NGOs / NPOs — regulation across countries
| Regulator | Country | Official site |
|---|---|---|
| DFAT Department of Foreign Affairs and Trade | Australia | source |
| BFIU Bangladesh Financial Intelligence Unit | Bangladesh | source |
| FSC Financial Services Commission | Belize | source |
| FSU Financial Services Unit | Dominica | source |
| UAFE Unidad de Análisis Financiero y Económico | Ecuador | source |
| SSM Suruhanjaya Syarikat Malaysia | Malaysia | source |
| FIC Financial Intelligence Centre | Namibia | source |
| NFIU Nauru Financial Intelligence Unit | Nauru | source |
| FASU Financial Analysis and Supervision Unit | Papua New Guinea | source |
| FSRC Financial Services Regulatory Commission | Saint Kitts and Nevis | source |
| OFSI Office of Financial Sanctions Implementation | United Kingdom | source |
| OFAC Office of Foreign Assets Control | United States | source |
| VFSC Vanuatu Financial Services Commission | Vanuatu | source |
| Applies across all sectors | ||
| MoLSA Ministry of Labour and Social Affairs | Afghanistan | source |
| IDPC Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale) | Albania | source |
| AIF Financial Intelligence Agency (Agjencia e Inteligjencës Financiare) | Albania | source |
| QKB National Business Centre (Qendra Kombëtare e Biznesit) | Albania | source |
| ISHPSHSH State Labour and Social Services Inspectorate (Inspektorati Shtetëror i Punës dhe Shërbimeve Shoqërore) | Albania | source |
| CTRF Cellule de Traitement du Renseignement Financier (Financial Intelligence Processing Unit) | Algeria | — |
| HATPLC Haute autorité de transparence, de prévention et de lutte contre la corruption (High Authority for Transparency, Prevention and Combating of Corruption) | Algeria | source |
| MTESS Ministère du Travail, de l'Emploi et de la Sécurité Sociale (Ministry of Labour, Employment and Social Security) | Algeria | source |
| APDA Agència Andorrana de Protecció de Dades | Andorra | source |
| ANC-AD Agència Nacional de Ciberseguretat d'Andorra | Andorra | source |
| UIF Unidade de Informação Financeira | Angola | source |
| Integrity Commission Integrity Commission | Antigua and Barbuda | — |
| AAIP Agencia de Acceso a la Información Pública | Argentina | source |
| OA Oficina Anticorrupción | Argentina | source |
| UIF Unidad de Información Financiera | Argentina | source |
| Anti-Corruption Committee of the Republic of Armenia Anti-Corruption Committee of the Republic of Armenia | Armenia | source |
| Corruption Prevention Commission Corruption Prevention Commission | Armenia | source |
| FMC Financial Monitoring Center | Armenia | source |
| ACSC Australian Cyber Security Centre | Australia | source |
| ATO Australian Taxation Office | Australia | source |
| NACC National Anti-Corruption Commission | Australia | source |
| Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) Arbeitsinspektion (Zentral-Arbeitsinspektorat and Arbeitsinspektorate) | Austria | source |
| BCS Bundesamt für Cybersicherheit | Austria | source |
| BAK Bundesamt zur Korruptionsprävention und Korruptionsbekämpfung | Austria | source |
| DSB Datenschutzbehörde (Austrian Data Protection Authority) | Austria | source |
| Financial Monitoring Service of the Republic of Azerbaijan Financial Monitoring Service of the Republic of Azerbaijan | Azerbaijan | source |
| Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan Ministry of Labour and Social Protection of Population of the Republic of Azerbaijan | Azerbaijan | source |
| State Labour Inspection Service State Labour Inspection Service | Azerbaijan | source |
| LMRA Labour Market Regulatory Authority | Bahrain | source |
| NCSC National Cyber Security Center | Bahrain | source |
| BGD e-GOV CIRT BGD e-GOV CIRT | Bangladesh | source |
| Ministry of Labour and Social Protection of the Republic of Belarus Ministry of Labour and Social Protection of the Republic of Belarus | Belarus | source |
| CCB Centre for Cybersecurity Belgium | Belgium | source |
| Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity Federaal Ombudsman / Médiateur fédéral (Federal Ombudsman) — Centre for Integrity | Belgium | source |
