Applies across all sectors
Incident notification to the National Cybersecurity Authority (NIS2) Greece Early warning 24 hours; update 72 hours; final report 1 month
— source View →
Protection of public officers who make protected disclosures Grenada Ongoing
— source View →
No victimisation of employees who complain or take part in proceedings Grenada Ongoing
— source View →
Valid reason, written notice and termination allowance on dismissal Grenada Event-triggered on dismissal; complaint to the Labour Commissioner within 3 months (s.82)
— source View →
Handling of personal data by public bodies: consent, access and correction Guatemala — — source View →
Annual declaration of income, assets and liabilities by persons in public life Guyana Annually on or before 30 June
— source View →
Beneficial ownership registration and annual update Honduras Annually by 30 May; changes within the first 10 business days of the following month
— source View →
Employment contracts and changes in writing Honduras At hiring and on any change
— source View →
No reprisals against workers for exercising labour rights Honduras Ongoing
— source View →
Employer duties to employees admitted to the witness protection programme Honduras Event-triggered on admission to the programme
— source View →
Report computer-system security incidents to the Commissioner's Office Hong Kong 12 hours (serious) or 48 hours (other); written report within 14 days
— source View →
Pay wages within seven days of the wage period Hong Kong Within 7 days after the wage period ends
— source View →
Keep wage and employment records Hong Kong 12 months of history; keep for 6 months after employment ends
— source View →
No dismissal for giving evidence or union activity Hong Kong Applies at all times
— source View →
Make mandatory MPF contributions for employees Hong Kong Monthly, by the 10th of the following month
— source View →
Private-sector agents must not accept advantages without principal's permission Hong Kong Applies at all times
— source View →
Cybersecurity registration of covered organisations Hungary Within 30 days of coming under the Act
— source View →
Data subject rights Hungary Within one month of request (extendable by two months)
— source View →
Beneficial owner registration and updates Iceland Changes within 2 weeks
— source View →
Lawful processing, notice and data subject rights Iceland — — source View →
Personal data breach notification Iceland Without undue delay and, if possible, within 72 hours
— source View →
Incident notification by operators of essential services Iceland As soon as possible ('svo fljótt sem verða má')
— source View →
Internal whistleblowing procedures Iceland — — source View →
Report cyber incidents to CERT-In within six hours India Within 6 hours of noticing the incident
— source View →
Keep system logs for 180 days within India India Rolling 180 days (logs); 5 years (VASP KYC and transaction records)
— source View →
Lawful basis, notice and data subject rights Indonesia Ongoing
— source View →
Sustainability report Indonesia Annually; 30 April if filed separately from the annual report
— source View →
Corporate social and environmental responsibility Indonesia Ongoing; reported in the annual report
— source View →
Internal reporting channels for protected disclosures Ireland Acknowledge within 7 days; feedback within 3 months
— source View →
Anti-corruption compliance: reasonable steps defence Ireland — — source View →
Weekly working time and rest limits Ireland — — source View →
Non-discrimination in employment Ireland — — source View →
Employer justification for dismissal Ireland Claims within 6 months of dismissal
— source View →
Database registration and data subject access Israel Ongoing
— source View →
Personal data breach notification Italy Without undue delay and, where possible, within 72 hours
— source View →
Whistleblowing channels and protection of reporters Italy Ongoing; ANAC acknowledgement within 7 days, feedback within 3 months
— source View →
Security control measures for personal data Japan — — source View →
Consent for provision of personal data to third parties abroad Japan Before each transfer
— source View →
Whistleblowing report handling system Japan — — source View →
Working hours limits and overtime agreements Japan 40 hours a week; overtime 45 hours a month and 360 hours a year
— source View →
Work rules for employers with ten or more workers Japan On preparation and on each change
— source View →
Lawful basis, consent and data subject rights Kazakhstan Ongoing
— source View →
Appoint a person responsible for organising personal data processing Kazakhstan Ongoing
— source View →
Lawful basis, notice and data subject rights Kenya Ongoing
— source View →
Personal data breach notification Kenya Within 72 hours of becoming aware (s.43(1)(a))
— source View →
Anti-bribery procedures Kenya Ongoing
— source View →
Duty to report bribery to the Commission Kenya Within 24 hours (s.14)
— source View →
Protection of whistle-blowers and witnesses Kenya Ongoing
— source View →
Beneficial ownership register and filing with the Registrar Kenya On incorporation and on each change
— source View →
Retention of employment records Kenya 5 years after termination (s.10(6))
— source View →
Declaration of cash above $5,000 at the border Kiribati On each entry or exit carrying cash above $5,000 equivalent
