As an update to our smaller breakdown of Global Data Privacy Laws we now have included every country listed in alphabetical order with the Country, key law, when it was established, and the data protection authority for that country. If you’d like a free data privacy audit for your business opt-in today with Captain Compliance to see how we can help get you compliant with global privacy laws for wherever you operate.
This webpage presents a detailed table summarizing data privacy laws, treaties, and data protection authorities across countries and jurisdictions worldwide, based on research conducted by the World Privacy Forum (WPF) as of June 8, 2024. The table includes key information such as the primary data protection legislation, the year it was established or last amended, and the responsible data protection authority for each country. Users can explore which countries have comprehensive data privacy laws, draft bills, or no legislation in place, along with details on participation in international treaties like Convention 108 and the Malabo Convention. This resource is ideal for researchers, policymakers, lawyers, and privacy advocates seeking to understand global data governance trends and regional patterns. The data is based on the United Nations M49 Standard for country and region classifications, ensuring a standardized and authoritative framework.
| Country | Key Law | Key Law Established or Amended | Data Protection Authority |
|---|---|---|---|
| Afghanistan | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Albania | Act on the Protection of Personal Data (Law No. 9887, Amended by Law No. 120/2014) | 2014 | The Information and Data Protection Commission |
| Algeria | Law No. 18-07 on protection of individuals in the processing of personal information | 2023 | National Authority for Protection of Personal Data |
| American Samoa | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Andorra | Qualified Act of personal data protection | 2021 | Data Protection Agency of Andorra |
| Angola | Personal Data Protection Law | 2011 | Data Protection Agency |
| Anguilla | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Antigua & Barbuda | Data Protection Act 2013 | 2013 | Information Commissioner |
| Argentina | Personal Data Protection Law No. 25,326 | 2018 | Agency for Access to Public Information |
| Armenia | Law of the Republic of Armenia on Protection of Personal Data | 2021 | Personal Data Protection Agency |
| Aruba | National Ordinance on Personal Registration | 2011 | Ministry of Justice |
| Australia | Privacy Act 1988 | 2022 | Office of the Australian Information Commissioner |
| Austria | Federal Act concerning the Protection of Personal Data | 2018 | Austrian Data Protection Authority |
| Azerbaijan | Law No. 998-IIIQ on Personal Data | 2010 | Ministry of Transport, Communications and High Technologies |
| Bahamas | Data Protection Act CH.324.A | 2003 | Office of the Data Protection Commissioner |
| Bahrain | Law No. (30) of 2018 with Respect to Personal Data Protection Law | 2022 | Personal Data Protection Authority |
| Bangladesh | [Draft] Revised Draft Data Protection Act 2023 | 2018 | Proposed: Data Protection Office |
| Barbados | Data Protection Act, 2019-29 | 2019 | Data Protection Commissioner |
| Belarus | Law on Personal Data Protection 2021 | 2021 | National Personal Data Protection Center |
| Belgium | Law on the Protection of Natural Persons with regard to the Processing of Personal Data | 2018 | Data Protection Authority |
| Belize | Data Protection Act No. 45 of 2021 | 2021 | Data Protection Commissioner |
| Benin | Law No. 2017-20 of April 20, 2018 | 2018 | Data Protection Authority |
| Bermuda | Personal Information Protection Act 2016 | 2016 | Office of the Privacy Commissioner for Bermuda |
| Bhutan | Bhutan Information, Communications and Media Act 2006 | 2018 | Bhutan Infocomm and Media Authority |
| Bolivia | [Draft] Draft Law N°185/2019 | – | No apparent DPA |
| Bonaire, Sint Eustatius & Saba | Personal Data Protection Act BES | 2010 | Commission Supervision Personal Data Protection BES |
| Bosnia & Herzegovina | Law on the protection of personal data | 2011 | Personal Data Protection Agency in Bosnia and Herzegovina |
| Botswana | Botswanan Data Protection Act, 2018 | 2018 | Information and Data Protection Commission |
| Bouvet Island | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Brazil | General Law for the Protection of Personal Data (LGPD) | 2018 | National Data Protection Authority |
