Adopted | Opt-in | Personal Data Protection Law No. 151 of 2020 (2020) | Personal Data Protection Center, which has begun licensing and issuing guidance | Fines up to EGP 5M plus imprisonment for certain violations; the Executive Regulation's one-year grace period runs out in early November 2026. | https://digitalprivacyregs.com/egypt.html
El Salvador | Americas | In force | Opt-in | Personal Data Protection Law (2024) (2024) | State Cybersecurity Agency (ACE) | The law scales fines by severity. | https://digitalprivacyregs.com/el-salvador.html
Equatorial Guinea | Sub-Saharan Africa | In force | Opt-in | Law 1/2016 on Personal Data Protection (2016) | Authority provided by law; limited operation | The law provides for fines. | https://digitalprivacyregs.com/equatorial-guinea.html
Eritrea | Sub-Saharan Africa | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/eritrea.html
Estonia | Europe | In force | Opt-in | GDPR + Personal Data Protection Act (2019) | Andmekaitse Inspektsioon (AKI) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/estonia.html
Eswatini | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2022 (2022) | Eswatini Communications Commission (data protection unit) | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/eswatini.html
Ethiopia | Sub-Saharan Africa | In force | Opt-in | Personal Data Protection Proclamation No. 1321/2024 (2024) | Ethiopian Communications Authority (ECA), which registers and licenses data handlers | The law provides for administrative fines and criminal penalties. | https://digitalprivacyregs.com/ethiopia.html
European Union | Special | In force | Opt-in | GDPR + ePrivacy Directive (2018) | EDPB coordination + national DPAs; European Commission for adequacy | Up to EUR 20M or 4% of global annual turnover, whichever is higher. | https://digitalprivacyregs.com/european-union.html
Fiji | Oceania | Bill pending | None | Personal data protection bill (in development); constitutional privacy right | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/fiji.html
Finland | Europe | In force | Opt-in | GDPR + Data Protection Act (1050/2018) (2018) | Office of the Data Protection Ombudsman | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/finland.html
France | Europe | In force | Opt-in | GDPR + Loi Informatique et Libertés (1978, as amended) (2018) | CNIL | Up to EUR 20M or 4% of global turnover; separate national cookie fines. | https://digitalprivacyregs.com/france.html
Gabon | Sub-Saharan Africa | In force | Opt-in | Law 001/2011 on Personal Data Protection (amended 2023) (2011) | CNPDCP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/gabon.html
Gambia | Sub-Saharan Africa | Adopted | Opt-in | Personal Data Protection and Privacy Act, 2025 (Act No. 11 of 2025) (2025) | Information Commission (established under the Access to Information Act 2021), with its data protection role still being built | The Act provides for fines and other sanctions; enforcement has yet to begin in earnest. | https://digitalprivacyregs.com/gambia.html
Georgia | Europe | In force | Opt-in | Law on Personal Data Protection (2023) (2023) | Personal Data Protection Service (PDPS) | Administrative fines apply, rising for repeat violations. | https://digitalprivacyregs.com/georgia.html
Germany | Europe | In force | Opt-in | GDPR + BDSG + TDDDG (cookies and terminal equipment) (2018) | BfDI plus 16 state DPAs | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/germany.html
Ghana | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2012 (Act 843) (2012) | Data Protection Commission | Fines and imprisonment for violations; registration enforcement is the practical lever. | https://digitalprivacyregs.com/ghana.html
Greece | Europe | In force | Opt-in | GDPR + Law 4624/2019 (2019) | Hellenic DPA (HDPA) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/greece.html
Grenada | Americas | Adopted | Opt-in | Data Protection Act 2023 (2023) | Information Commission (a three-member body under the Act; commencement order pending) | The Act provides for fines. | https://digitalprivacyregs.com/grenada.html
Guatemala | Americas | Bill pending | None | Data protection bills (pending); access-to-information law covers state data | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/guatemala.html
