Privacy enforcement worldwide 🌍

The authority

Name

Federal Trade Commission (federal); California Privacy Protection Agency (California) (Federal Trade Commission; California Privacy Protection Agency (now branded CalPrivacy), FTC; CPPA (CalPrivacy)) Website

How it is organised

There is no federal data protection authority and no federal comprehensive privacy law. The FTC, an independent federal agency, polices privacy under Section 5 of the FTC Act (unfair or deceptive practices) and sector rules such as COPPA; California's CPPA, now branding itself CalPrivacy, is the only dedicated state privacy agency, governed by a five-member board with its own Enforcement Division.

Regional authorities

State attorneys general enforce the comprehensive state privacy laws (around 20 states, most AG-only) and state consumer protection and biometric laws; the California AG shares CCPA enforcement with the CPPA, and county district attorneys and city attorneys have joined California cases. Sector regulators include HHS Office for Civil Rights (HIPAA), the FTC, CFPB and banking regulators (GLBA), and the FCC (telecoms).

National law

No federal comprehensive law. Federal: FTC Act s.5 (15 U.S.C. 45), COPPA (1998), HIPAA (1996) and its Privacy Rule, Gramm-Leach-Bliley Act (1999). State: California Consumer Privacy Act 2018 as amended by the California Privacy Rights Act 2020 (Cal. Civ. Code 1798.100 et seq., CPRA amendments operative 1 January 2023, CPPA enforcement from July 2023), around 20 other state comprehensive laws phased in 2023-2026, Illinois Biometric Information Privacy Act 2008 (740 ILCS 14), Texas Capture or Use of Biometric Identifier Act (CUBI). A federal comprehensive bill (the American Privacy Rights Act draft, 2024) stalled. Text

Complaining

How

Federal: individuals can report to the FTC online (ReportFraud.ftc.gov), free, but the FTC does not resolve individual complaints and uses them as intelligence for its own cases. California: sworn or unsworn complaints can be filed online with the CPPA (Cal. Civ. Code 1798.199.45) or with the AG, free of charge; other states take consumer complaints through the AG's consumer protection division.

Contact the organisation first?

Not required by the FTC or CPPA. Some state laws require the regulator to give the business a notice and cure period before suing (for example Texas, Virginia, Utah); in California the mandatory 30-day cure ended on 1 January 2023, though the CPPA may still decide to give a business time to cure (s.1798.199.45(a)). A consumer bringing a CCPA data breach claim for statutory damages must first give 30 days' written notice (s.1798.150(b)).

Deadlines

No statutory deadline for the FTC or CPPA to act on a complaint. The CPPA must bring administrative action within five years of the violation (s.1798.199.70); federal civil penalty actions are generally subject to the five-year limit in 28 U.S.C. 2462.

The complainant's position

A complainant is not a party at the FTC, CPPA or state AG and receives no binding decision; the CPPA must, however, tell the complainant in writing what action it has taken or plans to take, and why (s.1798.199.45(b)).

Procedure

1. FTC: investigation (civil investigative demands), then either a negotiated consent order (administrative, binding for 20 years typically) or litigation in an administrative Part 3 proceeding or in federal district court.
2. FTC money: after AMG Capital (2021) the FTC cannot obtain restitution or disgorgement under s.13(b); civil penalties are available only for violating an existing order or a trade regulation rule or specific statute such as COPPA, and are sought in federal court, normally by the Department of Justice on referral.
3. CPPA: Enforcement Division investigation, probable cause proceeding, then an administrative hearing before an administrative law judge and a decision by the CPPA Board (s.1798.199.50-.55); most cases end in a stipulated final order approved by the Board.
4. California AG and other state AGs: investigation, notice (and cure where the state law provides), then a civil lawsuit in state court, usually resolved by a court-approved settlement and injunction.

Who decides

FTC Commissioners (consent orders, administrative decisions) and federal courts (civil penalties); the CPPA Board (administrative fines); state courts in AG actions.