| British Indian Ocean Territory | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| British Virgin Islands | Virgin Islands Data Protection Act 2021 | 2021 | Office of the Information Commissioner |
| Brunei Darussalam | [Draft] Personal Data Protection for the Private Sector 2021 | – | Authority for Info-communications Technology Industry |
| Bulgaria | Personal Data Protection Act | 2023 | Commission for Personal Data Protection |
| Burkina Faso | Data Protection Act 2021 | 2021 | Commission Informatique et Libertés |
| Burundi | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Cabo Verde | Lei No. 120.IX.2021 | 2021 | National Data Protection Commission |
| Cambodia | [Sectoral] Article 32 of the Law on Electronic Commerce, 2019 | – | No apparent DPA |
| Cameroon | [Draft] Draft Bill, 30 May 2023 | – | No apparent DPA |
| Canada | Personal Information Protection and Electronic Documents Act | 2019 | Privacy Commissioner of Canada |
| Cayman Islands | Data Protection Law 2021 | 2021 | Office of the Ombudsman |
| Central African Republic | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Chad | Personal Data Protection Act No. 007/PR/2015 | 2019 | National Agency for Information Security and Electronic Certification |
| Chile | Law 19,628 on Protection of Private Life | 2020 | Council for Transparency |
| China | Personal Information Protection Law | 2021 | Cyberspace Administration of China |
| China: Hong Kong SAR | Personal Data (Privacy) Ordinance | 2022 | Office of the Privacy Commissioner for Personal Data |
| China: Macau SAR | Personal Data Protection Act | 2005 | Office for Personal Data Protection |
| Christmas Island | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Cocos (Keeling) Islands | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Colombia | Law 2157 | 2021 | Superintendence of Industry and Commerce |
| Comoros | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Congo | Law No. 29-2019 on personal data protection | 2019 | No apparent DPA |
| Cook Islands | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Costa Rica | Law No. 7975, Undisclosed Information Law | 2016 | Agency for the Protection of Personal Data of Inhabitants |
| Croatia | Law on the Implementation of the General Regulation on Data Protection | 2018 | Croatian Personal Data Protection Agency |
| Cuba | Law 149/2022 De Pretección do Datos Personales | – | Ministry of Justice |
| Curaçao | Privacy Act Curaçao, 2013 | 2013 | Data Protection Board |
| Cyprus | Law 125(I)2018 | 2018 | Office of the Commissioner for Personal Data Protection |
| Czechia | Personal Data Processing Act of 2019 | 2019 | Office for Personal Data Protection |
| Côte d’Ivoire | Law No. 2013-450 relating to the protection of Personal Data | 2013 | The Telecommunications Regulatory Authority of Côte d’Ivoire |
| Democratic People’s Republic of Korea | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Democratic Republic of the Congo | Law on Telecommunications, Information and Communication Technology No. 20/017 | 2023 | Post and Telecommunications Regulatory Authority of Congo |
| Denmark | Data Protection Act | 2018 | Danish Data Protection Agency |
| Djibouti | Comprehensive data protection is not in place. | – | No apparent DPA |
| Dominica | Law No. 172-13 on the Comprehensive Protection of Personal Data | 2013 | The Superintendence of Banks |
| Dominican Republic | Ley No. 172-13 sobre Protección de Datas de Carácter Personal | – | No apparent DPA |
| Ecuador | Organic Law on the Protection of Personal Data 2021 | 2021 | Superintendency of Data Protection |
| Egypt | Personal Data Protection Law, Law No. 151 of 2020 | 2020 | Personal Data Protection Center |
| El Salvador | [Sectoral] Ley de Protección de Datos Personales y Habeas Data | – | No apparent DPA |
| Equatorial Guinea | Personal Data Protection Law, Ley Núm. 1/2016 | 2016 | Governing Body for the Protection of Personal Data |
| Eritrea | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Estonia | Personal Data Protection Act | 2018 | Data Protection Inspectorate |
| Eswatini | The Data Protection Act No. 5 of 2022 | – | Eswatini Data Protection Authority |
| Ethiopia | FDRE Personal Data Protection Proclamation No. 1321/2024 | – | The Data Protection Commission of Ethiopia |
