What the law asks, by country.
22 jurisdictions: the AI law and how far it has come, data protection, where data must stay, and the channels customers use. Read on 2026-10-22. A map for orientation, not legal advice.
Where each AI law stands
Pick up to three to compare them side by side.
In force 4
Partly in force 2
Guidance only 3
A bill 5
No AI law 8
Side by side
United States
Partly in force · North America
- AI law
- Status: partly in force (state level only). No comprehensive federal AI statute was found. Federal executive actions: EO 14365 (11 Dec 2025, strategy on preempting state AI laws; DOJ directed to challenge them) and EO 14409 (2 Jun 2026, AI innovation and security; page says it does not authorize mandatory licensing or pre-clearance); a March 2026 White House legislative framework is a nonbinding proposal. States: Texas TRAIGA (HB 149) signed 22 Jun 2025, effective 1 Jan 2026; Colorado SB 26-189 signed 14 May 2026 repeals and replaces SB 24-205, developer and deployer duties and AG rulemaking from 1 Jan 2027 (the earlier 30 Jun 2026 date is superseded; one law-firm blog reports an April 2026 enforcement stay in a xAI suit with DOJ intervention); California CCPA automated-decision-making regulations require compliance from 1 Jan 2027 for businesses using ADMT for significant decisions, and a California AI Transparency Act is reported operative 2 Aug 2026. New York RAISE Act and California SB 53 dates were not verified.
- What it asks of a company
- Texas: prohibited-use law enforced by the AG. Colorado (from 1 Jan 2027): notice when consumers interact with covered ADMT for consequential decisions (education, employment, housing, lending, insurance, health care), plain-language explanation within 30 days of an adverse decision, human review on request, developer-to-deployer documentation, records kept 3 years. California: ADMT rules for significant decisions from 1 Jan 2027. No federal registration or risk-class regime.
- Data protection
- No comprehensive federal privacy law (American Privacy Rights Act of 2024 introduced, not passed). Sector federal laws (GLBA, HIPAA, COPPA amended Jan 2025, FTC Act). State comprehensive laws in force include California CCPA (2018; updated regulations effective 1 Jan 2026), Colorado, Connecticut, Texas, Virginia and others; New York listed as pending.
- Where data must stay
- No general rule; generally no geographic localisation restrictions, except some government records and information. DOJ Data Security Program (28 CFR Part 202, effective 8 Apr 2025, further requirements 5 Oct 2025) restricts transactions giving countries of concern (China incl. Hong Kong and Macau, Cuba, Iran, North Korea, Russia, Venezuela) access to bulk sensitive personal data or US government-related data.
- Sending data abroad
- No general transfer ban. HIPAA requires safeguards before disclosing protected health information outside the US; EO 14117 / DOJ rule restricts bulk sensitive data to countries of concern; EU-US Data Privacy Framework adequacy exists for EU-to-US flows.
- Finance and health rules
- Finance: Gramm-Leach-Bliley Act safeguards including service-provider oversight; NYDFS cybersecurity rules for licensees. Health: HIPAA privacy and security rules for covered entities and business associates; Washington My Health My Data Act (2023), Nevada SB 370, Connecticut consumer health data amendments.
- How customers are reached
- No dominant OTT app. Infobip (data through Jan 2026, share of phone users reachable) reports RCS 80%, Instagram 55%, Apple Messages 50%, Messenger 45%, WhatsApp 30%; Infobip notes there is no dominant OTT messaging app in North America. Email and SMS remain the default business channels (not separately sourced).
source 1 · source 2 · source 3 · source 4 · source 5 · source 6 · source 7 · gov; law-firm tracker; vendor survey
read 2026-10-22. Official: Colorado legislature, Texas legislature, DOJ. EO numbers and dates, California AI Transparency Act and the xAI stay rest on the Vorp Labs and a law-firm blog (secondary). Not verified: New York RAISE Act, California SB 53 dates, whitehouse.gov EO texts, HHS pages (403). The 'email and SMS default' channel statement is not sourced.
European Union
In force · Europe
- AI law
- Status: in force, phased. Regulation (EU) 2024/1689 (AI Act) entered into force 1 Aug 2024; prohibitions and AI literacy from 2 Feb 2025; GPAI rules and governance from 2 Aug 2025; applicable in general from 2 Aug 2026 with transparency rules (chatbot disclosure, deepfake labelling) from Aug 2026. The AI Omnibus (proposed 19 Nov 2025, political agreement 7 May 2026, entered into force 27 Jul 2026) moved high-risk obligations to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I products) and adds a ninth prohibition from Dec 2026.
- What it asks of a company
- Four risk classes: unacceptable (banned, nine practices), high risk (risk management, data quality, logging, documentation, human oversight, robustness before market entry), transparency risk (tell people they interact with AI, label AI-generated content), minimal (no rules). Member states must set up at least one regulatory sandbox by 2 Aug 2026.
- Data protection
- GDPR, Regulation (EU) 2016/679, applicable since 25 May 2018; in force.
- Where data must stay
- No general rule found in sources opened; GDPR Chapter V (Articles 44-49) regulates transfers, not storage location. Member-state or sector localisation rules were not checked.
- Sending data abroad
- Adequacy decisions (Commission list includes Brazil, Canada commercial, Japan, Republic of Korea, UK, US under the Data Privacy Framework, Switzerland, New Zealand and others); otherwise safeguards under Chapter V. The adequacy page does not describe SCCs or BCRs.
- Finance and health rules
- Not verified in sources opened (DORA, EBA outsourcing guidelines, European Health Data Space were not read).
