Data Protection & Privacy — across countries
| Instrument | Type | Country | Year | Source |
|---|---|---|---|---|
| Privacy Act 1988 | Act | Australia | 1988 | source |
| Lei Geral de Proteção de Dados (LGPD), Law No. 13,709/2018 | Act | Brazil | 2018 | source |
| Personal Information Protection and Electronic Documents Act (PIPEDA) | Act | Canada | 2000 | source |
| Personal Information Protection Law (PIPL) | Act | China | 2021 | source |
| Data Security Law | Act | China | 2021 | source |
| Personal Data Protection Law No. 151 of 2020 | Act | Egypt | 2020 | source |
| GDPR (Regulation (EU) 2016/679) | Regulation | Germany | 2016 | source |
| Personal Data (Privacy) Ordinance (Cap. 486) | Act | Hong Kong | 1995 | source |
| Digital Personal Data Protection Act, 2023 | Act | India | 2023 | source |
| Credit Information Companies (Regulation) Act, 2005 | Act | India | 2005 | source |
| Data Protection Act 2018 | Act | Ireland | 2018 | source |
| Act on the Protection of Personal Information (APPI) | Act | Japan | 2003 | source |
| Personal Data Protection Act 2010 | Act | Malaysia | 2010 | source |
| Data Protection Act 2017 | Act | Mauritius | 2017 | source |
| No laws for this country. | ||||
| Obligation | Country | Nature | Verified | Source | Detail |
|---|---|---|---|---|---|
| Personal data breach notification | France | Event-based | 1 Oct 2026 | source | View → |
| Personal data breach notification | Germany | 72 hours | 22 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Germany | Ongoing | 22 Sep 2026 | source | View → |
| Personal data breach notification | Hong Kong | Event-based | 23 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Hong Kong | Ongoing | 23 Sep 2026 | source | View → |
| Personal data breach notification | Ireland | 72-hour | 24 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Ireland | Ongoing | 24 Sep 2026 | source | View → |
| Personal data breach notification | Japan | Event-based | 25 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Japan | Ongoing | 25 Sep 2026 | source | View → |
| Personal data breach notification | Luxembourg | Event-based | 29 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Luxembourg | Ongoing | 29 Sep 2026 | source | View → |
| Personal data breach notification | Mauritius | Event-based | 30 Sep 2026 | source | View → |
| Lawful basis, notice and data subject rights | Mauritius | Ongoing | 30 Sep 2026 | source | View → |
| No obligations for this country. | |||||
| Date | Entity | Country | Action | Penalty | Source |
|---|---|---|---|---|---|
| 8 AUG 2025 | Singtel Optus Pty Limited / Optus Systems Pty Limited | Australia | Civil Penalty Proceedings Ongoing (Federal Court) — no penalty yet determined | — | source |
| 5 JUN 2024 | Medibank Private Limited | Australia | Civil Penalty Proceedings Ongoing (Federal Court) no penalty yet determined | — | source |
| 24 APR 2024 | Kotak Mahindra Bank Limited | India | Business restrictions (cease and desist) | — | source |
| No actions for this country. | |||||