Law 25

In Law 25

• Section 1Purpose and scope of the Act

  Applies to enterprises collecting, holding, using or communicating personal information about people in Quebec in the course of business.

• Section 1.1Collection for a serious and legitimate reason treated as establishing a file
• Section 2Definition of personal information
• Section 3Exclusions: public bodies and information held on their behalf
• Section 3.6Definition of confidentiality incident
• Section 12.1Decisions based exclusively on automated processing
• Section 42Application to the Commission
• Section 43Time limit for application
• Section 44Written application and fees
• Section 45Group applications
• Section 47Assistance in drafting applications
• Section 52Refusal of frivolous applications
• Section 60Peremption of applications
• Section 67Code of Civil Procedure applies
• Section 72Content of registration application
• Section 80Exercise of oversight powers
• Section 80.1Powers of a single member; delegation
• Section 80.1.1Political parties, independent members and candidates
• Section 80.2Authorization of inspectors
• Section 80.3Inspection powers
• Section 80.4Identification and immunity of inspectors
• Section 88Report to the Government on implementation
• Section 89Study of the report by a parliamentary committee
• Section 90Government regulations
• Section 90.6Application for review
• Section 93.1Punitive damages
• Section 114Transitional: statement of the object of existing files

Reach abroad across 39 laws

Quebec Law 25	2	Applies to enterprises collecting, holding, using or communicating personal information about people in Quebec in the course of business.
Brazil LGPD	3	Applies regardless of location if processing occurs in Brazil, targets goods or services to people in Brazil, or data was collected in Brazil.
Egypt PDPL	3	Covers Egyptians anywhere, non-Egyptians in Egypt, and non-Egyptians abroad where the data concerns Egyptians or residents and the act is also criminal there.
Ghana DPA	3	Applies to controllers in Ghana, foreign controllers using equipment or processors in Ghana, and processing of information originating in Ghana.
Indonesia PDP Law	3	Applies inside Indonesia and to acts abroad with legal effect in Indonesia or on Indonesian citizens abroad.
Kenya DPA	3	Applies to controllers and processors outside Kenya that process personal data of data subjects located in Kenya.
Nigeria NDPA	3	Applies to controllers and processors outside Nigeria processing personal data of data subjects in Nigeria.
Saudi Arabia PDPL	3	Applies to processing in the Kingdom and to processing outside it of personal data of individuals residing in the Kingdom, by any means.
Switzerland nFADP	3	Applies to any circumstances that have an effect in Switzerland, even if initiated abroad; some foreign controllers must appoint a Swiss representative.
UAE (federal) PDPL	3	Applies to controllers and processors outside the UAE that process personal data of data subjects inside the State.
Uganda DPPA	3	Applies to anyone collecting or processing personal data in Uganda, and to anyone outside Uganda handling data relating to Ugandan citizens.
Vietnam PDPL	3	Applies to foreign entities in Vietnam and to foreign entities directly processing data of Vietnamese citizens and residents in Vietnam.
Australia Privacy Act	2	Applies to organizations abroad with an Australian link, including carrying on business in Australia.
California CCPA	2	Applies to for-profit businesses doing business in California that meet revenue or data-volume thresholds, wherever located, for California residents' data.
Canada PIPEDA	2	Applies to commercial activity with a real and substantial connection to Canada, and to interprovincial or international disclosures for consideration.
China PIPL	2	Applies outside China when providing products or services to people in China or analyzing their behavior; foreign handlers need a local representative.
Ecuador LOPDP	2	Applies to foreign controllers offering goods or services to, or monitoring behavior of, residents of Ecuador; non-residents must appoint an agent in Ecuador.
European Union GDPR	2	Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
India DPDP Act	2	Applies to processing outside India connected with offering goods or services to data principals in India.
Japan APPI	2	Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them.
New Zealand Privacy Act	2	Applies to overseas agencies carrying on business in New Zealand, even without a place of business or commercial purpose.
Peru Law 29733	2	Covers non-established controllers that offer goods or services to, or profile, people in Peru; they must appoint a representative.
Philippines DPA	2	Applies to processing outside the Philippines of citizens' or residents' data where the entity has a Philippine link (contract, branch, business, data collected there).
Singapore PDPA	2	Applies to organizations whether or not resident or with an office in Singapore, in practice when collecting, using or disclosing data in Singapore.
South Korea PIPA	2	No express territorial clause, but foreign controllers meeting Decree thresholds without a Korean address must designate a domestic agent; PIPC applies the Act to services targeting Koreans.
Thailand PDPA	2	Applies to controllers or processors abroad that offer goods or services to people in Thailand or monitor their behavior in Thailand.
Turkey KVKK	2	The law is silent on territory, but the Board requires foreign controllers processing data of people in Turkey to register in VERBIS through a local representative.
United Kingdom UK GDPR	2	Applies to non-UK controllers offering goods or services to, or monitoring behavior of, people in the UK.
Uruguay Law 18,331	2	Applies to non-established controllers offering goods or services to, or analyzing behavior of, people in Uruguay, or using means located there.
Colombia Law 1581	1	Applies to processing in Colombia and to foreign controllers or processors when Colombian law applies under international norms or treaties.
DIFC DIFC DPL	1	Applies to controllers or processors incorporated in DIFC, and to processing in DIFC including through stable arrangements, wherever the controller sits.
Hong Kong PDPO	1	Applies to data users controlling data in or from Hong Kong; no express reach over foreign businesses targeting Hong Kong residents.
Israel PPL	1	No express extraterritorial clause; the PPA applies the law where processing has a material impact on Israelis, e.g. targeting the Israeli market or local servers.
Malaysia PDPA	1	Applies to persons established in Malaysia, or using equipment in Malaysia other than for transit; foreign users must nominate a local representative.
Mexico LFPDPPP	1	Law applies nationwide; the Regulation also reaches non-established controllers that use means located in Mexico (other than transit).
South Africa POPIA	1	Applies to responsible parties domiciled in South Africa, or not domiciled but using automated or non-automated means in the Republic.
Zimbabwe CDPA	1	Applies to controllers active in Zimbabwe and to controllers not established there that use means located in Zimbabwe.
Argentina Law 25,326	0	No extraterritorial provision; applies to files and databases, public or private, in Argentina.
Chile Law 19,628	0	No extraterritorial provision in the current text.

In Law 25

• Section 3.1Enterprise accountability and person in charge of protection of personal information
• Section 11Accuracy and up-to-date information
• Section 71Accuracy of agent's information

We don't score this topic in the comparison. The sections on the left are the place to start.

In Law 25

• Section 1.1Collection for a serious and legitimate reason treated as establishing a file
• Section 4Collection requires a serious and legitimate reason; purposes determined
• Section 4.1Consent for minors under 14
• Section 5Collect only necessary information by lawful means
• Section 8.3Consent by providing information
• Section 12Use only for the purposes of collection; exceptions

  Consent is the default basis for use and communication, with listed exceptions.

• Section 13Consent required to communicate to third persons

  Consent is the default basis for use and communication, with listed exceptions.

• Section 14Requirements for valid consent

  Consent is the default basis for use and communication, with listed exceptions.

• Section 15Consent to communication obtained by the collector
• Section 18Communication without consent: exceptions
• Section 21.1Authorization for communication of professional information
• Section 22Commercial or philanthropic prospection; withdrawal of consent
• Section 46Authorization to disregard improper or repetitive requests
• Section 80.2Authorization of inspectors

