Healthcare & Pharma — regulation across countries
| Regulator | Country | Official site |
|---|---|---|
| DFAT Department of Foreign Affairs and Trade | Australia | source |
| OAIC Office of the Australian Information Commissioner | Australia | source |
| ANPD Autoridade Nacional de Proteção de Dados | Brazil | source |
| OPC Office of the Privacy Commissioner of Canada | Canada | source |
| CAC Cyberspace Administration of China | China | source |
| CNIL Commission nationale de l'informatique et des libertés | France | source |
| BfDI Federal Commissioner for Data Protection and Freedom of Information | Germany | source |
| DPBI Data Protection Board of India | India | source |
| PPC Personal Information Protection Commission | Japan | source |
| MACC Malaysian Anti-Corruption Commission | Malaysia | — |
| PDPC-MY Personal Data Protection Commissioner | Malaysia | source |
| RMCD Royal Malaysian Customs Department | Malaysia | source |
| AP Autoriteit Persoonsgegevens | Netherlands | source |
| NDPC Nigeria Data Protection Commission | Nigeria | source |
| SDAIA Saudi Data and AI Authority | Saudi Arabia | source |
| PDPC Personal Data Protection Commission | Singapore | source |
| IR Information Regulator | South Africa | source |
| OFSI Office of Financial Sanctions Implementation | United Kingdom | source |
| OFAC Office of Foreign Assets Control | United States | source |
| Applies across all sectors | ||
| MoLSA Ministry of Labour and Social Affairs | Afghanistan | source |
| IDPC Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) | Albania | source |
| AIF Financial Intelligence Agency (Agjencia e Inteligjencës Financiare) | Albania | source |
| QKB National Business Centre (Qendra Kombëtare e Biznesit) | Albania | source |
| ISHPSHSH State Labour and Social Services Inspectorate (Inspektorati Shtetëror i Punës dhe Shërbimeve Shoqërore) | Albania | source |
| CTRF Cellule de Traitement du Renseignement Financier (Financial Intelligence Processing Unit) | Algeria | — |
| HATPLC Haute autorité de transparence, de prévention et de lutte contre la corruption (High Authority for Transparency, Prevention and Combating of Corruption) | Algeria | source |
| MTESS Ministère du Travail, de l'Emploi et de la Sécurité Sociale (Ministry of Labour, Employment and Social Security) | Algeria | source |
| APDA Agència Andorrana de Protecció de Dades | Andorra | source |
| ANC-AD Agència Nacional de Ciberseguretat d'Andorra | Andorra | source |
| UIF Unidade de Informação Financeira | Angola | source |
| Integrity Commission Integrity Commission | Antigua and Barbuda | — |
| AAIP Agencia de Acceso a la Información Pública | Argentina | source |
| OA Oficina Anticorrupción | Argentina | source |
| UIF Unidad de Información Financiera | Argentina | source |
| Anti-Corruption Committee of the Republic of Armenia Anti-Corruption Committee of the Republic of Armenia | Armenia | source |
| Corruption Prevention Commission Corruption Prevention Commission | Armenia | source |
| FMC Financial Monitoring Center | Armenia | source |
| ACSC Australian Cyber Security Centre | Australia | source |
| ATO Australian Taxation Office | Australia | source |
| NACC National Anti-Corruption Commission | Australia | source |
| Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) | Austria | source |
| BCS Bundesamt für Cybersicherheit | Austria | source |
| BAK Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung | Austria | source |
| DSB Datenschutzbehörde (Austrian Data Protection Authority) | Austria | source |
| Financial Monitoring Service of the Republic of Azerbaijan Financial Monitoring Service of the Republic of Azerbaijan | Azerbaijan | source |
| Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan | Azerbaijan | source |
| State Labour Inspection Service State Labour Inspection Service | Azerbaijan | source |
| LMRA Labour Market Regulatory Authority | Bahrain | source |
| NCSC National Cyber Security Center | Bahrain | source |
| BGD e-GOV CIRT BGD e-GOV CIRT | Bangladesh | source |
| Ministry of Labour and Social Protection of the Republic of Belarus Ministry of Labour and Social Protection of the Republic of Belarus | Belarus | source |
| CCB Centre for Cybersecurity Belgium | Belgium | source |
| Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity | Belgium | source |
| FPS Employment Federal Public Service Employment, Labour and Social Dialogue (FPS Employment) | Belgium | source |
| APD-GBA Gegevensbeschermingsautoriteit / Autorité de protection des données (Data Protection Authority) | Belgium | source |
