Loading...
107 articles
Argentina's Personal Data Protection Law (Ley 25.326) governs data privacy with EU adequacy status confirmed January 2024. Covers AAIP enforcement, habeas data, Ley Olimpia, pending GDPR reform, and 2024-2026 developments.
Australia's Privacy Act 1988 (Cth), 13 Australian Privacy Principles, OAIC enforcement, the new statutory tort (June 2025), NDB scheme, and 2024-2026 reform timeline — verified May 2026.
Austria enforces data privacy through the GDPR and DSG (Datenschutzgesetz). Learn about DSB enforcement, constitutional rights, AI Act rules, penalties, and breach rules.
Bahrain PDPL (Law No. 30 of 2018): supervisory authority, 72-hour breach notification, Resolution 42/2022 adequacy list (83 countries), DPG sector mandates, penalties up to BD 40,000. Updated May 2026.
Bangladesh enacted its first comprehensive data protection law, the Personal Data Protection Ordinance 2025. Learn about data subject rights, localization rules, the February 2026 amendment, penalties, and the May 2027 enforcement deadline.
Belgium enforces data privacy through GDPR, the Law of 30 July 2018, and Article 22 of the Constitution. APD/GBA fines, AI Act (BIPT), breach rules, and 2025-2026 decisions.
Guide to Bermuda Personal Information Protection Act covering consent, data subject rights, Privacy Commissioner enforcement, and cross-border rules.
Complete guide to Brazil's LGPD data privacy law. Covers the 10 legal bases, ANPD enforcement, penalties up to BRL 50M, EU adequacy decision, and compliance requirements.
Bulgaria enforces GDPR through the ZZLD (amended Aug 2024), supervised by the CPDP. Covers EGN protection, NRA breach, EU AI Act, NIS2, Schengen SIS, and compliance steps.
Complete guide to Canada data privacy laws including PIPEDA, Quebec Law 25, Alberta and BC PIPA. Covers penalties up to $25M, breach notification rules, and 2026 reform status.
Complete guide to Chile data privacy laws: Ley 21.719 (2024) replaces Ley 19.628, creates the Agencia de Protección de Datos Personales, GDPR-aligned rights, penalties up to 20,000 UTM, and enforcement from December 2026.
China's PIPL, amended Cybersecurity Law (Jan 2026), and Data Security Law form a strict data protection regime. Consent requirements, cross-border transfer rules, penalties up to CNY 10 million, compliance steps.
Colombia protects personal data through constitutional habeas data rights and Ley 1581 of 2012. Covers SIC enforcement, RNBD, cross-border transfers, Worldcoin shutdown, and 2025 reform bills.
Country-by-country guide to cookie consent requirements: the EU ePrivacy + GDPR opt-in model, the UK DUAA 2025 changes, the US state-law patchwork, and 30+ other jurisdictions including Brazil, China, India, and Australia.
Costa Rica data privacy law explained: Ley 8968, PRODHAB authority, constitutional basis, consent, data subject rights, database registration, cross-border transfers, penalties, and 2026 reform status.
Croatia enforces GDPR through the Act on Implementation (NN 42/2018) and AZOP, which imposed nearly EUR 7M in fines during 2025. Learn constitutional basis, OIB protections, cross-border transfer rules, EU AI Act overlay, and compliance steps.
Cyprus data privacy law explained: GDPR + Law 125(I)/2018, OCPDP enforcement, constitutional basis, DPO rules, cross-border transfers, EU AI Act, and 2024-2026 fines.
Czech Republic data privacy laws explained: GDPR + Act No. 110/2019 Coll., the ÚOOÚ supervisory authority, the EUR 13.9M Avast fine, public body exemptions, EU AI Act overlay, and 2024–2026 developments.
Country-by-country guide to data localization and residency requirements: China CSL 2026 update, Russia, India DPDP Rules, Vietnam, Indonesia, Nigeria NDPA 2023, Saudi Arabia, Kazakhstan, EU, and more.
Complete guide to DPO requirements worldwide. Covers GDPR Articles 37-39 triggers, EDPB guidelines, and DPO-equivalent rules in Brazil, China, Singapore, Malaysia, India, South Korea, UAE, and more.
Data retention law has two meanings: the GDPR storage-limitation principle (keep no longer than necessary) and mandatory telecom metadata laws. Compare rules across 14 countries including CJEU case law through 2024.
Denmark enforces GDPR through courts, not direct DPA fines. Learn how Datatilsynet works, the Danish Data Protection Act, EU AI Act Law 467/2025, CPR numbers, and compliance requirements.
