Healthcare & Pharma — regulation across countries
| Regulator | Country | Official site |
|---|---|---|
| DFAT Department of Foreign Affairs and Trade | Australia | source |
| OAIC Office of the Australian Information Commissioner | Australia | source |
| ANPD Autoridade Nacional de Proteção de Dados | Brazil | source |
| OPC Office of the Privacy Commissioner of Canada | Canada | source |
| CAC Cyberspace Administration of China | China | source |
| CNIL Commission nationale de l'informatique et des libertés | France | source |
| BfDI Federal Commissioner for Data Protection and Freedom of Information | Germany | source |
| DPBI Data Protection Board of India | India | source |
| PPC Personal Information Protection Commission | Japan | source |
| MACC Malaysian Anti-Corruption Commission | Malaysia | — |
| PDPC-MY Personal Data Protection Commissioner | Malaysia | source |
| RMCD Royal Malaysian Customs Department | Malaysia | source |
| AP Autoriteit Persoonsgegevens | Netherlands | source |
| NDPC Nigeria Data Protection Commission | Nigeria | source |
| SDAIA Saudi Data and AI Authority | Saudi Arabia | source |
| PDPC Personal Data Protection Commission | Singapore | source |
| IR Information Regulator | South Africa | source |
| OFSI Office of Financial Sanctions Implementation | United Kingdom | source |
| OFAC Office of Foreign Assets Control | United States | source |
| Applies across all sectors | ||
| MoLSA Ministry of Labour and Social Affairs | Afghanistan | source |
| IDPC Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) | Albania | source |
| AIF Financial Intelligence Agency (Agjencia e Inteligjencës Financiare) | Albania | source |
| QKB National Business Centre (Qendra Kombëtare e Biznesit) | Albania | source |
| ISHPSHSH State Labour and Social Services Inspectorate (Inspektorati Shtetëror i Punës dhe Shërbimeve Shoqërore) | Albania | source |
| CTRF Cellule de Traitement du Renseignement Financier (Financial Intelligence Processing Unit) | Algeria | — |
| HATPLC Haute autorité de transparence, de prévention et de lutte contre la corruption (High Authority for Transparency, Prevention and Combating of Corruption) | Algeria | source |
| MTESS Ministère du Travail, de l'Emploi et de la Sécurité Sociale (Ministry of Labour, Employment and Social Security) | Algeria | source |
| APDA Agència Andorrana de Protecció de Dades | Andorra | source |
| ANC-AD Agència Nacional de Ciberseguretat d'Andorra | Andorra | source |
| UIF Unidade de Informação Financeira | Angola | source |
| Integrity Commission Integrity Commission | Antigua and Barbuda | — |
| AAIP Agencia de Acceso a la Información Pública | Argentina | source |
| OA Oficina Anticorrupción | Argentina | source |
| UIF Unidad de Información Financiera | Argentina | source |
| Anti-Corruption Committee of the Republic of Armenia Anti-Corruption Committee of the Republic of Armenia | Armenia | source |
| Corruption Prevention Commission Corruption Prevention Commission | Armenia | source |
| FMC Financial Monitoring Center | Armenia | source |
| ACSC Australian Cyber Security Centre | Australia | source |
| ATO Australian Taxation Office | Australia | source |
| NACC National Anti-Corruption Commission | Australia | source |
| Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) | Austria | source |
| BCS Bundesamt für Cybersicherheit | Austria | source |
| BAK Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung | Austria | source |
| DSB Datenschutzbehörde (Austrian Data Protection Authority) | Austria | source |
| Financial Monitoring Service of the Republic of Azerbaijan Financial Monitoring Service of the Republic of Azerbaijan | Azerbaijan | source |
| Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan | Azerbaijan | source |
| State Labour Inspection Service State Labour Inspection Service | Azerbaijan | source |
| LMRA Labour Market Regulatory Authority | Bahrain | source |
| NCSC National Cyber Security Center | Bahrain | source |
| BGD e-GOV CIRT BGD e-GOV CIRT | Bangladesh | source |
| Ministry of Labour and Social Protection of the Republic of Belarus Ministry of Labour and Social Protection of the Republic of Belarus | Belarus | source |
| CCB Centre for Cybersecurity Belgium | Belgium | source |
| Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity | Belgium | source |
| FPS Employment Federal Public Service Employment, Labour and Social Dialogue (FPS Employment) | Belgium | source |
| APD-GBA Gegevensbeschermingsautoriteit / Autorité de protection des données (Data Protection Authority) | Belgium | source |
