Personal control.
Local obligations.

Identify an Article 6 basis and, where needed, an Article 9 condition. Assess controller roles, notices, rights, security, impact assessments and Chapter V transfers. National rules still differ. An Autonym grant does not grant permission to use cookies or send marketing.

• GDPR
• EDPB legal basis guidance

Use the amended UK rules separately from EU GDPR. The complaints procedure requirement took effect on 19 June 2026: provide a clear route, acknowledge within 30 days and respond without undue delay. Review UK transfer safeguards, sensitive data conditions and PECR separately.

• ICO: complaints law in force
• ICO: DUAA changes

GDPR has applied through the EEA since 20 July 2018. Check Norwegian supplementary and sector rules, supervisory procedures and the actual transfer route. EEA participation does not make every recipient outside the EEA an authorised destination.

• EFTA: GDPR in the EEA

GDPR has applied through the EEA since 20 July 2018. Assess Icelandic supplementary and sector rules and local rights procedures. Hosting in Iceland does not resolve the legality of subsequent disclosures to overseas assistants.

• EFTA: GDPR in the EEA

GDPR has applied through the EEA since 20 July 2018. Apply the local supplementary rules and regulator procedures. A provider and its recipients still need the appropriate legal roles, agreements and transfer safeguards.

• EFTA: GDPR in the EEA

The Swiss private-sector framework is not a copy of GDPR's six-basis model. Assess personality-rights protection, sensitive data, high-risk processing and transparency. Use the Swiss rules for overseas disclosures and any required contractual adaptations; EU paperwork alone is not a complete Swiss assessment.

• FDPIC: the revised FADP

Use Jersey's lawful-processing and special-category conditions. Restricted transfers may require the EU standard contractual clauses together with the Jersey Addendum and a transfer assessment. Do not substitute UK or EU jurisdiction labels for the local analysis.

• JOIC: lawful bases and special categories
• JOIC: international transfers

Assess local registration and levy duties and the conditions for sensitive processing. For applicable overseas transfers, use the Guernsey transfer guidance, impact assessment and local SCC addendum. A technical recipient registration is not registration with the authority.

• ODPA: the law
• ODPA: transfers
• ODPA: registration

Use the Manx application orders and implementing regulations, including local modifications and enforcement arrangements. UK DUAA amendments must not be assumed automatically to amend Manx law. Review recipient disclosures under the applied framework.

• Isle of Man Government: legislative framework

Apply the amended sensitive-data and overseas-transfer rules. Article 9 now includes mechanisms such as standard contracts and binding corporate rules. Complete the relevant local documentation and filing requirements; an Autonym grant or an EU SCC does not replace a KVKK transfer mechanism.

• KVKK: overseas-transfer by-law and contracts
• KVKK: 2024 amendments

Assess local legal grounds, sensitive-data conditions and international-transfer rules rather than treating Serbia as part of the EEA. Large-scale sensitive processing or systematic monitoring can trigger a data protection officer requirement. Determine the provider's and recipient's duties separately.

• Serbian Commissioner: DPO duties and legal framework

Use Law 124/2024 and its implementing measures, not only the older 2008 law. Verify local transfer decisions and any phased organisational requirements. Alignment with GDPR does not establish EU adequacy or certify an implementation.

• Commissioner: Law 124/2024
• Commissioner: 2025 transfer decision

The government published a proposed replacement law and conclusions in September 2026. This review does not establish its enactment or commencement. Confirm the governing text, transfer approvals and registration requirements before deployment; do not describe a proposal as law already in force.

• Agency: existing law in English
• Government: September 2026 proposal

Use the agency's current law and amendment register, including the 2021 amendments and subsequent applicable measures. Assess local overseas-transfer procedures, sensitive-data conditions and DPO duties. A GDPR-based implementation still needs local configuration.

• AZLP: laws and amendments

Use the 2025 replacement law and its transitional provisions. The agency confirms that application began on 4 October 2025. Check organisational transition duties and local implementing rules rather than continuing to rely solely on the older framework.

• Agency: new law
• Agency: application date

Law 195/2024 is now the relevant general framework; it must not be presented as a future reform or replaced with the old Law 133/2011 in a current assessment. Complete the new local controller, rights, security and transfer analysis.

