Privacy laws we cover
Each row links to a page with the official wording behind it. Data verified 2026-10-06. "Not stated" means the official pages we read do not say.
| Law | What it covers | In force from |
|---|---|---|
| Act on the Protection of Personal Information (Act No. 57 of 2003) | The Act protects the rights and interests of individuals while ensuring proper handling and use of personal information, by setting basic principles and establishing obligations that businesses and administrative entities that handle personal information must comply with. | Not stated |
| California Consumer Privacy Act of 2018 as amended by the CPRA (Cal. Civ. Code 1798.100 et seq.) and the CPPA regulations | Gives California consumers rights over their personal information and binds for-profit businesses that collect it and meet the statute's thresholds. | 2020-01-01 |
| Colorado Privacy Act (C.R.S. 6-1-1301 et seq.) | Protects personal data of Colorado consumers and binds controllers that conduct business in Colorado or intentionally target Colorado residents and meet the thresholds. | 2023-07-01 |
| Connecticut Data Privacy Act (Conn. Gen. Stat. 42-515 et seq., as amended by P.A. 25-113) | Protects the personal data of Connecticut consumers and binds controllers that conduct business in Connecticut or target its residents and meet the applicability tests. | 2023-07-01 |
| Delaware Personal Data Privacy Act (6 Del. C. ch. 12D) | Chapter 12D binds persons that conduct business in Delaware or produce products or services targeted to Delaware residents and that meet stated thresholds for controlling or processing consumers' personal data. | 2025-01-01 |
| Indiana Consumer Data Protection Act (Ind. Code 24-15) | Applies to Indiana residents acting in a personal, family, or household capacity (consumers) and to for-profit businesses that meet the applicable threshold and decide how data is processed (controllers), as described by the Attorney General. | 2026-01-01 |
| Iowa Consumer Data Protection Act (Iowa Code ch. 715D) | Chapter 715D binds persons conducting business in Iowa or producing products or services targeted to Iowa-resident consumers that meet the stated consumer-count thresholds, and gives those consumers rights over their personal data. | 2025-01-01 |
| Kentucky Consumer Data Protection Act (2024 Ky. Acts, HB 15, creating new sections of KRS Chapter 367) | Sections 1 to 10 of the Act apply to persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents and that meet the stated consumer-count or revenue thresholds. | 2026-01-01 |
| Lei Geral de Protecao de Dados Pessoais (Lei 13.709/2018) | The Law governs the processing of personal data, including in digital media, by natural persons or public or private legal entities, to protect the fundamental rights of freedom and privacy and the free development of the personality of natural persons. | Not stated |
| Maryland Online Data Privacy Act of 2024 (Md. Code, Com. Law 14-4601 et seq.; 2024 Md. Laws ch. 455, SB 541) | Regulates the manner in which a controller or processor in possession of a consumer's personal data may process it, and authorizes consumers to exercise rights over that data. | Not stated |
| Minnesota Consumer Data Privacy Act (Minn. Stat. 325M.10 to 325M.21) | Sections 325M.10 to 325M.21 apply to legal entities that conduct business in Minnesota or produce products or services targeted to Minnesota residents and that meet one of the stated consumer-count or revenue-from-sale thresholds. | 2025-07-31 |
| Montana Consumer Data Privacy Act (MCA Title 30, ch. 14, part 28) | Part 28 (the Consumer Data Privacy Act) binds persons that conduct business in Montana or produce products or services targeted to Montana residents and that control or process consumers' personal data above stated thresholds. | 2024-10-01 |
| Nebraska Data Privacy Act (LB 1074; Neb. Rev. Stat. 87-1101 to 87-1130) | The Data Privacy Act (Neb. Rev. Stat. 87-1101 to 87-1130) gives Nebraska residents rights over their personal data and sets responsibilities for businesses that control or process it, enforced by the Attorney General. | 2025-01-01 |
| New Hampshire privacy law, RSA chapter 507-H (Expectation of Privacy) | RSA 507-H applies to persons that conduct business in New Hampshire or produce products or services targeted to its residents and that meet stated thresholds for controlling or processing consumers' personal data, giving consumers rights over that data. | 2025-01-01 |
| New Jersey Data Privacy Act (P.L. 2023, c. 266; N.J.S.A. 56:8-166.4 et seq.) | The NJDPA (P.L. 2023, c.266) grants consumers certain rights regarding their personal data and imposes duties on the operators, called controllers, that collect it. | Not stated |
| Oregon Consumer Privacy Act (ORS 646A.570 et seq.) | A comprehensive consumer privacy law giving Oregon consumers rights over the collection, retention, use and sale of their personal and sensitive information, binding controllers and processors that meet its thresholds. | 2024-07-01 |
| Personal Information Protection and Electronic Documents Act (Canada, S.C. 2000, c. 5) | Part 1 establishes rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information. | 2001-01-01 |
| Privacy Act 1988 (Cth) and the Australian Privacy Principles | The Act's objects include promoting the protection of the privacy of individuals with respect to their personal information. | Not stated |
| Quebec Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (2021, c. 25) | The Act (the 'Loi sur le privé') applies to personal information that an enterprise collects, holds, uses or communicates to third parties, whether kept by the enterprise or by a third party. | 2023-09-22 |
| Regulation (EU) 2016/679 (General Data Protection Regulation) | Lays down rules on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; binds controllers and processors. | 2018-05-25 |
| Swiss Federal Act on Data Protection (FADP), SR 235.1, status as of 1 September 2023 | Protects the personality and fundamental rights of natural persons whose personal data is processed; applies to processing by private persons and federal bodies. | 2023-09-01 |
| Tennessee Information Protection Act (Tenn. Code Ann. 47-18-3201 et seq., as enacted by Public Chapter 408 of 2023, HB 1181) | The Act adds a new part to Tenn. Code Ann. Title 47, Chapter 18 that binds persons conducting business in Tennessee producing products or services that target Tennessee residents and that exceed $25,000,000 in revenue and meet a personal-information volume threshold. | 2025-07-01 |
| Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541) | Protects consumers' personal data and binds persons that do business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not small businesses. | 2024-07-01 |
| UK GDPR (Regulation (EU) 2016/679 as it forms part of UK law) and the Data Protection Act 2018 | Lays down rules relating to the protection of natural persons with regard to the processing of personal data and the free movement of personal data. | Not stated |
| Utah Consumer Privacy Act (Utah Code 13-61-101 et seq.) | Protects Utah consumers' personal data and binds controllers and processors that do business in Utah or target Utah residents and meet the revenue and volume tests. | 2023-12-31 |
| Virginia Consumer Data Protection Act (Va. Code 59.1-575 et seq.) | Protects consumers' personal data and binds persons who conduct business in Virginia or target Virginia residents and meet the volume thresholds. | 2023-01-01 |