Limitation

CPPA: five years from the violation (s.1798.199.70). Federal civil penalties: five years (28 U.S.C. 2462). State laws vary; not confirmed for each state.

Fines

Who imposes them

Mixed, so mapped as regulator-court: the FTC cannot fine for a first violation of Section 5 and must go to federal court (via DOJ) for civil penalties for order or rule violations, and state AGs must sue in court; the CPPA is the exception, imposing administrative fines itself of up to USD 2,500 per violation or USD 7,500 per intentional violation or violation involving minors under 16 (s.1798.155, CPI-adjusted to USD 2,663 and USD 7,988 from January 2025). The AG can recover the same amounts as civil penalties in court (s.1798.199.90).

Public bodies

Generally no: the FTC Act and the CCPA cover businesses, not government agencies. Federal agencies are governed by the Privacy Act of 1974, enforced by individual lawsuits, not fines; HIPAA covered entities can include public hospitals.

National specifics

Caps are per violation, so totals scale with the number of consumers or transactions rather than turnover. HIPAA civil money penalties are imposed administratively by HHS OCR, and criminal HIPAA offences are prosecuted by DOJ. Other sanctions include long-running consent orders with independent assessments, data and algorithm deletion orders, and bans on certain data uses.

Appeals

First court

FTC administrative orders: petition to a federal court of appeals (15 U.S.C. 45(c)). Federal court civil penalty judgments: ordinary federal appeals. CPPA decisions on a complaint or fine: judicial review in an action by an interested party, on an abuse of discretion standard (s.1798.199.85), in practice a petition for a writ of administrative mandate in the California Superior Court.

Deadline

FTC orders: 60 days after service (15 U.S.C. 45(c)). CPPA decisions: s.1798.199.85 sets no time limit; the deadline under the general Administrative Procedure Act rules is not confirmed.

Does it hold payment?

Not confirmed as a general rule; for FTC administrative orders, a cease and desist order becomes final only after the time for review expires or review concludes.

Further appeal

Federal: federal court of appeals, then a petition for certiorari to the US Supreme Court. California: Court of Appeal, then the California Supreme Court.

If the authority does nothing

There is no practical mechanism to challenge an FTC or AG decision not to act on a complaint; prosecutorial discretion is not reviewable in practice. For the CPPA, s.1798.199.85 allows judicial review of any decision on a complaint by an interested party, but whether a complainant can use it against a decision not to investigate is not confirmed. The individual's main route is a private lawsuit where a statute allows one.

Suing the organisation directly

Courts

Limited: there is no general private right of action under the FTC Act or most state comprehensive laws. The CCPA allows consumers to sue only for data breaches caused by a failure to maintain reasonable security (s.1798.150). Specific statutes give broad private rights, most importantly Illinois BIPA (740 ILCS 14/20), plus federal laws such as the Video Privacy Protection Act and Telephone Consumer Protection Act, and common law privacy torts.

Compensation

CCPA breach claims: statutory damages of USD 100 to 750 per consumer per incident or actual damages if greater (CPI-adjusted to USD 107 to 799). BIPA: USD 1,000 per negligent violation and USD 5,000 per intentional or reckless violation, or actual damages if greater; a 2024 amendment limits recovery to one violation per person rather than per scan.

Collective actions

Class actions are routine and are the main private enforcement tool; BIPA class actions have produced settlements such as Facebook's USD 650 million (2021). Arbitration clauses with class waivers often block them.

The authority

Name

Office of the Privacy Commissioner of Canada (Office of the Privacy Commissioner of Canada / Commissariat à la protection de la vie privée du Canada, OPC / CPVP) Website

How it is organised

The Privacy Commissioner is an independent officer of Parliament working on an ombudsman model: it investigates and recommends but cannot fine or issue binding orders under PIPEDA. Bill C-36 (June 2026) would move private-sector enforcement to a new Digital Safety and Data Protection Commission, leaving the OPC with the public-sector Privacy Act only.

