International data protection
Any jurisdiction. One privacy programme
Sentinel42 turns the data protection law of the countries you operate in into the same registers, clocks and evidence. UK and EU GDPR are automated in the core at every tier. Other jurisdictions are built on the same engine on request, from primary sources, by a qualified lead auditor and DPO — no second tool, no second team.
218
jurisdictions in the reference catalogue
135
with a comprehensive law
158
with a law in force today
2
regimes automated in the product now
Where your data lives
EU-hosted by default, a dedicated region on request
Every customer, today
Your workspace, database, evidence storage and backups sit in the EU region, with encryption in transit and at rest, tenant isolation enforced at the database and a standard Article 28 DPA. Full detail is on the security page.
Enterprise, by arrangement
Enterprise customers can request a dedicated instance in a chosen region — for example London or São Paulo — following a scoping call. It is arranged with us rather than self-serve, is priced per deal, and comes with a security review and a custom DPA. We will also tell you plainly which of your obligations a region change actually answers and which it does not.
Why one programme matters
The same incident, eleven different clocks
One breach in a company with customers in five countries starts five timers. Your breach register should show who has to be told, by when, and whether the threshold is even met — not send you back to eleven statutes.
72 h
EU and UK GDPR
to the regulator; people if high risk
3 working days
Brazil LGPD
ANPD Resolution 15/2024
48 h
Peru
regulation in force March 2025
72 h
Vietnam PDPL
Law 91/2025, from January 2026
72 h
South Korea PIPA
and affected individuals
3 days
Singapore PDPA
calendar days after assessment
72 h
India DPDP
detailed report to the Board
72 h
Saudi PDPL
to SDAIA
Immediately
China PIPL
remedial measures and notice
30 days
Australia
to assess a suspected breach
Most expedient
California
without unreasonable delay
How it works
Add a country. The registers know what changed
- 01
Tell us where you operate
The countries, states and free zones you sell into, employ in or host in. Free zones count separately — DIFC and ADGM are not the UAE federal law.
- 02
The rules are applied as requirements
Lawful bases, individual rights and their deadlines, breach clocks, DPO and representative duties, transfer mechanisms and retention rules, mapped to controls you already run.
- 03
Your registers adapt
One ROPA, one request queue, one breach log, one transfer register. Each row knows which law applies and what that changes — the deadline, the notice, the mechanism.
- 04
Evidence per regulator
Reports and audit packs cut by jurisdiction, so each regulator gets its own view of the same programme.
What is written per jurisdiction
Eight things every law has
Not a PDF of the statute — the law decomposed into the parts a compliance programme runs on, each wired to the register that uses it.
Scope and who it applies to
Territorial reach, thresholds and any small-business carve-outs.
Lawful bases
Including where consent is the only realistic route and where legitimate interests do not exist.
Individual rights and deadlines
Access, correction, deletion, portability and objection, each with its own statutory clock.
Breach notification
The regulator deadline, the threshold, and whether affected people must be told.
DPO and representative duties
Whether one is required, who they must be, and whether they must be published or registered.
Transfers
Adequacy, standard clauses, local approval or localisation requirements.
Retention and records
What must be kept, for how long, and what has to be produced on demand.
Penalties
The maximum exposure, so the risk register carries a real number.
Availability
Automated today, built on request for everywhere else
In the product now
Included in the core at every tier and maintained by the Sentinel42 team.
- UK GDPR, Data Protection Act 2018 and PECR
- EU GDPR, with the ePrivacy overlay
- ISO 27701 privacy information management, as a certifiable module
Built on request
Any other jurisdiction in the catalogue below — a country, a US state, a free zone or a regional framework — is scoped with you and built on the same engine. Until it is built, treat the catalogue as reference information rather than product behaviour.
- Tell us where you sell, employ and host, and we scope the jurisdictions with you
- Built from primary sources and reviewed by a qualified lead auditor and DPO
- Sectoral overlays such as HIPAA are available as modules today
Reference catalogue
218 jurisdictions, including the ones with no law yet
This is published reference information, not a list of regimes the product enforces. Only UK and EU GDPR are automated today; anything else here is built on request. Search by country, law or acronym, and open a row for the regulator, breach rule, DPO duty, transfer regime and penalties.