- How customers are reached
- Infobip (data through Jan 2026) gives no EU-wide figure; per country: Germany RCS 80%, WhatsApp 70%; France RCS 70%, Messenger 50%, WhatsApp 40%; Italy WhatsApp 75%; Spain WhatsApp 85%.
source 1 · source 2 · source 3 · source 4 · gov; vendor survey
read 2026-10-22. The EUR-Lex page returned almost no text (only application date 25 May 2018 and Chapter V heading). DLA Piper page for code EU returned Albania, so it was not used. Not verified: sector rules, localisation, SCC mechanics. AI Act dates come from the Commission page dated 19 Oct 2026.
United Kingdom
No AI law · Europe
- AI law
- Status: none (no dedicated AI law in force). Government keeps a non-statutory, principles-based approach (2023 AI White Paper: safety, transparency, fairness, accountability, redress) applied by sector regulators. King's Speech 2024 said it would legislate for the most powerful models but proposals were not published (CMS, updated 30 Apr 2026). Related: Data (Use and Access) Act 2025 data reforms took effect 5 Feb 2026; non-consensual intimate deepfake offences 6 Feb 2026; Crime and Policing Bill (AI child-abuse-image tools) awaiting Royal Assent at that date.
- What it asks of a company
- None specific. Existing law applies: UK GDPR Article 22 limits solely automated decisions with significant effects; Equality Act, Online Safety Act, consumer law. FCA says it does not plan extra AI regulation and relies on Consumer Duty and SM&CR.
- Data protection
- UK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025 (passed 19 Jun 2025, commenced in stages); PEC Regulations 2003 for marketing; in force.
- Where data must stay
- no general rule
- Sending data abroad
- Adequacy regulations (e.g. Japan, Canada with exceptions, South Korea, EU/EEA treated adequate, UK Extension to the EU-US DPF); otherwise IDTA or Addendum, BCRs; the DUA Act introduces a 'data protection test' (not materially lower than UK standards).
- Finance and health rules
- Finance: FCA, PRA and Bank of England apply existing rules to AI (FCA AI approach page, updated 2 Oct 2026: Consumer Duty, SM&CR, AI Lab). Health: MHRA call for evidence closed 2 Feb 2026; a National Commission into AI in healthcare due to publish in 2026.
- How customers are reached
- Infobip (data through Jan 2026) conflicts: country table WhatsApp 85%, RCS 70%, Instagram 65%, Messenger 45%, Telegram 35%; its UK section text says WhatsApp 65%, RCS 60%, Instagram 50%, Messenger 45%, Apple Messages 35%. Both reported, not resolved.
source 1 · source 2 · source 3 · source 4 · source 5 · source 6 · gov; law-firm tracker; vendor survey
read 2026-10-22. No legislation.gov.uk or ICO page opened. DLA page last modified 24 Feb 2026 says DUA Act complaints procedure was due June 2026; later commencement not verified.
Canada
No AI law · North America
- AI law
- Status: none in force at federal level. The Artificial Intelligence and Data Act (AIDA, part of Bill C-27) was not enacted; C-27 died on the order paper when Parliament was prorogued on 6 Jan 2025. A Minister of AI and Digital Innovation (Evan Solomon) was appointed. CP24 (27 Sep 2026) reports bills on privacy and consumer data, social media, deepfakes and AI chatbots, a concluded consultation on AI transparency, and no details yet on deployment rules. Voluntary Generative AI Code of Conduct (ISED); OPC generative AI principles are non-binding; Ontario IPC/OHRC principles issued 21 Jan 2026 are non-binding.
- What it asks of a company
- None specific at federal level. Quebec Law 25 requires notice, explanation and a chance to respond when decisions rest solely on automated processing. OSFI Guideline E-23 (model risk management) takes effect 1 May 2027 and covers AI/ML models for federally regulated financial institutions.
- Data protection
- PIPEDA (federal); Alberta PIPA, BC PIPA and Quebec private-sector Act (Law 25, final amendments in effect 22 Sep 2024) deemed substantially similar; Bill C-27 died Jan 2025.
- Where data must stay
- no general rule (Canadian law does not appear to require localisation; DLA page last reviewed 2023)
- Sending data abroad
- Transfers permitted if the organisation stays accountable, uses contracts or other safeguards and discloses the transfer; Quebec requires a case-by-case assessment of the destination before transfer; EU treats Canada as adequate for commercial organisations.
- Finance and health rules
- Finance: OSFI E-23 model risk management guideline effective 1 May 2027, covers AI/ML. CASL governs commercial electronic messages (consent, unsubscribe; penalties up to CA$10 million for corporations). Health-record laws were not checked.
- How customers are reached
- Infobip (data through Jan 2026): Messenger 55%, Instagram 50%, Apple Messages 50%, RCS 45%, WhatsApp 30%.
source 1 · source 2 · source 3 · source 4 · source 5 · source 6 · gov; law-firm tracker; press; vendor survey
read 2026-10-22. CMS Canada page returned 410. The June 2026 bills are known only from CP24's list; the Logic article was not opened, so bill numbers and stages are unverified. The OPC page was a navigation index. Provincial health-record laws not checked.
Brazil
A bill · Latin America
- AI law
- Status: bill. PL 2338/2023 (AI legal framework) was approved by the Senate plenary and sent to the Chamber of Deputies on 17 Mar 2025 (Senate record); Chamber review continues, no fixed timeline (CMS, 17 Feb 2026). Nothing in it is in force. Law 15,123/2025 raises penalties for psychological violence against women committed with AI tools.
- What it asks of a company
- None specific in force. The bill is risk-based (governance, transparency, liability, oversight, with ANPD coordinating a National AI System). Today LGPD automated-decision rights, consumer code and sector rules (BACEN, CVM, ANVISA, ANATEL) apply.
