Data Privacy Laws by Country: The Global List (2026)

Your first enterprise customer in Germany sends a vendor questionnaire. Your second, in Toronto, asks whether you meet Quebec's rules. A reseller in Sydney wants to know how you handle Australian personal information. Nobody on your team can say which of these laws actually applies to you.

More than 170 countries have a data privacy law, but a handful do most of the work for a SaaS company: the EU and UK GDPR, a growing set of US state laws, Canada's PIPEDA and Quebec's Law 25, Australia's Privacy Act, and the national laws of India, China and Brazil. What decides which ones bind you is where your users are, not where your company is registered.

This guide maps data privacy laws by country worldwide. It covers the laws that matter most, with effective dates, regulators and maximum penalties, and ends with a practical way to work out which of them apply to you. Dates and fines are current as of October 2026.

One boundary up front: if you need the list of EU and EEA member states or the full list of countries the EU has recognised as adequate, that sits in our dedicated guide to GDPR countries. Here, GDPR gets one entry among many.

Here's what's ahead:

• How many countries have data privacy laws, and what they share
• A comparison table of the main laws, regulators and maximum penalties
• Europe, the United States, Canada, Australia and New Zealand in detail
• Asia-Pacific, Latin America, the Middle East and Africa
• Where GDPR-like laws differ, and a guide to which laws apply to you
• The mistakes teams make when reading these laws

How Many Countries Have Data Privacy Laws, and What Global Data Privacy Laws Share

172 countries had a data privacy law by March 2025, according to Graham Greenleaf of Macquarie Law School. His count, published in Privacy Laws & Business International Report issue 195 on 5 June 2025, finds that new laws arrived at an average of 3.3 countries per year since 1973, and at 5.4 per year since 2020. Source: Greenleaf, Privacy Laws & Business.

The pace matters for you. A market you could ignore two years ago may now have a regulator and fines, which is why a static list of data privacy laws by country goes stale quickly. Our list of countries with data privacy laws includes several that only began to bite in 2025 or 2026.

Almost every national law is built from the same five parts:

• A lawful basis for processing: a legal reason to collect and use personal data (consent is only one option under most laws).
• Individual rights: access, correction, deletion and, in many laws, portability or objection.
• Security and breach notification: a duty to protect data and to tell a regulator or individuals when it leaks.
• A regulator with enforcement power: a named authority that can investigate and fine.
• Cross-border transfer rules: limits on moving data to other countries.

If you have built a GDPR programme, you already own most of these. The work is in the differences, which the later sections cover.

Data Privacy Laws by Country: A List of Data Privacy Laws and Penalties

The table below is the quick reference to data privacy laws by country and the global data privacy laws behind them, a list of data privacy laws and fines in one place. Each row is covered in the regional sections that follow, with scope and caveats. Penalty figures are the maximums written into each law, not typical fines.

Where a cell says "not confirmed," we could not verify the figure on a primary government source, and we have preferred a gap over a guess.

Data Privacy Laws by Country in Europe: GDPR, UK GDPR and Swiss FADP

Europe sets the template that data protection laws by country elsewhere copy, so it is worth knowing exactly where it ends. These GDPR like laws appear in almost every region below.

Data privacy laws by country in the EU and EEA: the GDPR

The General Data Protection Regulation applies from 25 May 2018, per Article 99 of the regulation. It covers processing by organisations established in the EU, and also by organisations outside it that offer goods or services to people in the EU or monitor their behaviour there (Article 3).

Penalties come in two tiers under Article 83. The higher tier is €20 million or 4% of total worldwide annual turnover, whichever is higher. The lower tier is €10 million or 2%.

That extraterritorial reach is why a US startup with a few EU users can be in scope. Our guide to GDPR compliance for US companies walks through exactly that situation, and the GDPR compliance guide covers the obligations themselves.

One thing to watch: the European Commission proposed a "Digital Omnibus" on 19 November 2025 that would amend parts of GDPR, including extending the breach-notification deadline from 72 to 96 hours and limiting reports to high-risk breaches. As of October 2026 it is still moving through the European Parliament and the Council, and the GDPR in force is unchanged.

