Data Protection Laws Around the World
Who protects your personal data, and under which law? This guide shows, for 112 countries, whether there is a general data protection law, its name and year, the authority that enforces it, and how the country stands with the EU’s GDPR.
Part of the comparative law toolkit. 100 of the 112 countries have a general law. For the whole world, UNCTAD’s tracker reports that about 71% of countries have one, 9% have a draft and 15% have none (June 2024).
Every country, side by side
Click a heading to sort. Open a country for the law's name and the authority that enforces it.
| Albania | General law | No adequacy decision |
|---|---|---|
| Algeria | General law | No adequacy decision |
| Andorra | General law | EU adequacy decision |
| Argentina | General law | EU adequacy decision |
| Armenia | General law | No adequacy decision |
| Australia | General law | No adequacy decision |
| Austria | General law | GDPR applies |
| Azerbaijan | General law | No adequacy decision |
| Bahrain | General law | No adequacy decision |
| Bangladesh | Draft law | No adequacy decision |
| Belarus | General law | No adequacy decision |
| Belgium | General law | GDPR applies |
| Bolivia | No general law | No adequacy decision |
| Bosnia and Herzegovina | General law | No adequacy decision |
| Botswana | General law | No adequacy decision |
| Brazil | General law | No adequacy decision |
| Bulgaria | General law | GDPR applies |
| Cameroon | Some sectors or states | No adequacy decision |
| Canada | General law | EU adequacy decision |
| Chile | General law | No adequacy decision |
| China | General law | No adequacy decision |
| Colombia | General law | No adequacy decision |
| Costa Rica | General law | No adequacy decision |
| Croatia | General law | GDPR applies |
| Cyprus | General law | GDPR applies |
| Czechia | General law | GDPR applies |
| Denmark | General law | GDPR applies |
| Dominican Republic | General law | No adequacy decision |
| Ecuador | General law | No adequacy decision |
| Egypt | General law | No adequacy decision |
| Estonia | General law | GDPR applies |
| Ethiopia | General law | No adequacy decision |
| Finland | General law | GDPR applies |
| France | General law | GDPR applies |
| Georgia | General law | No adequacy decision |
| Germany | General law | GDPR applies |
| Ghana | General law | No adequacy decision |
| Greece | General law | GDPR applies |
| Guatemala | No general law | No adequacy decision |
| Hong Kong | General law | No adequacy decision |
| Hungary | General law | GDPR applies |
| Iceland | General law | GDPR applies |
| India | General law | No adequacy decision |
| Indonesia | General law | No adequacy decision |
| Iran | No general law | No adequacy decision |
| Iraq | No general law | No adequacy decision |
| Ireland | General law | GDPR applies |
| Israel | General law | EU adequacy decision |
| Italy | General law | GDPR applies |
| Jamaica | General law | No adequacy decision |
| Japan | General law | EU adequacy decision |
| Jordan | General law | No adequacy decision |
| Kazakhstan | General law | No adequacy decision |
| Kenya | General law | No adequacy decision |
| Latvia | General law | GDPR applies |
| Lebanon | Some sectors or states | No adequacy decision |
| Liechtenstein | General law | GDPR applies |
| Lithuania | General law | GDPR applies |
| Luxembourg | General law | GDPR applies |
| Malaysia | General law | No adequacy decision |
| Malta | General law | GDPR applies |
| Mauritius | General law | No adequacy decision |
| Mexico | General law | No adequacy decision |
| Moldova | General law | No adequacy decision |
| Montenegro | General law | No adequacy decision |
| Morocco | General law | No adequacy decision |
| Nepal | Some sectors or states | No adequacy decision |
| Netherlands | General law | GDPR applies |
| New Zealand | General law | EU adequacy decision |
| Nigeria | General law | No adequacy decision |
| North Macedonia | General law | No adequacy decision |
| Norway | General law | GDPR applies |
| Oman | General law | No adequacy decision |
| Pakistan | Draft law | No adequacy decision |
| Panama | General law | No adequacy decision |
| Paraguay | General law | No adequacy decision |
| Peru | General law | No adequacy decision |
| Philippines | General law | No adequacy decision |
| Poland | General law | GDPR applies |
| Portugal | General law | GDPR applies |
| Qatar | General law | No adequacy decision |
| Romania | General law | GDPR applies |
| Russia | General law | No adequacy decision |
| Rwanda | General law | No adequacy decision |
| Saudi Arabia | General law | No adequacy decision |
| Senegal | General law | No adequacy decision |
| Serbia | General law | No adequacy decision |
| Singapore | General law | No adequacy decision |
| Slovakia | General law | GDPR applies |
| Slovenia | General law | GDPR applies |