| OCRC Office central pour la répression de la corruption (OCRC) of the Federal Judicial Police (Central Office for the Repression of Corruption) | Belgium | source |
| FIU Financial Intelligence Unit | Belize | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières du Bénin (National Financial Information Processing Unit) | Benin | source |
| ACC Anti-Corruption Commission of Bhutan | Bhutan | source |
| BtCIRT Bhutan Computer Incident Response Team (Government Technology Agency) | Bhutan | source |
| UIF Unidad de Investigaciones Financieras | Bolivia | source |
| APIK Agency for Prevention of Corruption and Coordination of the Fight against Corruption (Agencija za prevenciju korupcije i koordinaciju borbe protiv korupcije) | Bosnia and Herzegovina | source |
| FUZIP Federal Administration for Inspection Affairs (Federalna uprava za inspekcijske poslove) | Bosnia and Herzegovina | source |
| Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) | Bosnia and Herzegovina | source |
| CGU Controladoria-Geral da União | Brazil | source |
| GSI/PR Gabinete de Segurança Institucional da Presidência da República | Brazil | source |
| MTE Ministério do Trabalho e Emprego | Brazil | source |
| ACB Anti-Corruption Bureau | Brunei | source |
| CSB Cyber Security Brunei | Brunei | source |
| Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) | Bulgaria | source |
| Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) | Bulgaria | — |
| КЗЛД Комисия за защита на личните данни (Commission for Personal Data Protection) | Bulgaria | source |
| МТСП Министерство на труда и социалната политика (Ministry of Labour and Social Policy) | Bulgaria | source |
| ASCE-LC Autorité supérieure de contrôle d'État et de lutte contre la corruption (Supreme State Audit and Anti-Corruption Authority) | Burkina Faso | source |
| CNRF Cellule Nationale de Renseignement Financier (National Financial Intelligence Unit) | Burundi | source |
| CNPD Comissão Nacional de Proteção de Dados | Cabo Verde | source |
| CPC Conselho da Prevenção da Corrupção | Cabo Verde | — |
| ANIF Agence Nationale d'Investigation Financière (National Agency for Financial Investigation) | Cameroon | source |
| CONAC Commission Nationale Anti-Corruption (National Anti-Corruption Commission) | Cameroon | source |
| Corporations Canada Corporations Canada | Canada | source |
| ESDC Employment and Social Development Canada - Labour Program (Labour Standards Program) | Canada | source |
| PSIC Office of the Public Sector Integrity Commissioner of Canada | Canada | source |
| ANCI Agencia Nacional de Ciberseguridad | Chile | source |
| Ministerio Público (Fiscalía de Chile) Ministerio Público (Fiscalía de Chile) | Chile | source |
| Procuraduría General de la Nación Procuraduría General de la Nación | Colombia | source |
| SIC Superintendencia de Industria y Comercio | Colombia | source |
| UIAF Unidad de Información y Análisis Financiero | Colombia | source |
| Inspection du Travail et des Lois Sociales Inspection du Travail et des Lois Sociales | Comoros | — |
| PEP Procuraduría de la Ética Pública (Procuraduría General de la República) | Costa Rica | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières | Côte d'Ivoire | source |
| HABG Haute Autorité pour la Bonne Gouvernance | Côte d'Ivoire | source |
| AZOP Agencija za zaštitu osobnih podataka (Personal Data Protection Agency) | Croatia | source |
| Državni inspektorat (State Inspectorate) Državni inspektorat (State Inspectorate) | Croatia | source |
| CERT Nacionalni CERT (National CERT, operated by CARNET) | Croatia | source |
| Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) | Croatia | source |
| Pučki pravobranitelj (Ombudsman) Pučki pravobranitelj (Ombudsman) | Croatia | source |
| SOA Sigurnosno-obavještajna agencija (Security and Intelligence Agency) | Croatia | source |
| USKOK Ured za suzbijanje korupcije i organiziranog kriminaliteta (Office for the Suppression of Corruption and Organised Crime) | Croatia | source |
| Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) | Czechia | source |
| SÚIP Státní úřad inspekce práce (State Labour Inspection Office) | Czechia | source |
| No regulators for this country. | ||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Applies across all sectors | |||||
| Incident notification to the National Cybersecurity Authority (NIS2) | Greece | Early warning 24 hours; update 72 hours; final report 1 month | source | View → | |
| Protection of public officers who make protected disclosures | Grenada | Ongoing | source | View → | |
| No victimisation of employees who complain or take part in proceedings | Grenada | Ongoing | source | View → | |