UK data privacy laws by country: UK GDPR and the Data (Use and Access) Act

After Brexit the UK kept GDPR as the UK GDPR, alongside the Data Protection Act 2018. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amended both. The ICO has said the data protection provisions commenced in phases, with most in force from 5 February 2026.

The UK keeps the headline fine level:

• Higher tier: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.
• Standard tier: £8.7 million or 2%.

The ICO states that the new Act did not change these maximums.

Source: ICO fining guidance.

The UK GDPR has its own extraterritorial reach: it applies to non-UK organisations that offer goods or services to people in the UK or monitor their behaviour there. If you serve both the EU and the UK, you are working under two near-identical regimes with separate regulators.

To see how close the three European regimes are, and where they split, compare them side by side:

Switzerland: the revised FADP

Switzerland's revised Federal Act on Data Protection took effect on 1 September 2023. It is closer in spirit to GDPR than any other non-EU European law, but its enforcement is different: the maximum fine is CHF 250,000, it falls on the responsible natural person rather than the company, and it applies to intentional breaches.

A business can be fined up to CHF 50,000 where identifying the individual would take disproportionate effort. Prosecution is handled by the cantons, not the Federal Data Protection and Information Commissioner. Source: FDPIC on criminal provisions.

Verdict: Europe is the highest-fine, highest-scrutiny region. If you comply here first, you cover most of the other laws in this guide.

US Data Privacy Laws by State: The Full List of US State Privacy Laws

The United States has the most fragmented data privacy laws by country, and it is the market where the question "which law applies to me" is hardest, because there is no single answer.

Data privacy laws by country: does the US have a federal law?

No. As of October 2026, no federal comprehensive consumer privacy law has been enacted. A bill called the SECURE Data Act (H.R. 8413) was introduced in the House on 21 April 2026 and had a subcommittee hearing on 3 June 2026, but we found no record of a markup or floor vote, and Democrats have objected to its preemption of state laws.

State privacy laws list with effective dates

US state privacy laws are the fastest-growing group: twenty states have a comprehensive consumer privacy law in effect as of October 2026, and four more (Oklahoma, Louisiana, Alabama and Vermont) have signed laws that take effect in 2027 and 2028. That makes 24 enacted. Some trackers count 23 because they leave out Florida, whose law has a very high revenue threshold. Either way, the direction is one-way.

Sources: Enzuzo's state tracker, Perkins Coie, Troutman Pepper Locke on Louisiana and Hunton on Vermont.

The thresholds differ by state, and that is where small companies get caught. Indiana and Kentucky apply at 100,000 consumers, Rhode Island at 35,000 and Alabama at 25,000, the lowest of the 2026 group. Indiana and Kentucky allow up to $7,500 per violation with a 30-day cure period that has no expiry date. Rhode Island's penalty is up to $10,000 per violation with no cure period. Source: Koley Jessen on the three 2026 laws.

The two newest laws set their own tests. Louisiana's applies if you meet any one of three conditions: more than $25 million in annual gross revenue, personal data on 75,000 or more consumers, households or devices, or half your revenue from selling personal data. Its 30-day cure period ends on 31 July 2027.

Vermont's applies at 35,000 residents, or the sensitive data of 3,000 residents, or the sale of 3,000 residents' data, and its 60-day cure period runs from 1 January 2028 to 30 June 2029.

Sources: Davis Wright Tremaine on Louisiana and Hunton on Vermont.

California is the one most companies hit first. Its penalties, adjusted for inflation from 1 January 2025, are $2,663 per violation and $7,988 per intentional violation or violation involving a consumer under 16. Source: CPPA CPI adjustment. For the full California picture, see our CCPA compliance guide, and for tooling, best CCPA compliance software.

