Data Protection & Privacy

GDPR through the DSG, supervised by the Datenschutzbehörde

Data protection rests on the GDPR, supplemented by the Austrian Data Protection Act (DSG), which uniquely elevates a core right to data protection to constitutional rank. The Datenschutzbehörde is the single national supervisory authority for both the public and private sectors.

Austria's early practice favoured warnings over fines for first infringements, though enforcement has firmed up. The constitutional ranking of §1 DSG means a data-protection claim can, in principle, reach the Constitutional Court.

GDPR applied through the 2018 framework act and a Litigation Chamber

The GDPR applies directly, with the Act of 30 July 2018 filling in the margins the Regulation leaves to member states. The Data Protection Authority replaced the former Privacy Commission in 2018 and, unlike its predecessor, has a Litigation Chamber able to issue binding orders and fines.

Complaints must be in writing and in one of the national languages; the Litigation Chamber first tests admissibility and often closes cases through a settlement or a reprimand rather than a fine. A separate civil claim for damages goes to the ordinary courts, not the authority.

LGPD, closely modelled on the GDPR

The Lei Geral de Proteção de Dados applies to processing connected to Brazil regardless of where the controller sits. The ANPD supervises and has been issuing sanctions since 2023.

The ANPD's early enforcement has focused on small controllers with no DPO and no privacy notice, so the basics matter more than sophisticated documentation.

The GDPR applied through the loi Informatique et Libertés, policed by the CNIL

France applies the GDPR alongside its pioneering 1978 Data Protection Act. The CNIL, the world's oldest data-protection regulator, supervises compliance and issues some of Europe's largest fines.

The CNIL has led enforcement on cookies and advertising identifiers, so consent banners are a frequent audit target.

The Data Protection and Privacy Act 2023 created The Gambia's first general regime

The Data Protection and Privacy Act 2023 established a comprehensive framework and a Data Protection and Privacy Commission. It requires a lawful basis for processing, grants data subject rights, imposes security and breach obligations, and restricts cross-border transfers — replacing a prior position of no general statute.

Before 2023 The Gambia had no general data protection law, relying on constitutional privacy under s.23 and the Information and Communications Act 2009. The Data Protection and Privacy Act 2023 changed that, establishing the Data Protection and Privacy Commission as regulator with registration, investigation and enforcement functions. It sets processing principles of lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity and accountability; recognises consent, contract, legal obligation, vital interests, public interest and legitimate interests as bases; grants rights of access, rectification, erasure, restriction, objection and portability; and imposes security measures and breach notification duties. Cross-border transfers require adequacy, appropriate safeguards or a statutory derogation. Because the Act is recent, subsidiary regulations and the Commission's operational capacity are still developing, so practitioners should verify the commencement and registration position for a given obligation.

GDPR with strict German additions on employee data

The GDPR applies directly, supplemented by the BDSG. Germany layers on works-council involvement and a lower threshold for appointing a data protection officer.

Because supervision is decentralised, the competent authority depends on the establishment's Land, and their published guidance is not always identical.

Data Protection Act 2012 with a registration duty for data controllers

The Data Protection Act 2012 (Act 843) establishes the Data Protection Commission and requires every data controller to register with it. Processing must satisfy statutory principles, data subjects have access and correction rights, and cross-border transfers require adequate protection at the destination.

Act 843 predates the GDPR and follows the earlier European model. It sets eight principles — accountability, lawfulness, specification of purpose, compatibility, quality, openness, security safeguards and data subject participation. Registration of data controllers with the Data Protection Commission is mandatory and renewable, and processing without registration is an offence, which distinguishes Ghana from jurisdictions where registration is risk-based. Consent is a principal basis, with exceptions for contract, legal obligation, vital interests and public functions. Sensitive personal data attracts stricter conditions. Section 18 restricts foreign transfers unless the recipient jurisdiction provides adequate protection. Enforcement powers include compliance notices and prosecution, though the Commission's practical capacity has been the subject of criticism, and there is no revenue-linked administrative fine of the GDPR type.

Digital Personal Data Protection Act 2023, phased into force

The DPDP Act replaces the earlier IT Rules framework with a consent-centred regime supervised by a Data Protection Board. Rules bringing provisions into force are being notified in stages.

Because commencement is phased, the operative question for any given obligation is whether its rule has actually been notified yet.

APPI with EU adequacy in both directions

The Act on the Protection of Personal Information is enforced by the Personal Information Protection Commission. Japan and the EU recognise each other as adequate, easing transfers.

The PPC prefers guidance and corrective orders over fines, but the 2022 amendments materially raised corporate exposure.

No general data protection statute; constitutional privacy and sectoral rules only

Liberia has not enacted comprehensive data protection legislation and has no data protection authority. Privacy protection rests on article 16 of the Constitution, telecommunications regulation by the LTA, and confidentiality duties on financial institutions supervised by the Central Bank of Liberia.

The material fact recorded here is absence. There is no statute establishing processing principles, lawful bases, data subject rights, breach notification or transfer restrictions, and no supervisory authority. Article 16 of the 1986 Constitution protects the privacy of communications and the home, enforceable in the courts. The Telecommunications Act 2007 gives the Liberia Telecommunications Authority regulatory powers over licensees including consumer protection and some subscriber information duties. The Financial Institutions Act and Central Bank regulations impose banking secrecy and know-your-customer obligations, which operate as data rules in the financial sector without generalising. Draft data protection and cybercrime bills have appeared in national ICT policy documents and been the subject of stakeholder consultation, but none is in force, so organisations processing Liberian personal data rely on contract, sectoral licence conditions and general tort principles.