Regional authorities

Quebec's Commission d'accès à l'information (CAI) enforces Law 25 and can impose administrative monetary penalties. Alberta and British Columbia have their own private-sector PIPA statutes enforced by provincial Information and Privacy Commissioners with order-making powers. The Competition Bureau and CRTC (anti-spam law) also act on data practices.

National law

Personal Information Protection and Electronic Documents Act (PIPEDA, 2000), in force for federally regulated and interprovincial commercial activity. Bill C-27 (Consumer Privacy Protection Act) died when Parliament was prorogued and dissolved in 2025; its successor, Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 15 June 2026 and is at an early parliamentary stage. Quebec: Act respecting the protection of personal information in the private sector (CQLR c P-39.1) as amended by Law 25 (2021), phased in from September 2022 to September 2024, with the penalty regime in force since 22 September 2023. Text

Complaining

How

Written complaint to the OPC (PIPEDA s.11), in English or French, free, usually through the OPC's online form. In Quebec, complaints go to the CAI, also free; disagreements over access or rectification go to the CAI's adjudicative function (P-39.1 s.42).

Contact the organisation first?

The OPC expects individuals to raise the matter with the organisation first, and PIPEDA s.12(1) lets the Commissioner decline to investigate where the complainant ought first to exhaust grievance procedures that are reasonably available; this is a discretion, not an absolute bar.

Deadlines

The Commissioner must issue a report of findings within one year after the complaint is filed (s.13(1)), though in practice investigations often take longer; a court noted one that took nearly three years. The OPC may also decline complaints not filed within a reasonable time (s.12(1)).

The complainant's position

The complainant receives the report of findings and, unusually, is the person entitled to take the matter to Federal Court under s.14; the organisation cannot apply under s.14.

Procedure

1. OPC: early resolution where possible, otherwise formal investigation by an investigator, with preliminary findings shared with the organisation.
2. Report of findings by the Commissioner, classified as well-founded, resolved, not well-founded, settled or discontinued, with non-binding recommendations; organisations may enter compliance agreements enforceable in Federal Court (s.17.1).
3. Federal Court application by the complainant (s.14) or the Commissioner (s.15) within one year of the report; the Court hears the matter afresh and can order corrections, publication and damages (s.16).
4. Quebec: CAI inspection or investigation, notice of non-compliance with an opportunity to respond, then an administrative monetary penalty imposed by a person designated by the CAI, or penal proceedings before the courts; the CAI can also issue orders.

Who decides

OPC Commissioner (non-binding findings); Federal Court (binding orders and damages). In Quebec, designated CAI officials (penalties) and the CAI (orders), with penal fines imposed by the Court of Québec on prosecution.

Limitation

Federal Court application: one year after the report or notice of discontinuance is sent, extendable by the Court (s.14). Limitation periods for Quebec penalties and prosecutions: not confirmed.

Fines

Who imposes them

Federally, mapped as court: the OPC has no fining power; the only federal monetary sanctions are Federal Court damages and fines for PIPEDA offences such as obstructing the Commissioner or breaching breach-reporting duties, up to CAD 100,000 on indictment (s.28), imposed by criminal courts. Quebec is the exception: the CAI imposes administrative monetary penalties of up to CAD 50,000 for individuals and CAD 10 million or 2% of worldwide turnover for enterprises, and penal fines on prosecution reach CAD 25 million or 4% of worldwide turnover (doubled for repeat offences).

Public bodies

PIPEDA does not apply to government institutions, which fall under the federal Privacy Act (OPC, no fines). Quebec's AMP regime is in the private-sector act; public bodies are governed by the separate Access Act, and whether AMPs apply to them is not confirmed.

National specifics

Bill C-36 would give the new Commission order-making power and AMPs of up to the greater of CAD 10 million or 3% of global revenue, with offence fines up to CAD 25 million or 5%, but it is not law. Alberta and BC commissioners issue binding orders, with offence fines up to CAD 100,000 (not confirmed against current statute text).