• CNPDCP: commencement
• Law 195/2024

Use the current consolidated law. Data-protection oversight transferred to the State Audit Office from 2 March 2026. Configure incident escalation, impact assessments and transfer safeguards against the current authority and law, not obsolete regulator details.

• Matsne: consolidated law

The official register identifies Law 2297-VI as current. Assess sensitive processing, foreign disclosures and applicable sector or wartime measures. EU accession work is not itself enactment of a replacement GDPR-style law.

• Verkhovna Rada: current law register

Determine APP coverage, including relevant health-service and small-business exceptions. Assess sensitive-information consent, APP 8 overseas disclosure, APP 11 security/retention and breach reporting. Additional privacy-policy disclosure about certain automated decisions begins on 10 December 2026.

• OAIC: APP framework
• OAIC: automated-decision commencement

Provide indirect-collection notices where IPP3A requires them; a proposal waiting in Autonym is already collected information. Assess IPP12 for overseas disclosures, including its distinction from some agency processing arrangements. Health-sector codes may add duties.

• OPC: IPP3A
• OPC: overseas disclosure

Assess separate consent and necessity for sensitive information, recipient notices, impact assessments and Articles 38-40 transfer/local-storage conditions. Apply current CAC thresholds and exemptions. Do not enable a cross-border flow until its actual route is authorised; not all personal information has a blanket localisation requirement.

• National People's Congress: PIPL

Check special-care-required information, acquisition consent and third-party provision separately. Overseas provision may need informed consent or an applicable equivalent-protection route and continuing safeguards. Read the current Japanese law and guidance; older English translations can lag amendments.

• PPC: current APPI questions and answers
• PPC: English translation (older edition)

Distinguish entrusted processing from provision to another controller. Review sensitive-data consent and the applicable overseas-transfer basis, required notice and recipient details. PIPC's 2025 enforcement illustrates that describing a recipient as a processor does not settle its real legal role.

• PIPC: cross-border transfer enforcement

Do not describe all DPDP duties as already operative. The 2025 rules phase commencement: consent-manager rules after one year and most substantive rules after eighteen months. Map the Act's separate commencement notification and existing IT/SPDI duties. Autonym is not automatically a registered Consent Manager; that is a regulated role.

• MeitY: rules and Act enforcement timeline
• Gazette: Rules 2025, rule 1

Apply accountability, notification, consent or a valid exception, breach duties and comparable protection for overseas transfers. The PDPC page still describes the statutory portability obligation as taking effect when regulations are issued. Autonym can offer portability without claiming that right is already operative.

• PDPC: data protection obligations

Identify the ordinary legal basis and any section 26 sensitive-data condition. Assess sections 28-29 and implementing rules for overseas transfers, controller/processor agreements, rights handling and breach procedures. General consent must not be treated as every required sensitive-data or transfer consent.

• MDES: Act translation

Assess commercial-transaction scope, sensitive information, processor security, DPO and breach duties, portability conditions and revised transfer rules. DPO requirements took effect on 1 June 2025. Use the current Commissioner guidance, not only the original 2010 provisions.

• Commissioner: amendment materials
• Commissioner: DPO FAQ
• Commencement order

Specific personal data includes health, biometrics, children's information and personal financial data. Assess impact assessments, DPO triggers, rights and cross-border conditions. Article 46 prescribes a 3 x 24-hour breach-notice period. Review implementing measures and relevant court decisions before deployment.

• Komdigi: law text
• BPK: law and judicial update

Sensitive and privileged information have separate processing conditions. A controller remains accountable for information transferred for processing, domestically or internationally. Apply contracts or comparable safeguards, registration where required, breach procedures and statutory rights; consent must remain withdrawable.

• NPC: Data Privacy Act
• NPC: implementing rules

The assessment must use the new law and implementing decree, not Decree 13/2023 alone. Before enabling a recipient, verify consent, sensitive-data, processing-impact and cross-border dossier requirements, exemptions and applicable storage rules against the current Vietnamese text.

• Government: Law 91/2025
• Government: Decree 356/2025

Apply direct-marketing requirements separately. Overseas outsourcing still requires security and retention safeguards. PCPD material describes section 33's transfer restriction as uncommenced; this review does not establish a later commencement. Confirm that point before relying on it, and do not interpret it as permission for unrestricted exports.