218 of 218 shown
| Jurisdiction | Law | Type | Status | GDPR alignment | Detail |
|---|---|---|---|---|---|
| European Union / EEAPan-European (EU + EEA)GDPR | GDPR | Comprehensive | In force | High | |
| United KingdomWestern EuropeUK GDPR / DPA 2018 / DUAA / PECR | UK GDPR / DPA 2018 / DUAA / PECR | Comprehensive | In force | High | |
| SwitzerlandWestern EuropeFADP | FADP | Comprehensive | In force | High | |
| EEA EFTA states (Norway, Iceland, Liechtenstein)Northern / Western Europe (EEA EFTA)GDPR (EEA) + national DP acts | GDPR (EEA) + national DP acts | Comprehensive | In force | High | |
| JerseyCrown DependenciesDPJL | DPJL | Comprehensive | In force | High | |
| GuernseyCrown DependenciesDPL 2017 | DPL 2017 | Comprehensive | In force | High | |
| Isle of ManCrown DependenciesApplied GDPR (IoM) | Applied GDPR (IoM) | Comprehensive | In force | High | |
| GibraltarBritish Overseas Territory (Southern Europe)Gibraltar GDPR / DPA 2004 | Gibraltar GDPR / DPA 2004 | Comprehensive | In force | High | |
| TurkeyAnatolia / South-Eastern EuropeKVKK | KVKK | Comprehensive | In force | Medium | |
| RussiaEastern Europe / Eurasia152-FZ | 152-FZ | Comprehensive | In force | Low | |
| UkraineEastern EuropeLaw 2297-VI / Draft 8153 | Law 2297-VI / Draft 8153 | Comprehensive | In force | Low | |
| SerbiaBalkansZZPL / PDPA 2018 | ZZPL / PDPA 2018 | Comprehensive | In force | High | |
| Bosnia and HerzegovinaBalkansLPPD 2025 (BiH) | LPPD 2025 (BiH) | Comprehensive | In force | High | |
| MontenegroBalkansZZPL (Montenegro) | ZZPL (Montenegro) | Comprehensive | In force | Low | |
| North MacedoniaBalkansLPDP 2020 | LPDP 2020 | Comprehensive | In force | High | |
| AlbaniaBalkansLaw 124/2024 | Law 124/2024 | Comprehensive | Enacted, phasing in | High | |
| KosovoBalkansLPPD (Kosovo) | LPPD (Kosovo) | Comprehensive | In force | High | |
| MoldovaEastern EuropeLaw 195/2024 | Law 195/2024 | Comprehensive | Enacted, phasing in | High | |
| GeorgiaCaucasusLaw 3144/2023 | Law 3144/2023 | Comprehensive | In force | High | |
| ArmeniaCaucasusLaw HO-49-N (2015) | Law HO-49-N (2015) | Comprehensive | In force | Low | |
| AzerbaijanCaucasusLaw on Personal Data (2010) | Law on Personal Data (2010) | Comprehensive | In force | Low | |
| BelarusEastern EuropeLaw 99-Z | Law 99-Z | Comprehensive | In force | Medium | |
| AndorraMicrostates (Western Europe)LQPD | LQPD | Comprehensive | In force | High | |
| MonacoMicrostates (Western Europe)Law 1.565 | Law 1.565 | Comprehensive | Enacted, phasing in | High | |
| San MarinoMicrostates (Southern Europe)Law 171/2018 | Law 171/2018 | Comprehensive | In force | High | |
| Faroe IslandsNorthern Europe (Danish Realm, outside EU)Faroese DPA 2020 | Faroese DPA 2020 | Comprehensive | In force | High | |
| Vatican City StateMicrostates (Southern Europe)Vatican GDPR (Decree DCLVII) | Vatican GDPR (Decree DCLVII) | Comprehensive | In force | Medium | |
| KazakhstanCentral AsiaLaw 94-V | Law 94-V | Comprehensive | In force | Low | |
| UzbekistanCentral AsiaLaw ZRU-547 | Law ZRU-547 | Comprehensive | In force | Low | |
| KyrgyzstanCentral AsiaLaw No. 58 (2008) | Law No. 58 (2008) | Comprehensive | In force | Low | |
| TajikistanCentral AsiaLaw 1537 | Law 1537 | Comprehensive | In force | Low | |