Lawful basis across 39 laws

Quebec Law 25	3	Consent is the default basis for use and communication, with listed exceptions.
Argentina Law 25,326	3	Processing is unlawful without consent, except listed cases such as public sources, state functions, basic listings, contracts and certain financial operations. No legitimate interests.
Canada PIPEDA	3	Consent is the default basis, with limited statutory exceptions.
Chile Law 19,628	3	Processing only when a law authorizes it or the holder expressly consents; narrow exceptions for public-source and certain internal data. No legitimate interests.
Colombia Law 1581	3	Prior, express and informed authorization is required, with narrow exceptions (public authority requests, public data, medical emergencies, civil registry). No legitimate interests.
Egypt PDPL	3	Explicit consent is the default; other grounds are contract, legal obligation and exercising legal rights. No legitimate interests ground.
India DPDP Act	3	Consent is the default basis; processing without consent only for listed 'legitimate uses' (s.7). No general legitimate interests ground.
Israel PPL	3	Informed consent is the main basis; the alternative is statutory authority. There is no legitimate-interests basis, and new purposes need new consent.
Malaysia PDPA	3	Consent is the general rule; non-consent processing only where necessary for contract, legal obligation, vital interests, justice and similar listed grounds.
Mexico LFPDPPP	3	Consent is the default basis; processing without consent only under listed exceptions (law, public sources, legal relationship, emergency, health care, court order). No legitimate interests.
Peru Law 29733	3	Consent is the default basis; exceptions listed in the Law (public entities, public sources, contracts, health, anonymized data). No legitimate interests.
UAE (federal) PDPL	3	Processing without consent is prohibited except in listed cases (public interest, contract, legal obligation, public data and others); no legitimate interests ground.
Uganda DPPA	3	Prior consent is the default; exceptions cover law, national security, medical purposes, legal obligation and contracts. No legitimate interests ground.
Uruguay Law 18,331	3	Consent is the default basis, with exceptions for public sources, state functions, limited listings, contracts and domestic use. No legitimate interests.
Vietnam PDPL	3	Consent is the default basis; the Law adds listed exceptions such as contract performance, legal obligations and protecting legitimate rights.
China PIPL	2	Consent or six other bases (contract/HR, legal duty, emergencies, news, public data, other laws); no legitimate interests.
Australia Privacy Act	1	No lawful-basis list; collection must be reasonably necessary, and secondary use needs consent, reasonable expectation or an exception.
Brazil LGPD	1	Ten legal bases including consent, legal obligation, contract, credit protection and legitimate interests.
DIFC DIFC DPL	1	Multiple bases including consent, contract, legal obligation, vital interests and legitimate interests.
Ecuador LOPDP	1	Eight bases including consent, legal obligation, contract, vital interests, public interest and legitimate interest.
European Union GDPR	1	Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
Ghana DPA	1	Prior consent or listed grounds, including contract, legal obligation, and legitimate interests of the controller or a third party.
Hong Kong PDPO	1	No lawful-basis list; collection must be lawful, fair and for a purpose directly related to the data user's functions.
Indonesia PDP Law	1	Consent, contract, legal obligation, vital interests, public interest/authority, and legitimate interests.
Japan APPI	1	No list of lawful bases; purpose must be specified and notified, and consent is needed for use beyond purpose and for most third-party provision.
Kenya DPA	1	Consent or listed necessity grounds, including legitimate interests unless unwarranted given harm to the data subject.
New Zealand Privacy Act	1	No lawful-basis list; collection must be for a lawful purpose connected to the agency's functions and necessary for it.
Nigeria NDPA	1	Consent or listed necessity grounds, including legitimate interests unless the data subject would not reasonably expect the processing.
Philippines DPA	1	Multiple bases: consent, contract, legal obligation, vital interests, public order, public authority and legitimate interests.
Saudi Arabia PDPL	1	Consent plus other bases, including legitimate interests (since 2023 amendment) after a documented assessment; not for sensitive data.
Singapore PDPA	1	Consent, deemed consent, or exceptions in the First and Second Schedules, including a legitimate interests exception.
South Africa POPIA	1	Six lawful grounds including consent, contract, legal obligation, and legitimate interests of the responsible party or a third party.
South Korea PIPA	1	Consent, law, public duties, contract, vital interests, legitimate interests that clearly override data subject rights, and urgent public safety.
Switzerland nFADP	1	No closed list of bases; processing must follow the principles, and breaches are justified by consent, an overriding private or public interest, or law.
Thailand PDPA	1	Consent or six other bases: research, vital interests, contract, public task, legitimate interests, and legal obligation.
Turkey KVKK	1	Explicit consent is the default, but processing without consent is allowed on listed grounds, including contract, legal obligation and legitimate interests.
United Kingdom UK GDPR	1	Six GDPR bases plus a new 'recognised legitimate interests' basis (Annex 1) needing no balancing test, in force 5 Feb 2026.
Zimbabwe CDPA	1	Consent or listed grounds including legal obligation, vital interests, public interest and legitimate interests of the controller or third party.
California CCPA	0	No lawful-basis requirement; notice at collection plus purpose limitation, with opt-out of sale/sharing.

In Law 25

• Section 12Use only for the purposes of collection; exceptions

  Sensitive information requires express consent for secondary uses and communication.

• Section 37Health information: temporary refusal

Sensitive data across 39 laws

Quebec Law 25	1	Sensitive information requires express consent for secondary uses and communication.
Egypt PDPL	3	Processing sensitive data requires both written explicit consent and a licence from the Personal Data Protection Center.
Argentina Law 25,326	2	No one can be compelled to provide sensitive data; processing only for general interest authorized by law, or dissociated statistics or science.
Australia Privacy Act	2	Sensitive information may be collected only with consent and where reasonably necessary, or under listed exceptions.
Brazil LGPD	2	Sensitive data processed only with specific, highlighted consent or under listed exceptions.
Chile Law 19,628	2	Sensitive data cannot be processed unless a law authorizes it, the holder consents, or it is needed to grant health benefits.
China PIPL	2	Sensitive data needs a specific purpose, sufficient necessity, strict safeguards and separate consent.
Colombia Law 1581	2	Processing sensitive data is prohibited except with explicit authorization or listed exceptions; no activity may be conditioned on providing it.
DIFC DIFC DPL	2	Special categories may not be processed unless a listed condition, such as explicit consent, applies.
Ecuador LOPDP	2	Processing sensitive data is prohibited unless a listed exception applies, such as explicit consent.
European Union GDPR	2	Special categories (health, biometrics, religion, etc.) are prohibited unless explicit consent or another listed exception applies.
Ghana DPA	2	Special personal data (health, religion, ethnicity, sexual life and others) is prohibited unless consent or a listed exception applies.
Japan APPI	2	Special care-required information (race, creed, medical history, criminal record, etc.) needs prior consent to acquire and cannot be shared by opt-out.
Kenya DPA	2	Sensitive personal data may be processed only on listed grounds; health data only by or under health professionals.
Malaysia PDPA	2	Health, political, religious, offence and biometric data need explicit consent or a listed exception.
Mexico LFPDPPP	2	Sensitive data needs express written consent (signature, e-signature or other authentication); databases of sensitive data need a legitimate, specific justification.
Nigeria NDPA	2	Sensitive data (genetic, biometric, health, religion, politics, ethnicity, sex life, union membership) needs specific consent or a listed ground.
Peru Law 29733	2	Sensitive data, including biometric, genetic and neural data, requires written consent by signature or equivalent.
Philippines DPA	2	Processing sensitive and privileged information is prohibited except for listed cases such as specific consent, legal authorization or medical emergencies.
Saudi Arabia PDPL	2	Sensitive data needs explicit consent or a listed basis; legitimate interests cannot be used; DPIA and DPO triggers apply.
South Africa POPIA	2	Special personal information is prohibited unless consent or a listed exception applies; the Regulator may authorize processing in the public interest.
South Korea PIPA	2	Sensitive data (beliefs, union, politics, health, sex life, etc.) may be processed only with separate consent or where law requires or permits.
Switzerland nFADP	2	Sensitive data (incl. genetic, biometric, social assistance, criminal proceedings) needs express consent if relying on consent; disclosing it to third parties needs justification.
Thailand PDPA	2	Sensitive data (health, beliefs, criminal records, biometrics, genetics, etc.) requires explicit consent unless a listed exception applies.
Turkey KVKK	2	Processing special categories, including appearance, clothing and association membership, is prohibited unless an Art. 6(3) exception applies, such as explicit consent, law or employment obligations. Board-set measures are required.
Uganda DPPA	2	Special personal data (beliefs, politics, sexual life, financial, health) may be processed only under listed exceptions, such as freely given consent.
United Kingdom UK GDPR	2	Special categories prohibited unless explicit consent or listed condition applies; many conditions need an appropriate policy document.
Uruguay Law 18,331	2	No one may be compelled to provide sensitive data; processing needs express written consent or legal authorization for general interest.
Vietnam PDPL	2	Sensitive data list set by Government (now includes banking, credit, location and behavioral data); extra safeguards and notice required.
Zimbabwe CDPA	2	Sensitive, genetic, biometric and health data require written consent or listed exceptions; some uses need Authority authorization.
California CCPA	1	Sensitive personal information defined; consumers may limit its use to listed necessary purposes, with notice required.
Canada PIPEDA	1	No special category; sensitivity drives the form of consent, generally express for sensitive information.
Indonesia PDP Law	1	'Specific' data (health, biometric, genetic, criminal, child, financial) defined; mainly triggers DPIA and DPO duties rather than a ban.
Israel PPL	1	'Information of special sensitivity' is broadly defined (incl. biometrics, location, financial data). It brings higher security levels, PPA notification above 100,000 people, DPO triggers and higher fines, but no ban.
UAE (federal) PDPL	1	Sensitive data is defined; no separate prohibition, but large-volume sensitive processing triggers DPO and DPIA duties.
Hong Kong PDPO	0	No special category of sensitive data.
India DPDP Act	0	No separate sensitive data category; volume and sensitivity only factor into Significant Data Fiduciary designation.
New Zealand Privacy Act	0	No special category in the Act; Biometric Processing Privacy Code 2025 regulates biometrics.
Singapore PDPA	0	No statutory special category; PDPC treats some data as sensitive when assessing security and penalties.

In Law 25

• Section 4.1Consent for minors under 14

  Information about a minor under 14 requires consent from the person with parental authority, unless clearly for the minor's benefit.

