Data Protection Law by Country
EU or EEA Member country Adequate country Partially adequate country Independant authority and law(s) Data protection law(s) No specific law
Which countries have GDPR-class privacy protection, a data-protection authority, or none.
Source: CNIL, Data protection around the world, updated 03/02/2026. Full data at www.cnil.fr/en/data-protection-around-the-world
Data Protection Law by Country (218)
+ Afghanistan No specific law
+ Albania Independant authority and law(s)
+ Algeria Independant authority and law(s)
+ Andorra Adequate country
+ Angola Independant authority and law(s)
+ Antigua and Barbuda Data protection law(s)
+ Argentina Adequate country
+ Armenia Independant authority and law(s)
+ Australia Independant authority and law(s)
+ Austria EU or EEA Member country
+ Azerbaijan Data protection law(s)
+ Bahamas Data protection law(s)
+ Bahrain Data protection law(s)
+ Bangladesh Data protection law(s)
+ Barbados Data protection law(s)
+ Belarus Data protection law(s)
+ Belgium EU or EEA Member country
+ Belize Data protection law(s)
+ Benin Independant authority and law(s)
+ Bermuda Independant authority and law(s)
+ Bhutan No specific law
+ Bolivia No specific law
+ Bosnia and Herzegovina Independant authority and law(s)
+ Botswana Data protection law(s)
+ Brazil Adequate country
+ Brunei Darussalam Independant authority and law(s)
+ Bulgaria EU or EEA Member country
+ Burkina Faso Independant authority and law(s)
+ Burma (Myanmar) No specific law
+ Burundi No specific law
+ Cambodia No specific law
+ Cameroon Independant authority and law(s)
+ Canada Partially adequate country
+ Cape Verde Independant authority and law(s)
+ Cayman Islands Independant authority and law(s)
+ Central African Republic Data protection law(s)
+ Chad Data protection law(s)
+ Chile Independant authority and law(s)
+ China Data protection law(s)
+ Colombia Independant authority and law(s)
+ Comoros Data protection law(s)
+ Congo Data protection law(s)
+ Congo, The Democratic Republic Of The Data protection law(s)
+ Costa Rica Independant authority and law(s)
+ Croatia EU or EEA Member country
+ Cuba Data protection law(s)
+ Cyprus EU or EEA Member country
+ Czech Republic EU or EEA Member country
+ Côte d'Ivoire Independant authority and law(s)
+ Denmark EU or EEA Member country
+ Djibouti No specific law
+ Dominica No specific law
+ Dominican Republic Data protection law(s)
+ Ecuador Independant authority and law(s)
+ Egypt Data protection law(s)
+ Equatorial Guinea Data protection law(s)
+ Eritrea No specific law
+ Estonia EU or EEA Member country
+ Eswatini Data protection law(s)
+ Ethiopia Independant authority and law(s)
+ Faroe Islands Adequate country
+ Fiji No specific law
+ Finland EU or EEA Member country
+ France EU or EEA Member country
+ French Guiana EU or EEA Member country
+ French Polynesia EU or EEA Member country
+ French Southern Territories EU or EEA Member country
+ Gabon Independant authority and law(s)
+ Gambia No specific law
+ Georgia Independant authority and law(s)
+ Germany EU or EEA Member country
+ Ghana Independant authority and law(s)
+ Gibraltar Independant authority and law(s)
+ Greece EU or EEA Member country
+ Greenland Independant authority and law(s)
+ Grenada Data protection law(s)
+ Guadeloupe EU or EEA Member country
+ Guatemala No specific law
+ Guernsey Adequate country
+ Guinea Data protection law(s)
+ Guinea-Bissau No specific law
+ Guyana Data protection law(s)
+ Haiti No specific law
+ Honduras No specific law
+ Hong Kong Independant authority and law(s)
+ Hungary EU or EEA Member country
+ Iceland EU or EEA Member country
+ India Data protection law(s)
+ Indonesia Data protection law(s)
+ Irak No specific law
+ Iran No specific law
+ Ireland EU or EEA Member country
+ Isle Of Man Adequate country
+ Israel Adequate country
+ Italy EU or EEA Member country
+ Jamaica Data protection law(s)
+ Japan Adequate country
+ Jersey Adequate country
+ Jordan Independant authority and law(s)
+ Kazakhstan Data protection law(s)
+ Kenya Independant authority and law(s)
+ Kiribati No specific law
+ Kosovo Independant authority and law(s)
+ Kuwait No specific law
+ Kyrgyzstan Data protection law(s)
+ Laos Data protection law(s)