| TurkmenistanCentral AsiaLaw 519-V | Law 519-V | Comprehensive | In force | Low | |
| Council of Europe Convention 108 / 108+Pan-European treaty frameworkConvention 108 / 108+ | Convention 108 / 108+ | Framework / treaty | In force | High | |
| United States (federal)US federal / sectoralUS sectoral framework | US sectoral framework | Sectoral | In force | Low | |
| United States — HIPAAUS federal / sectoralHIPAA/HITECH | HIPAA/HITECH | Sectoral | In force | Medium | |
| United States — GLBAUS federal / sectoralGLBA | GLBA | Sectoral | In force | Low | |
| United States — COPPAUS federal / sectoralCOPPA | COPPA | Sectoral | In force | Low | |
| United States — CaliforniaUS statesCCPA/CPRA | CCPA/CPRA | Sub-national | In force | Medium | |
| United States — VirginiaUS statesVCDPA | VCDPA | Sub-national | In force | Medium | |
| United States — ColoradoUS statesCPA | CPA | Sub-national | In force | Medium | |
| United States — ConnecticutUS statesCTDPA | CTDPA | Sub-national | In force | Medium | |
| United States — UtahUS statesUCPA | UCPA | Sub-national | In force | Low | |
| United States — IowaUS statesICDPA | ICDPA | Sub-national | In force | Low | |
| United States — IndianaUS statesINCDPA | INCDPA | Sub-national | In force | Medium | |
| United States — TennesseeUS statesTIPA | TIPA | Sub-national | In force | Medium | |
| United States — MontanaUS statesMCDPA | MCDPA | Sub-national | In force | Medium | |
| United States — TexasUS statesTDPSA | TDPSA | Sub-national | In force | Medium | |
| United States — OregonUS statesOCPA | OCPA | Sub-national | In force | Medium | |
| United States — DelawareUS statesDPDPA | DPDPA | Sub-national | In force | Medium | |
| United States — New JerseyUS statesNJDPA | NJDPA | Sub-national | In force | Medium | |
| United States — New HampshireUS statesNHPA | NHPA | Sub-national | In force | Medium | |
| United States — KentuckyUS statesKCDPA | KCDPA | Sub-national | In force | Medium | |
| United States — NebraskaUS statesNDPA | NDPA | Sub-national | In force | Medium | |
| United States — MarylandUS statesMODPA | MODPA | Sub-national | In force | High | |
| United States — MinnesotaUS statesMCDPA | MCDPA | Sub-national | In force | Medium | |
| United States — Rhode IslandUS statesRIDTPPA | RIDTPPA | Sub-national | In force | Medium | |
| United States — OklahomaUS statesOCDPA | OCDPA | Sub-national | Enacted, phasing in | Medium | |
| United States — AlabamaUS statesALPDPA | ALPDPA | Sub-national | Enacted, phasing in | Low | |
| United States — LouisianaUS statesLDPA | LDPA | Sub-national | Enacted, phasing in | Low | |
| United States — VermontUS statesVDPOSA | VDPOSA | Sub-national | Enacted, phasing in | High | |
| United States — FloridaUS statesFDBR | FDBR | Sub-national | In force | Low | |
| United States — Illinois (BIPA)US statesBIPA | BIPA | Sub-national | In force | Medium | |
| United States — Washington (My Health My Data Act)US statesMHMDA | MHMDA | Sub-national | In force | Medium | |
| United States — New York (SHIELD Act)US statesNY SHIELD Act | NY SHIELD Act | Sub-national | In force | Low | |
| Canada (federal)North AmericaPIPEDA | PIPEDA | Comprehensive | In force | Medium | |
| Canada — QuebecNorth AmericaQuebec Law 25 | Quebec Law 25 | Sub-national | In force | High | |