Federal sector laws: HIPAA, GLBA and COPPA

Even without a general law, federal statutes cover specific data: HIPAA for health information (the Privacy Rule sits at 45 CFR Parts 160 and 164), the Gramm-Leach-Bliley Act for financial institutions (the FTC's Privacy Rule and Safeguards Rule are at 16 CFR Parts 313 and 314), and the Children's Online Privacy Protection Act for children under 13 (16 CFR Part 312). These apply on top of state laws.

Data Privacy Laws by Country: Canada, Australia and New Zealand

Data privacy regulations by country in these three markets share a common-law tradition and a habit of reforming privacy law in steps rather than in one big bang.

Canada data privacy laws by country: PIPEDA and Quebec's Law 25

Canada's federal law is the Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner of Canada. It covers federal works and businesses, and commercial activity in provinces without substantially similar legislation, including cross-border transfers of data in the course of commercial activity. Offences carry fines of up to $100,000 on indictment. Source: PIPEDA, Justice Laws.

Quebec is stricter. Its Law 25 phased in from 22 September 2022, with most provisions in force from 22 September 2023. Administrative penalties reach $10 million or 2% of worldwide revenue, and penal fines reach $25 million or 4%, whichever is higher. Source: Gouvernement du Québec.

A federal replacement is in progress. Bill C-27 died when Parliament was prorogued on 6 January 2025. Bill C-36, the Protecting Privacy and Consumer Data Act, was introduced on 15 June 2026 and was at second reading in the House of Commons at our last check. It is not law, and PIPEDA remains in force. Source: LEGISinfo, Bill C-36.

Australia: the Privacy Act 1988 and its reforms

The Privacy Act 1988 applies to Australian government agencies and to private organisations with annual turnover above A$3 million, under 13 Australian Privacy Principles. Source: OAIC.

The 2024 amendments changed the stakes in two ways:

• A new right to sue: a statutory tort for serious invasions of privacy commenced on 10 June 2025, and it applies to individuals and organisations, not only entities covered by the Act.
• Bigger penalties: serious or repeated interference with privacy now carries a penalty of the greatest of A$50 million, three times the benefit obtained, or 30% of adjusted turnover. Sources: OAIC statutory tort and OAIC regulatory action guide.

Two more things are moving. The OAIC published an exposure draft of a Children's Online Privacy Code on 31 March 2026, and a new automated decision-making transparency requirement starts on 10 December 2026: privacy policies must describe the kinds of personal information used in, and the decisions made or substantially assisted by, computer programs that significantly affect individuals. Source: Allens.

Putting the three side by side:

New Zealand: the Privacy Act 2020

New Zealand's Privacy Act 2020 took effect on 1 December 2020. The Privacy Amendment Act 2025 received Royal Assent on 23 September 2025, and its new Information Privacy Principle 3A, which requires telling people when you collect their data indirectly from another source, came into force on 1 May 2026. Sources: NZ Ministry of Justice and Office of the Privacy Commissioner.

Verdict: Canada is the one to plan for first, because Quebec's fines rival GDPR's and a federal rewrite is on the way. Australia is the fastest-tightening law in this group.

Asia-Pacific Data Privacy Laws by Country: India, China, Japan and More

Asia-Pacific has the most countries with data privacy laws that changed recently, and these are the global data privacy laws to watch. Most of the figures below come from law-firm trackers rather than government text, because several government sites blocked our review.

India: the DPDP Act and Rules

India's Digital Personal Data Protection Act, 2023 now has its rules. The DPDP Rules, 2025 were notified on 13 November 2025, and commencement is phased:

• 13 November 2025: the provisions creating the Data Protection Board.
• 13 November 2026: consent manager registration.
• 13 May 2027: the core obligations on organisations.

Until then, India's older IT Act rules continue to apply. The Act covers digital personal data processed in India and processing outside India connected to offering goods or services to people in India. The maximum penalty is INR 250 crore (about US$30 million) for most contraventions. Sources: DLA Piper and S.S. Rana.

China: the PIPL

China's Personal Information Protection Law took effect on 1 November 2021. It applies to processing outside China if the aim is to provide products or services to people in China or to analyse their behaviour. Fines for serious violations reach RMB 50 million or 5% of the prior year's revenue, whichever is greater, and the CAC can suspend apps or services.

