Privacy laws control how organisations collect, use, store and share personal data — any information that can identify a person. They grant individuals rights (access, deletion, correction) and impose duties on companies (consent, security, breach notification), with fines for violations. The EU’s GDPR is the best-known example; most countries now have their own version.

The US has no single federal privacy law. Roughly 20 states have enacted comprehensive privacy statutes — led by California’s CCPA/CPRA — and the count keeps rising. Our state index tracks each one, alongside sector-specific federal laws (HIPAA, GLBA, COPPA) that apply nationwide.

Governance laws set rules for how organisations manage and account for data and records: retention requirements, audit and reporting duties, board accountability, and data-governance standards for public bodies. They overlap with privacy law but focus on institutional accountability rather than individual rights.

Usually yes, though many laws have thresholds. GDPR applies to any organisation handling EU residents’ data regardless of size; most US state laws only apply above revenue or data-volume thresholds. Each country and state guide lists exactly who the law applies to.

Every entry is compiled from the official legal text and regulator publications, cross-checked against established legal trackers, and stamped with a “last verified” date. Where the landscape moves fast — like the US state count — we link to live official sources.