Sustainability-related financial disclosure by listed companies Brazil Annually, from fiscal years beginning on or after 1 January 2026
— source View →
Listed issuer annual audited financial statements Eswatini Within 4 months after financial year-end
— source View →
Notification of managers' own-account transactions Germany Within 3 business days
— source View →
Disclosure of inside information Germany As soon as possible
— source View →
Climate-related ESG disclosures by listed issuers Hong Kong Annual ESG report; phased from FY starting 1 January 2025
— source View →
Publish a standalone sustainability report (ASE 20 listed companies) Jordan Annually, with the annual report or within six months of year end; first reports in 2028
— source View →
Publication of regulated information by issuers Luxembourg Annual financial report within 4 months of year-end
— source View →
Large companies: publish a non-financial report Montenegro Annual; within six months of balance-sheet date if published on a website
— source View →
IFRS sustainability disclosures for public interest entities Nigeria Financial years beginning on or after 1 January 2028
— source View →
Sustainability reporting by large listed companies Norway Annually, from financial year 2024 for the largest listed companies
— source View →
Corporate social responsibility charter, plan and report Oman Annual plan and annual report chapter
— source View →
Whistle blowing policy and complainant protection in listed companies Pakistan Ongoing
— source View →
Keep beneficial ownership records for corporations Palau — — source View →
Sustainability disclosure by listed companies (comply or explain) Türkiye Annually, in the annual report
— source View →
Accurate books and records and adequate internal accounting controls United States Ongoing
— source View →
Audit committee procedures for complaints and anonymous employee concerns United States Ongoing
— source View →
No retaliation against employees who report fraud United States Ongoing; employee complaint within 180 days
— source View →
Material cybersecurity incident disclosure on Form 8-K United States Within four business days of determining materiality
— source View →
Applies across all sectors
Lawful basis, notice and data subject rights Albania — — source View →
Personal data breach notification Albania No later than 72 hours after becoming aware of the breach
— source View →
Beneficial ownership registration and updating Albania Changes within 90 calendar days of the actual change
— source View →
Lawful basis, notice and data subject rights Algeria — — source View →
Personal data breach notification Algeria No later than 5 days after becoming aware
— source View →
Appoint a data protection officer Algeria — — source View →
Designate a person responsible for information systems security Algeria — — source View →
Lawful basis, privacy notice and data subject rights Andorra Ongoing
— source View →
Personal data breach notification to the APDA Andorra Within a maximum of 72 hours of becoming aware (Art. 36)
— source View →
Lawful basis, notice and data subject rights Angola Ongoing
— source View →
File an annual beneficial ownership and control attestation with the Registrar of Companies Antigua and Barbuda Annually, within 30 days after the company's anniversary date
— source View →
Process personal data on a lawful basis, inform data subjects and honour their rights Argentina Ongoing; access within 10 calendar days; rectification or deletion within 5 business days
— source View →
Integrity programme for legal persons, required for certain contracts with the national State Argentina Ongoing; before contracting with the national State where Art. 24 applies
— source View →
Privacy policy, collection notice and individual access and correction rights Australia Ongoing
— source View →
Ransomware and cyber extortion payment reporting Australia Within 72 hours of the payment or of becoming aware of it
— source View →
Cybersecurity incident reporting by essential and important entities Austria Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification
— source View →
Internal whistleblowing channel Austria 50 or more employees
— source View →
Lawful basis, information and data subject rights Austria — — source View →
Personal data breach notification to the Datenschutzbehörde Austria Without undue delay and where possible within 72 hours of becoming aware
— source View →
Whistleblowing: internal channel for reports of corruption and protection of reporters Azerbaijan Reports considered within 20 working days
— source View →
Lawful basis, notice and data subject rights Bahrain Ongoing
— source View →
Personal data breach notification Bahrain Within 72 hours of discovery
— source View →
Lawful basis, notice and data subject rights Bangladesh Ongoing
— source View →
Keep basic and beneficial ownership information at the registered office Barbados Ongoing; kept at least 5 years; certified in each annual return
— source View →
Lawful basis, consent, notice and data subject rights Belarus Deadlines of 5 working days to 15 days depending on the request (Arts 10-13)
— source View →
Personal data breach notification Belarus Immediately, no later than 3 working days after becoming aware
— source View →
Data protection officer or dedicated unit Belarus — — source View →
Keep employee records available for labour inspection for at least two years Belize At least 2 years after the record is made
— source View →
Protection of whistleblowers, witnesses and victims of corruption Benin — — source View →
Private entities to supply information to the UIF and report suspected corruption Bolivia — — source View →
Providers of public services to accept digitally signed documents and digital-citizenship acts Bolivia — — source View →
Lawful basis, notice and data subject rights Bosnia and Herzegovina Ongoing
