Data protection
Data protection
Choose your country to see the law we align with, your rights and your consent wording. Draft for lawyer review.
Data protection
Draft for lawyer review. We say aligned with, never certified or compliant, until a lawyer has confirmed each part.
Different countries protect personal data in different ways. Choose your country with the Data law box next to the Language button, or below. The page then shows the law we align with for you, the rights you have and the consent wording you will see.
No country chosen yet. Choose one in the list below.
Your rights
- Choose a country to see your rights. Everyone can always ask to see, correct or delete their data and withdraw consent.
Consent wording for you
We keep a record of each consent: when it was given, the wording version, the law chosen and the choice made. You can ask for a copy of your record below. Not connected The record store is built, not yet switched on.
Ask for your data: access, correction or erasure
Contact for data requests: engage@avyramicrosystems.com Dedicated alias to be confirmed
How long we keep data
| Kind of data | Retention |
|---|---|
| Enquiries and messages | While we answer and for the business that follows, then up to 24 months, then deleted. |
| Consent records | For as long as the consent is relied on, plus the period the law requires to show it. |
| Data-rights requests and our replies | Up to 3 years, to show we answered. |
| Accounts and learning records | While the account is open, then up to 24 months unless the law needs longer. |
| Job applications | Up to 12 months, or longer only with your agreement. |
| Cookie choices | Up to 12 months, then we ask again. |
Cookies and consent record
Cookies other than the ones needed to run the site are used only if you agree. Saying no is as easy as saying yes. Your choice is recorded with its date and the wording shown.
Laws by country
| Country | Law | Status | Choose |
|---|---|---|---|
| Afghanistan | No single comprehensive law found | No single comprehensive law found | |
| Albania | Law 9887/2008 on Protection of Personal Data (as amended) | Law in force | |
| Algeria | Law 18-07 on Protection of Natural Persons in Personal Data Processing | Law in force | |
| Andorra | Qualified Law 29/2021 on Personal Data Protection | Law in force | |
| Angola | Law 22/11 on Personal Data Protection | Law in force | |
| Antigua and Barbuda | Data Protection Act 2013 | Law in force | |
| Argentina | Personal Data Protection Law 25.326 | Law in force | |
| Armenia | Law on Protection of Personal Data (2015) | Law in force | |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | Law in force | |
| Austria | GDPR (EU 2016/679) with the Austrian Data Protection Act | Law in force | |
| Azerbaijan | Law on Personal Data (2010) | Law in force | |
| Bahamas | Data Protection (Privacy of Personal Information) Act 2003 | Law in force | |
| Bahrain | Law 30/2018 on Personal Data Protection | Law in force | |
| Bangladesh | No single comprehensive law in force (ordinance or bill; lawyer to confirm) | No single comprehensive law found | |
| Barbados | Data Protection Act 2019 | Law in force | |
| Belarus | Law on Personal Data Protection (2021) | Law in force | |
| Belgium | GDPR (EU 2016/679) with the Belgian Data Protection Act 2018 | Law in force | |
| Belize | Data Protection Act 2021 | Law in force | |
| Benin | Digital Code (2017) | Law in force | |
| Bhutan | No single comprehensive law found | No single comprehensive law found | |
| Bolivia | No single comprehensive law found | No single comprehensive law found | |
| Bosnia and Herzegovina | Law on Protection of Personal Data | Law in force | |
| Botswana | Data Protection Act 2024 | Law passed, being phased in | |
| Brazil | LGPD, Law 13.709/2018 | Law in force | |
| Brunei | No single comprehensive law found | No single comprehensive law found | |
| Bulgaria | GDPR (EU 2016/679) with the Bulgarian Personal Data Protection Act | Law in force | |
| Burkina Faso | Law 001-2021 on Protection of Personal Data | Law in force | |
| Burundi | No single comprehensive law found | No single comprehensive law found | |
| Cabo Verde | Law 133/V/2001 on Personal Data Protection | Law in force | |
| Cambodia | No single comprehensive law found (draft) | No single comprehensive law found | |
| Cameroon | Law 2024/017 on Personal Data Protection | Law in force | |
| Canada | PIPEDA, provincial laws (including Quebec Law 25) and CASL for electronic messages | Law in force | |
| Central African Republic | No single comprehensive law found | No single comprehensive law found | |
| Chad | Law 007/PR/2015 on Personal Data Protection | Law in force | |