Appeals

First court

Federal: there is no appeal against an OPC finding as such; instead the complainant or Commissioner applies to the Federal Court for a fresh hearing (s.14-15). Quebec: CAI penalty decisions can be contested before the Court of Québec after a review request to the CAI.

Deadline

Federal Court s.14: one year after the report is sent. Quebec AMP contestation: commonly reported as 30 days, article number not confirmed.

Does it hold payment?

Not confirmed.

Further appeal

Federal Court decisions go to the Federal Court of Appeal and, with leave, the Supreme Court of Canada. Court of Québec decisions follow Quebec appeal routes to the Court of Appeal of Québec, then the Supreme Court of Canada with leave.

If the authority does nothing

If the OPC discontinues an investigation, the complainant can still apply to the Federal Court within one year of the notice of discontinuance (s.14). A decision not to investigate at all (s.12) does not open that route; judicial review of OPC conduct in the Federal Court is the general fallback.

Suing the organisation directly

Courts

Limited federally: PIPEDA has no free-standing right to sue; damages are available only through the Federal Court after an OPC complaint and report (s.14, s.16). Quebec gives a broader right: individuals can sue for damages in the ordinary Quebec courts, and Law 25 added punitive damages of at least CAD 1,000 for intentional or gross fault (P-39.1 s.93.1). Alberta and BC PIPA allow damages actions once a commissioner's order is final, and common law privacy torts exist in some provinces.

Compensation

Federal Court PIPEDA awards are modest, for example CAD 5,000 in A.T. v Globe24h.com (2017 FC 114). Quebec punitive damages minimum CAD 1,000 per intentional or gross fault.

Collective actions

Provincial class actions are the main private enforcement route, often pleaded in contract, negligence or privacy torts rather than directly under PIPEDA, as courts have noted the OPC's weak powers (Haikola v Personal Insurance, 2019 ONSC 5982). Quebec has an active class action regime for data breaches.

The authority

Name

Anti-Corruption and Good Government Secretariat (Secretaría Anticorrupción y Buen Gobierno, SABG) Website

How it is organised

A federal government ministry (secretaría) of the executive branch, not an independent authority. It took over private-sector data protection on 21 March 2025 when the constitutionally autonomous INAI was abolished following the constitutional reform published on 20 December 2024 (art. 2 fr. XV and the thirteenth transitional article of the 2025 decree).

Regional authorities

No regional authorities for the private sector. Public-sector data protection is governed by a separate general law (the 2025 General Law on Protection of Personal Data Held by Obligated Subjects) and federal public-sector transparency functions passed to 'Transparencia para el Pueblo'; its enforcement details were not confirmed. Consumer (Profeco) and financial (Condusef) authorities run do-not-call style registries and handle related complaints.

National law

Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on Protection of Personal Data Held by Private Parties), published in the Diario Oficial de la Federación on 20 March 2025 and in force 21 March 2025, replacing the 2010 law. The executive had 90 days to adapt the implementing regulation; whether a new regulation has been issued was not confirmed. Text

Complaining

How

By filing a request for protection of rights (solicitud de protección de derechos) with the Secretariat, which may supply deficiencies in the complaint without altering the facts. Fee and language details were not confirmed; Spanish is the working language.

Contact the organisation first?

Yes. The data subject must first submit an ARCO request (access, rectification, cancellation, objection) to the controller, which has 20 days to answer and 15 more to implement (art. 31). The protection request is filed within 15 days of the controller's answer, or after the answer deadline expires if there is none (art. 40).

Deadlines

The Secretariat must decide within 50 days of the request, extendable once for an equal period (art. 42). If the request is incomplete the complainant gets one chance to correct it within 5 days.

The complainant's position

The data subject is a party to the protection-of-rights procedure, which is adversarial: the controller has 15 days to respond and submit evidence, and the Secretariat can attempt conciliation and record a binding agreement.

