Healthcare & Pharma — regulation across countries
| Regulator | Country | Official site |
|---|---|---|
| Applies across all sectors | ||
| IGF Inspection Générale des Finances | Democratic Republic of the Congo | source |
| Arbejdstilsynet (Danish Working Environment Authority) Arbejdstilsynet (Danish Working Environment Authority) | Denmark | source |
| Datatilsynet (Danish Data Protection Agency) Datatilsynet (Danish Data Protection Agency) | Denmark | source |
| Erhvervsstyrelsen (Danish Business Authority) Erhvervsstyrelsen (Danish Business Authority) | Denmark | source |
| NSK Nationale enhed for Særlig Kriminalitet (National Unit for Special Crime) | Denmark | source |
| Integrity Commission Integrity Commission | Dominica | — |
| DGII Dirección General de Impuestos Internos (Internal Revenue Directorate) | Dominican Republic | source |
| UAF Unidad de Análisis Financiero (Financial Analysis Unit) | Dominican Republic | source |
| SPDP Superintendencia de Protección de Datos Personales | Ecuador | source |
| ACA Administrative Control Authority | Egypt | source |
| ACE Agencia de Ciberseguridad del Estado | El Salvador | source |
| AKI Data Protection Inspectorate (Andmekaitse Inspektsioon) | Estonia | source |
| Labour Inspectorate (Tööinspektsioon) Labour Inspectorate (Tööinspektsioon) | Estonia | source |
| Ministry of Justice and Digital Affairs (Justiits- ja Digiministeerium) Ministry of Justice and Digital Affairs (Justiits- ja Digiministeerium) | Estonia | source |
| Prosecutor's Office (Prokuratuur) Prosecutor's Office (Prokuratuur) | Estonia | source |
| EDPA Eswatini Data Protection Authority | Eswatini | source |
| FICAC Fiji Independent Commission Against Corruption | Fiji | source |
| Oikeusministeriö (Ministry of Justice) Oikeusministeriö (Ministry of Justice) | Finland | source |
| PRH Patentti- ja rekisterihallitus (Finnish Patent and Registration Office) | Finland | source |
| FIU Rahanpesun selvittelykeskus (Financial Intelligence Unit, National Bureau of Investigation) | Finland | source |
| Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) | Finland | source |
| AFA Agence française anticorruption | France | source |
| ANSSI Agence nationale de la sécurité des systèmes d'information | France | source |
| Défenseur des droits Défenseur des droits | France | source |
| DG Trésor Direction générale du Trésor | France | source |
| HATVP Haute Autorité pour la transparence de la vie publique | France | source |
| APDPVP Autorité pour la Protection des Données Personnelles et de la Vie Privée (Personal Data and Privacy Protection Authority) | Gabon | source |
| gmCSIRT The Gambia Computer Security Incident Response Team | Gambia | source |
| Anti-Corruption Bureau of Georgia Anti-Corruption Bureau of Georgia | Georgia | source |
| DEA Data Exchange Agency (operator of CERT.GOV.GE) | Georgia | source |
| Labour Inspection Service Labour Inspection Service | Georgia | — |
| BAFA Federal Office for Economic Affairs and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle) | Germany | source |
| BSI Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik) | Germany | source |
| CHRAJ Commission on Human Rights and Administrative Justice | Ghana | source |
| DPC Data Protection Commission | Ghana | source |
| EOCO Economic and Organised Crime Office | Ghana | source |
| FIC Financial Intelligence Centre | Ghana | source |
| OSP Office of the Special Prosecutor | Ghana | source |
| HDPA Hellenic Data Protection Authority | Greece | source |
| NCSA National Cybersecurity Authority | Greece | source |
| NTA National Transparency Authority | Greece | source |
| MARN Ministerio de Ambiente y Recursos Naturales | Guatemala | source |
| FIU Financial Intelligence Unit | Guyana | source |
| Ministry of Labour and Manpower Planning Ministry of Labour and Manpower Planning | Guyana | source |
| UCREF Unité Centrale de Renseignements Financiers | Haiti | source |
| SETRASS Secretaría de Trabajo y Seguridad Social | Honduras | source |