| Chile | Law 19.628, with reform Law 21.719 (2024) being phased in | Law passed, being phased in | |
| China | Personal Information Protection Law (PIPL) 2021 | Law in force | |
| Colombia | Statutory Law 1581 of 2012 | Law in force | |
| Comoros | No single comprehensive law found | No single comprehensive law found | |
| Congo (Democratic Republic) | Digital Code (2023); lawyer to confirm | No single comprehensive law found | |
| Congo (Republic) | Law 29-2019 on Personal Data Protection | Law in force | |
| Costa Rica | Law 8968 on Protection of the Person against Processing of Personal Data | Law in force | |
| Cote d'Ivoire | Law 2013-450 on Personal Data Protection | Law in force | |
| Croatia | GDPR (EU 2016/679) with the Croatian implementing Act (2018) | Law in force | |
| Cuba | No single comprehensive law found | No single comprehensive law found | |
| Cyprus | GDPR (EU 2016/679) with Law 125(I)/2018 | Law in force | |
| Czechia | GDPR (EU 2016/679) with Act 110/2019 | Law in force | |
| Denmark | GDPR (EU 2016/679) with the Danish Data Protection Act | Law in force | |
| Djibouti | No single comprehensive law found | No single comprehensive law found | |
| Dominica | No single comprehensive law found | No single comprehensive law found | |
| Dominican Republic | Law 172-13 on Personal Data Protection | Law in force | |
| Ecuador | Organic Law on Personal Data Protection (2021) | Law in force | |
| Egypt | Personal Data Protection Law 151/2020 | Law in force | |
| El Salvador | No single comprehensive law found | No single comprehensive law found | |
| Equatorial Guinea | No single comprehensive law found | No single comprehensive law found | |
| Eritrea | No single comprehensive law found | No single comprehensive law found | |
| Estonia | GDPR (EU 2016/679) with the Personal Data Protection Act 2018 | Law in force | |
| Eswatini | Data Protection Act 2022 | Law passed, being phased in | |
| Ethiopia | Personal Data Protection Proclamation 1321/2024 | Law passed, being phased in | |
| Fiji | No single comprehensive law found | No single comprehensive law found | |
| Finland | GDPR (EU 2016/679) with the Data Protection Act 1050/2018 | Law in force | |
| France | GDPR (EU 2016/679) with the Loi Informatique et Libertés | Law in force | |
| Gabon | Law 001/2011 on Personal Data Protection | Law in force | |
| Gambia | No single comprehensive law in force (bill; lawyer to confirm) | No single comprehensive law found | |
| Georgia | Law on Personal Data Protection (2023) | Law in force | |
| Germany | GDPR (EU 2016/679) with the Federal Data Protection Act (BDSG) | Law in force | |
| Ghana | Data Protection Act 2012 | Law in force | |
| Greece | GDPR (EU 2016/679) with Law 4624/2019 | Law in force | |
| Grenada | Data Protection Act 2023 | Law passed, being phased in | |
| Guatemala | No single comprehensive law found | No single comprehensive law found | |
| Guinea | Law on personal data (lawyer to confirm) | No single comprehensive law found | |
| Guinea-Bissau | No single comprehensive law found | No single comprehensive law found | |
| Guyana | No single comprehensive law found | No single comprehensive law found | |
| Haiti | No single comprehensive law found | No single comprehensive law found | |
| Honduras | No single comprehensive law found | No single comprehensive law found | |
| Hong Kong | Personal Data (Privacy) Ordinance | Law in force | |
| Hungary | GDPR (EU 2016/679) with Act CXII of 2011 | Law in force | |
| Iceland | GDPR through the EEA Agreement, with Act 90/2018 | Law in force | |
| India | Digital Personal Data Protection Act 2023 (Rules being phased in) | Law passed, being phased in | |
| Indonesia | Personal Data Protection Law 27/2022 | Law in force | |
| Iran | No single comprehensive law found | No single comprehensive law found | |
| Iraq | No single comprehensive law found | No single comprehensive law found | |
| Ireland | GDPR (EU 2016/679) with the Data Protection Act 2018 | Law in force | |
| Israel | Privacy Protection Law 1981 (Amendment 13, 2024) | Law in force | |
| Italy | GDPR (EU 2016/679) with the Personal Data Protection Code | Law in force | |
| Jamaica | Data Protection Act 2020 | Law passed, being phased in | |
| Japan | Act on the Protection of Personal Information (APPI) | Law in force | |
| Jordan | Personal Data Protection Law No. 24 of 2023 | Law in force | |
| Kazakhstan | Law on Personal Data and Their Protection (2013) | Law in force | |
| Kenya | Data Protection Act 2019 | Law in force | |
| Kiribati | No single comprehensive law found | No single comprehensive law found | |
| Kosovo | Law 06/L-082 on Protection of Personal Data | Law in force | |
