Telecom & Tech — regulation across countries

Regulator	Country	Official site
ATRA Afghanistan Telecom Regulatory Authority	Afghanistan	source
MCIT Ministry of Telecommunications and Information Technology	Afghanistan	source
CNC Centro Nacional de Ciberseguridad	Argentina	source
ASCS Australian Cyber Security Centre	Australia	source
DFAT Department of Foreign Affairs and Trade	Australia	source
OAIC Office of the Australian Information Commissioner	Australia	source
TKK Telekom-Control-Kommission (Rundfunk und Telekom Regulierungs-GmbH)	Austria	source
Special Communication and Information Security State Service of the Republic of Azerbaijan (Government CERT) Special Communication and Information Security State Service of the Republic of Azerbaijan (Government CERT)	Azerbaijan	source
HTP High-Tech Park (Secretariat of the Supervisory Board)	Belarus	source
BICMA Bhutan InfoComm and Media Authority	Bhutan	source
AGETIC Agencia de Gobierno Electrónico y Tecnologías de Información y Comunicación	Bolivia	source
CGII Centro de Gestión de Incidentes Informáticos	Bolivia	source
BOCRA Botswana Communications Regulatory Authority	Botswana	source
ANPD Autoridade Nacional de Proteção de Dados	Brazil	source
CERT.br Centro de Estudos, Resposta e Tratamento de Incidentes de Segurança no Brasil	Brazil	source
ARCT Agence de Régulation et de Contrôle des Télécommunications (Telecommunications Regulation and Control Agency)	Burundi	source
ARME Agência de Regulação Multissectorial da Economia	Cabo Verde	source
CamCERT Cambodia Computer Emergency Response Team	Cambodia	source
ANTIC Agence Nationale des Technologies de l'Information et de la Communication (National Agency for Information and Communication Technologies)	Cameroon	source
Canadian Centre for Cyber Security Canadian Centre for Cyber Security	Canada	source
OPC Office of the Privacy Commissioner of Canada	Canada	source
CAC Cyberspace Administration of China	China	source
ANRTIC Autorité Nationale de Régulation des Technologies de l'Information et de la Communication	Comoros	source
CSIRT-CR Centro de Respuesta de Incidentes de Seguridad Informática (CSIRT-CR), Ministerio de Ciencia, Innovación, Tecnología y Telecomunicaciones	Costa Rica	source
ANSSI Agence nationale de la sécurité des systèmes d'information	Côte d'Ivoire	source
ARTCI Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire	Côte d'Ivoire	source
DSA Digital Security Authority	Cyprus	source
Digitaliseringsstyrelsen (Danish Agency for Digital Government) Digitaliseringsstyrelsen (Danish Agency for Digital Government)	Denmark	source
SAMSIK Styrelsen for Samfundssikkerhed (Danish Resilience Agency)	Denmark	source
ITIDA Information Technology Industry Development Agency	Egypt	source
RIA Information System Authority (Riigi Infosüsteemi Amet)	Estonia	source
ESCCOM Eswatini Communications Commission	Eswatini	source
NCSC-FI Liikenne- ja viestintävirasto Traficom, Kyberturvallisuuskeskus (National Cyber Security Centre Finland)	Finland	source
CNIL Commission nationale de l'informatique et des libertés	France	source
PURA The Gambia Public Utilities Regulatory Authority	Gambia	source
BfDI Federal Commissioner for Data Protection and Freedom of Information	Germany	source
CSA Cyber Security Authority	Ghana	source
EETT Hellenic Telecommunications and Post Commission	Greece	source
RPSC Registro de Prestadores de Servicios de Certificación	Guatemala	source
ARPT Autorité de Régulation des Postes et Télécommunications	Guinea	source
CONATEL Comisión Nacional de Telecomunicaciones	Honduras	source
Digital Policy Office Digital Policy Office	Hong Kong	source
PCPD Privacy Commissioner for Personal Data	Hong Kong	source
SZTFH Szabályozott Tevékenységek Felügyeleti Hatósága (Supervisory Authority of Regulated Activities)	Hungary	source
Fjarskiptastofa (Electronic Communications Office of Iceland) Fjarskiptastofa (Electronic Communications Office of Iceland)	Iceland	source
CCI Competition Commission of India	India	source
DPBI Data Protection Board of India	India	source
CERT-In Indian Computer Emergency Response Team	India	source
CMC Communications and Media Commission (هيأة الاعلام والاتصالات)	Iraq	source
ComReg Commission for Communications Regulation	Ireland	source
DPC Data Protection Commission	Ireland	source
NCSC National Cyber Security Centre	Ireland	source
JPCERT/CC JPCERT Coordination Center	Japan	source