| Falkland Islands (Malvinas) | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Faroe Islands | Data Protection Act | 2020 | Data Protection Authority of the Faroe Islands |
| Fiji | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Finland | Data Protection Act (supplements GDPR) | 2018 | Office of the Data Protection Ombudsman |
| France | Law No. 2018-493 relating to the protection of personal data | 2018 | National Commission for Computing and Liberties |
| French Guiana | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| French Polynesia | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| French Southern Territories | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Gabon | Law No. 001/2011 on the Protection of Personal Data | 2011 | The National Commission for the Protection of Personal Data |
| Gambia | [Draft] Data Protection and Privacy Strategy 2019 | – | No apparent DPA |
| Georgia | Law on Personal Data Protection | 2012 | Personal Data Protection Service |
| Germany | Federal Data Protection Act | 2021 | The Federal Commissioner for Data Protection and Freedom of Information |
| Ghana | Data Protection Act (Act No. 843) 2012 | 2012 | Data Protection Commission |
| Gibraltar | Data Protection Act | 2004 | Gibraltar Regulatory Authority |
| Greece | Law 4624/2019 Protection of Personal Data | 2019 | Hellenic Data Protection Authority |
| Greenland | The Data Protection Act | 2018 | Danish Data Protection Agency |
| Grenada | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Guadeloupe | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Guam | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Guatemala | [Draft] Personal Data Protection Law 2022 | – | No apparent DPA |
| Guernsey | Data Protection (Bailiwick of Guernsey) Law | 2017 | Office of the Data Protection Authority |
| Guinea | Law on Cybersecurity and Personal Data 2016 | 2016 | Regulatory Authority for Posts and Telecommunications |
| Guinea-Bissau | Supplementary Act on Personal Data Protection within ECOWAS | – | No apparent DPA |
| Guyana | [Draft] Data Protection Bill 2023 | – | No apparent DPA |
| Haiti | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Heard Island and McDonald Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Holy See | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Honduras | [Draft] Ley de Protección de Datos Personales | – | No apparent DPA |
| Hungary | Act on Informational Self-Determination and Freedom of Information | 2018 | Hungarian National Authority for Data Protection and Freedom of Information |
| Iceland | Law No. 90/2018 Act on Data Protection and the Processing of Personal Data | 2018 | Icelandic Data Protection Authority |
| India | Digital Personal Data Protection Bill 2023 | 2000 | Data Protection Board of India |
| Indonesia | Personal Data Protection Law | 2022 | Data Protection Authority |
| Iran | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Iraq | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Ireland | Data Protection Act | 2022 | Data Protection Commission |
| Isle of Man | Data Protection Act 2018 | 2018 | Information Commissioner |
| Israel | Privacy Protection Law /57411981 and 5752/1992 | 1996 | Privacy Protection Authority |
| Italy | Personal Data Protection Code | 2018 | Italian Data Protection Authority |
| Jamaica | Data Protection Act 2020 | 2020 | Office of the Information Commissioner |
| Japan | Act on the Protection of Personal Information | 2020 | Personal Information Protection Commission |
| Jersey | Data Protection (Jersey) Law 2018 | 2018 | Office of the Information Commissioner |
| Jordan | Personal Data Protection Law No. 24 of 2023 | – | Personal Data Protection Directorate |
| Kazakhstan | Law on Personal Data and Their Protection | 2020 | Ministry of Digital Development, Innovations and Aerospace Industry |
| Kenya | Data Protection Act, 2019 | 2019 | Office of the Data Protection Commissioner |
| Kiribati | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Kosovo* | Law 06/L-082 on the Protection of Personal Data | 2019 | Commissioner for Information and Privacy |
| Kuwait | Data Privacy Protection Regulation 2021 | – | Communication and Information Technology Regulatory Authority |
| Kyrgyzstan | Law on Personal Data | 2021 | State Agency for Protection of Personal Data |
| Lao People’s Dem. Republic | Electronic Data Protection Act 2017 | 2018 | Ministry of Technology and Communication |
| Latvia | The Law on the Processing of Personal Data | 2021 | The State Data Inspectorate |
