Lawful basis, notice and data subject rights Albania — — source View →
Personal data breach notification Albania No later than 72 hours after becoming aware of the breach
— source View →
Lawful basis, notice and data subject rights Algeria — — source View →
Personal data breach notification Algeria No later than 5 days after becoming aware
— source View →
Appoint a data protection officer Algeria — — source View →
Lawful basis, privacy notice and data subject rights Andorra Ongoing
— source View →
Personal data breach notification to the APDA Andorra Within a maximum of 72 hours of becoming aware (Art. 36)
— source View →
Lawful basis, notice and data subject rights Angola Ongoing
— source View →
Process personal data on a lawful basis, inform data subjects and honour their rights Argentina Ongoing; access within 10 calendar days; rectification or deletion within 5 business days
— source View →
Privacy policy, collection notice and individual access and correction rights Australia Ongoing
— source View →
Lawful basis, information and data subject rights Austria — — source View →
Personal data breach notification to the Datenschutzbehörde Austria Without undue delay and where possible within 72 hours of becoming aware
— source View →
Lawful basis, notice and data subject rights Bahrain Ongoing
— source View →
Personal data breach notification Bahrain Within 72 hours of discovery
— source View →
Lawful basis, notice and data subject rights Bangladesh Ongoing
— source View →
Lawful basis, consent, notice and data subject rights Belarus Deadlines of 5 working days to 15 days depending on the request (Arts 10-13)
— source View →
Personal data breach notification Belarus Immediately, no later than 3 working days after becoming aware
— source View →
Data protection officer or dedicated unit Belarus — — source View →
Telecom operators to protect secrecy of communications and personal data Bolivia — — source View →
Lawful basis, notice and data subject rights Bosnia and Herzegovina Ongoing
— source View →
Personal data breach notification Bosnia and Herzegovina Within 72 hours where possible
— source View →
Bank secrecy over customer operations Brazil Ongoing
— source View →
Lawful basis, notice and data subject rights Brazil Ongoing
— source View →
Personal data breach notification to the ANPD and data subjects Brazil Within 3 business days; preliminary notice completed within 20 business days
— source View →
Retention of internet connection and application access logs Brazil Connection logs 1 year; application access logs 6 months
— source View →
Consent, notification and data subject access and correction Brunei — — source View →
Personal data breach notification to AITI Brunei No later than 3 days after assessing the breach as notifiable (s.28(1))
— source View →
Lawful basis, notice and data subject rights Cabo Verde Ongoing
— source View →
Personal data breach notification Cabo Verde Within 72 hours of becoming aware
— source View →
Notification of data processing to the CNPD Cabo Verde Before processing starts
— source View →
Designation of a data protection officer Cabo Verde Ongoing
— source View →
Fair information principles: accountability, purposes, consent and individual access Canada Ongoing
— source View →
Confidentiality incidents: notification and incident register (Quebec) Canada Promptly where there is a risk of serious injury; no fixed deadline
— source View →
Lawful basis, notice and individual rights for personal information China Ongoing
— source View →
Personal information protection officer, audits and impact assessments China Ongoing; impact assessment before the activity
— source View →
Conditions for transferring personal information abroad China Before each transfer abroad
— source View →
Report data security incidents to NFRA within 2 hours China Within 2 hours; written report within 24 hours
— source View →
Data subject rights and prior informed authorisation Colombia Ongoing
— source View →
Lawful basis, notice and data subject rights Costa Rica At collection + ongoing; access and rectification requests answered within five working days (Art. 7)
— source View →
Lawful basis, notice and data subject rights Croatia — — source View →
Personal data breach notification to AZOP Croatia Within 72 hours of becoming aware
— source View →
Data subject rights and information on processing Cuba — — source View →
Personal data breach notification to Datatilsynet Denmark Without undue delay and, where feasible, within 72 hours of becoming aware
— source View →
Data subject information, consent and rights (access, rectification, deletion) Dominican Republic Continuous
— source View →
Lawful basis, notice and data subject rights Ecuador Ongoing; 15-day response to rights requests
— source View →
Personal data breach notification Ecuador Authority: within 5 days of becoming aware; processor to controller: 2 days; data subject: 3 days
— source View →
Personal data breach notification El Salvador Within 72 hours of becoming aware