- Data protection
- LGPD (Lei Geral de Protecao de Dados), in force since 18 Sep 2020; penalties enforceable from 1 Aug 2021; ANPD became a federal agency linked to the Ministry of Justice on 17 Sep 2025.
- Where data must stay
- no general rule (page does not describe localisation)
- Sending data abroad
- Consent unless an exception applies: adequacy decision, ANPD standard contractual clauses, specific clauses, binding corporate rules, certifications, or ANPD authorisation (Regulation 19/2024). Mutual adequacy with the EU as of 27 Jan 2026.
- Finance and health rules
- Marco Civil da Internet: access records kept confidential and secure. Health data is sensitive data under LGPD. Breach notice to ANPD within 3 working days (Regulation 15/2024). Central bank cloud rules not checked.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 85%, RCS 70%, Instagram 65%, Messenger 45%, Telegram 35%.
source 1 · source 2 · source 3 · source 4 · source 5 · gov; law-firm tracker; vendor survey
read 2026-10-22. Senate record page: only the first 100k of 348k characters read; its capture date shows 22 Oct 2026 but last action is 17 Mar 2025. Chamber of Deputies page not opened, so any 2026 committee progress is unverified. BCB resolutions not read.
Mexico
No AI law · Latin America
- AI law
- Status: none. CMS (17 Feb 2026) states no dedicated AI law is in force; a Federal Law Initiative for the Ethical, Sovereign and Inclusive Development of AI was published in April 2025 for discussion, with its legislative stage not given. No official AI guidelines reported.
- What it asks of a company
- none specific (general law applies: personal data, consumer protection, CNBV rules indirectly for credit scoring and trading)
- Data protection
- New Federal Law for the Protection of Personal Data in Possession of Private Parties enacted 20 Mar 2025, repealing the 2010 law; the Ministry of Anticorruption and Good Governance replaces INAI. DLA page last modified 28 Jan 2024 but references the 2025 law, so currency is unclear.
- Where data must stay
- no general rule (page does not describe localisation)
- Sending data abroad
- Transfers to third parties require disclosure in the privacy notice and consent unless an exception applies (legal requirement, contract in the data subject's interest, intra-group transfers); transfers to processors ('remittances') need no consent.
- Finance and health rules
- Sensitive data (health, biometrics, financial, geolocation) needs express written consent; INAI-era guidance on biometrics and cloud contracts. CNBV rules indirectly cover AI in credit scoring (CMS). Central bank and health-record rules not read.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 75%, RCS 50%, Instagram 45%, Messenger 45%, Telegram 25%.
source 1 · source 2 · source 3 · law-firm tracker; vendor survey
read 2026-10-22. No Mexican government page opened. The 2025 law text, its effective date and secondary regulations were not verified.
China
Partly in force · East Asia
- AI law
- Status: partly in force (no comprehensive AI law). CMS (17 Feb 2026): no dedicated AI law in force; governed by the Cybersecurity Law, Interim Measures for Generative AI Services, Deep Synthesis Provisions, Recommendation Algorithm Provisions, and the Measures for Labeling AI-Generated Synthetic Content (issued 14 Mar 2025, effective 1 Sep 2025, with mandatory standard GB 45438-2025). CSL first amendment effective 1 Jan 2026 (DLA). A draft AI Law has been on legislative agendas since 2023 but no official draft had been released as of Dec 2025 (CMS).
- What it asks of a company
- Providers add explicit labels and implicit metadata labels to AI-generated content; platforms and app stores have duties; generative AI providers must prevent discrimination and respect personal information; CAC maintains a list of registered and recorded generative AI services (filing procedures not described by the sources read).
- Data protection
- PIPL (effective 1 Nov 2021), Data Security Law (1 Sep 2021), Cybersecurity Law (1 Jun 2017; amended effective 1 Jan 2026); all in force.
- Where data must stay
- Localisation-type effects only: critical information infrastructure operators (CIIOs) transferring any personal information abroad, and any 'important data' transfer, trigger a CAC security assessment.
- Sending data abroad
- CAC security assessment (important data; CIIO; non-sensitive PI of over 1 million people or sensitive PI of over 10,000 people); China standard contract filing (100,000 to 1 million people, or under 10,000 sensitive); certification from 1 Jan 2026; free trade zone lists; separate consent and PIPIA in all routes.
- Finance and health rules
- Sector data classification rules for industry/IT (MIIT 2023), accounting firms (2024), civil aviation (2025), automotive cross-border (3 Feb 2026), financial information services (draft, consultation closed 23 Feb 2026); financial, telecom and genetic/healthcare data subject to specific rules (details not read).
- How customers are reached
- Infobip (data through Jan 2026): WeChat dominant (over 1.3 billion active users); QQ, DingTalk and Telegram (via VPN) also mentioned; no percentages given.
source 1 · source 2 · source 3 · source 4 · law-firm tracker; vendor survey
read 2026-10-22. No Chinese government page opened (CAC, NPC), so all law cells rest on DLA, CMS and Loeb. CAC security-assessment thresholds are DLA's reading. The CMS page gives few effective dates; 2023 Generative AI Interim Measures date not verified.
Japan
In force · East Asia
- AI law
- Status: in force, promotion-oriented with no penalties. Act on Promotion of Research and Development and Utilization of AI-Related Technologies (AI Promotion Act) passed 28 May 2025; most provisions effective 4 Jun 2025, AI Strategy Headquarters and Basic Plan chapters 1 Sep 2025 (Nemko). Cabinet adopted the first AI Basic Plan on 23 Dec 2025 (press via search result, not opened). One search result reported a revised Basic Plan on 14 Jul 2026; unconfirmed.