Procedure

1. ARCO request to the controller (20 days to answer, art. 31).
2. Protection-of-rights procedure before the Secretariat (arts. 40 to 50): admission, controller response within 15 days, possible conciliation, decision within 50 days confirming, revoking or modifying the controller's answer or ordering delivery of the data.
3. Verification procedure (art. 54), opened on the Secretariat's own initiative or at a party's request, to check compliance generally.
4. Sanctioning procedure (arts. 56 to 57): the controller has 15 days to submit evidence and arguments; decision within 50 days, extendable once.
5. Publication of decisions in redacted public versions (art. 52).

Who decides

The Secretaría Anticorrupción y Buen Gobierno (the internal unit that decides was not confirmed).

Limitation

Not confirmed; no prescription rule for enforcement was found in the 2025 law.

Fines

Who imposes them

The Secretariat imposes sanctions itself by administrative decision (art. 56), so who_penalises is regulator. Fines are fixed ranges in UMA (Unidad de Medida y Actualización): 100 to 160,000 UMA for the infractions in art. 58 fr. II to VII, 200 to 320,000 UMA for fr. VIII to XVIII, and an additional 100 to 320,000 UMA for persistent infringement (art. 59); amounts may be doubled for sensitive data. The first infraction (failing to answer an ARCO request) is met with a warning (apercibimiento).

Public bodies

No: the federal law covers private parties only. Public bodies fall under the separate general law for obligated subjects, where breaches lead to administrative responsibility of officials rather than fines on the body (not confirmed in detail).

National specifics

Fine criteria include the nature of the data, whether the refusal was obviously unfounded, intent, the offender's economic capacity and recidivism. Criminal offences exist: 3 months to 3 years' prison for an authorised person who causes a security breach for profit (art. 62), 6 months to 5 years for processing data through deceit for profit (art. 63), doubled for sensitive data (art. 64). At 2025 UMA values the top ordinary fine is roughly MXN 36 million (value not confirmed against INEGI).

Appeals

First court

Constitutional amparo before specialised federal district judges and circuit tribunals (art. 51: 'Contra las resoluciones de la Secretaría, los particulares podrán promover juicio de amparo'). This replaced the former route of nullity proceedings before the Federal Administrative Court.

Deadline

Not confirmed; the general Amparo Law time limit is reported as 15 working days but was not checked for this regime.

Does it hold payment?

Not confirmed; suspension would depend on the amparo court granting a suspension order.

Further appeal

Review (recurso de revisión) of amparo judgments to the collegiate circuit courts and, in some cases, the Supreme Court (not confirmed for the specialised courts). The twentieth transitional article required the judiciary to set up specialised district courts and collegiate circuit tribunals within 120 calendar days and suspended procedural time limits in pending data protection and transparency amparo cases for 180 calendar days.

If the authority does nothing

Not confirmed. Because the regulator is a ministry, inaction would in principle be challenged by amparo; the law sets no specific remedy.

Suing the organisation directly

Courts

Limited: art. 53 preserves the data subject's right to seek compensation under the applicable civil or criminal law, so damages claims go to the ordinary civil courts under general civil liability (moral damage) rules rather than a specific privacy-law cause of action.

Compensation

No statutory damages; compensation under general civil law rules.

Collective actions

Federal collective actions exist under the Federal Code of Civil Procedure, mainly for consumer and environmental matters; their use for data protection was not confirmed.

The authority

Name

Superintendence of Industry and Commerce, Delegated Superintendence for Personal Data Protection (Superintendencia de Industria y Comercio, Delegatura para la Protección de Datos Personales, SIC) Website

How it is organised

A technical superintendence attached to the Ministry of Commerce, Industry and Tourism, not a stand-alone independent authority. Within it, the Delegated Superintendent for Personal Data Protection (art. 19 Law 1581) supervises compliance, with a Directorate of Personal Data Protection Investigation handling cases at first instance. The SIC is also the consumer, competition and industrial property authority, and exercises judicial functions in some of those fields.

