Jurisdiction directory
206 jurisdictions with their depth tier, status, principal law and regulator. Search, filter and sort below; select a row for the full profile.
Region
Status
Depth
Confidence
206 jurisdictions
| Principal law | Regulator | Pattern | Confidence | ||||
|---|---|---|---|---|---|---|---|
| Afghanistan | Asia-Pacific | Tier 3 | No general law | No comprehensive law in force | No dedicated authority | — | Seeded — unchecked |
| Albania | Europe | Tier 3 | Comprehensive law | Law 124/2024 (GDPR-aligned) | IDP Commissioner | — | Seeded — unchecked |
| Algeria | Africa | Tier 3 | Comprehensive law | Loi n° 18-07 du 10 juin 2018, modifiée par la Loi n° 25-11 du 24 juillet 2025 | Autorité nationale de protection des données à caractère personnel (ANPDP) | — | Sourced — unread |
| Andorra | Europe | Tier 3 | Comprehensive law | Law 29/2021 | APDA | — | Sourced — unread |
| Angola | Africa | Tier 3 | Comprehensive law | Lei n.º 22/11, de 17 de Junho — Lei da Protecção de Dados Pessoais | Agência de Protecção de Dados (APD) | — | Sourced — unread |
| Antigua & Barbuda | Americas | Tier 3 | Comprehensive law | Data Protection Act 2013 | — | — | Seeded — unchecked |
| Argentina | Americas | Tier 3 | Comprehensive law | Law 25.326 (reform pending) | AAIP | — | Sourced — unread |
| Armenia | Europe | Tier 3 | Comprehensive law | Law on Protection of Personal Data, HO-49-N, adopted 18 May 2015 | Personal Data Protection Agency of the Ministry of Justice | — | Sourced — unread |
| Australia | Asia-Pacific | Tier 2 | Comprehensive law | Privacy Act 1988 (major 2024 amendments) | Office of the Australian Information Commissioner (OAIC) | Pattern 3 | Sourced — unread |
| Austria | Europe | Tier 2 | Comprehensive law | Datenschutzgesetz (DSG) [Data Protection Act] | Österreichische Datenschutzbehörde (DSB) | — | Sourced — unread |
| Azerbaijan | Europe | Tier 3 | Comprehensive law | Law on Personal Data, No 998-IIIQ of 11 May 2010 | Ministry of Digital Development and Transport (authorised body; no independent DPA) | — | Sourced — unread |
| Bahamas | Americas | Tier 3 | Comprehensive law | Data Protection Act 2003 | Data Protection Commissioner | — | Seeded — unchecked |
| Bahrain | Middle East | Tier 3 | Comprehensive law | Law No. (30) of 2018 with Respect to Personal Data Protection Law | Personal Data Protection Authority (PDPA) | — | Sourced — unread |
| Bangladesh | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data Protection Act, 2026 (Act No. 63 of 2026) | — | — | Seeded — unchecked |
| Barbados | Americas | Tier 3 | Comprehensive law | Data Protection Act 2019 | Data Protection Commissioner | — | Seeded — unchecked |
| Belarus | Europe | Tier 3 | Comprehensive law | Law No. 99-Z on Personal Data Protection | NPDPC | — | Seeded — unchecked |
| Belgium | Europe | Tier 2 | Comprehensive law | Loi du 30 juillet 2018 relative à la protection des personnes physiques à l'égard des traitements de données à caractère personnel / Wet van 30 juli 2018 [Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data] | Autorité de la protection des données / Gegevensbeschermingsautoriteit (APD-GBA) | — | Sourced — unread |
| Belize | Americas | Tier 3 | Comprehensive law | Data Protection Act 2021 | — | — | Seeded — unchecked |
| Benin | Africa | Tier 3 | Comprehensive law | Loi n° 2017-20 du 20 avril 2018 portant Code du numérique (Livre V) | Autorité de Protection des Données Personnelles (APDP) | — | Sourced — unread |
| Bermuda | Americas | Tier 3 | Comprehensive law | PIPA 2016 (in force 2025) | PrivCom | — | Seeded — unchecked |
| Bhutan | Asia-Pacific | Tier 3 | Sectoral / partial | Bhutan Information, Communications and Media Act 2018; National Digital Identity Act 2023 | No dedicated authority | — | Seeded — unchecked |
| Bolivia | Americas | Tier 3 | No general law | Constitutional habeas data only | — | — | Seeded — unchecked |