| Canada — AlbertaNorth AmericaAlberta PIPA | Alberta PIPA | Sub-national | In force | Medium | |
| Canada — British ColumbiaNorth AmericaBC PIPA | BC PIPA | Sub-national | In force | Low | |
| MexicoNorth AmericaLFPDPPP (2025) | LFPDPPP (2025) | Comprehensive | In force | Medium | |
| GuatemalaCentral AmericaGuatemala (bill 6572) | Guatemala (bill 6572) | Bill / draft | Bill | Low | |
| BelizeCentral AmericaBelize DPA 2021 | Belize DPA 2021 | Comprehensive | Enacted, phasing in | Medium | |
| HondurasCentral AmericaHonduras (draft law) | Honduras (draft law) | Bill / draft | Bill | Low | |
| El SalvadorCentral AmericaEl Salvador LPDP 2024 | El Salvador LPDP 2024 | Comprehensive | In force | Medium | |
| NicaraguaCentral AmericaLaw 787 | Law 787 | Comprehensive | In force | Low | |
| Costa RicaCentral AmericaLaw 8968 | Law 8968 | Comprehensive | In force | Medium | |
| PanamaCentral AmericaLaw 81 | Law 81 | Comprehensive | In force | Medium | |
| BahamasCaribbeanBahamas DPA 2025 | Bahamas DPA 2025 | Comprehensive | Enacted, phasing in | Medium | |
| BarbadosCaribbeanBarbados DPA | Barbados DPA | Comprehensive | In force | High | |
| BermudaCaribbeanBermuda PIPA | Bermuda PIPA | Comprehensive | In force | Medium | |
| Cayman IslandsCaribbeanCayman DPA | Cayman DPA | Comprehensive | In force | High | |
| JamaicaCaribbeanJamaica DPA | Jamaica DPA | Comprehensive | In force | High | |
| Trinidad and TobagoCaribbeanT&T DPA 2011 | T&T DPA 2011 | Comprehensive | Enacted, phasing in | Low | |
| Dominican RepublicCaribbeanLaw 172-13 | Law 172-13 | Comprehensive | In force | Low | |
| CubaCaribbeanLaw 149/2022 | Law 149/2022 | Comprehensive | In force | Low | |
| HaitiCaribbeanHaiti (none) | Haiti (none) | None | No law yet | Low | |
| Puerto RicoCaribbeanPuerto Rico (US law + Act 111-2005) | Puerto Rico (US law + Act 111-2005) | Sectoral | In force | Low | |
| British Virgin IslandsCaribbeanBVI DPA | BVI DPA | Comprehensive | In force | Medium | |
| CuracaoCaribbeanCuracao LBP | Curacao LBP | Comprehensive | In force | Low | |
| ArubaCaribbeanAruba LPR | Aruba LPR | Comprehensive | In force | Low | |
| Antigua and BarbudaCaribbeanAntigua DPA 2013 | Antigua DPA 2013 | Comprehensive | In force | Low | |
| Saint LuciaCaribbeanSt Lucia DPA | St Lucia DPA | Comprehensive | Enacted, phasing in | Low | |
| Saint Kitts and NevisCaribbeanSt Kitts DPA 2018 | St Kitts DPA 2018 | Comprehensive | Enacted, phasing in | Low | |
| GrenadaCaribbeanGrenada DPA 2023 | Grenada DPA 2023 | Comprehensive | Enacted, phasing in | Medium | |
| Saint Vincent and the GrenadinesCaribbeanSVG Privacy Act 2003 | SVG Privacy Act 2003 | Comprehensive | Enacted, phasing in | Low | |
| DominicaCaribbeanDominica (none) | Dominica (none) | None | No law yet | Low | |
| BrazilSouth AmericaLGPD | LGPD | Comprehensive | In force | High | |
| ArgentinaSouth AmericaLaw 25,326 | Law 25,326 | Comprehensive | In force | Medium | |
| ChileSouth AmericaLaw 21.719 | Law 21.719 | Comprehensive | Enacted, phasing in | High | |
| ColombiaSouth AmericaLaw 1581 | Law 1581 | Comprehensive | In force | Medium | |
| PeruSouth AmericaLaw 29733 | Law 29733 | Comprehensive | In force | Medium | |