| TSC Tribunal Superior de Cuentas | Honduras | source |
| ICAC Independent Commission Against Corruption | Hong Kong | source |
| Labour Department Labour Department | Hong Kong | source |
| Office of the Commissioner of Critical Infrastructure (Computer-system Security) Office of the Commissioner of Critical Infrastructure (Computer-system Security) | Hong Kong | source |
| Integritás Hatóság (Integrity Authority) Integritás Hatóság (Integrity Authority) | Hungary | source |
| NAIH Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) | Hungary | source |
| NAV PEI Nemzeti Adó- és Vámhivatal Központi Irányítás Pénzmosás és Terrorizmusfinanszírozás Elleni Iroda (NAV Anti-Money Laundering and Counter-Terrorist Financing Office, Hungary's FIU) | Hungary | source |
| Persónuvernd (Icelandic Data Protection Authority) Persónuvernd (Icelandic Data Protection Authority) | Iceland | source |
| Vinnueftirlit ríkisins (Administration of Occupational Safety and Health) Vinnueftirlit ríkisins (Administration of Occupational Safety and Health) | Iceland | source |
| Lokpal of India Lokpal of India | India | source |
| Ministry of Labour and Employment Ministry of Labour and Employment | India | source |
| NCIIPC National Critical Information Infrastructure Protection Centre | India | source |
| KPK Komisi Pemberantasan Korupsi (Corruption Eradication Commission) | Indonesia | source |
| PPATK Pusat Pelaporan dan Analisis Transaksi Keuangan (Indonesian Financial Transaction Reports and Analysis Centre) | Indonesia | source |
| Office of Combating Money Laundering and Terrorist Financing (مكتب مكافحة غسل الأموال وتمويل الإرهاب) Office of Combating Money Laundering and Terrorist Financing (مكتب مكافحة غسل الأموال وتمويل الإرهاب) | Iraq | source |
| CCPC Competition and Consumer Protection Commission | Ireland | source |
| IMPA Israel Money Laundering and Terror Financing Prohibition Authority | Israel | source |
| State Comptroller and Ombudsman of Israel State Comptroller and Ombudsman of Israel | Israel | source |
| AGCM Autorità Garante della Concorrenza e del Mercato | Italy | source |
| Garante per la protezione dei dati personali Garante per la protezione dei dati personali | Italy | source |
| INL Ispettorato Nazionale del Lavoro | Italy | source |
| UIF Unità di Informazione Finanziaria per l'Italia | Italy | source |
| FID Financial Investigations Division | Jamaica | source |
| OIC Office of the Information Commissioner | Jamaica | source |
| Consumer Affairs Agency Consumer Affairs Agency | Japan | source |
| Ministry of Economy, Trade and Industry Ministry of Economy, Trade and Industry | Japan | source |
| Ministry of Health, Labour and Welfare Ministry of Health, Labour and Welfare | Japan | source |
| Ministry of Justice Ministry of Justice | Japan | source |
| AMLU Anti-Money Laundering and Counter-Terrorism Financing Unit | Jordan | source |
| JIACC Jordan Integrity and Anti-Corruption Commission | Jordan | source |
| Ministry of Labour Ministry of Labour | Jordan | source |
| NCSC National Cyber Security Centre | Jordan | source |
| PDPD Personal Data Protection Council and Directorate, Ministry of Digital Economy and Entrepreneurship | Jordan | source |
| Anti-Corruption Agency of the Republic of Kazakhstan (Anti-Corruption Service) Anti-Corruption Agency of the Republic of Kazakhstan (Anti-Corruption Service) | Kazakhstan | source |
| CAK Competition Authority of Kenya | Kenya | source |
| EACC Ethics and Anti-Corruption Commission | Kenya | source |
| ODPC Office of the Data Protection Commissioner | Kenya | source |
| PSO Public Service Office - Integrity and Corruption Control Division (Anti-Corruption Unit) | Kiribati | source |
| AKK Anti-Corruption Agency (Agjencia Kundër Korrupsionit; named in Law No. 08/L-017 as the Agency for the Prevention of Corruption) | Kosovo | source |
| AIP Information and Privacy Agency (Agjencia për Informim dhe Privatësi) | Kosovo | source |
| Nazaha Public Authority for Anti-Corruption (Nazaha) | Kuwait | source |
