The laws, and what they mean in practice

GDPR

European Union

The global reference point for privacy law: lawful bases, principles, rights, accountability, breach notice within 72 hours, transfer rules and fines up to 4 percent of worldwide turnover.

EU AI Act

European Union

Risk-based AI regulation with obligations assigned by role: prohibited practices, high-risk requirements, transparency duties and rules for general-purpose models.

ePrivacy Directive

European Union

The source of EU cookie consent and electronic marketing rules, alongside the GDPR.

NIS2

European Union

Cybersecurity risk management, management accountability and staged incident reporting starting with an early warning within 24 hours.

DORA

European Union

ICT risk management, incident reporting, resilience testing and a register of ICT third-party arrangements for the financial sector.

Data Act

European Union

Rights for users to access and share data from connected products, and rules making it easier to switch cloud providers.

DSA

European Union

Content moderation, transparency, a ban on ads targeted using sensitive data or at minors based on profiling, and risk assessments for very large platforms.

DMA

European Union

Limits on how gatekeepers combine personal data across services without consent, among other conduct rules.

CRA

European Union

Security requirements across the life of hardware and software products, with vulnerability handling and reporting duties.

DGA

European Union

Rules for neutral data intermediaries and for re-using protected public sector data.

EHDS

European Union

Patients' access to and control of electronic health data across the EU, and a framework for secondary use of health data.

EU-US DPF

European Union

An adequacy decision letting personal data flow to self-certified US companies without standard contractual clauses.

UK GDPR

United Kingdom

The UK's version of the GDPR after Brexit, now diverging in places through the Data (Use and Access) Act 2025.

HIPAA

US federal

Governs protected health information held by the health care system and its vendors: permitted uses and disclosures, patient rights, security safeguards for electronic records, and breach notice.

FTC Act Section 5

US federal

The main federal privacy enforcement tool: unfair or deceptive practices, including privacy promises not kept and unreasonable security.

GLBA

US federal

Privacy notices and opt-outs for sharing customer financial information, and an information security program with specific safeguards under the Safeguards Rule.

COPPA

US federal

Verifiable parental consent before collecting personal information from children under 13, with notice, access and deletion rights for parents.

CAN-SPAM

US federal

Honest headers and subject lines, a postal address, and an opt-out honored within ten business days. No consent is required to send.

TCPA

US federal

Consent rules for automated and prerecorded calls and texts, the National Do Not Call Registry, and statutory damages per call.

FCRA

US federal

Accuracy, permissible purpose and dispute rights for consumer reports, including background checks for employment.

FERPA

US federal

Parent and eligible student rights over education records, and limits on disclosing them.

VPPA

US federal

Limits disclosure of what video a person watched; now a frequent basis for lawsuits over tracking pixels on video pages.

GINA

US federal

Prohibits use of genetic information in employment and health insurance decisions.

SEC cyber disclosure

US federal

Disclosure of material cybersecurity incidents within four business days of determining materiality, and annual disclosure of risk management and governance.

FTC HBNR

US federal

Breach notice for health apps and similar services outside HIPAA, where unauthorized sharing counts as a breach.

CCPA/CPRA

California

The most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.

VCDPA

Virginia

The template for most later state laws: consumer rights, opt-outs from targeted advertising, sale and profiling, opt-in consent for sensitive data, and data protection assessments.

CPA

Colorado

Virginia-style law with detailed Attorney General rules, including requirements to honor universal opt-out signals.

CTDPA

Connecticut

Virginia-style law, amended to broaden coverage and strengthen rules on sensitive data and minors.

UCPA

Utah

One of the more business-friendly state laws, with narrower rights and higher thresholds.

TDPSA

Texas

No revenue or volume threshold: it reaches almost every business that is not a small business, which makes it one of the broadest state laws in practice.

OCPA

Oregon

Virginia-style law that also gives consumers the right to learn the specific third parties their data was disclosed to.

MCDPA

Montana

Virginia-style law with relatively low thresholds, reflecting the state's population.

FDBR

Florida

Narrow in who it covers, but strict for the largest technology companies it targets.

ICDPA

Iowa

A narrower Virginia-style law with fewer consumer rights.

DPDPA

Delaware

Virginia-style law with low thresholds and coverage of many nonprofits.

NHDPA

New Hampshire

Virginia-style law with thresholds scaled to a small state.

NJDPA

New Jersey

Virginia-style law with broad sensitive-data definitions and rulemaking by the Division of Consumer Affairs.

NDPA

Nebraska

Texas-style law without a volume threshold, applying to most businesses that are not small businesses.

TIPA

Tennessee

High thresholds, and an affirmative defense for businesses that follow the NIST Privacy Framework.