| Lebanon | Law No. 81 Relating to Electronic Transactions and Personal Data | 2018 | No apparent DPA |
| Lesotho | Data Protection Act 2012 | 2013 | Data Protection Commission |
| Liberia | Supplementary Act on Personal Data Protection within ECOWAS | – | No apparent DPA |
| Libya | Data protection law does not appear to be in place. | – | No apparent DPA |
| Liechtenstein | Data Protection Act (implements GDPR) | 2018 | Data Protection Office of Liechtenstein |
| Lithuania | Law on Legal Protection of Personal Data | 2018 | State Data Inspectorate |
| Luxembourg | Data Protection Law (implements GDPR) | 2018 | National Data Protection Commission |
| Madagascar | Law No. 2014 – 038 On the protection of personal data | 2014 | Malagasy Commission on Information Technology and Liberties |
| Malawi | [Draft] Data Protection Bill 2023 | 2016 | Malawi Communications Regulatory Authority |
| Malaysia | Personal Data Protection Act 2010 | 2010 | Personal Data Protection Department |
| Maldives | [Draft] Privacy and Personal Data Protection Bill 2023 | – | No apparent DPA |
| Mali | Law n ° 2013-015 on the Protection of Personal Data | 2013 | Personal Data Protection Authority |
| Malta | Data Protection Act | 2021 | Office of the Information and Data Protection Commissioner |
| Marshall Islands | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Martinique | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Mauritania | Law 2017-020 on Personal Data Protection | 2011 | Autoritė de Protection des Données à Caractère Personnel |
| Mauritius | Data Protection Act, 2017 | 2017 | Data Protection Office of Mauritius |
| Mayotte | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Mexico | Federal Law on Protection of Personal Data Held by Private Parties | 2017 | National Institute for Transparency |
| Micronesia | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Monaco | Act no. 1.353 modifying the Act no. 1.165 | 2008 | Personal Information Control Commission |
| Mongolia | Law on Protection of Personal Information 2021 | 2021 | National Human Rights Commission of Mongolia |
| Montenegro | Personal Data Protection Law | 2017 | Agency for Personal Data Protection and Free Access to Information |
| Montserrat | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Morocco | Law No. 09-08 on the Protection of Individuals | 2009 | National Commission for the Control and the Protection of Personal Data |
| Mozambique | [Draft] Mozambique Data Protection Act 2024 | – | No apparent DPA |
| Myanmar | [Sectoral] Electronic Transactions Law | – | No apparent DPA |
| Namibia | [Draft] Data Protection Bill | – | No apparent DPA |
| Nauru | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Nepal | The Privacy Act, 2075 | 2018 | National Information Commission |
| Netherlands | Personal Data Protection Act (Implements GDPR) | 2018 | Personal Data Authority |
| New Caledonia | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| New Zealand | Privacy Act 2020 | 2020 | Privacy Commissioner |
| Nicaragua | Law No 787 Personal Data Protection | 2012 | Personal Data Protection Directorate |
| Niger | Law No. 2017-28 on the Protection of Personal Data | 2020 | High Authority for the Protection of Personal Data |
| Nigeria | Nigeria Data Protection Act 2023 | 2020 | Nigeria Data Protection Commission |
| Niue | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Norfolk Island | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| North Macedonia | Law on Personal Data Protection | 2021 | Personal Data Protection Agency |
| Northern Mariana Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Norway | Act on Processing Personal Data | 2021 | Data Protection Authority |
| Oman | Personal Data Protection Law 2022 | 2022 | The Minister of Transport, Communications, and Information Technology |
| Pakistan | [Draft] Pakistan Draft Data Protection Bill, 2023 | – | No apparent DPA |
| Palau | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Palestine | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Panama | Law 81 on Protection of Personal Data | 2019 | National Authority of Transparency and Access to Information |
| Papua New Guinea | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Paraguay | Law No. 6534 Protection of Personal Credit Data | 2020 | No apparent DPA |
| Peru | Law No. 29733 Personal Data Protection Law | 2017 | National Authority for the Protection of Personal Data |