— source View →
Lawful basis, notice and data subject rights Eswatini Ongoing
— source View →
Notification of processing to the Data Protection Authority Eswatini Before processing; changes of name or address within 1 week
— source View →
Cross-border transfer of personal data Eswatini Ongoing
— source View →
Personal data breach notification France Event-based
1 Oct 2026 source View →
Consent for cookies and other trackers France Before placing or reading trackers
— source View →
Lawful basis, notice and data subject rights Gabon Ongoing
— source View →
Personal data breach notification Gabon Without undue delay
— source View →
Lawful basis, notice and data subject rights Georgia Ongoing
— source View →
Personal data breach notification Germany 72 hours
22 Sep 2026 source View →
Lawful basis, notice and data subject rights Germany Ongoing
22 Sep 2026 source View →
Register as a data controller with the Data Protection Commission Ghana Before processing personal data
— source View →
Personal data breach notification Ghana As soon as reasonably practicable after discovery
— source View →
Personal data breach notification to the HDPA Greece Within 72 hours where feasible
— source View →
Handling of personal data by public bodies: consent, access and correction Guatemala — — source View →
Personal data breach notification Hong Kong Event-based
23 Sep 2026 source View →
Lawful basis, notice and data subject rights Hong Kong Ongoing
23 Sep 2026 source View →
Data subject rights Hungary Within one month of request (extendable by two months)
— source View →
Lawful processing, notice and data subject rights Iceland — — source View →
Personal data breach notification Iceland Without undue delay and, if possible, within 72 hours
— source View →
Lawful basis, notice and data subject rights Indonesia Ongoing
— source View →
Personal data breach notification Ireland 72-hour
24 Sep 2026 source View →
Lawful basis, notice and data subject rights Ireland Ongoing
24 Sep 2026 source View →
Direct marketing consent Ireland — — source View →
Personal data breach notification by electronic communications providers Ireland Without undue delay
— source View →
Database registration and data subject access Israel Ongoing
— source View →
Personal data breach notification Italy Without undue delay and, where possible, within 72 hours
— source View →
Personal data breach notification Japan Event-based
25 Sep 2026 source View →
Lawful basis, notice and data subject rights Japan Ongoing
25 Sep 2026 source View →
Security control measures for personal data Japan — — source View →
Consent for provision of personal data to third parties abroad Japan Before each transfer
— source View →
Lawful basis, consent and data subject rights Kazakhstan Ongoing
— source View →
Appoint a person responsible for organising personal data processing Kazakhstan Ongoing
— source View →
Lawful basis, notice and data subject rights Kenya Ongoing
— source View →
Personal data breach notification Kenya Within 72 hours of becoming aware (s.43(1)(a))
— source View →
Lawful basis, notice and data subject rights Kosovo Ongoing
— source View →
Personal data breach notification to the Agency Kosovo Not later than 72 hours after becoming aware
— source View →
Respect data subject rights (access, rectification, erasure, restriction, portability, objection) Latvia Respond to requests within one month
— source View →
Data protection measures aligned with the GDPR, with a data protection officer Lebanon — — source View →
Lawful processing, notice and data subject rights Lesotho — — source View →
Personal data breach notification Lesotho As soon as reasonably possible after discovery (s. 23)
— source View →
Confidentiality and security of telecom customer data Liberia Ongoing
— source View →
Lawful basis, notice and data subject rights Liechtenstein — — source View →
Personal data breach notification Luxembourg Event-based
29 Sep 2026 source View →
Lawful basis, notice and data subject rights Luxembourg Ongoing
29 Sep 2026 source View →
Record of processing activities Luxembourg Ongoing; kept current
— source View →
Lawful basis, notice and data subject rights Macao Ongoing
— source View →
Notification of data processing to the public authority Macao In writing within 8 days of the start of processing
— source View →
Lawful basis, notice and data subject rights Madagascar — — source View →
Prior declaration or authorisation to the CMIL and data protection officer Madagascar Before processing starts
— source View →
Customer information breach notification to Bank Negara Malaysia and customers Malaysia Immediately on becoming aware; detailed report within 1 working day after Board tabling
— source View →
Lawful basis, notice and data subject rights Mali — — source View →
Lawful basis, notice to data subjects and data subject rights Mauritania — — source View →
Personal data breach notification Mauritius Event-based
30 Sep 2026 source View →
No obligations for this country.
