Contents Knowledge map

Before you read

This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.

By country

Open in Knowledge map

Each covered jurisdiction has a page, with the date its sources were last checked. The table carries the same information as the map, and can be filtered.

FijiTanzaniaW. SaharaCanadaUnited States of AmericaKazakhstanUzbekistanPapua New GuineaIndonesiaArgentinaChileDem. Rep. CongoSomaliaKenyaSudanChadHaitiDominican Rep.RussiaBahamasFalkland Is.NorwayGreenlandFr. S. Antarctic LandsTimor-LesteSouth AfricaLesothoMexicoUruguayBrazilBoliviaPeruColombiaPanamaCosta RicaNicaraguaHondurasEl SalvadorGuatemalaBelizeVenezuelaGuyanaSurinameFranceEcuadorPuerto RicoJamaicaCubaZimbabweBotswanaNamibiaSenegalMaliMauritaniaBeninNigerNigeriaCameroonTogoGhanaCôte d'IvoireGuineaGuinea-BissauLiberiaSierra LeoneBurkina FasoCentral African Rep.CongoGabonEq. GuineaZambiaMalawiMozambiqueeSwatiniAngolaBurundiIsraelLebanonMadagascarPalestineGambiaTunisiaAlgeriaJordanUnited Arab EmiratesQatarKuwaitIraqOmanVanuatuCambodiaThailandLaosMyanmarVietnamNorth KoreaSouth KoreaMongoliaIndiaBangladeshBhutanNepalPakistanAfghanistanTajikistanKyrgyzstanTurkmenistanIranSyriaArmeniaSwedenBelarusUkrainePolandAustriaHungaryMoldovaRomaniaLithuaniaLatviaEstoniaGermanyBulgariaGreeceTurkeyAlbaniaCroatiaSwitzerlandLuxembourgBelgiumNetherlandsPortugalSpainIrelandNew CaledoniaSolomon Is.New ZealandAustraliaSri LankaChinaTaiwanItalyDenmarkUnited KingdomIcelandAzerbaijanGeorgiaPhilippinesMalaysiaBruneiSloveniaFinlandSlovakiaCzechiaEritreaJapanParaguayYemenSaudi ArabiaCyprusMoroccoEgyptLibyaEthiopiaDjiboutiUgandaRwandaBosnia and Herz.MacedoniaSerbiaMontenegroTrinidad and TobagoS. Sudan
Covered Not yet coveredSome small countries are too small to appear at this scale. The table lists every covered jurisdiction.
JurisdictionRegionMain lawApplies sinceBreach noticeMaximum fineLast checked
European Union and EEAEuropeGeneral Data Protection Regulation (GDPR)2018-05-2572 hours to the regulator, where feasible€20 million or 4% of worldwide turnover, whichever is higher2026-11-09
EU cookie rulesEuropeePrivacy Directive 2002/58/EC2003-10-31Not its subjectSet by each country2026-11-09
EU AI ActEuropeRegulation (EU) 2024/16892025-02-02Not its subject€35 million or 7% of worldwide turnover2026-11-09
United KingdomEuropeUK GDPR and Data Protection Act 20182020-12-3172 hours to the regulator, where feasible£17.5 million or 4% of worldwide turnover, whichever is higher2026-11-09
SwitzerlandEuropeFederal Act on Data Protection2023-09-01As quickly as possible, if high risk250,000 francs, on the individual responsible2026-11-09
BrazilAmericasLGPD, Law 13.709/2018—Within a reasonable time set by the ANPD2% of revenue in Brazil, up to R$ 50 million2026-11-09
ChileAmericasLaw 21.7192026-12-01As fast as possible, if a reasonable risk20,000 UTM2026-11-09
United StatesAmericasNo general federal law; state laws and COPPA—Set by each state; not yet coveredCalifornia: $7,500 per intentional violation2026-11-09
CanadaAmericasPIPEDA—When a real risk of significant harm$100,000, for specified offences2026-11-09
AustraliaAsia-PacificPrivacy Act 1988—When serious harm is likelySee its page2026-11-09
IndiaAsia-PacificDPDP Act 2023PhasedTo the Board and each person250 crore rupees2026-11-09
ChinaAsia-PacificPIPL2021-11-01Immediately, to regulator and people50 million yuan or 5% of turnover2026-11-09
JapanAsia-PacificAPPI—To the Commission, if likely to harmSee its page2026-11-09
South KoreaAsia-PacificPIPA—Without delayUp to 10% of total sales, in serious repeat cases2026-11-09
Budapest ConventionInternationalConvention on Cybercrime—Not its subjectNot its subject2026-11-09
Convention 108+InternationalCouncil of Europe treatyNot yetSee its pageNot its subject2026-11-09