• Section 38Information about minors

Children across 39 laws

Quebec Law 25	2	Information about a minor under 14 requires consent from the person with parental authority, unless clearly for the minor's benefit.
Brazil LGPD	3	Under 12 needs specific parental consent; all minors under 18 must be processed in their best interest.
Colombia Law 1581	3	Processing data of all minors under 18 is prohibited except public data, or with legal representative authorization respecting the child's best interests.
Egypt PDPL	3	Children's data is sensitive. Under 15 needs written guardian consent; for ages 15 to 18 the Center sets the consent mechanism.
Ghana DPA	3	Age 18 (Children's Act). Data about a child under parental control is treated as special personal data.
India DPDP Act	3	Child means under 18; verifiable parental consent required; no tracking, behavioral monitoring or targeted advertising directed at children.
Indonesia PDP Law	3	Processing children's data needs consent of parent or guardian; child means under 18 under Indonesian child law.
Kenya DPA	3	Age 18. Processing requires parent or guardian consent and must serve the child's best interests; profiling children for direct marketing is barred.
Malaysia PDPA	3	For data subjects under 18, a parent, guardian or person with parental responsibility acts and consents.
Nigeria NDPA	3	Age 18 (Child's Rights Act). Parental or guardian consent with age verification; regulations pending for electronic services to children 13 and over.
Saudi Arabia PDPL	3	No fixed age in the PDPL; legal guardians act for persons lacking full legal capacity, including minors.
South Africa POPIA	3	Child means under 18. Processing children's information is prohibited unless a s.35 exception applies, such as consent of a competent person.
Thailand PDPA	3	Minors (under 20) need guardian consent unless they could act alone; under 10 always needs guardian consent.
Uganda DPPA	3	Age 18. Processing a child's data needs prior parental or guardian consent, unless required by law or for research or statistics.
Zimbabwe CDPA	3	Age 18. Parents or guardians consent and exercise rights; controllers must verify consent and run regular DPIAs for children's data.
California CCPA	2	Under 16: opt-in required to sell/share; under 13: parental authorization. Fines up to USD 7,988 for violations involving minors under 16.
China PIPL	2	Under 14 requires parent or guardian consent and special handling rules; such data is sensitive.
Ecuador LOPDP	2	Adolescents 15 and over may consent; younger children need a legal representative; ages 12-15 exercise rights through a representative.
European Union GDPR	2	Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
Peru Law 29733	2	Minors 14 to 18 may consent if information is understandable; under 14 needs parental or guardian consent; reasonable age verification required.
South Korea PIPA	2	Under 14: legal representative consent required and must be verified.
Vietnam PDPL	2	Legal representative acts for children (under 16); child aged 7+ and representative must both consent for private-life data.
Australia Privacy Act	1	No statutory age; OAIC guidance presumes capacity at 15. Children's Online Privacy Code (under 18) due by 10 Dec 2026.
Canada PIPEDA	1	No statutory age; the OPC considers children under 13 unable to give meaningful consent.
Japan APPI	1	No statutory age today; PPC Q&A treats roughly 12-15 as needing a guardian. Amendment sets under 16 for guardian consent once in force.
New Zealand Privacy Act	1	No age threshold; collection must be fair and not unreasonably intrusive, particularly from children or young persons.
Singapore PDPA	1	PDPC guidance: children 13 to 17 may consent if notices are understandable; under 13 need parent or guardian consent.
United Kingdom UK GDPR	1	Age of consent for information society services is 13; online services likely accessed by children must consider children's higher protection in design.
Argentina Law 25,326	0	No child-specific rule or age threshold in the Act; general capacity rules of the Civil and Commercial Code apply.
Chile Law 19,628	0	No child-specific rule or age threshold in the current text.
DIFC DIFC DPL	0	No children's consent age; minors are excluded from certain automated-decision exceptions.
Hong Kong PDPO	0	No age threshold or children-specific consent rule.
Israel PPL	0	No age threshold in the PPL; minors under 18 lack full legal capacity, so parental consent is generally needed.
Mexico LFPDPPP	0	No child-specific rule or age threshold; minors act through representatives under the Federal Civil Code (minority ends at 18).
Philippines DPA	0	No child-specific rule or age threshold in the Act; age is listed as sensitive personal information.
Switzerland nFADP	0	No fixed age; a minor can consent if they have capacity of judgment, assessed case by case.
Turkey KVKK	0	No specific rule; under-18s are minors under the Civil Code, so a parent or guardian generally gives consent.
UAE (federal) PDPL	0	No age threshold or child-specific rule in the Decree-Law.
Uruguay Law 18,331	0	No child-specific rule or age threshold in the Law; minors' data listed among vulnerable groups triggering a DPIA.

In Law 25

• Section 12.1Decisions based exclusively on automated processing

  Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.

• Section 20Access by employees limited to their duties
• Section 27Right of access

  Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.

• Section 28Right of rectification

  Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.

• Section 28.1Right to cease dissemination and de-indexing

  Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.

• Section 29Enterprise to facilitate exercise of rights
• Section 31Access to information on cause of death
• Section 32Time limit to respond

  Reply in writing promptly and within 30 days; no reply is a deemed refusal.

• Section 33Access free of charge; reasonable fees
• Section 35Copy of rectified information
• Section 41Refusal of access by heirs or successors
• Section 53Burden of proof on rectification
• Section 57.1Correction of clerical errors
• Section 75Public access to the register
• Section 78Agent rules for access and rectification

Rights across 39 laws

Quebec Law 25	3	Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.
Brazil LGPD	3	Confirmation, access, correction, anonymization/blocking/deletion, portability, consent revocation, objection and review of automated decisions.
California CCPA	3	Know/access, delete, correct, portability, opt-out of sale/sharing, limit sensitive data, and ADMT opt-out and access rights.
China PIPL	3	Know and decide, restrict or refuse, access and copy, portability, correction, deletion, explanation and refusal of solely automated decisions.
DIFC DIFC DPL	3	Withdraw consent, access, rectification, erasure, objection (incl. direct marketing), restriction, portability and automated-decision rights.
Ecuador LOPDP	3	Information, access, rectification, deletion, objection, portability, suspension of processing, and not to be subject to solely automated decisions.
European Union GDPR	3	Access, rectification, erasure, restriction, portability, objection and rights on solely automated decisions.
Indonesia PDP Law	3	Information, correction, access, erasure, withdrawal, objection to automated decisions, restriction/suspension, portability and compensation.
Kenya DPA	3	Information, access, objection, correction, deletion, restriction, portability, and the right not to be subject to solely automated decisions.
Nigeria NDPA	3	Access, copy, rectification, erasure, restriction, portability, objection (absolute for direct marketing) and safeguards against solely automated decisions.
Peru Law 29733	3	Information, access, portability, rectification, cancellation, opposition, and objective treatment (no solely automated decisions with significant effects).
South Africa POPIA	3	Access, correction, deletion, objection (including direct marketing), protection from solely automated decisions, and restriction in limited cases.
South Korea PIPA	3	Access, portability (transmission), correction, erasure, suspension of processing, and the right to object to or seek explanation of automated decisions.
Switzerland nFADP	3	Access, rectification, deletion, restriction/prohibition of processing, objection, data portability, and a right to be heard on automated individual decisions.
Thailand PDPA	3	Access, portability, objection, erasure, restriction and rectification.
UAE (federal) PDPL	3	Information and access, portability, correction and erasure, restriction, objection (incl. direct marketing) and rights against automated decisions.
United Kingdom UK GDPR	3	Access, rectification, erasure, restriction, portability, objection, and safeguards on significant automated decisions, plus a right to complain to the controller.
Argentina Law 25,326	2	Access, rectification, updating and suppression; removal or blocking of marketing data at any time.
Chile Law 19,628	2	Information (access), modification, deletion and blocking; opposition to use for advertising, market research or surveys.
Colombia Law 1581	2	Know, update and correct data; proof of authorization; information on use; complain to SIC; revoke authorization or request deletion.
Egypt PDPL	2	Know and access data, withdraw consent, correct and erase, restrict processing, object, and be told of breaches.
Ghana DPA	2	Access, correction and deletion, the right to prevent processing, direct marketing opt-out, and rights against solely automated decisions.
Israel PPL	2	Access, correction or deletion of inaccurate data, deletion from direct-mail databases (opt-out), and erasure for EEA-origin data.
Japan APPI	2	Disclosure (access), correction/deletion, cessation of use or erasure, cessation of third-party provision, and disclosure of third-party provision records.
Malaysia PDPA	2	Access, correction, withdrawal of consent, prevent damaging processing, stop direct marketing and data portability.
Mexico LFPDPPP	2	ARCO rights: access, rectification, cancellation and opposition, including objection to automated processing with significant effects. No portability right.
Philippines DPA	2	Right to be informed, access, rectification, erasure or blocking, objection (incl. direct marketing), portability and damages.
Saudi Arabia PDPL	2	Rights to be informed, access and copy, correction, restriction and destruction; no portability right.
Turkey KVKK	2	Learn whether data is processed and get information (access), rectification, erasure, notice to third-party recipients, objection to solely automated outcomes, and compensation.
Uganda DPPA	2	Access, correction and deletion, objection to damaging processing, direct marketing opt-out, and rights against solely automated decisions.
Uruguay Law 18,331	2	Access, rectification, updating, inclusion, suppression; challenge automated decisions; removal or blocking of marketing data.
Vietnam PDPL	2	Be informed, consent and withdraw, access, correction, deletion, restriction, objection, complaint and lawsuit.
Zimbabwe CDPA	2	Information, access, objection, correction and deletion of false data, and protection from solely automated decisions.
Australia Privacy Act	1	Access and correction; no statutory erasure, portability or objection rights (direct marketing opt-out aside).
Canada PIPEDA	1	Access, correction, and withdrawal of consent; no statutory deletion, portability or automated-decision rights.
Hong Kong PDPO	1	Access and correction only.
India DPDP Act	1	Access to information, correction, completion, updating and erasure, grievance redressal and nomination. No portability, objection or automated-decision rights.
New Zealand Privacy Act	1	Access and correction only.
Singapore PDPA	1	Access and correction; data portability enacted but not yet in force; right to withdraw consent.