National Cybersecurity Office (国家サイバー統括室) National Cybersecurity Office (国家サイバー統括室)	Japan	source
PPC Personal Information Protection Commission	Japan	source
CA Communications Authority of Kenya	Kenya	source
CITRA Communication and Information Technology Regulatory Authority	Kuwait	source
LCA Lesotho Communications Authority	Lesotho	source
Amt für Kommunikation Amt für Kommunikation	Liechtenstein	source
RRT Communications Regulatory Authority of the Republic of Lithuania (Ryšių reguliavimo tarnyba)	Lithuania	source
CNPD Commission nationale pour la protection des données	Luxembourg	source
ILR Institut luxembourgeois de régulation	Luxembourg	source
MACRA Malawi Communications Regulatory Authority	Malawi	source
MACC Malaysian Anti-Corruption Commission	Malaysia	—
PDPC-MY Personal Data Protection Commissioner	Malaysia	source
RMCD Royal Malaysian Customs Department	Malaysia	source
AMRTP Autorité malienne de Régulation des Télécommunications/TIC et des Postes (Malian Telecommunications, ICT and Postal Regulatory Authority)	Mali	source
MDIA Malta Digital Innovation Authority	Malta	source
DPO Data Protection Office	Mauritius	source
ICTA Information and Communication Technologies Authority	Mauritius	source
Department of Transportation, Communication and Infrastructure Department of Transportation, Communication and Infrastructure	Micronesia	source
CRAN Communications Regulatory Authority of Namibia	Namibia	source
ACM Autoriteit Consument & Markt	Netherlands	source
AP Autoriteit Persoonsgegevens	Netherlands	source
NCSC Nationaal Cyber Security Centrum	Netherlands	source
RDI Rijksinspectie Digitale Infrastructuur	Netherlands	source
NCSC National Cyber Security Centre	New Zealand	source
DGTEC Dirección General de Tecnología (Ministerio de Hacienda y Crédito Público)	Nicaragua	source
NITDA National Information Technology Development Agency	Nigeria	source
NDPC Nigeria Data Protection Commission	Nigeria	source
AEK Agency for Electronic Communications (Агенција за електронски комуникации)	North Macedonia	source
Nkom Nasjonal kommunikasjonsmyndighet (Norwegian Communications Authority)	Norway	source
AIG Autoridad Nacional para la Innovación Gubernamental	Panama	source
NICTA National Information and Communications Technology Authority	Papua New Guinea	source
CERT-PY CERT-PY (national cyber incident response centre)	Paraguay	source
MITIC Ministerio de Tecnologías de la Información y Comunicación	Paraguay	source
CNCS Centro Nacional de Cibersegurança	Portugal	source
GNS Gabinete Nacional de Segurança	Portugal	source
ANSSI Agence Nationale de Sécurité des Systèmes d'Information (National Information Systems Security Agency)	Republic of the Congo	—
Office of the Regulator Office of the Regulator	Samoa	source
CST Communications, Space and Technology Commission	Saudi Arabia	source
SDAIA Saudi Data and AI Authority	Saudi Arabia	source
NatCA National Communications Authority	Sierra Leone	source
CSA Cyber Security Agency of Singapore	Singapore	source
PDPC Personal Data Protection Commission	Singapore	source
MIRRI Ministerstvo investícií, regionálneho rozvoja a informatizácie Slovenskej republiky (Ministry of Investments, Regional Development and Informatization)	Slovakia	source
NCA National Communications Authority	Somalia	source
IR Information Regulator	South Africa	source
KISA Korea Internet & Security Agency	South Korea	source
NCA National Communication Authority	South Sudan	source

Law or regulation	Type	Country	Year	Source
Loi n° 18-05 du 10 mai 2018 relative au commerce électronique (Law 18-05 of 10 May 2018 on Electronic Commerce)	Act	Algeria	2018	source
Loi n° 15-04 du 1er février 2015 fixant les règles générales relatives à la signature et à la certification électroniques (Law 15-04 of 1 February 2015 on Electronic Signature and Certification)	Act	Algeria	2015	source
Loi n° 09-04 du 5 août 2009 portant règles particulières relatives à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication (Law 09-04 of 5 August 2009 on Prevention and Fight against ICT-related Offences)	Act	Algeria	2009	source
Privacy Act 1988	Act	Australia	1988	source
Lineamientos para la Elaboración e Implementación de los Planes Institucionales de Seguridad de la Información de las Entidades del Sector Público - PISI (Guidelines for institutional information security plans of public-sector entities)	Guideline	Bolivia	2017	source