GDPR applies to US companies that target or monitor people in the EU under Article 3(2). Learn the scope test, EU representative rule, and how to comply.
Complete guide to Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP): constitutional basis, SPDP authority, first sanctions (Dec 2025), DPO requirements, cross-border transfers, and business compliance.
Egypt's Personal Data Protection Law No. 151 of 2020 and Ministerial Decree 816/2025 (Executive Regulations): licensing regime, PDPC authority, data subject rights, cross-border transfers, penalties, and the October 2026 compliance deadline.
Estonia enforces data privacy through the EU GDPR and the Personal Data Protection Act (2019). Learn about AKI enforcement, the EUR 3 million Apotheka fine, constitutional rights, e-Estonia context, and business compliance obligations.
Complete guide to EU adequacy decisions under GDPR Article 45: all 17 adequate countries, the UK December 2025 renewal, the Brazil 2026 decision, the January 2024 review of 11 pre-GDPR decisions, and DPF litigation risks.
EU AI Act bans social scoring, facial scraping, and workplace emotion recognition since Feb 2025. Layers onto GDPR, demands FRIAs, and carries EUR 35M fines.
Complete guide to the EU ePrivacy Directive cookie law: consent requirements, the strictly-necessary exemption, how it interacts with GDPR, the withdrawn ePrivacy Regulation, and the November 2025 Digital Omnibus cookie proposals.
Complete guide to EU data privacy law: the GDPR framework across 27 member states, the EU AI Act phased timeline, the ePrivacy Directive, the withdrawn ePrivacy Regulation, the 2025 GDPR Procedural Regulation, the November 2025 Digital Omnibus proposal, and the wider digital rulebook.
Complete guide to the EU-US Data Privacy Framework: history, self-certification, the Data Protection Review Court, the Latombe case (dismissed September 2025, appealed to CJEU as C-703/25 P), PCLOB disruption, and what happens if the DPF falls.
Finland data privacy guide: GDPR, Data Protection Act 1050/2018, workplace privacy, Act 1377/2025 AI supervision, DPO enforcement, 2024-2026 fines, and compliance tips.
France enforces data privacy through GDPR and the Loi Informatique et Libertés. Learn about CNIL fines, cookie rules, breach notification, AI Act, and penalties.
Step-by-step GDPR compliance checklist: data mapping, lawful bases, privacy notices, DPIAs, breach procedures, DPO, AI Act obligations, and the November 2025 Digital Omnibus changes.
What valid consent means under GDPR: the four elements of Article 4(11), Article 7 conditions, explicit consent for special-category data, children consent, cookie rules, consent-or-pay models, and 2025 enforcement.
Complete guide to GDPR Articles 33 and 34 breach notification: the 72-hour rule, what counts as a personal data breach, processor duties, EDPB Guidelines 9/2022, enforcement cases, and how the clock starts.
GDPR Article 28 requires a written DPA with every processor. Learn the 8 mandatory clauses, sub-processor rules, and consequences of non-compliance.
The eight GDPR data subject rights under Chapter III: access, rectification, erasure, restriction, portability, objection, automated-decision rights, and the right to be informed. Timelines, exemptions, and 2026 enforcement.
GDPR Article 35 requires a DPIA before high-risk processing. Learn when it is mandatory, what it must contain, and when to consult your supervisory authority.
GDPR Articles 37-39 explained: the 3 mandatory DPO triggers, tasks, independence rules, conflict-of-interest bar, and fines for non-compliance.
GDPR fines explained: the two-tier Article 83 structure, EDPB fine-calculation methodology, the Deutsche Wohnen corporate-liability ruling, every major fine and its current appeal status, non-monetary consequences, and how to reduce your exposure.
Practical GDPR compliance guide for small businesses: what applies, the Article 30(5) records derogation, when you need a DPO, the 2025 Digital Omnibus simplification proposal, sector examples, and low-cost steps.
GDPR Chapter V bars EU data transfers abroad without a valid mechanism. Learn adequacy, SCCs, BCRs, derogations, and Schrems II in plain English.
GDPR Article 17 gives you the right to demand erasure of personal data in 6 grounds. Learn the exceptions, Google Spain ruling, and how to make a request.
Learn how to respond to a GDPR DSAR under Article 15: the one-month deadline, what data to provide, fees, refusals, and a step-by-step response workflow.