Guinea | Sub-Saharan Africa | In force | Opt-in | Law L/2016/037 (cybersecurity and personal data provisions) (2016) | Authority provided by law; limited operation | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/guinea.html
Guinea-Bissau | Sub-Saharan Africa | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/guinea-bissau.html
Guyana | Americas | Adopted | Opt-in | Data Protection Act 2023 (2023) | Data Protection Commissioner (appointed February 2026); commencement order pending | The Act provides for fines. | https://digitalprivacyregs.com/guyana.html
Haiti | Americas | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/haiti.html
Honduras | Americas | Bill pending | None | Data protection bill (pending); constitutional habeas data | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/honduras.html
Hong Kong | Special | In force | Hybrid | Personal Data (Privacy) Ordinance (PDPO) (1996) | Privacy Commissioner for Personal Data (PCPD) | Enforcement notices, then criminal prosecution; direct marketing offenses carry fines to HKD 1M and imprisonment. | https://digitalprivacyregs.com/hong-kong.html
Hungary | Europe | In force | Opt-in | GDPR + Act CXII of 2011 (Info Act) (2018) | NAIH | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/hungary.html
Iceland | Europe | In force | Opt-in | GDPR (via EEA) + Act 90/2018 (2018) | Personuvernd | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/iceland.html
India | Asia-Pacific | Adopted | Opt-in | Digital Personal Data Protection Act, 2023 + DPDP Rules, 2025 (2023) | Data Protection Board of India (legally established November 2025; being set up) | Up to INR 250 crore (about USD 30M) per category of breach, stackable, enforceable from 13 May 2027. | https://digitalprivacyregs.com/india.html
Indonesia | Asia-Pacific | In force | Opt-in | Personal Data Protection Law (Law 27/2022) (2022) | PDP supervisory agency mandated by law, still not established; the Ministry of Communication and Digital Affairs (Komdigi) supervises in the interim | Administrative fines up to 2% of annual revenue plus corporate criminal liability for misuse. | https://digitalprivacyregs.com/indonesia.html
Iran | Middle East & North Africa | Bill pending | None | Personal Data Protection and Safeguarding Bill (pending); e-commerce law has limited data rules | None yet | Only sector-specific penalties apply. | https://digitalprivacyregs.com/iran.html
Iraq | Middle East & North Africa | No law | None | None; constitutional privacy right and sectoral rules | None | None under a general privacy law. | https://digitalprivacyregs.com/iraq.html
Ireland | Europe | In force | Opt-in | GDPR + Data Protection Act 2018 (2018) | Data Protection Commission (DPC) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/ireland.html
Israel | Middle East & North Africa | In force | Opt-in | Protection of Privacy Law 1981, transformed by Amendment 13 (2024) (1981) | Privacy Protection Authority (PPA) | Amendment 13 armed the PPA with administrative fines that scale with database sensitivity and size; its first, in July 2026, was NIS 256,000 against the health fund Meuhedet for failing to report a breach. | https://digitalprivacyregs.com/israel.html
Italy | Europe | In force | Opt-in | GDPR + Privacy Code (D.Lgs. 196/2003, as amended) (2018) | Garante | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/italy.html
Jamaica | Americas | In force | Opt-in | Data Protection Act 2020 (2020) | Office of the Information Commissioner (OIC) | Certain offenses bring fines up to 4% of annual gross income. | https://digitalprivacyregs.com/jamaica.html
Japan | Asia-Pacific | In force | Hybrid | Act on the Protection of Personal Information (APPI) (2003) | Personal Information Protection Commission (PPC) | Orders first, then fines up to JPY 100M for corporate violations; the 2026 amendment adds tougher criminal penalties from January 2027 and administrative surcharges for violations affecting more than 1,000 people by July 2028. | https://digitalprivacyregs.com/japan.html
Jordan | Middle East & North Africa | In force | Opt-in | Personal Data Protection Law No. 24 of 2023 (2023) | Personal Data Protection Council / unit within the Ministry of Digital Economy | Administrative fines apply, and the authority can act against licences. | https://digitalprivacyregs.com/jordan.html
