Cross-border transfer controls
Controls on moving personal data across borders — adequacy findings, standard contractual clauses, and data-localization mandates.
Middle East & Africa20 laws
Code du numérique — Livre III (données personnelles) (RDC)
Democratic Republic of the Congo
Processing of personal data in the DRC or targeting Congolese data subjects.
Law · In Force
Data Protection Act, 2023 (Seychelles)
Republic of Seychelles
Processing of personal data in Seychelles or by controllers established in Seychelles.
Law · In Force
Data Protection Act, 2024 (Malawi)
Republic of Malawi
Processing of personal data in Malawi or targeting Malawian data subjects.
Law · In Force
Data Protection Act, No. 24 of 2019 (Kenya)
Republic of Kenya
Processing of personal data of data subjects located in Kenya, including by controllers established outside Kenya.
Law · In Force
Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (United Arab Emirates)
United Arab Emirates (federal)
Processing of personal data of UAE residents by controllers or processors inside or outside the UAE that target UAE residents.
Law · In Force
Israel Privacy Law
State of Israel
Databases of personal information held by Israeli organisations or that process Israeli personal information.
Law · In Force
Law No. 151 of 2020 promulgating the Personal Data Protection Law (Egypt)
Arab Republic of Egypt
Processing of Egyptian personal data by controllers or processors inside or outside Egypt.
Law · In Force
Loi n° 19-2019 du 5 juillet 2019 relative à la protection des données à caractère personnel (Congo-Brazzaville)
Republic of the Congo
Processing of personal data in the Republic of the Congo or targeting Congolese data subjects.
Law · In Force
Loi n° 2008-12 du 25 janvier 2008 sur la protection des données à caractère personnel (Sénégal)
Republic of Senegal
Processing of personal data in Senegal or by controllers targeting Senegalese data subjects.
Law · In Force
Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel (Côte d'Ivoire)
Republic of Côte d'Ivoire
Processing of personal data in Côte d'Ivoire or targeting Ivorian data subjects.
Law · In Force
Loi n° 2017-020 relative à la protection des données à caractère personnel (Mauritanie)
Islamic Republic of Mauritania
Processing of personal data in Mauritania or targeting Mauritanian data subjects.
Law · In Force
Loi n° 2017-20 portant code du numérique en République du Bénin
Republic of Benin
Processing of personal data in Benin or targeting Beninese data subjects.
Law · In Force
Loi organique n° 2004-63 du 27 juillet 2004 relative à la protection des données à caractère personnel (Tunisie)
Republic of Tunisia
Processing of personal data in Tunisia or targeting Tunisian data subjects.
Law · In Force
Morocco Law 09-08
Kingdom of Morocco
Processing of personal data in Morocco or by controllers targeting Moroccan data subjects.
Law · In Force
Personal Data Protection Act, 2022 (Tanzania)
United Republic of Tanzania
Processing of personal data in Tanzania or of Tanzanian data subjects.
Law · In Force
Personal Data Protection Law (Law No. 30 of 2018) (Bahrain)
Kingdom of Bahrain
Processing of personal data in Bahrain or of Bahraini residents by controllers established inside or outside the Kingdom.
Law · In Force
Personal Data Protection Law No. 24 of 2023 (Jordan)
Hashemite Kingdom of Jordan
Processing of personal data of Jordanian citizens and residents, including data collected before enactment; cross-border transfers subject to Council adequacy rules.
Law · In Force
Royal Decree 6/2022 promulgating the Personal Data Protection Law (Oman)
Sultanate of Oman
Processing of personal data of individuals in Oman, including extraterritorial controllers offering goods or services to Omani data subjects.
Law · In Force
Rwanda DPP Law
Republic of Rwanda
Processing of personal data in Rwanda or targeting Rwandan data subjects.
Law · In Force
Saudi Arabia Personal Data Protection Law
Kingdom of Saudi Arabia
Any processing of personal data of individuals located in Saudi Arabia, including extraterritorial processing.
Law · In Force
Asia Pacific15 laws
Act on the Protection of Personal Information (Act No. 57 of 2003)
Japan
Business operators handling personal information in Japan or providing services to individuals in Japan.
Law · In Force
Australia Privacy Act
Commonwealth of Australia
Australian Privacy Principle entities including most businesses with turnover above the small-business threshold, health service providers, and federal agencies.
Law · In Force
Data Protection Act 2025 (Kiribati)
Republic of Kiribati
Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.
Law · Pending
Kazakhstan PD Law
Republic of Kazakhstan
Collection, processing, and protection of personal data by database owners and operators in Kazakhstan; data localization requirements for personal data databases.
Law · In Force
Law No. 91/2025/QH15 on Personal Data Protection (Viet Nam)
Socialist Republic of Viet Nam
Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.
Law · In Force
Personal Data (Privacy) Ordinance (Cap. 486) (Hong Kong)
Hong Kong SAR
Data users controlling the collection, holding, processing, or use of personal data in or from Hong Kong, including AI-driven profiling and automated processing.
Ordinance · In Force
Personal Data Protection Act (Taiwan PDPA)
Republic of China (Taiwan)
Collection, processing, or use of personal data by government agencies or private-sector controllers targeting individuals in Taiwan, including automated decision-making and cross-border transfers.
Law · In Force
Personal Data Protection Act B.E. 2562 (2019) (Thailand)
Kingdom of Thailand
Controllers and processors handling personal data of individuals in Thailand or offering goods or services to them.
Law · In Force
Personal Data Protection Act, 2023 (Bangladesh) (as enacted; phased commencement)
People's Republic of Bangladesh
Processing of personal data of Bangladeshi citizens, residents, or data subjects connected to Bangladesh; extraterritorial reach for controllers/processors outside Bangladesh.