Decreto Supremo 2514 de Creación de la Agencia de Gobierno Electrónico y Tecnologías de Información y Comunicación - AGETIC (Decree 2514 creating AGETIC)	Act	Bolivia	2015	source
Lei nº 15.211, de 17 de setembro de 2025 (Law 15,211/2025 – Estatuto Digital da Criança e do Adolescente, ECA Digital)	Act	Brazil	2025	source
Lei Geral de Proteção de Dados (LGPD), Law No. 13,709/2018	Act	Brazil	2018	source
Lei nº 12.965, de 23 de abril de 2014 (Law 12,965/2014 – Marco Civil da Internet, the Brazilian Internet Civil Framework)	Act	Brazil	2014	source
Décret N°2012/1643/PM du 14 juin 2012 fixant les conditions d'audit de la sécurité obligatoire des réseaux de communication électronique et des systèmes d'information (Decree on mandatory security audits of electronic communication networks and information systems)	Regulation	Cameroon	2012	source
Décret N°2012/1318/PM du 22 mai 2012 fixant les conditions d'octroi de l'autorisation d'exploitation d'une activité de certification électronique (Decree on authorisation to carry on electronic certification activity)	Regulation	Cameroon	2012	source
Personal Information Protection and Electronic Documents Act (PIPEDA)	Act	Canada	2000	source
Loi N°013/PR/2014 portant régulation des communications électroniques et des activités postales (Law No. 013/PR/2014 on the regulation of electronic communications and postal activities)	Act	Chad	2014	source
Cybersecurity Law	Act	China	2025	source
Personal Information Protection Law (PIPL)	Act	China	2021	source
Data Security Law	Act	China	2021	source
Network and Information Systems Security Law of 2020 (Ο περί Ασφάλειας Δικτύων και Συστημάτων Πληροφοριών Νόμος του 2020, 89(I)/2020)	Act	Cyprus	2020	source
Loi n°74/AN/20/8ème L portant création de l'Autorité de Régulation Multisectorielle de Djibouti (Law 74/AN/20/8th L Creating the ARMD)	Act	Djibouti	2020	source
Personal Data Protection Law No. 151 of 2020	Act	Egypt	2020	source
Computer Crime and Cybercrime Act, 2022 (Act No. 6 of 2022)	Act	Eswatini	2022	source
GDPR (Regulation (EU) 2016/679)	Regulation	Germany	2016	source
Personal Data (Privacy) Ordinance (Cap. 486)	Act	Hong Kong	1995	source
Lög um öryggi net- og upplýsingakerfa mikilvægra innviða nr. 78/2019 (Act No. 78/2019 on the Security of Network and Information Systems of Critical Infrastructure)	Act	Iceland	2019	source
Lög um rafræn viðskipti og aðra rafræna þjónustu nr. 30/2002 (Act No. 30/2002 on Electronic Commerce and Other Electronic Services)	Act	Iceland	2002	source
Digital Personal Data Protection Act, 2023	Act	India	2023	source
CERT-In Directions on Cyber Incident Reporting, April 2022	Direction	India	2022	source
Competition Act, 2002	Act	India	2003	source
Information Technology Act, 2000	Act	India	2000	source
Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik (Law Number 11 of 2008 on Electronic Information and Transactions), as amended by Law 19 of 2016 and Law 1 of 2024	Act	Indonesia	2008	source
Data Protection Act 2018	Act	Ireland	2018	source
European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011)	Regulation	Ireland	2011	source
Act on the Protection of Personal Information (APPI)	Act	Japan	2003	source
Law No. 37 of 2014 Establishing the Communication and Information Technology Regulatory Authority (as amended by Law No. 98 of 2015)	Act	Kuwait	2014	source
قرار رقم 150 لسنة 2024 بشأن تنظيم مزاولة نشاط خدمات الأمن السيبراني (Decision No. 150 of 2024 on Regulating the Activity of Practicing Cybersecurity Services)	Regulation	Libya	2024	source
Gesetz vom 27. Februar 2019 über elektronische Signaturen und Vertrauensdienste für elektronische Transaktionen (Signatur- und Vertrauensdienstegesetz; SigVG) (Electronic Signatures and Trust Services Act)	Act	Liechtenstein	2019	source
Lei n.º 13/2019 Lei da Cibersegurança (Law 13/2019, Cybersecurity Law)	Act	Macao	2019	source
Communications Act, 2016 (Chapter 68:01)	Act	Malawi	2016	source
Personal Data Protection Act 2010	Act	Malaysia	2010	source
Loi n°2016-011 du 6 mai 2016 portant sur les règles applicables aux moyens, modalités, prestations et systèmes de cryptologie au Mali (Law No. 2016-011 on rules for cryptology means, services and systems)	Act	Mali	2016	source
Rule 3 of the MFSA Act: MFSA FinTech Regulatory Sandbox	Rule	Malta	2020	source
Data Protection Act 2017	Act	Mauritius	2017	source
