International Privacy Resources A-L | Privacy Rules A-L | Privacy Laws A-L | Privacy Regulations A-L
January 22nd, 2012
International Privacy Laws, Rules, Regulations and Resources, A Through L
As of November 11, 2011ce , Breach notification laws have moved to their own page, at www.arielsilverstone.com/resources/collection-of-breach-notification-laws
- Afghanistan/ Afġānistān / Afġānestān
- None Found
- Albania (CE185, CE)
- Algeria / Shqipëria
- None Found
- Andorra / Principat d’Andorra (CE)
- Agència Andorrana de Protecció de Dades (ADPD, Spanish)
- Angola
- None Found
- Antigua and Barbuda
- Barbuda is a Semi-Autonomous Territory
- None Found
- Argentina
- Dirección Nacional de Protección de Datos Personales(DNPDP, Spanish)
- Decree 995/2000 (Translated)
- Regulation 1/2003 – Data Protection Infringements and Penalties (Translated)
- Provision 11/2006 – Security Measures for Maintenance of Personal Data (Spanish PDF)
- Link to Regulations (Spanish)
- Protection of Personal Data Law (Spanish)
- Dirección Nacional de Protección de Datos Personales(DNPDP, Spanish)
- Armenia / Հայաստան / Hayastan (Member CE, CE185)
- Law on Personal Data / ԱՆՀԱՏԱԿԱՆ ՏՎՅԱԼՆԵՐԻ ՄԱՍԻՆ (Translated PDF)
- Aruba (generally administered from and by Holland)
- Australia (Member OECD, CPEA)
- Office of the Privacy Commissioner
- Federal Privacy Act (1988)
- Telecommunications Act (1997)
- States and Regions:
- Australian Capital Territory
- New South Wales Privacy Commissioner
- Privacy and Personal Information Protection Act Number 133 1998 (with Amendments to July 2009)
- Privacy and Personal Information Protection Regulation 2005 (with Amendments to January 2009)
- Health Records and Information Privacy Act 2002 (HRIPA)
- Health Records and Information Privacy Code of Practice 2005
- Office of the Northern Territory Information Commissioner
- Information Act (July 31, 2009)
- Queensland
- South Australia
- No specific legislation found
- Tasmania
- Victoria Privacy Commissioner – Privacy Victoria
- Western Australia
- No specific legislation found
- Other Territories:
- Christmas Island
- Cocos / Keeling Islands
- Austria / Österreich (Member EU, OECD, Schengen, CE)
- Österreichischen Datenschutzkommission (DSK, Data Safety Commission, German)
- Data Protection Act(DSG 2000, translated)
- Notice: Austria has state/canton laws relating to Privacy for each entity
- Azarbaijan / Azərbaycan (Member CE)
- Law on Information, Informatization and Protection of Information 1998 (Source not found)
- Bahamas
- Data Protection (Privacy of Information) Act (2003, PDF)
- Bahrain
- None Found
- Bangladesh / বাংলাদেশ
- None Found
- Barbadus
- None Found
- Belarus / White Russia / Беларусь (Despotic Regime)
- Belgium / België / Belgique / Belgien (Member EU, OECD, Schengen, CE)
- Act for the Protection of Private Data Files
- Commission de la Protection de la Vie Privée (CPVP/CPP/CBPL, Commission for the Protection of Private Life, French)
- Belize
- None Found
- Benin / Bénin
- None Found
- Bhutan / Druk Yul
- None Found
- Bolivia / Estado Plurinacional de Bolivia / Bulibiya / Wuliwya
- None Found
- Bosnia and Herzogovina / Bosna i Hercegovina / Босна и Херцеговина (Member CE)
- Including The Republika Srpska / Република Српска
- Law on The Protection of Personal Data (Translated PDF)
- Botswana / Lefatse la Botswana
- None Found
- Brazil
- Law 9472 on Telecommunications (Portuguese PDF)
- Brunei Darusallam
- None Found
- Bulgaria / България (Member EU, Schengen (not implemented), CE, CE185, CEEP)
- Комисията за защита на личните данни (CPDP, Commission for the Protection of Personal Data, Bulgarian)
- Law on Protection of Personal Data (Bulgarian)
- Rule 1 on the Minimum Level … Measures and … Data Protection (Bulgarian)
- Burkina Faso / Upper Volta
- None Found
- Burundi / Uburundi
- None Found
- Cambodia
- None Found
- Cameroon / Cameroun
- None Found
- Canada (Member, CPEA)
- Office of the Privacy Commissioner
- Privacy Act
- Identity Theft Act (Formerly Known as S-4, PDF)
