HIPAA Equivalent Laws by Country: Health Data Privacy Compared

Executive Summary: HIPAA Equivalent Laws by Country in Short

A hospital group in Toronto asks whether you are "HIPAA compliant." The honest answer is that HIPAA is not the law that governs their patients. So the useful question is not "what is the HIPAA equivalent in Canada?" It is "which laws attach to the health data I hold, and who do they hold responsible?"

No country has a copy of HIPAA. Most regulate health data through a general data protection law that treats it as a special category: the EU, the UK, Japan, China, Brazil, South Africa and Australia all work this way. Some add a dedicated health-information statute, such as Ontario's PHIPA or the UAE's health ICT law. A few rely on policy and guidance, such as England's Caldicott Principles. This guide maps the HIPAA equivalent laws by country as of October 2026.

One boundary up front. This article covers health privacy law outside the US and does not explain how HIPAA itself works. For that, see our guides to HIPAA covered entities, the business associate agreement and the HIPAA enforcement rule. For the EU and EEA member and adequacy lists, see GDPR countries.

By the end, you will be able to name the law that governs your health data in each major market, see the penalty exposure side by side, and run the three questions that decide which laws apply to your product. This is general information, not legal advice.

Here's what's ahead:

• Why nothing maps to HIPAA one to one, and what HIPAA vs GDPR shows about the difference
• A comparison table of 14 jurisdictions
• What nearly every health privacy regime shares
• Country profiles for North America, Europe, Asia-Pacific, Latin America, the Middle East and Africa
• Penalties and breach duties side by side
• Which laws apply to your business, and the mistakes to avoid

Is There a HIPAA Equivalent in Other Countries? Why Nothing Maps One to One

There is no single HIPAA equivalent in other countries. Each jurisdiction combines a general privacy law, sometimes a health-specific law, and sector rules, and none of them is built around the same idea as HIPAA.

To see why, start with what HIPAA actually regulates.

What HIPAA Regulates, and Why That Shapes Every Comparison

HIPAA's definitions sit in 45 CFR 160.103. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with covered transactions. Protected health information (PHI) is individually identifiable health information. A business associate is a person who creates, receives, maintains or transmits PHI on a covered entity's behalf.

Health data held by anyone outside those roles sits outside HIPAA. A consumer fitness app that is not working for a covered entity is the standard example.

HIPAA vs GDPR: Rules That Follow the Entity Against Rules That Follow the Data

GDPR Article 9(1) prohibits processing "data concerning health" unless an Article 9(2) condition applies. Health care under 9(2)(h), public health under (i), research under (j) and explicit consent under (a) are the ones you will meet most. Article 9(4) lets each Member State add further conditions for health data. The rule attaches to the data, whoever processes it.

That structural difference is the idea the rest of this article hangs on.

This is a difference in design, not a ranking. A GDPR regime is not stricter or looser than HIPAA in the abstract. It asks a different first question.

Does HIPAA Apply Outside the US?

HIPAA's definitions are not tied to a country. A non-US vendor that handles PHI for a US covered entity fits the business associate definition and is typically bound through the business associate agreement, which we cover in our BAA guide. Confirm your own position with counsel.

The reverse is the common surprise. Serving patients in Toronto or London does not make HIPAA the governing law. Local law attaches to the data, and it applies whether or not you ever signed a BAA.

Why HIPAA Equivalent Laws by Country Are Not Like-for-Like

Three regime types organise everything that follows:

1. General data protection law with health as a special category. The EU, UK, Japan, China, Brazil, South Africa and Australia.
2. A dedicated health-information statute on top. Ontario's PHIPA, the UAE's health ICT law, Australia's My Health Records Act, New Zealand's Health Information Privacy Code.
3. Policy or guidance layered over the law. England's Caldicott Principles and India's ABDM policy.

What does that change in practice? It means a country row in a table is a starting point. You usually answer to a layer of two or three instruments, not one.

