Healthcare & Pharma — regulation across countries
| Regulator | Country | Official site |
|---|---|---|
| Applies across all sectors | ||
| IGF Inspection Générale des Finances | Democratic Republic of the Congo | source |
| Arbejdstilsynet (Danish Working Environment Authority) Arbejdstilsynet (Danish Working Environment Authority) | Denmark | source |
| Datatilsynet (Danish Data Protection Agency) Datatilsynet (Danish Data Protection Agency) | Denmark | source |
| Erhvervsstyrelsen (Danish Business Authority) Erhvervsstyrelsen (Danish Business Authority) | Denmark | source |
| NSK Nationale enhed for Særlig Kriminalitet (National Unit for Special Crime) | Denmark | source |
| Integrity Commission Integrity Commission | Dominica | — |
| DGII Dirección General de Impuestos Internos (Internal Revenue Directorate) | Dominican Republic | source |
| UAF Unidad de Análisis Financiero (Financial Analysis Unit) | Dominican Republic | source |
| SPDP Superintendencia de Protección de Datos Personales | Ecuador | source |
| ACA Administrative Control Authority | Egypt | source |
| ACE Agencia de Ciberseguridad del Estado | El Salvador | source |
| AKI Data Protection Inspectorate (Andmekaitse Inspektsioon) | Estonia | source |
| Labour Inspectorate (Tööinspektsioon) Labour Inspectorate (Tööinspektsioon) | Estonia | source |
| Ministry of Justice and Digital Affairs (Justiits- ja Digiministeerium) Ministry of Justice and Digital Affairs (Justiits- ja Digiministeerium) | Estonia | source |
| Prosecutor's Office (Prokuratuur) Prosecutor's Office (Prokuratuur) | Estonia | source |
| EDPA Eswatini Data Protection Authority | Eswatini | source |
| FICAC Fiji Independent Commission Against Corruption | Fiji | source |
| Oikeusministeriö (Ministry of Justice) Oikeusministeriö (Ministry of Justice) | Finland | source |
| PRH Patentti- ja rekisterihallitus (Finnish Patent and Registration Office) | Finland | source |
| FIU Rahanpesun selvittelykeskus (Financial Intelligence Unit, National Bureau of Investigation) | Finland | source |
| Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) | Finland | source |
| AFA Agence française anticorruption | France | source |
| ANSSI Agence nationale de la sécurité des systèmes d'information | France | source |
| Défenseur des droits Défenseur des droits | France | source |
| DG Trésor Direction générale du Trésor | France | source |
| HATVP Haute Autorité pour la transparence de la vie publique | France | source |
| APDPVP Autorité pour la Protection des Données Personnelles et de la Vie Privée (Personal Data and Privacy Protection Authority) | Gabon | source |
| gmCSIRT The Gambia Computer Security Incident Response Team | Gambia | source |
| Anti-Corruption Bureau of Georgia Anti-Corruption Bureau of Georgia | Georgia | source |
| DEA Data Exchange Agency (operator of CERT.GOV.GE) | Georgia | source |
| Labour Inspection Service Labour Inspection Service | Georgia | — |
| BAFA Federal Office for Economic Affairs and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle) | Germany | source |
| BSI Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik) | Germany | source |
| CHRAJ Commission on Human Rights and Administrative Justice | Ghana | source |
| DPC Data Protection Commission | Ghana | source |
| EOCO Economic and Organised Crime Office | Ghana | source |
| FIC Financial Intelligence Centre | Ghana | source |
| OSP Office of the Special Prosecutor | Ghana | source |
| HDPA Hellenic Data Protection Authority | Greece | source |
| NCSA National Cybersecurity Authority | Greece | source |
| NTA National Transparency Authority | Greece | source |
| MARN Ministerio de Ambiente y Recursos Naturales | Guatemala | source |
| FIU Financial Intelligence Unit | Guyana | source |
| Ministry of Labour and Manpower Planning Ministry of Labour and Manpower Planning | Guyana | source |
| UCREF Unité Centrale de Renseignements Financiers | Haiti | source |
| SETRASS Secretaría de Trabajo y Seguridad Social | Honduras | source |
| TSC Tribunal Superior de Cuentas | Honduras | source |
| ICAC Independent Commission Against Corruption | Hong Kong | source |
| Labour Department Labour Department | Hong Kong | source |
| Office of the Commissioner of Critical Infrastructure (Computer-system Security) Office of the Commissioner of Critical Infrastructure (Computer-system Security) | Hong Kong | source |
| Integritás Hatóság (Integrity Authority) Integritás Hatóság (Integrity Authority) | Hungary | source |
| NAIH Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) | Hungary | source |
| NAV PEI Nemzeti Adó- és Vámhivatal Központi Irányítás Pénzmosás és Terrorizmusfinanszírozás Elleni Iroda (NAV Anti-Money Laundering and Counter-Terrorist Financing Office, Hungary's FIU) | Hungary | source |