- Personal Information Protection and Electronic Documents Act (PIPEDA)
- States:
- Information and Privacy Commissioner of Alberta
- Information and Privacy Commissioner for British Columbia
- Manitoba Ombudsman’s Office Access and Privacy Division
- New Brunswick Office of the Ombudsman
- No current law noted on Privacy in the Private Sector
- Information and Privacy Commissioner for Newfoundland and Labrador
- No current law noted on Privacy in the Private Sector
- Information and Privacy Commissioner of the Northwest Territories (Generally coordinated with Nunavut, below)
- Freedom of Information and Protection of Privacy Review Office of Nova Scotia
- Privacy Review Officer Act (PRO, 2008, took effect Sep 2009)
- Freedom of Information and Protection of Privacy Act (FOIPOP, 1993, as amended 1999, 2004, 2007)
- Information and Privacy Commissioner of Nunavut / ᑲᒥᓴᓇ ᐃᒻᒥᒃᑰᖅᖢᓂ ᑲᒪᔨᓐᖑᖅᑎᑕᐅᓯᒪᕗᖅ ᓄᓇᕗᑦ / Naunaipkainiq Tuhaqtipkailinirmutlu Kamisina
- No current law noted on Privacy in the Private Sector
- Information and Privacy Commissioner of Ontario
- Information and Privacy Commissioner of Prince Edward Island
- No current law noted on Privacy in the Private Sector
- Commission d’Accès à l’Information du Québec(Quebec Commission on Information Access)
- Office of the Information and Privacy Commissioner for Saskatchewan (OPIC)
- Ombudsman and Information and Privacy Commissioner of the Yukon
- No current law noted on Privacy in the Private Sector
- Cape Verde / Cabo Verde
- None Found
- Central African Republic / République Centrafricaine / Ködörösêse tî Bêafrîka
- None Found
- Chad / Tchad / Tshād
- None Found
- Chile
- Ley Sobre Protección de la Vida Privada (Law for the Protection of Private Life, Spanish)
- China / 中华人民共和国 (Peoples’ Republic of)
- None Found for Mainland
- Regions:
- Anhui (安徽)
- Fujian (福建)
- Gansu (甘肃)
- Guangdong (广东)
- Guizhou (贵州)
- Hainan (海南)
- Hebei (河北)
- Heilongjiang (黑龙江)
- Henan (河南)
- Hubei (湖北)
- Hunan (湖南)
- Jiangsu (江苏)
- Jiangxi (江西)
- Jilin (吉林)
- Laoning (辽宁)
- Qinghai (青海)
- Shaanxi (陕西)
- Shandong (山东)
- Shanxi (山西)
- Sichuan (四川)
- Yunnan (云南)
- Zhejiang (浙江)
- China also claims Taiwan and Tibet. Both are not included here.
- Special Administrative Regions (SAR)
- Macao
- Personal Data Protection Act (2006) (PDF, unofficial English Translation)
- Gabinete para a Protecção de Dados Pessoais / 個人資料保護辦公室 / Office for Personal Data Protection
- Hong Kong, Special Administrative Region, People’s Republic of China (Member, CPEA)
- Macao
- Colombia
- Note: Including the Archipelago of San Andrés, Providencia and Santa Catalina
- None Found
- Comoros / Union des Comores / al-Ittiḥād al-Qumuriyy
- None Found
- Congo (Democratic) / République Démocratique du Congo / Zaire / Belgian Congo / Zaïre
- None Found
- Congo (Republic) / République du Congo / Repubilika ya Kongo / Republiki ya Kongó
- None Found
- Cook Islands / Kūki ‘Āirani , Includes:
- Atiu / Enua Manu / Island of Birds
- Ma’uke / Akatokamanava
- Mitiaro / Nukuroa
- Aitutaki / Araura Enua
- Mangaia / Auau Enua
- Rarotonga / Tumutevarovaro)
- Avarua
- Palmerston Island / Pamati
- Manuae
- Takutea
- Winslow Reef
- Manihiki / Te Fuinga O niva
- Nassau
- Penrhyn Island / Tongareva / Mangarongaro
- Pukapuka /Te ulu o te watu
- Rakahanga / Tapuahua
- Suwarrow / Suvorov
- Tema Reef
- Note: Generally administered with New Zealand
- Costa Rica
- None Found
- Croatia / Republika Hrvatska (Member CE, CE185, CEEP)
- Agencije za Zaštitu Osobnih Podataka (Personal Data Protection Agency, Croat)
- Personal Data Protection Act (PDDA) (Translated PDF)
- Amendements to PDDA (Translated PDF)
- Regulation on Keeping Patients Records (Translated PDF)
- Regulation on Storage of Personal Data (Translated PDF)
- Cuba (Despotic Regime)
- None Found
- Cyprus / Κυπριακή Δημοκρατία / Kypriakí Dimokratía / Kıbrıs Cumhuriyeti (Member EU, Schengen (not implamented), CE, CE185)
- Γραφείου Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Office of the Commissioner for Personal Data Protection, in Greek)