Regional authorities

No regional authorities. The Financial Superintendence shares supervision of financial and credit data under Law 1266 of 2008; the Procurator General (Procuraduría) handles breaches by public authorities; judges protect habeas data through the constitutional tutela action.

National law

Statutory Law 1581 of 2012 on personal data protection (reviewed in advance by the Constitutional Court in judgment C-748 of 2011) and Decree 1377 of 2013, now compiled in Decree 1074 of 2015; Statutory Law 1266 of 2008 on financial and credit habeas data; constitutional right to habeas data in art. 15 of the Constitution. Text

Complaining

How

By filing a complaint (denuncia or reclamo) with the SIC, online through its electronic portal or in writing, free of charge, in Spanish.

Contact the organisation first?

Yes, mandatory: art. 16 Law 1581 makes prior exhaustion of the query or claim process with the controller a procedural requirement (requisito de procedibilidad). Controllers must answer queries within 10 working days (art. 14) and claims within 15 working days (art. 15), each extendable.

Deadlines

Not confirmed; no statutory deadline for the SIC to decide was confirmed.

The complainant's position

Not confirmed. The administrative sanctioning procedure runs between the SIC and the controller; the complainant's party rights were not confirmed.

Procedure

1. Complaint after the controller has failed to resolve the claim, or own-initiative inquiry; the SIC can request information and carry out inspections.
2. Preliminary inquiry and formal statement of charges (formulación de cargos) by the Directorate of Personal Data Protection Investigation.
3. Defence and evidence phase, then a first-instance decision imposing fines and orders (for example to delete data or stop a practice).
4. Appeal for reconsideration (reposición) to the Directorate, and appeal (apelación) to the Delegated Superintendent for Personal Data Protection.
5. The SIC can also issue administrative orders (órdenes administrativas) to bring processing into line, including to foreign platforms operating in Colombia.

Who decides

The Director of Personal Data Protection Investigation at first instance; the Delegated Superintendent for Personal Data Protection on appeal.

Limitation

Reported as 3 years from the conduct under the general administrative sanctions rule in art. 52 of the Administrative Procedure Code (CPACA); not confirmed against the text.

Fines

Who imposes them

The SIC imposes fines itself by administrative decision (art. 23 Law 1581), so who_penalises is regulator. The maximum is 2,000 statutory monthly minimum wages (SMMLV) per sanction; national rules require such wage-linked amounts to be expressed in tax or basic value units, and the conversion now applied by the SIC was not confirmed.

Public bodies

No fines on public authorities: under art. 23 Law 1581, where the infringer is a public authority the SIC refers the case to the Procurator General's Office for disciplinary action.

National specifics

Other sanctions are suspension of processing activities for up to 6 months, temporary closure of operations if the failings are not corrected, and immediate and definitive closure of operations involving sensitive data (art. 23). Graduation criteria in art. 24 include harm, benefit obtained, recidivism, obstruction and acknowledgement. Unauthorised access to or use of personal data is also a crime under art. 269F of the Criminal Code (Law 1273 of 2009), with 48 to 96 months' prison.

Appeals

First court

After the internal appeals, judicial review is by the action for annulment and restoration of rights (nulidad y restablecimiento del derecho) before the contentious-administrative courts (Administrative Court of Cundinamarca or Council of State, depending on amount); not confirmed against a primary source.

Deadline

Internal appeals: reported as 10 working days after notification under the CPACA (not confirmed). Judicial review: reported as 4 months (not confirmed).

Does it hold payment?

Not confirmed. Internal appeals are generally suspensive under the CPACA; filing a court action does not by itself suspend the decision.

Further appeal

Second-instance appeal within the contentious-administrative jurisdiction, ending at the Council of State (Consejo de Estado).

