The laws, and what they mean in practice

GDPR

European Union

The global reference point for privacy law: lawful bases, principles, rights, accountability, breach notice within 72 hours, transfer rules and fines up to 4 percent of worldwide turnover.

UK GDPR

United Kingdom

The UK's version of the GDPR after Brexit, now diverging in places through the Data (Use and Access) Act 2025.

FTC Act Section 5

US federal

The main federal privacy enforcement tool: unfair or deceptive practices, including privacy promises not kept and unreasonable security.

CCPA/CPRA

California

The most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.

VCDPA

Virginia

The template for most later state laws: consumer rights, opt-outs from targeted advertising, sale and profiling, opt-in consent for sensitive data, and data protection assessments.

CPA

Colorado

Virginia-style law with detailed Attorney General rules, including requirements to honor universal opt-out signals.

CTDPA

Connecticut

Virginia-style law, amended to broaden coverage and strengthen rules on sensitive data and minors.

UCPA

Utah

One of the more business-friendly state laws, with narrower rights and higher thresholds.

TDPSA

Texas

No revenue or volume threshold: it reaches almost every business that is not a small business, which makes it one of the broadest state laws in practice.

OCPA

Oregon

Virginia-style law that also gives consumers the right to learn the specific third parties their data was disclosed to.

MCDPA

Montana

Virginia-style law with relatively low thresholds, reflecting the state's population.

FDBR

Florida

Narrow in who it covers, but strict for the largest technology companies it targets.

ICDPA

Iowa

A narrower Virginia-style law with fewer consumer rights.

DPDPA

Delaware

Virginia-style law with low thresholds and coverage of many nonprofits.

NHDPA

New Hampshire

Virginia-style law with thresholds scaled to a small state.

NJDPA

New Jersey

Virginia-style law with broad sensitive-data definitions and rulemaking by the Division of Consumer Affairs.

NDPA

Nebraska

Texas-style law without a volume threshold, applying to most businesses that are not small businesses.

TIPA

Tennessee

High thresholds, and an affirmative defense for businesses that follow the NIST Privacy Framework.

MCDPA

Minnesota

Adds rights other states lack, including the right to question the result of a profiling decision and to see the list of third parties that received data.

MODPA

Maryland

The strictest state law on data minimization: collection must be reasonably necessary for the service, and selling sensitive data is prohibited.

ICDPA

Indiana

Virginia-style law, in force from 2026.

KCDPA

Kentucky

Virginia-style law, in force from 2026.

RIDTPPA

Rhode Island

Virginia-style law with unusual website disclosure duties and no cure period.

LPDP

Argentina

An early EU-adequate law built on written consent, database registration and a court habeas data action, with very short response deadlines. It has no breach notification, DPO or DPIA duties, and fines remain small.

Privacy Act (AU)

Australia

Australia's privacy law, built on the thirteen Australian Privacy Principles, now in a period of reform.

LGPD

Brazil

Brazil's GDPR-inspired law, with ten legal bases and a national authority.

PIPEDA

Canada

Canada's federal private-sector privacy law, built on ten fair information principles.

Law 25

Quebec, Canada

The strictest privacy law in Canada, with privacy impact assessments for transfers and GDPR-level fines.

LPVP

Chile

Until December 2026 Chile runs a light 1999 regime enforced only by courts, with written consent, a two-day response deadline and tiny fines. Law 21,719 then brings a GDPR-style regime with a new agency, breach duties and fines up to 20,000 UTM.

PIPL

China

China's comprehensive privacy law, with strict rules on consent and cross-border transfers.

Law 1581

Colombia

Every use of personal data needs prior, express, informed authorization that the controller can prove, and every controller must name a data protection person or area. The SIC actively enforces, larger firms register databases in the RNBD, and breaches go to the SIC within 15 business days.

LOPDP

Ecuador

The closest GDPR copy in the region, with legitimate interest, portability, DPIAs and DPOs, plus turnover-based fines up to 1%. It is stricter on timing: 5 days to notify the regulator and 3 days to notify individuals.

PDPL (Egypt)

Egypt

Egypt's data protection law. Controllers and processors need a license from the Personal Data Protection Center, and data protection officers register with it.

DPA (Ghana)

Ghana

Ghana's data protection law. Controllers register with the Data Protection Commission and renew every two years.

PDPO

Hong Kong SAR

Asia's oldest comprehensive privacy law, built on six data protection principles with no breach notification duty and no transfer restriction in force. Its sharpest teeth are criminal offenses for direct marketing without consent and doxxing.

DPDP Act

India

India's comprehensive privacy law, consent-centered, with duties for significant data fiduciaries.