| Valid reason, written notice and termination allowance on dismissal | Grenada | Event-triggered on dismissal; complaint to the Labour Commissioner within 3 months (s.82) | source | View → | |
| Handling of personal data by public bodies: consent, access and correction | Guatemala | — | source | View → | |
| Annual declaration of income, assets and liabilities by persons in public life | Guyana | Annually on or before 30 June | source | View → | |
| Beneficial ownership registration and annual update | Honduras | Annually by 30 May; changes within the first 10 business days of the following month | source | View → | |
| Employment contracts and changes in writing | Honduras | At hiring and on any change | source | View → | |
| No reprisals against workers for exercising labour rights | Honduras | Ongoing | source | View → | |
| Employer duties to employees admitted to the witness protection programme | Honduras | Event-triggered on admission to the programme | source | View → | |
| Report computer-system security incidents to the Commissioner's Office | Hong Kong | 12 hours (serious) or 48 hours (other); written report within 14 days | source | View → | |
| Pay wages within seven days of the wage period | Hong Kong | Within 7 days after the wage period ends | source | View → | |
| Keep wage and employment records | Hong Kong | 12 months of history; keep for 6 months after employment ends | source | View → | |
| No dismissal for giving evidence or union activity | Hong Kong | Applies at all times | source | View → | |
| Make mandatory MPF contributions for employees | Hong Kong | Monthly, by the 10th of the following month | source | View → | |
| Private-sector agents must not accept advantages without principal's permission | Hong Kong | Applies at all times | source | View → | |
| Cybersecurity registration of covered organisations | Hungary | Within 30 days of coming under the Act | source | View → | |
| Data subject rights | Hungary | Within one month of request (extendable by two months) | source | View → | |
| Beneficial owner registration and updates | Iceland | Changes within 2 weeks | source | View → | |
| Lawful processing, notice and data subject rights | Iceland | — | source | View → | |
| Personal data breach notification | Iceland | Without undue delay and, if possible, within 72 hours | source | View → | |
| Incident notification by operators of essential services | Iceland | As soon as possible ('svo fljótt sem verða má') | source | View → | |
| Internal whistleblowing procedures | Iceland | — | source | View → | |
| Report cyber incidents to CERT-In within six hours | India | Within 6 hours of noticing the incident | source | View → | |
| Keep system logs for 180 days within India | India | Rolling 180 days (logs); 5 years (VASP KYC and transaction records) | source | View → | |
| Lawful basis, notice and data subject rights | Indonesia | Ongoing | source | View → | |
| Sustainability report | Indonesia | Annually; 30 April if filed separately from the annual report | source | View → | |
| Corporate social and environmental responsibility | Indonesia | Ongoing; reported in the annual report | source | View → | |
| Internal reporting channels for protected disclosures | Ireland | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Anti-corruption compliance: reasonable steps defence | Ireland | — | source | View → | |
| Weekly working time and rest limits | Ireland | — | source | View → | |
| Non-discrimination in employment | Ireland | — | source | View → | |
| Employer justification for dismissal | Ireland | Claims within 6 months of dismissal | source | View → | |
| Database registration and data subject access | Israel | Ongoing | source | View → | |
| Personal data breach notification | Italy | Without undue delay and, where possible, within 72 hours | source | View → | |
| Whistleblowing channels and protection of reporters | Italy | Ongoing; ANAC acknowledgement within 7 days, feedback within 3 months | source | View → | |
| Security control measures for personal data | Japan | — | source | View → | |
| Consent for provision of personal data to third parties abroad | Japan | Before each transfer | source | View → | |
| Whistleblowing report handling system | Japan | — | source | View → | |
| Working hours limits and overtime agreements | Japan | 40 hours a week; overtime 45 hours a month and 360 hours a year | source | View → | |
| Work rules for employers with ten or more workers | Japan | On preparation and on each change | source | View → | |
| Lawful basis, consent and data subject rights | Kazakhstan | Ongoing | source | View → | |
