North America:
Bahamas
Privacy Legislation:
Authority:
Last Updated: December 2021
Barbados
Privacy Legislation:
Authority:
Barbados appointed its first Data Protection Commissioner in 2021. IAPP is unaware of an established data protection office.
Last Updated: December 2021
Belize
Privacy Legislation/Authority:
The IAPP is unaware of a data protection authority or data protection legislation for Belize.
Last Updated: December 2021
Canada
Privacy Legislation:
Authority:
Additional Resources:
The IAPP Resource Center hosts a "Canada" topic page.
Canada is included in the IAPP's "Global Comprehensive Privacy Law Mapping Chart."
Last Updated: December 2021
Costa Rica
Privacy Legislation:
Authority:
Last Updated: December 2021
Cuba
Privacy Legislation:
The IAPP is unaware of data protection legislation in Cuba.
Last Updated: December 2021
Dominica
Privacy Legislation:
The IAPP is unaware of data protection legislation in Dominica.
Last Updated: December 2021
Dominican Republic
Privacy Legislation:
Authority:
The IAPP is unaware of a data protection authority for the Dominican Republic.
Last Updated: December 2021
El Salvador
Privacy Legislation:
Grenada
Guatemala
Privacy Legislation:
The IAPP is unaware of data protection legislation in Guatemala.
Last Updated: December 2021
Haiti
Privacy Legislation:
The IAPP is unaware of data protection legislation in Haiti.
Last Updated: December 2021
Honduras
Privacy Legislation:
The IAPP is unaware of data protection legislation for Honduras.
Authority:
Last Updated: December 2021
Jamaica
Privacy Legislation:
Authority:
The Information Commissioner, Celia Barclay, assumed her role on December 1, 2021. The Office of the Information Commissioner is in the process of being staffed.
Last Updated: December 2021
Mexico
Privacy Legislation:
Authority:
Last Updated: December 2021
Nicaragua
Privacy Legislation:
Authority:
The IAPP is unaware of an established data protection agency.
Last Updated: December 2021
Panama
Privacy Legislation:
Authority:
Last Updated: December 2021
Saint Kitts and Nevis
Privacy Legislation:
Data Protection Act, 2018 (does not appear to be in force)
Authority:
The IAPP is unaware of an established data protection authority for Saint Kitts and Nevis.
Last Updated: December 2021
Saint Lucia
Privacy Legislation:
Authority:
The IAPP is unaware of an established data protection authority for Saint Lucia.
Last Updated: December 2021
Saint Vincent and the Grenadines
Privacy Legislation:
Authority:
The IAPP is unaware of an established data protection authority for Saint Vincent and the Grenadines.
Last Updated: December 2021
Trinidad and Tobago
Privacy Legislation:
Data Protection Act, 2011 (partially in force)
Authority:
It does not appear the Office of the Information Commissioner is established.
Last Updated: December 2021
United States of America
Federal Privacy Legislation:
The U.S. does not have a comprehensive federal data protection law. It takes a sectoral approach, with national laws and regulations addressing privacy in several areas, including personal health information, financial institutions, credit report information, and children’s information. The Federal Trade Commission is the most prominent enforcement body, but there are sector-specific enforcement bodies too.
The IAPP Resource Center hosts a US Federal Privacy Legislation tracker.
State Privacy Legislation:
Each state also may have its own sectoral privacy laws and regulations. California, Virginia and Colorado have adopted comprehensive data protection laws. State attorney generals typically are the primary enforcement authorities for state privacy laws. California has established the California Privacy Protection Agency. The CPPA and the California attorney general will share enforcement authority.
The IAPP Resource Center hosts a US State Privacy Legislation tracker.
Additional Resources:
The IAPP Resource Center hosts United States, US Federal Privacy and US State Privacy topic pages.
Last Updated: December 2021
Please note that the territories are also included in the list based on the information provided. Some territories may have unique statuses or affiliations that aren't fully represented here.