Legea nr. 48 din 16-03-2023 privind securitatea cibernetică (Law No. 48 of 16 March 2023 on cybersecurity)	Act	Moldova	2023	source
Loi n° 1.435 du 8 novembre 2016 relative à la lutte contre la criminalité technologique (Law 1,435 on combating technological crime)	Act	Monaco	2016	source
General Data Protection Regulation Implementation Act	Regulation	Netherlands	2018	source
Telecommunications (Interception Capability and Security) Act 2013	Act	New Zealand	2013	source
Nigeria Data Protection Act 2023	Act	Nigeria	2023	source
Nigeria Startup Act, 2022	Act	Nigeria	2022	source
National Information Technology Development Agency Act, 2007	Act	Nigeria	2007	source
Decreto Supremo N° 017-2024-PCM, que aprueba el Reglamento de la Ley N° 30999, Ley de Ciberdefensa (Regulation of the Cyberdefence Law)	Regulation	Peru	2024	source
Ustawa z dnia 5 lipca 2018 r. o krajowym systemie cyberbezpieczeństwa (Act of 5 July 2018 on the National Cybersecurity System)	Act	Poland	2018	source
Comércio electrónico no mercado interno e tratamento de dados pessoais — Decreto-Lei n.º 7/2004, de 7 de janeiro (Electronic commerce in the internal market)	Act	Portugal	2004	source
Law No. 13 of 2016 on Personal Data Privacy Protection	Act	Qatar	2016	source
Legea nr. 506/2004 privind prelucrarea datelor cu caracter personal şi protecţia vieţii private în sectorul comunicaţiilor electronice (Law 506/2004 on personal data processing and privacy in electronic communications)	Act	Romania	2004	source
Personal Data Protection Law (PDPL)	Act	Saudi Arabia	2021	source
Law on Information Security (Official Gazette RS No 91/25)	Act	Serbia	2025	source
Cybersecurity Act 2018	Act	Singapore	2018	source
Personal Data Protection Act 2012	Act	Singapore	2012	source
Protection of Personal Information Act 4 of 2013 (POPIA)	Act	South Africa	2013	source
The National Communication Act, 2012	Act	South Sudan	2012	source
Real Decreto 311/2022, de 3 de mayo, por el que se regula el Esquema Nacional de Seguridad (Royal Decree 311/2022 of 3 May regulating the National Security Framework)	Regulation	Spain	2022	source
Ley 34/2002, de 11 de julio, de servicios de la sociedad de la información y de comercio electrónico (Law 34/2002 on information society services and electronic commerce)	Act	Spain	2002	source
Online Safety Act, No. 9 of 2024	Act	Sri Lanka	2024	source
Electronic Transactions Act (No. 3), B.E. 2562 (2019)	Act	Thailand	2019	source
Electronic Transactions Act, B.E. 2544 (2001)	Act	Thailand	2001	source
Décret n° 2019-095/PR du 08 juillet 2019 relatif aux opérateurs de services essentiels, aux infrastructures essentielles et aux obligations y afférentes (Decree No. 2019-095/PR of 8 July 2019 on operators of essential services, essential infrastructure and related obligations)	Regulation	Togo	2019	source
Décret-loi n° 2023-17 du 11 mars 2023 relatif à la cybersécurité (Decree-Law 2023-17 on cybersecurity)	Act	Tunisia	2023	source
The Network and Information Systems Regulations 2018	Regulation	United Kingdom	2018	source
Applies across all sectors
Law No. 124/2024 "Për mbrojtjen e të dhënave personale" (Law No. 124/2024 on the Protection of Personal Data)	Act	Albania	2024	source
Law No. 112/2020 "Për regjistrin e pronarëve përfitues" (Law No. 112/2020 on the Register of Beneficial Owners), as amended	Act	Albania	2020	source
Law No. 10237 dated 18.02.2010 "Për sigurinë dhe shëndetin në punë" (Law on Safety and Health at Work)	Act	Albania	2010	source
Law No. 10273 dated 29.04.2010 "Për dokumentin elektronik" (Law No. 10273/2010 on the Electronic Document)	Act	Albania	2010	source
Law No. 9049 dated 10.04.2003 "Për deklarimin dhe kontrollin e pasurive, të detyrimeve financiare të të zgjedhurve dhe të disa nëpunësve publikë" (Law on the Declaration and Audit of Assets, Financial Obligations of Elected Persons and Certain Public Officials)	Act	Albania	2003	source
Loi n° 25-11 du 24 juillet 2025 modifiant et complétant la loi n° 18-07 (Law 25-11 of 24 July 2025 amending and supplementing Law 18-07)	Act	Algeria	2025	source
Loi n° 23-01 du 7 février 2023 modifiant et complétant la loi n° 05-01 (Law 23-01 of 7 February 2023 amending and supplementing Law 05-01)	Act	Algeria	2023	source
Loi n° 22-08 du 5 mai 2022 fixant l'organisation, la composition et les attributions de la Haute autorité de transparence, de prévention et de lutte contre la corruption (Law 22-08 of 5 May 2022 on the High Authority for Transparency, Prevention and Combating of Corruption)	Act	Algeria	2022	source