| Bosnia & Herzegovina | Europe | Tier 3 | Comprehensive law | Law on Protection of Personal Data (new draft pending) | Personal Data Protection Agency | — | Seeded — unchecked |
| Botswana | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2024 (Act No. 18 of 2024) | Information and Data Protection Commission | — | Seeded — unchecked |
| Brazil | Americas | Tier 2 | Comprehensive law | LGPD | ANPD | — | Sourced — unread |
| Brunei | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data Protection Order, 2025 (S 1/2025) | Authority for Info-communications Technology Industry (AITI) | — | Sourced — unread |
| Bulgaria | Europe | Tier 2 | Comprehensive law | Закон за защита на личните данни (ЗЗЛД) [Personal Data Protection Act] | Commission for Personal Data Protection (CPDP) | — | Sourced — unread |
| Burkina Faso | Africa | Tier 3 | Comprehensive law | Loi n° 001-2021/AN du 30 mars 2021 | Commission de l'Informatique et des Libertés (CIL) | — | Seeded — unchecked |
| Burundi | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Cabo Verde | Africa | Tier 3 | Comprehensive law | Law 133/V/2001 (rev. 2013) | CNPD | — | Seeded — unchecked |
| Cambodia | Asia-Pacific | Tier 3 | Draft / pending | Draft Law on Personal Data Protection (not enacted) | No dedicated authority | — | Seeded — unchecked |
| Cameroon | Africa | Tier 3 | Comprehensive law | Law 2024/017 on Personal Data Protection | Authority being established | — | Seeded — unchecked |
| Canada | Americas | Tier 2 | Comprehensive law | PIPEDA + provincial (Quebec Law 25) | OPC | Pattern 2 | Sourced — unread |
| Cayman Islands | Americas | Tier 3 | Comprehensive law | Data Protection Act 2017 (in force 2019) | Ombudsman | — | Seeded — unchecked |
| Central African Republic | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Chad | Africa | Tier 3 | Comprehensive law | Loi n° 007/PR/2015 du 10 février 2015 | Agence Nationale de Sécurité Informatique et de Certification Électronique (ANSICE) | — | Sourced — unread |
| Chile | Americas | Tier 2 | Comprehensive law | Law 21.719 (fully in force Dec 2026) | Personal Data Protection Agency (from 2026) | — | Sourced — unread |
| China | Asia-Pacific | Tier 2 | Comprehensive law | Personal Information Protection Law, in force 1 Nov 2021 | Cyberspace Administration of China | — | Sourced — unread |
| Colombia | Americas | Tier 3 | Comprehensive law | Law 1581 on Personal Data Protection | SIC | — | Seeded — unchecked |
| Comoros | Africa | Tier 3 | Comprehensive law | Loi relative à la protection des données à caractère personnel, adoptée le 29 juin 2021 | Autorité nationale de protection des données à caractère personnel | — | Seeded — unchecked |
| Congo (Rep.) | Africa | Tier 3 | Comprehensive law | Loi n° 29-2019 du 10 octobre 2019 | Autorité de protection des données à caractère personnel | — | Sourced — unread |
| Costa Rica | Americas | Tier 3 | Comprehensive law | Law 8968 on Personal Data Protection | Prodhab | — | Seeded — unchecked |
| Côte d'Ivoire | Africa | Tier 3 | Comprehensive law | Loi n° 2013-450 du 19 juin 2013 | ARTCI, designated as the Autorité de Protection des Données à Caractère Personnel | — | Sourced — unread |
| Croatia | Europe | Tier 2 | Comprehensive law | Zakon o provedbi Opće uredbe o zaštiti podataka [Act on the Implementation of the General Data Protection Regulation] | Agencija za zaštitu osobnih podataka (AZOP) | — | Sourced — unread |
| Cuba | Americas | Tier 3 | Comprehensive law | Law 149/2022 on Personal Data Protection | — | — | Seeded — unchecked |
| Cyprus | Europe | Tier 2 | Comprehensive law | Ο περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα Νόμος 125(I)/2018 [Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data] | Cypriot Data Protection Authority | — | Sourced — unread |
| Czechia | Europe | Tier 2 | Comprehensive law | Zákon č. 110/2019 Sb., o zpracování osobních údajů [Act No. 110/2019 Coll. on Personal Data Processing] | Office for Personal Data Protection (UOOU) | — | Sourced — unread |