Kazakhstan | Asia-Pacific | In force | Opt-in | Law on Personal Data and its Protection (2013) | Ministry of Artificial Intelligence and Digital Development (successor to the Ministry of Digital Development since September 2025) | Administrative fines; criminal exposure for unlawful dissemination. | https://digitalprivacyregs.com/kazakhstan.html
Kenya | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2019 (2019) | Office of the Data Protection Commissioner (ODPC) | Up to KES 5M or 1% of the preceding year's annual turnover, whichever is lower. | https://digitalprivacyregs.com/kenya.html
Kiribati | Oceania | Bill pending | None | Data Protection Bill 2025 (first reading April 2025); no law confirmed in force | None yet | No penalties apply until a law is passed. | https://digitalprivacyregs.com/kiribati.html
Kuwait | Middle East & North Africa | Sectoral | Opt-in | CITRA Data Privacy Protection Regulation (2021, updated 2024); no standalone statute (2021) | CITRA (Communication and Information Technology Regulatory Authority) | CITRA enforces through sanctions attached to its licensing powers. | https://digitalprivacyregs.com/kuwait.html
Kyrgyzstan | Asia-Pacific | In force | Opt-in | Law on Personal Information (2008, amended 2021) (2008) | State Personal Data Protection Agency | The authority can impose administrative fines. | https://digitalprivacyregs.com/kyrgyzstan.html
Laos | Asia-Pacific | Sectoral | Opt-in | Law on Electronic Data Protection (2017) (2017) | Ministry of Technology and Communications | The law provides for administrative sanctions. | https://digitalprivacyregs.com/laos.html
Latvia | Europe | In force | Opt-in | GDPR + Personal Data Processing Law (2018) | Data State Inspectorate (DVI) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/latvia.html
Lebanon | Middle East & North Africa | In force | Opt-in | Law No. 81/2018 on Electronic Transactions and Personal Data (2018) | Ministry of Economy and Trade (licensing role) | Fines are limited. | https://digitalprivacyregs.com/lebanon.html
Lesotho | Sub-Saharan Africa | Adopted | Opt-in | Data Protection Act 2011 (2011) | Commission provided by law; never fully operational | The law provides for fines. | https://digitalprivacyregs.com/lesotho.html
Liberia | Sub-Saharan Africa | Adopted | Opt-in | Data Protection Act (2026) (2026) | Supervision arrangements under the new Act; no regulator operating yet | The Act provides for sanctions, but no regulator is operating to impose them yet. | https://digitalprivacyregs.com/liberia.html
Libya | Middle East & North Africa | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/libya.html
Liechtenstein | Europe | In force | Opt-in | GDPR (via EEA) + Data Protection Act 2018 (2018) | Datenschutzstelle | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/liechtenstein.html
Lithuania | Europe | In force | Opt-in | GDPR + Law on Legal Protection of Personal Data (2018) | VDAI | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/lithuania.html
Luxembourg | Europe | In force | Opt-in | GDPR + Law of 1 August 2018 (2018) | CNPD | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/luxembourg.html
Macau | Special | In force | Opt-in | Personal Data Protection Act (Law 8/2005) (2005) | Office for Personal Data Protection (GPDP) | Administrative fines and criminal penalties for serious violations. | https://digitalprivacyregs.com/macau.html
Madagascar | Sub-Saharan Africa | Adopted | Opt-in | Law 2014-038 on Personal Data Protection (2014) | Commission (CMIL) provided by law; operationalization has lagged | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/madagascar.html
Malawi | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2024 (2024) | Malawi Communications Regulatory Authority (MACRA, interim) | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/malawi.html
Malaysia | Asia-Pacific | In force | Opt-in | Personal Data Protection Act 2010, amended 2024 (2010) | Personal Data Protection Commissioner (JPDP) | Raised in 2024 to RM 1M and imprisonment exposure per violation. | https://digitalprivacyregs.com/malaysia.html
Maldives | Asia-Pacific | Bill pending | None | Data protection bill pending; constitutional privacy right | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/maldives.html