| Persónuvernd (Icelandic Data Protection Authority) Persónuvernd (Icelandic Data Protection Authority) | Iceland | source |
| Vinnueftirlit ríkisins (Administration of Occupational Safety and Health) Vinnueftirlit ríkisins (Administration of Occupational Safety and Health) | Iceland | source |
| Lokpal of India Lokpal of India | India | source |
| Ministry of Labour and Employment Ministry of Labour and Employment | India | source |
| NCIIPC National Critical Information Infrastructure Protection Centre | India | source |
| KPK Komisi Pemberantasan Korupsi (Corruption Eradication Commission) | Indonesia | source |
| PPATK Pusat Pelaporan dan Analisis Transaksi Keuangan (Indonesian Financial Transaction Reports and Analysis Centre) | Indonesia | source |
| Office of Combating Money Laundering and Terrorist Financing (مكتب مكافحة غسل الأموال وتمويل الإرهاب) Office of Combating Money Laundering and Terrorist Financing (مكتب مكافحة غسل الأموال وتمويل الإرهاب) | Iraq | source |
| CCPC Competition and Consumer Protection Commission | Ireland | source |
| IMPA Israel Money Laundering and Terror Financing Prohibition Authority | Israel | source |
| State Comptroller and Ombudsman of Israel State Comptroller and Ombudsman of Israel | Israel | source |
| AGCM Autorità Garante della Concorrenza e del Mercato | Italy | source |
| Garante per la protezione dei dati personali Garante per la protezione dei dati personali | Italy | source |
| INL Ispettorato Nazionale del Lavoro | Italy | source |
| UIF Unità di Informazione Finanziaria per l'Italia | Italy | source |
| FID Financial Investigations Division | Jamaica | source |
| OIC Office of the Information Commissioner | Jamaica | source |
| Consumer Affairs Agency Consumer Affairs Agency | Japan | source |
| Ministry of Economy, Trade and Industry Ministry of Economy, Trade and Industry | Japan | source |
| Ministry of Health, Labour and Welfare Ministry of Health, Labour and Welfare | Japan | source |
| Ministry of Justice Ministry of Justice | Japan | source |
| AMLU Anti-Money Laundering and Counter-Terrorism Financing Unit | Jordan | source |
| JIACC Jordan Integrity and Anti-Corruption Commission | Jordan | source |
| Ministry of Labour Ministry of Labour | Jordan | source |
| NCSC National Cyber Security Centre | Jordan | source |
| PDPD Personal Data Protection Council and Directorate, Ministry of Digital Economy and Entrepreneurship | Jordan | source |
| Anti-Corruption Agency of the Republic of Kazakhstan (Anti-Corruption Service) Anti-Corruption Agency of the Republic of Kazakhstan (Anti-Corruption Service) | Kazakhstan | source |
| CAK Competition Authority of Kenya | Kenya | source |
| EACC Ethics and Anti-Corruption Commission | Kenya | source |
| ODPC Office of the Data Protection Commissioner | Kenya | source |
| PSO Public Service Office - Integrity and Corruption Control Division (Anti-Corruption Unit) | Kiribati | source |
| AKK Anti-Corruption Agency (Agjencia Kundër Korrupsionit; named in Law No. 08/L-017 as the Agency for the Prevention of Corruption) | Kosovo | source |
| AIP Information and Privacy Agency (Agjencia për Informim dhe Privatësi) | Kosovo | source |
| Nazaha Public Authority for Anti-Corruption (Nazaha) | Kuwait | source |
| CERT.LV CERT.LV (Cyber Incident Response Institution of the Republic of Latvia) | Latvia | source |
| DVI Datu valsts inspekcija (Data State Inspectorate) | Latvia | source |
| Finanšu izlūkošanas dienests (Financial Intelligence Unit of Latvia) Finanšu izlūkošanas dienests (Financial Intelligence Unit of Latvia) | Latvia | source |
| KNAB Korupcijas novēršanas un apkarošanas birojs (Corruption Prevention and Combating Bureau) | Latvia | source |
| Latvijas Republikas Uzņēmumu reģistrs (Register of Enterprises of the Republic of Latvia) Latvijas Republikas Uzņēmumu reģistrs (Register of Enterprises of the Republic of Latvia) | Latvia | source |
| NKDC Nacionālais kiberdrošības centrs (National Cyber Security Centre) | Latvia | source |
| VDI Valsts darba inspekcija (State Labour Inspectorate) | Latvia | source |
| DCEO Directorate on Corruption and Economic Offences | Lesotho | source |
| FIU Financial Intelligence Unit | Lesotho | source |
| EPA Environmental Protection Agency of Liberia | Liberia | source |
| NACC National Anti-Corruption Commission (الهيئة الوطنية لمكافحة الفساد) | Libya | source |
| NISSA National Information Security and Safety Authority (الهيئة الوطنية لأمن وسلامة المعلومات) | Libya | source |
| Amt für Justiz Amt für Justiz | Liechtenstein | source |
| No regulators for this country. | ||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Applies across all sectors | |||||