In Law 25

• Section 22Commercial or philanthropic prospection; withdrawal of consent

  Prospection must identify the enterprise and inform individuals of their right to withdraw consent; electronic messages need CASL opt-in.

Marketing across 39 laws

Quebec Law 25	1	Prospection must identify the enterprise and inform individuals of their right to withdraw consent; electronic messages need CASL opt-in.
Colombia Law 1581	3	Any marketing use needs prior, express, informed authorization for that purpose; holders may revoke at any time.
Ghana DPA	3	Direct marketing requires the data subject's prior written consent, and data subjects may later require it to stop.
Hong Kong PDPO	3	Consent (incl. 'no objection') required before using or providing personal data for any direct marketing; oral consent confirmed in writing within 14 days.
Kenya DPA	3	Commercial use, including direct marketing, requires express consent; messages must carry a simple opt-out, and objection is absolute.
Nigeria NDPA	3	Consent is required for any direct marketing; objection to direct marketing is absolute.
Peru Law 29733	3	Consent for marketing must be obtained directly; one first contact allowed to seek it, no further contact if refused; opt-outs handled within 10 days.
Saudi Arabia PDPL	3	Consent required before sending advertising or using personal data for direct marketing; easy opt-out required; no existing-customer exception confirmed.
Australia Privacy Act	2	APP 7 requires opt-out; Spam Act 2003 requires opt-in consent for commercial electronic messages.
China PIPL	2	Automated-decision marketing must offer a non-personalized option or easy refusal; marketing otherwise needs consent.
Egypt PDPL	2	Electronic direct marketing requires prior consent, a clear opt-out and a Center licence; consent records kept three years.
European Union GDPR	2	Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
Israel PPL	2	Prior written or electronic opt-in for commercial electronic messages, with a narrow existing-customer exception; the PPL also gives an absolute right to opt out of direct mail.
Japan APPI	2	Marketing email requires prior opt-in consent under the Act on Regulation of Transmission of Specified Electronic Mail.
New Zealand Privacy Act	2	Commercial electronic messages require consent under the Unsolicited Electronic Messages Act 2007.
South Africa POPIA	2	Electronic direct marketing requires prior opt-in consent, which may be requested only once; existing customers may receive similar offers with an opt-out.
South Korea PIPA	2	Electronic advertising requires the recipient's prior explicit opt-in consent.
Switzerland nFADP	2	Opt-in for automated mass advertising (email, SMS), except to existing customers for similar products with an opt-out offered.
Turkey KVKK	2	Commercial electronic messages need prior opt-in consent recorded in the national IYS system; opt-outs must be honored within 3 business days.
United Kingdom UK GDPR	2	Prior consent needed for electronic marketing, with soft opt-in for existing customers (extended to charities by DUAA); absolute right to object.
Vietnam PDPL	2	Consent required for behavioral and targeted advertising, with an opt-out mechanism, plus anti-spam rules.
Argentina Law 25,326	1	Marketing may use data from public sources or provided by the holder; holders may demand removal or blocking at any time (opt-out).
Brazil LGPD	1	No specific marketing rule; requires a legal basis, and data subjects may object or revoke consent.
California CCPA	1	Right to opt out of selling or sharing data for cross-context behavioral advertising; email marketing governed by federal CAN-SPAM.
Canada PIPEDA	1	Opt-out consent can suffice for non-sensitive secondary marketing uses; commercial electronic messages need opt-in under CASL.
Chile Law 19,628	1	Holders may object to use of their data for advertising, market research or opinion surveys (opt-out).
DIFC DIFC DPL	1	Inform subjects before first disclosure for marketing and honor the right to object at any time, offered by the first communication.
Ecuador LOPDP	1	Data subjects may object at any time to direct marketing, including related profiling.
Malaysia PDPA	1	Data subjects may require a controller, by written notice, to stop or not begin processing for direct marketing.
Mexico LFPDPPP	1	Marketing is a secondary purpose disclosed in the privacy notice; data subjects can object or opt out.
Philippines DPA	1	Data subjects have a right to object to direct marketing; processing must stop on objection.
Singapore PDPA	1	Check the Do Not Call Register before marketing calls or texts unless clear consent; marketing use of data also needs consent.
Thailand PDPA	1	Data subjects may object to direct marketing at any time; no PDPA-specific opt-in for electronic marketing.
UAE (federal) PDPL	1	Data subjects may object to processing for direct marketing, including related profiling.
Uganda DPPA	1	Data subjects may require a controller to stop direct marketing processing; the controller must respond within 14 days.
Uruguay Law 18,331	1	Marketing profiles only from public sources, data provided by the holder or with consent; holder may request removal or blocking at any time.
Zimbabwe CDPA	1	Data subjects may object free of charge to processing for direct marketing; no opt-in rule.
India DPDP Act	0	No specific direct marketing rule; marketing requires consent like other processing; targeted ads to children banned.
Indonesia PDP Law	0	Not addressed specifically; marketing needs a lawful basis and consent can be withdrawn.

In Law 25

• Section 3.1Enterprise accountability and person in charge of protection of personal information

  The person with highest authority in every enterprise is by default the person in charge of personal information protection; may delegate in writing.

• Section 3.4Protection measures suggested by the person in charge

DPO required across 39 laws

Quebec Law 25	3	The person with highest authority in every enterprise is by default the person in charge of personal information protection; may delegate in writing.
Canada PIPEDA	3	Every organization must designate an individual accountable for compliance.
Colombia Law 1581	3	Every controller and processor must designate a person or area to assume the data protection function and handle requests.
Egypt PDPL	3	Every legal-entity controller and processor must appoint a qualified employee as DPO and register them with the Center.
Mexico LFPDPPP	3	Every controller must designate a person or data protection department to handle ARCO requests and promote data protection internally.
New Zealand Privacy Act	3	Every agency must appoint one or more privacy officers.
Philippines DPA	3	Every personal information controller and processor must designate a DPO or accountable individual, and register one DPO.
Singapore PDPA	3	Every organization must designate one or more individuals responsible for PDPA compliance and publish business contact information.
South Africa POPIA	3	Every public and private body has an Information Officer (the head by default), who must be registered with the Regulator before taking up duties.
South Korea PIPA	3	Every controller must designate a chief privacy officer; small businesses default to the owner or representative.
Uganda DPPA	3	The head of every institution covered by the Act must designate a data protection officer.
Zimbabwe CDPA	3	Every data controller must appoint a DPO and notify POTRAZ on Form DP2.
Brazil LGPD	2	Controllers must appoint an encarregado; ANPD may exempt small processing agents.
Ghana DPA	2	Statute lets controllers appoint a certified data protection supervisor; DPC guidance requires medium and large controllers to appoint one.
Nigeria NDPA	2	Data controllers and processors of major importance must designate a DPO; low thresholds (over 200 data subjects in six months) capture many firms.
Vietnam PDPL	2	Must appoint qualified data protection personnel or department, or hire a service provider.
Australia Privacy Act	1	Not required for organizations; Australian Government agencies must appoint a privacy officer under the Agencies Code.
China PIPL	1	Handlers processing personal information above the volume set by the CAC must appoint a personal information protection officer.
DIFC DIFC DPL	1	DPO required for DIFC Bodies and for controllers or processors performing high-risk processing on a systematic or regular basis.
Ecuador LOPDP	1	DPO required for public-sector processing, large-scale systematic monitoring and large-scale processing of special categories.
European Union GDPR	1	DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
India DPDP Act	1	Only Significant Data Fiduciaries notified by the government must appoint a DPO; others publish contact of a DPO or responsible person.
Indonesia PDP Law	1	DPO required for public-service processing, large-scale systematic monitoring, or large-scale specific/criminal data; any one trigger suffices.
Israel PPL	1	Required for public bodies, data brokers and direct mailers above 10,000 people, and entities whose core activity is systematic monitoring or large-scale special-sensitivity data.
Kenya DPA	1	Controllers and processors may appoint a DPO for public or private bodies, systematic monitoring, or sensitive data processing.
Malaysia PDPA	1	Controllers and processors must appoint a DPO when processing data of over 20,000 subjects, sensitive data of over 10,000, or systematic monitoring.
Peru Law 29733	1	Data protection officer required for public entities, large-scale or sensitive processing, and core sensitive-data activities; phased in by company size through Nov 2028.
Saudi Arabia PDPL	1	DPO required for public entities processing at large scale, and where core activities involve systematic monitoring or sensitive data.
Switzerland nFADP	1	Optional for private controllers; federal bodies must appoint a data protection advisor.
Thailand PDPA	1	DPO required for public authorities, large-scale regular monitoring, or core activities involving sensitive data.
UAE (federal) PDPL	1	DPO required for high-risk processing, systematic assessment of sensitive data including profiling, or large-volume sensitive data.
United Kingdom UK GDPR	1	DPO required for public authorities, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
Uruguay Law 18,331	1	DPO required for public bodies, majority state-owned entities, private entities whose core business is sensitive data, and those processing data of over 35,000 people.
California CCPA	0	No DPO requirement; executive accountable for risk-assessment attestations and cybersecurity audit certification.
Hong Kong PDPO	0	No DPO requirement.
Japan APPI	0	No DPO requirement; controllers must take necessary security control measures, including organizational measures.
Turkey KVKK	0	No DPO requirement; registered controllers must appoint a contact person for the Authority and data subjects.
Argentina Law 25,326	–	Not addressed
Chile Law 19,628	–	Not addressed