| Denmark | Europe | Tier 2 | Comprehensive law | Databeskyttelsesloven (lov nr. 502 af 23. maj 2018) [Data Protection Act] | Datatilsynet | — | Sourced — unread |
| Djibouti | Africa | Tier 3 | Comprehensive law | Loi n° 019/AN/23/9ème L portant Code du numérique | No dedicated authority | — | Sourced — unread |
| Dominica | Americas | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Dominican Republic | Americas | Tier 3 | Comprehensive law | Law 172-13 on Personal Data Protection | No dedicated DPA | — | Seeded — unchecked |
| DR Congo | Africa | Tier 3 | Comprehensive law | Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique | Autorité de protection des données | — | Seeded — unchecked |
| Ecuador | Americas | Tier 3 | Comprehensive law | LOPDP | Superintendencia de Protección de Datos | — | Seeded — unchecked |
| Egypt | Africa | Tier 3 | Comprehensive law | Law No. 151 of 2020 promulgating the Personal Data Protection Law | Personal Data Protection Centre (PDPC) | — | Seeded — unchecked |
| El Salvador | Americas | Tier 3 | Comprehensive law | Personal Data Protection Law 2024 | State Cybersecurity Agency (ACE) | — | Seeded — unchecked |
| Equatorial Guinea | Africa | Tier 3 | Comprehensive law | Ley núm. 1/2016, de 22 de julio, de Protección de Datos Personales | Órgano Rector de Protección de Datos Personales | — | Seeded — unchecked |
| Eritrea | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Estonia | Europe | Tier 2 | Comprehensive law | Isikuandmete kaitse seadus (IKS) [Personal Data Protection Act] | Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) | — | Sourced — unread |
| Eswatini | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2022 | Eswatini Data Protection Authority (ESCCOM designated) | — | Sourced — unread |
| Ethiopia | Africa | Tier 3 | Comprehensive law | Personal Data Protection Proclamation No. 1321/2024 | Ethiopian Communications Authority (designated) | — | Seeded — unchecked |
| European Union | Supranational | Tier 3 | Comprehensive law | Regulation (EU) 2016/679 (GDPR) | National supervisory authorities, coordinated by the EDPB | — | Sourced — unread |
| Faroe Islands | Europe | Tier 3 | Comprehensive law | Data Protection Act 2020 | Dátueftirlitið | — | Sourced — unread |
| Fiji | Asia-Pacific | Tier 3 | No general law | Constitutional right; no general law | — | — | Seeded — unchecked |
| Finland | Europe | Tier 2 | Comprehensive law | Tietosuojalaki (1050/2018) [Data Protection Act] | Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) | — | Sourced — unread |
| France | Europe | Tier 2 | Comprehensive law | GDPR + Loi Informatique et Libertés | Commission Nationale de l'Informatique et des Libertés (CNIL) | — | Sourced — unread |
| Gabon | Africa | Tier 3 | Comprehensive law | Loi n° 001/2011 du 25 septembre 2011, modifiée par la Loi n° 025/2023 | Autorité pour la Protection des Données à Caractère Personnel et de la Vie Privée (APDPVP) | — | Sourced — unread |
| Gambia | Africa | Tier 3 | Comprehensive law | Personal Data Protection and Privacy Act, 2025 | National Data Protection Commission | — | Seeded — unchecked |
| Georgia | Europe | Tier 3 | Comprehensive law | Law of Georgia on Personal Data Protection, adopted 14 June 2023 | Personal Data Protection Service | — | Sourced — unread |
| Germany | Europe | Tier 1 | Comprehensive law | GDPR supplemented by the Bundesdatenschutzgesetz (BDSG) and 16 Land acts | 16 Land data protection authorities plus the federal BfDI | Pattern 3 | Sourced — unread |
| Ghana | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2012 (Act 843) | Data Protection Commission | — | Sourced — unread |
| Gibraltar | Europe | Tier 3 | Comprehensive law | Gibraltar GDPR + DPA 2004 | GRA | — | Seeded — unchecked |