+ Latvia EU or EEA Member country
+ Lebanon Data protection law(s)
+ Lesotho Data protection law(s)
+ Liberia No specific law
+ Libya No specific law
+ Liechtenstein EU or EEA Member country
+ Lithuania EU or EEA Member country
+ Luxembourg EU or EEA Member country
+ Macao Data protection law(s)
+ Madagascar Data protection law(s)
+ Malawi Independant authority and law(s)
+ Malaysia Data protection law(s)
+ Maldives No specific law
+ Mali Independant authority and law(s)
+ Malta EU or EEA Member country
+ Marshall Islands No specific law
+ Martinique EU or EEA Member country
+ Mauritania Independant authority and law(s)
+ Mauritius Independant authority and law(s)
+ Mayotte EU or EEA Member country
+ Mexico Independant authority and law(s)
+ Micronesia No specific law
+ Moldova Independant authority and law(s)
+ Monaco Independant authority and law(s)
+ Mongolia Data protection law(s)
+ Montenegro Independant authority and law(s)
+ Morocco Independant authority and law(s)
+ Mozambique No specific law
+ Namibia No specific law
+ Nauru No specific law
+ Nepal Data protection law(s)
+ Netherlands EU or EEA Member country
+ New Caledonia EU or EEA Member country
+ New Zealand Adequate country
+ Nicaragua Data protection law(s)
+ Niger Independant authority and law(s)
+ Nigeria Independant authority and law(s)
+ North Korea No specific law
+ North Macedonia Independant authority and law(s)
+ Norway EU or EEA Member country
+ Oman Data protection law(s)
+ Pakistan No specific law
+ Palau No specific law
+ Palestine No specific law
+ Panama Data protection law(s)
+ Papua New Guinea No specific law
+ Paraguay Data protection law(s)
+ Peru Independant authority and law(s)
+ Philippines Independant authority and law(s)
+ Poland EU or EEA Member country
+ Portugal EU or EEA Member country
+ Puerto Rico No specific law
+ Qatar Independant authority and law(s)
+ Romania EU or EEA Member country
+ Russian Federation Data protection law(s)
+ Rwanda Data protection law(s)
+ Réunion EU or EEA Member country
+ Saint Kitts And Nevis Data protection law(s)
+ Saint Lucia Data protection law(s)
+ Saint Vincent and The Grenadines Data protection law(s)
+ Salvador Data protection law(s)
- Samoa No specific law
Protection level
No specific law
What it means
This country doesn't ensure an adequate level of data protection recognized by EU. Data transfers to this country require the use of transfer tools.
EU/EEA (GDPR)
No
+ San Marino Independant authority and law(s)
+ Sao Tome and Principe Independant authority and law(s)
+ Saudi Arabia Data protection law(s)
+ Senegal Independant authority and law(s)
+ Serbia Independant authority and law(s)
+ Seychelles Data protection law(s)
+ Sierra Leone No specific law
+ Singapore Data protection law(s)
+ Slovakia EU or EEA Member country
+ Slovenia EU or EEA Member country
+ Solomon Islands No specific law
+ Somalia Independant authority and law(s)
+ Somaliland No specific law
+ South Africa Independant authority and law(s)
+ South Korea Adequate country
+ South Sudan No specific law
+ Spain EU or EEA Member country
+ Sri Lanka Data protection law(s)
+ Sudan No specific law
+ Suriname No specific law
+ Sweden EU or EEA Member country
+ Switzerland Adequate country
+ Syria Data protection law(s)
+ Taiwan Data protection law(s)
+ Tajikistan Data protection law(s)
+ Tanzania Data protection law(s)
+ Thailand Data protection law(s)
+ Timor-Leste No specific law
+ Togo Data protection law(s)
+ Tonga No specific law
+ Trinidad and Tobago Data protection law(s)
+ Tunisia Independant authority and law(s)
+ Turkey Independant authority and law(s)
+ Turkmenistan Data protection law(s)
+ Tuvalu No specific law
+ Uganda Independant authority and law(s)
+ Ukraine Independant authority and law(s)
+ United Arab Emirates Data protection law(s)
+ United Kingdom Adequate country
+ United States Partially adequate country
+ Uruguay Adequate country
+ Uzbekistan Data protection law(s)
+ Vanuatu Independant authority and law(s)
+ Vatican Independant authority and law(s)
+ Venezuela No specific law
+ Viet Nam Data protection law(s)
+ Western Sahara No specific law
+ Yemen No specific law
+ Zambia Data protection law(s)
+ Zimbabwe Independant authority and law(s)
Murphy's Law