| CERT.LV CERT.LV (Cyber Incident Response Institution of the Republic of Latvia) | Latvia | source |
| DVI Datu valsts inspekcija (Data State Inspectorate) | Latvia | source |
| Finanšu izlūkošanas dienests (Financial Intelligence Unit of Latvia) Finanšu izlūkošanas dienests (Financial Intelligence Unit of Latvia) | Latvia | source |
| KNAB Korupcijas novēršanas un apkarošanas birojs (Corruption Prevention and Combating Bureau) | Latvia | source |
| Latvijas Republikas Uzņēmumu reģistrs (Register of Enterprises of the Republic of Latvia) Latvijas Republikas Uzņēmumu reģistrs (Register of Enterprises of the Republic of Latvia) | Latvia | source |
| NKDC Nacionālais kiberdrošības centrs (National Cyber Security Centre) | Latvia | source |
| VDI Valsts darba inspekcija (State Labour Inspectorate) | Latvia | source |
| DCEO Directorate on Corruption and Economic Offences | Lesotho | source |
| FIU Financial Intelligence Unit | Lesotho | source |
| EPA Environmental Protection Agency of Liberia | Liberia | source |
| NACC National Anti-Corruption Commission (الهيئة الوطنية لمكافحة الفساد) | Libya | source |
| NISSA National Information Security and Safety Authority (الهيئة الوطنية لأمن وسلامة المعلومات) | Libya | source |
| Amt für Justiz Amt für Justiz | Liechtenstein | source |
| No regulators for this country. | ||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Applies across all sectors | |||||
| Internal whistleblowing reporting procedure | Netherlands | Acknowledgement within 7 days; feedback within 3 months | source | View → | |
| Occupational risk inventory and evaluation | Netherlands | Ongoing | source | View → | |
| No retaliation against employees who make protected disclosures | New Zealand | Ongoing | source | View → | |
| Deal with each other in good faith in the employment relationship | New Zealand | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Niger | — | source | View → | |
| Personal data breach notification to the HAPDP | Niger | Without delay (controller to HAPDP); processor to controller within 72 hours | source | View → | |
| Freeze assets of designated persons and report within 24 hours | Nigeria | Immediately, no later than 24 hours | source | View → | |
| Data privacy impact assessment for high-risk processing | Nigeria | Before processing begins | source | View → | |
| Report persons with significant control | Nigeria | PSC to company within 7 days; company to CAC within one month | source | View → | |
| Written terms of employment and notice of termination | Nigeria | Within 3 months of starting work | source | View → | |
| Beneficial ownership register entry | North Macedonia | Within 15 days of registration and of any change | source | View → | |
| Lawful basis, notice and data subject rights | North Macedonia | — | source | View → | |
| Personal data breach notification | North Macedonia | Immediately and no later than 72 hours after becoming aware | source | View → | |
| Whistleblowing channel and protection | North Macedonia | Reply to the whistleblower within 15 days | source | View → | |
| Report significant incidents under the Digital Security Act | Norway | Without undue delay (sections 8 and 11); NSM states 24 hours for essential-service providers | source | View → | |
| Internal whistleblowing routines | Norway | — | source | View → | |
| Register beneficial owners | Norway | Within 14 days of registration or of a change | source | View → | |
| Consent, notice and data subject rights | Oman | — | source | View → | |
| Protection of workers who complain, and grievance system | Oman | — | source | View → | |
| Protection of whistleblowers from victimisation | Pakistan | Ongoing | source | View → | |
| Cash courier declaration of US$10,000 or more | Palau | On entering or leaving Palau | source | View → | |
| Lawful basis, privacy notice and data subject rights | Peru | — | source | View → | |
| Lawful basis for processing, privacy notice and data subject rights | Philippines | Ongoing | source | View → | |