A 2025 addition matters for larger processors: audit measures effective 1 May 2025 require controllers handling the data of more than 10 million people to self-audit at least every two years. Source: DLA Piper on China.

Japan, South Korea and Singapore

• Japan's APPI is enforced by the Personal Information Protection Commission. An amendment was promulgated on 17 July 2026 that introduces administrative surcharges, but the main reforms take effect by Cabinet Order no later than 17 July 2028, so no administrative fine is in force today. Heavier criminal penalties take effect on 17 January 2027. Current corporate criminal fines reach JPY 100 million for certain offences. Sources: A&O Shearman and DLA Piper on Japan.
• South Korea's PIPA was amended in 2026, with most provisions effective 11 September 2026. The penalty surcharge cap rises from 3% to 10% of total revenue for repeated intentional or grossly negligent violations, and for harm affecting 10 million or more people. Mandatory ISMS-P certification fines start on 1 July 2027. Source: BKL.
• Singapore's PDPA allows fines up to S$1 million or 10% of annual turnover for organisations with turnover above S$10 million, and requires breach notification to the PDPC within three calendar days. Source: DLA Piper on Singapore.

Vietnam, Thailand and Indonesia

• Vietnam's Law No. 91/2025/QH15 took effect on 1 January 2026, and is enforced by the Ministry of Public Security. Most violations are capped at VND 3 billion, but selling personal data can cost 10 times the revenue, and cross-border transfer violations up to 5% of prior-year revenue. These fines need a separate sanctioning decree, which the Ministry was preparing in April 2026, so check that it has been issued. Source: DLA Piper on Vietnam.
• Thailand's PDPA has been fully in effect since 1 June 2022, with administrative fines up to THB 5 million. Enforcement is real: in August 2025 the regulator announced eight fines across five cases, totalling about THB 21.5 million. Source: Tilleke & Gibbins.
• Indonesia's PDP Law has been enforceable since the transition period ended on 17 October 2024, with administrative fines up to 2% of annual revenue and criminal penalties for unlawful collection or disclosure. The Ministry of Communications and Digital Affairs handles enforcement for now. The presidential regulation creating a dedicated PDP agency was still awaiting approval in 2026, and we could not confirm the agency is operating. Sources: DLA Piper on Indonesia and Rajah & Tann.

Verdict: For a SaaS company, India and China matter first. India's core obligations start in May 2027, which is closer than it feels.

Data Protection Laws by Country in Latin America, the Middle East and Africa

In these regions, data privacy laws by country are where "do we have to care?" is most often answered wrongly, in both directions.

Brazil, Mexico, Chile and Argentina

• Brazil's LGPD has been in force since September 2020, with administrative sanctions enforceable from 1 August 2021. It applies where processing happens in Brazil, targets people in Brazil, or uses data collected there. Fines reach 2% of Brazilian revenue, up to R$50 million per infraction. The ANPD became an autonomous federal agency in 2025. Source: DLA Piper on Brazil.
• Mexico replaced its 2010 private-sector privacy law with a new one published on 20 March 2025 and in force the next day. The regulator is now the Secretariat of Anticorruption and Good Governance, which replaced INAI. Fines range from 100 to 320,000 times the daily UMA unit. Source: Clym on the LFPDPPP.
• Chile's Law 21.719 creates a new Data Protection Agency and is scheduled to take effect on 1 December 2026. The government filed a bill on 1 September 2026 to push that to 1 December 2027, and it was still in the Senate at our last check. Treat the date as unsettled. Fines run up to 5,000, 10,000 and 20,000 UTM for minor, serious and very serious infractions, and large companies face 2% to 4% of prior-year revenue. Sources: Carey on the postponement bill and DLA Piper on Chile.
• Argentina's Law 25.326, from 2000, is enforced by the Agency for Access to Public Information and holds EU adequacy status. Fine amounts are not confirmed here.