- Processing of Personal Data (Protection of the Individual) Law (Translated PDF)
- Amendment to Law (Translated PDF)
- Czech / Česko (Member EU, OECD, Schengen, CE, CEEP)
- Úřad pro Ochranu Osobních Údajů (UOOU) (The Office for Personal Data Protection, Czech)
- Act 101 on The Protection of Personal Data (Consolidated version, translated PDF)
- Denmark (Member EU, OECD, Schengen, CE, CE185)
- Datatilsynet (Danish Data Protection Agency, in Dansk)
- Act on Processing of Personal Data (Translated)
- Djibouti / Jumhūriyyat Jībūtī / Jamhuuriyadda Jabuuti / République de Djibouti
- None Found
- Dominica
- None Found
- Dominican Republic
- None Found
- East Timor / Democratic Republic of Timor-Leste / Repúblika Demokrátika Timór Lorosa’e / República Democrática de Timor-Leste
- Including Atauro / Kambing Island, Jaco / Jako Island, Oecussi-Ambeno,
- None Found
- Ecuador
- None Found
- Egypt / Mişr
- None Found
- El Salvador
- None Found
- Equatorial Guinea / Guinea Ecuatorial / Ecuatorial Guyana / Guinée Équatoriale / Guiné Equatorial
- None Found
- Eritrea / ኤርትራ / Ertra
- None Found
- Estonia / Eesti (Member EU, Schengen, CE, CE185, CEEP)
- Andmekaitse Inspektsioon (Data Protection Inspectorate)
- Personal Data Protection Act (Translated RTF)
- Ethiopia/ ኢትዮጵያ / Ityop’iya
- None Found
- Fiji / Matanitu ko Viti / फ़िजी) (Despotic Regime)
- None Found
- Finland (Member EU, OECD, Schengen, CE)
- Dataombudsmannens Byrå (The Offiice of the Data Protection Ombudsman, Finnish)
- Personal Data Act (Translated, Original Act)
- Act on the amendment of the Personal Data Act (Translated RTF)
- Act on the Protection of Privacy in Working Life (APPWL, translated PDF)
- Amendments to APPWL (Finnish)
- France (Member EU, OECD, Schengen, CE, CE185)
- Commission Nationale de l’Informatique et des Libertés (CNIL, Data Protection Authority, French)
- Loi Informatique et Libertés (Information and Freedom Law, 1978, French)
- Loi pour la Confiance dans l’économie Numérique (Confidence in the Digital Economy Law, 2004, modifying the 1978 law, above, French)
- Note: French Regions (régions d’outre-mer), sometimesadministered as part of the French Republic, include:
- French Guiana / Guyane (EU)
- Guadeloupe / Gwadloup / குவாதலூப்பே (EU, But not a part of Schengen)
- Martinique (EU)
- Reunion/ Réunion / Île Bourbon / றியூனியன் (EU)
- Note: French Overseas Collectives (collectivités d’outre-mer), generallyadministered as part of the French Republic, include:
- Corsica / La Corse (almost as autonomous as a French Region)
- French Polynesia / Polynésie Française (semi-independent parliament), including:
- Ahe / Ahemaru / Omaru
- Bora-Bora / Bollabolla / Pora Pora
- Hiva Oa
- Huahine (2 islands)
- Maiao (2 islands)
- Maupiti
- Mehetia / Meetia
- Morea / Aimeho / Aimeo / Eimeo / York Island
- Nuku Hiva / Nukahiva / Île Marchand / Madison Island
- Raiatea
- Tahaa / Oataha
- Tahiti
- Tahuata
- Tetiaroa
- Tubuai
- Tupai (and group)
- Rimatara
- Rurutu
- Mayotte / Maore / Mahori (will become a Department in 2011)
- Saint-Barthélemy / Sankt Barthelemy / Saint Barts (member EU)
- Saint-Martin (member EU)
- Saint-Pierre and Miquelon
- Wallis and Futuna / Territoire des îles Wallis et Futuna / Uveo mo Futuna
- Note: Unique “Land” in the French system, administered as part of the French Republic (until 2014):
- New Caldeonia / Nouvelle-Calédonie / Kanak
- Note: Unique “Territory” in the French system, administered as part of the French Republic:
- French Southern and Antarctic Lands / Terres Australes et Antarctiques Françaises (TAAF)
- Note: Unique “Property” in the French system, administered as part of the French Republic:
- Clipperton Island
- Gabon
- None Found
- Gambia
- None Found
- Georgia / საქართველო / Sak’art’velo (Member CE)
- None Found
- Germany / Deutchland (Member EU, OECD, Schengen, CE)
- Bundesdatenschutzgesetz (BDSG, German, 1990 Privacy Law )
- Bundesdatenschutzgesetz (PDF, German, 2006 Federal Data Protection Law)
