Applies across all sectors
Internal whistleblowing reporting procedure Netherlands Acknowledgement within 7 days; feedback within 3 months
— source View →
Occupational risk inventory and evaluation Netherlands Ongoing
— source View →
No retaliation against employees who make protected disclosures New Zealand Ongoing
— source View →
Deal with each other in good faith in the employment relationship New Zealand Ongoing
— source View →
Lawful basis, notice and data subject rights Niger — — source View →
Personal data breach notification to the HAPDP Niger Without delay (controller to HAPDP); processor to controller within 72 hours
— source View →
Freeze assets of designated persons and report within 24 hours Nigeria Immediately, no later than 24 hours
— source View →
Data privacy impact assessment for high-risk processing Nigeria Before processing begins
— source View →
Report persons with significant control Nigeria PSC to company within 7 days; company to CAC within one month
— source View →
Written terms of employment and notice of termination Nigeria Within 3 months of starting work
— source View →
Beneficial ownership register entry North Macedonia Within 15 days of registration and of any change
— source View →
Lawful basis, notice and data subject rights North Macedonia — — source View →
Personal data breach notification North Macedonia Immediately and no later than 72 hours after becoming aware
— source View →
Whistleblowing channel and protection North Macedonia Reply to the whistleblower within 15 days
— source View →
Report significant incidents under the Digital Security Act Norway Without undue delay (sections 8 and 11); NSM states 24 hours for essential-service providers
— source View →
Internal whistleblowing routines Norway — — source View →
Register beneficial owners Norway Within 14 days of registration or of a change
— source View →
Consent, notice and data subject rights Oman — — source View →
Protection of workers who complain, and grievance system Oman — — source View →
Protection of whistleblowers from victimisation Pakistan Ongoing
— source View →
Cash courier declaration of US$10,000 or more Palau On entering or leaving Palau
— source View →
Lawful basis, privacy notice and data subject rights Peru — — source View →
Lawful basis for processing, privacy notice and data subject rights Philippines Ongoing
— source View →
Notify the President of UODO of the appointment of a data protection officer Poland Within 14 days of designation or change
— source View →
Personal data breach notification to the President of UODO Poland Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
Internal whistleblowing channel and handling of reports Poland Acknowledge within 7 days; feedback within 3 months
— source View →
Beneficial-owner declaration to the central register (RCBE) Portugal Initial and updates within 30 days; annual confirmation by 31 December
— source View →
Lawful basis, notice and data subject rights Portugal One month from receipt, extendable by two months
— source View →
Personal data breach notification to the CNPD Portugal Within 72 hours of becoming aware
— source View →
Internal whistleblowing channel Portugal Acknowledge within 7 days; feedback within 3 months
— source View →
Corruption-prevention compliance programme and compliance officer Portugal Ongoing; risk plan reviewed every three years
— source View →
Cybersecurity incident notification to the competent authority Portugal Initial notification within 24 hours; end-of-impact notice within 24 hours; final report within 30 working days
— source View →
Personal data breach notification to the QFC Data Protection Office Qatar Within 72 hours
— source View →
Lawful basis, notice and data subject rights Republic of the Congo Ongoing
— source View →
Personal data breach notification Republic of the Congo Within 72 hours where possible
— source View →
Cyber-incident notification to the national security agency Republic of the Congo Without delay
— source View →
Whistleblower protection and anti-retaliation Republic of the Congo Ongoing
— source View →
Public-interest whistleblowing channel and follow-up Romania Acknowledge within 7 calendar days; feedback within 3 months
— source View →
Personal data incident notification to the authorised body Russia Within 24 hours (initial notice) and within 72 hours (investigation results)
— source View →
Person responsible for organising personal data processing Russia Ongoing
— source View →
Lawful processing, consent and data subject rights Rwanda Ongoing; 30 days for objection and portability requests
— source View →
Personal data breach notification Rwanda Within 48 hours to the NCSA; report within 72 hours
— source View →
Report systems used for cybercrime and cyber threat incidents Rwanda On becoming aware
— source View →
Anti-corruption prevention mechanisms in public and private institutions Rwanda Ongoing
— source View →
No dismissal for making a complaint against the employer Saint Kitts and Nevis — — source View →
Do not penalise employees for complying with, enforcing or giving evidence under the Labour Act Saint Lucia — — source View →
Do not take employment reprisals against a person who complains to the Special Prosecutor Saint Lucia — — source View →
Beneficial ownership reporting by companies and trusts San Marino — — source View →
Lawful basis, notice and data subject rights San Marino — — source View →