HIPAA Equivalent Laws by Country: The Comparison Table

Here are the main instruments for 14 jurisdictions, with HIPAA as the baseline. Where a cell is not covered, it says so.

International Health Data Privacy Laws: What Nearly Every Regime Shares

Across these regimes, six building blocks keep recurring:

• Health data is singled out as sensitive.
• A consent or care-delivery exception lets clinicians do their work.
• Clinicians and care staff owe confidentiality duties.
• Breaches must be notified, with timing that varies.
• A regulator holds enforcement powers.
• Cross-border transfers face limits.

The regimes diverge on four points.

The first is who is the regulated party: an entity under HIPAA, a data controller under GDPR, a custodian under Ontario's PHIPA.

The second is whether consent is the default or one of several lawful bases. The third is whether data must stay in the country, which the UAE answers firmly. The fourth is whether a national health record system adds a second law, as with Australia's My Health Records Act, Singapore's new health information law and the EU's Health Data Space.

HIPAA Equivalent Laws by Country in North America

Each jurisdiction below follows the same order: what it is, what counts as health data, who it covers, penalty exposure, and a one-line verdict.

HIPAA Equivalent in Canada: PIPEDA, PHIPA and Provincial Health Acts

What it is. Canada has no single federal health privacy statute. PIPEDA covers private-sector organisations in the course of commercial activity.

Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar to PIPEDA, and organisations covered by them are generally exempt from PIPEDA for in-province activity. Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have health-specific statutes, according to the Office of the Privacy Commissioner of Canada. Alberta (Health Information Act), Saskatchewan (HIPA) and Manitoba (PHIA) have their own health acts as well.

Who it covers. Ontario's PHIPA governs health information custodians such as clinics and hospitals, and the vendors that act for them. Quebec's private-sector law, as amended by Law 25, treats medical information as sensitive.

Penalty exposure. Ontario's Information and Privacy Commissioner can issue administrative monetary penalties of up to CAD 50,000 for individuals and CAD 500,000 for organisations, in force since January 2024, according to McCarthy Tetrault. The first ones came in 2025: CAD 5,000 for a physician and CAD 7,500 for the physician's clinic.

Prosecution fines under PHIPA go higher, up to CAD 200,000 for individuals and CAD 1,000,000 for organisations, per BLG. Quebec Law 25 allows penalties of up to CAD 25 million or 4% of worldwide turnover for organisations, according to DLA Piper.

Verdict: the closest structural cousin to HIPAA, but provincial and custodian-based, so which province the patient is in decides the law.

The US Beyond HIPAA: Health Data Outside Covered Entities

HIPAA is not the whole answer even at home. Washington's My Health My Data Act (RCW 19.373) regulates "consumer health data" collected by entities HIPAA does not reach. Its main obligations took effect on 31 March 2024, with small businesses following on 30 June 2024, and a violation counts as an unfair or deceptive act under the state's Consumer Protection Act. Health data in a wellness app that is not a business associate lands here, not under HIPAA.

For the wider state-law picture, see our CCPA compliance guide.

HIPAA Equivalent Laws by Country in Europe

European Union and Germany: GDPR Article 9, National Law and the Health Data Space

We covered Article 9 above. The penalty side is the Article 83(5) ceiling: EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Because Article 9(4) lets Member States add conditions, national variation is real.

Germany is the worked example. Section 22 of the Federal Data Protection Act (BDSG) permits processing of special categories on health-care grounds and requires appropriate safeguards, such as pseudonymisation, encryption, access restrictions and a data protection officer. Supervision is split between 16 state authorities and the federal commissioner (BfDI) for federal bodies, according to DLA Piper.

The European Health Data Space (EHDS), Regulation (EU) 2025/327, adds a second layer. It entered into force on 26 March 2025. Exchange of patient summaries and ePrescriptions starts from March 2029, and images, lab results and discharge reports follow from March 2031. Secondary-use rules apply from March 2029 for most categories and March 2031 for the rest, according to the European Commission.