- What it asks of a company
- No direct duties or fines on companies; authorities may advise, request information, or publicly disclose non-compliance. Businesses are expected to follow the METI/MIC AI Guidelines for Business (v1.1, March 2025) on a comply-or-explain basis: risk assessment, transparency, monitoring, record-keeping.
- Data protection
- Act on the Protection of Personal Information (APPI), enacted 2003; amended APPI effective 1 Apr 2022; consolidated text as of 1 Apr 2023; in force. Discussion of administrative fines pending (DLA).
- Where data must stay
- no general rule (page does not describe localisation)
- Sending data abroad
- Prior consent identifying the destination country, unless the country is whitelisted (EU and UK, 23 Jan 2019 adequacy) or the recipient has equivalent standards (e.g. APEC CBPR); consent notices must describe the destination's system and the recipient's measures.
- Finance and health rules
- Not verified in sources read (FSA outsourcing or cloud rules and health-record laws were not opened). Marketing: Act on Specified Commercial Transactions and Anti-Spam Act require opt-in for email ads.
- How customers are reached
- Infobip (data through Jan 2026): LINE 80%, Instagram 40%, WhatsApp 25%, Apple Messages 25%, Messenger 20%.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; vendor tracker
read 2026-10-22. White & Case article returned 403 and the CMS Japan page 410. Basic Plan dates and the possible 14 Jul 2026 revision come from search snippets, not an opened page, and are not used as facts. Nemko page has no publication date. PPC page lists the Act but not transfer rules.
South Korea
In force · East Asia
- AI law
- Status: in force. AI Basic Act took effect 22 Jan 2026 together with its Enforcement Decree (Shin & Kim); Cooley (27 Jan 2026) said decrees were not yet final, so sources differ on decree status. MSIT announced a grace period of at least one year for administrative fines.
- What it asks of a company
- Advance notice to users when generative or high-impact AI is used; label generative AI output; high-impact AI (e.g. healthcare, energy, transport, hiring, biometric analysis) must be assessed before deployment with risk management, explanation, user protection, human oversight and 5-year documentation; high-compute AI (10^26 FLOPs per Cooley) reports risk results to MSIT; foreign providers above KRW 1 trillion revenue, KRW 10 billion AI revenue or 1 million daily users appoint a local representative. Fines up to KRW 30 million.
- Data protection
- Personal Information Protection Act (PIPA); amendment passed 10 Mar 2026, most provisions effective 11 Sep 2026; mandatory ISMS-P for qualifying private entities from 1 Jul 2027 (DLA). Original enactment year not stated on the page.
- Where data must stay
- no general rule (page does not describe localisation)
- Sending data abroad
- Consent with prior notice of destination, recipient, purpose and retention; exceptions for treaty or law, contract delegation disclosed in the privacy policy, recipient safeguards (e.g. ISMS-P) or PIPC-recognised adequacy; PIPC recognised EU standards as equivalent on 3 Sep 2025 (and EU Commission reviewed Korea's adequacy, concluded 23 Jul 2026).
- Finance and health rules
- Credit Information Act and Location Information Act named by DLA without detail; health data is sensitive information requiring a statutory basis or separate consent. Financial cloud rules not read.
- How customers are reached
- Infobip (data through Jan 2026): Kakao 95%, Instagram 45%, WhatsApp 20%, Apple Messages 20%, Telegram 15%.
source 1 · source 2 · source 3 · source 4 · source 5 · source 6 · gov; law-firm tracker; vendor survey
read 2026-10-22. No MSIT or law.go.kr text opened (MSIT home page had nothing on the Act). The 10^26 FLOPs figure is Cooley's; other reports conflict and are unresolved. PIPC page had no substantive content.
India
Guidance only · South Asia
- AI law
- Status: guidance only, plus a binding intermediary rule. CMS (21 Jul 2026): no standalone AI law. MeitY India AI Governance Guidelines (Nov 2025) are non-binding. Binding: IT Rules amendment 2026 (dated 10 Feb 2026, effective 20 Feb 2026) on 'synthetically generated information'. No draft AI bill; MeitY official said on 9 Jul 2026 drafting would begin soon.
- What it asks of a company
- Intermediaries must use technical measures against unlawful synthetic content, label other synthetic content and embed provenance metadata; significant social media intermediaries collect and verify user declarations; non-compliance can cost safe harbour. DPDP: Significant Data Fiduciaries must run algorithmic due diligence, audits and impact assessments. RBI FREE-AI framework (7 principles, 26 recommendations) for finance.
- Data protection
- Digital Personal Data Protection Act 2023: Board provisions effective 13 Nov 2025; consent manager provisions 13 Nov 2026; all other obligations 13 May 2027. IT Act 2000 and 2011 Privacy Rules govern until then (DLA).
- Where data must stay
- No general rule in the DPDP Act, but sector localisation: RBI payment data stored in India (since 15 Oct 2018); SEBI-regulated cloud data within India; insurance records on systems in India; CERT-In logs maintained in India; Significant Data Fiduciaries may have government-specified data kept in India.
- Sending data abroad
- Allowed to any country except those blacklisted by the Government (blacklist not yet notified); contract required for onward processors; Government may restrict making data available to foreign states.
- Finance and health rules
- RBI payments localisation and FREE-AI framework; SEBI cloud localisation; insurance records in India; clinical establishments get limited exemptions from child-data restrictions. Companies Act: electronic books accessible in India.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 70%, RCS 45%, Instagram 40%, Messenger 30%, Telegram 20%.
source 1 · source 2 · source 3 · law-firm tracker; vendor survey
read 2026-10-22. No Indian government page opened (meity.gov.in returned 403; PIB not opened). The DPDP Rules phase dates are DLA's reading; CMS page says the DPIIT copyright working paper summary is internally inconsistent.