Side-by-side comparison of GDPR and CCPA/CPRA: scope, consent models, consumer rights, sensitive data, penalties, CPPA enforcement, and the 2025 ADMT/cybersecurity regulations.
Side-by-side comparison of the EU GDPR and Brazil's LGPD: legal bases (6 vs 10), penalties, data subject rights, the ANPD vs EU DPAs, breach notification, and the January 2026 mutual adequacy decision.
Side-by-side comparison of GDPR and China's PIPL: scope, legal bases, individual rights, penalties, cross-border transfers, and 2025-2026 regulatory updates.
The EU GDPR and UK GDPR started identical after Brexit. The Data (Use and Access) Act 2025—in force February 2026—has introduced recognised legitimate interests, new ADM rules, SAR stop-the-clock, and cookie exemptions. The EU renewed UK adequacy through December 2031.
Germany enforces the EU GDPR through the BDSG, 17 supervisory authorities, and a constitutional right to informational self-determination. Full guide to compliance, DPO rules, employee data, AI Act overlay, and enforcement.
Complete guide to Ghana data privacy laws: Data Protection Act 2012 (Act 843), the Data Protection Commission, mandatory registration, data subject rights, cross-border transfer rules, penalties, and the pending Data Protection Bill 2025 that would modernize the framework.
Greece data privacy laws explained: GDPR implementation via Law 4624/2019, Hellenic Data Protection Authority enforcement, Clearview AI fine, Predatorgate, EU AI Act, cookies, and compliance tips.
Complete guide to Hong Kong's Personal Data (Privacy) Ordinance (PDPO, Cap. 486): six Data Protection Principles, 2021 anti-doxxing regime, breach handling, cross-border transfer rules, AI guidance, and 2026 reform proposals.
Hungary data privacy law explained: GDPR + Info Act CXII of 2011, NAIH enforcement, AI Act overlay, cross-border transfers, DPO rules, penalties up to EUR 20 million.
Iceland applies the GDPR through the EEA Agreement and Act No. 90/2018. Learn how Persónuvernd enforces data protection, what fines apply, and how businesses must comply.
India's Digital Personal Data Protection Act 2023 and the DPDP Rules notified November 2025 form the country's first comprehensive data protection regime. This guide covers consent, Data Principal rights, the Data Protection Board, penalties up to INR 250 crore, cross-border transfers, and the phased compliance timeline to May 2027.
Man arrested in Assam, India for using AI tools to create explicit deepfake images of his ex-girlfriend and selling access online. Indian deepfake laws explained.
Indonesia's Personal Data Protection Law (UU PDP, Law 27/2022) is fully in force since October 2024. Guide covers supervisory authority status, data subject rights, breach notification, cross-border transfers, criminal and administrative penalties, and compliance steps.
Ireland's DPC enforces GDPR for Meta, Google, TikTok and more. Learn about the Data Protection Act 2018, record fines exceeding 4 billion euros, AI Act obligations, cross-border transfer rules, and your rights.
Complete guide to Israel data privacy laws. Covers the Protection of Privacy Law 1981, Amendment 13 (effective August 14, 2025), PPA enforcement, EU adequacy renewal, DPO requirements, and compliance.
Italy enforces data privacy through the GDPR, the Privacy Code (D.Lgs. 196/2003), and the Garante. Covers Law 132/2025 AI law, criminal penalties, Enel EUR 79M fine, and 2025-2026 enforcement.
Complete guide to Jamaica's Data Protection Act 2020 -- the OIC, eight data protection standards, phased commencement, registration, data subject rights, breach notification, cross-border transfers, and penalties.
Japan's APPI governs personal data with mandatory breach reporting, cross-border transfer rules, and EU mutual adequacy. The January 2026 PPC reform policy introduces administrative fines for the first time, with implementation expected by 2028.
Kenya enforces data privacy through the Data Protection Act 2019 and the ODPC. Learn about the registration regime, data subject rights, 72-hour breach notification, cross-border transfer rules, and ODPC enforcement actions including KES 26M+ in fines through 2024.
Latvia data privacy laws explained: GDPR + Personal Data Processing Law, DVI enforcement (EUR 1.2M TET fine upheld 2024, EUR 300K ZZ Dats fine 2025), EU AI Act overlay, criminal penalties, and compliance steps.
Complete guide to Liechtenstein data protection: GDPR via EEA, the 2018 Data Protection Act (DSG), Datenschutzstelle enforcement, DPO rules, financial sector compliance, blockchain, AI Act, and 2024–2026 updates.
