DPM Radar: Privacy

Australia

Privacy Act 1988

Applies to agencies as defined in the Act and to organisations (an individual, body corporate, partnership, unincorporated association or trust) that are not small business operators, registered political parties or State or Territory authorities, and extends to acts outside Australia by an agency or by an organisation with an Australian link.

131 sections

Brazil

LGPD

Unofficial English translation

Applies to any processing of personal data by a natural person or a public or private legal entity, regardless of the means or the country of its headquarters or of the data, provided that the processing takes place in Brazil, the processing is aimed at offering or supplying goods or services, or at processing data of individuals located in Brazil, or the data was collected in Brazil, subject to the exceptions in the Act.

73 sections

California, USA

CCPA / CPRA

Applies to for-profit businesses doing business in California that collect consumers' personal information and meet one of the statutory thresholds: annual gross revenues above the adjusted USD 25 million, buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenues from selling or sharing it.

46 sections

Canada

PIPEDA

Part 1 applies to every organization in respect of personal information that it collects, uses or discloses in the course of commercial activities, and in respect of personal information about its employees or job applicants in connection with the operation of a federal work, undertaking or business, subject to the exceptions in the Act.

55 sections

China

PIPL

Unofficial English translation

Applies to the processing of personal information of natural persons within China, and, in the circumstances set out in the Law, to processing outside China of the personal information of natural persons in China.

74 sections

European Union

GDPR

Applies to the processing of personal data wholly or partly by automated means, and to other processing of personal data in a filing system, in the context of an EU establishment of a controller or processor, and to controllers or processors outside the EU that offer goods or services to, or monitor the behaviour of, data subjects in the Union.

99 sections

India

DPDP Act 2023

Applies to the processing of digital personal data within India, and to such processing outside India if it is in connection with offering goods or services to data principals within India, subject to the exceptions in the Act.

45 sections

Israel

Privacy Protection Law

Unofficial consolidated text, up to Amendment 13

Prohibits infringing a person's privacy without consent, and sets rules for processing personal information in databases, defined as collections of personal information processed by digital means, subject to the exceptions in the definition.

126 sections

Japan

APPI

Unofficial English translation

Places obligations on businesses handling personal information, meaning those using a personal information database or the equivalent for business, and also on administrative entities; it also applies to handling of personal information outside Japan in connection with supplying goods or services to a person in Japan.

187 sections

Nigeria

NDPA

Applies to the processing of personal data, by automated means or not, where the controller or processor is domiciled, resident or operating in Nigeria, where processing occurs in Nigeria, or where a controller or processor outside Nigeria processes personal data of a data subject in Nigeria, subject to the exceptions in the Act.

67 sections

Singapore

PDPA

Governs the collection, use and disclosure of personal data by organisations, which include any individual, company, association or body of persons, corporate or unincorporated. The obligations in Parts 3 to 6B do not apply to individuals acting in a personal or domestic capacity, employees acting in the course of employment, or public agencies.

97 sections

South Africa

POPIA

Applies to the processing of personal information entered in a record by or for a responsible party, by automated or non-automated means (non-automated processing only where the information forms part of a filing system or is intended to), where the responsible party is domiciled in South Africa, or is not domiciled there but uses means in South Africa, unless those means are used only to forward information through it, subject to the exceptions in the Act.

116 sections

South Korea

PIPA

Unofficial English translation

Applies to personal information controllers: public institutions, legal persons, organizations or individuals that process personal information directly or through others to operate personal information files for their work.

125 sections

Switzerland

nFADP

Unofficial English translation

Applies to the processing of personal data of natural persons by private persons and federal bodies, and to circumstances that have an effect in Switzerland even if they were initiated abroad.

77 sections

Thailand

PDPA

Unofficial English translation

Applies to the collection, use or disclosure of personal data by a data controller or processor in Thailand, whether or not the activity takes place in Thailand, and to controllers or processors outside Thailand that offer goods or services to, or monitor the behaviour of, data subjects in Thailand, subject to the exceptions in the Act.

97 sections

United Kingdom

UK GDPR & DPA 2018

Applies to the automated or structured processing of personal data in the context of a UK establishment of a controller or processor, and to controllers or processors outside the UK that offer goods or services to, or monitor the behaviour of, data subjects in the UK.

120 sections

USA

HIPAA

The rules in Part 164 held in the library apply to covered entities and, where provided, to business associates, with respect to protected health information.

36 sections

European Union

EU AI Act

Consolidated text, for documentation only

Applies to providers placing AI systems or general-purpose AI models on the EU market or putting AI systems into service in the EU, wherever they are established; to deployers established or located in the EU; to providers and deployers in third countries where the output is used in the EU; and to importers, distributors, product manufacturers placing an AI system on the market or putting it into service together with their product under their own name or trademark, authorised representatives and affected persons in the EU.

315 sections

European Union

Regulation (EU) 2026/1744 (Digital Omnibus on AI)

Amends Regulation (EU) 2024/1689 (the AI Act) and two other regulations to simplify the implementation of the harmonised rules on artificial intelligence.

98 sections

European Union

Implementing Decision (EU) 2026/2274

Publishes in the Official Journal the reference of harmonised standard EN 18286:2026 on quality management systems for providers of AI systems, drafted in support of the AI Act.

13 sections