| Notify the President of UODO of the appointment of a data protection officer | Poland | Within 14 days of designation or change | source | View → | |
| Personal data breach notification to the President of UODO | Poland | Without undue delay and, where feasible, within 72 hours of becoming aware | source | View → | |
| Internal whistleblowing channel and handling of reports | Poland | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Beneficial-owner declaration to the central register (RCBE) | Portugal | Initial and updates within 30 days; annual confirmation by 31 December | source | View → | |
| Lawful basis, notice and data subject rights | Portugal | One month from receipt, extendable by two months | source | View → | |
| Personal data breach notification to the CNPD | Portugal | Within 72 hours of becoming aware | source | View → | |
| Internal whistleblowing channel | Portugal | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Corruption-prevention compliance programme and compliance officer | Portugal | Ongoing; risk plan reviewed every three years | source | View → | |
| Cybersecurity incident notification to the competent authority | Portugal | Initial notification within 24 hours; end-of-impact notice within 24 hours; final report within 30 working days | source | View → | |
| Personal data breach notification to the QFC Data Protection Office | Qatar | Within 72 hours | source | View → | |
| Lawful basis, notice and data subject rights | Republic of the Congo | Ongoing | source | View → | |
| Personal data breach notification | Republic of the Congo | Within 72 hours where possible | source | View → | |
| Cyber-incident notification to the national security agency | Republic of the Congo | Without delay | source | View → | |
| Whistleblower protection and anti-retaliation | Republic of the Congo | Ongoing | source | View → | |
| Public-interest whistleblowing channel and follow-up | Romania | Acknowledge within 7 calendar days; feedback within 3 months | source | View → | |
| Personal data incident notification to the authorised body | Russia | Within 24 hours (initial notice) and within 72 hours (investigation results) | source | View → | |
| Person responsible for organising personal data processing | Russia | Ongoing | source | View → | |
| Lawful processing, consent and data subject rights | Rwanda | Ongoing; 30 days for objection and portability requests | source | View → | |
| Personal data breach notification | Rwanda | Within 48 hours to the NCSA; report within 72 hours | source | View → | |
| Report systems used for cybercrime and cyber threat incidents | Rwanda | On becoming aware | source | View → | |
| Anti-corruption prevention mechanisms in public and private institutions | Rwanda | Ongoing | source | View → | |
| No dismissal for making a complaint against the employer | Saint Kitts and Nevis | — | source | View → | |
| Do not penalise employees for complying with, enforcing or giving evidence under the Labour Act | Saint Lucia | — | source | View → | |
| Do not take employment reprisals against a person who complains to the Special Prosecutor | Saint Lucia | — | source | View → | |
| Beneficial ownership reporting by companies and trusts | San Marino | — | source | View → | |
| Lawful basis, notice and data subject rights | San Marino | — | source | View → | |
| Personal data breach notification | San Marino | Within 72 hours of awareness, where feasible | source | View → | |
| Confidentiality of persons reporting corruption-related facts | San Marino | — | source | View → | |
| Just cause or justified reason for dismissal of permanent staff | San Marino | — | source | View → | |
| Lawful basis, information to data subjects and data subject rights | São Tomé and Príncipe | Ongoing | source | View → | |
| Appoint a personal data protection officer | Saudi Arabia | Ongoing, in the listed cases | source | View → | |
| Lawful basis, notice and data subject rights | Senegal | — | source | View → | |
