SECTORAL REGULATION OF PII:
Countries with solely sectoral approaches: (1) US, (2) China, (3) Cuba, (5) Thailand – although they are
finalizing their omnibus legislation, (6) Venezuela, (7) Guatemala – very limited regulation – closer to no
regulation but restrictions are imposed on sharing private information, (8) Brunei – although legislation is
expected to pass soon, (9) Burundi, (10) Cambodia – limited under general constitutional right to privacy and
E-Commerce/ virtual or digital data, (11) Costa Rica – although omnibus legislation coming, (12) El Salvador
– limited sectoral, 13 Fiji, 14 Iran, 15 Jordan (note – no regime but GDPR type in the works), 16 Kuwait, 17
Liberia, 18 Libya (limited general right under constitution), 19 MOZAMBIQUE, 20 MYANMAR, 21 Nambia,
22 Pakistan (limited sectoral but omnibus legislation in the works, 23 Sri Lanka, 24 Vietnam
OMNIBUS PRIVACY CONFERRED EXPLICITLY EITHER UNDER CONSTITUTION –
INDIVIDUAL RIGHT TO PRIVACY OR OMNIBUS PRIVACY LEGISLATION ENACTED:
Most other countries have a minimum threshold set under their data privacy law and additional sectoral
regulations enacted, but have at the minimum a universal standard: (1) EU member states, (2) Canada, (3)
Mexico, (4) Panama, (5) Brazil, (6) Japan, (7) South Korea, (8) Russia, (9) Malaysia, (10) New Zealand, (11)
Phillipines, (12) South Africa, (13) Switzerland, (14) Uraguay, (15) Algeria, (16) Angola, (17) Argentina, (18)
Armenia, (19) AZERBAIJAN, 20 Bahamas, 21 Bahrain, 22 Bangledesh, 23 Barbados, 24 Belarus, 25 Benin,
26 Bermuda, 27 Bolivia, 28 Botswana, 29 British virgin islands, 30 Burkina Faso, 31 Cape Verde, 32 Cayman
Islands, 33 Chad, 34 Chile, 35 Democratic Republic of Congo – all digital data, 36 Dominican Republic, 37
Ecuador, 38 Egypt, 39 Equitorial Guinea, 40 Ethiopia – general right under constitution, and specific rights
allocated for certain types of info/ compliance requirements, 41 Gabon, 42 Georgia, 43 Ghana, 44 Republic of
Guinea, 45 Haiti, 46 Honduras (asterisk – constitutional right and GDPR type legislation coming), 47 Hong
Kong, 48 India – constitutional right and gdpr type legislation pending, 49 Israel, 50 Jersey, 51 Kazakhstan, 52
Kenya, 53 KYRGYZSTAN, 54 Laos – general application only to digital, 55 Lebanon, 56 Lesotho, 57 Macau,
58 Madagascar, 59 Monaco (did not adopt GDPR – has own privacy legislation), 60 Montenegro (has own
statute but will adopt GDPR), 61 Morocco, 62 Nepal, 63 New Zealand (repeat), 64 Nicaragua, 65 Niger, 66
Nigeria, 67 North Macedonia, 68 Paraguay, 69 Peru, 70A QATAR - FINANCIAL CENTRE, 70B Qatar, 71
Republic of Congo, 72 Rwanda, 73 Saudi arabia, 74 Senegal, 75 Seychilles, 76 Singapore, 77 Taiwan, 78
TAJIKISTAN, 79 TANZANIA – constitutional right, general right under legislation and additional
sectoral regs, 80 Thailand, 81 Trinidad and Tobago, 82 Tunisia, 83 Turkey, 84
TURKMENISTAN, 85 UAE, 86 Uganda 87 Ukraine, 88 Zambia, 89 Zimbabwe
Countries with nothing – 1 Tonga (all common law)