| OCRC Office central pour la répression de la corruption (OCRC) of the Federal Judicial Police (Central Office for the Repression of Corruption) | Belgium | source |
| FIU Financial Intelligence Unit | Belize | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières du Bénin (National Financial Information Processing Unit) | Benin | source |
| ACC Anti-Corruption Commission of Bhutan | Bhutan | source |
| BtCIRT Bhutan Computer Incident Response Team (Government Technology Agency) | Bhutan | source |
| UIF Unidad de Investigaciones Financieras | Bolivia | source |
| APIK Agency for Prevention of Corruption and Coordination of the Fight against Corruption (Agencija za prevenciju korupcije i koordinaciju borbe protiv korupcije) | Bosnia and Herzegovina | source |
| FUZIP Federal Administration for Inspection Affairs (Federalna uprava za inspekcijske poslove) | Bosnia and Herzegovina | source |
| Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) | Bosnia and Herzegovina | source |
| CGU Controladoria-Geral da União | Brazil | source |
| GSI/PR Gabinete de Segurança Institucional da Presidência da República | Brazil | source |
| MTE Ministério do Trabalho e Emprego | Brazil | source |
| ACB Anti-Corruption Bureau | Brunei | source |
| CSB Cyber Security Brunei | Brunei | source |
| Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) | Bulgaria | source |
| Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) | Bulgaria | — |
| КЗЛД Комисия за защита на личните данни (Commission for Personal Data Protection) | Bulgaria | source |
| МТСП Министерство на труда и социалната политика (Ministry of Labour and Social Policy) | Bulgaria | source |
| ASCE-LC Autorité supérieure de contrôle d'État et de lutte contre la corruption (Supreme State Audit and Anti-Corruption Authority) | Burkina Faso | source |
| CNRF Cellule Nationale de Renseignement Financier (National Financial Intelligence Unit) | Burundi | source |
| CNPD Comissão Nacional de Proteção de Dados | Cabo Verde | source |
| CPC Conselho da Prevenção da Corrupção | Cabo Verde | — |
| ANIF Agence Nationale d'Investigation Financière (National Agency for Financial Investigation) | Cameroon | source |
| CONAC Commission Nationale Anti-Corruption (National Anti-Corruption Commission) | Cameroon | source |
| Corporations Canada Corporations Canada | Canada | source |
| ESDC Employment and Social Development Canada - Labour Program (Labour Standards Program) | Canada | source |
| PSIC Office of the Public Sector Integrity Commissioner of Canada | Canada | source |
| ANCI Agencia Nacional de Ciberseguridad | Chile | source |
| Ministerio Público (Fiscalía de Chile) Ministerio Público (Fiscalía de Chile) | Chile | source |
| Procuraduría General de la Nación Procuraduría General de la Nación | Colombia | source |
| SIC Superintendencia de Industria y Comercio | Colombia | source |
| UIAF Unidad de Información y Análisis Financiero | Colombia | source |
| Inspection du Travail et des Lois Sociales Inspection du Travail et des Lois Sociales | Comoros | — |
| PEP Procuraduría de la Ética Pública (Procuraduría General de la República) | Costa Rica | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières | Côte d'Ivoire | source |
| HABG Haute Autorité pour la Bonne Gouvernance | Côte d'Ivoire | source |
| AZOP Agencija za zaštitu osobnih podataka (Personal Data Protection Agency) | Croatia | source |
| Državni inspektorat (State Inspectorate) Državni inspektorat (State Inspectorate) | Croatia | source |
| CERT Nacionalni CERT (National CERT, operated by CARNET) | Croatia | source |
| Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) | Croatia | source |
| Pučki pravobranitelj (Ombudsman) Pučki pravobranitelj (Ombudsman) | Croatia | source |
| SOA Sigurnosno-obavještajna agencija (Security and Intelligence Agency) | Croatia | source |
| USKOK Ured za suzbijanje korupcije i organiziranog kriminaliteta (Office for the Suppression of Corruption and Organised Crime) | Croatia | source |
| Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) | Czechia | source |
| SÚIP Státní úřad inspekce práce (State Labour Inspection Office) | Czechia | source |
| No regulators for this country. | ||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Applies across all sectors | |||||
| Internal whistleblowing reporting procedure | Netherlands | Acknowledgement within 7 days; feedback within 3 months | source | View → | |
| Occupational risk inventory and evaluation | Netherlands | Ongoing | source | View → | |
| No retaliation against employees who make protected disclosures | New Zealand | Ongoing | source | View → | |
| Deal with each other in good faith in the employment relationship | New Zealand | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Niger | — | source | View → | |