| Notify significant ICT incidents to the competent authority | Serbia | Within 24 hours of learning of the incident | source | View → | |
| Lawful basis, notice and data subject rights | Serbia | Ongoing; response within 30 days | source | View → | |
| Internal whistleblowing procedure | Serbia | Rules adopted and published; reports acted on within 15 days | source | View → | |
| Beneficial ownership register and updates | Seychelles | Within 14 days of a declaration or change | source | View → | |
| Lawful basis, notice and data subject rights | Seychelles | Ongoing | source | View → | |
| Personal data breach notification | Seychelles | Not later than 72 hours after becoming aware | source | View → | |
| Written particulars of employment | Sierra Leone | Within 12 weeks of the start date | source | View → | |
| Internal whistleblowing channel | Slovenia | Acknowledge within 7 days; outcome within 3 months | source | View → | |
| Prohibition of retaliation against reporting persons | Slovenia | — | source | View → | |
| Whistleblowing channel: authorise internal procedures for protected disclosures | South Africa | Ongoing | source | View → | |
| Protect employees who report corrupt practices | South Sudan | — | source | View → | |
| Declare income, assets and liabilities to the Anti-Corruption Commission | South Sudan | Within 30 days of taking office, then annually by the end of February | source | View → | |
| Beneficial ownership declaration to the Central Register | Spain | Within 1 month of formation; updates within 10 days; annual declaration in January | source | View → | |
| Notification of security incidents through the reference CSIRT | Spain | Initial notification without undue delay, then intermediate and final (Art. 22) | source | View → | |
| Internal whistleblowing channel | Spain | Ongoing; acknowledgement within 7 calendar days; response within 3 months | source | View → | |
| Anti-bribery and criminal compliance model | Spain | Ongoing (exemption condition) | source | View → | |
| Lawful basis, transparency and data subject rights | Spain | Ongoing | source | View → | |
| Personal data breach notification to the AEPD | Spain | Within 72 hours of becoming aware | source | View → | |
| Lawful basis, notice and data subject rights | Sri Lanka | Ongoing | source | View → | |
| Credit information: customer access, appeal and correction of errors | Sudan | Ongoing; appeals reviewed within 15 days | source | View → | |
| Registration with FIU Suriname | Suriname | Within 3 months of starting business (Art. 28) | source | View → | |
| Internal reporting channels for employers with 50 or more employees | Sweden | Ongoing | source | View → | |
| Cyber incident reporting by essential and important entities | Sweden | Early warning within 24 hours; notification within 24 hours (trust services) or 72 hours (others); final report within one month | source | View → | |
| Personal data breach notification to IMY | Sweden | Within 72 hours of becoming aware | source | View → | |
| Lawful grounds, information to individuals and data subject rights | Sweden | Ongoing | source | View → | |
| Beneficial ownership information held and filed with Bolagsverket | Sweden | At registration or within four weeks; changes without delay | source | View → | |
| Information to data subjects and right of access | Switzerland | Ongoing; access requests answered within 30 days (Art. 25 para. 7) | source | View → | |
| Notifying the FDPIC of a data security breach | Switzerland | As quickly as possible | source | View → | |
| Due diligence and reporting on conflict minerals and child labour | Switzerland | Ongoing | source | View → | |
| Prohibition of retaliation against public interest whistleblowers | Taiwan | Ongoing | source | View → | |
| Protection of workers who report labour law violations | Taiwan | Authority to notify the worker within 60 days of the complaint | source | View → | |
| State protection for persons who help counter corruption | Tajikistan | — | source | View → | |
