International Privacy Laws

The following list contains a number of international privacy related laws by country and region. Wherever possible, these hyperlinks reference an English translation of the law. See also our list of U.S. Privacy Laws and other information security policy resources.

• Argentina: Personal Data Protection Act of 2000 (aka Habeas Data)
• Austria: Data Protection Act 2000, Austrian Federal Law Gazette part I No. 165/1999  (Datenschutzgesetz 2000 or DSG 2000).
• Australia: Privacy Act of 1988
• Belgium: Belgium Data Protection Law and Belgian Data Privacy Commission Privacy Blog
• Brazil: Privacy currently governed by Article 5 of the 1988 Constitution.
• Bulgaria: The Bulgarian Personal Data Protection Act, was adopted on December 21, 2001 and entered into force on January 1, 2002. More information at the Bugarian Data Protection Authority
• Canada: The Privacy Act – July 1983
  Personal Information Protection and Electronic Data Act (PIPEDA) of 2000 (Bill C-6)
• Chile: Act on the Protection of Personal Data, August 1998
• Colombia: Two laws affecting data privacy – Law 1266 of 2008: (in Spanish) and Law 1273 of 2009 (in Spanish) Also, the constitution provides any person the right to update their personal information
• Czech Republic: Act on Protection of Personal Data (April 2000) No. 101
• Denmark: Act on Processing of Personal Data, Act No. 429, May 2000.
• Estonia: Personal Data Protection Act of 2003. June 1996, Consolidated July 2002.
• European Union: European Union Data Protection Directive of 1998
• EU Internet Privacy Law of 2002 (DIRECTIVE 2002/58/EC) With a discussion here.
• Finland: Act on the Amendment of the Personal Data Act (986) 2000.
• France: Data Protection Act of 1978 (revised in 2004)
• Germany: Federal Data Protection Act of 2001
• Greece: Law No.2472 on the Protection of Individuals with Regard to the Processing of Personal Data, April 1997.
• Guernsey: Data Protection (Bailiwick of Guernsey) Law of 2001
• Hong Kong: Personal Data Ordinance (The “Ordinance”)
• Hungary: Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interests (excerpts in English).
• Iceland: Act of Protection of Individual; Processing Personal Data (Jan 2000)
• Ireland: Data Protection (Amendment) Act, Number 6 of 2003
• India: Information Technology Act of 2000
• Italy: Data Protection Code of 2003, Processing of Personal Data Act, January 1997
• Japan: Personal Information Protection Law (Act) (Official English Translation)
  Law Summary from Jonesday Publishing
• Japan: Law for the Protection of Computer Processed Data Held by Administrative Organs, December 1988.
• Korea – Act on Personal Information Protection of Public Agencies Act on Information and Communication Network Usage
• Latvia: Personal Data Protection Law, March 23, 2000.
• Lithuania: Law on Legal Protection of Personal Data (June 1996)
• Luxembourg: Law of 2 August 2002 on the Protection of Persons with Regard to the Processing of Personal Data.
• Malaysia – Common Law principle of confidentiality Personal data Protection Bill (Not finalized) Banking and Financial Institutions Act of 1989 privacy provisions.
• Malta: Data Protection Act (Act XXVI of 2001), Amended March 22, 2002, November 15, 2002 and July 15, 2003
• Mexico: Federal Law for the Protection of Personal Data Possessed by Private Persons (Spanish) – The regulations deal with data subjects’ rights, security and breach notification provisions, cloud computing, consent and notice requirements, and data transfers. Good summary of the law in English at the IT Law Group
• Morocco: Data Protection Act
• Netherlands: Dutch Personal Data Protection Act 2000 as amended by Acts dated 5 April 2001, Bulletin of Acts, Orders and Decrees 180, 6 December 2001
• New Zealand: Privacy Act, May 1993; Privacy Amendment Act, 1993; Privacy Amendment Act, 1994
• Norway: Personal Data Act (April 2000) – Act of 14 April 2000 No. 31 Relating to the Processing of Personal Data (Personal Data Act)
• Philippines: DATA PRIVACY ACT OF 2011 There is also a recognized right of privacy in civil law and a model data protection code.
• Romania: Law No. 677/2001 for the Protection of Persons concerning the Processing of Personal Data and the Free Circulation of Such Data
• Poland: Act of the Protection of Personal Data (August 1997)
• Portugal: Act on the Protection of Personal Data (Law 67/98 of 26 October)
• Singapore – The E-commerce Code for the Protection of Personal Information and Communications of Consumers of Internet Commerce. Other related Singapore Laws and E-commerce Laws .
• Slovak Republic: Act No. 428 of 3 July 2002 on Personal Data Protection.
• Slovenia: Personal Data Protection Act, RS No. 55/99.
• South Africa: Electronic Communications and Transactions Act, 2002
• South Korea: The Act on Promotion of Information and Communications Network Utilization and Data Protection of 2000
• Spain: ORGANIC LAW 15/1999 of 13 December on the Protection of Personal Data
• Switzerland: The Federal Law on Data Protection of 1992
• Sweden: Personal Data Protection Act (1998:204), October 24, 1998
• Taiwan: Computer Processed Personal data Protection Law – applies only to public institutions. (English Translation)
• Thailand: Official Information Act, B.E. 2540 (1997) for state agencies. (Personal data Protection bill under consideration.)
• United Kingdom: UK Data Protection Act 1998
  Privacy and Electronic Communications (EC Directive) Regulations 2003 official text, and a consumer oriented site at the Information Commissioner’s Office.
• Vietnam: The Law on Electronic Transactions 2008

For additions to this list, please contact us with suggestions.