In Law 25

• Section 3.8Register of confidentiality incidents
• Section 70Registration of personal information agents
• Section 70.1Registration not an approval
• Section 72Content of registration application
• Section 73Registration by the Commission
• Section 74Register of agents
• Section 75Public access to the register

Registration across 39 laws

Quebec Law 25	–	Not addressed
Egypt PDPL	3	Controllers and processors need Center licences with fees capped at EGP 2 million, plus permits for transfers, marketing and CCTV.
Ghana DPA	3	Every data controller must register with the Commission, pay a fee and renew every two years; processing unregistered is an offense.
Kenya DPA	3	Controllers and processors must register, pay tiered fees (KES 4,000-40,000) and renew every 24 months; small entities exempt unless in listed sectors.
Uganda DPPA	3	All collectors, processors and controllers must register with the PDPO, renew annually and pay fees (UGX 100,000 reported).
Zimbabwe CDPA	3	Controllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, renewed every 12 months.
Argentina Law 25,326	2	Public databases and private databases that go beyond exclusively personal use must register with the AAIP registry.
DIFC DIFC DPL	2	Controllers and processors must register by filing a notification of processing with the Commissioner, kept up to date, with fees.
Ecuador LOPDP	2	Controllers must register with and keep updated the National Personal Data Protection Registry.
Malaysia PDPA	2	Prescribed classes of controllers (banking, insurance, health, telecoms, education, real estate and others) must register and renew certificates with fees.
Nigeria NDPA	2	Controllers and processors of major importance must register, with fees of N10,000-250,000 by tier; ordinary-tier entities renew annually.
Peru Law 29733	2	Creation, modification and cancellation of personal data banks must be registered (free, automatic approval) with the National Registry.
Philippines DPA	2	Register processing systems and DPO if 250+ employees, sensitive data of 1,000+ individuals, or risky processing; renew annually.
Turkey KVKK	2	Controllers must register in VERBIS before processing, unless exempt (under 50 employees and under TRY 100m balance sheet, or under 10 and TRY 10m if mainly sensitive data).
United Kingdom UK GDPR	2	Most controllers must pay an annual data protection fee to the ICO unless exempt.
Uruguay Law 18,331	2	All public and private databases, other than purely personal ones, must be registered with the URCDP, including foreign controllers in scope.
California CCPA	1	No general registration; data brokers must register annually with the CPPA under the Delete Act.
Colombia Law 1581	1	Companies and non-profits above an asset threshold (and public entities) must register databases in the SIC's National Database Registry (RNBD) and update annually.
Indonesia PDP Law	1	No PDP Law registration; electronic system operators register with the ministry under GR 71/2019.
Israel PPL	1	Registration only for public-body databases and databases of 10,000+ people mainly used to transfer data for payment; notify the PPA of special-sensitivity databases above 100,000 people.
Japan APPI	1	No general registration; businesses using the opt-out route for third-party provision must notify the PPC in advance.
Saudi Arabia PDPL	1	National Register of Controllers applies to public entities, controllers whose main activity is processing, sensitive-data processors and some individuals; no fees seen.
South Africa POPIA	1	No general controller registration. Information Officers must be registered; prior authorization needed for listed processing such as credit reporting.
South Korea PIPA	1	Public institutions must register personal information files with the PIPC; no registration for private controllers.
Switzerland nFADP	1	No registration for private controllers; federal bodies must report their processing activities to the FDPIC.
Vietnam PDPL	1	No controller registration; impact assessment dossiers are filed with the Ministry of Public Security instead.
Australia Privacy Act	0	No registration of organizations.
Chile Law 19,628	0	No registration for private controllers; the Civil Registry keeps a registry of public bodies' databases.
China PIPL	0	No general controller registration; foreign handlers report their China representative to regulators.
European Union GDPR	0	No general registration; controllers communicate DPO contact details to the supervisory authority.
Hong Kong PDPO	0	Data user return scheme exists but has not been activated for any class of data user.
India DPDP Act	0	No general controller registration. Only Consent Managers must register with the Data Protection Board.
Mexico LFPDPPP	0	No registration or notification of databases with the regulator.
New Zealand Privacy Act	0	No registration.
Singapore PDPA	0	No controller registration.
Thailand PDPA	0	No registration of controllers.
UAE (federal) PDPL	0	No controller registration or licensing.
Brazil LGPD	–	Not addressed
Canada PIPEDA	–	Not addressed

In Law 25

• Section 3.3Privacy impact assessment for information system projects

  Privacy impact assessment required for any information system project involving personal information and before communicating data outside Quebec.

• Section 3.8Register of confidentiality incidents

  No processing inventory; enterprises must keep a register of confidentiality incidents.

• Section 17Assessment before communicating information outside Québec

  Privacy impact assessment required for any information system project involving personal information and before communicating data outside Quebec.

• Section 65Service of notice and record

Records across 39 laws

Quebec Law 25	1	No processing inventory; enterprises must keep a register of confidentiality incidents.
Turkey KVKK	3	Controllers must keep a personal data processing inventory and file its contents in the public VERBIS registry, plus keep a retention and destruction policy.
Zimbabwe CDPA	3	Controllers must notify the Authority of all processing activities, including purposes and retention, and keep a breach register.
Brazil LGPD	2	Controllers and processors must keep records of processing operations, especially those based on legitimate interest.
China PIPL	2	Keep processing records and assessment reports for at least three years; regular compliance audits required.
DIFC DIFC DPL	2	Controllers must keep a written record of processing activities, which may be electronic.
Ecuador LOPDP	2	Records of processing required; controllers with fewer than 100 workers exempt if processing is occasional, low risk and excludes special categories.
Egypt PDPL	2	Controllers must keep a dedicated record of processing, and processors a record of processing activities.
European Union GDPR	2	Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
Ghana DPA	2	No standalone record of processing duty; registration files the data held, purposes, recipients and transfer countries. DPC guidance recommends a RoPA.
Indonesia PDP Law	2	Controllers must record all processing activities.
Israel PPL	2	Every database needs a database definition document (purposes, data types, transfers, processors) and written security procedures.
Kenya DPA	2	No standalone record of processing duty; registration requires describing data, purposes, recipients and transfers, and breaches must be recorded.
Nigeria NDPA	2	GAID defines a Record of Processing Activities; DPO reports feed into it and it is checked in the annual compliance audit.
Peru Law 29733	2	A dated security document must include an inventory of personal data and processing systems, kept for Authority review.
Philippines DPA	2	Maintain records describing processing systems, purposes, data categories, flows, retention, security measures and accountable persons.
Saudi Arabia PDPL	2	Keep a written record of processing during processing and five years after it ends; provide to SDAIA on request.
South Africa POPIA	2	Responsible parties must maintain documentation of all processing operations, as required by PAIA manuals.
Switzerland nFADP	2	Controllers and processors must keep records; firms under 250 employees are exempt unless they process sensitive data at scale or do high-risk profiling.
Thailand PDPA	2	Controllers must keep written or electronic records of processing; small organizations exempt per PDPC notification.
UAE (federal) PDPL	2	Keep a special record of processing including controller and DPO details; provide to the Data Office on request.
United Kingdom UK GDPR	2	Records of processing required; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
Vietnam PDPL	2	Controllers must keep evidence of consent and document processing in the filed impact assessment dossier.
Argentina Law 25,326	1	No separate records duty; the database registration filing describes each database.
Australia Privacy Act	1	Only a privacy policy and some use/disclosure notes (e.g. enforcement-related disclosures); no general ROPA.
California CCPA	1	No general record of processing; businesses keep records of consumer requests for at least 24 months.
Canada PIPEDA	1	No processing inventory; organizations must keep records of every breach of security safeguards.
Colombia Law 1581	1	No general records duty; RNBD filings and documented processing, retention and deletion procedures act as a limited inventory.
Hong Kong PDPO	1	Log book required only for refused access or correction requests, kept 4 years.
India DPDP Act	1	No general record of processing; fiduciaries must keep processing logs and related data for at least one year.
Japan APPI	1	Records required only for providing personal data to, or receiving it from, third parties.
Malaysia PDPA	1	Keep a record of applications, notices, requests and other information relating to personal data, in the Commissioner's prescribed form.
Mexico LFPDPPP	1	Regulation requires an inventory of personal data and processing systems as a security measure; not filed with the regulator.
South Korea PIPA	1	Public institution file registration and privacy policy disclosures; no general ROPA for private controllers.
Uganda DPPA	1	No general record of processing duty; the PDPO register records each entity's processing purpose, and registered entities file annual compliance reports.
Uruguay Law 18,331	1	Accountability measures must be documented and available to the URCDP; database registration describes processing.
Chile Law 19,628	0	No records-of-processing requirement in the current text.
New Zealand Privacy Act	0	No records-of-processing duty.
Singapore PDPA	0	No record of processing requirement; organizations must document policies and practices.