MCDPA

Minnesota

Adds rights other states lack, including the right to question the result of a profiling decision and to see the list of third parties that received data.

MODPA

Maryland

The strictest state law on data minimization: collection must be reasonably necessary for the service, and selling sensitive data is prohibited.

ICDPA

Indiana

Virginia-style law, in force from 2026.

KCDPA

Kentucky

Virginia-style law, in force from 2026.

RIDTPPA

Rhode Island

Virginia-style law with unusual website disclosure duties and no cure period.

OCDPA

Oklahoma

Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.

LDPA

Louisiana

Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.

APDPA

Alabama

Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.

VDPOSA

Vermont

Enacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.

BIPA

Illinois

Written notice and consent before collecting biometrics, a public retention schedule, and a private right of action that has produced some of the largest privacy settlements in the US.

CUBI

Texas

Notice and consent before capturing biometric identifiers, limits on sale and disclosure, and destruction within a set period. Enforced by the Attorney General, which has obtained large settlements.

RCW 19.375

Washington

Notice and consent or an opt-out mechanism before enrolling biometric identifiers for a commercial purpose.

MHMDA

Washington

A broad definition of consumer health data, separate consent to collect and to share, a signed authorization to sell, geofencing limits near health facilities, and a private right of action.

SB 370

Nevada

Similar in approach to Washington's law, without a private right of action.

Delete Act

California

Lets a California resident ask every registered data broker to delete their data with one request, which brokers must check and process on a fixed schedule.

Vermont data broker law

Vermont

The first state data broker registry, with security program and disclosure requirements.

Texas data broker law

Texas

Registration, website notices and a security program for data brokers.

Oregon data broker registry

Oregon

Annual registration for data brokers.

CA AADC

California

Would require child-protective defaults and assessments for services likely to be used by children. Its enforceability is being decided in court.

SAFE for Kids Act

New York

Limits addictive algorithmic feeds and overnight notifications for minors without parental consent.

SHIELD Act

New York

Broadened New York's breach notification law and requires reasonable administrative, technical and physical safeguards.

201 CMR 17.00

Massachusetts

One of the first prescriptive state security rules: a written information security program, encryption and vendor oversight.

NYDFS Part 500

New York

A detailed cybersecurity program regulation with annual certification, CISO reporting, incident notice within 72 hours and personal liability exposure for certifying executives.

Colorado AI Act

Colorado

The first broad US state law on algorithmic discrimination, modeled partly on risk-based approaches like the EU AI Act.

Every state requires notice to affected residents after a breach of personal information. Deadlines, regulator notices and what counts as personal information differ, so a multi-state breach means applying several laws at once.

LPDP

Argentina

An early EU-adequate law built on written consent, database registration and a court habeas data action, with very short response deadlines. It has no breach notification, DPO or DPIA duties, and fines remain small.

Privacy Act (AU)

Australia

Australia's privacy law, built on the thirteen Australian Privacy Principles, now in a period of reform.

LGPD

Brazil

Brazil's GDPR-inspired law, with ten legal bases and a national authority.

PIPEDA

Canada

Canada's federal private-sector privacy law, built on ten fair information principles.

Law 25

Quebec, Canada

The strictest privacy law in Canada, with privacy impact assessments for transfers and GDPR-level fines.

Bill C-36

Canada

The federal bill that would replace the private-sector part of PIPEDA. It keeps the penalty caps proposed in C-27 (up to CAD 10m or 3% of global revenue, and fines up to CAD 25m or 5%) but drops the AI act and the tribunal. PIPEDA stays in force until it passes.

LPVP

Chile

Until December 2026 Chile runs a light 1999 regime enforced only by courts, with written consent, a two-day response deadline and tiny fines. Law 21,719 then brings a GDPR-style regime with a new agency, breach duties and fines up to 20,000 UTM.

PIPL

China

China's comprehensive privacy law, with strict rules on consent and cross-border transfers.

Law 1581

Colombia

Every use of personal data needs prior, express, informed authorization that the controller can prove, and every controller must name a data protection person or area. The SIC actively enforces, larger firms register databases in the RNBD, and breaches go to the SIC within 15 business days.

LOPDP

Ecuador

The closest GDPR copy in the region, with legitimate interest, portability, DPIAs and DPOs, plus turnover-based fines up to 1%. It is stricter on timing: 5 days to notify the regulator and 3 days to notify individuals.

PDPL (Egypt)

Egypt

Egypt's data protection law. Controllers and processors need a license from the Personal Data Protection Center, and data protection officers register with it.

DPA (Ghana)

Ghana

Ghana's data protection law. Controllers register with the Data Protection Commission and renew every two years.

PDPO

Hong Kong SAR

Asia's oldest comprehensive privacy law, built on six data protection principles with no breach notification duty and no transfer restriction in force. Its sharpest teeth are criminal offenses for direct marketing without consent and doxxing.