| UruguaySouth AmericaLaw 18.331 | Law 18.331 | Comprehensive | In force | High | |
| EcuadorSouth AmericaLOPDP | LOPDP | Comprehensive | In force | High | |
| BoliviaSouth AmericaBolivia (draft law) | Bolivia (draft law) | Bill / draft | Bill | Low | |
| ParaguaySouth AmericaLaw 7593/2025 | Law 7593/2025 | Comprehensive | Enacted, phasing in | High | |
| VenezuelaSouth AmericaVenezuela (none) | Venezuela (none) | None | No law yet | Low | |
| GuyanaSouth AmericaGuyana DPA 2023 | Guyana DPA 2023 | Comprehensive | Enacted, phasing in | Medium | |
| SurinameSouth AmericaSuriname (draft bill) | Suriname (draft bill) | Bill / draft | Bill | Low | |
| Ibero-American / OAS regional frameworksRegional frameworkRIPD Standards / OAS Principles | RIPD Standards / OAS Principles | Framework / treaty | In force | High | |
| EgyptNorth AfricaPDPL | PDPL | Comprehensive | In force | Medium | |
| MoroccoNorth AfricaLaw 09-08 | Law 09-08 | Comprehensive | In force | Medium | |
| TunisiaNorth AfricaOrganic Law 2004-63 | Organic Law 2004-63 | Comprehensive | In force | Low | |
| AlgeriaNorth AfricaLaw 18-07 | Law 18-07 | Comprehensive | In force | Medium | |
| LibyaNorth AfricaCybercrime/E-Transactions Laws 2022 | Cybercrime/E-Transactions Laws 2022 | Sectoral | In force | Low | |
| SudanNorth Africa— | — | None | No law yet | Low | |
| NigeriaWest AfricaNDPA | NDPA | Comprehensive | In force | High | |
| GhanaWest AfricaAct 843 | Act 843 | Comprehensive | In force | Medium | |
| SenegalWest AfricaAct 2008-12 | Act 2008-12 | Comprehensive | In force | Medium | |
| Côte d'IvoireWest AfricaLaw 2013-450 | Law 2013-450 | Comprehensive | In force | Medium | |
| BeninWest AfricaDigital Code | Digital Code | Comprehensive | In force | High | |
| Burkina FasoWest AfricaLaw 001-2021 | Law 001-2021 | Comprehensive | In force | Medium | |
| MaliWest AfricaLaw 2013-015 | Law 2013-015 | Comprehensive | In force | Low | |
| NigerWest AfricaLaw 2022-59 | Law 2022-59 | Comprehensive | In force | Medium | |
| TogoWest AfricaLaw 2019-014 | Law 2019-014 | Comprehensive | In force | Low | |
| GuineaWest AfricaLaw L/2016/037 | Law L/2016/037 | Comprehensive | Enacted, phasing in | Low | |
| Guinea-BissauWest Africa— | — | None | No law yet | Low | |
| Sierra LeoneWest AfricaData Protection Bill | Data Protection Bill | Bill / draft | Bill | Low | |
| LiberiaWest Africa— | — | None | No law yet | Low | |
| GambiaWest Africa— | — | Bill / draft | Bill | Low | |
| MauritaniaWest AfricaLaw 2017-020 | Law 2017-020 | Comprehensive | In force | Low | |
| Cabo VerdeWest AfricaLaw 133/V/2001 | Law 133/V/2001 | Comprehensive | In force | High | |
| KenyaEast AfricaDPA 2019 | DPA 2019 | Comprehensive | In force | High | |
| UgandaEast AfricaDPPA 2019 | DPPA 2019 | Comprehensive | In force | Medium | |
| RwandaEast AfricaLaw 058/2021 | Law 058/2021 | Comprehensive | In force | High | |
| TanzaniaEast AfricaPDPA 2022 | PDPA 2022 | Comprehensive | In force | Medium | |
| EthiopiaEast AfricaProclamation 1321/2024 | Proclamation 1321/2024 | Comprehensive | Enacted, phasing in | Medium | |
| SomaliaEast AfricaDPA 2023 | DPA 2023 | Comprehensive | In force | Low | |
| DjiboutiEast Africa— | — | None | No law yet | Low | |
| EritreaEast Africa— | — | None | No law yet | Low | |