| South Africa | General law | No adequacy decision |
| South Korea | General law | EU adequacy decision |
| Spain | General law | GDPR applies |
| Sri Lanka | General law | No adequacy decision |
| Sweden | General law | GDPR applies |
| Switzerland | General law | EU adequacy decision |
| Taiwan | General law | No adequacy decision |
| Tanzania | General law | No adequacy decision |
| Thailand | General law | No adequacy decision |
| Tunisia | General law | No adequacy decision |
| Turkey | General law | No adequacy decision |
| Uganda | General law | No adequacy decision |
| Ukraine | General law | No adequacy decision |
| United Arab Emirates | General law | No adequacy decision |
| United Kingdom | General law | EU adequacy decision |
| United States | Some sectors or states | EU adequacy decision |
| Uruguay | General law | EU adequacy decision |
| Uzbekistan | General law | No adequacy decision |
| Venezuela | No general law | No adequacy decision |
| Vietnam | Some sectors or states | No adequacy decision |
| Zambia | General law | No adequacy decision |
| Zimbabwe | General law | No adequacy decision |
Read this first
This guide gives the name, year and enforcer of each country's general data protection law from our own knowledge, with the UNCTAD tracker and the European Commission's adequacy list as references. It does not state fines, deadlines or how a law is applied in practice. Laws are being passed and reformed quickly, so check the authority's website before you rely on it. This is general information, not legal advice.
Is there a data protection law?
Whether the country has a general law on how organisations may collect, use and share personal data, usually with rights for individuals and an authority that enforces it. 'Laws for some sectors or states only' means there is no single national law, as in the United States.
Relationship to the EU's GDPR
The EU's General Data Protection Regulation (GDPR) applies in all EU and EEA countries. For the rest, the European Commission may decide that a country's law offers an adequate level of protection, which lets personal data flow freely from the EU. Without it, transfers need other safeguards.
Good to know
A law on paper is not always a law in practice
Some countries have passed a law but have not yet set up the authority that enforces it, or are still bringing it into force in stages. We say so where we know.
The GDPR can reach you outside the EU
The GDPR applies to organisations anywhere in the world that offer goods or services to people in the EU, or monitor their behaviour, even without a presence there.
Moving data across borders
Many laws limit sending personal data abroad. Typical safeguards are an adequacy decision, standard contractual clauses, binding corporate rules, or the person's explicit consent.
Your rights
Most general laws let you ask what data an organisation holds about you, ask for corrections and, in many places, deletion. Find the country's authority below to file a complaint.
Laws are being updated
Many countries have passed or reformed a law in the last five years, and more are in the pipeline. Check the authority's website for the current text.
Where to check
- UNCTAD: data protection and privacy legislation worldwide (the global tracker)
- European Commission: adequacy decisions (the list of countries)
- European Data Protection Board: the national data protection authorities of the EU and EEA
- Global Privacy Assembly: the world's data protection and privacy authorities
Take it further
A plain, editable privacy policy for a website or app.
Clear terms of use for your website.
A whole chapter of black-letter law on one printable page. Free sample.
Support this free tool
This guide is free, and it takes a lot of careful work to build and keep up to date. If it helped you, you can leave a small contribution. No account is needed, and nothing is sold to you.
A one-time card payment through Stripe. It is a contribution, not a purchase, and it is not tax-deductible.
Use this on your own site
Teachers, bloggers, journalists and researchers are welcome to use the map and the data, free, with a link back to this page. The data is licensed under CC BY 4.0: reuse it, even commercially, if you credit us. More about the licence.
Embed the map
<iframe src="https://tools.thelawtoknow.com/embed/data-protection" title="Data Protection Laws Around the World, TheLawToKnow" width="100%" height="560" style="border:0" loading="lazy"></iframe>
Download the data
The table as a CSV file (opens in Excel and Google Sheets)
Credit line
<a href="https://tools.thelawtoknow.com/data-protection">Data Protection Laws Around the World</a>, TheLawToKnow
Cite this page
TheLawToKnow Tools. Data Protection Laws Around the World. https://tools.thelawtoknow.com/data-protection.
Know the law in a country we have not covered, or spotted a mistake? Tell us.