| Greece | Europe | Tier 2 | Comprehensive law | Νόμος 4624/2019 [Law 4624/2019 on the Personal Data Protection Authority and measures implementing the GDPR] | Hellenic Data Protection Authority | — | Sourced — unread |
| Grenada | Americas | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Guatemala | Americas | Tier 3 | No general law | No general law (drafts circulated) | — | — | Seeded — unchecked |
| Guernsey | Europe | Tier 3 | Comprehensive law | Data Protection (Bailiwick of Guernsey) Law 2017 | ODPA | — | Sourced — unread |
| Guinea | Africa | Tier 3 | Comprehensive law | Loi L/2016/037/AN du 28 juillet 2016 | ARPT exercises data protection functions; a dedicated APDP is legislated for but not operational | — | Sourced — unread |
| Guinea-Bissau | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Guyana | Americas | Tier 3 | Comprehensive law | Data Protection Act 2023 | — | — | Seeded — unchecked |
| Haiti | Americas | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Honduras | Americas | Tier 3 | Draft / pending | Draft data protection bill | — | — | Seeded — unchecked |
| Hong Kong SAR | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data (Privacy) Ordinance (Cap. 486) | Office of the Privacy Commissioner for Personal Data (PCPD) | — | Sourced — unread |
| Hungary | Europe | Tier 2 | Comprehensive law | 2011. évi CXII. törvény az információs önrendelkezési jogról és az információszabadságról (Infotv.) [Act CXII of 2011 on Informational Self-Determination and Freedom of Information] | Hungarian National Authority for Data Protection and Freedom of Information (NAIH) | — | Sourced — unread |
| Iceland | Europe | Tier 2 | Comprehensive law | Lög nr. 90/2018 um persónuvernd og vinnslu persónuupplýsinga [Act No. 90/2018 on Data Protection and the Processing of Personal Data] | Persónuvernd (Icelandic Data Protection Authority) | — | Sourced — unread |
| India | Asia-Pacific | Tier 2 | Comprehensive law | Digital Personal Data Protection Act, 2023, with the DPDP Rules 2025 | Data Protection Board of India | — | Sourced — unread |
| Indonesia | Asia-Pacific | Tier 3 | Comprehensive law | Law No. 27 of 2022 on Personal Data Protection | No dedicated authority | — | Sourced — unread |
| Iran | Middle East | Tier 3 | Draft / pending | None enacted; a bill remains before the Majlis | No dedicated authority | — | Seeded — unchecked |
| Iraq | Middle East | Tier 3 | Draft / pending | None enacted; draft Personal Data Protection Law pending | No dedicated authority | — | Seeded — unchecked |
| Ireland | Europe | Tier 2 | Comprehensive law | GDPR + Data Protection Act 2018 | Data Protection Commission | — | Sourced — unread |
| Isle of Man | Europe | Tier 3 | Comprehensive law | Data Protection Act 2018 (Applied GDPR) | Information Commissioner | — | Sourced — unread |
| Israel | Middle East | Tier 3 | Comprehensive law | Privacy Protection Law 1981 (Amendment 13) | Privacy Protection Authority | — | Sourced — unread |
| Italy | Europe | Tier 2 | Comprehensive law | GDPR + Privacy Code (as amended) | Garante per la protezione dei dati personali | — | Sourced — unread |
| Jamaica | Americas | Tier 3 | Comprehensive law | Data Protection Act 2020 (in force 2023) | Office of the Information Commissioner | — | Seeded — unchecked |
| Japan | Asia-Pacific | Tier 2 | Comprehensive law | APPI (as amended) | PPC | — | Sourced — unread |
| Jersey | Europe | Tier 3 | Comprehensive law | Data Protection (Jersey) Law 2018 | JOIC | — | Sourced — unread |
| Jordan | Middle East | Tier 3 | Comprehensive law | Personal Data Protection Law No. (24) of 2023 | Personal Data Protection Council | — | Sourced — unread |
| Kazakhstan | Asia-Pacific | Tier 3 | Comprehensive law | Law on Personal Data and Its Protection, No. 94-V of 21 May 2013 | Ministry of Digital Development (Information Security Committee) | — | Seeded — unchecked |
| Kenya | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2019 (No. 24 of 2019) | Office of the Data Protection Commissioner (ODPC) | — | Sourced — unread |