| FPS Employment Federal Public Service Employment, Labour and Social Dialogue (FPS Employment) | Belgium | source |
| APD-GBA Gegevensbeschermingsautoriteit / Autorité de protection des données (Data Protection Authority) | Belgium | source |
| OCRC Office central pour la répression de la corruption (OCRC) of the Federal Judicial Police (Central Office for the Repression of Corruption) | Belgium | source |
| FIU Financial Intelligence Unit | Belize | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières du Bénin (National Financial Information Processing Unit) | Benin | source |
| ACC Anti-Corruption Commission of Bhutan | Bhutan | source |
| BtCIRT Bhutan Computer Incident Response Team (Government Technology Agency) | Bhutan | source |
| UIF Unidad de Investigaciones Financieras | Bolivia | source |
| APIK Agency for Prevention of Corruption and Coordination of the Fight against Corruption (Agencija za prevenciju korupcije i koordinaciju borbe protiv korupcije) | Bosnia and Herzegovina | source |
| FUZIP Federal Administration for Inspection Affairs (Federalna uprava za inspekcijske poslove) | Bosnia and Herzegovina | source |
| Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u Bosni i Hercegovini) | Bosnia and Herzegovina | source |
| CGU Controladoria-Geral da União | Brazil | source |
| GSI/PR Gabinete de Segurança Institucional da Presidência da República | Brazil | source |
| MTE Ministério do Trabalho e Emprego | Brazil | source |
| ACB Anti-Corruption Bureau | Brunei | source |
| CSB Cyber Security Brunei | Brunei | source |
| Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) Дирекция „Финансово разузнаване“ на Държавна агенция „Национална сигурност“ (Financial Intelligence Directorate, State Agency for National Security) | Bulgaria | source |
| Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) Изпълнителна агенция „Главна инспекция по труда“ (Executive Agency General Labour Inspectorate) | Bulgaria | — |
| КЗЛД Комисия за защита на личните данни (Commission for Personal Data Protection) | Bulgaria | source |
| МТСП Министерство на труда и социалната политика (Ministry of Labour and Social Policy) | Bulgaria | source |
| ASCE-LC Autorité supérieure de contrôle d'État et de lutte contre la corruption (Supreme State Audit and Anti-Corruption Authority) | Burkina Faso | source |
| CNRF Cellule Nationale de Renseignement Financier (National Financial Intelligence Unit) | Burundi | source |
| CNPD Comissão Nacional de Proteção de Dados | Cabo Verde | source |
| CPC Conselho da Prevenção da Corrupção | Cabo Verde | — |
| ANIF Agence Nationale d'Investigation Financière (National Agency for Financial Investigation) | Cameroon | source |
| CONAC Commission Nationale Anti-Corruption (National Anti-Corruption Commission) | Cameroon | source |
| Corporations Canada Corporations Canada | Canada | source |
| ESDC Employment and Social Development Canada - Labour Program (Labour Standards Program) | Canada | source |
| PSIC Office of the Public Sector Integrity Commissioner of Canada | Canada | source |
| ANCI Agencia Nacional de Ciberseguridad | Chile | source |
| Ministerio Público (Fiscalía de Chile) Ministerio Público (Fiscalía de Chile) | Chile | source |
| Procuraduría General de la Nación Procuraduría General de la Nación | Colombia | source |
| SIC Superintendencia de Industria y Comercio | Colombia | source |
| UIAF Unidad de Información y Análisis Financiero | Colombia | source |
| Inspection du Travail et des Lois Sociales Inspection du Travail et des Lois Sociales | Comoros | — |
| PEP Procuraduría de la Ética Pública (Procuraduría General de la República) | Costa Rica | source |
| CENTIF Cellule Nationale de Traitement des Informations Financières | Côte d'Ivoire | source |
| HABG Haute Autorité pour la Bonne Gouvernance | Côte d'Ivoire | source |
| AZOP Agencija za zaštitu osobnih podataka (Personal Data Protection Agency) | Croatia | source |
| Državni inspektorat (State Inspectorate) Državni inspektorat (State Inspectorate) | Croatia | source |