| Kuwait | Data privacy rules of the communications regulator (2021); no single statute | No single comprehensive law found | |
| Kyrgyzstan | Law on Personal Information (2008) | Law in force | |
| Laos | Law on Electronic Data Protection (2017) | Law in force | |
| Latvia | GDPR (EU 2016/679) with the Personal Data Processing Law | Law in force | |
| Lebanon | Law 81/2018 on Electronic Transactions and Personal Data | Law in force | |
| Lesotho | Data Protection Act 2011 | Law in force | |
| Liberia | No single comprehensive law found | No single comprehensive law found | |
| Libya | No single comprehensive law found | No single comprehensive law found | |
| Liechtenstein | GDPR through the EEA Agreement, with the Data Protection Act | Law in force | |
| Lithuania | GDPR (EU 2016/679) with the Law on Legal Protection of Personal Data | Law in force | |
| Luxembourg | GDPR (EU 2016/679) with the Law of 1 August 2018 | Law in force | |
| Macao | Personal Data Protection Act 8/2005 | Law in force | |
| Madagascar | Law 2014-038 on Protection of Personal Data | Law in force | |
| Malawi | Data Protection Act 2024 | Law passed, being phased in | |
| Malaysia | Personal Data Protection Act 2010 (amended 2024) | Law in force | |
| Maldives | No single comprehensive law found (lawyer to confirm) | No single comprehensive law found | |
| Mali | Law 2013-015 on Personal Data Protection | Law in force | |
| Malta | GDPR (EU 2016/679) with the Data Protection Act (Chapter 586) | Law in force | |
| Marshall Islands | No single comprehensive law found | No single comprehensive law found | |
| Mauritania | Law 2017-020 on Personal Data Protection | Law in force | |
| Mauritius | Data Protection Act 2017 | Law in force | |
| Mexico | Federal Law on Protection of Personal Data Held by Private Parties (law renewed 2025; lawyer to confirm) | Law in force | |
| Micronesia | No single comprehensive law found | No single comprehensive law found | |
| Moldova | Law 133/2011 on Personal Data Protection | Law in force | |
| Monaco | Law 1.165 on Protection of Personal Information | Law in force | |
| Mongolia | Law on Personal Secrets and Law on Protection of Personal Information (2021) | Law in force | |
| Montenegro | Law on Personal Data Protection | Law in force | |
| Morocco | Law 09-08 on Protection of Personal Data | Law in force | |
| Mozambique | No single comprehensive law found | No single comprehensive law found | |
| Myanmar | No single comprehensive law found | No single comprehensive law found | |
| Namibia | No single comprehensive law in force (bill; lawyer to confirm) | No single comprehensive law found | |
| Nauru | No single comprehensive law found | No single comprehensive law found | |
| Nepal | Privacy Act 2018 | Law in force | |
| Netherlands | GDPR (EU 2016/679) with the UAVG implementing Act | Law in force | |
| New Zealand | Privacy Act 2020 | Law in force | |
| Nicaragua | Law 787 on Protection of Personal Data | Law in force | |
| Niger | Law 2017-28 on Protection of Personal Data | Law in force | |
| Nigeria | Nigeria Data Protection Act 2023 | Law in force | |
| North Korea | No single comprehensive law found | No single comprehensive law found | |
| North Macedonia | Law on Personal Data Protection (2020) | Law in force | |
| Norway | GDPR through the EEA Agreement, with the Personal Data Act 2018 | Law in force | |
| Oman | Royal Decree 6/2022 on Personal Data Protection | Law in force | |
| Pakistan | No single comprehensive law in force (bill; lawyer to confirm) | No single comprehensive law found | |
| Palau | No single comprehensive law found | No single comprehensive law found | |
| Palestine | No single comprehensive law found | No single comprehensive law found | |
| Panama | Law 81 of 2019 on Personal Data Protection | Law in force | |
| Papua New Guinea | No single comprehensive law found | No single comprehensive law found | |
| Paraguay | Law 6534/2020 on Personal Data Protection | Law in force | |
| Peru | Personal Data Protection Law 29733 | Law in force | |
| Philippines | Data Privacy Act 2012 | Law in force | |
| Poland | GDPR (EU 2016/679) with the Personal Data Protection Act 2018 | Law in force | |
| Portugal | GDPR (EU 2016/679) with Law 58/2019 | Law in force | |
| Qatar | Law 13/2016 on Personal Data Privacy Protection | Law in force | |
| Romania | GDPR (EU 2016/679) with Law 190/2018 | Law in force | |
| Russia | Federal Law 152-FZ on Personal Data | Law in force | |
| Rwanda | Law 058/2021 on Personal Data and Privacy | Law in force | |
| Saint Kitts and Nevis | No single comprehensive law found | No single comprehensive law found | |
| Saint Lucia | Data Protection Act 2011 | Law in force | |
| Saint Vincent and the Grenadines | Privacy Act 2003 | Law in force | |