In Law 25

• Section 3.5Response to confidentiality incidents
• Section 3.6Definition of confidentiality incident
• Section 3.8Register of confidentiality incidents
• Section 8.2Publication of confidentiality policy
• Section 8.4No information requests after a credit security freeze
• Section 9.1Highest level of confidentiality by default
• Section 10Security measures
• Section 23Destruction or anonymization when purposes achieved
• Section 24(repealed)
• Section 25(repealed)
• Section 26(repealed)
• Section 81.4Orders after confidentiality incidents

We don't score this topic in the comparison. The sections on the left are the place to start.

In Law 25

• Section 3.5Response to confidentiality incidents

  Promptly notify the Commission d'accès à l'information of incidents presenting a risk of serious injury.

• Section 3.6Definition of confidentiality incident
• Section 3.7Assessing risk of serious injury from an incident
• Section 3.8Register of confidentiality incidents
• Section 81.4Orders after confidentiality incidents

Tell the regulator across 39 laws

Quebec Law 25	1	Promptly notify the Commission d'accès à l'information of incidents presenting a risk of serious injury.
China PIPL	3	Immediately take remedial measures and notify the regulator of a leak, alteration or loss.
India DPDP Act	3	Intimate the Board without delay, then a detailed report within 72 hours of becoming aware.
Israel PPL	3	Report a severe security incident to the PPA immediately on discovery, through its online form.
Uganda DPPA	3	Notify the PDPO immediately on believing data was accessed or acquired by an unauthorized person.
Zimbabwe CDPA	3	Notify POTRAZ within 24 hours of becoming aware, on Form DP3; investigation report within 21 days.
Brazil LGPD	2	Notify ANPD within 3 business days of learning an incident affected personal data and may cause relevant risk or harm.
California CCPA	2	Notify the Attorney General within 15 days of notifying consumers when a breach affects more than 500 California residents.
Colombia Law 1581	2	Report security incidents to SIC through the RNBD within 15 business days of detection.
Ecuador LOPDP	2	Notify the Superintendency within 5 days of becoming aware, unless the breach is unlikely to create risk; processors tell controllers within 2 days.
Egypt PDPL	2	Notify the Center within 72 hours of becoming aware; national-security breaches immediately.
European Union GDPR	2	Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
Indonesia PDP Law	2	Written notice to the agency within 72 hours (3x24 hours) after a failure is established.
Japan APPI	2	Report reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 persons) promptly (3-5 days guidance), final report within 30 days, 60 if malicious.
Kenya DPA	2	Notify the Data Commissioner within 72 hours of becoming aware where there is a real risk of harm; processors tell controllers within 48 hours.
Malaysia PDPA	2	Notify the Commissioner as soon as practicable and within 72 hours of the breach.
Nigeria NDPA	2	Notify the Commission within 72 hours of becoming aware of a breach likely to risk individuals' rights.
Peru Law 29733	2	Notify the Authority within 48 hours of qualifying incidents (large-scale, sensitive data or many affected); digital incidents also to the National Digital Security Center.
Philippines DPA	2	Notify the NPC within 72 hours of knowledge of a breach involving sensitive or fraud-enabling data with real risk of serious harm.
Saudi Arabia PDPL	2	Notify SDAIA within 72 hours of becoming aware of a breach that may harm data subjects.
Singapore PDPA	2	After assessing a breach as notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days.
South Korea PIPA	2	Report to PIPC within 72 hours where 1,000+ persons, sensitive or unique identifiers, or external hacking are involved.
Thailand PDPA	2	Notify the PDPC Office within 72 hours of becoming aware, where feasible, unless no risk to rights.
Turkey KVKK	2	Notify the Board as soon as possible, interpreted by the Board as within 72 hours of discovery, with no risk threshold.
United Kingdom UK GDPR	2	Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
Uruguay Law 18,331	2	Notify the URCDP within 72 hours of becoming aware of a breach, then file a detailed report once resolved.
Vietnam PDPL	2	Notify the specialized agency (A05) within 72 hours of detecting a breach likely to cause serious harm.
Australia Privacy Act	1	Assess suspected breaches within 30 days; notify OAIC as soon as practicable for eligible data breaches.
Canada PIPEDA	1	Report to the Commissioner as soon as feasible if a breach creates a real risk of significant harm.
DIFC DIFC DPL	1	Notify the Commissioner as soon as practicable in the circumstances; no fixed hours.
Ghana DPA	1	Notify the Commission as soon as reasonably practicable after discovery; no fixed hour limit.
New Zealand Privacy Act	1	Notify the Commissioner as soon as practicable after becoming aware of a notifiable breach (OPC guide: within 72 hours).
South Africa POPIA	1	Notify the Regulator as soon as reasonably possible after discovering a security compromise; no fixed hour limit. Filed through the eServices portal since April 2025.
Switzerland nFADP	1	Notify the FDPIC as soon as possible of a breach likely to pose a high risk; no fixed hour deadline.
UAE (federal) PDPL	1	Notify the Data Office on becoming aware of a breach prejudicing privacy, within a period the Executive Regulations will set.
Argentina Law 25,326	0	No statutory breach notification duty.
Chile Law 19,628	0	No breach notification duty in the current text.
Hong Kong PDPO	0	No mandatory notification; voluntary notice to PCPD encouraged.
Mexico LFPDPPP	0	No duty to notify the regulator.

In Law 25

• Section 17Assessment before communicating information outside Québec

  Before communicating data outside Quebec, conduct a PIA confirming adequate protection and sign a written agreement.

Transfers abroad across 39 laws

Quebec Law 25	2	Before communicating data outside Quebec, conduct a PIA confirming adequate protection and sign a written agreement.
China PIPL	3	Transfers need CAC security assessment, certification or the CAC standard contract, plus notice and separate consent.
Egypt PDPL	3	Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.
Vietnam PDPL	3	Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.
Argentina Law 25,326	2	Transfers prohibited to countries or bodies without adequate protection, except listed cases such as treaties, judicial cooperation and other statutory exceptions.
Brazil LGPD	2	Transfers allowed via adequacy, ANPD standard clauses (mandatory since Aug 2025), ANPD-approved specific clauses or BCRs, or specific consent.
Colombia Law 1581	2	Transfers to countries without adequate protection are prohibited unless an exception applies (explicit consent, contract, treaty) or SIC issues a declaration of conformity.
DIFC DIFC DPL	2	Transfer if destination has adequate protection or with appropriate safeguards, or listed derogations.
Ecuador LOPDP	2	Transfers allowed to countries declared adequate by the regulator, or with binding guarantees or binding corporate rules; listed exceptions include explicit consent.
European Union GDPR	2	Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
Indonesia PDP Law	2	Destination must offer equal or higher protection, else adequate binding safeguards, else consent; BCRs need DPA approval under GR 33.
Israel PPL	2	Allowed only if the destination's protection is no lower than Israel's, or under listed exceptions such as consent, EU-adequate or Convention 108 countries, group or contractual safeguards; no PPA approval.
Japan APPI	2	Transfer abroad needs prior consent after information on the destination regime, an adequate country (EU/UK), or a recipient with equivalent systems.
Kenya DPA	2	Transfers need proof of appropriate safeguards to the Data Commissioner or a listed condition; sensitive data needs consent.
Malaysia PDPA	2	Transfer allowed if destination law is substantially similar or protection equivalent, or under listed exceptions (consent, contract, due diligence).
Mexico LFPDPPP	2	Domestic and international transfers need consent via the privacy notice, with listed exceptions; recipient assumes the controller's obligations, typically by contract.
New Zealand Privacy Act	2	Overseas disclosure allowed only with comparable safeguards, consent after warning, prescribed binding scheme or country, or contract.
Nigeria NDPA	2	Transfers need an adequate level of protection in the destination or a listed basis such as informed consent.
Peru Law 29733	2	Transfers allowed to adequate countries or with safeguards such as model clauses; every cross-border flow must be notified to the Authority.
Saudi Arabia PDPL	2	Transfers need a specified purpose, minimum data, and adequacy, BCRs, standard clauses, certification or listed derogations, with a risk assessment.
Singapore PDPA	2	Transfers only under prescribed requirements ensuring a comparable standard of protection (contracts, BCRs, certification, consent).
South Africa POPIA	2	Transfers abroad allowed only with adequate protection (law, binding corporate rules or agreement), consent, contract necessity, or data subject benefit.
South Korea PIPA	2	Transfer abroad needs separate consent, a statutory basis, contract necessity with disclosure, a certified recipient, or a PIPC-recognized country.
Switzerland nFADP	2	Allowed to Federal Council-listed adequate countries; otherwise FDPIC-recognized SCCs, FDPIC-approved BCRs, or notified clauses; limited derogations such as explicit consent.
Thailand PDPA	2	Destination must have adequate standards, or a listed exception applies (consent, contract, etc.); intra-group transfers need a PDPC-certified policy.
Turkey KVKK	2	Needs a Board adequacy decision; else Board-approved BCRs or undertakings, or a Board standard contract filed within five business days. Incidental transfers allowed on listed grounds.
UAE (federal) PDPL	2	Transfer to countries with adequate protection approved by the Data Office, or via contract, explicit consent and other listed grounds.
Uganda DPPA	2	Processing or storage abroad requires adequate protection at least equivalent to the Act, or data subject consent; onward transfer needs express consent.
United Kingdom UK GDPR	2	Transfers need UK adequacy regulations under a 'not materially lower' data protection test, or appropriate safeguards such as the IDTA or Addendum.
Uruguay Law 18,331	2	Transfers prohibited to countries without adequate protection, except listed cases (explicit consent, contract, vital interest); URCDP may authorize transfers with safeguards.
Zimbabwe CDPA	2	Transfers abroad need adequate protection in the recipient country or a listed derogation such as unambiguous consent.
Australia Privacy Act	1	Take reasonable steps so overseas recipients comply with APPs; discloser stays accountable. Whitelist power added in 2024.
Canada PIPEDA	1	Organization remains accountable and must use contracts or other means to ensure comparable protection by third-party processors.
Ghana DPA	1	No general transfer restriction; controllers must ensure foreign processors comply and list transfer countries at registration.
Philippines DPA	1	No adequacy regime; controller stays accountable for data sent abroad and must ensure comparable protection by contract or other means.
Chile Law 19,628	0	No international transfer restriction in the current text.
Hong Kong PDPO	0	No transfer restriction in force; s.33 never commenced. PCPD recommends model contract clauses.
India DPDP Act	0	Transfers allowed except to countries the government restricts by notification; conditions may be set by order.
California CCPA	–	Not addressed