For member and adequacy lists, see GDPR countries. For timing rules after an incident, see GDPR breach notification.

Verdict: the EU is the data-based model in its purest form, and national law decides the details.

HIPAA Equivalent in the UK: UK GDPR, the Data (Use and Access) Act and the Caldicott Principles

What it is. Health data is special category data under UK GDPR Article 9, according to the ICO. The Data Protection Act 2018 adds a health and social care condition in Schedule 1, and relying on it requires an appropriate policy document. The Data (Use and Access) Act 2025 passed on 19 June 2025 and amends the regime, per DLA Piper.

Guidance layer. In England, eight Caldicott Principles guide how health and social care organisations use patient information, as published on GOV.UK. They are framed as guidance rather than statute, and Principle 6 is "comply with the law." The NHS also runs the Data Security and Protection Toolkit, which NHS England's information standard says all organisations with access to NHS patient data and systems must use, so a supplier selling into the NHS will meet it in contracts.

Penalty exposure. The higher tier is GBP 17.5 million or 4% of worldwide turnover, and the lower tier is GBP 8.7 million or 2%, according to DLA Piper.

Verdict: there is no single UK statute, so compliance is UK GDPR plus professional and NHS contract layers.

HIPAA Equivalent Laws by Country in Asia-Pacific

HIPAA Equivalent in Australia: Privacy Act, My Health Records Act and State Health Records Laws

What it is. Health information is sensitive information under the Privacy Act 1988. Collecting it generally needs consent and necessity, with a "permitted health situation" exception, according to DLA Piper. The OAIC says every private-sector organisation that provides a health service and holds health information is covered, regardless of size.

Layers. The My Health Records Act 2012 governs the national record system. Authorised handling under that Act does not breach the Privacy Act, data downloaded from the system falls back to the Privacy Act and state laws, and unauthorised handling carries civil or criminal penalties, per the OAIC. New South Wales (Health Records and Information Privacy Act 2002) and Victoria (Health Records Act 2001) add their own rules.

Penalty exposure. AUD 50 million. That is the Australian ceiling for a serious interference with privacy: the greater of AUD 50 million, three times the benefit obtained, or 30% of domestic turnover. Non-serious interferences cap at AUD 3.3 million, according to DLA Piper.

Verdict: the clearest example of three layers, federal, state and system-specific, stacking on the same record.

HIPAA Equivalent in India: The DPDP Act and the ABDM Health Data Policy

What it is. The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified on 13 November 2025, are being phased in. The Data Protection Board started on 13 November 2025, consent managers follow on 13 November 2026, and the substantive obligations commence on 13 May 2027. Until then the IT Act and its privacy rules apply, according to DLA Piper.

Health data. As DLA Piper describes the Act, it does not create a separate health-data category, so health data is personal data until sector rules say otherwise. The Ayushman Bharat Digital Mission (ABDM) publishes a Health Data Management Policy for its participants, which commentators describe as self-regulatory rather than statute. Treat its legal force as something to confirm with Indian counsel.

Penalty exposure. The highest penalty is INR 250 crore, for failing to maintain reasonable security safeguards, per DLA Piper.

Verdict: the largest gap between the "HIPAA equivalent" you expect and the legal reality, because India is a timeline story, not a settled regime.

Japan, Singapore, China and New Zealand: Four Quick Profiles

Japan.

• What it is: the Act on the Protection of Personal Information (APPI).
• Health data: "special care-required" sensitive information includes medical history.
• Who it covers: businesses handling personal information. Consent is generally required before collection, and sensitive data cannot move to third parties on an opt-out basis.
• Penalty: fines of up to JPY 100 million for entities, per DLA Piper and Morgan Lewis.

Verdict: consent-first, with medical history named in the law.

Singapore.