| Personal data breach notification to the HAPDP | Niger | Without delay (controller to HAPDP); processor to controller within 72 hours | source | View → | |
| Freeze assets of designated persons and report within 24 hours | Nigeria | Immediately, no later than 24 hours | source | View → | |
| Data privacy impact assessment for high-risk processing | Nigeria | Before processing begins | source | View → | |
| Report persons with significant control | Nigeria | PSC to company within 7 days; company to CAC within one month | source | View → | |
| Written terms of employment and notice of termination | Nigeria | Within 3 months of starting work | source | View → | |
| Beneficial ownership register entry | North Macedonia | Within 15 days of registration and of any change | source | View → | |
| Lawful basis, notice and data subject rights | North Macedonia | — | source | View → | |
| Personal data breach notification | North Macedonia | Immediately and no later than 72 hours after becoming aware | source | View → | |
| Whistleblowing channel and protection | North Macedonia | Reply to the whistleblower within 15 days | source | View → | |
| Report significant incidents under the Digital Security Act | Norway | Without undue delay (sections 8 and 11); NSM states 24 hours for essential-service providers | source | View → | |
| Internal whistleblowing routines | Norway | — | source | View → | |
| Register beneficial owners | Norway | Within 14 days of registration or of a change | source | View → | |
| Consent, notice and data subject rights | Oman | — | source | View → | |
| Protection of workers who complain, and grievance system | Oman | — | source | View → | |
| Protection of whistleblowers from victimisation | Pakistan | Ongoing | source | View → | |
| Cash courier declaration of US$10,000 or more | Palau | On entering or leaving Palau | source | View → | |
| Lawful basis, privacy notice and data subject rights | Peru | — | source | View → | |
| Lawful basis for processing, privacy notice and data subject rights | Philippines | Ongoing | source | View → | |
| Notify the President of UODO of the appointment of a data protection officer | Poland | Within 14 days of designation or change | source | View → | |
| Personal data breach notification to the President of UODO | Poland | Without undue delay and, where feasible, within 72 hours of becoming aware | source | View → | |
| Internal whistleblowing channel and handling of reports | Poland | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Beneficial-owner declaration to the central register (RCBE) | Portugal | Initial and updates within 30 days; annual confirmation by 31 December | source | View → | |
| Lawful basis, notice and data subject rights | Portugal | One month from receipt, extendable by two months | source | View → | |
| Personal data breach notification to the CNPD | Portugal | Within 72 hours of becoming aware | source | View → | |
| Internal whistleblowing channel | Portugal | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Corruption-prevention compliance programme and compliance officer | Portugal | Ongoing; risk plan reviewed every three years | source | View → | |
| Cybersecurity incident notification to the competent authority | Portugal | Initial notification within 24 hours; end-of-impact notice within 24 hours; final report within 30 working days | source | View → | |
| Personal data breach notification to the QFC Data Protection Office | Qatar | Within 72 hours | source | View → | |
| Lawful basis, notice and data subject rights | Republic of the Congo | Ongoing | source | View → | |
| Personal data breach notification | Republic of the Congo | Within 72 hours where possible | source | View → | |
| Cyber-incident notification to the national security agency | Republic of the Congo | Without delay | source | View → | |
| Whistleblower protection and anti-retaliation | Republic of the Congo | Ongoing | source | View → | |
| Public-interest whistleblowing channel and follow-up | Romania | Acknowledge within 7 calendar days; feedback within 3 months | source | View → | |
| Personal data incident notification to the authorised body | Russia | Within 24 hours (initial notice) and within 72 hours (investigation results) | source | View → | |
| Person responsible for organising personal data processing | Russia | Ongoing | source | View → | |
| Lawful processing, consent and data subject rights | Rwanda | Ongoing; 30 days for objection and portability requests | source | View → | |
| Personal data breach notification | Rwanda | Within 48 hours to the NCSA; report within 72 hours | source | View → | |
