Applies across all sectors
Lawful basis, notice and data subject rights Albania — — source View →
Personal data breach notification Albania No later than 72 hours after becoming aware of the breach
— source View →
Beneficial ownership registration and updating Albania Changes within 90 calendar days of the actual change
— source View →
Lawful basis, notice and data subject rights Algeria — — source View →
Personal data breach notification Algeria No later than 5 days after becoming aware
— source View →
Appoint a data protection officer Algeria — — source View →
Designate a person responsible for information systems security Algeria — — source View →
Lawful basis, privacy notice and data subject rights Andorra Ongoing
— source View →
Personal data breach notification to the APDA Andorra Within a maximum of 72 hours of becoming aware (Art. 36)
— source View →
Lawful basis, notice and data subject rights Angola Ongoing
— source View →
File an annual beneficial ownership and control attestation with the Registrar of Companies Antigua and Barbuda Annually, within 30 days after the company's anniversary date
— source View →
Process personal data on a lawful basis, inform data subjects and honour their rights Argentina Ongoing; access within 10 calendar days; rectification or deletion within 5 business days
— source View →
Integrity programme for legal persons, required for certain contracts with the national State Argentina Ongoing; before contracting with the national State where Art. 24 applies
— source View →
Privacy policy, collection notice and individual access and correction rights Australia Ongoing
— source View →
Ransomware and cyber extortion payment reporting Australia Within 72 hours of the payment or of becoming aware of it
— source View →
Cybersecurity incident reporting by essential and important entities Austria Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification
— source View →
Internal whistleblowing channel Austria 50 or more employees
— source View →
Lawful basis, information and data subject rights Austria — — source View →
Personal data breach notification to the Datenschutzbehörde Austria Without undue delay and where possible within 72 hours of becoming aware
— source View →
Whistleblowing: internal channel for reports of corruption and protection of reporters Azerbaijan Reports considered within 20 working days
— source View →
Lawful basis, notice and data subject rights Bahrain Ongoing
— source View →
Personal data breach notification Bahrain Within 72 hours of discovery
— source View →
Lawful basis, notice and data subject rights Bangladesh Ongoing
— source View →
Keep basic and beneficial ownership information at the registered office Barbados Ongoing; kept at least 5 years; certified in each annual return
— source View →
Lawful basis, consent, notice and data subject rights Belarus Deadlines of 5 working days to 15 days depending on the request (Arts 10-13)
— source View →
Personal data breach notification Belarus Immediately, no later than 3 working days after becoming aware
— source View →
Data protection officer or dedicated unit Belarus — — source View →
Keep employee records available for labour inspection for at least two years Belize At least 2 years after the record is made
— source View →
Protection of whistleblowers, witnesses and victims of corruption Benin — — source View →
Private entities to supply information to the UIF and report suspected corruption Bolivia — — source View →
Providers of public services to accept digitally signed documents and digital-citizenship acts Bolivia — — source View →
Lawful basis, notice and data subject rights Bosnia and Herzegovina Ongoing
— source View →
Personal data breach notification Bosnia and Herzegovina Within 72 hours where possible
— source View →
Protection against dismissal for good-faith corruption reports Bosnia and Herzegovina Ongoing
— source View →
Lawful basis, notice and data subject rights Brazil Ongoing
— source View →
Personal data breach notification to the ANPD and data subjects Brazil Within 3 business days; preliminary notice completed within 20 business days
— source View →
Integrity (anti-bribery compliance) programme Brazil Ongoing
— source View →
Whistleblowing channel and protection against retaliation (public bodies and state-owned companies) Brazil Ongoing
— source View →
Consent, notification and data subject access and correction Brunei — — source View →
Personal data breach notification to AITI Brunei No later than 3 days after assessing the breach as notifiable (s.28(1))
— source View →
Internal whistleblowing channel Bulgaria Acknowledge within 7 days; feedback within 3 months
— source View →
Protection of employees, witnesses and whistleblowers reporting corruption Burkina Faso — — source View →
Lawful basis, notice and data subject rights Cabo Verde Ongoing
— source View →
Personal data breach notification Cabo Verde Within 72 hours of becoming aware
— source View →
Notification of data processing to the CNPD Cabo Verde Before processing starts
— source View →
Designation of a data protection officer Cabo Verde Ongoing
— source View →
Fair information principles: accountability, purposes, consent and individual access Canada Ongoing
— source View →
Annual forced labour and child labour supply-chain report Canada Annually by 31 May
— source View →
Confidentiality incidents: notification and incident register (Quebec) Canada Promptly where there is a risk of serious injury; no fixed deadline
— source View →
Protection against dismissal for complaints against the employer Central African Republic — — source View →