UAE, Saudi Arabia and Turkey

• Saudi Arabia's PDPL took effect on 14 September 2023, with a compliance deadline of 14 September 2024, and is enforced by SDAIA. Disclosing or publishing sensitive data to cause harm can bring up to two years in prison and a SAR 3 million fine. Other breaches face warnings or fines up to SAR 5 million. It reaches foreign organisations that process data about people in Saudi Arabia. Source: DLA Piper on Saudi Arabia.
• The UAE's federal PDPL (Federal Decree-Law 45 of 2021) came into force on 2 January 2022, according to the UAE government portal. DLA Piper reported in January 2025 that the executive regulations had not been published and the UAE Data Office had not been established, and the law leaves penalties to a later Cabinet decision. The free zones DIFC and ADGM run their own regimes. Treat UAE enforcement as unsettled. Sources: UAE government portal and DLA Piper on the UAE.
• Turkey's KVKK (Law No. 6698) dates from 7 April 2016. Law No. 7499, published on 12 March 2024, replaced its cross-border transfer regime from 1 June 2024. Penalty amounts are revalued each year, and for 2026 the top administrative fine, for data-security failures, is TRY 17,092,242. Source: Cott Group.

South Africa, Nigeria and Kenya

• South Africa's POPIA is enforced by the Information Regulator, with criminal penalties up to 10 years and fines up to R10 million for listed offences.
• Nigeria's Data Protection Act 2023, which received assent on 13 June 2023, created the Nigeria Data Protection Commission. Entities of "major importance" (more than 200 data subjects in six months, or designated sectors like finance, health and telecoms) face fines of the greater of ₦10 million or 2% of annual gross revenue.
• Kenya's Data Protection Act 2019 took effect on 25 November 2019. The maximum administrative fine is KES 5 million or 1% of the preceding year's turnover, whichever is lower. Source: DLA Piper on Kenya.

Verdict: Brazil is the one Latin American law most SaaS companies must plan for. In the Middle East, Saudi Arabia is the clearest and most enforced.

GDPR Like Laws: Where Privacy Laws Around the World Differ

If the building blocks are shared across privacy laws around the world, why can't you comply once and be done? Because three things vary widely.

• Penalty basis: GDPR, the UK, Quebec, China and Singapore tie fines to a percentage of revenue. India, Vietnam, Thailand and Saudi Arabia cap fines at a fixed currency amount. Japan and Switzerland lean on criminal provisions against individuals.
• Reach: Most of these global data privacy laws and data privacy regulations by country reach foreign companies that serve people in their territory. Saudi Arabia, China, Brazil and India do. US state laws are triggered by consumer-count and revenue thresholds, not by location of the company.
• Timing: Several laws are mid-rollout, which means a "compliant today" answer can be wrong in six months. India's core obligations start in May 2027, Chile's law is scheduled for December 2026 or later, and Japan's surcharges arrive by 2028.

Strictest data privacy laws by country: how to compare

On the measure of the maximum fine, the highest ceilings sit with GDPR, the UK and Quebec at 4% of global revenue, and with Australia's 30% of adjusted turnover and China's 5%. On the measure of breadth, GDPR is still the benchmark that others copy. There is no single ranking: the strictest law for you is the one that covers your users and has an active regulator.

Which Privacy Laws Apply to My Business? A Practical Guide

Mapping data privacy laws by country to your business sounds legal, but you can answer most of it with a data pull from your own product analytics. Privacy laws around the world and us state privacy laws alike key off your users.

Start with where your users and customers are, not where your company is registered. A Delaware company with users in Quebec and Brazil answers to Quebec's regulator and Brazil's ANPD for that data.

Then work down this table:

If GDPR is on your list, two follow-up reads help: whether you need an EU representative under GDPR, and what the GDPR breach notification clock requires.

A minimum viable global privacy programme, in order:

1. Map your data: what personal data you hold, where it flows, and who processes it.
2. Publish an accurate privacy notice that names the rights you honour.
3. Set up a way to handle individual requests within the shortest deadline of any law that applies to you.
4. Write a breach response plan with the shortest notification deadline across your markets.
5. Sign data processing agreements with every vendor that touches personal data.
6. Review quarterly, because dates and thresholds in this guide are changing.