Singapore
Guidance only · Southeast Asia
- AI law
- Status: guidance only. CMS (17 Feb 2026): no dedicated AI law in force and no AI-specific legislation launched. Non-binding frameworks: Model AI Governance Framework (plus generative AI version), AI Verify, National AI Strategy 2.0, PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, MAS FEAT principles, healthcare AI guidelines, AI security guidelines.
- What it asks of a company
- none specific (voluntary frameworks; AI medical software may need registration as Software as a Medical Device under the Health Products Act 2007)
- Data protection
- Personal Data Protection Act 2012 (No. 26 of 2012), amended by the Personal Data Protection (Amendment) Act 2020; in force.
- Where data must stay
- no general rule
- Sending data abroad
- Transfer limitation obligation: recipient must provide comparable protection, via data transfer agreements (PDPC sample clauses), consent with notice, prescribed circumstances, or Commission exemption.
- Finance and health rules
- Finance: MAS Guidelines on Outsourcing (2016, revised 2018, covering cloud) show as cancelled with effect 10 Dec 2024 on the MAS page, replacement not named there; MAS FEAT principles for AI. Health: Health Products Act 2007 for AI medical software; AI in Healthcare Guidelines.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 90%, Telegram 45%, Instagram 40%, Apple Messages 30%, Messenger 25%.
source 1 · source 2 · source 3 · source 4 · source 5 · gov; law-firm tracker; vendor survey
read 2026-10-22. PDPC overview page had no text on the Act's name or transfers (details from DLA). MAS outsourcing replacement notice and MAS AI risk management guidelines were not found on the pages opened. IMDA AI governance page opened but had no AI content.
Indonesia
Guidance only · Southeast Asia
- AI law
- Status: guidance only; draft pending. No binding overarching AI framework. Draft Presidential Regulations (National AI Roadmap and AI ethics, risk-based, EU-style classification, self-assessment) remain pending as of mid-2026 (Tech for Good Institute); a search result reported inter-ministerial review completed in late July 2026 awaiting presidential approval (not verified on an opened page). 2023 Circular Letter on AI Ethics is soft law.
- What it asks of a company
- none specific (draft would add risk classification and self-assessment for developers and users). PDP Law gives a right to complain about automated decision-making.
- Data protection
- Law No. 27 of 2022 on Personal Data Protection (enacted 17 Oct 2022; two-year transition ended 17 Oct 2024). The PDP Agency is not yet operational (targeted 2026) and the implementing regulation is still being harmonised (DLA).
- Where data must stay
- No general mandate. Commercial banks need prior FSA (OJK) approval to set up a data centre or processing outside Indonesia (POJK 11/2022 Art. 35(3)); private electronic system operators storing data abroad must ensure regulators can supervise and law enforcement can act.
- Sending data abroad
- Principally permitted if the destination has equal or higher protection, or binding safeguards, or prior consent; the PDP Agency is expected to publish an adequacy list.
- Finance and health rules
- Banking Law customer confidentiality (prison 2-4 years for intentional breach); OJK POJK 11/2022 on data centre approval; telecom log retention at least 3 months (MOCI Reg. 26/2007). OJK AI guidance not found in sources read.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 65%, Instagram 45%, Telegram 30%, Messenger 30%, Line 15%.
source 1 · source 2 · source 3 · law-firm tracker; think-tank analysis; vendor survey
read 2026-10-22. No Indonesian government page and no CMS page (404) opened. Perpres status after mid-2026 is unverified. The PDP Agency start and the implementing regulation are as of DLA's page (date not shown).
Malaysia
A bill · Southeast Asia
- AI law
- Status: bill. The National AI Office issued a public consultation paper on a proposed AI Governance Bill on 10 Jul 2026; feedback closed 31 Jul 2026 (Baker McKenzie). Not enacted; no report of tabling found. Non-binding National Guidelines on AI Governance and Ethics exist (search result, Sept 2024; not on an opened page).
- What it asks of a company
- Proposed: deployers and developers established in Malaysia give due regard to five principles (human dignity, transparency and explainability, accountability, safety and security, data governance), submit AI incident reports, and meet stronger duties for high-risk systems (risk assessment, documentation, human oversight, monitoring); a Central AI Authority with sector regulators as leads.
- Data protection
- Personal Data Protection Act 2010 (in force 15 Nov 2013); Personal Data Protection (Amendment) Act 2024 took effect in three stages during 2025 (DPO, breach notification, data portability, stricter cross-border rules, biometric data as sensitive).
- Where data must stay
- no general rule (page describes none)
- Sending data abroad
- Permitted if the destination has substantially similar laws or equivalent protection, or consent, contract performance, due diligence or vital interests; Cross-Border Personal Data Transfer Guidelines (29 Apr 2025) require a Transfer Impact Assessment and recognise BCRs, SCCs and approved certifications.
- Finance and health rules
- Mandatory registration for data users in classes including banking, insurance, healthcare, communications; sector codes of practice for banking and financial services, healthcare, insurance/takaful. BNM RMiT page returned 404 and was not read.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 90%, Telegram 60%, Messenger 50%, Instagram 40%, Apple Messages 25%.
source 1 · source 2 · source 3 · law-firm tracker; vendor survey
read 2026-10-22. No Malaysian government page opened (pdp.gov.my 404). The 2024 national guidelines date is from a search snippet only. Baker McKenzie article does not list deployer duties; the list above is its broader description of the proposal.
Thailand
A bill · Southeast Asia
- AI law
- Status: bill. ETDA released a new draft Act on Artificial Intelligence on 2 Jul 2026 (Tilleke & Gibbins); public hearing about 30 days. A second firm (Rajah & Tann, page returned 403, snippet only) dates the release 9 Jul 2026 with consultation to 14 Aug 2026; sources disagree and are not resolved. Not enacted as far as found.