| Report systems used for cybercrime and cyber threat incidents | Rwanda | On becoming aware | source | View → | |
| Anti-corruption prevention mechanisms in public and private institutions | Rwanda | Ongoing | source | View → | |
| No dismissal for making a complaint against the employer | Saint Kitts and Nevis | — | source | View → | |
| Do not penalise employees for complying with, enforcing or giving evidence under the Labour Act | Saint Lucia | — | source | View → | |
| Do not take employment reprisals against a person who complains to the Special Prosecutor | Saint Lucia | — | source | View → | |
| Beneficial ownership reporting by companies and trusts | San Marino | — | source | View → | |
| Lawful basis, notice and data subject rights | San Marino | — | source | View → | |
| Personal data breach notification | San Marino | Within 72 hours of awareness, where feasible | source | View → | |
| Confidentiality of persons reporting corruption-related facts | San Marino | — | source | View → | |
| Just cause or justified reason for dismissal of permanent staff | San Marino | — | source | View → | |
| Lawful basis, information to data subjects and data subject rights | São Tomé and Príncipe | Ongoing | source | View → | |
| Appoint a personal data protection officer | Saudi Arabia | Ongoing, in the listed cases | source | View → | |
| Lawful basis, notice and data subject rights | Senegal | — | source | View → | |
| Notify significant ICT incidents to the competent authority | Serbia | Within 24 hours of learning of the incident | source | View → | |
| Lawful basis, notice and data subject rights | Serbia | Ongoing; response within 30 days | source | View → | |
| Internal whistleblowing procedure | Serbia | Rules adopted and published; reports acted on within 15 days | source | View → | |
| Beneficial ownership register and updates | Seychelles | Within 14 days of a declaration or change | source | View → | |
| Lawful basis, notice and data subject rights | Seychelles | Ongoing | source | View → | |
| Personal data breach notification | Seychelles | Not later than 72 hours after becoming aware | source | View → | |
| Written particulars of employment | Sierra Leone | Within 12 weeks of the start date | source | View → | |
| Internal whistleblowing channel | Slovenia | Acknowledge within 7 days; outcome within 3 months | source | View → | |
| Prohibition of retaliation against reporting persons | Slovenia | — | source | View → | |
| Whistleblowing channel: authorise internal procedures for protected disclosures | South Africa | Ongoing | source | View → | |
| Protect employees who report corrupt practices | South Sudan | — | source | View → | |
| Declare income, assets and liabilities to the Anti-Corruption Commission | South Sudan | Within 30 days of taking office, then annually by the end of February | source | View → | |
| Beneficial ownership declaration to the Central Register | Spain | Within 1 month of formation; updates within 10 days; annual declaration in January | source | View → | |
| Notification of security incidents through the reference CSIRT | Spain | Initial notification without undue delay, then intermediate and final (Art. 22) | source | View → | |
| Internal whistleblowing channel | Spain | Ongoing; acknowledgement within 7 calendar days; response within 3 months | source | View → | |
| Anti-bribery and criminal compliance model | Spain | Ongoing (exemption condition) | source | View → | |
| Lawful basis, transparency and data subject rights | Spain | Ongoing | source | View → | |
| Personal data breach notification to the AEPD | Spain | Within 72 hours of becoming aware | source | View → | |
| Lawful basis, notice and data subject rights | Sri Lanka | Ongoing | source | View → | |
| Credit information: customer access, appeal and correction of errors | Sudan | Ongoing; appeals reviewed within 15 days | source | View → | |
| Registration with FIU Suriname | Suriname | Within 3 months of starting business (Art. 28) | source | View → | |
| Internal reporting channels for employers with 50 or more employees | Sweden | Ongoing | source | View → | |
| Cyber incident reporting by essential and important entities | Sweden | Early warning within 24 hours; notification within 24 hours (trust services) or 72 hours (others); final report within one month | source | View → | |
| Personal data breach notification to IMY | Sweden | Within 72 hours of becoming aware | source | View → | |
| Lawful grounds, information to individuals and data subject rights | Sweden | Ongoing | source | View → | |