Décret exécutif n° 22-36 du 4 janvier 2022 fixant les missions, l'organisation et le fonctionnement de la cellule de traitement du renseignement financier (Executive Decree 22-36 of 4 January 2022 on the Missions, Organisation and Operation of the CTRF)	Regulation	Algeria	2022	source
Décret présidentiel n° 20-05 du 20 janvier 2020 portant mise en place d'un dispositif national de la sécurité des systèmes d'information (Presidential Decree 20-05 of 20 January 2020 Establishing a National Information Systems Security Framework)	Regulation	Algeria	2020	source
Loi n° 18-07 du 10 juin 2018 relative à la protection des personnes physiques dans le traitement des données à caractère personnel (Law 18-07 of 10 June 2018 on the Protection of Natural Persons in Personal Data Processing)	Act	Algeria	2018	source
Llei 5/2022, del 3 de març, d'aplicació de sancions internacionals (Law 5/2022 on the application of international sanctions)	Act	Andorra	2022	source
Llei 22/2022, del 9 de juny, de mesures per a la seguretat de les xarxes i dels sistemes d'informació (Ciberseguretat) (Law 22/2022 on measures for the security of networks and information systems)	Act	Andorra	2022	source
Llei 29/2021, del 28 d'octubre, qualificada de protecció de dades personals (Qualified Law 29/2021 on personal data protection)	Act	Andorra	2021	source
Lei n.º 8/26, de 19 de Agosto — Lei que altera a Lei n.º 5/20 (Law 8/26 amending the AML/CFT/CPF Law)	Act	Angola	2026	source
Instrução n.º 001/DG-UIF/2026 — prazo para comunicação imediata de operações suspeitas (UIF Instruction 001/DG-UIF/2026 on the deadline for immediate reporting of suspicious operations)	Direction	Angola	2026	source
Decreto Presidencial n.º 263/25, de 10 de Dezembro — Criação do Centro Nacional de Cibersegurança e Estatuto Orgânico (Presidential Decree 263/25 creating the National Cybersecurity Centre)	Regulation	Angola	2025	source
Lei n.º 11/24, de 4 de Julho — Lei que altera a Lei n.º 5/20 (Law 11/24 amending the AML/CFT/CPF Law)	Act	Angola	2024	source
Decreto Executivo n.º 127/24, de 13 de Junho — Regulamento Interno da Direcção de Inteligência Inspectiva, Transparência e Combate à Corrupção da IGAE (Executive Decree 127/24 on the IGAE directorate for inspection intelligence, transparency and anti-corruption)	Regulation	Angola	2024	source
Lei n.º 5/20, de 27 de Janeiro — Lei de Prevenção e Combate ao Branqueamento de Capitais, do Financiamento do Terrorismo e da Proliferação de Armas de Destruição em Massa (Law 5/20 on the Prevention and Combating of Money Laundering, Terrorist Financing and Proliferation of Weapons of Mass Destruction)	Act	Angola	2020	source
Lei n.º 7/17, de 16 de Fevereiro — Lei de Protecção das Redes e Sistemas Informáticos (Law 7/17 on the Protection of Networks and Computer Systems)	Act	Angola	2017	source
Companies (Amendment) Act, 2022 (No. 22 of 2022)	Act	Antigua and Barbuda	2022	source
Electronic Transactions (Amendment) Act, 2016 (No. 10 of 2016)	Act	Antigua and Barbuda	2016	source
Electronic Evidence Act, 2013 (No. 11 of 2013)	Act	Antigua and Barbuda	2013	source
The Prevention of Corruption Act, 2004 (No. 21 of 2004)	Act	Antigua and Barbuda	2004	source
The Integrity in Public Life Act, 2004 (No. 23 of 2004)	Act	Antigua and Barbuda	2004	source
Resolución 27/2018 — Lineamientos de Integridad para el mejor cumplimiento de lo establecido en los artículos 22 y 23 de la Ley N° 27.401 de Responsabilidad Penal de Personas Jurídicas (Integrity Guidelines for Articles 22 and 23 of Law 27,401)	Guideline	Argentina	2018	source
Ley 26.388 — Modificación del Código Penal (Law 26,388 amending the Criminal Code on computer crimes)	Act	Argentina	2008	source
Ley 25.877 — Régimen Laboral, Arts. 25–27 Balance Social (Law 25,877 on the Labour Regime: annual social balance sheet)	Act	Argentina	2004	source
Ley 25.326 de Protección de los Datos Personales (Law 25,326 on Personal Data Protection)	Act	Argentina	2000	source
Law on Cybersecurity (HO-442-N)	Act	Armenia	2025	source
Law on Protection of Personal Data (HO-49-N)	Act	Armenia	2015	source
Law on Combating Money Laundering and Terrorism Financing	Act	Armenia	2008	source

Obligation	Country	Nature	Verified	Source	Detail