- What it asks of a company
- Proposed: prohibited AI (subliminal manipulation, unfair broad discrimination); royal-decree-designated high-risk AI; deployers run risk management, assign human oversight, keep logs 6 months, notify authorities of unforeseen risks; AI-generated media embedded with machine-readable marks; strict joint liability for damages; fines THB 1-5 million; foreign providers appoint a local representative.
- Data protection
- Personal Data Protection Act B.E. 2562 (2019), fully in force since 1 Jun 2022; PDPC established Jan 2022; many subordinate regulations still expected (DLA).
- Where data must stay
- no general rule (page describes none)
- Sending data abroad
- Transfer only if the destination has adequate standards, or exemption (consent with notice, contract performance, vital interests), approved BCRs, or appropriate measures such as ASEAN Model Clauses or EU SCCs; a Dec 2023 regulation excludes transit or storage intermediaries such as cloud services.
- Finance and health rules
- DPO required for large-scale processing including behavioural advertising by insurers, financial institutions and telecom operators (100,000 or more data subjects); criminal-records regulation 2024; research-data regulation 2024. Bank of Thailand rules not read.
- How customers are reached
- LINE reported 56 million users in Thailand and over 12 billion conversations via LINE Official Accounts in 2025 (Marketing Oops, 11 Aug 2026, relaying LINE Thailand's own unverified figures). Infobip does not cover Thailand.
source 1 · source 2 · source 3 · law-firm tracker; trade press
read 2026-10-22. No Thai government page opened (pdpc.or.th 403), no CMS page (404). Channel figures are LINE's own and unverified; no independent source for WhatsApp or Facebook Messenger use in Thailand was found.
Vietnam
In force · Southeast Asia
- AI law
- Status: in force. Law on Artificial Intelligence passed by the National Assembly on 10 Dec 2025, effective 1 Mar 2026 (Baker McKenzie). Framework law: implementing decrees still being drafted at the time of the article (Feb 2026); none reported issued.
- What it asks of a company
- Risk classification high / medium / low; high-risk systems face periodic audits and the Prime Minister lists systems needing pre-market conformity certification; deployers must flag AI audio, image or video that could confuse people about authenticity and not erase mandatory labels; detailed transparency rules to come by decree. Systems already operating get 12 months (to 1 Mar 2027), or 18 months (to 1 Sep 2027) in health care, education and finance.
- Data protection
- Personal Data Protection Law (Law No. 91/2025/QH15, enacted 26 Jun 2025, effective 1 Jan 2026) and Decree 356/2025/ND-CP (issued 31 Dec 2025, replaces Decree 13/2023); Data Law has separate rules for important and core data.
- Where data must stay
- Cybersecurity Law: certain domestic and foreign providers handling designated data must store it in Vietnam for a period set by the Government; Decree 147: domestic information websites and social networks must store user data on servers with Vietnamese IP addresses; update to these rules was expected to go to the Prime Minister in April 2026.
- Sending data abroad
- Transfer impact assessment filed with the Ministry of Public Security (A05) within 60 days of transfer, updated every six months; separate assessment for important or core data; data transfer agreement required; fines up to 5% of prior-year revenue for cross-border violations.
- Finance and health rules
- Decree 356 requires data protection measures in AI, big data and metaverse systems with annual compliance assessments; Decree 91/2020 anti-spam rules for marketing messages; sector laws (finance, e-commerce) add breach deadlines such as 24 hours for e-commerce incidents.
- How customers are reached
- Infobip (data through Jan 2026): Zalo 85%, Messenger 45%, Apple Messages 30%, Viber 26%, WhatsApp 15%.
source 1 · source 2 · source 3 · law-firm tracker; vendor survey
read 2026-10-22. No Vietnamese government page and no CMS page (404) opened. The AI law's number is not stated on the page opened. Decrees after Feb 2026 not checked. DLA's PDPL and Decree 356 details are as stated on its page (date not shown).
Philippines
A bill · Southeast Asia
- AI law
- Status: bill. House technical working group on the Artificial Intelligence Development and Regulation Act consolidating 26 House bills; not passed as of the 14 Jul 2026 article; amendments accepted to 20 Jul 2026 (Philstar). Pages show headlines from Oct 2026, so later progress is possible and unverified. Search results mention a December 2024 NPC guideline on AI under the Data Privacy Act (DLA mentions it without detail).
- What it asks of a company
- Proposed: strict rules for high-risk systems (lending, hiring, health) with registration and safety checks, most AI systems not required to register, regulatory sandbox, no dismissal by algorithm alone, 60 days' notice and retraining before AI-driven job displacement.
- Data protection
- Data Privacy Act of 2012 (Republic Act 10173), in force since 8 Sep 2012; four amendment bills pending, none expected within 12 months (DLA).
- Where data must stay
- no general rule (page describes none)
- Sending data abroad
- Controller stays responsible for data transferred for processing, domestic or abroad; data sharing or outsourcing agreements required; NPC model contractual clauses for cross-border transfers (May 2024 guidelines).
- Finance and health rules
- Bank secrecy, credit information and anti-money-laundering laws are carved out of the Act for certain financial institutions; medical practitioners may process sensitive data for treatment with adequate protection. Joint DTI-DOH-DA Administrative Order 01 (2008) and JAO 2022-01 cover online consumer transactions and online businesses.
- How customers are reached
- Infobip (data through Jan 2026): Messenger 95%, Viber 71%, WhatsApp 40%, Instagram 25%, Telegram 20%.
source 1 · source 2 · source 3 · law-firm tracker; press; vendor survey
read 2026-10-22. privacy.gov.ph returned 403; no CMS page (404). The NPC AI guideline is known only from DLA's one-line mention and a search snippet. BSP rules not read.