| CERT Nacionalni CERT (National CERT, operated by CARNET) | Croatia | source |
| Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) Povjerenstvo za odlučivanje o sukobu interesa (Commission for Resolving Conflicts of Interest) | Croatia | source |
| Pučki pravobranitelj (Ombudsman) Pučki pravobranitelj (Ombudsman) | Croatia | source |
| SOA Sigurnosno-obavještajna agencija (Security and Intelligence Agency) | Croatia | source |
| USKOK Ured za suzbijanje korupcije i organiziranog kriminaliteta (Office for the Suppression of Corruption and Organised Crime) | Croatia | source |
| Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) Ministerstvo spravedlnosti ČR (Ministry of Justice of the Czech Republic) | Czechia | source |
| SÚIP Státní úřad inspekce práce (State Labour Inspection Office) | Czechia | source |
| IGF Inspection Générale des Finances | Democratic Republic of the Congo | source |
| Arbejdstilsynet (Danish Working Environment Authority) Arbejdstilsynet (Danish Working Environment Authority) | Denmark | source |
| Datatilsynet (Danish Data Protection Agency) Datatilsynet (Danish Data Protection Agency) | Denmark | source |
| Erhvervsstyrelsen (Danish Business Authority) Erhvervsstyrelsen (Danish Business Authority) | Denmark | source |
| NSK Nationale enhed for Særlig Kriminalitet (National Unit for Special Crime) | Denmark | source |
| Integrity Commission Integrity Commission | Dominica | — |
| No regulators for this country. | ||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Applies across all sectors | |||||
| Lawful basis, notice and data subject rights | Albania | — | source | View → | |
| Personal data breach notification | Albania | No later than 72 hours after becoming aware of the breach | source | View → | |
| Beneficial ownership registration and updating | Albania | Changes within 90 calendar days of the actual change | source | View → | |
| Lawful basis, notice and data subject rights | Algeria | — | source | View → | |
| Personal data breach notification | Algeria | No later than 5 days after becoming aware | source | View → | |
| Appoint a data protection officer | Algeria | — | source | View → | |
| Designate a person responsible for information systems security | Algeria | — | source | View → | |
| Lawful basis, privacy notice and data subject rights | Andorra | Ongoing | source | View → | |
| Personal data breach notification to the APDA | Andorra | Within a maximum of 72 hours of becoming aware (Art. 36) | source | View → | |
| Lawful basis, notice and data subject rights | Angola | Ongoing | source | View → | |
| File an annual beneficial ownership and control attestation with the Registrar of Companies | Antigua and Barbuda | Annually, within 30 days after the company's anniversary date | source | View → | |
| Process personal data on a lawful basis, inform data subjects and honour their rights | Argentina | Ongoing; access within 10 calendar days; rectification or deletion within 5 business days | source | View → | |
| Integrity programme for legal persons, required for certain contracts with the national State | Argentina | Ongoing; before contracting with the national State where Art. 24 applies | source | View → | |
| Privacy policy, collection notice and individual access and correction rights | Australia | Ongoing | source | View → | |
| Ransomware and cyber extortion payment reporting | Australia | Within 72 hours of the payment or of becoming aware of it | source | View → | |
| Cybersecurity incident reporting by essential and important entities | Austria | Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification | source | View → | |
| Internal whistleblowing channel | Austria | 50 or more employees | source | View → | |
| Lawful basis, information and data subject rights | Austria | — | source | View → | |
| Personal data breach notification to the Datenschutzbehörde | Austria | Without undue delay and where possible within 72 hours of becoming aware | source | View → | |
| Whistleblowing: internal channel for reports of corruption and protection of reporters | Azerbaijan | Reports considered within 20 working days | source | View → | |