— source View →
Personal data breach notification Bosnia and Herzegovina Within 72 hours where possible
— source View →
Protection against dismissal for good-faith corruption reports Bosnia and Herzegovina Ongoing
— source View →
Lawful basis, notice and data subject rights Brazil Ongoing
— source View →
Personal data breach notification to the ANPD and data subjects Brazil Within 3 business days; preliminary notice completed within 20 business days
— source View →
Integrity (anti-bribery compliance) programme Brazil Ongoing
— source View →
Whistleblowing channel and protection against retaliation (public bodies and state-owned companies) Brazil Ongoing
— source View →
Consent, notification and data subject access and correction Brunei — — source View →
Personal data breach notification to AITI Brunei No later than 3 days after assessing the breach as notifiable (s.28(1))
— source View →
Internal whistleblowing channel Bulgaria Acknowledge within 7 days; feedback within 3 months
— source View →
Protection of employees, witnesses and whistleblowers reporting corruption Burkina Faso — — source View →
Lawful basis, notice and data subject rights Cabo Verde Ongoing
— source View →
Personal data breach notification Cabo Verde Within 72 hours of becoming aware
— source View →
Notification of data processing to the CNPD Cabo Verde Before processing starts
— source View →
Designation of a data protection officer Cabo Verde Ongoing
— source View →
Fair information principles: accountability, purposes, consent and individual access Canada Ongoing
— source View →
Annual forced labour and child labour supply-chain report Canada Annually by 31 May
— source View →
Confidentiality incidents: notification and incident register (Quebec) Canada Promptly where there is a risk of serious injury; no fixed deadline
— source View →
Protection against dismissal for complaints against the employer Central African Republic — — source View →
Report significant cyber incidents to the national CSIRT Chile Early alert within 3 hours; update within 72 hours; final report within 15 calendar days
— source View →
Adopt a crime prevention model to avoid corporate criminal liability Chile Ongoing
— source View →
Lawful basis, notice and individual rights for personal information China Ongoing
— source View →
Personal information protection officer, audits and impact assessments China Ongoing; impact assessment before the activity
— source View →
Conditions for transferring personal information abroad China Before each transfer abroad
— source View →
Report cybersecurity incidents within 1, 2 or 4 hours China 1 hour (CII operators), 2 hours (central government departments), 4 hours (others)
— source View →
Sign a written employment contract within one month of starting work China Within one month of the start of work
— source View →
Data subject rights and prior informed authorisation Colombia Ongoing
— source View →
Lawful basis, notice and data subject rights Costa Rica At collection + ongoing; access and rectification requests answered within five working days (Art. 7)
— source View →
Employers must allow labour inspection Costa Rica — — source View →
Lawful basis, notice and data subject rights Croatia — — source View →
Personal data breach notification to AZOP Croatia Within 72 hours of becoming aware
— source View →
Internal whistleblowing channel and confidential person Croatia Acknowledge within 7 days; feedback within 30 days, max 90
— source View →
Data subject rights and information on processing Cuba — — source View →
Report ICT security incidents immediately Cuba Immediately ("inmediata"); no fixed deadline
— source View →
Whistleblowing channel and follow-up Cyprus Acknowledge within 7 days; feedback within 3 months of acknowledgement
— source View →
Cash payment limit of €10,000 Cyprus — — source View →
Internal whistleblowing channel for employers with 50 or more employees Czechia Acknowledge within 7 days; assess within 30 days of receipt
— source View →
Mining permit applicants commit to a community-responsibility cahier des charges Democratic Republic of the Congo At permit application and renewal
— source View →
Significant incident notification under the NIS 2 Act Denmark Early warning within 24 hours; notification within 72 hours; final report within one month
— source View →
Personal data breach notification to Datatilsynet Denmark Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
Internal whistleblower scheme for employers Denmark Acknowledge within 7 days; feedback within 3 months of acknowledgment
— source View →
Beneficial owner registration by companies Denmark Register as soon as possible; review at least annually; keep documentation 5 years
— source View →
Protection of whistleblowers, witnesses and experts from retaliation Djibouti Ongoing
— source View →
Data subject information, consent and rights (access, rectification, deletion) Dominican Republic Continuous
— source View →
Notice of dismissal to the labour authority Dominican Republic Within 48 hours of the dismissal
— source View →
Lawful basis, notice and data subject rights Ecuador Ongoing; 15-day response to rights requests
— source View →
Personal data breach notification Ecuador Authority: within 5 days of becoming aware; processor to controller: 2 days; data subject: 3 days
— source View →
Respond to an electronic labour inspection with documentation Ecuador 10 days from notice (one 5-day extension)
— source View →
Personal data breach notification El Salvador Within 72 hours of becoming aware
— source View →
No reprisals against workers who complain to the authorities Equatorial Guinea — — source View →
Targeted financial sanctions: screening, freezing and reporting Eswatini Freeze and report within 24 hours; quarterly reports to the FSRA
— source View →
No obligations for this country.
