Applies across all sectors
Lawful basis, notice and data subject rights Croatia — — source View →
Personal data breach notification to AZOP Croatia Within 72 hours of becoming aware
— source View →
Internal whistleblowing channel and confidential person Croatia Acknowledge within 7 days; feedback within 30 days, max 90
— source View →
Data subject rights and information on processing Cuba — — source View →
Report ICT security incidents immediately Cuba Immediately ("inmediata"); no fixed deadline
— source View →
Whistleblowing channel and follow-up Cyprus Acknowledge within 7 days; feedback within 3 months of acknowledgement
— source View →
Cash payment limit of €10,000 Cyprus — — source View →
Internal whistleblowing channel for employers with 50 or more employees Czechia Acknowledge within 7 days; assess within 30 days of receipt
— source View →
Mining permit applicants commit to a community-responsibility cahier des charges Democratic Republic of the Congo At permit application and renewal
— source View →
Significant incident notification under the NIS 2 Act Denmark Early warning within 24 hours; notification within 72 hours; final report within one month
— source View →
Personal data breach notification to Datatilsynet Denmark Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
Internal whistleblower scheme for employers Denmark Acknowledge within 7 days; feedback within 3 months of acknowledgment
— source View →
Beneficial owner registration by companies Denmark Register as soon as possible; review at least annually; keep documentation 5 years
— source View →
Protection of whistleblowers, witnesses and experts from retaliation Djibouti Ongoing
— source View →
Data subject information, consent and rights (access, rectification, deletion) Dominican Republic Continuous
— source View →
Notice of dismissal to the labour authority Dominican Republic Within 48 hours of the dismissal
— source View →
Lawful basis, notice and data subject rights Ecuador Ongoing; 15-day response to rights requests
— source View →
Personal data breach notification Ecuador Authority: within 5 days of becoming aware; processor to controller: 2 days; data subject: 3 days
— source View →
Respond to an electronic labour inspection with documentation Ecuador 10 days from notice (one 5-day extension)
— source View →
Personal data breach notification El Salvador Within 72 hours of becoming aware
— source View →
No reprisals against workers who complain to the authorities Equatorial Guinea — — source View →
Targeted financial sanctions: screening, freezing and reporting Eswatini Freeze and report within 24 hours; quarterly reports to the FSRA
— source View →
Lawful basis, notice and data subject rights Eswatini Ongoing
— source View →
Notification of processing to the Data Protection Authority Eswatini Before processing; changes of name or address within 1 week
— source View →
Cross-border transfer of personal data Eswatini Ongoing
— source View →
Duty to report corruption and theft or fraud Eswatini When the suspicion arises
— source View →
Internal whistleblowing channel Finland — — source View →
Consent for cookies and other trackers France Before placing or reading trackers
— source View →
Anti-bribery compliance programme (eight measures) France Ongoing
— source View →
Internal whistleblowing channel France Ongoing
— source View →
Asset freezing applied without delay France Applicable without delay (sans délai)
— source View →
Lawful basis, notice and data subject rights Gabon Ongoing
— source View →
Personal data breach notification Gabon Without undue delay
— source View →
Lawful basis, notice and data subject rights Georgia Ongoing
— source View →
NIS-2 cybersecurity risk-management measures Germany Continuous
— source View →
Internal whistleblowing channel Germany Acknowledge within 7 days; feedback within 3 months
— source View →
Register as a data controller with the Data Protection Commission Ghana Before processing personal data
— source View →
Personal data breach notification Ghana As soon as reasonably practicable after discovery
— source View →
Keep a register of beneficial owners and file particulars with the Registrar Ghana Within 28 days of receipt or change
— source View →
Personal data breach notification to the HDPA Greece Within 72 hours where feasible
— source View →
Incident notification to the National Cybersecurity Authority (NIS2) Greece Early warning 24 hours; update 72 hours; final report 1 month
— source View →
Protection of public officers who make protected disclosures Grenada Ongoing
— source View →
No victimisation of employees who complain or take part in proceedings Grenada Ongoing
— source View →
Valid reason, written notice and termination allowance on dismissal Grenada Event-triggered on dismissal; complaint to the Labour Commissioner within 3 months (s.82)
— source View →
Handling of personal data by public bodies: consent, access and correction Guatemala — — source View →
Annual declaration of income, assets and liabilities by persons in public life Guyana Annually on or before 30 June
— source View →
Beneficial ownership registration and annual update Honduras Annually by 30 May; changes within the first 10 business days of the following month
— source View →
Employment contracts and changes in writing Honduras At hiring and on any change