Retain user and traffic data for investigators	Algeria	1 year from recording	—	source	View →
E-commerce provider registration and local hosting	Algeria	—	—	source	View →
Telecom operators to protect secrecy of communications and personal data	Bolivia	—	—	source	View →
Retention of internet connection and application access logs	Brazil	Connection logs 1 year; application access logs 6 months	—	source	View →
Certification entities: send an annual external security audit and submit new certificates for approval	Ecuador	Annually, within the first 15 days of the following year	—	source	View →
Retain service-provider user and traffic data for 180 days	Egypt	180 days	—	source	View →
Hosting provider notification to the Commission (condition of liability exemption)	Eswatini	Promptly on becoming aware	—	source	View →
Personal data breach notification	France	Event-based	1 Oct 2026	source	View →
Personal data breach notification	Germany	72 hours	22 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Germany	Ongoing	22 Sep 2026	source	View →
Report cybersecurity incidents (critical information infrastructure owners)	Ghana	Within 24 hours of detection	—	source	View →
Periodic conformity assessment audit of qualified trust service providers	Greece	At least every 24 months	—	source	View →
Personal data breach notification	Hong Kong	Event-based	23 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Hong Kong	Ongoing	23 Sep 2026	source	View →
Personal data breach notification	Ireland	72-hour	24 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Ireland	Ongoing	24 Sep 2026	source	View →
Direct marketing consent	Ireland	—	—	source	View →
Personal data breach notification by electronic communications providers	Ireland	Without undue delay	—	source	View →
Personal data breach notification	Japan	Event-based	25 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Japan	Ongoing	25 Sep 2026	source	View →
Confidentiality and security of telecom customer data	Liberia	Ongoing	—	source	View →
Practising permit for cybersecurity service providers	Libya	Before offering the services	—	source	View →
Personal data breach notification	Luxembourg	Event-based	29 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Luxembourg	Ongoing	29 Sep 2026	source	View →
Personal data breach notification	Mauritius	Event-based	30 Sep 2026	source	View →
Lawful basis, notice and data subject rights	Mauritius	Ongoing	30 Sep 2026	source	View →
Personal data breach notification	Netherlands	Event-based	6 Oct 2026	source	View →
Lawful basis, notice and data subject rights	Netherlands	Ongoing	6 Oct 2026	source	View →
Notify the GCSB before certain telecommunications network changes	New Zealand	Before making the change	—	source	View →
Personal data breach notification	Nigeria	Event-based	8 Oct 2026	source	View →
Lawful basis, notice and data subject rights	Nigeria	Ongoing	8 Oct 2026	source	View →
Personal data breach notification	Qatar	72 hours	12 Oct 2026	source	View →
Lawful basis, notice and data subject rights	Qatar	Ongoing	12 Oct 2026	source	View →
Personal data breach notification	Saudi Arabia	Event-based	14 Oct 2026	source	View →
Lawful basis, notice and data subject rights	Saudi Arabia	Ongoing	14 Oct 2026	source	View →
Personal data breach notification	Singapore	Event-based	15 Oct 2026	source	View →
Lawful basis, notice and data subject rights	Singapore	Ongoing	15 Oct 2026	source	View →
Personal data breach notification	South Africa	Event-based	16 Oct 2026	source	View →
Lawful basis, notice and data subject rights	South Africa	Ongoing	16 Oct 2026	source	View →
Service provider duty to report illegal activity to law enforcement	Tanzania	On becoming aware	—	source	View →
Applies across all sectors
Lawful basis, notice and data subject rights	Albania	—	—	source	View →
Personal data breach notification	Albania	No later than 72 hours after becoming aware of the breach	—	source	View →
Beneficial ownership registration and updating	Albania	Changes within 90 calendar days of the actual change	—	source	View →
Lawful basis, notice and data subject rights	Algeria	—	—	source	View →
Personal data breach notification	Algeria	No later than 5 days after becoming aware	—	source	View →
Appoint a data protection officer	Algeria	—	—	source	View →
Designate a person responsible for information systems security	Algeria	—	—	source	View →
Lawful basis, privacy notice and data subject rights	Andorra	Ongoing	—	source	View →