| Incident notification to the National Cybersecurity Authority (NIS2) | Greece | Early warning 24 hours; update 72 hours; final report 1 month | source | View → | |
| Protection of public officers who make protected disclosures | Grenada | Ongoing | source | View → | |
| No victimisation of employees who complain or take part in proceedings | Grenada | Ongoing | source | View → | |
| Valid reason, written notice and termination allowance on dismissal | Grenada | Event-triggered on dismissal; complaint to the Labour Commissioner within 3 months (s.82) | source | View → | |
| Handling of personal data by public bodies: consent, access and correction | Guatemala | — | source | View → | |
| Annual declaration of income, assets and liabilities by persons in public life | Guyana | Annually on or before 30 June | source | View → | |
| Beneficial ownership registration and annual update | Honduras | Annually by 30 May; changes within the first 10 business days of the following month | source | View → | |
| Employment contracts and changes in writing | Honduras | At hiring and on any change | source | View → | |
| No reprisals against workers for exercising labour rights | Honduras | Ongoing | source | View → | |
| Employer duties to employees admitted to the witness protection programme | Honduras | Event-triggered on admission to the programme | source | View → | |
| Report computer-system security incidents to the Commissioner's Office | Hong Kong | 12 hours (serious) or 48 hours (other); written report within 14 days | source | View → | |
| Pay wages within seven days of the wage period | Hong Kong | Within 7 days after the wage period ends | source | View → | |
| Keep wage and employment records | Hong Kong | 12 months of history; keep for 6 months after employment ends | source | View → | |
| No dismissal for giving evidence or union activity | Hong Kong | Applies at all times | source | View → | |
| Make mandatory MPF contributions for employees | Hong Kong | Monthly, by the 10th of the following month | source | View → | |
| Private-sector agents must not accept advantages without principal's permission | Hong Kong | Applies at all times | source | View → | |
| Cybersecurity registration of covered organisations | Hungary | Within 30 days of coming under the Act | source | View → | |
| Data subject rights | Hungary | Within one month of request (extendable by two months) | source | View → | |
| Beneficial owner registration and updates | Iceland | Changes within 2 weeks | source | View → | |
| Lawful processing, notice and data subject rights | Iceland | — | source | View → | |
| Personal data breach notification | Iceland | Without undue delay and, if possible, within 72 hours | source | View → | |
| Incident notification by operators of essential services | Iceland | As soon as possible ('svo fljótt sem verða má') | source | View → | |
| Internal whistleblowing procedures | Iceland | — | source | View → | |
| Report cyber incidents to CERT-In within six hours | India | Within 6 hours of noticing the incident | source | View → | |
| Keep system logs for 180 days within India | India | Rolling 180 days (logs); 5 years (VASP KYC and transaction records) | source | View → | |
| Lawful basis, notice and data subject rights | Indonesia | Ongoing | source | View → | |
| Sustainability report | Indonesia | Annually; 30 April if filed separately from the annual report | source | View → | |
| Corporate social and environmental responsibility | Indonesia | Ongoing; reported in the annual report | source | View → | |
| Internal reporting channels for protected disclosures | Ireland | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Anti-corruption compliance: reasonable steps defence | Ireland | — | source | View → | |
| Weekly working time and rest limits | Ireland | — | source | View → | |
| Non-discrimination in employment | Ireland | — | source | View → | |
| Employer justification for dismissal | Ireland | Claims within 6 months of dismissal | source | View → | |
| Database registration and data subject access | Israel | Ongoing | source | View → | |
| Personal data breach notification | Italy | Without undue delay and, where possible, within 72 hours | source | View → | |
| Whistleblowing channels and protection of reporters | Italy | Ongoing; ANAC acknowledgement within 7 days, feedback within 3 months | source | View → | |
| Security control measures for personal data | Japan | — | source | View → | |
| Consent for provision of personal data to third parties abroad | Japan | Before each transfer | source | View → | |
| Whistleblowing report handling system | Japan | — | source | View → | |
| Working hours limits and overtime agreements | Japan | 40 hours a week; overtime 45 hours a month and 360 hours a year | source | View → | |
