Cross-border transfer controls

Processing personal data by ADGM-established controllers or processors.

Law · In Force

Processing of personal data in the DRC or targeting Congolese data subjects.

Law · In Force

Processing of personal data in Seychelles or by controllers established in Seychelles.

Law · In Force

Processing of personal data in Malawi or targeting Malawian data subjects.

Law · In Force

Processing of personal data of data subjects located in Kenya, including by controllers established outside Kenya.

Law · In Force

Processing of personal data of UAE residents by controllers or processors inside or outside the UAE that target UAE residents.

Law · In Force

Databases of personal information held by Israeli organisations or that process Israeli personal information.

Law · In Force

Processing of Egyptian personal data by controllers or processors inside or outside Egypt.

Law · In Force

Processing of personal data by any person or entity of the public, private or cooperative sector, where the controller is seated in Angola, is established there, is subject to Angolan law by public or private international law, or has recourse to processing means situated in Angolan territory including hosting, collection, registration or transit (art. 3.º).

Law · In Force

Processing of personal data in Equatorial Guinea or targeting Equatoguinean data subjects.

Law · In Force

Processing of personal data where the controller is established in Burkina Faso, whatever the place of implementation, or where a controller or processor not established there implements processing operations from the national territory, transit data excepted, or falls under Burkina Faso by virtue of public international law (art. 3).

Law · In Force

Processing of personal data in Gabon or targeting Gabonese data subjects.

Law · In Force

Processing of personal data in Senegal or by controllers targeting Senegalese data subjects.

Law · In Force

Processing of personal data in Côte d'Ivoire or targeting Ivorian data subjects.

Law · In Force

Processing of personal data in Mauritania or targeting Mauritanian data subjects.

Law · In Force

Collection, processing, transmission, storage or use of personal data by a natural person, by the State, by decentralised administrative entities or by legal persons of public or private law; processing implemented by a controller on the territory of the Republic of the Congo or in any place where the law of that country applies; or processing implemented by a controller, established in Congo or not, which has recourse to means of processing situated on Congolese territory, excluding means used only for transit (art. 2).

Law · In Force

Processing of personal data in Tunisia or targeting Tunisian data subjects.

Law · In Force

Processing of personal data in Morocco or by controllers targeting Moroccan data subjects.

Law · In Force

Processing of personal data of individuals in Qatar by controllers or processors, including extraterritorial processing targeting Qatari residents.

Law · In Force

Processing of personal data in Tanzania or of Tanzanian data subjects.

Law · In Force

Processing of personal data of Jordanian citizens and residents, including data collected before enactment; cross-border transfers subject to Council adequacy rules.

Law · In Force

Processing of personal data of individuals in Oman, including extraterritorial controllers offering goods or services to Omani data subjects.

Law · In Force

Processing of personal data in Rwanda or targeting Rwandan data subjects.

Law · In Force

Any processing of personal data of individuals located in Saudi Arabia, including extraterritorial processing.

Law · In Force

Business operators handling personal information in Japan or providing services to individuals in Japan.

Law · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.

Ordinance · Partially In Force

Collection, processing, and protection of personal data by database owners and operators in Kazakhstan; data localization requirements for personal data databases.

Law · In Force

Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.

Law · In Force

Section 2(1): any person who processes, and any person who has control over or authorises the processing of, personal data in respect of commercial transactions. Section 2(2) additionally reaches a person established outside Malaysia who uses equipment in Malaysia for processing otherwise than for transit, who must nominate a representative established in Malaysia under s. 2(3). Section 3 excludes the Federal and State Governments; s. 45 exempts personal, family and household processing and several further classes. No revenue, headcount or record-count threshold. Registration under Division 2 of Part II applies only to classes of data controller specified by Ministerial order under s. 14(1).

Law · In Force

Cross-border transfers from China meeting CAC security assessment thresholds.

Regulation · In Force

Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.

Law · In Force

Processing personal information of individuals in China or providing products/services to individuals in China.

Law · In Force

Cross-border transfer of personal information from China under PIPL standard contracts or security assessment.

