Risk & impact assessments

Processing of personal data in Albania or targeting Albanian data subjects by controllers and processors.

Law · Partially In Force

Personal data processed by an authority or other public body of the Land Berlin or of a Land corporation, institution or foundation of public law (§ 2 Abs. 1), by a private-law association performing public-administration tasks in which Berlin holds an absolute majority or by a non-public body performing sovereign tasks (§ 2 Abs. 2), or by a processor acting for one of them. Teil 3 applies instead of Teil 2 where the processing serves the prevention, investigation, detection, prosecution or punishment of criminal or administrative offences (§ 2 Abs. 4, § 30). § 19 additionally reaches non-public bodies processing for journalistic, artistic or literary purposes (§ 2 Abs. 7).

Law · In Force

Processing of personal data by an authority, institution or other public body of the Land Brandenburg, by a municipality or association of municipalities, by a legal person of public law under their supervision, by a non-public body performing sovereign tasks of a Land public body, or by a processor acting for any of them; and, for §§ 29 Absatz 1 and 2, by any body processing for journalistic, artistic or literary purposes.

Law · In Force

Processing of personal data in Liechtenstein; EEA GDPR applies directly with DSG as national implementing law.

Law · In Force

Processing of personal data in the Bailiwick of Guernsey or by controllers established in the Bailiwick.

Law · In Force

A relevant information society service (DPA 2018 s. 123(7): provided for remuneration, at a distance, by electronic means, at the individual request of a recipient, excluding preventive or counselling services) likely to be accessed by children under 18 in the United Kingdom.

Guidance · In Force

Processing by public and private bodies in Kosovo; limited extraterritorial reach for equipment in Kosovo.

Law · In Force

Processing of personal data in Georgia or using technical means in Georgia; extraterritorial reach for Georgian data subjects.

Law · In Force

Processing of personal data in Ukraine or of Ukrainian data subjects by controllers and processors.

Law · In Force

Collection or processing of personal data about a natural person in the Republic of Azerbaijan by a state or local self-government body or by a legal or natural person, other than collection and processing by a natural person exclusively for personal and family needs (art. 3.3) and the national-security and state-secret cases left to other legislation by art. 3.2.

Law · In Force

Processing of personal data in North Macedonia or targeting North Macedonian data subjects.

Law · In Force

Processing of personal data in Serbia or targeting Serbian data subjects; GDPR-aligned controller and processor obligations.

Law · In Force

Processing of personal data in BiH or of BiH data subjects; foreign controllers must appoint local representative where required.

Law · In Force

Public-sector personal data processing in Rhineland-Palatinate including AI.

Law · In Force

Processing of personal data in Andorra or by controllers/processors subject to Andorran law, including extraterritorial targeting of Andorran data subjects.

Law · In Force

Processing of personal data in Moldova or by controllers subject to Moldovan law after August 23, 2026.

Law · In Force

Processing by controllers/processors in Monaco or targeting data subjects in Monaco (GDPR-style territorial and extraterritorial scope).

Law · In Force

Processing of personal data in San Marino or by controllers established in San Marino, including automated and filing-system processing.

Law · In Force

Law · Pending

Frontier developers training or deploying foundation models meeting the 10^26 FLOP threshold; large frontier developers with >$500M annual gross revenue (with affiliates).

Law · In Force

CCPA-covered businesses that use ADMT to make significant decisions about California consumers.

Regulation · Partially In Force

Online products or services likely to be accessed by children and offered to California consumers.

Law · Partially In Force

Law · In Force

Controllers or processors conducting business in Iowa, or targeting products/services to Iowa residents, that meet the § 715D.2(1) consumer-volume/revenue thresholds (100,000 consumers, or 25,000 consumers with 50%+ revenue from data sales).

Law · In Force

Law · In Force

Applies to a person who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an artificial intelligence system in Texas (sec. 551.002). There is no revenue, headcount, data-volume or consumer-count threshold anywhere in the Act. Three duties are narrower than the Act: sec. 552.051(b) binds a governmental agency, and secs. 552.053 and 552.054(b) bind a governmental entity as sec. 552.001(3) defines it. One is narrower the other way: sec. 552.051(f) binds the provider of a health care service or treatment.

Law · In Force

Law · In Force

Processing personal data by ADGM-established controllers or processors.

Law · In Force

Processing of personal data in the context of the activities of a controller or processor on Beninese territory, or of persons who are in Benin where the activities relate to offering them goods or services or to monitoring their behaviour in Benin (art. 381).

Law · In Force

Controllers and processors collecting or processing personal data in Ghana.

Law · In Force

Automated or non-automated filing-system processing by a controller or processor established in Botswana; or, where not established there, processing where the activities of an establishment are in Botswana, or the activities relate to offering goods or services to data subjects in Botswana or to monitoring their behaviour there (s. 4).

Law · In Force

Processing of personal data by wholly or partly automated means, or non-automated processing of data in a filing system, in the context of an establishment of a controller or processor situated in Cabo Verde whatever the place of processing; or outside the territory where Cabo Verdean law applies by public international law; or by a controller or processor not established in Cabo Verde where the activities relate to offering goods or services to data subjects in Cabo Verde or to monitoring their behaviour there (art. 2.º).