In Law 25

• Section 23Destruction or anonymization when purposes achieved

  Destroy or anonymize information once its purposes are achieved, subject to legal retention periods.

• Section 24(repealed)
• Section 25(repealed)
• Section 26(repealed)
• Section 36Retention of information pending recourse
• Section 79.1Destruction of information after seven years

Retention across 39 laws

Quebec Law 25	2	Destroy or anonymize information once its purposes are achieved, subject to legal retention periods.
India DPDP Act	3	Erase when purpose ends or consent is withdrawn; large e-commerce, gaming and social platforms must erase after three years of inactivity with 48 hours' notice.
Nigeria NDPA	3	Without a statutory period, storage must end within six months after the purpose is accomplished.
Australia Privacy Act	2	Destroy or de-identify personal information once no longer needed for any permitted purpose.
Brazil LGPD	2	Data must be deleted when processing ends, with listed exceptions such as legal obligations or research.
California CCPA	2	Disclose retention period per category and keep data no longer than reasonably necessary for the disclosed purpose.
China PIPL	2	Retain for the shortest period necessary; delete when purpose is achieved, consent withdrawn or retention period expires.
DIFC DIFC DPL	2	Keep data no longer than necessary; when the basis ends, delete, anonymize, pseudonymize, encrypt or put it beyond use.
Egypt PDPL	2	Data may not be kept longer than the purpose requires and must be erased when the purpose ends.
Ghana DPA	2	Data may not be kept longer than necessary and must then be destroyed, deleted or de-identified.
Hong Kong PDPO	2	Do not keep data longer than necessary and take practicable steps to erase it.
Indonesia PDP Law	2	Delete or destroy data at the end of the retention period or on request; notices must state the retention period.
Kenya DPA	2	Keep data only as long as reasonably necessary, maintain a retention schedule with periodic review, then erase or anonymize.
Malaysia PDPA	2	Do not keep data longer than necessary and take reasonable steps to destroy or permanently delete it.
Mexico LFPDPPP	2	Data must be blocked, then deleted, once purposes end; records of contractual defaults must be deleted after 72 months.
Peru Law 29733	2	Indefinite retention generally prohibited; processors keep data at most 2 years after the engagement ends; access logs kept at least 2 years.
Saudi Arabia PDPL	2	Destroy data when no longer needed for its purpose or processed unlawfully, subject to legal retention exceptions.
South Africa POPIA	2	Records may not be kept longer than necessary for the purpose and must be destroyed, deleted or de-identified afterward.
South Korea PIPA	2	Destroy personal information without delay once the retention period ends or the purpose is achieved.
Thailand PDPA	2	Controllers must examine and erase or anonymize data after the retention period or when no longer needed.
Turkey KVKK	2	Erase, destroy or anonymize data once processing grounds end; registered controllers need a retention policy and periodic destruction at least every six months.
Uganda DPPA	2	Data may not be kept longer than necessary; at expiry it must be destroyed, deleted or de-identified.
Uruguay Law 18,331	2	Delete data once no longer necessary; negative credit records limited to 5 years, renewable once.
Vietnam PDPL	2	Delete when purpose is complete, retention period ends, ordered by authorities, or on request.
Argentina Law 25,326	1	Data must be destroyed once no longer necessary or relevant to the purpose collected.
Canada PIPEDA	1	Keep information only as long as needed for its purposes; destroy, erase or anonymize when no longer required.
Chile Law 19,628	1	Data must be deleted or cancelled when storage lacks a legal basis or the data has expired.
Colombia Law 1581	1	Process data only as long as reasonable and necessary for the purpose, then delete unless law or contract requires retention.
Ecuador LOPDP	1	Data kept no longer than necessary; controllers must set deletion or periodic review deadlines; the regulator may set periods.
European Union GDPR	1	Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
Israel PPL	1	Delete data once its lawful purpose is exhausted and review holdings periodically, at least annually, for excess data; no statutory periods.
Japan APPI	1	Businesses must endeavor to delete personal data without delay once it is no longer needed.
New Zealand Privacy Act	1	Do not keep information longer than required for lawful purposes.
Philippines DPA	1	Retain only as long as necessary for the declared purpose, legal claims or legitimate business purposes, then dispose securely.
Singapore PDPA	1	Cease retention or anonymize once the purpose is no longer served and no legal or business need remains.
Switzerland nFADP	1	Destroy or anonymize personal data once it is no longer needed for its purpose; no statutory periods.
UAE (federal) PDPL	1	Personal data must not be kept after the purpose is exhausted, unless anonymized.
United Kingdom UK GDPR	1	Storage limitation: keep identifiable data no longer than necessary.
Zimbabwe CDPA	1	Data may be kept no longer than necessary for the purpose collected; no specific periods.

In Law 25

• Section 41.1Functions exercised by the Commission's adjudicative division
• Section 42Application to the Commission
• Section 51Duty to provide information to the Commission
• Section 73Registration by the Commission
• Section 92Penal proceedings by the Commission
• Section 93Liability of directors and officers
• Section 95Agreements by the Commission

We don't score this topic in the comparison. The sections on the left are the place to start.

In Law 25

• Section 39Refusal to protect investigations and proceedings
• Section 55Powers to order remedies
• Section 61Appeal to the Court of Québec
• Section 61.1Leave to appeal interlocutory decisions
• Section 63Filing of notice of appeal
• Section 80.2Authorization of inspectors
• Section 80.3Inspection powers
• Section 80.4Identification and immunity of inspectors
• Section 81Inquiries on complaint or own initiative
• Section 81.4Orders after confidentiality incidents
• Section 83Inquiry procedure and orders
• Section 84Public notice of failure to comply with an order
• Section 86Enforceability of orders
• Section 87Contestation of orders
• Section 90.1Grounds for monetary administrative penalties
• Section 93.1Punitive damages

  Courts must award punitive damages of at least CAD 1,000 for intentional or grossly negligent infringements; class actions available.