Regulation · In Force

Recorded for footprint mapping only. Section 2, which supplies the Act’s application, is not in operation until 1 January 2027. From that date it reaches processing wholly or partly in Sri Lanka, and a controller or processor domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour in Sri Lanka including profiling with the intention of making decisions about it.

Law · Partially In Force

Collection, processing, storage, and protection of personal data by public and private entities in Tajikistan; information security facility certification requirements.

Law · In Force

Processing of personal information by data controllers and processors in Tonga — lawful basis, consent, data-subject rights including portability, cross-border transfer standards, Privacy Commission supervision.

Law · Pending

Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.

Law · In Force

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Processing of personal data by state administration or local self-government bodies, state or community institutions or organisations, or legal or natural persons, within the scope of art. 1(1).

Law · In Force

Processing of personal data with the use of means of automation, or without them where the data can be searched or accessed by set criteria, by an operator or authorised person as defined in art. 1, within the scope of art. 2(1); excluding processing by natural persons for exclusively personal, family or household use and data classified as state secrets (art. 2(2)).

Law · In Force

Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.

Law · In Force

Processing of personal data of individuals in Russia by operators, including extraterritorial operators targeting Russian data subjects; localization rules apply under Law 242-FZ.

Law · In Force

Processing of personal data in the Bailiwick of Guernsey or by controllers established in the Bailiwick.

Law · In Force

Processing of personal data in Georgia or using technical means in Georgia; extraterritorial reach for Georgian data subjects.

Law · In Force

Processing of personal data in Ukraine or of Ukrainian data subjects by controllers and processors.

Law · In Force

Processing by controllers in Montenegro or using equipment situated in Montenegro (limited extraterritorial reach).

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.

Law · In Force

UK restricted transfers relying on ICO IDTA or Addendum as Art. 46 safeguard.

Guidance · In Force

The organization is a data controller established in The Bahamas and the data are processed in the context of that establishment (s. 4 (1) (a)), or it is not so established but uses equipment in The Bahamas to process personal data otherwise than for transit (s. 4 (1) (b)), in which case s. 4 (2) additionally requires nomination of a representative established in The Bahamas. Section 4 (3) deems four categories to be established in The Bahamas: an individual ordinarily resident there; a body incorporated or registered under Bahamian law; a partnership or unincorporated association formed under Bahamian law; and any person maintaining an office, branch or agency there through which he carries on a business activity or a regular practice. Section 3 binds the Crown, with the head of a government agency deemed to be the controller. There is no revenue, headcount or sector threshold. Section 5 excludes five categories of data, not classes of organization.

Law · In Force

Processing of personal data in the context of the activities of a data controller or data processor established in Barbados (s. 3 (1) (a)), or processing of personal data of data subjects in Barbados by a controller or processor not established in Barbados where the processing relates to the offering of goods or services to data subjects in Barbados (s. 3 (1) (b)).

Law · Partially In Force

A data controller that is established in the Cayman Islands and processes personal data in the context of that establishment, or that is not established in the Islands but processes personal data in the Islands otherwise than for the purposes of transit (s. 6(1)). Establishment is defined in s. 6(3). There is no size threshold, no revenue threshold and no sector limitation.

Law · In Force

Processing of personal data in Jamaica or targeting Jamaican data subjects.

Law · In Force

Processing of personal data in Belize by public or private controllers subject to the Act.

Law · Pending

Processing of personal data in El Salvador by public or private controllers.

Law · In Force

Processing of personal data in Panama or targeting Panamanian data subjects.

Law · In Force

Processing of personal data in Peru or of Peruvian data subjects by public or private controllers, including automated processing and cross-border transfers.

Law · In Force

Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.

Law · In Force

Processing of personal data in Uruguay or by controllers targeting Uruguayan data subjects.

Law · In Force

Transfers of EU personal data to US organizations relying on Data Privacy Framework certification.

Framework · In Force

Transfers of personal data from Switzerland to a U.S. organization relying on Swiss-U.S. DPF self-certification, including an AI vendor receiving Swiss-sourced training, inference or customer data.

Framework · In Force

EU/EEA personal data transfers using 2021 SCC modules as GDPR transfer safeguard.

Guidance · In Force

Processing of personal data of individuals in Türkiye or by controllers established in Türkiye.

Law · In Force