Mali | Sub-Saharan Africa | In force | Opt-in | Law 2013-015 on Personal Data Protection (2013) | APDP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/mali.html
Malta | Europe | In force | Opt-in | GDPR + Data Protection Act (Cap. 586) (2018) | IDPC | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/malta.html
Marshall Islands | Oceania | Sectoral | None | Personal Data Protection Act 2025 (P.L. 2025-43), public sector only (2025) | Economic Policy, Planning and Statistics Office (for government bodies) | No penalties apply to private businesses under a general privacy law. | https://digitalprivacyregs.com/marshall-islands.html
Mauritania | Sub-Saharan Africa | In force | Opt-in | Law 2017-020 on Personal Data Protection (2017) | Authority provided by law; operationalization limited | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/mauritania.html
Mauritius | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2017 (2017) | Data Protection Office | Violations can bring fines up to MUR 200,000 and imprisonment. | https://digitalprivacyregs.com/mauritius.html
Mexico | Americas | In force | Hybrid | Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP 2025) (2025) | Secretariat of Anti-Corruption and Good Governance (SABG), replacing the dissolved INAI | Fines from 100 to 320,000 UMA (into the millions of dollars), doubled for sensitive data, plus criminal exposure; in July 2026 the SABG fined the Mexican Football Federation MXN 42.8M over biometric data in its FAN ID program. | https://digitalprivacyregs.com/mexico.html
Micronesia | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/micronesia.html
Moldova | Europe | In force | Opt-in | Law No. 133/2011 on Personal Data Protection (2011) | NCPDP | The authority can impose administrative fines. | https://digitalprivacyregs.com/moldova.html
Monaco | Europe | In force | Opt-in | Law No. 1.565 on Personal Data Protection (2024) | APDP (formerly CCIN) | The new law provides for administrative fines. | https://digitalprivacyregs.com/monaco.html
Mongolia | Asia-Pacific | In force | Opt-in | Law on Personal Data Protection (2021) | National Human Rights Commission (oversight role) | The authority can impose administrative fines. | https://digitalprivacyregs.com/mongolia.html
Montenegro | Europe | In force | Opt-in | Law on Personal Data Protection (2008, as amended); GDPR-aligned replacement adopted on the EU accession track (2008) | AZLP | The authority can impose administrative fines. | https://digitalprivacyregs.com/montenegro.html
Morocco | Middle East & North Africa | In force | Opt-in | Law No. 09-08 on Personal Data Protection (2009) | CNDP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/morocco.html
Mozambique | Sub-Saharan Africa | Bill pending | None | Draft data protection law (pending); constitutional and sectoral protections | None yet | Only sector-specific penalties apply. | https://digitalprivacyregs.com/mozambique.html
Myanmar | Asia-Pacific | Sectoral | None | Cybersecurity Law (2025) data provisions; Law Protecting Privacy and Security of Citizens (2017, partly suspended) (2025) | Military-controlled ministries | Criminal penalties apply under security laws. | https://digitalprivacyregs.com/myanmar.html
Namibia | Sub-Saharan Africa | Bill pending | None | Data Protection Bill (long pending) | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/namibia.html
Nauru | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/nauru.html
Nepal | Asia-Pacific | In force | Opt-in | Individual Privacy Act, 2075 (2018) (2018) | No dedicated DPA; enforcement through courts and the National Information Commission for related matters | Violations can bring fines and up to three years' imprisonment. | https://digitalprivacyregs.com/nepal.html
Netherlands | Europe | In force | Opt-in | GDPR + GDPR Implementation Act (UAVG) (2018) | Autoriteit Persoonsgegevens (AP) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/netherlands.html
New Zealand | Oceania | In force | Hybrid | Privacy Act 2020 (2020) | Office of the Privacy Commissioner (OPC) | Compliance notices and modest fines (to NZD 10,000), plus Human Rights Review Tribunal damages; light by global standards. | https://digitalprivacyregs.com/new-zealand.html
Nicaragua | Americas | Adopted | Opt-in | Law 787 on Personal Data Protection (2012) | DIPRODAP (provided by law, never operational) | Penalties are nominal. | https://digitalprivacyregs.com/nicaragua.html