| Kiribati | Asia-Pacific | Tier 3 | No general law | No comprehensive law | No dedicated authority | — | Seeded — unchecked |
| Kosovo | Europe | Tier 3 | Comprehensive law | Law No. 06/L-082 on Protection of Personal Data | Information and Privacy Agency | — | Seeded — unchecked |
| Kuwait | Middle East | Tier 3 | Sectoral / partial | Data Privacy Protection Regulation, CITRA Resolution No. 42 of 2021 (amended 2024) | Communication and Information Technology Regulatory Authority (CITRA) | — | Sourced — unread |
| Kyrgyzstan | Asia-Pacific | Tier 3 | Comprehensive law | Law on Personal Information, No. 58 of 14 April 2008 | State Agency for Personal Data Protection under the Cabinet of Ministers | — | Seeded — unchecked |
| Laos | Asia-Pacific | Tier 3 | Sectoral / partial | Electronic Data Protection Law | MTC | — | Seeded — unchecked |
| Latvia | Europe | Tier 2 | Comprehensive law | Fizisko personu datu apstrādes likums [Personal Data Processing Law] | Data State Inspectorate (DVI) | — | Sourced — unread |
| Lebanon | Middle East | Tier 3 | Comprehensive law | Law No. 81 of 2018 on Electronic Transactions and Personal Data | No dedicated authority | — | Seeded — unchecked |
| Lesotho | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2011 | Data Protection Commission (never constituted) | — | Seeded — unchecked |
| Liberia | Africa | Tier 3 | Draft / pending | Personal Data Protection and Privacy Act (bill, not enacted) | No dedicated authority | — | Seeded — unchecked |
| Libya | Africa | Tier 3 | Sectoral / partial | No comprehensive law; Laws 6 and 5 of 2022 contain personal data provisions | No dedicated authority | — | Seeded — unchecked |
| Liechtenstein | Europe | Tier 2 | Comprehensive law | Datenschutzgesetz (DSG) vom 4. Oktober 2018 [Data Protection Act] | Data Protection Authority, Principality of Liechtenstein | — | Sourced — unread |
| Lithuania | Europe | Tier 2 | Comprehensive law | Asmens duomenų teisinės apsaugos įstatymas [Law on Legal Protection of Personal Data] | State Data Protection Inspectorate | — | Sourced — unread |
| Luxembourg | Europe | Tier 2 | Comprehensive law | Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en œuvre du règlement (UE) 2016/679 [Act of 1 August 2018 organising the CNPD and implementing the GDPR] | Commission Nationale pour la Protection des Données (CNPD) | — | Sourced — unread |
| Macau SAR | Asia-Pacific | Tier 3 | Comprehensive law | PDPA (Law 8/2005) | GPDP | — | Seeded — unchecked |
| Madagascar | Africa | Tier 3 | Comprehensive law | Loi n° 2014-038 du 9 janvier 2015 | Commission Malagasy de l'Informatique et des Libertés (CMIL) | — | Sourced — unread |
| Malawi | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2024 | Malawi Communications Regulatory Authority (MACRA) | — | Sourced — unread |
| Malaysia | Asia-Pacific | Tier 3 | Comprehensive law | PDPA 2010 (amended 2024) | PDP Commissioner (JPDP) | — | Seeded — unchecked |
| Maldives | Asia-Pacific | Tier 3 | No general law | No general law (draft discussed) | — | — | Seeded — unchecked |
| Mali | Africa | Tier 3 | Comprehensive law | Loi n° 2013-015 du 21 mai 2013, modifiée par la loi n° 2017-070 | Autorité de Protection des Données à Caractère Personnel (APDP) | — | Sourced — unread |
| Malta | Europe | Tier 2 | Comprehensive law | Data Protection Act (Chapter 586) | Office of the Information and Data Protection Commissioner (IDPC) | — | Sourced — unread |
| Marshall Islands | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Mauritania | Africa | Tier 3 | Comprehensive law | Loi n° 2017-020 du 22 juillet 2017 | Autorité de Protection des Données à Caractère Personnel (APD) | — | Sourced — unread |
| Mauritius | Africa | Tier 3 | Comprehensive law | Data Protection Act 2017 (Act No. 20 of 2017) | Data Protection Office | — | Sourced — unread |