If the authority does nothing

The data subject can bring a tutela action (art. 86 Constitution) before any judge for violation of the fundamental right to habeas data, decided within about 10 days; this is also the usual route against public bodies.

Suing the organisation directly

Courts

Tutela gives fast judicial orders to correct, update or delete data but not damages. Compensation is claimed in the ordinary civil courts under general civil liability rules, as Law 1581 creates no specific damages action, so private_action is limited.

Compensation

No statutory damages.

Collective actions

Group actions (acciones de grupo) and popular actions under Law 472 of 1998 exist for collective harm; their use in data protection was not confirmed.

The authority

Name

National Data Protection Agency (formerly National Data Protection Authority) (Agência Nacional de Proteção de Dados (formerly Autoridade Nacional de Proteção de Dados), ANPD) Website

How it is organised

Federal regulatory agency (special autonomous body) linked to the Ministry of Justice and Public Security, with functional, technical, decision-making, administrative and financial autonomy, run by a Board of Directors (Conselho Diretor). Provisional Measure 1.317 of 17/18 September 2025 converted it from an authority into a regulatory agency under Law 13.848/2019 and gave it supervision of the Digital Statute of Children and Adolescents (Law 15.211/2025); Congress approved the conversion on 24 February 2026, and the number of the resulting law was not confirmed.

Regional authorities

No regional data protection authorities. In practice consumer bodies (state and municipal Procons and the federal National Consumer Secretariat, Senacon) and public prosecutors (Ministério Público) also act on privacy failures under the Consumer Defence Code and through public civil actions.

National law

Lei Geral de Proteção de Dados Pessoais (LGPD), Law 13.709 of 14 August 2018, in force 18 September 2020; administrative sanctions (arts. 52 to 54) applicable from 1 August 2021. Key ANPD rules: Resolution CD/ANPD 1/2021 (inspection and sanctioning procedure) and Resolution CD/ANPD 4/2023 (dosimetry and application of sanctions, February 2023). Text

Complaining

How

Through the ANPD's online petition service on the gov.br portal, free of charge, in Portuguese. Two routes exist: a data subject petition (petição de titular) about one's own data, and a report (denúncia) about a suspected LGPD breach that anyone can file.

Contact the organisation first?

Yes for a data subject petition: art. 18 para. 1 LGPD gives the right to petition the ANPD against the controller, and art. 25 para. 1 of Resolution CD/ANPD 1/2021 requires proof that the request was first made to the controller and not resolved in time (a self-declaration is accepted if no other proof exists). A denúncia does not need prior contact.

Deadlines

Not confirmed. The ANPD does not commit to deciding individual petitions within a fixed period; it handles complaints in bulk, using them to prioritise monitoring and inspection.

The complainant's position

Limited. The petitioner is informed of the outcome but the sanctioning procedure runs between the ANPD and the controller; the complainant is not a party with appeal rights in the way a GDPR complainant is (not confirmed in a primary source).

Procedure

1. Monitoring, guidance and preventive phase: the ANPD can request information, issue guidance and impose preventive measures (for example the 2024 Meta AI suspension) with a daily fine for non-compliance.
2. Inspection (fiscalização) triggered by complaints, breach notifications or own initiative.
3. Administrative sanctioning procedure (processo administrativo sancionador) opened by the General Coordination of Inspection, with notice of charges and a defence period.
4. First-instance decision applying sanctions graded under Resolution CD/ANPD 4/2023; administrative appeal to the Board of Directors.
5. Publication of the sanction and, where applicable, a publicity order requiring the controller to disclose the infringement.

Who decides

The General Coordination of Inspection decides at first instance; the Board of Directors (Conselho Diretor) decides administrative appeals and adopts preventive measures in urgent cases.

Limitation

Not confirmed in a primary source; the general five-year limitation for federal punitive administrative action (Law 9.873/1999) is reported to apply.

