Automated decision-making rights

Law · Pending

Developers and deployers of Automated Decision-Making Technology making consequential decisions about Colorado consumers.

Law · Pending

Controllers that conduct business in Colorado or deliver commercial products or services deliberately targeted to Colorado residents and meet the § 6-1-1304(1) thresholds; the thresholds do not apply to a controller processing any amount of biometric identifiers or biometric data.

Law · In Force

Businesses meeting CCPA revenue or data thresholds that collect personal information of California consumers.

Law · Partially In Force

CCPA-covered businesses that use ADMT to make significant decisions about California consumers.

Regulation · Partially In Force

Controllers or processors conducting business in Delaware, or targeting products/services to Delaware residents, that meet the § 12D-103(a) consumer-volume/revenue thresholds.

Law · In Force

A large-platform controller ($1B+ global gross annual revenue and an ad-revenue-share, smart-speaker, or app-store limb, Fla. Stat. s. 501.702(9)(a)) conducting business in Florida or producing a product/service used by Florida residents. The s. 501.715 sensitive-data-sale notice/consent duty reaches a broader for-profit, Florida-nexus population regardless of the revenue/limb test (s. 501.702(9)(a)1.-3. only).

Law · In Force

Law · In Force

Controllers or processors conducting business in Iowa, or targeting products/services to Iowa residents, that meet the § 715D.2(1) consumer-volume/revenue thresholds (100,000 consumers, or 25,000 consumers with 50%+ revenue from data sales).

Law · In Force

Controllers processing personal data of Minnesota consumers above applicability thresholds.

Law · In Force

Law · In Force

Law · In Force

Law · In Force

New Jersey employers using AI or an automated decision-making tool in hiring, compensation, or other employment decisions -- the statute is technology-neutral and DCR's guidance is interpretive, so the trigger is the same employment-decision nexus as any other NJLAD claim.

Law · In Force

Law · In Force

Law · In Force

Law · In Force

Texas utilization review agents — may not use an automated decision system (including AI) to make, wholly or partly, an adverse determination on medical necessity; TDI may audit AI use in utilization review; administrative support and fraud-detection AI permitted.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Law · In Force

Law · In Force

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Personal data processed by a Bavarian public body within Art. 1 Abs. 1 or Abs. 2 BayDSG, by a natural or legal person carrying out sovereign public-administration tasks within Art. 1 Abs. 4, or by a processor acting for one of them. Art. 38 additionally reaches non-public bodies processing for journalistic, artistic or literary purposes.

Law · In Force

Personal data processed by an authority or other public body of the Land Berlin or of a Land corporation, institution or foundation of public law (§ 2 Abs. 1), by a private-law association performing public-administration tasks in which Berlin holds an absolute majority or by a non-public body performing sovereign tasks (§ 2 Abs. 2), or by a processor acting for one of them. Teil 3 applies instead of Teil 2 where the processing serves the prevention, investigation, detection, prosecution or punishment of criminal or administrative offences (§ 2 Abs. 4, § 30). § 19 additionally reaches non-public bodies processing for journalistic, artistic or literary purposes (§ 2 Abs. 7).

Law · In Force

Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.

Law · In Force

Processing of personal data in Liechtenstein; EEA GDPR applies directly with DSG as national implementing law.

Law · In Force

Law · In Force

Processing of personal data of individuals in Russia by operators, including extraterritorial operators targeting Russian data subjects; localization rules apply under Law 242-FZ.

Law · In Force

A relevant information society service (DPA 2018 s. 123(7): provided for remuneration, at a distance, by electronic means, at the individual request of a recipient, excluding preventive or counselling services) likely to be accessed by children under 18 in the United Kingdom.

Guidance · In Force

Processing of personal data in Jersey or by controllers established in Jersey targeting Jersey data subjects.

Law · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Processing of personal data in Ukraine or of Ukrainian data subjects by controllers and processors.

Law · In Force

Collection or processing of personal data about a natural person in the Republic of Azerbaijan by a state or local self-government body or by a legal or natural person, other than collection and processing by a natural person exclusively for personal and family needs (art. 3.3) and the national-security and state-secret cases left to other legislation by art. 3.2.

Law · In Force

Processing of personal data in North Macedonia or targeting North Macedonian data subjects.

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Processing of personal data in BiH or of BiH data subjects; foreign controllers must appoint local representative where required.

Law · In Force

Personal data processing in Spain including AI under Organic Law 3/2018.

Law · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

Processing of personal data in Moldova or by controllers subject to Moldovan law after August 23, 2026.

Law · In Force

Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.

Law · In Force

An organization, as defined in s. 1(1)(i), that collects, uses or discloses personal information about an individual in Alberta (s. 4(1)). There is no commercial-activity threshold and no size threshold. The Act does not apply to a public body (s. 4(2)) or to the purpose-based exclusions in s. 4(3), each of which applies only where the stated purpose is the sole purpose.

Law · In Force

Processing of personal data in the context of the activities of a data controller or data processor established in Barbados (s. 3 (1) (a)), or processing of personal data of data subjects in Barbados by a controller or processor not established in Barbados where the processing relates to the offering of goods or services to data subjects in Barbados (s. 3 (1) (b)).

Law · Partially In Force

An organisation that uses personal information in Bermuda, where the information is used wholly or partly by automated means or forms, or is intended to form, part of a structured filing system (s. 3). An organisation is any individual, entity or public authority that uses personal information (s. 2), and the Act binds the Crown (s. 50).