| Mexico | Americas | Tier 3 | Comprehensive law | LFPDPPP 2025 (replacing the 2010 law) | Anti-Corruption & Good Governance Secretariat | Pattern 3 | Seeded — unchecked |
| Micronesia | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Moldova | Europe | Tier 3 | Comprehensive law | Law 133/2011 on Personal Data Protection | NCPDP | — | Seeded — unchecked |
| Monaco | Europe | Tier 3 | Comprehensive law | Law 1.565 (GDPR-aligned) | CCIN | — | Seeded — unchecked |
| Mongolia | Asia-Pacific | Tier 3 | Comprehensive law | Law on Protection of Personal Information | — | — | Seeded — unchecked |
| Montenegro | Europe | Tier 3 | Comprehensive law | Personal Data Protection Law (new draft pending) | AZLP | — | Seeded — unchecked |
| Morocco | Africa | Tier 3 | Comprehensive law | Loi n° 09-08 (2009) | Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) | — | Sourced — unread |
| Mozambique | Africa | Tier 3 | Draft / pending | Proposta de Lei (bill, not in force) | No dedicated authority | — | Sourced — unread |
| Myanmar | Asia-Pacific | Tier 3 | No general law | No general law (cyber-law provisions only) | — | — | Seeded — unchecked |
| Namibia | Africa | Tier 3 | Draft / pending | Data Protection Bill (draft, not enacted) | No dedicated authority | — | Seeded — unchecked |
| Nauru | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Nepal | Asia-Pacific | Tier 3 | Comprehensive law | Privacy Act 2018 | No dedicated DPA | — | Seeded — unchecked |
| Netherlands | Europe | Tier 2 | Comprehensive law | GDPR + Implementation Act (UAVG) | Autoriteit Persoonsgegevens | — | Sourced — unread |
| New Zealand | Asia-Pacific | Tier 3 | Comprehensive law | Privacy Act 2020 | OPC | — | Sourced — unread |
| Nicaragua | Americas | Tier 3 | Comprehensive law | Law 787 on Personal Data Protection | DIPRODAP (nominal) | — | Seeded — unchecked |
| Niger | Africa | Tier 3 | Comprehensive law | Loi n° 2022-59 du 16 décembre 2022 | Haute Autorité de Protection des Données à caractère Personnel (HAPDP) | — | Sourced — unread |
| Nigeria | Africa | Tier 2 | Comprehensive law | Nigeria Data Protection Act, 2023 (Act No. 37 of 2023) | Nigeria Data Protection Commission (NDPC) | — | Sourced — unread |
| North Korea | Asia-Pacific | Tier 3 | No general law | No verifiable law | No dedicated authority | — | Seeded — unchecked |
| North Macedonia | Europe | Tier 3 | Comprehensive law | Law on Personal Data Protection (GDPR-aligned) | PDPA (DZLP) | — | Seeded — unchecked |
| Norway | Europe | Tier 2 | Comprehensive law | Personopplysningsloven (lov 15. juni 2018 nr. 38) [Personal Data Act] | Datatilsynet | — | Sourced — unread |
| Oman | Middle East | Tier 3 | Comprehensive law | PDPL (Royal Decree 6/2022) | MTCIT | — | Seeded — unchecked |
| Pakistan | Asia-Pacific | Tier 3 | Draft / pending | Personal Data Protection Bill (pending) | — | — | Seeded — unchecked |
| Palau | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Palestine | Middle East | Tier 3 | Draft / pending | Draft data protection law | — | — | Seeded — unchecked |
| Panama | Americas | Tier 3 | Comprehensive law | Law 81 on Personal Data Protection | ANTAI | — | Seeded — unchecked |
| Papua New Guinea | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Paraguay | Americas | Tier 3 | Comprehensive law | Personal Data Protection Law (phased entry) | — | — | Seeded — unchecked |
| Peru | Americas | Tier 3 | Comprehensive law | Law 29733 (2025 regulations) | ANPD (MINJUS) | — | Seeded — unchecked |
| Philippines | Asia-Pacific | Tier 3 | Comprehensive law | Data Privacy Act 2012 | NPC | — | Seeded — unchecked |
| Poland | Europe | Tier 2 | Comprehensive law | Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych [Act of 10 May 2018 on the Protection of Personal Data] | Urząd Ochrony Danych Osobowych (UODO) | — | Sourced — unread |