- Novellierung des BDSG in den Bereichen Adresshandel, Werbung und Datenschutzaudit (German PDF, 2008 Amendment of the Data Protection Act to address the areas of trade, advertising and data protection audit)
- Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BFDI, The Federal Commissioner for Data Protection and Freedom of Information)
- Regions:
- Landesbeauftragte für den Datenschutz Baden-Wüerttemberg (LFD, Baden-Wuerttemberg State Data Protection Bureau)
- Bayerischen Landesbeauftragten für den Datenschutz (Bayer State Data Protection Bureau)
- Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI, Berlin Commissioner for Data Protection and Freedom of Information)
- Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (Brandenburg State Commissioner for Data Protection and Access to Information for Data Protection and Access to Information)
- Landesbeauftragten für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (LDA, State Bureau for the Protection of Data and Freedom of Information of the Free Hanseatic Bremen)
- Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburger Commission for Data Protection and Freedom of Information)
- Hessischen Datenschutzbeauftragten (Hesse Data Protection Bureau)
- Landesbeauftragte für den Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (State Bureau for the Protection of Data and Freedom of Information of Mecklenburg-West Pommerania)
- Landesbeauftragte für den Datenschutz Niedersächsen (Niedersachsen State Commissioner Data Protection Bureau)
- Landesbeauftragten für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI, North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information)
- Landesbeauftragte für den Datenschutz Rheinland-Pfalz (Rhineland-Palatinate State Bureau for the Protection of Data)
- Landesbeauftragte für Datenschutz und Informationsfreiheit Saarland (State Bureau for the Protection of Data and Freedom of Information of Saar)
- Sächsische Datenschutzbeauftragte (Saxony Commissioner for Data Protection)
- Landesbeauftragte für den Datenschutz Sachsen-Anhalt (Saxony-Anhalt State Commission for Data Protection)
- Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (Independent Centre for Privacy Protection Schleswig-Holstein)
- Thüringer Landesbeauftragten für den Datenschutz (TLFD, Thuringia State Commission for Data Protection)
- Ghana
- None Found
- Greece / Ελλάδα (Member EU, OECD, Schengen, CE)
- Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα / Hellenic Data Protection Authority, in Greek)
- Protection of Individuals with regard to the Processing of Personal Data (Translated PDF)
- Protection of personal data and privacy in the electronic telecommunications sector and amendment of law 2472/1997 (Translated PDF)
- Guidelines for Data Controllers
- Grenada
- None Found
- Guatamala
- None Found
- Guernsey / Bailliage de Guernesey (UK Protectorate, not a part of the EU)
- Guinea / Guinée
- None Found
- Guinea-Bissau / Guiné-Bissau / Portuguese Guinea
- None Found
- Guyana / British Guiana
- None Found
- Haiti / Haïti / Ayiti
- None Found
- Holland / Dutch / Netherlands / Nederland / Nederlanden /Hulanda / Ulanda (Member EU, OECD, Schengen, CE, CE 108)
- College Bescherming Persoonsgegevens(College of Personal Data Protection, Dutch)
- Guidelines for Personal Data Processors (English PDF)
- Privacy Audit Framework (English PDF)
- Privacy: Guidelines for the Workplace (Dutch PDF)
- Wet Bescherming Persoonsgegevens (WBP, Personal Data Protection Act, Dutch PDF)
- College Bescherming Persoonsgegevens(College of Personal Data Protection, Dutch)
- Honduras
- None Found
- Hungary / Magyarország (Member EU, OECD, CE, CE185, CEEP) <– currently under investigation by the EU for not meeting committments
- Note: Hungary seems to be running towards a dictatorial regime. Many Privacy laws have been cancelled and the DPA agency has been made much weaker.
- ACT 83 (LXXXIII) of 1992 on Protection of Personal Data et al <– May no longer be in effect.
- Data Protection (and Freedom of Information) Commissioner of Hungary <- Notice, This agency seems to have ceased to exist.
