Abu Dhabi Global MarketAE-ADGM
- ADGM DPR 2021
The laws Privatrol checks against
Each place data is found is checked against the law data for every jurisdiction the organisation operates in. Every law entry cites its primary sources and states a confidence.
91jurisdictions
119laws
19with a localisation rule
Checked periodically, not legal advice
The law data is checked against its sources from time to time, and each jurisdiction shows the date its facts were last checked (the newest is 2026-11-03). Laws change. This list explains what Privatrol checks; it is not legal advice, and a finding is a question to put to someone who can advise.
What a localisation rule is
Most privacy laws allow data to leave the country if safeguards are in place. A localisation rule goes further: it requires the data, or a copy of it, to stay in-country. A breach of one is among the most serious things Privatrol reports. Some apply only to a sector such as health or government work; those are marked.
Each law entry also records the law's transfer rules, its penalties and any adequacy list. Laws that say nothing about where data is kept are not judged by the residency check.
Coverage
Every jurisdiction, with its laws
Countries, provinces and states are listed separately where they have their own laws, as is the European Union and European Economic Area.
AlabamaUS-AL
- APDPA
AlbertaCA-AB
- Alberta PIPA
- Alberta HIA
ArgentinaAR
- Argentina Law 25,326
AustraliaAU
- Privacy Act APP 8
- My Health Records Act s77
BahrainBH
- Bahrain PDPL
BangladeshBD
- Bangladesh PDP law
BrazilBR
- LGPD
British ColumbiaCA-BC
- BC FIPPA (public bodies)
CaliforniaUS-CA
- CCPA/CPRA
CanadaCA
- PIPEDA
- Government of Canada data residency
ChileCL
- Chile Law 21,719
China (mainland)CN
- PIPL cross-border
- CSL/DSL localisation (CIIO, important data)
ColombiaCO
- Colombia Law 1581
ColoradoUS-CO
- CPA
ConnecticutUS-CT
- CTDPA
DelawareUS-DE
- DPDPA
Dubai International Financial CentreAE-DIFC
- DIFC DP Law
EgyptEG
- Egypt PDPL
EthiopiaET
- Ethiopia PDP Proclamation
European Union / European Economic AreaEU
- GDPR
- EU Data Act
Faroe IslandsFO
- Faroese Data Protection Act
FloridaUS-FL
- FDBR
FranceFR
- France HDS
- France SREN Art. 31 (state cloud)
GermanyDE
- Germany § 393 SGB V
- Germany tax records location
GhanaGH
- Ghana DPA
Hong KongHK
- PDPO
IcelandIS
- Iceland Data Protection Act
IndiaIN
- DPDP Act s16
- SPDI Rules
- RBI payment data localisation
- IRDAI insurance records in India
- SEBI cloud data localisation
IndianaUS-IN
- ICDPA
IndonesiaID
- PDP Law
- GR 71/2019 public-scope localisation
- POJK 11/2022 bank data centres
IowaUS-IA
- ICDPA
IsraelIL
- Israel Privacy Protection Law
JapanJP
- APPI Art. 28
KazakhstanKZ
- Kazakhstan Personal Data Law
KentuckyUS-KY
- KCDPA
KenyaKE
- Kenya DPA
KuwaitKW
- Kuwait CITRA DPPR
LiechtensteinLI
- Liechtenstein DSG
LouisianaUS-LA
- LDPA
MacauMO
- Macau PDPA
MalaysiaMY
- PDPA s129
MarylandUS-MD
- MODPA
MauritiusMU
- Mauritius DPA
MexicoMX
- Mexico LFPDPPP 2025
MinnesotaUS-MN
- MCDPA
MontanaUS-MT
- MCDPA
MoroccoMA
- Law 09-08
NebraskaUS-NE
- NDPA
New BrunswickCA-NB
- New Brunswick PHIPAA
New HampshireUS-NH
- NH RSA 507-H
New JerseyUS-NJ
- NJDPA
New ZealandNZ
- Privacy Act 2020 IPP 12
Newfoundland and LabradorCA-NL
- NL PHIA
NigeriaNG
- NDPA / GAID
NorwayNO
- Norway Personal Data Act
- Norway public archives export ban
- Norway accounting records storage
Nova ScotiaCA-NS
- Nova Scotia PIIDPA
OklahomaUS-OK
- OCDPA
OmanOM
- Oman PDPL
OntarioCA-ON
- Ontario PHIPA
OregonUS-OR
- OCPA
PeruPE
- Peru Law 29733
PhilippinesPH
- Data Privacy Act
QatarQA
- Qatar PDPPL
QuebecCA-QC
- Quebec Law 25 (private sector)
- Quebec Access Act (public bodies)
Rhode IslandUS-RI
- RIDTPPA
RussiaRU
- 152-FZ / 242-FZ
RwandaRW
- Rwanda Law 058/2021
Saudi ArabiaSA
- Saudi PDPL
- KSA government data localisation
SerbiaRS
- Serbia ZZPL
SingaporeSG
- PDPA s26
South AfricaZA
- POPIA s72
South KoreaKR
- PIPA Art. 28-8
Sri LankaLK
- Sri Lanka PDPA
SwitzerlandCH
- revFADP
TaiwanTW
- Taiwan PDPA
- NCC order: no subscriber data to mainland China
TanzaniaTZ
- Tanzania PDPA
TennesseeUS-TN
- TIPA
TexasUS-TX
- TDPSA
ThailandTH
- Thai PDPA s28-29
Turkey (Türkiye)TR
- KVKK
- Turkey bank systems localisation
UgandaUG
- Uganda DPPA
UkraineUA
- Ukraine PDP Law
United Arab Emirates (federal)AE
- UAE PDPL
- UAE Health Data Law
United KingdomGB
- UK GDPR
United StatesUS
- DOJ bulk data rule
- PADFA
- IRS Pub 1075 (FTI)
- CJIS Security Policy
- ITAR
- EAR
- DFARS cloud clause
- HIPAA
UruguayUY
- Uruguay Law 18,331
UtahUS-UT
- UCPA
VermontUS-VT
- VDPOSA
VietnamVN
- PDP Law 2025
- Cybersecurity data localisation
VirginiaUS-VA
- VCDPA