Lithuania implements GDPR through its 2018 Law on Legal Protection of Personal Data. Learn about the VDAI, the EUR 2.4M Vinted fine, constitutional basis, data subject rights, DPO requirements, cross-border transfers, the EU AI Act overlay, and 2024-2025 enforcement trends.
Luxembourg data privacy laws explained: GDPR implementation, Law of 1 August 2018, CNPD enforcement powers, the EUR 746M Amazon fine and its annulment on appeal, EU AI Act, financial sector rules, and 2024-2026 developments.
Malaysia enforces data privacy through the PDPA 2010 (Act 709) and its 2024 amendments. Learn about JPDP enforcement, 7 data protection principles, breach notification, and penalties up to RM 1 million.
Malta data privacy laws: GDPR, Cap. 586, and IDPC enforcement. Covers the age-13 digital consent rule, iGaming sector compliance, EU AI Act designation, and cross-border transfer rules.
Mexico replaced its 2010 data privacy law in March 2025. New LFPDPPP, INAI dissolved, SABG enforces. ARCO rights, penalties up to MXN 37.5M, AI provisions explained.
Morocco data protection under Law 09-08: CNDP registration rules, constitutional basis, legal bases, data subject rights, cross-border transfers, penalties, and 2025-2026 developments.
Complete guide to Netherlands data privacy laws: GDPR, UAVG, Autoriteit Persoonsgegevens enforcement, Clearview AI EUR 30.5M fine, EU AI Act, breach rules, DPO requirements, and 2024-2026 developments.
New Zealand Privacy Act 2020: 13 IPPs, IPP 3A indirect-collection rule (May 2026), Biometric Code 2025, breach notification, IPP 12 cross-border transfer, and enforcement powers.
Complete guide to Nigeria data privacy laws: the NDPA 2023, GAID 2025, NDPC enforcement, DCPMI registration, data subject rights, breach notification, penalties up to 2% annual revenue.
Norway applies the full GDPR through the EEA Agreement. The Personal Data Act 2018 supplements it with national rules. Datatilsynet enforces with fines up to EUR 20 million. Updated 2026.
Pakistan has no enacted data protection law as of 2026. PECA 2016 (amended January 2025) and sector rules apply. Full guide to the pending Personal Data Protection Bill.
Panama's Law 81 of 2019 and Executive Decree 285 of 2021 govern personal data protection. Learn about ANTAI oversight, ARCO rights, consent rules, cross-border transfers, sectoral rules, penalties, and 2025 updates.
Peru data privacy law explained: Law 29733, DS 016-2024-JUS (March 2025), DPO requirements, 48-hour breach notification, ARCO-PD rights, penalties up to 100 UIT. Updated May 2026.
Complete guide to Philippine data privacy law under the Data Privacy Act of 2012 (RA 10173). Covers constitutional basis, NPC enforcement, administrative fines, data subject rights, breach notification, cross-border transfers, DPO requirements, and 2024-2026 NPC developments.
Complete guide to Poland data privacy laws: EU GDPR, the Polish Personal Data Protection Act 2018, UODO enforcement record, constitutional basis, penalties, breach notification, and 2024-2026 developments.
Portugal data privacy law explained: GDPR implementation via Lei 58/2019, the CNPD supervisory authority, constitutional basis in Article 35, the 2019 deliberation disapplying national provisions, penalties up to €20M, and 2024–2026 enforcement.
Complete guide to Qatar data privacy laws: Law No. 13 of 2016 (PDPPL), the NCSA/CDP supervisory authority, the QFC Data Protection Regulations 2021, data subject rights, breach notification, cross-border transfers, and penalties up to QAR 5 million.
Complete guide to Romania data privacy laws: GDPR implementation via Law 190/2018, ANSPDCP enforcement, public authority fine caps, employee monitoring rules, biometric data restrictions, EU AI Act overlap, and 2024–2025 enforcement actions.
Complete guide to Russia's data privacy laws: Federal Law 152-FZ, Roskomnadzor enforcement, data localization (242-FZ), the 2025 fine increases under 420-FZ (up to 500M rubles), new criminal liability under 421-FZ (up to 10 years), breach notification, and SORM surveillance.
Complete guide to Saudi Arabia's Personal Data Protection Law (PDPL), Royal Decrees M/19 and M/148, SDAIA enforcement, data subject rights, breach notification, penalties up to SAR 5M, cross-border transfer rules, and 2025–2026 regulatory updates.