| Portugal | Europe | Tier 2 | Comprehensive law | Lei n.º 58/2019, de 8 de agosto [Law No. 58/2019 of 8 August implementing the GDPR] | Comissão Nacional de Proteção de Dados (CNPD) | — | Sourced — unread |
| Qatar | Middle East | Tier 3 | Comprehensive law | Law 13/2016 on Personal Data Privacy Protection | NCGAA (+ separate QFC regime) | — | Seeded — unchecked |
| Romania | Europe | Tier 2 | Comprehensive law | Legea nr. 190/2018 privind măsuri de punere în aplicare a Regulamentului (UE) 2016/679 [Law No. 190/2018 on implementing measures for Regulation (EU) 2016/679] | The National Supervisory Authority for Personal Data Processing (ANSPDCP) | — | Sourced — unread |
| Russia | Europe | Tier 3 | Comprehensive law | Federal Law 152-FZ on Personal Data | Roskomnadzor | — | Seeded — unchecked |
| Rwanda | Africa | Tier 3 | Comprehensive law | Law No. 058/2021 of 13/10/2021 | National Cyber Security Authority — Data Protection and Privacy Office | — | Sourced — unread |
| Samoa | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| San Marino | Europe | Tier 3 | Comprehensive law | Law 171/2018 | Data Protection Authority | — | Seeded — unchecked |
| São Tomé & Príncipe | Africa | Tier 3 | Comprehensive law | Lei n.º 3/2016 de Protecção de Dados Pessoais | Agência Nacional de Protecção de Dados Pessoais (ANPDP) | — | Seeded — unchecked |
| Saudi Arabia | Middle East | Tier 2 | Comprehensive law | PDPL (amended 2023) | SDAIA | — | Sourced — unread |
| Senegal | Africa | Tier 3 | Comprehensive law | Loi n° 2008-12 du 25 janvier 2008 | Commission de Protection des Données Personnelles (CDP) | — | Sourced — unread |
| Serbia | Europe | Tier 3 | Comprehensive law | Law on Personal Data Protection (GDPR-modelled) | Poverenik (Commissioner) | — | Seeded — unchecked |
| Seychelles | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2023 (Act 24 of 2023) | Information Commission | — | Sourced — unread |
| Sierra Leone | Africa | Tier 3 | Draft / pending | Data Protection and Right to Access Information Bill, 2025 (draft) | No dedicated authority | — | Seeded — unchecked |
| Singapore | Asia-Pacific | Tier 3 | Comprehensive law | PDPA 2012 (amended 2020) | PDPC | — | Seeded — unchecked |
| Slovakia | Europe | Tier 2 | Comprehensive law | Zákon č. 18/2018 Z. z. o ochrane osobných údajov [Act No. 18/2018 Coll. on Personal Data Protection] | Úrad na ochranu osobných údajov Slovenskej republiky (DPU) | — | Sourced — unread |
| Slovenia | Europe | Tier 2 | Comprehensive law | Zakon o varstvu osebnih podatkov (ZVOP-2) [Personal Data Protection Act] | Information Commissioner of the Republic of Slovenia | — | Sourced — unread |
| Solomon Islands | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Somalia | Africa | Tier 3 | Comprehensive law | Data Protection Act, Law No. 005 of 2023 | Data Protection Authority | — | Sourced — unread |
| South Africa | Africa | Tier 2 | Comprehensive law | Protection of Personal Information Act, 2013 (Act 4 of 2013) — POPIA | The Information Regulator (South Africa) | — | Sourced — unread |
| South Korea | Asia-Pacific | Tier 3 | Comprehensive law | PIPA (as amended 2023) | PIPC | — | Sourced — unread |
| South Sudan | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Spain | Europe | Tier 2 | Comprehensive law | GDPR + LOPDGDD | Agencia Española de Protección de Datos (AEPD) | Pattern 3 | Sourced — unread |
| Sri Lanka | Asia-Pacific | Tier 3 | Comprehensive law | PDPA No. 5 of 2022 (phased) | Data Protection Authority | — | Seeded — unchecked |
| St Kitts & Nevis | Americas | Tier 3 | Comprehensive law | Data Protection Act 2018 | — | — | Seeded — unchecked |
| St Lucia | Americas | Tier 3 | Comprehensive law | Data Protection Act 2011 (partially in force) | — | — | Seeded — unchecked |
| St Vincent & the Grenadines | Americas | Tier 3 | Sectoral / partial | Privacy Act 2003 (limited) | — | — | Seeded — unchecked |