— source View →
Lawful basis, notice and data subject rights Kosovo Ongoing
— source View →
Personal data breach notification to the Agency Kosovo Not later than 72 hours after becoming aware
— source View →
Duty to report corruption and protection of whistleblowers Kuwait — — source View →
Respect data subject rights (access, rectification, erasure, restriction, portability, objection) Latvia Respond to requests within one month
— source View →
No adverse consequences for employees who report suspected offences at work Latvia — — source View →
Lawful processing, notice and data subject rights Lesotho — — source View →
Personal data breach notification Lesotho As soon as reasonably possible after discovery (s. 23)
— source View →
Beneficial owner identification and reporting to the register Liechtenstein Within 30 days of commercial register entry and of each change
— source View →
Lawful basis, notice and data subject rights Liechtenstein — — source View →
Cyber-incident reporting to the Stabsstelle Cyber-Sicherheit Liechtenstein Early warning 24 hours; notification 72 hours; final report within one month
— source View →
Record of processing activities Luxembourg Ongoing; kept current
— source View →
Lawful basis, notice and data subject rights Macao Ongoing
— source View →
Notification of data processing to the public authority Macao In writing within 8 days of the start of processing
— source View →
Lawful basis, notice and data subject rights Madagascar — — source View →
Prior declaration or authorisation to the CMIL and data protection officer Madagascar Before processing starts
— source View →
Asset and interest declarations by listed officials Madagascar Within 3 months of appointment; renewal every 2 years or after a major change
— source View →
Protect people who report corruption Malawi Ongoing
— source View →
Give a valid reason and fair procedure before dismissal Malawi Ongoing
— source View →
Lawful basis, notice and data subject rights Mali — — source View →
Asset declaration by public officials Mali Before taking office, updated annually, and on leaving office
— source View →
Internal whistleblowing reporting channel Malta Acknowledge within 7 days; feedback within 3 months
— source View →
Lawful basis, notice to data subjects and data subject rights Mauritania — — source View →
Annual independent IT security audit for critical information infrastructure Mauritius Annually or after major changes
— source View →
Registration as data controller or processor Mauritius Certificate valid 3 years; renewal application no later than 3 months before expiry
— source View →
Freezing and reporting assets of UN-designated parties Mauritius Immediately: without delay and not later than 24 hours (s. 2)
— source View →
Declaration of assets by public officials Mauritius Within 30 days of taking office; every 5 years for certain officers
— source View →
Written statement of particulars of employment Mauritius For workers engaged for more than one month
— source View →
Monthly payment of remuneration and payslips Mauritius Monthly
— source View →
Lawful basis, privacy notice and data subject rights Mexico At collection and on request
— source View →
Notify data subjects of security breaches Mexico Immediately (no fixed period stated)
— source View →
Adopt an integrity policy (weighed in corporate liability) Mexico — — source View →
Lawful basis, notice and data subject rights Moldova Ongoing
— source View →
Personal data breach notification Moldova Within 72 hours of becoming aware, where possible
— source View →
Whistleblowing channel and protection from retaliation Moldova Ongoing
— source View →
Lawful basis, transparency notice and data subject rights Monaco Ongoing; responses generally within one month (art. 10)
— source View →
Personal data breach notification Monaco As soon as possible, if possible within 72 hours of becoming aware
— source View →
Notice periods for ending an employment contract Monaco Notice 1 to 3 months depending on service
— source View →
Lawful basis, consent and data subject rights Mongolia — — source View →
Personal data breach notification Mongolia Immediately (shortest possible duration; no fixed deadline)
— source View →
Cyber-incident notification Mongolia Immediately
— source View →
Set up an internal whistleblowing channel Montenegro Acknowledge within 7 days; outcome within 45 days
— source View →
Cybersecurity incident declaration to the national authority Morocco As soon as the entity becomes aware (Art. 8); without delay (Art. 30)
— source View →
Reporting channel and protection for corruption whistleblowers Morocco Ongoing
— source View →
Data subject notice, consent and rights Morocco Ongoing
— source View →
Virtual asset service provider licensing Namibia Before offering virtual asset services
— source View →
Travel-rule information for virtual asset transfers Namibia With each virtual asset transfer
— source View →
Report gratification offers to the Anti-Corruption Commission Namibia On receiving or soliciting gratification
— source View →
No prejudice to employees for disclosing information Namibia — — source View →
Nominated officer and beneficial ownership information Nauru Notify appointment within 30 days; keep details 7 years
— source View →
No obligations for this country.