| Appoint a person responsible for organising personal data processing | Kazakhstan | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Kenya | Ongoing | source | View → | |
| Personal data breach notification | Kenya | Within 72 hours of becoming aware (s.43(1)(a)) | source | View → | |
| Anti-bribery procedures | Kenya | Ongoing | source | View → | |
| Duty to report bribery to the Commission | Kenya | Within 24 hours (s.14) | source | View → | |
| Protection of whistle-blowers and witnesses | Kenya | Ongoing | source | View → | |
| Beneficial ownership register and filing with the Registrar | Kenya | On incorporation and on each change | source | View → | |
| Retention of employment records | Kenya | 5 years after termination (s.10(6)) | source | View → | |
| Declaration of cash above $5,000 at the border | Kiribati | On each entry or exit carrying cash above $5,000 equivalent | source | View → | |
| Lawful basis, notice and data subject rights | Kosovo | Ongoing | source | View → | |
| Personal data breach notification to the Agency | Kosovo | Not later than 72 hours after becoming aware | source | View → | |
| Duty to report corruption and protection of whistleblowers | Kuwait | — | source | View → | |
| Respect data subject rights (access, rectification, erasure, restriction, portability, objection) | Latvia | Respond to requests within one month | source | View → | |
| No adverse consequences for employees who report suspected offences at work | Latvia | — | source | View → | |
| Lawful processing, notice and data subject rights | Lesotho | — | source | View → | |
| Personal data breach notification | Lesotho | As soon as reasonably possible after discovery (s. 23) | source | View → | |
| Beneficial owner identification and reporting to the register | Liechtenstein | Within 30 days of commercial register entry and of each change | source | View → | |
| Lawful basis, notice and data subject rights | Liechtenstein | — | source | View → | |
| Cyber-incident reporting to the Stabsstelle Cyber-Sicherheit | Liechtenstein | Early warning 24 hours; notification 72 hours; final report within one month | source | View → | |
| Record of processing activities | Luxembourg | Ongoing; kept current | source | View → | |
| Lawful basis, notice and data subject rights | Macao | Ongoing | source | View → | |
| Notification of data processing to the public authority | Macao | In writing within 8 days of the start of processing | source | View → | |
| Lawful basis, notice and data subject rights | Madagascar | — | source | View → | |
| Prior declaration or authorisation to the CMIL and data protection officer | Madagascar | Before processing starts | source | View → | |
| Asset and interest declarations by listed officials | Madagascar | Within 3 months of appointment; renewal every 2 years or after a major change | source | View → | |
| Protect people who report corruption | Malawi | Ongoing | source | View → | |
| Give a valid reason and fair procedure before dismissal | Malawi | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Mali | — | source | View → | |
| Asset declaration by public officials | Mali | Before taking office, updated annually, and on leaving office | source | View → | |
| Internal whistleblowing reporting channel | Malta | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Lawful basis, notice to data subjects and data subject rights | Mauritania | — | source | View → | |
| Annual independent IT security audit for critical information infrastructure | Mauritius | Annually or after major changes | source | View → | |
| Registration as data controller or processor | Mauritius | Certificate valid 3 years; renewal application no later than 3 months before expiry | source | View → | |
| Freezing and reporting assets of UN-designated parties | Mauritius | Immediately: without delay and not later than 24 hours (s. 2) | source | View → | |
| Declaration of assets by public officials | Mauritius | Within 30 days of taking office; every 5 years for certain officers | source | View → | |
| Written statement of particulars of employment | Mauritius | For workers engaged for more than one month | source | View → | |
| Monthly payment of remuneration and payslips | Mauritius | Monthly | source | View → | |
| Lawful basis, privacy notice and data subject rights | Mexico | At collection and on request | source | View → | |
| Notify data subjects of security breaches | Mexico | Immediately (no fixed period stated) | source | View → | |
| Adopt an integrity policy (weighed in corporate liability) | Mexico | — | source | View → | |
| Lawful basis, notice and data subject rights | Moldova | Ongoing | source | View → | |
