Instruments
An instrument is an Act, not a country. Tier 1 profiles answer all ten points of the asymmetry checklist, itemise criminal offences separately from regulatory penalties, and record every exemption with the condition that triggers it.
| Instrument | Jurisdiction | Type | Depth | Status | Confidence |
|---|---|---|---|---|---|
| BDSG BDSG of 30 June 2017 (BGBl. I p. 2097), as amended | Germany | implementing | Tier 1 | In force | Seeded |
| CCPA/CPRA Cal. Civ. Code sec. 1798.100 et seq. | United States | comprehensive | Tier 1 | In force | Seeded |
| COPPA 15 U.S.C. 6501-6506; 16 CFR Part 312 | United States | sectoral | Tier 1 | Partially in force | Seeded |
| Codice Privacy Decreto legislativo 30 giugno 2003, n. 196, as amended by d.lgs. 101/2018 | Italy | implementing | Tier 2 | In force | Seeded |
| DPA 2018 Data Protection Act 2018, c. 12 | United Kingdom | comprehensive | Tier 1 | Partially in force | Verified |
| DPA 2018 (IE) Data Protection Act 2018 (No. 7 of 2018) | Ireland | implementing | Tier 2 | In force | Seeded |
| Digital Personal Data Protection Act (India) Digital Personal Data Protection Act, 2023 (No. 22 of 2023), India; Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) | India | comprehensive | Tier 2 | Partially in force | Seeded |
| FCRA 15 U.S.C. 1681 et seq. | United States | sectoral | Tier 1 | In force | Seeded |
| GLBA Pub. L. 106-102, Title V; Regulation P, 12 CFR Part 1016; FTC Safeguards Rule, 16 CFR Part 314 | United States | sectoral | Tier 1 | In force | Seeded |
| HIPAA Pub. L. 104-191, as amended by the HITECH Act 2009; 45 CFR Parts 160 and 164 | United States | sectoral | Tier 1 | In force | Seeded |
| Lei Geral de Proteção de Dados (Brazil) Lei Geral de Proteção de Dados Pessoais, Lei No. 13.709/2018, Brazil | Brazil | comprehensive | Tier 2 | In force | Seeded |
| LOPDGDD Ley Orgánica 3/2018, de 5 de diciembre | Spain | implementing | Tier 2 | In force | Seeded |
| Loi 78-17 Loi n° 78-17 du 6 janvier 1978, as amended | France | implementing | Tier 2 | In force | Seeded |
| PDPA 2012 (Singapore) Personal Data Protection Act 2012 (No. 26 of 2012), Singapore, as amended by the PDP(A) Act 2020 | Singapore | comprehensive | Tier 2 | In force | Seeded |
| Personal Information Protection Law (China) Personal Information Protection Law of the PRC | China | comprehensive | Tier 2 | In force | Seeded |
| POPIA (South Africa) Protection of Personal Information Act 4 of 2013, South Africa | South Africa | comprehensive | Tier 2 | In force | Seeded |
| Privacy Act 1988 (Australia) Privacy Act 1988 (Cth), No. 119 of 1988, as amended by the Privacy and Other Legislation Amendment Act 2024 (No. 128 of 2024) | Australia | comprehensive | Tier 2 | In force | Seeded |
| PECR SI 2003/2426 | United Kingdom | secondary | Tier 1 | In force | Seeded |
| GDPR Regulation (EU) 2016/679 (General Data Protection Regulation) | European Union | comprehensive | Tier 1 | In force | Seeded |
| revFADP (Switzerland) Revised Federal Act on Data Protection (revFADP / nFADG), Switzerland | Switzerland | comprehensive | Tier 2 | In force | Seeded |
| UAVG Uitvoeringswet AVG (2018) | Netherlands | implementing | Tier 2 | In force | Seeded |
| UK GDPR Regulation (EU) 2016/679 as retained and amended by the European Union (Withdrawal) Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) | United Kingdom | comprehensive | Tier 1 | In force | Seeded |
| VCDPA Va. Code sec. 59.1-575 et seq. | United States | comprehensive | Tier 1 | In force | Seeded |