Australia
No AI law · Oceania
- AI law
- Status: none (existing technology-neutral law). National AI Plan released 2 Dec 2025 dropped the earlier promise of mandatory guardrails for high-risk AI in favour of updating existing laws and issuing guidance, and plans an AI Safety Institute (Piper Alderman). Privacy and Other Legislation Amendment Act 2024: from 10 Dec 2026 privacy policies must describe wholly or substantially automated decisions that significantly affect individuals (DLA).
- What it asks of a company
- none specific; businesses expected to comply with privacy, consumer, competition, directors' duties and workplace law. From 10 Dec 2026 disclose substantially automated decision-making in the privacy policy.
- Data protection
- Privacy Act 1988 (13 Australian Privacy Principles; applies to turnover of AUD 3 million or more); Privacy and Other Legislation Amendment Act 2024 commenced mostly in 2025 incl. statutory tort for serious privacy invasions; further reform expected.
- Where data must stay
- no general rule (page does not cover localisation)
- Sending data abroad
- APP 8: take reasonable steps to ensure the overseas recipient does not breach the APPs and remain liable; exceptions include similar overseas protections and informed consent; no 'declaration of equivalency' made yet.
- Finance and health rules
- Finance: APRA CPS 234 information security (notify APRA within 72 hours of an incident) and CPS 230 operational risk (named, no detail; APRA page returned 404). Health: My Health Records and state health records laws named, not detailed.
- How customers are reached
- Infobip (data through Jan 2026): Apple Messages 55%, Instagram 50%, Messenger 45%, WhatsApp 35%, Telegram 10%.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; vendor survey
read 2026-10-22. industry.gov.au National AI Plan page timed out and was not read; no CMS page for Australia. OAIC page did not mention the 2024 amendment, AI or APP 8 (details from DLA). CPS 230 requirements not read.
United Arab Emirates
No AI law · Middle East
- AI law
- Status: none (policy and charters). CMS (17 Feb 2026): no dedicated AI law in force. National AI Strategy 2031; UAE Charter for the Development and Use of AI (June 2024; binding status not stated); Federal Decree Law 25 of 2018 on Projects of Future Nature (pilot licensing); DIFC Data Protection Law No. 5 of 2020 (amended 2023) applies to autonomous systems; Dubai AI Seal (voluntary status not stated).
- What it asks of a company
- none specific; PDPL gives objection to automated decisions with significant effects and requires impact assessments for high-risk new technologies processing sensitive data at scale (Art. 21).
- Data protection
- Federal Decree-Law No. 45 of 2021 (PDPL), in force 2 Jan 2022 per u.ae; Executive Regulations were unpublished as of Jan 2025 and the Data Office not established at that time (DLA, page modified 27 Jan 2025). DIFC, ADGM and Dubai Healthcare City keep their own laws.
- Where data must stay
- Sector rules: health information generally may not be stored, processed or transferred outside the UAE (Federal Law 2 of 2019; exceptions in Ministerial Decision 51 of 2021); stored value facility customer and transaction data and retail payments data must be stored in the UAE (payments: five years with secure backup elsewhere).
- Sending data abroad
- PDPL restricts transfers outside the UAE; Data Office expected to recognise adequate jurisdictions and exceptions exist, but details were awaited and no adequate jurisdictions listed.
- Finance and health rules
- Central Bank Law Art. 120 customer confidentiality and Consumer Protection Standards (consent before sharing, 5-year retention, breach notice, card schemes within 72 hours); Federal Law 2 of 2019 and Cabinet Resolution 32 of 2020 for health records.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 90%, Instagram 65%, Messenger 50%, Telegram 35%, Viber 20%.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; vendor survey
read 2026-10-22. DLA's AE page is dated Jan 2025: PDPL executive regulations, Data Office and any 2025-2026 developments are unverified; u.ae page (4 Dec 2025) says 'will act' for the Data Office. CMS does not cover ADGM. u.ae does not mention localisation, DLA does.
Saudi Arabia
No AI law · Middle East
- AI law
- Status: none (soft law). CMS (17 Feb 2026): Saudi Arabia does not currently have an AI-specific law, no draft text or timeline. A draft Global AI Hub Law was released for consultation in April 2025 (concerns sovereign data hosting, not AI regulation). SDAIA issued non-binding Generative AI Guidelines (public and government), Deepfakes Guidelines and National AI Ethics Principles; issue dates not given.
- What it asks of a company
- none specific; SDAIA guidelines recommend transparency, accountability, human review and watermarking for deepfakes; PDPL applies directly to AI training and deployment.
- Data protection
- Personal Data Protection Law, Royal Decree M/19 (issued 16 Sep 2021 per SDAIA portal), in effect 14 Sep 2023, amended by Royal Decree M/148 (27 Mar 2023); compliance expected by 14 Sep 2024; SDAIA enforces (DLA).
- Where data must stay
- No general mandate; sector-specific approvals: banking transfers may need Saudi Central Bank (SAMA) approval; telecom, postal, IT and government-held data face extra limits.
- Sending data abroad
- Permitted to countries with adequate protection or with appropriate safeguards, for listed purposes and with minimisation, under the Implementing and Transfer Regulations; limited exceptions otherwise.
- Finance and health rules
- SAMA retains jurisdiction in its remit; NCA Essential Cybersecurity Controls apply to AI systems in regulated entities (CMS); CST oversees cloud and ICT; health data is sensitive data under the PDPL.
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 80%, Telegram 60%, Instagram 45%, Messenger 35%, Apple 20%.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; vendor survey
read 2026-10-22. SDAIA portal page showed only the PDPL issue date (16 Sep 2021) and no regulation dates; DLA gives Royal Decree M/19 as 2024 in CMS and 2021 elsewhere: sources differ and are not resolved (CMS says M/19 of 2024, DLA says issued 16 Sep 2021). Regulation dates were not verified on a Saudi official page.