• What it is: the Personal Data Protection Act (PDPA).
• Health data: the PDPA has no sensitive category, but the PDPC's guidance expects stronger safeguards for health data.
• Penalty: up to 10% of annual Singapore turnover (above SGD 10 million) or SGD 1 million. Notifiable breaches go to the PDPC within 3 calendar days of assessment.
• Next layer: the Health Information Bill passed Parliament on 12 January 2026, with commencement intended for early 2027, according to Baker McKenzie.

Verdict: a general law today, with a health-specific law arriving.

China.

• What it is: the Personal Information Protection Law (PIPL).
• Health data: medical health information is sensitive personal information, and separate consent is needed where consent is the basis.
• Penalty: for serious violations, up to RMB 50 million or 5% of the previous year's turnover, per Article 66 as translated by Prighter.

Verdict: strict on consent and heavy on turnover-based penalties.

New Zealand.

• What it is: the Health Information Privacy Code, a code of practice under the Privacy Act 2020.
• Health data: it replaces the general principles with its own rules.
• Who it covers: health agencies such as doctors, pharmacists, hospitals and insurers. Complaints go to the agency, the Privacy Commissioner, then the Tribunal.
• Penalty: failing to notify a notifiable breach carries a fine of up to NZD 10,000.

Verdict: the most health-specific code in the Asia-Pacific group, sitting under a general Act.

HIPAA Equivalent Laws by Country in Latin America, the Middle East and Africa

Brazil.

• What it is: the General Data Protection Law (LGPD).
• Health data: sensitive personal data includes health. Article 11, item II(f) allows processing without consent for "health protection, exclusively in a procedure performed by health professionals, health services or health authority."
• Penalty: fines of up to 2% of revenue in Brazil, capped at BRL 50 million per infraction, with the ANPD enforcing since 1 August 2021, per DLA Piper.

Verdict: a consent-free route that is narrower than it looks, because it is tied to who performs the care.

United Arab Emirates.

• What it is: Federal Law No. 2 of 2019 on the use of ICT in health fields, alongside the PDPL (Federal Decree-Law 45 of 2021).
• Health data: Article 13 says health information may not be stored, processed or transferred outside the UAE except in cases set by the relevant emirate's Health Authority in coordination with the Federal Ministry of Health. Ministerial Decision No. 51 of 2021 (28 April 2021) sets when it can leave.
• Layers: DIFC, ADGM and DHCC keep their own regimes. DLA Piper's January 2025 update reported that the PDPL's executive regulations were still unpublished, so confirm the current position with UAE counsel.

Verdict: the localisation outlier, and the one that changes architecture.

South Africa.

• What it is: the Protection of Personal Information Act (POPIA).
• Health data: health is "special personal information." Section 32(1) lifts the general prohibition for medical professionals, healthcare institutions and facilities, and for insurers, medical schemes and managed healthcare organisations, for defined purposes such as treatment and care. Section 32(2) adds a confidentiality duty.
• Penalty: administrative fines and criminal offences run to R10 million and, for the most serious offences, up to 10 years' imprisonment, per DLA Piper.

Verdict: a profession-based exception, with confidentiality built in.

Health Data Privacy Laws by Country: Penalties and Breach Duties Side by Side

The table shows statutory ceilings for the regimes covered above, with currency and basis.

HIPAA's figures are the adjustment effective 28 January 2026, which the eCFR table at 45 CFR 102.3 and Mercer's summary both show. HHS's 2019 enforcement discretion notice keeps lower operative annual limits for most tiers: $25,000, $100,000, $250,000 and $1,500,000, according to Mercer.

So which country has the strictest health data privacy law? There is no single answer. Turnover-based ceilings (EU, UK, China, Australia) and fixed-sum ceilings (HIPAA, Ontario, Japan) cannot be compared directly, and real enforcement sits far below both.

HIPAA Equivalent Laws by Country: Which Ones Apply to Your Business?