Niger | Sub-Saharan Africa | In force | Opt-in | Law 2017-28 on Personal Data Protection (amended 2022) (2017) | HAPDP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/niger.html
Nigeria | Sub-Saharan Africa | In force | Opt-in | Nigeria Data Protection Act (NDPA) 2023 + GAID 2025 (2023) | Nigeria Data Protection Commission (NDPC) | Up to NGN 10M or 2% of annual gross revenue for major data handlers, whichever is higher. | https://digitalprivacyregs.com/nigeria.html
North Korea | Asia-Pacific | No law | None | No comprehensive law | None | Not applicable. | https://digitalprivacyregs.com/north-korea.html
North Macedonia | Europe | In force | Opt-in | Law on Personal Data Protection (2020) | Agency for Personal Data Protection | Fines are set as a percentage of turnover, on the GDPR model. | https://digitalprivacyregs.com/north-macedonia.html
Norway | Europe | In force | Opt-in | GDPR (via EEA) + Personal Data Act 2018 (2018) | Datatilsynet | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/norway.html
Oman | Middle East & North Africa | In force | Opt-in | Personal Data Protection Law (Royal Decree 6/2022) (2022) | Ministry of Transport, Communications and IT | Fines reach OMR 500,000. | https://digitalprivacyregs.com/oman.html
Pakistan | Asia-Pacific | Bill pending | None | Personal Data Protection Bill (pending); PECA 2016 covers cyber offenses | None yet (bill proposes a National Commission for Personal Data Protection) | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/pakistan.html
Palau | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/palau.html
Panama | Americas | In force | Opt-in | Law 81 of 2019 on Personal Data Protection (2019) | ANTAI | Fines reach USD 10,000 plus other sanctions, a modest ceiling. | https://digitalprivacyregs.com/panama.html
Papua New Guinea | Oceania | No law | None | None; Digital Government Act touches public-sector data | None | None under a general privacy law. | https://digitalprivacyregs.com/papua-new-guinea.html
Paraguay | Americas | Adopted | Opt-in | Law No. 7593/2025 on Personal Data Protection (2025) | National Personal Data Protection Agency, a unit under the ICT ministry (MITIC), not yet operating | The new law provides for administrative fines once it applies in late 2027. | https://digitalprivacyregs.com/paraguay.html
Peru | Americas | In force | Opt-in | Law 29733 on Personal Data Protection + 2024 Regulation (2011) | ANPD (National Authority, within the Ministry of Justice) | Fines up to 100 UIT (S/550,000, about USD 160,000) for very serious infractions, actively imposed. | https://digitalprivacyregs.com/peru.html
Philippines | Asia-Pacific | In force | Opt-in | Data Privacy Act of 2012 (RA 10173) (2012) | National Privacy Commission (NPC) | Criminal penalties under the Act plus NPC administrative fines of up to 3% of annual gross income, capped at PHP 5M per act (2022 circular). | https://digitalprivacyregs.com/philippines.html
Poland | Europe | In force | Opt-in | GDPR + Personal Data Protection Act 2018 (2018) | UODO | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/poland.html
Portugal | Europe | In force | Opt-in | GDPR + Law 58/2019 (2019) | CNPD | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/portugal.html
Qatar | Middle East & North Africa | In force | Opt-in | Law No. 13 of 2016 on Personal Data Privacy Protection (2016) | National Cyber Governance and Assurance Affairs (NCGAA) under the NCSA; QFC has its own regime | Fines reach QAR 5M. | https://digitalprivacyregs.com/qatar.html
Republic of the Congo | Sub-Saharan Africa | In force | Opt-in | Law 29-2019 on Personal Data Protection (2019) | Authority provided by law | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/republic-of-the-congo.html
Romania | Europe | In force | Opt-in | GDPR + Law 190/2018 (2018) | ANSPDCP | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/romania.html
Russia | Europe | In force | Opt-in | Federal Law No. 152-FZ on Personal Data (2006) | Roskomnadzor | From May 30, 2025, leak-related fines reach turnover-based levels up to 3%, plus large fixed fines and criminal liability for illegal data trafficking. | https://digitalprivacyregs.com/russia.html
