Start here: three questions
Privacy law is easier once you know what you hold, why, and who could be hurt if it leaked.
- Which law applies? Usually the law of the country where you are based, and sometimes the law where the people you serve live. Public bodies, health providers and charities are often covered by different rules from businesses.
- What do you hold that is sensitive? Most laws give extra protection to health, ethnicity, religion, sexual life and similar categories, and many treat identity numbers and financial details as high-risk in a breach.
- What would you do on the day of a breach? Several countries below set short deadlines. Decide now who assesses a breach, who decides whether to report it, and where the regulator’s reporting form is.
United States
- Main law
- No single general federal privacy law. Sector laws apply instead, including HIPAA for health plans, health care clearinghouses and many health care providers, and their business associates, and the FTC’s Health Breach Notification Rule for personal health record apps outside HIPAA. State laws also apply, including breach-notification laws.
- Regulator
- HHS Office for Civil Rights (HIPAA); Federal Trade Commission; state attorneys general.
- Sensitive data
- There is no single federal list. HIPAA protects health information held by the organizations it covers; state laws set their own categories.
- If there is a breach
- Under HIPAA, notify affected people without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured health information. For 500 or more people, notify HHS at the same time; for fewer than 500, log it and report to HHS within 60 days of the end of the calendar year. State breach laws add their own duties, depending on where the affected people live.
Canada
- Main law
- PIPEDA for private-sector organizations in commercial activity. It generally does not apply to the non-commercial work of nonprofits and charities. Alberta, British Columbia and Québec have their own private-sector laws, several provinces have health privacy laws, and municipalities, hospitals, schools and universities are generally covered by provincial laws. Federal institutions are covered by the Privacy Act.
- Regulator
- Office of the Privacy Commissioner of Canada, plus a commissioner or ombudsman in each province and territory.
- Sensitive data
- Judged in context. When deciding whether a breach must be reported, the OPC asks you to weigh how sensitive the information is and how likely it is to be misused.
- If there is a breach
- Under PIPEDA, report to the OPC any breach of security safeguards that creates a real risk of significant harm, notify the affected people as soon as feasible, and keep a record of every breach, reportable or not. This applies to small organizations too. Provincial laws have their own rules.
Mexico
- Main law
- A new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (private sector) was published in the Diario Oficial on 20 March 2025, alongside a new general law for public bodies. The same reform abolished INAI, the former data protection and transparency institute.
- Regulator
- For the private sector, the Secretaría Anticorrupción y Buen Gobierno, which took over INAI’s functions.
- Sensitive data
- Datos personales sensibles: data touching the most intimate sphere of a person, or whose misuse could lead to discrimination or serious risk, including racial or ethnic origin, present or future health, genetic information, religious, philosophical and moral beliefs, political opinions and sexual preference.
- If there is a breach
- Security breaches that significantly affect people’s property or moral rights must be reported to those people immediately, so they can take steps to protect themselves (article 19).
NoteIn transition: the 2025 law replaced the 2010 law and moved oversight from INAI to a government ministry. Expect new regulations and guidance.
Argentina
- Main law
- Ley 25.326 de Protección de los Datos Personales. Public and private databases intended to provide reports must be registered with the national registry of personal databases.
- Regulator
- Agencia de Acceso a la Información Pública (AAIP).
- Sensitive data
- Datos sensibles: data revealing racial and ethnic origin, political opinions, religious, philosophical or moral convictions, trade union membership, and information about health or sex life.
- If there is a breach
- The law requires technical and organizational measures to keep personal data secure and confidential (article 9). We did not find a general deadline for notifying breaches in the law itself. Take advice if you have a breach.
NoteA reform of Ley 25.326 has been under public consultation by the AAIP.
United Kingdom
- Main law
- The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. The ICO says all its provisions affecting data protection law are now in force.
- Regulator
- Information Commissioner’s Office (ICO).
- Sensitive data
- Special category data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health, sex life and sexual orientation. Criminal offence data has its own rules.
- If there is a breach
- If a personal data breach is likely to put people’s rights and freedoms at risk, tell the ICO as soon as possible and, where feasible, within 72 hours. If the risk is high, tell the affected people too.
Armenia
- Main law
- The Law of the Republic of Armenia on Protection of Personal Data.
- Regulator
- The Personal Data Protection Agency of the Ministry of Justice.
NoteWe could not open the regulator’s pages or the consolidated text of the law when we last reviewed this guide, so we have not summarized the details. Read the current text on the official legal information system, ARLIS, and take local advice.
India
- Main law
- The Digital Personal Data Protection Act, 2023.
- Regulator
- The Data Protection Board of India, set up under the Act; the Ministry of Electronics and Information Technology (MeitY) makes the rules.
NoteIn transition. When the Act’s provisions take effect is set by government notification, and MeitY makes the rules under it. Official government sites did not respond to our checks when we last reviewed this guide, so we have not stated commencement dates or duties here. Check MeitY’s current notifications before relying on any summary, including this one.
Philippines
- Main law
- The Data Privacy Act of 2012 (Republic Act No. 10173), with rules and circulars issued by the National Privacy Commission.
- Regulator
- National Privacy Commission (NPC).
- Sensitive data
- Sensitive personal information includes race, ethnic origin, marital status, age, colour, religious, philosophical or political affiliations; health, education, genetic or sexual life; criminal proceedings; and government-issued identifiers such as social security numbers, health records, licences and tax returns.
- If there is a breach
- The Act requires you to notify the NPC and the affected people promptly when sensitive personal information, or information that could enable identity fraud, is reasonably believed to have been acquired by an unauthorized person. The NPC’s breach-management rules set out the details and timing; read them on the NPC site.
Australia
- Main law
- The Privacy Act 1988 and its Australian Privacy Principles. It covers Australian Government agencies and organizations with an annual turnover of more than $3 million. Some smaller organizations are covered regardless of turnover, including any health service provider. A small business or not-for-profit can also choose to opt in.
- Regulator
- Office of the Australian Information Commissioner (OAIC).
- Sensitive data
- Sensitive information: racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership or associations, sexual orientation or practices, criminal record, health or genetic information, and some aspects of biometric information.
- If there is a breach
- Under the Notifiable Data Breaches scheme, if a breach is likely to result in serious harm to someone, notify the affected people and the OAIC. If you suspect a breach, you must quickly assess whether it is likely to cause serious harm.
New Zealand
- Main law
- The Privacy Act 2020. The Privacy Amendment Act 2025 added a new principle, IPP 3A, from 1 May 2026: a duty to tell people when you collect their personal information from someone other than them.
- Regulator
- Office of the Privacy Commissioner.
- Sensitive data
- There is no separate list. The Privacy Commissioner notes that some kinds of information are inherently more sensitive and more likely to cause serious harm if a breach happens.
- If there is a breach
- If a privacy breach has caused, or is likely to cause, anyone serious harm, notify the Privacy Commissioner and the affected people as soon as you are practically able.
NoteRecently changed: IPP 3A has applied since 1 May 2026.
What to do everywhere
Whatever the country, the same habits keep you on the right side of the law and of the people you serve.
- Keep a simple record of what personal information you hold, where, why, and who can access it.
- Collect less. Information you never collected cannot leak.
- Tell people, in plain words, what you collect and why, and how to ask for their information.
- Write down who decides whether a breach must be reported, and keep the regulator’s reporting link in your incident plan. Our first-hour checklist is a good place for it.
- Ask every vendor how quickly they will tell you about a breach. See Before you sign.