| Lawful basis, notice and data subject rights | Bahrain | Ongoing | source | View → | |
| Personal data breach notification | Bahrain | Within 72 hours of discovery | source | View → | |
| Lawful basis, notice and data subject rights | Bangladesh | Ongoing | source | View → | |
| Keep basic and beneficial ownership information at the registered office | Barbados | Ongoing; kept at least 5 years; certified in each annual return | source | View → | |
| Lawful basis, consent, notice and data subject rights | Belarus | Deadlines of 5 working days to 15 days depending on the request (Arts 10-13) | source | View → | |
| Personal data breach notification | Belarus | Immediately, no later than 3 working days after becoming aware | source | View → | |
| Data protection officer or dedicated unit | Belarus | — | source | View → | |
| Keep employee records available for labour inspection for at least two years | Belize | At least 2 years after the record is made | source | View → | |
| Protection of whistleblowers, witnesses and victims of corruption | Benin | — | source | View → | |
| Private entities to supply information to the UIF and report suspected corruption | Bolivia | — | source | View → | |
| Providers of public services to accept digitally signed documents and digital-citizenship acts | Bolivia | — | source | View → | |
| Lawful basis, notice and data subject rights | Bosnia and Herzegovina | Ongoing | source | View → | |
| Personal data breach notification | Bosnia and Herzegovina | Within 72 hours where possible | source | View → | |
| Protection against dismissal for good-faith corruption reports | Bosnia and Herzegovina | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Brazil | Ongoing | source | View → | |
| Personal data breach notification to the ANPD and data subjects | Brazil | Within 3 business days; preliminary notice completed within 20 business days | source | View → | |
| Integrity (anti-bribery compliance) programme | Brazil | Ongoing | source | View → | |
| Whistleblowing channel and protection against retaliation (public bodies and state-owned companies) | Brazil | Ongoing | source | View → | |
| Consent, notification and data subject access and correction | Brunei | — | source | View → | |
| Personal data breach notification to AITI | Brunei | No later than 3 days after assessing the breach as notifiable (s.28(1)) | source | View → | |
| Internal whistleblowing channel | Bulgaria | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Protection of employees, witnesses and whistleblowers reporting corruption | Burkina Faso | — | source | View → | |
| Lawful basis, notice and data subject rights | Cabo Verde | Ongoing | source | View → | |
| Personal data breach notification | Cabo Verde | Within 72 hours of becoming aware | source | View → | |
| Notification of data processing to the CNPD | Cabo Verde | Before processing starts | source | View → | |
| Designation of a data protection officer | Cabo Verde | Ongoing | source | View → | |
| Fair information principles: accountability, purposes, consent and individual access | Canada | Ongoing | source | View → | |
| Annual forced labour and child labour supply-chain report | Canada | Annually by 31 May | source | View → | |
| Confidentiality incidents: notification and incident register (Quebec) | Canada | Promptly where there is a risk of serious injury; no fixed deadline | source | View → | |
| Protection against dismissal for complaints against the employer | Central African Republic | — | source | View → | |
| Report significant cyber incidents to the national CSIRT | Chile | Early alert within 3 hours; update within 72 hours; final report within 15 calendar days | source | View → | |
| Adopt a crime prevention model to avoid corporate criminal liability | Chile | Ongoing | source | View → | |
| Lawful basis, notice and individual rights for personal information | China | Ongoing | source | View → | |
| Personal information protection officer, audits and impact assessments | China | Ongoing; impact assessment before the activity | source | View → | |