— source View →
No reprisals against workers for exercising labour rights Honduras Ongoing
— source View →
Employer duties to employees admitted to the witness protection programme Honduras Event-triggered on admission to the programme
— source View →
Report computer-system security incidents to the Commissioner's Office Hong Kong 12 hours (serious) or 48 hours (other); written report within 14 days
— source View →
Pay wages within seven days of the wage period Hong Kong Within 7 days after the wage period ends
— source View →
Keep wage and employment records Hong Kong 12 months of history; keep for 6 months after employment ends
— source View →
No dismissal for giving evidence or union activity Hong Kong Applies at all times
— source View →
Make mandatory MPF contributions for employees Hong Kong Monthly, by the 10th of the following month
— source View →
Private-sector agents must not accept advantages without principal's permission Hong Kong Applies at all times
— source View →
Cybersecurity registration of covered organisations Hungary Within 30 days of coming under the Act
— source View →
Data subject rights Hungary Within one month of request (extendable by two months)
— source View →
Beneficial owner registration and updates Iceland Changes within 2 weeks
— source View →
Lawful processing, notice and data subject rights Iceland — — source View →
Personal data breach notification Iceland Without undue delay and, if possible, within 72 hours
— source View →
Incident notification by operators of essential services Iceland As soon as possible ('svo fljótt sem verða má')
— source View →
Internal whistleblowing procedures Iceland — — source View →
Report cyber incidents to CERT-In within six hours India Within 6 hours of noticing the incident
— source View →
Keep system logs for 180 days within India India Rolling 180 days (logs); 5 years (VASP KYC and transaction records)
— source View →
Lawful basis, notice and data subject rights Indonesia Ongoing
— source View →
Sustainability report Indonesia Annually; 30 April if filed separately from the annual report
— source View →
Corporate social and environmental responsibility Indonesia Ongoing; reported in the annual report
— source View →
Internal reporting channels for protected disclosures Ireland Acknowledge within 7 days; feedback within 3 months
— source View →
Anti-corruption compliance: reasonable steps defence Ireland — — source View →
Weekly working time and rest limits Ireland — — source View →
Non-discrimination in employment Ireland — — source View →
Employer justification for dismissal Ireland Claims within 6 months of dismissal
— source View →
Database registration and data subject access Israel Ongoing
— source View →
Personal data breach notification Italy Without undue delay and, where possible, within 72 hours
— source View →
Whistleblowing channels and protection of reporters Italy Ongoing; ANAC acknowledgement within 7 days, feedback within 3 months
— source View →
Security control measures for personal data Japan — — source View →
Consent for provision of personal data to third parties abroad Japan Before each transfer
— source View →
Whistleblowing report handling system Japan — — source View →
Working hours limits and overtime agreements Japan 40 hours a week; overtime 45 hours a month and 360 hours a year
— source View →
Work rules for employers with ten or more workers Japan On preparation and on each change
— source View →
Lawful basis, consent and data subject rights Kazakhstan Ongoing
— source View →
Appoint a person responsible for organising personal data processing Kazakhstan Ongoing
— source View →
Lawful basis, notice and data subject rights Kenya Ongoing
— source View →
Personal data breach notification Kenya Within 72 hours of becoming aware (s.43(1)(a))
— source View →
Anti-bribery procedures Kenya Ongoing
— source View →
Duty to report bribery to the Commission Kenya Within 24 hours (s.14)
— source View →
Protection of whistle-blowers and witnesses Kenya Ongoing
— source View →
Beneficial ownership register and filing with the Registrar Kenya On incorporation and on each change
— source View →
Retention of employment records Kenya 5 years after termination (s.10(6))
— source View →
Declaration of cash above $5,000 at the border Kiribati On each entry or exit carrying cash above $5,000 equivalent
— source View →
Lawful basis, notice and data subject rights Kosovo Ongoing
— source View →
Personal data breach notification to the Agency Kosovo Not later than 72 hours after becoming aware
— source View →
Duty to report corruption and protection of whistleblowers Kuwait — — source View →
Respect data subject rights (access, rectification, erasure, restriction, portability, objection) Latvia Respond to requests within one month
— source View →
No adverse consequences for employees who report suspected offences at work Latvia — — source View →
Lawful processing, notice and data subject rights Lesotho — — source View →
Personal data breach notification Lesotho As soon as reasonably possible after discovery (s. 23)
— source View →
Beneficial owner identification and reporting to the register Liechtenstein Within 30 days of commercial register entry and of each change
— source View →
Lawful basis, notice and data subject rights Liechtenstein — — source View →
No obligations for this country.