Rwanda | Sub-Saharan Africa | In force | Opt-in | Law No. 058/2021 on Personal Data Protection and Privacy (2021) | National Cyber Security Authority (NCSA) | Fines up to RWF 5M or 1% of turnover, plus criminal exposure. | https://digitalprivacyregs.com/rwanda.html
Saint Kitts and Nevis | Americas | Adopted | Opt-in | Data Protection Act 2018 (2018) | Information Commissioner (being operationalized) | The Act provides for fines. | https://digitalprivacyregs.com/saint-kitts-and-nevis.html
Saint Lucia | Americas | In force | Opt-in | Data Protection Act 2011 (2011) | Data Protection Commissioner | The Act provides for fines. | https://digitalprivacyregs.com/saint-lucia.html
Saint Vincent and the Grenadines | Americas | No law | None | None in force; the Privacy Act 2003 was passed but never brought into force | None | None. | https://digitalprivacyregs.com/saint-vincent-and-the-grenadines.html
Samoa | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/samoa.html
San Marino | Europe | In force | Opt-in | Law No. 171/2018 on Personal Data Protection (2018) | Data Protection Authority of San Marino | Administrative fines follow the GDPR model. | https://digitalprivacyregs.com/san-marino.html
Sao Tome and Principe | Sub-Saharan Africa | In force | Opt-in | Law 3/2016 on Personal Data Protection (2016) | Authority provided by law | The law provides for fines. | https://digitalprivacyregs.com/sao-tome-and-principe.html
Saudi Arabia | Middle East & North Africa | In force | Opt-in | Personal Data Protection Law (PDPL), amended 2023 (2021) | Saudi Data and AI Authority (SDAIA) | Fines up to SAR 5M (doubled for repeats), criminal exposure for sensitive-data disclosure, plus SDAIA corrective powers. | https://digitalprivacyregs.com/saudi-arabia.html
Senegal | Sub-Saharan Africa | In force | Opt-in | Law 2008-12 on Personal Data Protection (2008) | CDP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/senegal.html
Serbia | Europe | In force | Opt-in | Law on Personal Data Protection (2018) | Commissioner for Information of Public Importance and Personal Data Protection | Fines reach RSD 2M per violation, low by EU standards; a draft law published in July 2026 would overhaul the regime. | https://digitalprivacyregs.com/serbia.html
Seychelles | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2023 (2023) | Information Commission | The authority can impose administrative fines. | https://digitalprivacyregs.com/seychelles.html
Sierra Leone | Sub-Saharan Africa | Bill pending | None | Data Protection Bill (pending); cybersecurity law 2021 | None yet | No penalties apply under a general privacy law. | https://digitalprivacyregs.com/sierra-leone.html
Singapore | Asia-Pacific | In force | Hybrid | Personal Data Protection Act (PDPA) 2012, amended 2020 (2012) | Personal Data Protection Commission (PDPC) | Up to 10% of annual Singapore turnover for large firms, or SGD 1M. | https://digitalprivacyregs.com/singapore.html
Slovakia | Europe | In force | Opt-in | GDPR + Act No. 18/2018 (2018) | Office for Personal Data Protection | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/slovakia.html
Slovenia | Europe | In force | Opt-in | GDPR + ZVOP-2 (2023) (2023) | Information Commissioner (IP-RS) | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/slovenia.html
Solomon Islands | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/solomon-islands.html
Somalia | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2023 (2023) | Data Protection Authority | The authority can impose administrative fines. | https://digitalprivacyregs.com/somalia.html
South Africa | Sub-Saharan Africa | In force | Opt-in | Protection of Personal Information Act (POPIA) (2013) | Information Regulator | Fines up to ZAR 10M and criminal penalties; enforcement notices are the workhorse. | https://digitalprivacyregs.com/south-africa.html
South Korea | Asia-Pacific | In force | Opt-in | Personal Information Protection Act (PIPA), overhauled 2023 (2011) | Personal Information Protection Commission (PIPC) | Up to 3% of total revenue, excluding revenue shown to be unrelated; from September 2026, up to 10% for repeat intentional violations, incidents affecting 10 million or more people, and breaches after an ignored corrective order. | https://digitalprivacyregs.com/south-korea.html