• PCPD: six principles
• PCPD: section 33 and existing safeguards

Article 6 restricts medical, genetic, sexual-life and other listed information; written consent is one conditional route. Apply indirect-collection notices and any sector transfer restrictions. The official register marks parts of the November 2025 amendments as awaiting commencement; do not treat every amended provision as operative.

• Official current register and commencement flags
• Official English law

The July 2026 commencement order sets 1 January 2027 for sections 2 and 3, Part I and Part III. This is not commencement of every provision, including all rights in Part II. Use the amended Act and check each applicable part, transfer instrument and regulator procedure before launch; the original March 2025 date was postponed.

• Gazette 2498/16: July 2026 commencement order
• Amendment Act 22/2025

Map the activity and province. PIPEDA remains relevant to commercial interprovincial/international flows. Québec requires a privacy assessment before communicating information outside Québec; its portability provisions apply from 22 September 2024. Assess express consent for sensitive information, provincial health laws and accountable outsourcing separately.

• OPC: federal and provincial interaction
• Quebec CAI: Law 25 changes

Assess FTC Act duties, HIPAA relationships, the FTC Health Breach Notification Rule, COPPA and relevant financial, education, biometric and state health laws. A direct-to-consumer health record is not automatically subject to HIPAA; absence of HIPAA coverage does not remove privacy obligations.

• HHS: health apps and HIPAA
• FTC: health breach rule
• FTC: COPPA

Assess business coverage, service-provider contracts, sale/sharing and sensitive-information limits. Honour applicable opt-out preference signals; an ordinary grant must not silently override them. Risk-assessment requirements began in 2026, while the new automated-decision requirements begin in 2027 and audit deadlines are staged. A read log is not the full required assessment.

• CPPA: current law and regulations
• CPPA: dates and requirements

Review Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, Maryland and Minnesota individually. Other enacted regimes include Utah, Iowa, Indiana, Tennessee, Nebraska, New Hampshire, Kentucky and Rhode Island. Coverage, exemptions, sensitive-data treatment, appeals and opt-out signals differ. The state notes below identify key differences; this is not an exhaustive US-law inventory.

• NCSL: legislation register
• NCSL: 2024 enactments

Use the distinct sensitive-data grounds and assess data-subject rights and security duties. International transfers need an LGPD mechanism. ANPD Resolution 19/2024 establishes local transfer arrangements and standard clauses; do not assume an EU contract or protocol grant is enough.

• ANPD: LGPD and official English materials
• ANPD: transfer regulation

Use the new private-sector law and current authority arrangements, not only the repealed 2010 text. Assess privacy notices, sensitive-data consent formalities, transfers and access, rectification, cancellation and opposition. The official consolidated text records a further amendment on 14 November 2025.

• Chamber of Deputies: current LFPDPPP

Articles 7-8 impose specific restrictions on sensitive-data databases and health processing. Obtain a local assessment before enabling health, identity or other sensitive categories; do not assume an opt-in cures a prohibition. Assess AAIP transfer mechanisms separately. An Autonym account must not be treated as an automatic exemption.

• Official consolidated Law 25,326
• AAIP: international transfers

Review sensitive-data formalities, local registration, accountable processing and breach requirements. Article 23 restricts international transfers and provides specified exceptions and authorisation routes. A recipient's technical compatibility is not evidence of adequate legal protection.

• Official law: international transfers

Explain the optional nature of sensitive-data answers and use a permitted sensitive-data condition. Distinguish controller-to-controller transfer from transmission to a processor and apply the relevant rules and contracts. Assess database-registration scope and overseas adequacy or exceptions; not every foreign disclosure follows the same route.

• Official Law 1581

Use the replacement regulation. Assess local representation, data protection officer triggers, consent and sensitive-data formalities, transfers and registration. Covered security incidents can trigger a 48-hour notification requirement. Configure duties and deadlines locally, including any staged provisions.

• ANPD: replacement regulation
• Ministry: commencement and DPO changes
• ANPD: regulatory summary

Apply the currently operative Law 19,628 until the reform's commencement. Prepare for the expanded rights, accountability, regulator and international-transfer regime from 1 December 2026. The official register explicitly separates the current and future consolidated texts.

