The laws, and what they mean in practice

LPDP

Argentina

An early EU-adequate law built on written consent, database registration and a court habeas data action, with very short response deadlines. It has no breach notification, DPO or DPIA duties, and fines remain small.

Privacy Act (AU)

Australia

Australia's privacy law, built on the thirteen Australian Privacy Principles, now in a period of reform.

LGPD

Brazil

Brazil's GDPR-inspired law, with ten legal bases and a national authority.

PIPEDA

Canada

Canada's federal private-sector privacy law, built on ten fair information principles.

Law 25

Quebec, Canada

The strictest privacy law in Canada, with privacy impact assessments for transfers and GDPR-level fines.

Bill C-36

Canada

The federal bill that would replace the private-sector part of PIPEDA. It keeps the penalty caps proposed in C-27 (up to CAD 10m or 3% of global revenue, and fines up to CAD 25m or 5%) but drops the AI act and the tribunal. PIPEDA stays in force until it passes.

LPVP

Chile

Until December 2026 Chile runs a light 1999 regime enforced only by courts, with written consent, a two-day response deadline and tiny fines. Law 21,719 then brings a GDPR-style regime with a new agency, breach duties and fines up to 20,000 UTM.

PIPL

China

China's comprehensive privacy law, with strict rules on consent and cross-border transfers.

Law 1581

Colombia

Every use of personal data needs prior, express, informed authorization that the controller can prove, and every controller must name a data protection person or area. The SIC actively enforces, larger firms register databases in the RNBD, and breaches go to the SIC within 15 business days.

LOPDP

Ecuador

The closest GDPR copy in the region, with legitimate interest, portability, DPIAs and DPOs, plus turnover-based fines up to 1%. It is stricter on timing: 5 days to notify the regulator and 3 days to notify individuals.

PDPL (Egypt)

Egypt

Egypt's data protection law. Controllers and processors need a license from the Personal Data Protection Center, and data protection officers register with it.

DPA (Ghana)

Ghana

Ghana's data protection law. Controllers register with the Data Protection Commission and renew every two years.

PDPO

Hong Kong SAR

Asia's oldest comprehensive privacy law, built on six data protection principles with no breach notification duty and no transfer restriction in force. Its sharpest teeth are criminal offenses for direct marketing without consent and doxxing.

DPDP Act

India

India's comprehensive privacy law, consent-centered, with duties for significant data fiduciaries.

PDP Law

Indonesia

GDPR-like structure but with very short 72-hour deadlines for both data subject requests and breach notices. Consent must be written or recorded, and criminal penalties up to 6 years sit alongside fines of 2% of revenue.

PPL

Israel

The PPL is a consent-based, database-centric law with very prescriptive security rules, including immediate reporting of severe incidents. Amendment 13 added GDPR-style definitions, DPO duties, per-data-subject administrative fines, and statutory damages, and cut database registration back to data brokers and public bodies.

APPI

Japan

Japan's privacy law, recognized by the EU as adequate.

DPA (Kenya)

Kenya

Kenya's data protection law. Controllers and processors register with the Data Commissioner. Appointing a data protection officer is optional under the Act.

PDPA (Malaysia)

Malaysia

Malaysia's data protection law, amended in 2024. Data protection officer appointment and breach notice to the Commissioner within 72 hours apply from 1 June 2025.

LFPDPPP

Mexico

Consent is the default basis, tacit consent through a privacy notice is enough for most data, and every controller must name a data protection person or department. The 2025 rewrite moved enforcement from the independent INAI to a federal ministry and dropped the old law's regulator-facing duties while keeping prison terms for data offenses.

Privacy Act

New Zealand

A principles-based law with 14 IPPs, mandatory privacy officers for every agency and serious-harm breach notification. Fines are small; remedies run through the Commissioner and the Human Rights Review Tribunal.

NDPA (Nigeria)

Nigeria

Nigeria's data protection law. Controllers and processors of major importance register with the NDPC and appoint a data protection officer, who must keep up yearly professional development.

LPDP

Peru

The 2024 Regulation brought Peru close to GDPR: extraterritorial reach with a local representative, 48-hour breach notice to the regulator and individuals, portability and a phased DPO duty. It keeps Peru's distinctive database registration and notification of every cross-border flow.

DPA (Philippines)

Philippines

The Philippines' data privacy law. Organizations designate a data protection officer, and those that meet the thresholds register with the National Privacy Commission.

PDPL (Saudi Arabia)

Saudi Arabia

Saudi Arabia's data protection law, enforced by SDAIA. Rules set when a data protection officer is required, and registration and breach notices run through the National Data Governance Platform.

PDPA (SG)

Singapore

Consent-based privacy law with mandatory breach notification since 2021.

POPIA

South Africa

South Africa's comprehensive privacy law, based on eight conditions for lawful processing.

PIPA

South Korea

Korea combines GDPR-style rights with unusually granular, item-by-item consent rules and a mandatory chief privacy officer for every controller. Enforcement is heavy: revenue-based surcharges now up to 10%, statutory damages and criminal penalties.

nFADP

Switzerland

Switzerland's revised law, closely aligned with the GDPR, with fines aimed at responsible individuals.

DIFC DPL

United Arab Emirates

The data protection law of the Dubai International Financial Centre, a financial free zone with its own laws and courts. It follows the GDPR closely and has its own Commissioner of Data Protection.

PDPA

Thailand

Closely modeled on GDPR, but consent must generally be in writing or electronic form and minors under 20 need guardian involvement. Civil liability is strict and courts can add punitive damages up to twice actual loss.

KVKK

Turkey

KVKK is GDPR-inspired but keeps a public controller registry (VERBIS) with filed data inventories, and requires breach notice to individuals in every case. Since 2024, transfers abroad work on adequacy, Board-approved safeguards or Board-issued standard contracts that must be filed within five business days.

DPPA (Uganda)

Uganda

Uganda's data protection law. The head of every institution it covers must designate a data protection officer, and anyone collecting or processing personal data registers with the Personal Data Protection Office.

PDPL (UAE)

United Arab Emirates

The UAE's federal data protection law. It has been in force since January 2022, but its Executive Regulations have not been issued, so there is no set breach deadline or penalty schedule yet.

LPDP

Uruguay

EU-adequate law that pairs documented consent and universal database registration with GDPR-style add-ons: 72-hour breach notice, mandatory DPIAs and DPOs for large or sensitive processing. Fines are low but response deadlines are five business days.

PDPL

Vietnam

Vietnam's first statute on personal data replaces Decree 13 with a consent-first regime in which impact assessments and transfer assessments must be filed with the Ministry of Public Security. Fines reach 5% of revenue for transfer violations and 10x revenue for illegal data trading.

CDPA (Zimbabwe)

Zimbabwe

Zimbabwe's data protection law, enforced by POTRAZ. Controllers need a license, and data protection officers must be appointed within 90 days and complete an approved certification course.