Automated decision-making rights

Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.

Law · In Force

Processing of personal data in Liechtenstein; EEA GDPR applies directly with DSG as national implementing law.

Law · In Force

Processing of personal data in Jersey or by controllers established in Jersey targeting Jersey data subjects.

Law · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Processing of personal data in North Macedonia or targeting North Macedonian data subjects.

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Processing of personal data in BiH or of BiH data subjects; foreign controllers must appoint local representative where required.

Law · In Force

Personal data processing in Spain including AI under Organic Law 3/2018.

Law · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

Processing of personal data in Moldova or by controllers subject to Moldovan law after August 23, 2026.

Law · In Force

Online services (including AI-powered features) likely to be accessed by children in the United Kingdom.

Guidance · In Force

Developers and deployers of Automated Decision-Making Technology making consequential decisions about Colorado consumers.

Law · Pending

Businesses meeting CCPA revenue or data thresholds that collect personal information of California consumers.

Law · In Force

CCPA-covered businesses that use ADMT to make significant decisions about California consumers.

Regulation · Partially In Force

Controllers processing personal data of Minnesota consumers above applicability thresholds.

Law · In Force

New Jersey employers using AI or automated systems in hiring, compensation, or other employment decisions.

Law · In Force

Controllers and processors conducting business in Texas or targeting Texas residents, excluding small-business and certain entity exemptions.

Law · In Force

Texas utilization review agents — may not use an automated decision system (including AI) to make, wholly or partly, an adverse determination on medical necessity; TDI may audit AI use in utilization review; administrative support and fraud-detection AI permitted.

Law · In Force

Law · In Force

Providers using algorithmic recommendation technology to deliver information to users in China.

Regulation · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Individuals, organisations, and legal entities handling electronic personal data within Laos, including foreign entities without physical presence that process Lao electronic data.

Law · In Force

Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.

Ordinance · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Processing of personal data of Bangladeshi citizens, residents, or data subjects connected to Bangladesh; extraterritorial reach for controllers/processors outside Bangladesh.

Law · In Force

Any personal information controller handling personal information of individuals in Korea.

Law · In Force

Processing personal information of individuals in China or providing products/services to individuals in China.

Law · In Force

Collection, processing, retention, or use of personal data in Lebanon whether by electronic means or otherwise — prior declaration or licence to Ministry of Economy and Trade unless exempt.

Law · In Force

{"scope_basis":"jurisdiction","jurisdictions":["BI"],"regions":["Middle East & Africa"],"requires_ai":false}

Regulation · In Force

Processing of personal data in Bahrain or of Bahraini residents by controllers established inside or outside the Kingdom.

Law · In Force

Federal Canadian institutions using automated decision-making systems including AI.

Regulation · In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Text and data mining for AI training in EU/EEA jurisdictions subject to Directive 2019/790.

Law · In Force

Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.

Regulation · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force

Processing of personal data carried out in Brazil, by data subjects located in Brazil at the time of collection, or for the offering of goods or services to individuals in Brazil.

Law · In Force

Organisations established in the UK and those that offer goods or services to, or monitor, individuals in the UK from outside.

Regulation · In Force