• BCN: current Law 19,628
• BCN: Law 21,719 commencement

Sensitive categories expressly include gender identity and cultural identity, alongside other protected data. Classify context under local law, including what a value reveals indirectly. Assess local representation, DPO/impact duties where applicable and overseas-transfer mechanisms under current SPDP measures.

• Government: Organic Law

Assess the law together with the implementing decree, including sensitive information, controller/custodian responsibilities, overseas transfers and statutory rights. A general purpose statement or a purge acknowledgement is not the full notice, contractual or deletion process.

• ANTAI: Executive Decree 285 and legal framework

Article 9 restricts sensitive-data processing and enumerates exceptions. Do not assume ordinary explicit consent alone permits a general health or identity database. Obtain local confirmation of any exception and of the law's database scope; assess transfer consent and PRODHAB duties separately.

• Official law register
• PGR: Article 9 restrictions and exceptions

Use Amendment 13, the security regulations and applicable overseas-transfer rules. Assess updated sensitive-information definitions, DPO triggers and database registration or notification duties. The regulator issued final DPO guidance in July 2026. An Autonym grant does not replace required organisational or database obligations.

• Knesset: Amendment 13 and commencement
• Privacy Protection Authority: Amendment 13 FAQ
• Authority: final DPO guidance, July 2026

First distinguish federal coverage from DIFC/ADGM and excluded government, health and banking data governed by other rules. Health-sector legislation can apply in free zones too. Verify executive regulations and any associated compliance timetable before launch; this review does not establish their current issuance. Assess health-data location rules and permitted cross-border routes separately.

• UAE government: data protection laws
• Official federal law

Use the DIFC regime independently from UAE federal law. Review special categories, high-risk assessments, registration and transfer safeguards, including the 2025 amendments. Regulation 10 addresses autonomous and semi-autonomous systems and can matter to assistant integrations. June 2026 regulatory proposals require an adoption check; do not treat consultation text as operative.

• DIFC: guidance and Regulation 10
• DIFC: July 2025 enactment
• DIFC: June 2026 consultation

Apply ADGM-specific controller/processor, registration, special-category and impact-assessment rules. Certain sensitive-data grounds require an Appropriate Policy Document. Transfers outside ADGM need a permitted route; approved mechanisms include ADGM clauses and an ADGM addendum to EU clauses. A transfer to the wider UAE is not automatically internal to ADGM.

• ADGM: official guidance and transfer instruments
• ADGM: 2025 substantial-public-interest rules

Assess the Saudi conditions for sensitive data, direct marketing, rights, DPO/registration duties and overseas transfers. Apply the current transfer regulation, local safeguards and risk-assessment requirements rather than assuming an EU agreement or general consent is sufficient. Determine scope for processing Saudi residents' data from abroad and any sector-specific restrictions.

• SDAIA: PDPL English text
• SDAIA: transfer regulation

Assess notification and prior-authorisation procedures, sensitive-data conditions and the 2022 implementing orders. Overseas transfers follow the local adequate-country, authorisation or exception routes, including Order 42/2022. Order 45/2022 addresses sensitive processing. Personal permission does not substitute for a required authority approval.

• Authority: Law 30/2018
• Order 42/2022: overseas transfers
• Order 45/2022: sensitive processing

Article 16 requires permission from the competent authority before processing personal data of a special nature, including relevant health, religious and children's data. Obtain the applicable permit as well as satisfying consent and other duties. Assess marketing, security and cross-border risks separately. Qatar Financial Centre has a separate regime outside this entry.

• Ministry of Justice: Law 13/2016
• NCSA: special-nature processing guidance

Article 5 data processing needs a Ministry permit; verify the covered categories before accepting health or other sensitive context. The executive regulation also addresses children, rights, breach handling and overseas flows. Track permit conditions and validity. A grant or a submitted application is not the required regulatory permission.

• MTCIT: executive regulation
• MTCIT: Article 5 permit service
• MTCIT: 2026 enforcement statement

The PDPC now publishes the licensing and permit framework: do not describe the executive regulations as still absent. Assess controller/processor licensing, registered DPOs, sensitive-data formalities and direct marketing. Cross-border disclosures need the applicable licence/permit or a permitted Article 15 exception. Confirm transition deadlines and procedures for the actual launch.