Law · In Force
Personal Information Protection Law of the People's Republic of China
People's Republic of China
Processing personal information of individuals in China or providing products/services to individuals in China.
Law · In Force
PIPL Measures for Standard Contracts for Cross-Border Transfer of Personal Information
China (National)
Cross-border transfer of personal information from China under PIPL standard contracts or security assessment.
Regulation · In Force
PIPL Security Assessment
China (National)
Cross-border transfers from China meeting CAC security assessment thresholds.
Regulation · In Force
Tajikistan PD Law
Republic of Tajikistan
Collection, processing, storage, and protection of personal data by public and private entities in Tajikistan; information security facility certification requirements.
Law · In Force
Tonga Privacy Act 2025
Kingdom of Tonga
Processing of personal information by data controllers and processors in Tonga — lawful basis, consent, data-subject rights including portability, cross-border transfer standards, Privacy Commission supervision.
Law · Pending
Uzbekistan PD Law
Republic of Uzbekistan
Processing and protection of personal data in Uzbekistan regardless of means used, including information technologies; extraterritorial application to operators processing Uzbek personal data.
Law · In Force
Europe & Central Asia12 laws
Albania Law 124/2024
Republic of Albania
Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.
Law · In Force
Azerbaijan PD Law
Republic of Azerbaijan
Collection and processing of personal data in Azerbaijan; operators must register information systems with the Ministry.
Law · In Force
Belarus PD Law
Republic of Belarus
Processing of personal data in Belarus by controllers and processors; extraterritorial reach for Belarusian data subjects where applicable.
Law · In Force
Data Protection Act 2004 (Gibraltar) / Gibraltar GDPR
Gibraltar
Processing of personal data in Gibraltar or by controllers established in Gibraltar targeting Gibraltar data subjects.
Law · In Force
Federal Law No. 152-FZ on Personal Data (Russian Federation)
Russian Federation
Processing of personal data of individuals in Russia by operators, including extraterritorial operators targeting Russian data subjects; localization rules apply under Law 242-FZ.
Law · In Force
Guernsey DP Law 2017
Bailiwick of Guernsey
Processing of personal data in the Bailiwick of Guernsey or by controllers established in the Bailiwick.
Law · In Force
Law of Georgia on Personal Data Protection
Georgia
Processing of personal data in Georgia or using technical means in Georgia; extraterritorial reach for Georgian data subjects.
Law · In Force
Law on Personal Data Protection (Montenegro)
Montenegro
Processing by controllers in Montenegro or using equipment situated in Montenegro (limited extraterritorial reach).
Law · In Force
Law on Personal Data Protection (Serbia) (Zakon o zaštiti podataka o ličnosti)
Republic of Serbia
Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.
Law · In Force
Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Andorra)
Principality of Andorra
Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.
Law · In Force
San Marino Law 171/2018
Republic of San Marino
Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.
Law · In Force
UK International Data Transfer Agreement (IDTA)
United Kingdom
UK restricted transfers relying on ICO IDTA or Addendum as Art. 46 safeguard.
Guidance · In Force
Americas9 laws
Costa Rica Law 8968
Republic of Costa Rica
Processing of personal data in Costa Rica or targeting Costa Rican data subjects.
Law · In Force
Data Protection Act (2021 Revision)
Cayman Islands
Processing of personal data by controllers established in the Cayman Islands or processing data in the territory.
Law · In Force
Data Protection Act, 2021 (Act No. 45 of 2021) (Belize)
Belize
Processing of personal data in Belize by public or private controllers subject to the Act.
Law · Partially In Force
Dominican Republic Law 172-13
Dominican Republic
Processing of personal data in the Dominican Republic or targeting Dominican data subjects.
Law · In Force
Ley para la Protección de Datos Personales (Decreto Legislativo No. 144/2024)
Republic of El Salvador
Processing of personal data in El Salvador by public or private controllers.
Law · In Force
Panama Law 81/2019
Republic of Panama
Processing of personal data in Panama or targeting Panamanian data subjects.
Law · In Force
Peru Privacy Law
Republic of Peru
Processing of personal data in Peru or of Peruvian data subjects by public or private controllers, including automated processing and cross-border transfers.
Law · In Force
Quebec Law 25
Quebec, Canada
Enterprise in Quebec collecting, holding, using, or communicating personal information of Quebec residents — provincial overlay in addition to PIPEDA.
Law · In Force
Uruguay Law 18.331
Oriental Republic of Uruguay
Processing of personal data in Uruguay or by controllers targeting Uruguayan data subjects.
Law · In Force
Global & Voluntary3 laws
EU-U.S. Data Privacy Framework — Commission Implementing Decision (EU) 2023/1795
European Union / United States
Transfers of EU personal data to US organizations relying on Data Privacy Framework certification.
Framework · In Force
IOSCO Final Report — The use of artificial intelligence and machine learning by market intermediaries and asset managers
International
Securities firms or market infrastructures aligning with IOSCO AI/ML supervisory expectations.
Guidance · In Force
Swiss-U.S. Data Privacy Framework
Switzerland / United States
Transfers of Swiss personal data to U.S. organizations under Swiss-U.S. DPF certification.
Framework · In Force
EU & EEA1 law
EU Standard Contractual Clauses for International Transfers (2021)
European Union
EU/EEA personal data transfers using 2021 SCC modules as GDPR transfer safeguard.
Guidance · In Force
Turkey1 law
Law No. 6698 on the Protection of Personal Data (Turkey)
Republic of Türkiye
Processing of personal data of individuals in Türkiye or by controllers established in Türkiye.
Law · In Force
Sourced from the LegisGate™ intelligence library — our single source of truth (SSOT). Theme membership is computed deterministically from curated library text; run a LegisGate™ report to see how these obligations apply to your specific AI tool.