DPM Radar

Australia

Privacy Act 1988

Australia's Privacy Act governs the handling of information or opinions about identified or reasonably identifiable individuals. It applies to agencies and to organisations, among them individuals, bodies corporate, partnerships and trusts, but not, among others, small business operators or registered political parties. It extends to acts outside Australia by agencies, and by organisations or small business operators with an Australian link. All subject to the exceptions in the Act.

131 sections

Source: Privacy Act 1988 (Cth) sections 2A, 5B, 6 and 6C

Brazil

LGPD

Unofficial English translation

Brazil's General Personal Data Protection Law applies to any processing of personal data by a natural person or a public or private legal entity, wherever its headquarters are, provided that the processing takes place in Brazil, is aimed at offering or supplying goods or services or at processing data of individuals located in Brazil, or the data were collected in Brazil. All subject to the exceptions in the Act.

73 sections

Source: LGPD Article 3

California, United States

CCPA / CPRA

The California Consumer Privacy Act places duties on businesses that collect consumers' personal information. To be a business it must, among other conditions, be for-profit, do business in California and meet at least one of three thresholds set in the Act. Under the conditions in the Act, other entities also count as businesses, among them linked entities and joint ventures. All subject to the exceptions in the Act.

46 sections

Source: Cal. Civ. Code §1798.140(d)

Canada

PIPEDA

This Canadian Act sets rules for the collection, use and disclosure of personal information by organizations in the course of commercial activities. Organizations include associations, partnerships, persons and trade unions. It also covers information about an organization's employees and job applicants in connection with the operation of a federal work, undertaking or business. All subject to the exceptions in the Act.

55 sections

Source: PIPEDA Part 1, sections 2 to 4

China

PIPL

Unofficial English translation

The Law applies to processing personal information of natural persons within China, and to processing outside China of personal information of such persons in China to provide them with products or services, to analyze or evaluate their behaviour, or in other circumstances provided by law or administrative regulation. Duties fall on personal information processors, which autonomously determine the purposes and means of processing; personal or household processing by a natural person is excluded.

74 sections

European Union

GDPR

The EU's data protection regulation protects people when personal data about them is processed. It applies to processing in the context of an EU establishment of a controller or processor, wherever it takes place, and to controllers and processors not established in the EU where the processing relates to offering goods or services to people in the EU or monitoring their behaviour there. All subject to the exceptions in the Regulation.

99 sections

Source: GDPR Articles 1 to 4

India

DPDP Act 2023

The Act applies to Data Fiduciaries, who alone or with others determine the purpose and means of processing personal data, and to processing digital personal data within India, collected digitally or digitised later. It also applies to such processing outside India in connection with offering goods or services to Data Principals within India. All subject to the exceptions in the Act.

45 sections

Israel

Privacy Protection Law

Unofficial consolidated text, up to Amendment 13

Israel's Protection of Privacy Law prohibits infringing another person's privacy without consent, and sets rules for processing personal information in databases, meaning collections of personal information processed by digital means, subject to the exceptions in the definition. Duties regarding a database fall, among others, on the controller of the database and on the holder, a party external to the controller that processes information for it.

126 sections

Source: sections 1 and 3 of the Law

Japan

APPI

Unofficial English translation

Japan's Act on the Protection of Personal Information sets rules for the proper handling of personal information. It places obligations on businesses using a personal information database or the equivalent for business, and on administrative entities, among them administrative and local government organs. It also covers handling outside Japan of personal information identifying a person in Japan, connected with supplying that person goods or services. All subject to the exceptions in the Act.

187 sections

Source: APPI Articles 2, 16 and 171

Nigeria

NDPA

Nigeria's Data Protection Act applies to the processing of personal data, by automated means or not, by a data controller or a data processor. It applies where the controller or processor is domiciled, resident or operating in Nigeria, where processing occurs in Nigeria, or where a controller or processor outside Nigeria processes personal data of a data subject in Nigeria. All subject to the exceptions in the Act.

67 sections

Source: NDPA sections 2 and 65

Singapore

PDPA

Singapore's Personal Data Protection Act governs the collection, use and disclosure of personal data by organisations, among them individuals and companies, whether or not formed or recognised under Singapore law or resident, or having an office or place of business, there. Some obligations, among them consent and breach notification, do not apply to individuals acting in a personal or domestic capacity, employees in the course of employment, or public agencies. All subject to the further exceptions in the Act.