South Sudan | Sub-Saharan Africa | Bill pending | None | Draft Data Protection Bill (validated at a 2026 workshop); no law in force | None yet (the National Communication Authority is leading the draft) | No penalties apply until a law is passed. | https://digitalprivacyregs.com/south-sudan.html
Spain | Europe | In force | Opt-in | GDPR + LOPDGDD (Organic Law 3/2018) + LSSI (2018) | AEPD | Up to EUR 20M or 4% of global turnover; LSSI fines on top. | https://digitalprivacyregs.com/spain.html
Sri Lanka | Asia-Pacific | Adopted | Opt-in | Personal Data Protection Act No. 9 of 2022, amended by Act No. 22 of 2025 (2022) | Data Protection Authority of Sri Lanka (operating) | Fines up to LKR 10M per violation, escalating for repeats, once the substantive provisions start. | https://digitalprivacyregs.com/sri-lanka.html
Sudan | Sub-Saharan Africa | No law | None | None; sectoral informatics offenses only | None | None under a general privacy law. | https://digitalprivacyregs.com/sudan.html
Suriname | Americas | Bill pending | None | Draft Privacy and Personal Data Protection Act (pending in the National Assembly) | None yet | No penalties apply until a law is passed. | https://digitalprivacyregs.com/suriname.html
Sweden | Europe | In force | Opt-in | GDPR + Data Protection Act (2018:218) (2018) | IMY | Up to EUR 20M or 4% of global turnover. | https://digitalprivacyregs.com/sweden.html
Switzerland | Europe | In force | Hybrid | Federal Act on Data Protection (revFADP) (2023) | FDPIC | Criminal fines up to CHF 250,000, aimed primarily at responsible individuals; a business can be fined up to CHF 50,000 where identifying the individual would be disproportionate. | https://digitalprivacyregs.com/switzerland.html
Syria | Middle East & North Africa | Adopted | None | Law No. 12 of 2024 on the Protection of Electronic Personal Data (2024) | Personal Data Protection Authority provided by law; operating status unclear | No enforcement has been observed under the 2024 law. | https://digitalprivacyregs.com/syria.html
Taiwan | Special | In force | Opt-in | Personal Data Protection Act (PDPA) (2010) | Personal Data Protection Commission (preparatory office; a November 2025 amendment makes it the sole authority from a date not yet set), with sectoral ministries in the meantime | 2023 amendments raised fines (to NTD 15M for serious security failures) after the iRent breach; criminal exposure for unlawful use. | https://digitalprivacyregs.com/taiwan.html
Tajikistan | Asia-Pacific | In force | Opt-in | Law on Personal Data Protection (2018) | Communications service under the Government | The authority can impose administrative fines. | https://digitalprivacyregs.com/tajikistan.html
Tanzania | Sub-Saharan Africa | In force | Opt-in | Personal Data Protection Act 2022 (2022) | Personal Data Protection Commission (PDPC) | Administrative fines set by the PDPC up to TZS 100M; criminal fines for companies reach TZS 5B. | https://digitalprivacyregs.com/tanzania.html
Thailand | Asia-Pacific | In force | Opt-in | Personal Data Protection Act (PDPA) (2019) | Personal Data Protection Committee (PDPC) | Administrative fines to THB 5M, criminal penalties for sensitive-data violations, and statutory damages with punitive multipliers. | https://digitalprivacyregs.com/thailand.html
Timor-Leste | Asia-Pacific | No law | None | None; constitutional privacy right | None | None. | https://digitalprivacyregs.com/timor-leste.html
Togo | Sub-Saharan Africa | In force | Opt-in | Law 2019-014 on Personal Data Protection (2019) | IPDCP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/togo.html
Tonga | Oceania | Adopted | Opt-in | Privacy Act 2025 (Act 34 of 2025) (2025) | Privacy Commissioner (provided by the Act; appointment not yet announced) | The Act provides for penalties; breach notification duties apply only two years after commencement. | https://digitalprivacyregs.com/tonga.html
Trinidad and Tobago | Americas | Adopted | Opt-in | Data Protection Act 2011 (partially proclaimed) (2011) | Office of the Information Commissioner (partially constituted) | Penalties for the core duties are not yet operative. | https://digitalprivacyregs.com/trinidad-and-tobago.html
Tunisia | Middle East & North Africa | In force | Opt-in | Organic Law 2004-63 on Personal Data Protection (2004) | INPDP | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/tunisia.html