| Personal data breach notification | Moldova | Within 72 hours of becoming aware, where possible | source | View → | |
| Whistleblowing channel and protection from retaliation | Moldova | Ongoing | source | View → | |
| Lawful basis, transparency notice and data subject rights | Monaco | Ongoing; responses generally within one month (art. 10) | source | View → | |
| Personal data breach notification | Monaco | As soon as possible, if possible within 72 hours of becoming aware | source | View → | |
| Notice periods for ending an employment contract | Monaco | Notice 1 to 3 months depending on service | source | View → | |
| Lawful basis, consent and data subject rights | Mongolia | — | source | View → | |
| Personal data breach notification | Mongolia | Immediately (shortest possible duration; no fixed deadline) | source | View → | |
| Cyber-incident notification | Mongolia | Immediately | source | View → | |
| Set up an internal whistleblowing channel | Montenegro | Acknowledge within 7 days; outcome within 45 days | source | View → | |
| Cybersecurity incident declaration to the national authority | Morocco | As soon as the entity becomes aware (Art. 8); without delay (Art. 30) | source | View → | |
| Reporting channel and protection for corruption whistleblowers | Morocco | Ongoing | source | View → | |
| Data subject notice, consent and rights | Morocco | Ongoing | source | View → | |
| Virtual asset service provider licensing | Namibia | Before offering virtual asset services | source | View → | |
| Travel-rule information for virtual asset transfers | Namibia | With each virtual asset transfer | source | View → | |
| Report gratification offers to the Anti-Corruption Commission | Namibia | On receiving or soliciting gratification | source | View → | |
| No prejudice to employees for disclosing information | Namibia | — | source | View → | |
| Nominated officer and beneficial ownership information | Nauru | Notify appointment within 30 days; keep details 7 years | source | View → | |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 13 OCT 2026 | Bank of America, N.A. | United States | Settlement | US$11,662,930 | source |
| 9 OCT 2026 | Pegasus Worldwide Logistics | United States | Settlement | US$175,015 | source |
| 10 SEP 2026 | An Individual | United States | Settlement | US$1,427,230 | source |
| 2 SEP 2026 | Citibank, N.A., London Branch | United Kingdom | Monetary Penalty | £4,732,830.58 | source |
| 19 AUG 2026 | KDDI株式会社 (KDDI Corporation) | Japan | Formal Reprimand | — | source |
| 12 AUG 2026 | Rice Lake Weighing Systems, Inc. | United States | Settlement | US$60,764 | source |
| 21 JUL 2026 | EXTIA | France | Monetary Penalty | €300,000 | source |
| 21 JUL 2026 | Hôpital Privé de la Loire | France | Monetary Penalty · Remedial Direction | €500,000 | source |
| 17 JUN 2026 | Sabre Global Technologies Limited | United Kingdom | Monetary Penalty | £1,000,920.59 | source |
| 10 JUN 2026 | Unnamed data controller (savings finance company; not named in the published summary), Board decision 2026/1183 | Türkiye | Monetary Penalty | TRY 1,000,000 | source |
| 1 JUN 2026 | FTI Consulting, Inc. | United States | Settlement | US$1,050,000 | source |
| 26 MAY 2026 | IQVIA OPERATIONS FRANCE | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 22 MAY 2026 | Central Johannesburg TVET College | South Africa | Remedial Direction | — | source |
| 19 MAY 2026 | Deutsche Bank AG London Branch | United Kingdom | Monetary Penalty | £165,000 | source |
| 18 MAY 2026 | Adani Enterprises Limited | United States | Settlement | US$275,000,000 | source |
| 29 APR 2026 | Blouberg Local Municipality | South Africa | Monetary Penalty | ZAR 250,000≈ US$15,274 | source |
| 17 APR 2026 | Cream della Cream Switzerland GmbH and Philipp Plein International AG | Switzerland | Remedial Direction | — | source |
| 30 MAR 2026 | Apple Distribution International Limited | United Kingdom | Monetary Penalty | £390,000 | source |
| 17 MAR 2026 | TradeStation Securities, Inc. | United States | Settlement | US$1,110,661 | source |
| 25 FEB 2026 | 埼玉県所沢市 (Tokorozawa City, Saitama Prefecture) | Japan | Formal Reprimand | — | source |
| 25 FEB 2026 | An Individual | United States | Settlement | US$3,777,000 | source |
| 12 FEB 2026 | IMG Academy, LLC | United States | Settlement | US$1,720,000 | source |
| 26 JAN 2026 | Bank of Scotland PLC | United Kingdom | Monetary Penalty | £160,000 | source |
| 22 JAN 2026 | FRANCE TRAVAIL | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 8 JAN 2026 | FREE | France | Monetary Penalty · Remedial Direction | €15,000,000 | source |
| No actions for this country. | |||||