| South SudanEast Africa— | — | None | No law yet | Low | |
| BurundiEast AfricaSectoral laws | Sectoral laws | Sectoral | In force | Low | |
| CameroonCentral AfricaLaw 2024/017 | Law 2024/017 | Comprehensive | Enacted, phasing in | Medium | |
| GabonCentral AfricaAct 001/2011 | Act 001/2011 | Comprehensive | In force | Medium | |
| Congo-BrazzavilleCentral AfricaLaw 29-2019 | Law 29-2019 | Comprehensive | Enacted, phasing in | Medium | |
| DR CongoCentral AfricaDigital Code | Digital Code | Comprehensive | Enacted, phasing in | Low | |
| ChadCentral AfricaAct 007/PR/2015 | Act 007/PR/2015 | Comprehensive | In force | Low | |
| Equatorial GuineaCentral AfricaLaw 1/2016 | Law 1/2016 | Comprehensive | In force | Low | |
| Central African RepublicCentral Africa— | — | None | No law yet | Low | |
| São Tomé and PríncipeCentral AfricaLaw 3/2016 | Law 3/2016 | Comprehensive | In force | Low | |
| South AfricaSouthern AfricaPOPIA | POPIA | Comprehensive | In force | High | |
| BotswanaSouthern AfricaDPA 2024 | DPA 2024 | Comprehensive | In force | High | |
| ZambiaSouthern AfricaDPA 2021 | DPA 2021 | Comprehensive | In force | Medium | |
| ZimbabweSouthern AfricaCyber and Data Protection Act | Cyber and Data Protection Act | Comprehensive | In force | Medium | |
| MalawiSouthern AfricaData Protection Act 2024 | Data Protection Act 2024 | Comprehensive | In force | Low | |
| MozambiqueSouthern AfricaElectronic Transactions Law | Electronic Transactions Law | Sectoral | In force | Low | |
| AngolaSouthern AfricaLaw 22/11 | Law 22/11 | Comprehensive | In force | Medium | |
| NamibiaSouthern AfricaDraft Data Protection Bill | Draft Data Protection Bill | Bill / draft | Bill | Low | |
| EswatiniSouthern AfricaData Protection Act 2022 | Data Protection Act 2022 | Comprehensive | Enacted, phasing in | Medium | |
| LesothoSouthern AfricaDPA 2013 | DPA 2013 | Comprehensive | In force | Medium | |
| MauritiusIndian OceanDPA 2017 | DPA 2017 | Comprehensive | In force | High | |
| MadagascarIndian OceanLaw 2014-038 | Law 2014-038 | Comprehensive | Enacted, phasing in | Medium | |
| SeychellesIndian OceanDPA 2023 | DPA 2023 | Comprehensive | In force | High | |
| ComorosIndian OceanLaw 21-005 | Law 21-005 | Comprehensive | Enacted, phasing in | Low | |
| African Union (Malabo Convention)Regional frameworkMalabo Convention | Malabo Convention | Framework / treaty | In force | Medium | |
| ECOWAS Supplementary ActRegional frameworkECOWAS Supplementary Act | ECOWAS Supplementary Act | Framework / treaty | In force | Medium | |
| United Arab EmiratesGulfUAE PDPL | UAE PDPL | Comprehensive | Enacted, phasing in | Medium | |
| UAE — DIFCGulfDIFC DP Law 2020 | DIFC DP Law 2020 | Comprehensive | In force | High | |
| UAE — ADGMGulfADGM DPR 2021 | ADGM DPR 2021 | Comprehensive | In force | High | |
| Saudi ArabiaGulfSaudi PDPL | Saudi PDPL | Comprehensive | In force | High | |
| QatarGulfLaw 13/2016 | Law 13/2016 | Comprehensive | In force | Medium | |
| Qatar — QFCGulfQFC DPR 2021 | QFC DPR 2021 | Comprehensive | In force | High | |
| BahrainGulfBahrain PDPL | Bahrain PDPL | Comprehensive | In force | Medium | |
| OmanGulfOman PDPL | Oman PDPL | Comprehensive | In force | Medium | |
| KuwaitGulfKuwait DPR 2024 | Kuwait DPR 2024 | Sectoral | In force | Low | |
