Privacy law worldwide, scored and compared.

laws score most demanding on tell the regulator.

India. Intimate the Board without delay, then a detailed report within 72 hours of becoming aware.

China. Immediately take remedial measures and notify the regulator of a leak, alteration or loss.

Israel. Report a severe security incident to the PPA immediately on discovery, through its online form.

Uganda. Notify the PDPO immediately on believing data was accessed or acquired by an unauthorized person.

Scale: value with the deadline. Level 0 no duty, 1 "as soon as reasonably possible" with no fixed time, 2 fixed deadline over 24 hours (e.g. 72 hours), 3 within 24 hours or "immediately".

laws score most demanding on dpo required.

Canada. Every organization must designate an individual accountable for compliance.

Quebec. The person with highest authority in every enterprise is by default the person in charge of personal information protection; may delegate in writing.

Mexico. Every controller must designate a person or data protection department to handle ARCO requests and promote data protection internally.

Colombia. Every controller and processor must designate a person or area to assume the data protection function and handle requests.

Scale: 0 not required, 1 required in limited cases (large-scale, public bodies), 2 required for most or registered controllers, 3 required for every institution or controller.

laws score most demanding on registration.

Uganda. All collectors, processors and controllers must register with the PDPO, renew annually and pay fees (UGX 100,000 reported).

Kenya. Controllers and processors must register, pay tiered fees (KES 4,000-40,000) and renew every 24 months; small entities exempt unless in listed sectors.

Zimbabwe. Controllers processing data of 50 or more people need a POTRAZ licence, tiered USD 50-2,500, renewed every 12 months.

Ghana. Every data controller must register with the Commission, pay a fee and renew every two years; processing unregistered is an offense.

Scale: 0 none, 1 notification in limited cases, 2 registration of most controllers, 3 licensing with fees and renewal.

laws score most demanding on transfers abroad.

China. Transfers need CAC security assessment, certification or the CAC standard contract, plus notice and separate consent.

Vietnam. Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.

Egypt. Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.

Scale: 0 free, 1 accountability/adequate protection, 2 adequacy or listed safeguards (SCCs, BCRs, consent), 3 regulator approval or authorization needed.

laws score most demanding on localization.

Scale: 0 none, 1 sectoral, 2 copy must stay or certain data must stay, 3 broad localization.

laws score most demanding on criminal liability.

Malaysia. Most breaches are criminal offences with imprisonment; directors and officers are jointly liable unless they prove due diligence.

Philippines. Broad offenses with 1 to 6 years' imprisonment; responsible officers of corporations who participated or were grossly negligent are punished.

China. Violations constituting crimes are prosecuted under criminal law, including imprisonment for infringing personal information.

Zimbabwe. Most breaches of the Act and SI 155 are offenses, carrying up to 7 years' imprisonment; failing to appoint a DPO up to 2 years.

Scale: 0 none, 1 limited offenses, 2 imprisonment for listed offenses, 3 broad criminal offenses for officers.

laws score most demanding on request deadline.

Brazil. Full access response within 15 days of the request; simplified confirmation immediately.

Argentina. Access within 10 calendar days; rectification, updating or suppression within 5 business days.

Chile. Controller must respond within 2 business days, otherwise the holder may go to the civil court.

Colombia. Queries within 10 business days (plus 5); claims for correction or deletion within 15 business days (plus 8).

Scale: value in days. Level 0 none set, 1 over 30 days, 2 21 to 30 days or one month, 3 under 21 days.

laws score most demanding on children.

Brazil. Under 12 needs specific parental consent; all minors under 18 must be processed in their best interest.

Colombia. Processing data of all minors under 18 is prohibited except public data, or with legal representative authorization respecting the child's best interests.

India. Child means under 18; verifiable parental consent required; no tracking, behavioral monitoring or targeted advertising directed at children.

Malaysia. For data subjects under 18, a parent, guardian or person with parental responsibility acts and consents.

Scale: record the age threshold in value. Level 0 no rule, 1 age 13 or lower, 2 age 14 to 16, 3 age 17 or 18 or a stricter regime.

laws score most demanding on maximum fine.

European Union. Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.

United Kingdom. Up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher; PECR fines now aligned to the same level.

Quebec. Penal fines up to CAD 25 million or 4% of worldwide turnover; administrative penalties up to CAD 10 million or 2%.

Brazil. Simple fine up to 2% of Brazil revenue for the prior year, capped at BRL 50 million per infraction; daily fines also possible.

Scale: value as stated (currency and/or % of turnover). Level 0 none, 1 under USD 100k, 2 USD 100k to 5m, 3 over USD 5m or % of global turnover.

laws score most demanding on consent.

Argentina. Consent must be free, express and informed, given in writing or by an equivalent means.

Chile. Consent must be express, informed about purpose and possible disclosure, and recorded in writing; revocation also in writing.

Colombia. Authorization may be written, oral or by unequivocal conduct, never silence; controllers must keep proof of it.

Uruguay. Consent must be free, prior, express and informed, and must be documented.

Scale: 0 implied/opt-out acceptable, 1 express for some uses, 2 express, specific, informed, 3 express plus written/recorded or regulator-prescribed form.