| Philippines | Republic Act 10173 – Data Privacy Act of 2012 | 2012 | National Privacy Commission |
| Pitcairn | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Poland | The Personal Data Protection Act | 2018 | Personal Data Protection Office |
| Portugal | Personal Data Protection Law No. 58 | 2019 | National Data Protection Commission |
| Puerto Rico | Puerto Rico Data Protection Act (Law 52 of 2018) | – | Departmento de Asuntos del Consumidor |
| Qatar | Law No. 13/2016 Concerning Privacy and Protection of Personal Data | 2016 | National Cyber Governance and Assurance Affairs |
| Qatar | QFC Data Protection Regulations | 2021 | Data Protection Office |
| Republic of Korea | Personal Information Protection Act 2011 | 2020 | Personal Information Protection Commission |
| Republic of Moldova | Law No.133 on Personal Data Protection | 2021 | National Center for Personal Data Protection |
| Romania | Federal Law Regarding Personal Data | 2018 | National Supervisory Authority for Personal Data Protection |
| Russian Federation | Federal Law of 26.07.2006, No. 52-FZ On personal data | 2014 | Federal Service for Supervision of Communications |
| Rwanda | Law No. 058/2021 Relating to the Protection of Personal Data and Privacy | 2021 | National Cybersecurity Authority |
| Réunion | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Saint Barthélemy | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Saint Helena | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Saint Kitts & Nevis | Data Protection Act, 5 of 2018 | 2018 | Information Commissioner |
| Saint Lucia | Data Protection (Amendment ) Act No 2 of 2015 | 2015 | Data Protection Commissioner |
| Saint Martin | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Saint Pierre and Miquelon | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Saint Vincent and the Grenadines | Privacy Act, No. 18 of 2003 | 2003 | Ministry of Legal Affairs |
| Samoa | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| San Marino | Law n. 70: Act on Collection, Elaboration and Use of Computerised Personal Data | 2019 | Guarantor Authority for the Protection of Personal Data |
| Saudi Arabia | Personal Data Protection Law 14 September 2023 | 2021 | Saudi Data & Artificial Intelligence Authority |
| Senegal | Law N 2008- 12 Concerning Personal Data Protection | 2008 | Commission of Personal Data Protection |
| Serbia | The Law on the Protection of Personal Data | 2018 | Commissioner for Information of Public Importance and Personal Data Protection |
| Seychelles | Data Protection Act 2023 | 2003 | Office of the Data Protection Commissioner |
| Sierra Leone | Supplementary Act on Personal Data Protection within ECOWAS | – | No DPA appointed |
| Singapore | Personal Data Protection Act 2012 | 2020 | Personal Data Protection Commission |
| Sint Maarten | National ordinance personal data protection | 2010 | Personal Data Protection Supervisory Committee |
| Slovakia | Personal Data Protection Act (Implements GDPR) | 2018 | Office of Data Protection Office of the Slovak Republic |
| Slovenia | Personal Data Protection Act (ZVOP-2) | 2022 | Slovenian Data Protection Authority |
| Solomon Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Somalia | Data Protection Act 2023 | – | Somali Data Protection Authority |
| South Africa | Protection of Personal Information Act (PoPIA) 2013 | 2013 | Information Regulator of South Africa |
| South Georgia and South Sandwich Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| South Sudan | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Spain | Law 3/2018 Protection of Personal Data and guarantee of digital rights | 2018 | Data Protection Commissioner |
| Sri Lanka | Personal Data Protection Act, No. 9 of 2022 | 2022 | DPA (Authority) |
| Sudan | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Suriname | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Svalbard and Jan Mayen Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Sweden | Act 2018:218 (Implements GDPR) | 2018 | Federal Data Protection and Information Commissioner |
| Switzerland | Federal Act on Data Protection | 2020 | Federal Data Protection and Information Commissioner |
| Syrian Arab Republic | Law No. 12 of 2024 Regarding the Protection of Electronic Personal Data | – | Personal Data Protection Authority |
| São Tomé and Principe | Law No. 03/X/2.a/2015 – Protection of Personal Data | 2015 | National Data Protection Agency |