Private action across 39 laws

Quebec Law 25	3	Courts must award punitive damages of at least CAD 1,000 for intentional or grossly negligent infringements; class actions available.
Brazil LGPD	3	Controllers and processors must compensate material or moral damage; individual and collective actions allowed.
California CCPA	3	Private right of action for data breaches from failure to maintain reasonable security: USD 107-799 per consumer per incident, class actions allowed.
China PIPL	3	Tort claims with presumed fault of the handler; prosecutors and designated organizations may bring public interest suits.
European Union GDPR	3	Right to compensation for material or non-material damage; representative bodies may bring claims, including collective redress.
Israel PPL	3	Civil tort claims plus statutory damages without proof of harm: up to ILS 10,000 for listed database violations, more for privacy infringement. Class actions are available.
South Korea PIPA	3	Damages with reversed burden of proof, up to 5x for intentional or negligent leaks, statutory damages up to KRW 3 million, and group suits.
Thailand PDPA	3	Strict liability for damages, plus punitive damages up to twice actual damages; class actions available under civil procedure.
Argentina Law 25,326	2	Habeas data court action to access, rectify, suppress or keep data confidential; liability for damages also arises.
Australia Privacy Act	2	Statutory tort for serious invasions of privacy (from 10 Jun 2025); representative complaints to OAIC.
Chile Law 19,628	2	Controller must compensate material and moral damage from improper processing; amount set by the judge.
Colombia Law 1581	2	Data subjects complain to SIC after exhausting the controller process; damages are claimed under general civil liability.
DIFC DIFC DPL	2	Data subjects may sue directly in DIFC Courts for financial and non-financial harm, including distress.
Ecuador LOPDP	2	Data subjects may sue for damages (Constitution art. 92 habeas data) and must be guaranteed full reparation.
Egypt PDPL	2	Victims keep the right to claim compensation; entities are jointly liable for employees' violations.
Ghana DPA	2	Individuals who suffer damage or distress from a contravention are entitled to compensation, subject to a reasonable care defense.
Hong Kong PDPO	2	Individuals suffering damage, including injury to feelings, may claim compensation; PCPD may give legal assistance.
Indonesia PDP Law	2	Data subjects may sue for compensation for violations of processing.
Japan APPI	2	Individuals may sue to compel disclosure, correction or cessation, and claim tort damages under the Civil Code.
Kenya DPA	2	Persons who suffer damage, including distress, are entitled to compensation from the controller or processor.
Mexico LFPDPPP	2	Administrative sanctions apply without prejudice to civil liability, so data subjects can claim damages in the civil courts.
New Zealand Privacy Act	2	After a Commissioner complaint, individuals may bring proceedings in the Human Rights Review Tribunal for damages.
Nigeria NDPA	2	Data subjects who suffer injury, loss or harm may sue for damages; the Commission can also order compensation.
Peru Law 29733	2	Anyone harmed may claim compensation; denied rights can be pursued before the Authority or by habeas data action.
Philippines DPA	2	Data subjects may be indemnified for damages from inaccurate or unlawful processing.
Saudi Arabia PDPL	2	Anyone harmed may seek proportionate compensation for material or moral damage before the competent court.
Singapore PDPA	2	Persons suffering loss or damage may sue for injunction, declaration, damages or other relief.
South Africa POPIA	2	Data subjects, or the Regulator on their behalf, may sue for patrimonial, non-patrimonial and aggravated damages, regardless of intent or negligence.
Switzerland nFADP	2	Data subjects can sue for injunctions, rectification or deletion, damages, moral damages and surrender of profits.
Turkey KVKK	2	Data subjects can claim compensation in civil courts for damage from unlawful processing; complaints to the Board come after a request to the controller.
Uganda DPPA	2	A data subject who suffers damage or distress may apply to court for compensation; complaints also go to the PDPO.
United Kingdom UK GDPR	2	Individuals can claim compensation for material or non-material damage; representative actions are limited in practice.
Uruguay Law 18,331	2	Habeas data court action with summary procedure to access, rectify, include or delete data.
Vietnam PDPL	2	Violators must compensate damage; controllers and processors liable for losses caused by their processing.
Canada PIPEDA	1	After a Commissioner complaint, individuals may apply to the Federal Court for damages, including for humiliation.
India DPDP Act	1	Civil courts barred; data principals complain to the Data Protection Board after exhausting grievance redressal. No compensation provision.
UAE (federal) PDPL	1	Data subjects may complain to the Data Office; no compensation or civil claim provision.
Zimbabwe CDPA	1	No statutory compensation right; data subjects complain to POTRAZ, with appeal to the Administrative Court.
Malaysia PDPA	0	No statutory right for data subjects to sue for compensation; complaints go to the Commissioner.

In Law 25

• Section 90.1Grounds for monetary administrative penalties
• Section 90.2General framework for penalties
• Section 90.10Limitation period for penalties
• Section 90.11No penalty where offence already charged
• Section 90.12Maximum penalty amounts

  Penal fines up to CAD 25 million or 4% of worldwide turnover; administrative penalties up to CAD 10 million or 2%.

• Section 91Offences and fines

  Penal fines up to CAD 25 million or 4% of worldwide turnover; administrative penalties up to CAD 10 million or 2%.

• Section 92.1Fines doubled for subsequent offences
• Section 93Liability of directors and officers

  Penal offenses with fines for enterprises and individuals (CAD 5,000-100,000); directors or officers who authorize offenses can be party to them.

Maximum fine across 39 laws

Quebec Law 25	3	Penal fines up to CAD 25 million or 4% of worldwide turnover; administrative penalties up to CAD 10 million or 2%.
Australia Privacy Act	3	Body corporate: greater of AUD 50 million, 3x the benefit, or 30% of adjusted turnover for serious interferences.
Brazil LGPD	3	Simple fine up to 2% of Brazil revenue for the prior year, capped at BRL 50 million per infraction; daily fines also possible.
China PIPL	3	Up to RMB 50 million or 5% of prior-year revenue; responsible individuals RMB 100,000 to 1 million.
Ecuador LOPDP	3	Serious infringements: 0.7% to 1% of prior-year business volume; public servants 10 to 20 basic salaries.
European Union GDPR	3	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.
India DPDP Act	3	Up to INR 250 crore (about USD 30m) per instance for security safeguard failures.
Indonesia PDP Law	3	Administrative fines up to 2% of annual revenue; criminal corporate fines up to 10x individual maximum.
Israel PPL	3	Tiered administrative fines, many per data subject (e.g., ILS 4-8 per person for sensitive databases), plus fixed amounts up to ILS 640,000 per violation; no overall cap stated.
Nigeria NDPA	3	Greater of N10 million or 2% of prior-year annual gross revenue for entities of major importance; N2 million or 2% for others.
Singapore PDPA	3	Up to 10% of annual Singapore turnover if over SGD 10 million, otherwise SGD 1 million.
South Korea PIPA	3	Penalty surcharge up to 3% of total revenue (excluding unrelated revenue); up to 10% for repeat, mass (10m+) or post-order breaches.
Uganda DPPA	3	Courts may fine a corporation up to 2% of annual gross turnover; individual offenses up to 245 currency points (UGX 4.9 million).
United Kingdom UK GDPR	3	Up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher; PECR fines now aligned to the same level.
Vietnam PDPL	3	Up to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data trading, VND 3 billion for other violations.
California CCPA	2	Up to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving minors, with no aggregate cap.
Colombia Law 1581	2	Up to 2,000 monthly minimum wages (roughly USD 0.7m), plus suspension or closure of operations.
DIFC DIFC DPL	2	Administrative fines up to USD 100,000 per standard contravention under Schedule 2.
Egypt PDPL	2	Fines up to EGP 5 million (about USD 100,000) per offense, doubled for repeat offenses.
Hong Kong PDPO	2	Criminal fines up to HKD 1,000,000 (about USD 128k) for doxxing causing harm or selling data for marketing.
Japan APPI	2	Criminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database provision. Amendment adds revenue-linked administrative surcharges.
Malaysia PDPA	2	Up to RM1,000,000 (about USD 235k) and/or 3 years' imprisonment for breaching the data protection principles.
Mexico LFPDPPP	2	Up to 320,000 UMA (about MXN 36 million, roughly USD 2m), doubled for sensitive data, plus an additional fine of up to 320,000 UMA for repeat violations.
Peru Law 29733	2	Up to 100 UIT (about PEN 535,000, roughly USD 145,000), not exceeding 10% of prior-year gross income.
Saudi Arabia PDPL	2	Fines up to SAR 5 million (about USD 1.3m) per violation, doubled for repeat violations.
South Africa POPIA	2	Administrative fine up to R10 million (about USD 550,000).
Switzerland nFADP	2	Criminal fine up to CHF 250,000 per individual; a company can be fined up to CHF 50,000 when identifying the individual is disproportionate.
Thailand PDPA	2	Administrative fines up to THB 5 million per violation (about USD 150k).
Turkey KVKK	2	Administrative fines up to TRY 17,092,242 per violation in 2026, revalued each year.
Argentina Law 25,326	1	ARS 1,000 to 100,000 per infringement; total for the same conduct capped at ARS 50 million (about USD 35,000-40,000).
Canada PIPEDA	1	Fines up to CAD 100,000 on indictment (CAD 10,000 summary) for knowing breach-reporting and listed violations; no administrative fines.
Chile Law 19,628	1	Court-imposed fines of 1 to 10 UTM, or 10 to 50 UTM for economic, financial and commercial data (about USD 3,500 at most).
Ghana DPA	1	General penalty up to 5,000 penalty units (about GHS 60,000) and/or 10 years' imprisonment.
Kenya DPA	1	Up to KES 5 million or 1% of prior-year annual turnover, whichever is lower (about USD 39,000 maximum).
New Zealand Privacy Act	1	Criminal fines up to NZD 10,000 (e.g. failing to notify a breach).
Philippines DPA	1	Criminal fines up to PHP 5 million; administrative fines up to 3% of annual gross income, capped at PHP 5 million (about USD 86k) per act.
Uruguay Law 18,331	1	Up to 500,000 indexed units (UI) (roughly USD 80,000), plus warning or suspension of the database.
Zimbabwe CDPA	1	Fines up to level 11 (reported at about USD 1,000) and/or up to 7 years' imprisonment.
UAE (federal) PDPL	0	No fines in force; Cabinet decision defining violations and penalties not issued.