Law · In Force

An institution subject to the Policy on Service and Digital — a department within the meaning of s. 2 of the Financial Administration Act — using an automated decision system in production to make an administrative decision or a related assessment about a client (Directive, ss. 5.1 and 8.1). Systems used solely for research and experimentation and those in test environments are out of scope (s. 5.2). The instrument reaches systems developed or procured after 1 April 2020, and systems predating that date once significantly modified (s. 1.2).

Guidance · In Force

A data controller that is established in the Cayman Islands and processes personal data in the context of that establishment, or that is not established in the Islands but processes personal data in the Islands otherwise than for the purposes of transit (s. 6(1)). Establishment is defined in s. 6(3). There is no size threshold, no revenue threshold and no sector limitation.

Law · In Force

A market participant regulated under Canadian securities legislation — a registered dealer, adviser or investment fund manager; a non-investment fund reporting issuer; a marketplace or marketplace participant; a clearing agency or matching service utility; a trade repository; a designated rating organization; or a designated benchmark administrator — using, or planning to use, an artificial intelligence system in its regulated business activities, including derivatives firms through the parallel provisions of NI 93-101 (Notice, Introduction and footnotes 4 and 23).

Guidance · In Force

Any public or private file, register or database of personal data in the Dominican Republic that makes the data susceptible of processing, and every later use of those data (arts. 2 and 3), other than the four art. 4 exclusions (domestic files, State investigation and intelligence files, deceased persons, data of legal persons and professional contact data); credit-information duties attach to the Sociedades de Información Crediticia, their data furnishers and their users or subscribers (Chapter III and Chapter IV, Section III).

Law · In Force

Law · Pending

Processing of personal data in Peru or of Peruvian data subjects by public or private controllers, including automated processing and cross-border transfers.

Law · In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Section 1(2): processing of personal data by or about a Bangladeshi citizen, resident or person working or temporarily present in Bangladesh; processing carried on inside Bangladesh other than in transit; or processing outside Bangladesh in connection with offering goods or services to, or monitoring or profiling, a data subject located in Bangladesh. No entity, revenue or record-count threshold.

Law · Partially In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Providing a generative artificial intelligence service in mainland China (clause 1). No revenue, headcount or sector threshold. Adoption is voluntary: the standard is a recommended national standard and creates no legal duty of its own.

Standard · In Force

Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.

Ordinance · Partially In Force

Individuals, organisations, and legal entities handling electronic personal data within Laos, including foreign entities without physical presence that process Lao electronic data.

Law · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Any personal information controller handling personal information of individuals in Korea.

Law · In Force

Processing personal information of individuals in China or providing products/services to individuals in China.

Law · In Force

Recorded for footprint mapping only. Section 2, which supplies the Act’s application, is not in operation until 1 January 2027. From that date it reaches processing wholly or partly in Sri Lanka, and a controller or processor domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour in Sri Lanka including profiling with the intention of making decisions about it.

Law · Partially In Force

Processing of personal data in the context of the activities of a controller or processor on Beninese territory, or of persons who are in Benin where the activities relate to offering them goods or services or to monitoring their behaviour in Benin (art. 381).

Law · In Force

Collection, processing, retention, or use of personal data in Lebanon whether by electronic means or otherwise — prior declaration or licence to Ministry of Economy and Trade unless exempt.

Law · In Force

Processing of personal data by wholly or partly automated means, or non-automated processing of data in a filing system, in the context of an establishment of a controller or processor situated in Cabo Verde whatever the place of processing; or outside the territory where Cabo Verdean law applies by public international law; or by a controller or processor not established in Cabo Verde where the activities relate to offering goods or services to data subjects in Cabo Verde or to monitoring their behaviour there (art. 2.º).

Law · In Force

{"scope_basis":"jurisdiction","jurisdictions":["BI"],"regions":["Middle East & Africa"],"requires_ai":false}

Regulation · In Force

Wholly or partly automated processing of personal data, or non-automated processing of personal data held in manual files, where the controller is established on Algerian territory or, not being established there, has recourse to processing means situated on Algerian territory other than for transit (art. 4).

Law · In Force

Processing of personal data in Niger or targeting Nigerien data subjects.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Text and data mining for AI training in EU/EEA jurisdictions subject to Directive 2019/790.

Law · In Force

Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.

Regulation · In Force

Processing of personal data of individuals in Türkiye or by controllers established in Türkiye.

Law · In Force

Any one of the three alternative tests in art. 3º is met: the processing operation is carried out in the national territory (I); the processing activity has as its object the offer or supply of goods or services, or the processing of data, of individuals located in the national territory (II); or the personal data being processed were collected in the national territory (III), § 1º deeming data collected there where the titular was in Brazil at the moment of collection. The tests apply irrespective of the medium, of the country of the controller seat and of the country where the data are located. Art. 1º parágrafo único makes the general rules a matter of national interest binding the Union, the States, the Federal District and the Municipalities. There is no revenue, headcount or record-count threshold. Art. 4º excludes four categories of processing, not classes of organization, and the academic limb preserves arts. 7º and 11 in full.

Law · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force

Organisations established in the UK and those that offer goods or services to, or monitor, individuals in the UK from outside.

Regulation · In Force