Breach notification duties

Processing of personal data in the context of the activities of a controller or processor on Beninese territory, or of persons who are in Benin where the activities relate to offering them goods or services or to monitoring their behaviour in Benin (art. 381).

Law · In Force

Processing of personal data in Zimbabwe; cyber and data protection obligations for digital services including AI.

Law · In Force

CITRA-licensed telecommunications and IT service providers collecting, processing, or storing personal data and user content in Kuwait.

Regulation · In Force

Automated or non-automated filing-system processing by a controller or processor established in Botswana; or, where not established there, processing where the activities of an establishment are in Botswana, or the activities relate to offering goods or services to data subjects in Botswana or to monitoring their behaviour there (s. 4).

Law · In Force

Processing of Egyptian personal data by controllers or processors inside or outside Egypt.

Law · In Force

Processing of personal data by wholly or partly automated means, or non-automated processing of data in a filing system, in the context of an establishment of a controller or processor situated in Cabo Verde whatever the place of processing; or outside the territory where Cabo Verdean law applies by public international law; or by a controller or processor not established in Cabo Verde where the activities relate to offering goods or services to data subjects in Cabo Verde or to monitoring their behaviour there (art. 2.º).

Law · In Force

Collection, processing, transmission, storage or use of the personal data of a natural person, carried out in Chad by a natural person, by the State, by a local authority, or by a public- or private-law legal person (art. 2).

Law · In Force

Collection, processing, transmission, storage or use of personal data by a natural person, by the State, by decentralised administrative entities or by legal persons of public or private law; processing implemented by a controller on the territory of the Republic of the Congo or in any place where the law of that country applies; or processing implemented by a controller, established in Congo or not, which has recourse to means of processing situated on Congolese territory, excluding means used only for transit (art. 2).

Law · In Force

Data controllers and processors of personal data in Nigeria or processing personal data of Nigerians extraterritorially.

Law · In Force

Processing of personal data of individuals in Qatar by controllers or processors, including extraterritorial processing targeting Qatari residents.

Law · In Force

Processing of personal data of individuals in Oman, including extraterritorial controllers offering goods or services to Omani data subjects.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Business operators handling personal information in Japan or providing services to individuals in Japan.

Law · In Force

Australian Privacy Principle entities including most businesses with turnover above the small-business threshold, health service providers, and federal agencies.

Law · Partially In Force

Processing of personal information of individuals in the Philippines or by entities with a Philippine link.

Law · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Any controller or processor handling personal data of individuals in Indonesia, including extraterritorially.

Law · In Force

Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.

Law · In Force

Section 2(1): any person who processes, and any person who has control over or authorises the processing of, personal data in respect of commercial transactions. Section 2(2) additionally reaches a person established outside Malaysia who uses equipment in Malaysia for processing otherwise than for transit, who must nominate a representative established in Malaysia under s. 2(3). Section 3 excludes the Federal and State Governments; s. 45 exempts personal, family and household processing and several further classes. No revenue, headcount or record-count threshold. Registration under Division 2 of Part II applies only to classes of data controller specified by Ministerial order under s. 14(1).

Law · In Force

Agencies handling personal information in connection with New Zealand operations.

Law · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Recorded for footprint mapping only. Section 2, which supplies the Act’s application, is not in operation until 1 January 2027. From that date it reaches processing wholly or partly in Sri Lanka, and a controller or processor domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour in Sri Lanka including profiling with the intention of making decisions about it.

Law · Partially In Force

A data controller or data processor located in Thailand, whatever the location of the processing; or a controller or processor located outside Thailand that offers goods or services to data subjects in Thailand, whether or not payment is made, or that monitors their behaviour taking place in Thailand (s. 5).

Law · In Force

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Processing of personal data with the use of means of automation, or without them where the data can be searched or accessed by set criteria, by an operator or authorised person as defined in art. 1, within the scope of art. 2(1); excluding processing by natural persons for exclusively personal, family or household use and data classified as state secrets (art. 2(2)).

Law · In Force

Processing of personal data in the Bailiwick of Guernsey or by controllers established in the Bailiwick.

Law · In Force

Processing of personal data in Jersey or by controllers established in Jersey targeting Jersey data subjects.

Law · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Processing of personal data in North Macedonia or targeting North Macedonian data subjects.

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Processing of personal data in BiH or of BiH data subjects; foreign controllers must appoint local representative where required.

Law · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

Processing by controllers/processors in Monaco or targeting data subjects in Monaco (GDPR-style territorial and extraterritorial scope).

Law · In Force

Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.

Law · In Force

Processing of personal data in the context of the activities of a data controller or data processor established in Barbados (s. 3 (1) (a)), or processing of personal data of data subjects in Barbados by a controller or processor not established in Barbados where the processing relates to the offering of goods or services to data subjects in Barbados (s. 3 (1) (b)).

Law · Partially In Force

An organisation that uses personal information in Bermuda, where the information is used wholly or partly by automated means or forms, or is intended to form, part of a structured filing system (s. 3). An organisation is any individual, entity or public authority that uses personal information (s. 2), and the Act binds the Crown (s. 50).

Law · In Force

A data controller that is established in the Cayman Islands and processes personal data in the context of that establishment, or that is not established in the Islands but processes personal data in the Islands otherwise than for the purposes of transit (s. 6(1)). Establishment is defined in s. 6(3). There is no size threshold, no revenue threshold and no sector limitation.

Law · In Force

Processing of personal data in Jamaica or targeting Jamaican data subjects.

Law · In Force

Same covered entities and business associates as HIPAA; HITECH layered direct enforcement on business associates and increased penalties.

Law · In Force

Covered entities and their business associates that create, receive, maintain, or transmit protected health information (PHI) in the United States.

Law · In Force

Processing of personal data of individuals in Türkiye or by controllers established in Türkiye.

Law · In Force

Organisations that collect, use, or disclose personal data in Singapore, regardless of where established.

Law · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force