Report significant cyber incidents to the national CSIRT Chile Early alert within 3 hours; update within 72 hours; final report within 15 calendar days
— source View →
Adopt a crime prevention model to avoid corporate criminal liability Chile Ongoing
— source View →
Lawful basis, notice and individual rights for personal information China Ongoing
— source View →
Personal information protection officer, audits and impact assessments China Ongoing; impact assessment before the activity
— source View →
Conditions for transferring personal information abroad China Before each transfer abroad
— source View →
Report cybersecurity incidents within 1, 2 or 4 hours China 1 hour (CII operators), 2 hours (central government departments), 4 hours (others)
— source View →
Sign a written employment contract within one month of starting work China Within one month of the start of work
— source View →
Data subject rights and prior informed authorisation Colombia Ongoing
— source View →
Lawful basis, notice and data subject rights Costa Rica At collection + ongoing; access and rectification requests answered within five working days (Art. 7)
— source View →
Employers must allow labour inspection Costa Rica — — source View →
Lawful basis, notice and data subject rights Croatia — — source View →
Personal data breach notification to AZOP Croatia Within 72 hours of becoming aware
— source View →
Internal whistleblowing channel and confidential person Croatia Acknowledge within 7 days; feedback within 30 days, max 90
— source View →
Data subject rights and information on processing Cuba — — source View →
Report ICT security incidents immediately Cuba Immediately ("inmediata"); no fixed deadline
— source View →
Whistleblowing channel and follow-up Cyprus Acknowledge within 7 days; feedback within 3 months of acknowledgement
— source View →
Cash payment limit of €10,000 Cyprus — — source View →
Internal whistleblowing channel for employers with 50 or more employees Czechia Acknowledge within 7 days; assess within 30 days of receipt
— source View →
Mining permit applicants commit to a community-responsibility cahier des charges Democratic Republic of the Congo At permit application and renewal
— source View →
Significant incident notification under the NIS 2 Act Denmark Early warning within 24 hours; notification within 72 hours; final report within one month
— source View →
Personal data breach notification to Datatilsynet Denmark Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
Internal whistleblower scheme for employers Denmark Acknowledge within 7 days; feedback within 3 months of acknowledgment
— source View →
Beneficial owner registration by companies Denmark Register as soon as possible; review at least annually; keep documentation 5 years
— source View →
Protection of whistleblowers, witnesses and experts from retaliation Djibouti Ongoing
— source View →
Data subject information, consent and rights (access, rectification, deletion) Dominican Republic Continuous
— source View →
Notice of dismissal to the labour authority Dominican Republic Within 48 hours of the dismissal
— source View →
Lawful basis, notice and data subject rights Ecuador Ongoing; 15-day response to rights requests
— source View →
Personal data breach notification Ecuador Authority: within 5 days of becoming aware; processor to controller: 2 days; data subject: 3 days
— source View →
Respond to an electronic labour inspection with documentation Ecuador 10 days from notice (one 5-day extension)
— source View →
Personal data breach notification El Salvador Within 72 hours of becoming aware
— source View →
No reprisals against workers who complain to the authorities Equatorial Guinea — — source View →
Targeted financial sanctions: screening, freezing and reporting Eswatini Freeze and report within 24 hours; quarterly reports to the FSRA
— source View →
Lawful basis, notice and data subject rights Eswatini Ongoing
— source View →
Notification of processing to the Data Protection Authority Eswatini Before processing; changes of name or address within 1 week
— source View →
Cross-border transfer of personal data Eswatini Ongoing
— source View →
Duty to report corruption and theft or fraud Eswatini When the suspicion arises
— source View →
Internal whistleblowing channel Finland — — source View →
Consent for cookies and other trackers France Before placing or reading trackers
— source View →
Anti-bribery compliance programme (eight measures) France Ongoing
— source View →
Internal whistleblowing channel France Ongoing
— source View →
Asset freezing applied without delay France Applicable without delay (sans délai)
— source View →
Lawful basis, notice and data subject rights Gabon Ongoing
— source View →
Personal data breach notification Gabon Without undue delay
— source View →
Lawful basis, notice and data subject rights Georgia Ongoing
— source View →
NIS-2 cybersecurity risk-management measures Germany Continuous
— source View →
Internal whistleblowing channel Germany Acknowledge within 7 days; feedback within 3 months
— source View →
Register as a data controller with the Data Protection Commission Ghana Before processing personal data
— source View →
Personal data breach notification Ghana As soon as reasonably practicable after discovery
— source View →
Keep a register of beneficial owners and file particulars with the Registrar Ghana Within 28 days of receipt or change
— source View →
Personal data breach notification to the HDPA Greece Within 72 hours where feasible
— source View →
No obligations for this country.