| Samoa | No single comprehensive law found | No single comprehensive law found | |
| San Marino | Law 171/2018 on Personal Data Protection | Law in force | |
| Sao Tome and Principe | Law 03/2016 on Personal Data Protection | Law in force | |
| Saudi Arabia | Personal Data Protection Law (Royal Decree M/19, 2021) | Law in force | |
| Senegal | Law 2008-12 on Personal Data Protection | Law in force | |
| Serbia | Law on Personal Data Protection (2018) | Law in force | |
| Seychelles | Data Protection Act 2023 | Law passed, being phased in | |
| Sierra Leone | No single comprehensive law found | No single comprehensive law found | |
| Singapore | Personal Data Protection Act 2012 | Law in force | |
| Slovakia | GDPR (EU 2016/679) with Act 18/2018 | Law in force | |
| Slovenia | GDPR (EU 2016/679) with the Personal Data Protection Act (ZVOP-2) | Law in force | |
| Solomon Islands | No single comprehensive law found | No single comprehensive law found | |
| Somalia | No single comprehensive law found | No single comprehensive law found | |
| South Africa | Protection of Personal Information Act (POPIA) 2013 | Law in force | |
| South Korea | Personal Information Protection Act (PIPA) | Law in force | |
| South Sudan | No single comprehensive law found | No single comprehensive law found | |
| Spain | GDPR (EU 2016/679) with Organic Law 3/2018 | Law in force | |
| Sri Lanka | Personal Data Protection Act No. 9 of 2022 | Law passed, being phased in | |
| Sudan | No single comprehensive law found | No single comprehensive law found | |
| Suriname | No single comprehensive law found | No single comprehensive law found | |
| Sweden | GDPR (EU 2016/679) with the Data Protection Act 2018:218 | Law in force | |
| Switzerland | Federal Act on Data Protection (revised, in force 2023) | Law in force | |
| Syria | No single comprehensive law found | No single comprehensive law found | |
| Taiwan | Personal Data Protection Act | Law in force | |
| Tajikistan | Law on Personal Data Protection (2018) | Law in force | |
| Tanzania | Personal Data Protection Act 2022 | Law in force | |
| Thailand | Personal Data Protection Act 2019 | Law in force | |
| Timor-Leste | No single comprehensive law found | No single comprehensive law found | |
| Togo | Law 2019-014 on Personal Data Protection | Law in force | |
| Tonga | No single comprehensive law found | No single comprehensive law found | |
| Trinidad and Tobago | Data Protection Act 2011 (partly in force) | Law passed, being phased in | |
| Tunisia | Organic Law 2004-63 on Personal Data Protection | Law in force | |
| Turkey | Law 6698 on Personal Data Protection (KVKK) | Law in force | |
| Turkmenistan | Law on Information about Private Life and its Protection (2017) | Law in force | |
| Tuvalu | No single comprehensive law found | No single comprehensive law found | |
| Uganda | Data Protection and Privacy Act 2019 | Law in force | |
| Ukraine | Law on Personal Data Protection (2010) | Law in force | |
| United Arab Emirates | Federal Decree-Law 45/2021 on Personal Data Protection (PDPL); free-zone rules may also apply | Law in force | |
| United Kingdom | UK GDPR and the Data Protection Act 2018 | Law in force | |
| United States | No federal general law. State privacy laws, for example California CCPA/CPRA | Law in force | |
| Uruguay | Law 18.331 on Personal Data Protection | Law in force | |
| Uzbekistan | Law on Personal Data (2019) | Law in force | |
| Vanuatu | No single comprehensive law found | No single comprehensive law found | |
| Vatican City | General Decree on personal data protection | No single comprehensive law found | |
| Venezuela | No single comprehensive law found | No single comprehensive law found | |
| Vietnam | Personal Data Protection Law (2025) and Decree 13/2023 | Law passed, being phased in | |
| Yemen | No single comprehensive law found | No single comprehensive law found | |
| Zambia | Data Protection Act 2021 | Law in force | |
| Zimbabwe | Cyber and Data Protection Act 2021 | Law in force |
Countries and territories are listed alphabetically. Where no single comprehensive law was found, our standard commitment applies. Rules for sectors such as health, finance and children can add to these.
Open items for the owner and the lawyer
- Lawyer to confirm every row of the country list (law name, whether in force, free-zone and provincial rules).
- Owner to confirm the dedicated data-requests email alias; until then the site contact alias is used.
- Lawyer to set final retention periods, the legal basis for each use and the consent wording for each family.
- Consent record store and request queue are not connected yet (marked Not connected).