Turkey | Europe | In force | Opt-in | Law No. 6698 on Protection of Personal Data (KVKK), amended 2024 (2016) | KVKK (Personal Data Protection Authority) | Administrative fines revalued each year; the 2026 range runs from TRY 85,437 to TRY 17,092,242 per violation. | https://digitalprivacyregs.com/turkey.html
Turkmenistan | Asia-Pacific | In force | Opt-in | Law on Information about Private Life and its Protection (2017) | State bodies; no independent DPA | The law provides for administrative sanctions. | https://digitalprivacyregs.com/turkmenistan.html
Tuvalu | Oceania | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/tuvalu.html
Uganda | Sub-Saharan Africa | In force | Opt-in | Data Protection and Privacy Act 2019 (2019) | Personal Data Protection Office (PDPO) | Fines and imprisonment; corporate fines tied to turnover percentages for some offenses. | https://digitalprivacyregs.com/uganda.html
Ukraine | Europe | In force | Opt-in | Law No. 2297-VI on Personal Data Protection (2010) | Parliament Commissioner for Human Rights (Ombudsman) | Modest administrative fines; the pending bill would raise them sharply. | https://digitalprivacyregs.com/ukraine.html
United Arab Emirates | Middle East & North Africa | Adopted | Opt-in | Federal Decree-Law No. 45/2021 (PDPL); DIFC and ADGM run separate GDPR-style regimes (2021) | UAE Data Office (federal); DIFC and ADGM Commissioners in the financial free zones | To be set by the pending executive regulations; DIFC fines have already reached six figures. | https://digitalprivacyregs.com/united-arab-emirates.html
United Kingdom | Europe | In force | Opt-in | UK GDPR + Data Protection Act 2018 + PECR, amended by the Data (Use and Access) Act 2025 (2018) | Information Commission (operating as the ICO), board-led since September 30, 2026 | Fines reach GBP 17.5M or 4% of global annual turnover, whichever is higher. | https://digitalprivacyregs.com/united-kingdom.html
United States | Americas | In force | Opt-out | No federal comprehensive law; 24 state comprehensive laws (20 in effect) + sectoral statutes (COPPA, HIPAA, GLBA, FCRA, TCPA, CAN-SPAM) (2020) | FTC (Section 5) + state Attorneys General + California Privacy Protection Agency | State AG actions typically $7,500 per violation ($2,500-$7,500 under CCPA); FTC consent decrees; TCPA statutory damages of $500-$1,500 per call or text. | https://digitalprivacyregs.com/united-states.html
Uruguay | Americas | In force | Opt-in | Law 18.331 on Personal Data Protection (2008) | URCDP | Administrative fines apply, alongside registry sanctions. | https://digitalprivacyregs.com/uruguay.html
Uzbekistan | Asia-Pacific | In force | Opt-in | Law on Personal Data (2019, amended 2021) (2019) | Personalization Agency under the Cabinet of Ministers (Uzkomnazorat oversight) | Administrative fines; blocking powers used against non-compliant platforms. | https://digitalprivacyregs.com/uzbekistan.html
Vanuatu | Oceania | Adopted | Opt-in | Data Protection and Privacy Act No. 13 of 2024 (2024) | Deputy Commissioner of Data Protection and Privacy under the Digital Safety Authority (not yet operational) | The Act provides for penalties that no operating regulator yet enforces. | https://digitalprivacyregs.com/vanuatu.html
Venezuela | Americas | No law | None | None; constitutional habeas data and case law only | None | None under a general privacy law. | https://digitalprivacyregs.com/venezuela.html
Vietnam | Asia-Pacific | In force | Opt-in | Law on Personal Data Protection (Law 91/2025/QH15) + Decree 356/2025 (2025) | Ministry of Public Security (A05) | Administrative penalties with turnover-based elements introduced through the new framework; criminal exposure for data trafficking. | https://digitalprivacyregs.com/vietnam.html
Yemen | Middle East & North Africa | No law | None | No comprehensive law | None | None. | https://digitalprivacyregs.com/yemen.html
Zambia | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2021 (2021) | Office of the Data Protection Commissioner | Some violations bring fines up to 2% of annual turnover. | https://digitalprivacyregs.com/zambia.html
Zimbabwe | Sub-Saharan Africa | In force | Opt-in | Data Protection Act 2021 (Cyber and Data Protection Act) (2021) | POTRAZ (as Data Protection Authority) | The law provides for fines and criminal penalties. | https://digitalprivacyregs.com/zimbabwe.html