Common Mistakes When Reading Data Privacy Laws by Country

These are the errors that most often trip up teams building a country-by-country view.

• Assuming headquarters decides applicability. The location of the individual usually decides it.
• Treating US state laws as one law. They share a family resemblance but differ on thresholds, definitions and cure periods.
• Equating "no law" with "no obligation." Contracts, sector rules and customer questionnaires impose duties even where no national law exists.
• Copying GDPR fines as the only risk. Australia's tort, Quebec's penal fines and China's suspension powers are different shapes of risk.
• Using stale effective dates. Several laws here (India, Chile, Japan, South Korea) have changed dates within the last year.
• Ignoring localization and transfer rules. Where data is stored can matter as much as how it is handled.

How ComplyJet Fits Into a Global Privacy Programme

We built ComplyJet for early-stage teams who need privacy and security controls to hold up in an enterprise review. GDPR and CCPA are among the frameworks we support, alongside SOC 2, ISO 27001 and HIPAA, and a team that has done the data mapping and policy work once can reuse it across several of the laws in this guide.

Be clear about what that means.

ComplyJet is compliance automation software, not a law firm, and it does not replace counsel for jurisdiction-specific legal questions such as Quebec's penal provisions or India's consent manager rules. What it does is keep evidence, policies and controls in one place, so your answers to a customer's privacy questionnaire come from a system and not a scramble. If ISO 27701 is on your roadmap as a privacy certification, our ISO 27701 guide explains how it fits.

FAQs

What are the main data privacy laws by country?

By March 2025, 172 countries had one, according to Greenleaf's count, and the number keeps growing. The ones that matter most for international business are the EU member states, the UK, the US (at state level), Canada, Australia, India, China, Japan, South Korea, Brazil and Saudi Arabia.

Does the US have a federal data privacy law?

No comprehensive one. The US relies on state laws, 24 enacted and 20 in effect as of October 2026, plus federal sector laws like HIPAA and COPPA. A federal bill, the SECURE Data Act, was introduced in April 2026 but has not passed.

Which countries have GDPR-like laws?

Many. Brazil's LGPD, Switzerland's FADP, the UK GDPR, South Africa's POPIA, Thailand's PDPA and India's DPDP Act all borrow GDPR's structure. They differ in fines, consent rules and who they reach, so "GDPR-like" is a starting point, not a finish line.

Which country has the strictest data privacy laws?

There is no single answer. GDPR, the UK and Quebec cap fines at 4% of worldwide revenue, China at 5%, and Australia at 30% of adjusted turnover in serious cases. For your business, the strictest law is whichever one covers your users and has an active regulator.

Which data privacy laws apply to my business?

Those that cover the people whose data you handle, wherever you are based. Export a users-by-country list, match each against the table above, and start with GDPR, the UK GDPR, California and any state or country where your user count is significant.

Do data privacy laws apply outside the country?

Often, yes. GDPR applies to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there. The UK GDPR, Brazil's LGPD, China's PIPL and Saudi Arabia's PDPL have comparable reach. Read each law's own scope clause before assuming either way.

What is the difference between GDPR and CCPA?

GDPR is an EU-wide regulation built on lawful bases and covers any personal data of people in the EU. CCPA is a California law built on notice and opt-out, and applies once a business meets revenue, data-volume or data-sale thresholds. Our CCPA compliance guide compares them in detail.

Related Reading

• GDPR Countries: Where GDPR Applies: the EU and EEA member list, adequacy countries and the extraterritorial test
• GDPR Compliance Guide: the obligations behind the world's most-copied privacy law
• GDPR Compliance for US Companies: when a US business is in scope
• CCPA Compliance Guide: California's law in depth
• Best GDPR Compliance Software: tools compared
• ISO 27701 Guide: the privacy extension to ISO 27001