| Beneficial ownership information held and filed with Bolagsverket | Sweden | At registration or within four weeks; changes without delay | source | View → | |
| Information to data subjects and right of access | Switzerland | Ongoing; access requests answered within 30 days (Art. 25 para. 7) | source | View → | |
| Notifying the FDPIC of a data security breach | Switzerland | As quickly as possible | source | View → | |
| Due diligence and reporting on conflict minerals and child labour | Switzerland | Ongoing | source | View → | |
| Prohibition of retaliation against public interest whistleblowers | Taiwan | Ongoing | source | View → | |
| Protection of workers who report labour law violations | Taiwan | Authority to notify the worker within 60 days of the complaint | source | View → | |
| State protection for persons who help counter corruption | Tajikistan | — | source | View → | |
| Lawful basis, notice and data subject rights | Tanzania | Ongoing | source | View → | |
| Personal data breach notification | Tanzania | Without any undue delay | source | View → | |
| Registration as a data controller or processor | Tanzania | Before processing; renew every 5 years | source | View → | |
| Whistleblower disclosure channel and protection | Tanzania | Ongoing | source | View → | |
| Written employment contract and particulars; five-year retention | Tanzania | 5 years after termination | source | View → | |
| Personal data breach notification | Thailand | Within 72 hours of becoming aware, where feasible | source | View → | |
| Accept and protect whistleblower reports | Timor-Leste | — | source | View → | |
| No dismissal for lodging a complaint with the authorities | Timor-Leste | — | source | View → | |
| Lawful basis, notice and data subject rights | Togo | Ongoing | source | View → | |
| Personal data breach notification | Tonga | Within 72 hours of becoming aware | source | View → | |
| Cyber-incident reporting and annual security audit | Tunisia | Immediately | source | View → | |
| Whistleblowing: internal reporting unit in public bodies | Tunisia | — | source | View → | |
| Lawful basis, notice and data subject rights | Türkiye | At collection + on request | source | View → | |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 8 JAN 2026 | FREE MOBILE | France | Monetary Penalty · Remedial Direction | €27,000,000 | source |
| 22 DEC 2025 | NEXPUBLICA FRANCE | France | Monetary Penalty | €1,700,000 | source |
| 16 DEC 2025 | Exodus Movement, Inc. | United States | Settlement | US$3,103,360 | source |
| 11 DEC 2025 | MOBIUS SOLUTIONS LTD | France | Monetary Penalty | €1,000,000 | source |
| 9 DEC 2025 | An Individual | United States | Settlement | US$1,092,000 | source |
| 4 DEC 2025 | Gracetown, Inc. | United States | Monetary Penalty | US$7,139,305 | source |
| 2 DEC 2025 | IPI Partners, LLC | United States | Settlement | US$11,485,352 | source |
| 27 NOV 2025 | AMERICAN EXPRESS CARTE FRANCE | France | Monetary Penalty | €1,500,000≈ US$1,736,550 | source |
| 24 NOV 2025 | An Individual | United States | Monetary Penalty | US$4,677,552 | source |
| 20 NOV 2025 | LES PUBLICATIONS CONDE NAST | France | Monetary Penalty | €750,000≈ US$863,550 | source |
| 28 OCT 2025 | Marina Bay Sands Pte. Ltd. | Singapore | Monetary Penalty | SGD 315,000 | source |
| 8 OCT 2025 | Australian Clinical Labs Limited | Australia | Monetary Penalty | AUD 5,800,000 | source |
| 30 SEP 2025 | Colorcon Limited | United Kingdom | Monetary Penalty | £152,750 | source |
| 22 SEP 2025 | ShapeShift AG | United States | Settlement | US$750,000 | source |
| 10 SEP 2025 | 株式会社中央ビジネスサービス (Chuo Business Service Co., Ltd.) | Japan | Formal Reprimand | — | source |
| 8 SEP 2025 | Vanquis Bank Limited | United Kingdom | Formal Reprimand | — | source |
| 3 SEP 2025 | Fracht FWO Inc. | United States | Settlement | US$1,610,775 | source |
| 1 SEP 2025 | INFINITE STYLES SERVICES CO. LIMITED | France | Monetary Penalty | €150,000,000 | source |
| 8 AUG 2025 | Singtel Optus Pty Limited / Optus Systems Pty Limited | Australia | Monetary Penalty | — | source |
| 31 JUL 2025 | Markom Management Limited | United Kingdom | Monetary Penalty | £300,000 | source |
| 15 JUL 2025 | Interactive Brokers LLC | United States | Settlement | US$11,832,136 | source |
| 8 JUL 2025 | Harman International Industries, Inc. | United States | Settlement | US$1,454,145 | source |
| 2 JUL 2025 | Key Holding, LLC | United States | Settlement | US$608,825 | source |
| 16 JUN 2025 | Unicat Catalyst Technologies, LLC | United States | Settlement | US$3,882,797 | source |
| 12 JUN 2025 | GVA Capital Ltd. | United States | Monetary Penalty | US$215,988,868 | source |
| No actions for this country. | |||||