| IsraelLevantPPL / Amendment 13 | PPL / Amendment 13 | Comprehensive | In force | High | |
| JordanLevantLaw 24/2023 | Law 24/2023 | Comprehensive | In force | Medium | |
| LebanonLevantLaw 81/2018 | Law 81/2018 | Comprehensive | In force | Low | |
| IraqGulfDraft PDP Bill | Draft PDP Bill | Bill / draft | Bill | Low | |
| IranGulfSectoral cyber laws | Sectoral cyber laws | Sectoral | In force | Low | |
| SyriaLevant— | — | None | No law yet | Low | |
| YemenGulf— | — | None | No law yet | Low | |
| PalestineLevant— | — | None | No law yet | Low | |
| ChinaEast AsiaPIPL | PIPL | Comprehensive | In force | Medium | |
| Hong KongEast AsiaPDPO | PDPO | Comprehensive | In force | Medium | |
| MacauEast AsiaMacau PDPL | Macau PDPL | Comprehensive | In force | Medium | |
| TaiwanEast AsiaTaiwan PDPA | Taiwan PDPA | Comprehensive | In force | Medium | |
| JapanEast AsiaAPPI | APPI | Comprehensive | In force | High | |
| South KoreaEast AsiaPIPA | PIPA | Comprehensive | In force | High | |
| MongoliaEast AsiaMongolia PDPL | Mongolia PDPL | Comprehensive | In force | Low | |
| IndiaSouth AsiaDPDP Act | DPDP Act | Comprehensive | Enacted, phasing in | Medium | |
| PakistanSouth AsiaPECA / draft PDPB | PECA / draft PDPB | Sectoral | In force | Low | |
| Sri LankaSouth AsiaSri Lanka PDPA | Sri Lanka PDPA | Comprehensive | Enacted, phasing in | Medium | |
| BangladeshSouth AsiaCyber Security Act 2023 | Cyber Security Act 2023 | Sectoral | In force | Low | |
| NepalSouth AsiaIndividual Privacy Act | Individual Privacy Act | Comprehensive | In force | Low | |
| BhutanSouth AsiaNone | None | None | No law yet | Low | |
| MaldivesSouth AsiaNone | None | None | No law yet | Low | |
| AfghanistanSouth AsiaNone | None | None | No law yet | Low | |
| SingaporeSouth-East AsiaPDPA | PDPA | Comprehensive | In force | High | |
| MalaysiaSouth-East AsiaMalaysia PDPA | Malaysia PDPA | Comprehensive | In force | Medium | |
| ThailandSouth-East AsiaThailand PDPA | Thailand PDPA | Comprehensive | In force | High | |
| IndonesiaSouth-East AsiaPDP Law | PDP Law | Comprehensive | In force | Medium | |
| PhilippinesSouth-East AsiaData Privacy Act | Data Privacy Act | Comprehensive | In force | Medium | |
| VietnamSouth-East AsiaPDPL | PDPL | Comprehensive | In force | Medium | |
| CambodiaSouth-East AsiaDraft PDP Law | Draft PDP Law | Bill / draft | Bill | Low | |
| LaosSouth-East AsiaElectronic Data Protection Law | Electronic Data Protection Law | Sectoral | In force | Low | |
| MyanmarSouth-East AsiaSectoral (Cybersecurity Law 2025) | Sectoral (Cybersecurity Law 2025) | Sectoral | In force | Low | |
| BruneiSouth-East AsiaBrunei PDPO | Brunei PDPO | Comprehensive | In force | Medium | |
| Timor-LesteSouth-East AsiaNone | None | None | No law yet | Low | |
| AustraliaOceaniaPrivacy Act 1988 | Privacy Act 1988 | Comprehensive | In force | Medium | |
| New ZealandOceaniaPrivacy Act 2020 | Privacy Act 2020 | Comprehensive | In force | Medium | |
| Papua New GuineaOceaniaNone | None | None | No law yet | Low | |
| FijiOceaniaNone (sectoral only) | None (sectoral only) | Sectoral | In force | Low | |
| SamoaOceaniaNone | None | None | No law yet | Low | |
| TongaOceaniaNone | None | None | No law yet | Low | |