Personal data breach notification San Marino Within 72 hours of awareness, where feasible
— source View →
Confidentiality of persons reporting corruption-related facts San Marino — — source View →
Just cause or justified reason for dismissal of permanent staff San Marino — — source View →
Lawful basis, information to data subjects and data subject rights São Tomé and Príncipe Ongoing
— source View →
Appoint a personal data protection officer Saudi Arabia Ongoing, in the listed cases
— source View →
Lawful basis, notice and data subject rights Senegal — — source View →
Notify significant ICT incidents to the competent authority Serbia Within 24 hours of learning of the incident
— source View →
Lawful basis, notice and data subject rights Serbia Ongoing; response within 30 days
— source View →
Internal whistleblowing procedure Serbia Rules adopted and published; reports acted on within 15 days
— source View →
Beneficial ownership register and updates Seychelles Within 14 days of a declaration or change
— source View →
Lawful basis, notice and data subject rights Seychelles Ongoing
— source View →
Personal data breach notification Seychelles Not later than 72 hours after becoming aware
— source View →
Written particulars of employment Sierra Leone Within 12 weeks of the start date
— source View →
Internal whistleblowing channel Slovenia Acknowledge within 7 days; outcome within 3 months
— source View →
Prohibition of retaliation against reporting persons Slovenia — — source View →
Whistleblowing channel: authorise internal procedures for protected disclosures South Africa Ongoing
— source View →
Protect employees who report corrupt practices South Sudan — — source View →
Declare income, assets and liabilities to the Anti-Corruption Commission South Sudan Within 30 days of taking office, then annually by the end of February
— source View →
Beneficial ownership declaration to the Central Register Spain Within 1 month of formation; updates within 10 days; annual declaration in January
— source View →
Notification of security incidents through the reference CSIRT Spain Initial notification without undue delay, then intermediate and final (Art. 22)
— source View →
Internal whistleblowing channel Spain Ongoing; acknowledgement within 7 calendar days; response within 3 months
— source View →
Anti-bribery and criminal compliance model Spain Ongoing (exemption condition)
— source View →
Lawful basis, transparency and data subject rights Spain Ongoing
— source View →
Personal data breach notification to the AEPD Spain Within 72 hours of becoming aware
— source View →
Lawful basis, notice and data subject rights Sri Lanka Ongoing
— source View →
Credit information: customer access, appeal and correction of errors Sudan Ongoing; appeals reviewed within 15 days
— source View →
Registration with FIU Suriname Suriname Within 3 months of starting business (Art. 28)
— source View →
Internal reporting channels for employers with 50 or more employees Sweden Ongoing
— source View →
Cyber incident reporting by essential and important entities Sweden Early warning within 24 hours; notification within 24 hours (trust services) or 72 hours (others); final report within one month
— source View →
Personal data breach notification to IMY Sweden Within 72 hours of becoming aware
— source View →
Lawful grounds, information to individuals and data subject rights Sweden Ongoing
— source View →
Beneficial ownership information held and filed with Bolagsverket Sweden At registration or within four weeks; changes without delay
— source View →
Information to data subjects and right of access Switzerland Ongoing; access requests answered within 30 days (Art. 25 para. 7)
— source View →
Notifying the FDPIC of a data security breach Switzerland As quickly as possible
— source View →
Due diligence and reporting on conflict minerals and child labour Switzerland Ongoing
— source View →
Prohibition of retaliation against public interest whistleblowers Taiwan Ongoing
— source View →
Protection of workers who report labour law violations Taiwan Authority to notify the worker within 60 days of the complaint
— source View →
State protection for persons who help counter corruption Tajikistan — — source View →
Lawful basis, notice and data subject rights Tanzania Ongoing
— source View →
Personal data breach notification Tanzania Without any undue delay
— source View →
Registration as a data controller or processor Tanzania Before processing; renew every 5 years
— source View →
Whistleblower disclosure channel and protection Tanzania Ongoing
— source View →
Written employment contract and particulars; five-year retention Tanzania 5 years after termination
— source View →
Personal data breach notification Thailand Within 72 hours of becoming aware, where feasible
— source View →
Accept and protect whistleblower reports Timor-Leste — — source View →
No dismissal for lodging a complaint with the authorities Timor-Leste — — source View →
Lawful basis, notice and data subject rights Togo Ongoing
— source View →
Personal data breach notification Tonga Within 72 hours of becoming aware
— source View →
Cyber-incident reporting and annual security audit Tunisia Immediately
— source View →
Whistleblowing: internal reporting unit in public bodies Tunisia — — source View →
Lawful basis, notice and data subject rights Türkiye At collection + on request
— source View →
No obligations for this country.