Where the patients or data subjects are matters more than where your company is incorporated.

Applying HIPAA Equivalent Laws by Country to a SaaS Product: Three Questions

Three questions sort most cases.

1. Are you a controller or custodian, or a processor or service provider? In the HIPAA mental model, a processor looks like a business associate. The duties differ, but the question is the same.
2. Can the data leave the country? The UAE says no by default, and other regimes attach transfer conditions.
3. Is there a second layer? A national health record, a state law or an NHS contract can add duties your first read missed.

Then decide:

• If you only have US customers, HIPAA plus state laws is your map.
• If you are adding Canada or the UK, start with PIPEDA or PHIPA and UK GDPR, and ask each customer about contract terms.
• If you are adding the UAE or India, resolve data residency and timeline first.
• Otherwise, start from the table above and work row by row.

Mistakes to Avoid When Comparing HIPAA Equivalent Laws by Country

• Assuming "HIPAA compliant" carries over. It does not. It describes one entity-based US regime.
• Searching for a law with a health name. In many countries the governing law is the general privacy law, not a health statute.
• Treating the UK or Canada as one law. The UK is UK GDPR plus NHS layers. Canada is a federal law and provincial laws.
• Ignoring data residency. The UAE rule can break an architecture that was fine everywhere else.
• Reading statutory ceilings as likely fines. Ceilings show how a regulator is allowed to act, not how it does.
• Treating a bill or a phased law as in force. Singapore's Health Information Bill, India's DPDP obligations and the EHDS all start on future dates.

How ComplyJet Fits When You Take HIPAA Abroad

ComplyJet supports HIPAA, GDPR and ISO 27701 on one platform. We do not map to every regime in this article, and we would rather say that plainly. What carries across regimes is the shared control evidence: access control, encryption, logging and vendor management. The legal basis does not carry, so local counsel still decides which law applies to your data.

If HIPAA is already in place, our guide to SOC 2 vs HIPAA shows how it sits next to a trust-services framework. For the privacy-management side, see our ISO 27701 guide.

FAQs

Is There a HIPAA Equivalent in Other Countries?

No country has an exact copy of HIPAA. Most regulate health data through a general data protection law that treats it as a special category, and some add a dedicated health statute. HIPAA follows the entity, while most others follow the data.

What Is the UK Equivalent of HIPAA?

There is no single UK statute. Health data is special category data under UK GDPR and the Data Protection Act 2018, and England's Caldicott Principles and NHS contract terms add guidance on top. Fines reach GBP 17.5 million or 4% of worldwide turnover.

What Is the Canadian Equivalent of HIPAA?

It depends on the province. PIPEDA covers private-sector commercial activity, and Ontario's PHIPA regulates health information custodians, with penalties of up to CAD 500,000 for organisations. Several other provinces have their own health acts.

What Is the Australian Equivalent of HIPAA?

The Privacy Act 1988 is the base, because health information is sensitive information. The My Health Records Act 2012 and state health records laws add layers. The ceiling for a serious interference is AUD 50 million.

What Is the HIPAA Equivalent in India?

India does not have a settled equivalent yet. The DPDP Act's main obligations commence on 13 May 2027, and until then the IT Act and its privacy rules apply. The Act does not create a separate health-data category.

Is GDPR the Equivalent of HIPAA?

Not quite. GDPR Article 9 protects health data held by anyone, while HIPAA protects PHI held by covered entities and business associates. A non-US company can fall under both, and the sections above show how to tell which applies.

Related Reading

• HIPAA covered entities guide: who HIPAA itself regulates
• Business associate agreement under HIPAA: how vendors, including non-US vendors, get bound
• HIPAA enforcement rule: HIPAA penalties and enforcement in the US
• GDPR countries: EU and EEA member and adequacy lists
• SOC 2 vs HIPAA: HIPAA against a trust-services framework
• ISO 27701 guide: privacy management on top of ISO 27001