| Work rules for employers with ten or more workers | Japan | On preparation and on each change | source | View → | |
| Lawful basis, consent and data subject rights | Kazakhstan | Ongoing | source | View → | |
| Appoint a person responsible for organising personal data processing | Kazakhstan | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Kenya | Ongoing | source | View → | |
| Personal data breach notification | Kenya | Within 72 hours of becoming aware (s.43(1)(a)) | source | View → | |
| Anti-bribery procedures | Kenya | Ongoing | source | View → | |
| Duty to report bribery to the Commission | Kenya | Within 24 hours (s.14) | source | View → | |
| Protection of whistle-blowers and witnesses | Kenya | Ongoing | source | View → | |
| Beneficial ownership register and filing with the Registrar | Kenya | On incorporation and on each change | source | View → | |
| Retention of employment records | Kenya | 5 years after termination (s.10(6)) | source | View → | |
| Declaration of cash above $5,000 at the border | Kiribati | On each entry or exit carrying cash above $5,000 equivalent | source | View → | |
| Lawful basis, notice and data subject rights | Kosovo | Ongoing | source | View → | |
| Personal data breach notification to the Agency | Kosovo | Not later than 72 hours after becoming aware | source | View → | |
| Duty to report corruption and protection of whistleblowers | Kuwait | — | source | View → | |
| Respect data subject rights (access, rectification, erasure, restriction, portability, objection) | Latvia | Respond to requests within one month | source | View → | |
| No adverse consequences for employees who report suspected offences at work | Latvia | — | source | View → | |
| Lawful processing, notice and data subject rights | Lesotho | — | source | View → | |
| Personal data breach notification | Lesotho | As soon as reasonably possible after discovery (s. 23) | source | View → | |
| Beneficial owner identification and reporting to the register | Liechtenstein | Within 30 days of commercial register entry and of each change | source | View → | |
| Lawful basis, notice and data subject rights | Liechtenstein | — | source | View → | |
| Cyber-incident reporting to the Stabsstelle Cyber-Sicherheit | Liechtenstein | Early warning 24 hours; notification 72 hours; final report within one month | source | View → | |
| Record of processing activities | Luxembourg | Ongoing; kept current | source | View → | |
| Lawful basis, notice and data subject rights | Macao | Ongoing | source | View → | |
| Notification of data processing to the public authority | Macao | In writing within 8 days of the start of processing | source | View → | |
| Lawful basis, notice and data subject rights | Madagascar | — | source | View → | |
| Prior declaration or authorisation to the CMIL and data protection officer | Madagascar | Before processing starts | source | View → | |
| Asset and interest declarations by listed officials | Madagascar | Within 3 months of appointment; renewal every 2 years or after a major change | source | View → | |
| Protect people who report corruption | Malawi | Ongoing | source | View → | |
| Give a valid reason and fair procedure before dismissal | Malawi | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Mali | — | source | View → | |
| Asset declaration by public officials | Mali | Before taking office, updated annually, and on leaving office | source | View → | |
| Internal whistleblowing reporting channel | Malta | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Lawful basis, notice to data subjects and data subject rights | Mauritania | — | source | View → | |
| Annual independent IT security audit for critical information infrastructure | Mauritius | Annually or after major changes | source | View → | |
| Registration as data controller or processor | Mauritius | Certificate valid 3 years; renewal application no later than 3 months before expiry | source | View → | |
| Freezing and reporting assets of UN-designated parties | Mauritius | Immediately: without delay and not later than 24 hours (s. 2) | source | View → | |
| Declaration of assets by public officials | Mauritius | Within 30 days of taking office; every 5 years for certain officers | source | View → | |
| Written statement of particulars of employment | Mauritius | For workers engaged for more than one month | source | View → | |
| Monthly payment of remuneration and payslips | Mauritius | Monthly | source | View → | |
| Lawful basis, privacy notice and data subject rights | Mexico | At collection and on request | source | View → | |
| Notify data subjects of security breaches | Mexico | Immediately (no fixed period stated) | source | View → | |
| Adopt an integrity policy (weighed in corporate liability) | Mexico | — | source | View → | |