97 sections

Source: PDPA sections 2 to 4; the exemption covers Parts 3, 4, 5, 6, 6A and 6B

South Africa

POPIA

South Africa's Protection of Personal Information Act regulates how personal information may be processed. It applies to processing personal information entered in a record by or for a responsible party, whoever determines the purpose of and means for processing, where that party is domiciled in South Africa or uses means there, unless those means are used only to forward information through South Africa. All subject to the exceptions in the Act.

116 sections

Source: POPIA sections 1 to 3

South Korea

PIPA

Unofficial English translation

South Korea's Personal Information Protection Act sets rules for processing and protecting personal information. It applies to personal information controllers: public institutions, legal persons, organizations, individuals and the like that process personal information to operate personal information files as part of their work. Personal information is information about a living individual that identifies them, alone or easily combined with other information, including once pseudonymized. All subject to the exceptions in the Act.

125 sections

Source: PIPA Articles 1 and 2

Switzerland

nFADP

Unofficial English translation

The Act applies to the processing of personal data of natural persons by private persons and by federal bodies, among them authorities and services of the Confederation. It applies to circumstances that have an effect in Switzerland, even if initiated abroad. All subject to the exceptions in the Act, among them processing by a natural person exclusively for personal use.

77 sections

Thailand

PDPA

Unofficial English translation

Thailand's Personal Data Protection Act applies to the collection, use or disclosure of personal data by a data controller or data processor in Thailand, whether or not the activity takes place in Thailand. It also applies to controllers or processors outside Thailand that offer goods or services to, or monitor the behaviour of, data subjects in Thailand. All subject to the exceptions in the Act.

97 sections

Source: PDPA sections 5 and 6

United Kingdom

UK GDPR & DPA 2018

The UK General Data Protection Regulation protects people when personal data about them is processed. It applies to processing in the context of a UK establishment of a controller or processor, wherever it takes place, and to controllers and processors not established in the UK where the processing relates to offering goods or services to people in the UK or monitoring their behaviour there. All subject to the exceptions in the Regulation.

120 sections

Source: UK GDPR Articles 1 to 4

United States

HIPAA

US federal rules that protect health information. They apply to covered entities, namely health plans, health care clearinghouses and health care providers who transmit any health information in electronic form in connection with a transaction covered by the rules, with respect to protected health information and, where the rules so provide, to business associates and their subcontractors. Covered entities and business associates must protect electronic protected health information and may use or disclose protected health information only as permitted or required. All subject to the exceptions in the rules.

36 sections

Source: 45 CFR Part 164, Subparts C, D and E, and the definitions in § 160.103 (CFR annual edition, 10–1–25 Edition)

European Union

EU AI Act

Consolidated text, for documentation only

The EU's AI Act sets harmonised rules for AI systems and general-purpose AI models. It applies, among others, to providers placing them on the EU market or putting AI systems into service in the EU, wherever established; to deployers established or located in the EU; and to providers and deployers in third countries whose system output is used in the EU. All subject to the exceptions in the Regulation.

315 sections

Source: AI Act Articles 2 and 3

European Union

Regulation (EU) 2026/1744 (Digital Omnibus on AI)

An EU regulation that amends the AI Act and two other EU regulations to simplify the implementation of the AI rules, with changes concerning providers and deployers of AI systems, among others. Among the main changes, it sets when the high-risk rules apply, and, within set limits, prohibits AI systems that generate or manipulate realistic intimate or sexually explicit material of an identifiable person without that person's valid consent, or child sexual abuse material.

98 sections

Source: Regulation (EU) 2026/1744, Article 1, points (6), (7) and (40), amending the AI Act (Regulation (EU) 2024/1689); also amended: (EU) 2018/1139 and (EU) 2023/1230; child sexual abuse material within the meaning of Directive 2011/93/EU

European Union

Implementing Decision (EU) 2026/2274

A European Commission decision that publishes in the Official Journal of the EU the reference of a harmonised European standard on quality management for providers of AI systems. Under the AI Act, high-risk AI systems or general-purpose AI models conforming to such standards are presumed to meet its requirements for high-risk systems in Articles 8 to 15 or, as applicable, the obligations of general-purpose model providers in Articles 53 to 55, to the extent the standards cover them.

13 sections

Source: Implementing Decision (EU) 2026/2274, Articles 1 and 2 and Annex (standard EN 18286:2026); AI Act Articles 17 and 40, Chapter III, Section 2, and Chapter V, Sections 2 and 3; Article 113 for the dates