Singapore PDPA explained: 9 data protection obligations, mandatory DPO, breach notification in 3 days, penalties up to 10% turnover, data portability status, DNC registry, AI guidelines, and 2025-2026 enforcement cases.
Slovakia enforces data privacy through GDPR and Act No. 18/2018, overseen by the UOOU. Learn about birth number protections, enforcement, the EU AI Act overlay, and NIS2 compliance.
Slovenia was the last EU member state to adopt a GDPR implementing law. Learn how ZVOP-2 (in force January 2023), the Information Commissioner, Article 38 constitutional protection, biometric restrictions, processing logs, and the EU AI Act shape compliance in Slovenia.
South Africa POPIA compliance guide: eight conditions for lawful processing, Information Regulator enforcement actions, 2025 regulation amendments, cross-border transfers under Section 72, and penalties up to ZAR 10 million.
South Korea's PIPA is among the world's strictest data privacy laws. Learn about the March 2026 amendment, 10% turnover penalties, CEO accountability, PIPC enforcement, data subject rights, and cross-border transfer rules.
Spain enforces data privacy through the GDPR, the LOPDGDD (Organic Law 3/2018), and the highly active AEPD. Covers digital rights, AESIA/AI Act, biometric enforcement, penalties up to 20M euros, and 2025-2026 developments.
Complete guide to Sri Lanka data privacy laws. Covers the PDPA No. 9 of 2022, Amendment Act No. 22 of 2025, the Data Protection Authority, enforcement timeline, data subject rights, penalties, and cross-border transfers.
Complete guide to EU Standard Contractual Clauses: the 2021 modular SCCs, Transfer Impact Assessments, supplementary measures, the pending Article 3(2) SCCs, UK IDTA, and 2024-2026 enforcement.
Sweden enforces GDPR through the Data Protection Act (2018:218) and IMY. Covers constitutional exemptions, offentlighetsprincipen, enforcement cases, penalties, AI Act overlay, and compliance requirements.
Complete guide to Switzerland's revised Federal Act on Data Protection (nFADP/revDSG), in force September 1, 2023. Covers FDPIC enforcement, CHF 250,000 individual criminal penalties, cross-border transfers, Swiss-US DPF, and 2025-2026 developments.
Taiwan PDPA guide: the November 2025 amendments establish the Personal Data Protection Commission (PDPC), mandatory breach notification, strengthened fines, and new DPO requirements.
Tanzania's Personal Data Protection Act 2022 is now actively enforced. Full guide: PDPC, data subject rights, DPO requirements, Zanzibar rules, penalties up to TZS 5 billion, and compliance steps.
Thailand's PDPA governs personal data collection, use, and transfer. Updated 2026 guide: PDPC enforcement record, the 2024 first fine and 2025 wave, the Emergency Decree on Technology Crimes, BCR framework, data subject rights, DPO requirements, and penalties.
Complete guide to Tunisia data protection law: Organic Law 2004-63, the INPDP authority, registration and authorization rules, Convention 108+, cross-border transfers, penalties, and the 2025 GDPR-alignment reform bill.
Turkey's KVKK (Law No. 6698) governs personal data protection. Law No. 7499 (June 2024) overhauled cross-border transfers and special-category rules. Learn about SCCs, adequacy decisions, VERBIS, 2026 fines up to 17M TRY, and KVKK Board enforcement.
Complete guide to UAE data privacy laws: federal PDPL (Decree-Law 45/2021), DIFC Data Protection Law 2020, ADGM Regulations 2021, penalties, cross-border transfers, and 2025-2026 developments.
Complete 2026 guide to UK data privacy laws: UK GDPR, Data Protection Act 2018, the Data Use and Access Act 2025 (DUAA) reforms, ICO enforcement, EU adequacy renewed to 2031, and PECR cookie changes.
Complete guide to Ukraine's data privacy laws: the 2010 Law on Personal Data Protection, the Ombudsperson as supervisory authority, Draft Law 8153 and its GDPR-alignment status, EU accession obligations, cross-border transfer rules, martial-law context, and penalties.
Complete guide to Uruguay data privacy laws: Law 18.331, Decree 414/009, DPO rules, 72-hour breach notification, EU adequacy reaffirmed 2024, Convention 108+, and URCDP enforcement.
Complete guide to Vietnam data privacy laws. Covers Law No. 91/2025/QH15 (effective January 1, 2026), Decree 356, cross-border transfers, data subject rights, and penalties.
GDPR is the EU data protection law. Learn the 7 principles, your data subject rights, who must comply, and fines up to EUR 20M or 4% of global turnover.