PDP Law

Indonesia

GDPR-like structure but with very short 72-hour deadlines for both data subject requests and breach notices. Consent must be written or recorded, and criminal penalties up to 6 years sit alongside fines of 2% of revenue.

PPL

Israel

The PPL is a consent-based, database-centric law with very prescriptive security rules, including immediate reporting of severe incidents. Amendment 13 added GDPR-style definitions, DPO duties, per-data-subject administrative fines, and statutory damages, and cut database registration back to data brokers and public bodies.

APPI

Japan

Japan's privacy law, recognized by the EU as adequate.

DPA (Kenya)

Kenya

Kenya's data protection law. Controllers and processors register with the Data Commissioner. Appointing a data protection officer is optional under the Act.

PDPA (Malaysia)

Malaysia

Malaysia's data protection law, amended in 2024. Data protection officer appointment and breach notice to the Commissioner within 72 hours apply from 1 June 2025.

LFPDPPP

Mexico

Consent is the default basis, tacit consent through a privacy notice is enough for most data, and every controller must name a data protection person or department. The 2025 rewrite moved enforcement from the independent INAI to a federal ministry and dropped the old law's regulator-facing duties while keeping prison terms for data offenses.

Privacy Act

New Zealand

A principles-based law with 14 IPPs, mandatory privacy officers for every agency and serious-harm breach notification. Fines are small; remedies run through the Commissioner and the Human Rights Review Tribunal.

NDPA (Nigeria)

Nigeria

Nigeria's data protection law. Controllers and processors of major importance register with the NDPC and appoint a data protection officer, who must keep up yearly professional development.

LPDP

Peru

The 2024 Regulation brought Peru close to GDPR: extraterritorial reach with a local representative, 48-hour breach notice to the regulator and individuals, portability and a phased DPO duty. It keeps Peru's distinctive database registration and notification of every cross-border flow.

DPA (Philippines)

Philippines

The Philippines' data privacy law. Organizations designate a data protection officer, and those that meet the thresholds register with the National Privacy Commission.

PDPL (Saudi Arabia)

Saudi Arabia

Saudi Arabia's data protection law, enforced by SDAIA. Rules set when a data protection officer is required, and registration and breach notices run through the National Data Governance Platform.

PDPA (SG)

Singapore

Consent-based privacy law with mandatory breach notification since 2021.

POPIA

South Africa

South Africa's comprehensive privacy law, based on eight conditions for lawful processing.

PIPA

South Korea

Korea combines GDPR-style rights with unusually granular, item-by-item consent rules and a mandatory chief privacy officer for every controller. Enforcement is heavy: revenue-based surcharges now up to 10%, statutory damages and criminal penalties.

nFADP

Switzerland

Switzerland's revised law, closely aligned with the GDPR, with fines aimed at responsible individuals.

DIFC DPL

United Arab Emirates

The data protection law of the Dubai International Financial Centre, a financial free zone with its own laws and courts. It follows the GDPR closely and has its own Commissioner of Data Protection.

PDPA

Thailand

Closely modeled on GDPR, but consent must generally be in writing or electronic form and minors under 20 need guardian involvement. Civil liability is strict and courts can add punitive damages up to twice actual loss.

KVKK

Turkey

KVKK is GDPR-inspired but keeps a public controller registry (VERBIS) with filed data inventories, and requires breach notice to individuals in every case. Since 2024, transfers abroad work on adequacy, Board-approved safeguards or Board-issued standard contracts that must be filed within five business days.

DPPA (Uganda)

Uganda

Uganda's data protection law. The head of every institution it covers must designate a data protection officer, and anyone collecting or processing personal data registers with the Personal Data Protection Office.

PDPL (UAE)

United Arab Emirates

The UAE's federal data protection law. It has been in force since January 2022, but its Executive Regulations have not been issued, so there is no set breach deadline or penalty schedule yet.

LPDP

Uruguay

EU-adequate law that pairs documented consent and universal database registration with GDPR-style add-ons: 72-hour breach notice, mandatory DPIAs and DPOs for large or sensitive processing. Fines are low but response deadlines are five business days.

PDPL

Vietnam

Vietnam's first statute on personal data replaces Decree 13 with a consent-first regime in which impact assessments and transfer assessments must be filed with the Ministry of Public Security. Fines reach 5% of revenue for transfer violations and 10x revenue for illegal data trading.

CDPA (Zimbabwe)

Zimbabwe

Zimbabwe's data protection law, enforced by POTRAZ. Controllers need a license, and data protection officers must be appointed within 90 days and complete an approved certification course.