Law · In Force

{"scope_basis":"jurisdiction","jurisdictions":["BI"],"regions":["Middle East & Africa"],"requires_ai":false}

Regulation · In Force

Collection, processing, transmission, storage or use of personal data by a natural person, by the State, by decentralised administrative entities or by legal persons of public or private law; processing implemented by a controller on the territory of the Republic of the Congo or in any place where the law of that country applies; or processing implemented by a controller, established in Congo or not, which has recourse to means of processing situated on Congolese territory, excluding means used only for transit (art. 2).

Law · In Force

Organisations self-assessing AI trustworthiness in the EU; especially relevant for high-risk and limited-risk AI under the EU AI Act.

Framework · In Force

Guidance · Pending

Intermediary services offered in the EU, especially VLOPs and VLOSEs using recommender systems and content moderation AI.

Regulation · In Force

Any organisation that offers goods or services to, or monitors the behaviour of, individuals in the EU/EEA — regardless of where the controller or processor is established.

Regulation · In Force

Providers placing AI on the EU market, deployers in the EU, and providers or deployers established in third countries whose AI system output is used in the EU.

Regulation · Partially In Force

Manufacturers placing products with digital elements on the EU market, including standalone AI software.

Regulation · Partially In Force

Surfaced wherever an AI system is designed, developed, deployed or used, in any sector, for civilian purposes: para. 4 scopes the Compact to the non-military domain and it names no sector, size or entity class. It creates no duty on anyone — its commitments are what Governments will do; its paragraphs addressed to companies, developers and platforms (22, 25, 32, 36) are calls; and endorsement (66) is voluntary. Two rows are conditioned on hosting user-generated content (32 (d), 36 (b)) and one on generating synthetic content (36 (c)), because those paragraphs are addressed to platforms and to content generators respectively.

Guidance · In Force

Surfaced as voluntary standards context wherever an autonomous or intelligent system is deployed. IEEE Std 7010-2020 creates no duty of its own; where an organisation is bound to it, the binding instrument is a contract, and the contract governs scope.

Standard · In Force

Surfaced as voluntary standards context wherever an organisation provides or uses a product or service that utilizes an AI system. ISO/IEC 42001 creates no duty of its own; where an organisation is bound to it, the binding instrument is a contract, a tender condition, an internal policy, a maintained certificate or a regulator instrument that references it, and that document governs scope.

Standard · In Force

Surfaced as voluntary standards context wherever an organisation develops, provides or uses an AI system. ISO/IEC 42005 creates no duty of its own; where an organisation is bound to it, the binding instrument is a contract, a tender condition, an internal policy or a regulator instrument that references it, and that document governs scope.

Standard · In Force

Surfaced wherever an AI system is designed, developed, deployed or used, in any sector and for any purpose: para. 2 (b) defines AI actors as any natural or legal person involved in any stage of the life cycle, para. 4 offers ethical guidance to all AI actors including the private sector, and the Recommendation carves out no domain. It creates no duty on anyone — Member States apply it voluntarily and AI actors receive guidance. Three rows carry the condition their paragraph turns on: decisions about people (para. 38, decision limb) and the provider role (paras. 51, last sentence, and 120, last sentence).

Guidance · In Force

Surfaced for any AI system used in health-care delivery, diagnostics, health research, or population/public health, consistent with the guidance's own stated scope (Executive Summary; §5, chapeau).

Guidance · In Force

Processing of personal data in the context of the activities of a data controller or data processor established in Barbados (s. 3 (1) (a)), or processing of personal data of data subjects in Barbados by a controller or processor not established in Barbados where the processing relates to the offering of goods or services to data subjects in Barbados (s. 3 (1) (b)).

Law · Partially In Force

An institution subject to the Policy on Service and Digital — a department within the meaning of s. 2 of the Financial Administration Act — using an automated decision system in production to make an administrative decision or a related assessment about a client (Directive, ss. 5.1 and 8.1). Systems used solely for research and experimentation and those in test environments are out of scope (s. 5.2). The instrument reaches systems developed or procured after 1 April 2020, and systems predating that date once significantly modified (s. 1.2).

Guidance · In Force

Processing of personal data in Belize by public or private controllers subject to the Act.

Law · Pending

Law · Pending

Processing of personal data in Ecuador or targeting Ecuadorian data subjects.

Law · In Force

Processing of personal data by controllers and processors in Kiribati — lawful basis, consent, data-subject rights, security and breach notification, data protection impact assessments, cross-border transfer standards; phased application for non–major-importance controllers.

Law · Pending

Providing a generative artificial intelligence service in mainland China (clause 1). No revenue, headcount or sector threshold. Adoption is voluntary: the standard is a recommended national standard and creates no legal duty of its own.

Standard · In Force

Vietnamese and foreign agencies, organisations, and individuals processing personal data in Vietnam or related to Vietnamese citizens.

Law · In Force

Cross-border transfer of personal information from China under PIPL standard contracts or security assessment.

Regulation · In Force

Recorded for footprint mapping only. Section 2, which supplies the Act’s application, is not in operation until 1 January 2027. From that date it reaches processing wholly or partly in Sri Lanka, and a controller or processor domiciled or ordinarily resident in Sri Lanka, incorporated under Sri Lankan law, offering goods or services to data subjects in Sri Lanka, or specifically monitoring their behaviour in Sri Lanka including profiling with the intention of making decisions about it.

Law · Partially In Force

Guidance · In Force

Organisations established in the UK and those that offer goods or services to, or monitor, individuals in the UK from outside.

Regulation · In Force

Processing of personal data of individuals in Switzerland, regardless of where the controller is established.

Law · In Force