GDPR through the EEA, supervised by a national Data Protection Authority

As an EEA member, Liechtenstein applies the GDPR, incorporated through the EEA Agreement and implemented by a national Data Protection Act. The Data Protection Authority (Datenschutzstelle) supervises compliance and cooperates within the European data-protection framework.

Because Liechtenstein has a large financial and trust sector, data-protection and confidentiality duties interact closely with financial-services regulation. EEA membership keeps the regime aligned with the EU.

GDPR supervised by the CNPD, the regulator of a major data-hosting hub

Data protection follows the GDPR, with a national implementing law of 1 August 2018. The National Commission for Data Protection (CNPD) supervises compliance and matters especially because Luxembourg hosts significant EU data-processing and financial infrastructure.

Because Luxembourg is a base for many EU financial and technology operations, the CNPD acts as lead supervisory authority in a number of cross-border cases. Public bodies are exempt from administrative fines under national law.

A national data-protection law overseen by the APDP

As a non-EU state, Monaco does not apply the GDPR directly but has its own data-protection law, modernised to align with European standards. The Personal Data Protection Authority (APDP) supervises processing by both public and private bodies.

Because Monaco is outside the EU, transfers to and from the Principality raise adequacy and safeguard questions that businesses must manage. Alignment with European standards is an ongoing policy goal.

GDPR applied through the UAVG and supervised by the Autoriteit Persoonsgegevens

Data protection is governed directly by the EU General Data Protection Regulation, with the Dutch GDPR Implementation Act (UAVG) filling in national choices. The Autoriteit Persoonsgegevens supervises, investigates and fines, and was an early and active enforcer among EU regulators.

The regulator publishes sector guidance and has fined both public bodies and large platforms. A Data Protection Officer is mandatory for public authorities and for controllers whose core activities involve large-scale monitoring.

The Nigeria Data Protection Act 2023 created a statutory commission and replaced the 2019 regulation

The NDPA 2023 is Nigeria's first primary data protection statute, superseding the NDPR 2019 issued by NITDA. It establishes the Nigeria Data Protection Commission, requires a lawful basis for processing, mandates data protection officers for higher-risk controllers, and provides for sanctions calculated on gross annual revenue.

Before 2023 Nigerian data protection rested on the Nigeria Data Protection Regulation 2019, a subsidiary instrument of NITDA whose legal foundation was contested. The Nigeria Data Protection Act 2023 puts the framework on a statutory footing and creates the Nigeria Data Protection Commission as an independent regulator with investigative and enforcement powers. It sets out lawful bases including consent, contract, legal obligation, vital interests and legitimate interests; requires that consent be freely given, specific and revocable; and grants data subject rights of access, rectification, erasure, restriction, objection and portability. Controllers of major importance must register with the Commission and appoint a data protection officer. Cross-border transfers require an adequate destination or an approved mechanism. Sanctions for data controllers of major importance can reach the greater of a fixed sum or 2% of gross annual revenue in the preceding year.

No comprehensive data protection statute; sectoral rules and a cybersecurity act apply

Sierra Leone has not enacted a general data protection law. Personal data is addressed indirectly through the Cybersecurity and Cybercrime Act 2021, the constitutional privacy guarantee, and sectoral banking and telecommunications rules, so there is no data protection authority or general lawful-basis requirement.

The atlas records the absence of a general regime as the material fact. The Cybersecurity and Cybercrime Act 2021 criminalises unauthorised access, interception and data interference and creates investigatory powers, but it is a criminal statute rather than a data protection framework: it does not establish processing principles, data subject rights or a supervisory authority. Section 22 of the Constitution protects the privacy of home and property and correspondence, enforceable under s.28. The Bank of Sierra Leone imposes customer confidentiality duties on financial institutions, and NATCOM regulates telecommunications operators including some subscriber data obligations. Drafting of a comprehensive data protection bill has been reported in successive digital strategy documents but no Act is in force, so cross-border transfer restrictions and breach notification duties of the GDPR type do not apply.

PDPA with mandatory breach notification

The Personal Data Protection Act governs private-sector data use and is enforced by the PDPC. Amendments in 2020 introduced mandatory breach notification and a higher financial cap.

The PDPC publishes detailed decisions, so its expectations on access controls and vendor management are unusually easy to research.

A revised FADP since 2023, aligned with the GDPR but enforced without regulator fines

The totally revised Federal Act on Data Protection entered into force on 1 September 2023, modernising Swiss law and bringing it closer to the GDPR. The Federal Data Protection and Information Commissioner (FDPIC) supervises and can issue binding orders, but it cannot itself impose fines: penalties are criminal and pursued by the cantons against responsible individuals.

The Swiss model differs sharply from the GDPR in that the regulator cannot fine companies directly; liability targets individuals through the criminal route, which changes how compliance risk is assessed. An EU adequacy decision covers transfers to Switzerland.

UK GDPR plus the Data Protection Act 2018

The UK retained the GDPR framework after leaving the EU. The ICO supervises compliance and the regime remains recognised as adequate by the European Commission.

The ICO publishes enforcement outcomes and tends to escalate through warnings and reprimands before fining, which makes documented remediation genuinely valuable.

Sectoral federal rules plus comprehensive state statutes

There is no general federal privacy statute. Health data (HIPAA), financial data (GLBA) and children's data (COPPA) are regulated separately, while comprehensive obligations come from state law led by California.

Compliance is usually built to the strictest applicable state standard and then applied nationally, because maintaining fifty separate data flows is more expensive than levelling up.