• PDPC: framework and executive regulations
• PDPC: licensing, rights and cross-border FAQ
• PDPC: DPO guidance, January 2026

Use the local responsible-party/operator roles, information-officer duties and special-personal-information conditions. Section 57 prior authorisation can apply to certain identifier-linking activities and transfers of special or children's information to countries without adequate protection. Section 72 governs foreign transfers. Assess direct-marketing consent separately; a grant is not regulatory authorisation.

• Information Regulator: POPIA and authorisation guidance
• Information Regulator: prior authorisation

Use the Act and GAID, not the older NDPR alone. Assess designation and registration as a controller or processor of major importance, DPO and audit-return requirements, sensitive-data conditions, high-risk assessments and transfers. A technical conformance declaration does not establish registration with the NDPC.

• NDPC: GAID 2025
• NDPC: 2026 audit-return guidance

Health data has additional section 46 provider/professional-confidentiality conditions; ordinary consent alone is not the whole assessment for a general context host. Apply registration rules and exemptions, transfer safeguards and any applicable localisation rules. ODPC's September 2026 proposal to expand sensitive categories must be checked for final adoption before treating it as law.

• ODPC: health-data guidance
• ODPC: general regulations
• ODPC: registration regulations
• ODPC: draft additional sensitive categories

Controllers must assess registration before processing, special personal data, security, rights and overseas recipients. Registration particulars include purposes, recipient categories and destination countries. The Commission published a 2025 replacement draft; this review does not establish enactment. Do not substitute that draft for the operative law.

• Commission: Act 843
• Commission: 2025 draft bill

Assess the Act's extraterritorial scope, registration as a collector/controller/processor, annual renewal and local DPO/incident duties. Overseas processing or storage needs the applicable adequacy or consent conditions under the Act and regulations. Corrections may need communication to earlier recipients; changing the current record alone is not enough.

• PDPO: organisational obligations
• PDPO: Regulations 2021

Distinguish permission to transfer from permission to store abroad. Article 50 requires a valid authority-issued authorisation for overseas storage; Articles 48-49 govern foreign sharing/access and contracts. Apply registration and sensitive-data conditions. A lawful recipient transfer or EU cloud contract does not automatically authorise foreign storage or backups.

• DPO: transfer, storage and retention provisions
• DPO: external storage approval service

Assess controller/processor registration, special-category conditions, impact assessment and prior consultation where required. Section 36 specifies overseas-transfer routes; document the applicable safeguards or exception. Automated decision rights and local breach duties require processes beyond the read log.

• Data Protection Office: Act 2017
• Data Protection Office: registration and transfer services

Assess CNDP declarations and prior authorisation, particularly for sensitive data and national identity numbers. Foreign-transfer formalities are separate, and the related underlying processing must already have the required approval. A person's consent or an Autonym recipient registration does not replace a CNDP filing or authorisation.

• CNDP: website processing requirements
• CNDP: overseas transfers
• CNDP: Law 09-08

Apply declaration and authorisation procedures and the specific restrictions on sensitive and health information. Article 52 requires INPDP authorisation for overseas transfers; health processing can also require prior permission. Do not enable a foreign assistant on the strength of consent alone. Assess special procedures for children and each intended use.

• INPDP: legislation and implementing decrees
• INPDP: transfer and health-data authorisations

Use the 2024 replacement Act rather than an undated reference to the earlier legislation. Assess its scope, lawful and sensitive-processing conditions, rights, security, officer/assessment triggers and cross-border provisions against the current legal text and implementing measures. Government material confirms the January 2025 commencement.

• Botswana government: Act and commencement notice
• Government: access to current legislation

Section 70 requires processing and storage on a server or data centre in Zambia; assess any applicable category restrictions and authorised arrangements. Section 71 separately sets foreign-transfer conditions. The regulator's registration process flags separate transfer authorisation. Do not assume overseas-only hosting, encrypted backups or personal consent satisfy these obligations.

• Commissioner: Act 2021
• Commissioner: registration and storage guide

Assess POTRAZ data-controller licensing and exemptions, DPO requirements, sensitive-data conditions and overseas sharing. SI 155/2024 provides 12-month licences and renewal procedures, and notification of intended foreign transfers. A valid technical grant is not a controller licence; track both approval scope and expiry.

• POTRAZ: Cyber and Data Protection Act
• POTRAZ: SI 155/2024 licensing and DPO regulations