| Lawful basis, notice and data subject rights | Tanzania | Ongoing | source | View → | |
| Personal data breach notification | Tanzania | Without any undue delay | source | View → | |
| Registration as a data controller or processor | Tanzania | Before processing; renew every 5 years | source | View → | |
| Whistleblower disclosure channel and protection | Tanzania | Ongoing | source | View → | |
| Written employment contract and particulars; five-year retention | Tanzania | 5 years after termination | source | View → | |
| Personal data breach notification | Thailand | Within 72 hours of becoming aware, where feasible | source | View → | |
| Accept and protect whistleblower reports | Timor-Leste | — | source | View → | |
| No dismissal for lodging a complaint with the authorities | Timor-Leste | — | source | View → | |
| Lawful basis, notice and data subject rights | Togo | Ongoing | source | View → | |
| Personal data breach notification | Tonga | Within 72 hours of becoming aware | source | View → | |
| Cyber-incident reporting and annual security audit | Tunisia | Immediately | source | View → | |
| Whistleblowing: internal reporting unit in public bodies | Tunisia | — | source | View → | |
| Lawful basis, notice and data subject rights | Türkiye | At collection + on request | source | View → | |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 13 OCT 2026 | Bank of America, N.A. | United States | Settlement | US$11,662,930 | source |
| 9 OCT 2026 | Pegasus Worldwide Logistics | United States | Settlement | US$175,015 | source |
| 10 SEP 2026 | An Individual | United States | Settlement | US$1,427,230 | source |
| 2 SEP 2026 | Citibank, N.A., London Branch | United Kingdom | Monetary Penalty | £4,732,830.58 | source |
| 19 AUG 2026 | KDDI株式会社 (KDDI Corporation) | Japan | Formal Reprimand | — | source |
| 12 AUG 2026 | Rice Lake Weighing Systems, Inc. | United States | Settlement | US$60,764 | source |
| 21 JUL 2026 | EXTIA | France | Monetary Penalty | €300,000 | source |
| 21 JUL 2026 | Hôpital Privé de la Loire | France | Monetary Penalty · Remedial Direction | €500,000 | source |
| 17 JUN 2026 | Sabre Global Technologies Limited | United Kingdom | Monetary Penalty | £1,000,920.59 | source |
| 10 JUN 2026 | Unnamed data controller (savings finance company; not named in the published summary), Board decision 2026/1183 | Türkiye | Monetary Penalty | TRY 1,000,000 | source |
| 1 JUN 2026 | FTI Consulting, Inc. | United States | Settlement | US$1,050,000 | source |
| 26 MAY 2026 | IQVIA OPERATIONS FRANCE | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 22 MAY 2026 | Central Johannesburg TVET College | South Africa | Remedial Direction | — | source |
| 19 MAY 2026 | Deutsche Bank AG London Branch | United Kingdom | Monetary Penalty | £165,000 | source |
| 18 MAY 2026 | Adani Enterprises Limited | United States | Settlement | US$275,000,000 | source |
| 29 APR 2026 | Blouberg Local Municipality | South Africa | Monetary Penalty | ZAR 250,000≈ US$15,274 | source |
| 17 APR 2026 | Cream della Cream Switzerland GmbH and Philipp Plein International AG | Switzerland | Remedial Direction | — | source |
| 30 MAR 2026 | Apple Distribution International Limited | United Kingdom | Monetary Penalty | £390,000 | source |
| 17 MAR 2026 | TradeStation Securities, Inc. | United States | Settlement | US$1,110,661 | source |
| 25 FEB 2026 | 埼玉県所沢市 (Tokorozawa City, Saitama Prefecture) | Japan | Formal Reprimand | — | source |
| 25 FEB 2026 | An Individual | United States | Settlement | US$3,777,000 | source |
| 12 FEB 2026 | IMG Academy, LLC | United States | Settlement | US$1,720,000 | source |
| 26 JAN 2026 | Bank of Scotland PLC | United Kingdom | Monetary Penalty | £160,000 | source |
| 22 JAN 2026 | FRANCE TRAVAIL | France | Monetary Penalty · Remedial Direction | €5,000,000 | source |
| 8 JAN 2026 | FREE | France | Monetary Penalty · Remedial Direction | €15,000,000 | source |
| No actions for this country. | |||||