| Conditions for transferring personal information abroad | China | Before each transfer abroad | source | View → | |
| Report cybersecurity incidents within 1, 2 or 4 hours | China | 1 hour (CII operators), 2 hours (central government departments), 4 hours (others) | source | View → | |
| Sign a written employment contract within one month of starting work | China | Within one month of the start of work | source | View → | |
| Data subject rights and prior informed authorisation | Colombia | Ongoing | source | View → | |
| Lawful basis, notice and data subject rights | Costa Rica | At collection + ongoing; access and rectification requests answered within five working days (Art. 7) | source | View → | |
| Employers must allow labour inspection | Costa Rica | — | source | View → | |
| Lawful basis, notice and data subject rights | Croatia | — | source | View → | |
| Personal data breach notification to AZOP | Croatia | Within 72 hours of becoming aware | source | View → | |
| Internal whistleblowing channel and confidential person | Croatia | Acknowledge within 7 days; feedback within 30 days, max 90 | source | View → | |
| Data subject rights and information on processing | Cuba | — | source | View → | |
| Report ICT security incidents immediately | Cuba | Immediately ("inmediata"); no fixed deadline | source | View → | |
| Whistleblowing channel and follow-up | Cyprus | Acknowledge within 7 days; feedback within 3 months of acknowledgement | source | View → | |
| Cash payment limit of €10,000 | Cyprus | — | source | View → | |
| Internal whistleblowing channel for employers with 50 or more employees | Czechia | Acknowledge within 7 days; assess within 30 days of receipt | source | View → | |
| Mining permit applicants commit to a community-responsibility cahier des charges | Democratic Republic of the Congo | At permit application and renewal | source | View → | |
| Significant incident notification under the NIS 2 Act | Denmark | Early warning within 24 hours; notification within 72 hours; final report within one month | source | View → | |
| Personal data breach notification to Datatilsynet | Denmark | Without undue delay and, where feasible, within 72 hours of becoming aware | source | View → | |
| Internal whistleblower scheme for employers | Denmark | Acknowledge within 7 days; feedback within 3 months of acknowledgment | source | View → | |
| Beneficial owner registration by companies | Denmark | Register as soon as possible; review at least annually; keep documentation 5 years | source | View → | |
| Protection of whistleblowers, witnesses and experts from retaliation | Djibouti | Ongoing | source | View → | |
| Data subject information, consent and rights (access, rectification, deletion) | Dominican Republic | Continuous | source | View → | |
| Notice of dismissal to the labour authority | Dominican Republic | Within 48 hours of the dismissal | source | View → | |
| Lawful basis, notice and data subject rights | Ecuador | Ongoing; 15-day response to rights requests | source | View → | |
| Personal data breach notification | Ecuador | Authority: within 5 days of becoming aware; processor to controller: 2 days; data subject: 3 days | source | View → | |
| Respond to an electronic labour inspection with documentation | Ecuador | 10 days from notice (one 5-day extension) | source | View → | |
| Personal data breach notification | El Salvador | Within 72 hours of becoming aware | source | View → | |
| No reprisals against workers who complain to the authorities | Equatorial Guinea | — | source | View → | |
| Targeted financial sanctions: screening, freezing and reporting | Eswatini | Freeze and report within 24 hours; quarterly reports to the FSRA | source | View → | |
| Lawful basis, notice and data subject rights | Eswatini | Ongoing | source | View → | |
| Notification of processing to the Data Protection Authority | Eswatini | Before processing; changes of name or address within 1 week | source | View → | |
| Cross-border transfer of personal data | Eswatini | Ongoing | source | View → | |