| Taiwan* | Personal Data Protection Act (PDPA) | 2016 | The Personal Data Protection Office |
| Tajikistan | Law on the Protection of Personal Information | 2018 | Communication Service |
| Thailand | Personal Data Protection Act 2019 | 2021 | Personal Data Protection Committee |
| Timor-Leste | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Togo | Law No. 2019-014 Relating to the Protection of Personal Data | 2019 | Togolese Personal data protection authority IPDCP |
| Tokelau | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Tonga | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Trinidad & Tobago | Data Protection Act 2011 | 2011 | Office of the Information Commissioner |
| Tunisia | Law No. 2004-63 Relating to the Protection of Personal Data | 2004 | National Authority for the Protection of Personal Data |
| Turkmenistan | Law on Information on Private Life and its Protection | 2017 | Cabinet of Ministers of Turkmenistan |
| Turks and Caicos Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Tuvalu | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Türkiye | Personal Data Protection Law | 2016 | Personal Data Protection Authority |
| Uganda | The Data Protection and Privacy Act 2019 | 2019 | Personal Data Protection Office |
| Ukraine | Law No. 2297-VI on Personal Data Protection | 2020 | Department for Personal Data Protection |
| United Arab Emirates | Federal Decree Law No. 45 of 2021 | 2021 | UAE Data Office |
| United Arab Emirates: Abu Dhabi Global Market | Data Protection Regulations 2021 | 2021 | ADGM Office of Data Protection |
| United Arab Emirates: Dubai IFC | Data Protection Law No. 5 of 2020 | 2020 | Commissioner of Data Protection |
| United Kingdom | Data Protection Act 2018 | 2018 | Information Commissioner’s Office |
| United Rep. of Tanzania | Personal Data Protection Act 2022 | 2022 | Personal Data Protection Commission |
| United States Minor Outlying Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| United States Virgin Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| United States of America | Privacy Act of 1974 | 1974 | Federal Trade Commission |
| Uruguay | Law No. 18331 Personal Data Protection Law | 2022 | Regulatory and Control Unit of Personal Data |
| Uzbekistan | Law on Personal Data | 2019 | Cabinet of Ministers and the State Center for Personalization |
| Vanuatu | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Venezuela | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Viet Nam | Law on Protection of Consumers’ Rights | 2023 | PDP Committee |
| Wallis and Futuna Islands | Comprehensive data protection law does not appear to be in place. | – | No apparent DPA |
| Western Sahara* | Comprehensive data protection does not appear to be in place. | – | No apparent DPA |
| Yemen | Law of the Right of Access to Information | 2012 | Commissioner-General for Information |
| Zambia | The Data Protection Act, 2021 | 2021 | Office of the Data Protection Commissioner |
| Zimbabwe | Data Protection Act 05/ 2021 | 2021 | Postal and Telecommunications Regulatory Authority |
| Åland Is. | Provincial law on data protection | 2019 | Data Protection Authority of the Åland Islands |
In an era where personal data drives global economies and digital interactions, understanding the landscape of data privacy laws is crucial for individuals, businesses, and policymakers alike. This webpage offers a comprehensive overview of data protection legislation across the globe, detailing key laws, their establishment or amendment dates, and the authorities responsible for enforcement in each country. Compiled from rigorous research by the World Privacy Forum and aligned with the UN M49 Standard, this table provides a clear snapshot of how nations are addressing data privacy, from robust frameworks like the GDPR to emerging draft bills in developing regions.
As data privacy continues to shape the future of digital trust, this global overview underscores the diverse approaches countries take to protect personal information. Whether you’re a privacy professional, a researcher, or simply curious about global data governance, this table serves as a valuable resource to navigate the evolving landscape of data protection laws. Explore the data, filter by region or treaty, and stay informed about the global movement toward safeguarding personal data in an increasingly connected world.