| VanuatuOceaniaNone | None | None | No law yet | Low | |
| Solomon IslandsOceaniaNone | None | None | No law yet | Low | |
| Other Pacific Islands (Kiribati, Micronesia, Palau, Marshall Islands, Nauru, Tuvalu)OceaniaNone | None | None | No law yet | Low | |
| APEC CBPR / Global CBPR ForumRegional frameworkGlobal CBPR Forum | Global CBPR Forum | Framework / treaty | In force | Low | |
| ASEAN Framework on Personal Data ProtectionRegional frameworkASEAN PDP Framework | ASEAN PDP Framework | Framework / treaty | In force | Low |
Catalogue compiled 5 September 2026 from primary legislation, regulator publications and the DLA Piper Data Protection Laws of the World handbook. Information, not legal advice — your DPO or counsel owns interpretation. Entries marked “verify” rest on secondary sources and are confirmed before anything is built on them.
Who it is for
Small teams with customers in more countries than they have lawyers
UK → US
A UK SaaS company selling into the United States
Twenty-three state privacy laws with different thresholds, opt-out rights and cure periods. One request queue that knows which state a requester is in and what that state gives them.
EU → BR · IN · ZA
A European company with teams in Brazil, India or South Africa
HR data under three regimes: the LGPD encarregado, India's phased DPDP rules and POPIA's information officer, each mapped back to the GDPR controls already in place.
AE · DIFC · ADGM
A group with entities in the Gulf
The UAE federal PDPL, the DIFC law and the ADGM regulations are three separate regimes. Each entity sees its own obligations; the group sees all three in one register.
What people ask before adding a jurisdiction
Is this legal advice?
No. What we build is a configuration taken from the published law and regulator guidance, so your registers apply the right rules and deadlines. Interpreting the law for your situation stays with your DPO or counsel — and Sentinel42's consultancy can act as your DPO if you need one.
Which laws does the product automate today?
UK GDPR with the Data Protection Act 2018 and PECR, EU GDPR with the ePrivacy overlay, and ISO 27701 as a certifiable privacy management module. Everything else in the catalogue below is reference information until we build it with you.
How current is the catalogue?
It was compiled on 5 September 2026 and is reviewed quarterly against primary sources. Entries that rest on secondary sources are marked "verify" and are confirmed before anything is built on them.
Can our data be held in a particular country?
The platform runs in the EU region by default. Enterprise customers can request a dedicated instance in a chosen region — for example London or São Paulo — by arrangement, following a scoping call. It is not self-serve, and we will tell you honestly what a region change does and does not solve.
Does this replace ISO 27701?
No, they do different jobs. ISO 27701 is a management system you can be certified against; a jurisdiction configuration is the legal requirement set for one country. They map onto each other, so neither duplicates the other.
Start with the countries you are in. Add the rest as you grow
14-day free trial, no card. UK or EU GDPR on day one, and ask us about the next jurisdiction whenever you need it.