| Duty to report corruption and theft or fraud | Eswatini | When the suspicion arises | source | View → | |
| Internal whistleblowing channel | Finland | — | source | View → | |
| Consent for cookies and other trackers | France | Before placing or reading trackers | source | View → | |
| Anti-bribery compliance programme (eight measures) | France | Ongoing | source | View → | |
| Internal whistleblowing channel | France | Ongoing | source | View → | |
| Asset freezing applied without delay | France | Applicable without delay (sans délai) | source | View → | |
| Lawful basis, notice and data subject rights | Gabon | Ongoing | source | View → | |
| Personal data breach notification | Gabon | Without undue delay | source | View → | |
| Lawful basis, notice and data subject rights | Georgia | Ongoing | source | View → | |
| NIS-2 cybersecurity risk-management measures | Germany | Continuous | source | View → | |
| Internal whistleblowing channel | Germany | Acknowledge within 7 days; feedback within 3 months | source | View → | |
| Register as a data controller with the Data Protection Commission | Ghana | Before processing personal data | source | View → | |
| Personal data breach notification | Ghana | As soon as reasonably practicable after discovery | source | View → | |
| Keep a register of beneficial owners and file particulars with the Registrar | Ghana | Within 28 days of receipt or change | source | View → | |
| Personal data breach notification to the HDPA | Greece | Within 72 hours where feasible | source | View → | |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 13 OCT 2026 | Bank of America, N.A. | United States | Settlement | US$11,662,930 | source |
| 9 OCT 2026 | Pegasus Worldwide Logistics | United States | Settlement | US$175,015 | source |
| 10 SEP 2026 | An Individual | United States | Settlement | US$1,427,230 | source |
| 2 SEP 2026 | Citibank, N.A., London Branch | United Kingdom | Monetary Penalty | £4,732,830.58 | source |
| 12 AUG 2026 | Rice Lake Weighing Systems, Inc. | United States | Settlement | US$60,764 | source |
| 17 JUN 2026 | Sabre Global Technologies Limited | United Kingdom | Monetary Penalty | £1,000,920.59 | source |
| 1 JUN 2026 | FTI Consulting, Inc. | United States | Settlement | US$1,050,000 | source |
| 19 MAY 2026 | Deutsche Bank AG London Branch | United Kingdom | Monetary Penalty | £165,000 | source |
| 18 MAY 2026 | Adani Enterprises Limited | United States | Settlement | US$275,000,000 | source |
| 30 MAR 2026 | Apple Distribution International Limited | United Kingdom | Monetary Penalty | £390,000 | source |
| 17 MAR 2026 | TradeStation Securities, Inc. | United States | Settlement | US$1,110,661 | source |
| 25 FEB 2026 | An Individual | United States | Settlement | US$3,777,000 | source |
| 12 FEB 2026 | IMG Academy, LLC | United States | Settlement | US$1,720,000 | source |
| 26 JAN 2026 | Bank of Scotland PLC | United Kingdom | Monetary Penalty | £160,000 | source |
| 16 DEC 2025 | Exodus Movement, Inc. | United States | Settlement | US$3,103,360 | source |
| 9 DEC 2025 | An Individual | United States | Settlement | US$1,092,000 | source |
| 4 DEC 2025 | Gracetown, Inc. | United States | Monetary Penalty | US$7,139,305 | source |
| 2 DEC 2025 | IPI Partners, LLC | United States | Settlement | US$11,485,352 | source |
| 24 NOV 2025 | An Individual | United States | Monetary Penalty | US$4,677,552 | source |
| 13 NOV 2025 | Belize Offshore Services Limited (BOSL) | Belize | Licence Action | — | source |
| 30 SEP 2025 | Colorcon Limited | United Kingdom | Monetary Penalty | £152,750 | source |
| 22 SEP 2025 | ShapeShift AG | United States | Settlement | US$750,000 | source |
| 10 SEP 2025 | Real estate agents (62 entities named in Annexure A to the notice) | Namibia | Business Restriction | — | source |
| 10 SEP 2025 | Trust and Company Service Providers (151 entities named in Annexure A to the notice) | Namibia | Business Restriction | — | source |
| 8 SEP 2025 | Vanquis Bank Limited | United Kingdom | Formal Reprimand | — | source |
| No actions for this country. | |||||