Personal data breach notification to the APDA	Andorra	Within a maximum of 72 hours of becoming aware (Art. 36)	—	source	View →
Lawful basis, notice and data subject rights	Angola	Ongoing	—	source	View →
File an annual beneficial ownership and control attestation with the Registrar of Companies	Antigua and Barbuda	Annually, within 30 days after the company's anniversary date	—	source	View →
Process personal data on a lawful basis, inform data subjects and honour their rights	Argentina	Ongoing; access within 10 calendar days; rectification or deletion within 5 business days	—	source	View →
Integrity programme for legal persons, required for certain contracts with the national State	Argentina	Ongoing; before contracting with the national State where Art. 24 applies	—	source	View →
Privacy policy, collection notice and individual access and correction rights	Australia	Ongoing	—	source	View →
Ransomware and cyber extortion payment reporting	Australia	Within 72 hours of the payment or of becoming aware of it	—	source	View →
Cybersecurity incident reporting by essential and important entities	Austria	Early warning within 24 hours of becoming aware; notification within 72 hours; final report within one month of the notification	—	source	View →
Internal whistleblowing channel	Austria	50 or more employees	—	source	View →
Lawful basis, information and data subject rights	Austria	—	—	source	View →
Personal data breach notification to the Datenschutzbehörde	Austria	Without undue delay and where possible within 72 hours of becoming aware	—	source	View →
Whistleblowing: internal channel for reports of corruption and protection of reporters	Azerbaijan	Reports considered within 20 working days	—	source	View →
Lawful basis, notice and data subject rights	Bahrain	Ongoing	—	source	View →
Personal data breach notification	Bahrain	Within 72 hours of discovery	—	source	View →
Lawful basis, notice and data subject rights	Bangladesh	Ongoing	—	source	View →
Keep basic and beneficial ownership information at the registered office	Barbados	Ongoing; kept at least 5 years; certified in each annual return	—	source	View →
Lawful basis, consent, notice and data subject rights	Belarus	Deadlines of 5 working days to 15 days depending on the request (Arts 10-13)	—	source	View →
Personal data breach notification	Belarus	Immediately, no later than 3 working days after becoming aware	—	source	View →
Data protection officer or dedicated unit	Belarus	—	—	source	View →
Keep employee records available for labour inspection for at least two years	Belize	At least 2 years after the record is made	—	source	View →
Protection of whistleblowers, witnesses and victims of corruption	Benin	—	—	source	View →
Private entities to supply information to the UIF and report suspected corruption	Bolivia	—	—	source	View →
Providers of public services to accept digitally signed documents and digital-citizenship acts	Bolivia	—	—	source	View →
Lawful basis, notice and data subject rights	Bosnia and Herzegovina	Ongoing	—	source	View →
Personal data breach notification	Bosnia and Herzegovina	Within 72 hours where possible	—	source	View →
Protection against dismissal for good-faith corruption reports	Bosnia and Herzegovina	Ongoing	—	source	View →
Lawful basis, notice and data subject rights	Brazil	Ongoing	—	source	View →
Personal data breach notification to the ANPD and data subjects	Brazil	Within 3 business days; preliminary notice completed within 20 business days	—	source	View →
Integrity (anti-bribery compliance) programme	Brazil	Ongoing	—	source	View →
Whistleblowing channel and protection against retaliation (public bodies and state-owned companies)	Brazil	Ongoing	—	source	View →
Consent, notification and data subject access and correction	Brunei	—	—	source	View →
Personal data breach notification to AITI	Brunei	No later than 3 days after assessing the breach as notifiable (s.28(1))	—	source	View →
Internal whistleblowing channel	Bulgaria	Acknowledge within 7 days; feedback within 3 months	—	source	View →
Protection of employees, witnesses and whistleblowers reporting corruption	Burkina Faso	—	—	source	View →
Lawful basis, notice and data subject rights	Cabo Verde	Ongoing	—	source	View →
Personal data breach notification	Cabo Verde	Within 72 hours of becoming aware	—	source	View →