DPDP Act

India

India's comprehensive privacy law, consent-centered, with duties for significant data fiduciaries.

PDP Law

Indonesia

GDPR-like structure but with very short 72-hour deadlines for both data subject requests and breach notices. Consent must be written or recorded, and criminal penalties up to 6 years sit alongside fines of 2% of revenue.

PPL

Israel

The PPL is a consent-based, database-centric law with very prescriptive security rules, including immediate reporting of severe incidents. Amendment 13 added GDPR-style definitions, DPO duties, per-data-subject administrative fines, and statutory damages, and cut database registration back to data brokers and public bodies.

APPI

Japan

Japan's privacy law, recognized by the EU as adequate.

DPA (Kenya)

Kenya

Kenya's data protection law. Controllers and processors register with the Data Commissioner. Appointing a data protection officer is optional under the Act.

PDPA (Malaysia)

Malaysia

Malaysia's data protection law, amended in 2024. Data protection officer appointment and breach notice to the Commissioner within 72 hours apply from 1 June 2025.

LFPDPPP

Mexico

Consent is the default basis, tacit consent through a privacy notice is enough for most data, and every controller must name a data protection person or department. The 2025 rewrite moved enforcement from the independent INAI to a federal ministry and dropped the old law's regulator-facing duties while keeping prison terms for data offenses.

Privacy Act

New Zealand

A principles-based law with 14 IPPs, mandatory privacy officers for every agency and serious-harm breach notification. Fines are small; remedies run through the Commissioner and the Human Rights Review Tribunal.

NDPA (Nigeria)

Nigeria

Nigeria's data protection law. Controllers and processors of major importance register with the NDPC and appoint a data protection officer, who must keep up yearly professional development.

LPDP

Peru

The 2024 Regulation brought Peru close to GDPR: extraterritorial reach with a local representative, 48-hour breach notice to the regulator and individuals, portability and a phased DPO duty. It keeps Peru's distinctive database registration and notification of every cross-border flow.

DPA (Philippines)

Philippines

The Philippines' data privacy law. Organizations designate a data protection officer, and those that meet the thresholds register with the National Privacy Commission.

PDPL (Saudi Arabia)

Saudi Arabia

Saudi Arabia's data protection law, enforced by SDAIA. Rules set when a data protection officer is required, and registration and breach notices run through the National Data Governance Platform.

PDPA (SG)

Singapore

Consent-based privacy law with mandatory breach notification since 2021.

POPIA

South Africa

South Africa's comprehensive privacy law, based on eight conditions for lawful processing.

PIPA

South Korea

Korea combines GDPR-style rights with unusually granular, item-by-item consent rules and a mandatory chief privacy officer for every controller. Enforcement is heavy: revenue-based surcharges now up to 10%, statutory damages and criminal penalties.

nFADP

Switzerland

Switzerland's revised law, closely aligned with the GDPR, with fines aimed at responsible individuals.

DIFC DPL

United Arab Emirates

The data protection law of the Dubai International Financial Centre, a financial free zone with its own laws and courts. It follows the GDPR closely and has its own Commissioner of Data Protection.

PDPA

Thailand

Closely modeled on GDPR, but consent must generally be in writing or electronic form and minors under 20 need guardian involvement. Civil liability is strict and courts can add punitive damages up to twice actual loss.

KVKK

Turkey

KVKK is GDPR-inspired but keeps a public controller registry (VERBIS) with filed data inventories, and requires breach notice to individuals in every case. Since 2024, transfers abroad work on adequacy, Board-approved safeguards or Board-issued standard contracts that must be filed within five business days.

DPPA (Uganda)

Uganda

Uganda's data protection law. The head of every institution it covers must designate a data protection officer, and anyone collecting or processing personal data registers with the Personal Data Protection Office.

PDPL (UAE)

United Arab Emirates

The UAE's federal data protection law. It has been in force since January 2022, but its Executive Regulations have not been issued, so there is no set breach deadline or penalty schedule yet.

LPDP

Uruguay

EU-adequate law that pairs documented consent and universal database registration with GDPR-style add-ons: 72-hour breach notice, mandatory DPIAs and DPOs for large or sensitive processing. Fines are low but response deadlines are five business days.

PDPL

Vietnam

Vietnam's first statute on personal data replaces Decree 13 with a consent-first regime in which impact assessments and transfer assessments must be filed with the Ministry of Public Security. Fines reach 5% of revenue for transfer violations and 10x revenue for illegal data trading.

CDPA (Zimbabwe)

Zimbabwe

Zimbabwe's data protection law, enforced by POTRAZ. Controllers need a license, and data protection officers must be appointed within 90 days and complete an approved certification course.