- Excerpts from The Criminal Code, Section 177/A (Unjustified Data Handling) and Section 177/B (Misuse of Special Personal Data) (Translated)
- Act 112 (CXII) of 2011 on Informational Self-determination and Freedom of Information (Translated, PDF)
- Iceland / Island (Member OECD, Schengen, CE)
- Persónuvernd(Data Protection Authority, Icelandic)
- Rule 299/2001 – Security of Personal Data (Translated)
- Rights of Patients Act (Translated)
- Act 77/2000 – The Protection of Privacy (In English)
- Persónuvernd(Data Protection Authority, Icelandic)
- India / भारत गणराज्य / Bhārat Gaṇarājya / ভাৰত / ભારત / ഭാരതം / ਭਾਰਤ / இந்தியா
- Department of Information Technology
- Information Technology Act of 2000 (See section 72)
- IT Act Amendment of 2008 (PDF)
- Indonesia
- Law on Information and Electronic Transaction Number 11 (2008) – no source found
- Iran (Despotic Regime)
- None Found
- Iraq (not while being wholly owned and operated)
- None Found
- Ireland / Éire (Member EU, OECD, CE, Schengen (only partially implamented))
- Isle of Man / Ellan Vannin (Protectorate of the UK, not part of the EU)
- Israel / ישראל
- הרשות למשפט, טכנולוגיה ומידע / Israeli Law and Information Technologies Authority (ILITA)
- חוק הגנת הפרטיות (Defense of Privacy Law, including data, Hebrew DOC) (translated DOC)
- Communication Data Law (Criminal Law, Hebrew PDF)
- Italy / Italia (Member EU, OECD, Schengen, CE)
- Garante de la Protezione dei Dati Personali (Supervisor of Protection of Personal Information)
- Code for the Protection of Personal Data (hard to believe, I know, but this is very complicated, half in Italian, half English, one third PDF)
- Codice della Privacy Dlgs 196/2003 (Code for the Protection of Personal Data, hard to believe, I know, but this is very complicated, half in Italian, half English, one third PDF)
- Law 675 (Italian, will eventually lead to a PDF)
- Ivory Coast / Côte d’Ivoire
- None Found
- Jamaica
- None Found
- Japan / 日本 / Nippon / Nihon (Memeber OECD, CE185)
- 内閣府 (Japanese National Cabinet, Personal Life Policy) (PDF)
- Ministry of Economy, Trade and Industry (METI) – good place to learn about Japan’s view of Privacy
- Law on the Protection of Personal Information (Translated PDF)
- Jordan / Al-Mamlakah al-Urdunniyyah al-Hāshimiyyah
- None Found
- Kazakhstan / Қазақстан / Qazaqstan
- In June 2009 it passed and enacted one of the most anti-privacy laws around
- Kenya
- None Found
- Kiribati / Gilbert Islands
- None Found
- Kuwait
- None Found
- Kyrgyzstan / Кыргыз Республикасы / Kyrgyz Respublikasy / Кыргызская Республика / Kyrgyzskaya Respublika
- None Found
- Laos / ນລາວ
- None Found
- Latvia / Latvija (Member EU, CEEP)
- Datu Valsts Inspekcija (State Data Inspectorate, Litvak)
- Personal Data Protection Law (Translated)
- Regulation 40 – …Technical and Organizational Requirements for Protection of Personal Data Processing Systems (Translated)
- Lebanon
- None Found
- Lesotho
- None Found
- Liberia
- None Found
- Libya (Despotic Regime)
- None Found
- Liechtenstein (Schengen (not implemented), CE)
- Datensammlungen (DSS, Data Protection Directorate, German)
- Lithuania / Lietuva (Member EU, Schengen, CE, CE108, CE185, CEEP)
- Valstybinė Duomenų Apsaugos Inspekcija (State Data Protection Inspectorate, Lithuanian)
- Law on the Ratification … Protection of … Automatic Processing of Personal Data (ETS108) (Translated DOC)
- Code of Administrative Law Violations (Lithuanian)
- Law on Electronic Communications (Translated PDF)
- Law on Legal Protection of Personal Data (Translated PDF)
- Law on Legal Protection of Personal Data Amendment (Translated)
- Luxemburg / Lëtzebuerg (Member EU, OECD, Schengen, CE)
- Commission Nationale pour la Protection des Données (CNPD, National Commission for Protection of Information, French)
- Data Protection Act (Translated PDF)
- Data Protection and Electronic Communication Law (French PDF)
- Regulation A-200 re:Data Protection Officers (French PDF)
Thanks for this waste collection of DP laws! I am still looking for an Englisch translation of the new Ukrainian data protection law, any idea?