| Lawful basis, notice and data subject rights | Moldova | Ongoing | source | View → | |
| Personal data breach notification | Moldova | Within 72 hours of becoming aware, where possible | source | View → | |
| Whistleblowing channel and protection from retaliation | Moldova | Ongoing | source | View → | |
| Lawful basis, transparency notice and data subject rights | Monaco | Ongoing; responses generally within one month (art. 10) | source | View → | |
| Personal data breach notification | Monaco | As soon as possible, if possible within 72 hours of becoming aware | source | View → | |
| Notice periods for ending an employment contract | Monaco | Notice 1 to 3 months depending on service | source | View → | |
| Lawful basis, consent and data subject rights | Mongolia | — | source | View → | |
| Personal data breach notification | Mongolia | Immediately (shortest possible duration; no fixed deadline) | source | View → | |
| Cyber-incident notification | Mongolia | Immediately | source | View → | |
| Set up an internal whistleblowing channel | Montenegro | Acknowledge within 7 days; outcome within 45 days | source | View → | |
| Cybersecurity incident declaration to the national authority | Morocco | As soon as the entity becomes aware (Art. 8); without delay (Art. 30) | source | View → | |
| Reporting channel and protection for corruption whistleblowers | Morocco | Ongoing | source | View → | |
| Data subject notice, consent and rights | Morocco | Ongoing | source | View → | |
| Virtual asset service provider licensing | Namibia | Before offering virtual asset services | source | View → | |
| Travel-rule information for virtual asset transfers | Namibia | With each virtual asset transfer | source | View → | |
| Report gratification offers to the Anti-Corruption Commission | Namibia | On receiving or soliciting gratification | source | View → | |
| No prejudice to employees for disclosing information | Namibia | — | source | View → | |
| Nominated officer and beneficial ownership information | Nauru | Notify appointment within 30 days; keep details 7 years | source | View → | |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 13 OCT 2026 | Bank of America, N.A. | United States | Settlement | US$11,662,930 | source |
| 9 OCT 2026 | Pegasus Worldwide Logistics | United States | Settlement | US$175,015 | source |
| 10 SEP 2026 | An Individual | United States | Settlement | US$1,427,230 | source |
| 2 SEP 2026 | Citibank, N.A., London Branch | United Kingdom | Monetary Penalty | £4,732,830.58 | source |
| 19 AUG 2026 | KDDI株式会社 (KDDI Corporation) | Japan | Formal Reprimand | — | source |
| 12 AUG 2026 | Rice Lake Weighing Systems, Inc. | United States | Settlement | US$60,764 | source |
| 21 JUL 2026 | EXTIA | France | Monetary Penalty | €300,000 | source |
| 21 JUL 2026 | Hôpital Privé de la Loire | France | Monetary Penalty · Remedial Direction | €500,000 | source |
| 17 JUN 2026 | Sabre Global Technologies Limited | United Kingdom | Monetary Penalty | £1,000,920.59 | source |
| 10 JUN 2026 | Unnamed data controller (savings finance company; not named in the published summary), Board decision 2026/1183 | Türkiye | Monetary Penalty | TRY 1,000,000 | source |
| 1 JUN 2026 | FTI Consulting, Inc. | United States | Settlement | US$1,050,000 | source |
| 26 MAY 2026 | IQVIA OPERATIONS FRANCE | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 22 MAY 2026 | Central Johannesburg TVET College | South Africa | Remedial Direction | — | source |
| 19 MAY 2026 | Deutsche Bank AG London Branch | United Kingdom | Monetary Penalty | £165,000 | source |
| 18 MAY 2026 | Adani Enterprises Limited | United States | Settlement | US$275,000,000 | source |
| 29 APR 2026 | Blouberg Local Municipality | South Africa | Monetary Penalty | ZAR 250,000≈ US$15,274 | source |
| 17 APR 2026 | Cream della Cream Switzerland GmbH and Philipp Plein International AG | Switzerland | Remedial Direction | — | source |
| 30 MAR 2026 | Apple Distribution International Limited | United Kingdom | Monetary Penalty | £390,000 | source |
| 17 MAR 2026 | TradeStation Securities, Inc. | United States | Settlement | US$1,110,661 | source |
| 25 FEB 2026 | 埼玉県所沢市 (Tokorozawa City, Saitama Prefecture) | Japan | Formal Reprimand | — | source |
| 25 FEB 2026 | An Individual | United States | Settlement | US$3,777,000 | source |
| 12 FEB 2026 | IMG Academy, LLC | United States | Settlement | US$1,720,000 | source |
| 26 JAN 2026 | Bank of Scotland PLC | United Kingdom | Monetary Penalty | £160,000 | source |
| 22 JAN 2026 | FRANCE TRAVAIL | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 8 JAN 2026 | FREE | France | Monetary Penalty · Remedial Direction | €15,000,000 | source |
| No actions for this country. | |||||