| Sudan | Africa | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Suriname | Americas | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Sweden | Europe | Tier 2 | Comprehensive law | Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning (dataskyddslagen) [Act (2018:218) with supplementary provisions to the EU GDPR] | Integritetsskyddsmyndigheten (IMY) | — | Sourced — unread |
| Switzerland | Europe | Tier 2 | Comprehensive law | Revised FADP | FDPIC | Pattern 3 | Sourced — unread |
| Syria | Middle East | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Taiwan | Asia-Pacific | Tier 3 | Comprehensive law | PDPA (2023 amendments) | PDPC (being established) | — | Seeded — unchecked |
| Tajikistan | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data Law 1537 | — | — | Seeded — unchecked |
| Tanzania | Africa | Tier 3 | Comprehensive law | Personal Data Protection Act, 2022 (Act No. 11 of 2022) | Personal Data Protection Commission (PDPC) | — | Sourced — unread |
| Thailand | Asia-Pacific | Tier 3 | Comprehensive law | PDPA (in force 2022) | PDPC | — | Seeded — unchecked |
| Timor-Leste | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Togo | Africa | Tier 3 | Comprehensive law | Loi n° 2019-014 du 29 octobre 2019 | Instance de Protection des Données à Caractère Personnel (IPDCP) | — | Sourced — unread |
| Tonga | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Trinidad & Tobago | Americas | Tier 3 | Sectoral / partial | Data Protection Act 2011 (partially proclaimed) | Office of the Information Commissioner | — | Seeded — unchecked |
| Tunisia | Africa | Tier 3 | Comprehensive law | Loi organique n° 2004-63 du 27 juillet 2004 | Instance Nationale de Protection des Données à Caractère Personnel (INPDP) | — | Sourced — unread |
| Türkiye | Europe | Tier 3 | Comprehensive law | Law 6698 (KVKK, amended 2024) | KVKK Authority | — | Seeded — unchecked |
| Turkmenistan | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data Law | — | — | Seeded — unchecked |
| Tuvalu | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Uganda | Africa | Tier 3 | Comprehensive law | Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) | Personal Data Protection Office (PDPO) | — | Sourced — unread |
| Ukraine | Europe | Tier 3 | Comprehensive law | Law 2297-VI (EU-aligned bill pending) | Parliament Commissioner (Ombudsman) | — | Seeded — unchecked |
| United Arab Emirates | Middle East | Tier 2 | Comprehensive law | Federal Decree-Law 45/2021 (+ DIFC / ADGM regimes) | UAE Data Office | — | Sourced — unread |
| United Kingdom | Europe | Tier 1 | Comprehensive law | Data Protection Act 2018 + UK GDPR | Information Commissioner's Office (ICO) | Pattern 4 | Verified |
| United States | Americas | Tier 2 | Sectoral / partial | Sectoral federal laws + ~20 state privacy acts | FTC + state regulators | Pattern 1 | Sourced — unread |
| Uruguay | Americas | Tier 3 | Comprehensive law | Law 18.331 on Personal Data Protection | URCDP | — | Sourced — unread |
| Uzbekistan | Asia-Pacific | Tier 3 | Comprehensive law | Personal Data Law 547 (localisation 2021) | Personalisation Agency (Uzkomnazorat) | — | Seeded — unchecked |
| Vanuatu | Asia-Pacific | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Venezuela | Americas | Tier 3 | No general law | Constitutional habeas data only | — | — | Seeded — unchecked |
| Vietnam | Asia-Pacific | Tier 3 | Comprehensive law | PDP Law 2025 (in force Jan 2026) | Ministry of Public Security (A05) | — | Seeded — unchecked |
| Yemen | Middle East | Tier 3 | No general law | No general data protection law | — | — | Seeded — unchecked |
| Zambia | Africa | Tier 3 | Comprehensive law | Data Protection Act, 2021 (Act No. 3 of 2021) | Office of the Data Protection Commissioner | — | Sourced — unread |
| Zimbabwe | Africa | Tier 3 | Comprehensive law | Cyber and Data Protection Act [Chapter 12:07] (Act No. 5 of 2021) | Postal and Telecommunications Regulatory Authority (POTRAZ) | — | Sourced — unread |
No jurisdiction matches those filters.