Notification of data processing to the CNPD	Cabo Verde	Before processing starts	—	source	View →
Designation of a data protection officer	Cabo Verde	Ongoing	—	source	View →
Fair information principles: accountability, purposes, consent and individual access	Canada	Ongoing	—	source	View →
Annual forced labour and child labour supply-chain report	Canada	Annually by 31 May	—	source	View →
Confidentiality incidents: notification and incident register (Quebec)	Canada	Promptly where there is a risk of serious injury; no fixed deadline	—	source	View →
Protection against dismissal for complaints against the employer	Central African Republic	—	—	source	View →
Report significant cyber incidents to the national CSIRT	Chile	Early alert within 3 hours; update within 72 hours; final report within 15 calendar days	—	source	View →
Adopt a crime prevention model to avoid corporate criminal liability	Chile	Ongoing	—	source	View →
Lawful basis, notice and individual rights for personal information	China	Ongoing	—	source	View →
Personal information protection officer, audits and impact assessments	China	Ongoing; impact assessment before the activity	—	source	View →
Conditions for transferring personal information abroad	China	Before each transfer abroad	—	source	View →
Report cybersecurity incidents within 1, 2 or 4 hours	China	1 hour (CII operators), 2 hours (central government departments), 4 hours (others)	—	source	View →
Sign a written employment contract within one month of starting work	China	Within one month of the start of work	—	source	View →
Data subject rights and prior informed authorisation	Colombia	Ongoing	—	source	View →
Lawful basis, notice and data subject rights	Costa Rica	At collection + ongoing; access and rectification requests answered within five working days (Art. 7)	—	source	View →
Employers must allow labour inspection	Costa Rica	—	—	source	View →

Date	Entity	Country	Action	Penalty	Source
13 OCT 2026	Bank of America, N.A.	United States	Settlement	US$11,662,930	source
9 OCT 2026	Pegasus Worldwide Logistics	United States	Settlement	US$175,015	source
1 OCT 2026	Children's Health Ireland at Tallaght	Ireland	Formal Reprimand · Remedial Direction	—	source
10 SEP 2026	An Individual	United States	Settlement	US$1,427,230	source
7 SEP 2026	Brown Thomas Arnotts Limited	Ireland	Criminal Resolution	—	source
2 SEP 2026	Health Service Executive (HSE)	Ireland	Monetary Penalty · Formal Reprimand	€645,000	source
2 SEP 2026	Citibank, N.A., London Branch	United Kingdom	Monetary Penalty	£4,732,830.58	source
19 AUG 2026	KDDI株式会社 (KDDI Corporation)	Japan	Formal Reprimand	—	source
12 AUG 2026	Rice Lake Weighing Systems, Inc.	United States	Settlement	US$60,764	source
21 JUL 2026	EXTIA	France	Monetary Penalty	€300,000	source
21 JUL 2026	Hôpital Privé de la Loire	France	Monetary Penalty · Remedial Direction	€500,000	source
13 JUL 2026	16 HP India Resellers (combined)	India	Monetary Penalty	₹2.3 crore≈ US$239,765	source
13 JUL 2026	5 HP India Resellers	India	Monetary Penalty	₹1.22 crore≈ US$127,158	source
13 JUL 2026	HP India Sales Pvt Ltd	India	Monetary Penalty	₹126.87 crore≈ US$13,215,625	source
17 JUN 2026	Sabre Global Technologies Limited	United Kingdom	Monetary Penalty	£1,000,920.59	source
15 JUN 2026	Midlands Regional Hospital Tullamore	Ireland	Monetary Penalty · Formal Reprimand	€300,000	source
10 JUN 2026	Unnamed data controller (savings finance company; not named in the published summary), Board decision 2026/1183	Türkiye	Monetary Penalty	TRY 1,000,000	source
1 JUN 2026	FTI Consulting, Inc.	United States	Settlement	US$1,050,000	source
26 MAY 2026	IQVIA OPERATIONS FRANCE	France	Monetary Penalty · Remedial Direction	€5,000,000	source
22 MAY 2026	Central Johannesburg TVET College	South Africa	Remedial Direction	—	source
19 MAY 2026	Deutsche Bank AG London Branch	United Kingdom	Monetary Penalty	£165,000	source
18 MAY 2026	Adani Enterprises Limited	United States	Settlement	US$275,000,000	source
29 APR 2026	Blouberg Local Municipality	South Africa	Monetary Penalty	ZAR 250,000≈ US$15,274	source
17 APR 2026	Cream della Cream Switzerland GmbH and Philipp Plein International AG	Switzerland	Remedial Direction	—	source
30 MAR 2026	Apple Distribution International Limited	United Kingdom	Monetary Penalty	£390,000	source

• US sanctions bill targets Russian energy sector under Graham legislation 3 Oct 2026