South Africa
No AI law · Africa
- AI law
- Status: none. CMS (17 Feb 2026): no standalone AI law and no draft AI bill; National AI Plan (April 2024) and National AI Framework Policy are the basis for future regulation. DCDT oversees AI.
- What it asks of a company
- none specific (POPIA and Consumer Protection Act duties apply)
- Data protection
- Protection of Personal Information Act 4 of 2013 (POPIA); the Information Regulator's page treats 1 Jul 2021 as the cutoff for complaints and prior authorisation; in force.
- Where data must stay
- no general rule (DLA page does not cover localisation)
- Sending data abroad
- Transfer only if the recipient is bound by law, binding corporate rules or a binding agreement with substantially similar protection, or consent, contract necessity, or a transfer in the data subject's interest where consent is impractical; the Regulator must be notified before transferring special personal information or children's data to a country without adequate protection (prior authorisation).
- Finance and health rules
- none found in sources read (SARB financial rules and health-record rules not covered by the DLA or Information Regulator pages)
- How customers are reached
- Infobip (data through Jan 2026): WhatsApp 70%, Telegram 30%, Instagram 15%, Messenger 15%, RCS 10%.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; vendor survey
read 2026-10-22. The brief's sector cell is 'none found' because the pages read do not mention SARB or health rules; absence of such rules is not established. POPIA commencement date not stated on the opened pages. The Regulator's page cites s72 prior authorisation in a way DLA's page does not.
Nigeria
A bill · Africa
- AI law
- Status: bill (status after March 2026 unknown). The National Digital Economy and E-Governance Bill, reported as on track to pass in March 2026 (Techpoint, 20 Mar 2026), would make NITDA the AI regulator; the page does not confirm passage. Search results from Jan 2026 (Bloomberg) said the same; nothing found after March. In force today: the NDPA 2023 and the NDPC GAID 2025 (20 Mar 2025), which carries AI-specific data protection duties.
- What it asks of a company
- GAID 2025: controllers using AI, IoT or blockchain complete a DPIA before deployment, test in sandboxes, monitor continuously, file system parameters with the NDPC in the compliance audit return, and respect the right not to be subject to solely automated decisions. The bill (as described by Techpoint) would add risk tiers, high-risk conformity assessments, NITDA registration and fines of N10 million or 2% of annual revenue.
- Data protection
- Nigeria Data Protection Act 2023 (assent 13 Jun 2023); GAID 2025 issued 20 Mar 2025 replaced the NDPR 2019; in force.
- Where data must stay
- no general rule (DLA page does not describe localisation)
- Sending data abroad
- Permitted where the NDPC finds adequate protection; otherwise approved instruments (codes, certifications, BCRs, SCCs) or conditions such as informed consent, contract necessity or legal claims.
- Finance and health rules
- CBN Consumer Protection Framework 2016: no disclosure of customer information, written consent before sharing or promotional use; National Health Act 2014: health establishments keep records confidential. Major data controllers register with the NDPC in OHL/EHL/UHL tiers.
- How customers are reached
- Not covered by Infobip. GeoPoll (citing Statista, Q4 2020, published 18 Feb 2022): 95% of Nigeria's digital population used WhatsApp monthly. No newer source found.
source 1 · source 2 · source 3 · source 4 · gov; law-firm tracker; trade press; vendor data
read 2026-10-22. Bill status after March 2026 unverified; bill details rest on a trade-press explainer. NDPC page did not describe transfers or GAID contents. WhatsApp figure is five years old. DLA page still cites older NDPR references in places.
Kenya
No AI law · Africa
- AI law
- Status: none. CMS (17 Feb 2026): no dedicated AI law and no AI regulator. Kenya Artificial Intelligence Strategy 2025-2030 launched March 2025; a draft KEBS AI Code of Practice (2024) is not gazetted; the Kenya Robotics and Artificial Intelligence Bill 2023 remains in draft.
- What it asks of a company
- none specific (Data Protection Act right not to be subject to solely automated decisions with significant effects applies)
- Data protection
- Data Protection Act 2019 (in force 25 Nov 2019); Data Protection (General) and Complaints Handling Regulations effective 14 Feb 2022, Registration Regulations 14 Jul 2022 (DLA, modified 23 Mar 2026).
- Where data must stay
- no general rule stated by DLA; civil registration data needs the Commissioner's written approval to leave Kenya. (Kenyan 2021 General Regulations localisation provisions for strategic interests were not verified.)
- Sending data abroad
- Controller or processor gives the Commissioner proof of safeguards and documents each transfer; bases: appropriate safeguards (reciprocal agreement, Malabo Convention, BCRs), Commissioner adequacy decision, necessity, or informed consent; sensitive data needs consent.
- Finance and health rules
- Mandatory registration for sectors such as health, finance, telecoms, education and direct marketing; Commissioner guidance notes on health (HMIS, eHealth, mHealth), digital credit providers, communications and education. CBK rules not read.
- How customers are reached
- Not covered by Infobip. Communications Authority of Kenya audience report (via The Star, 19 Mar 2024): WhatsApp 45.9% of mentions in Q1 and 47.3% in Q2, with Facebook about equal; GeoPoll (Statista Q4 2020): 97% of the digital population used WhatsApp monthly.
source 1 · source 2 · source 3 · source 4 · source 5 · gov; law-firm tracker; press; vendor data
read 2026-10-22. ODPC page had no regulation text. The two WhatsApp figures measure different things (mentions vs monthly use) and are not reconciled. Localisation under the 2021 regulations not verified.