Fines

Who imposes them

The ANPD imposes fines itself by administrative decision (art. 52 LGPD), so who_penalises is regulator. The simple fine is up to 2% of the revenue of the private legal entity, group or conglomerate in Brazil in its last financial year, excluding taxes, capped at BRL 50 million per infringement; a daily fine is also available.

Public bodies

Public bodies cannot be fined: art. 52 para. 3 LGPD limits them to warnings, publicity, blocking, deletion and suspension-type sanctions. Most ANPD sanctions to date (Ministry of Health, INSS, state health and education secretariats) were warnings or publicity orders against public entities.

National specifics

Other sanctions are warning, publicisation of the infringement, blocking or deletion of the data, partial suspension of the database for up to six months (renewable), suspension of the processing activity, and partial or total prohibition of data processing. The LGPD itself creates no criminal offences; criminal liability comes from other laws. The 2% cap uses Brazilian revenue only, not global turnover.

Appeals

First court

Administrative appeal first lies to the ANPD Board of Directors. Judicial review is before the federal courts (Justiça Federal), since the ANPD is a federal body.

Deadline

Administrative appeal: 10 working days to the Board of Directors (art. 58 Resolution CD/ANPD 1/2021). Judicial review: not confirmed.

Does it hold payment?

The administrative appeal suspends the decision only as to the matter contested, unless there is a justified risk of harm that is hard to repair (art. 60 Resolution CD/ANPD 1/2021). Preventive measures can stay in force meanwhile, as in the 2024 Meta case.

Further appeal

Ordinary federal appeals: Regional Federal Court (TRF), then the Superior Court of Justice (STJ) and, on constitutional questions, the Federal Supreme Court (STF).

If the authority does nothing

Not confirmed. There is no specific statutory remedy against ANPD inaction; complainants typically turn to consumer bodies, public prosecutors or the courts directly.

Suing the organisation directly

Courts

Yes: art. 42 LGPD makes controllers and processors liable for material, moral, individual or collective damage caused by processing in breach of the law, and art. 22 allows defence of data subjects' interests individually or collectively in court. Claims go to the ordinary state civil courts, including small claims courts, or consumer courts where the Consumer Defence Code applies.

Compensation

No statutory damages; compensation is assessed by the judge. There is heavy volume of individual LGPD litigation, and the burden of proof can be reversed in the data subject's favour (art. 42 para. 2). The STJ has reportedly held that a leak of ordinary (non-sensitive) personal data does not by itself create presumed moral damages (case reference not confirmed).

Collective actions

Yes: collective redress through the public civil action (ação civil pública, Law 7.347/1985) and the Consumer Defence Code, brought by public prosecutors, public defenders, consumer bodies and associations such as Idec. Prosecutors also obtain settlement agreements (TACs) with companies.

The authority

Name

Agency for Access to Public Information (National Directorate for Personal Data Protection) (Agencia de Acceso a la Información Pública (Dirección Nacional de Protección de Datos Personales), AAIP) Website

How it is organised

A self-governing body created by the Access to Public Information Law 27.275 (2016) and given the data protection supervisory role in 2017, operating within the orbit of the Chief of Cabinet of Ministers. Data protection is handled by its National Directorate for Personal Data Protection; the AAIP also runs the national 'No Llame' do-not-call registry under Law 26.951.

Regional authorities

Some provinces and the City of Buenos Aires have their own data protection rules and bodies; Law 25.326 invites provincial adherence and federal jurisdiction applies to national bodies and interjurisdictional networks (art. 44). Consumer authorities also act on related complaints.

National law

Personal Data Protection Law 25.326 of 2000 (Ley de Protección de los Datos Personales), regulated by Decree 1558/2001, with constitutional habeas data in art. 43 of the National Constitution. Sanctions are classified and graded by AAIP Resolution 126/2024 (published 24 May 2024, in force 1 June 2024). A replacement bill sent by the executive in 2023 (Message 87/2023) was never enacted. Text

Complaining

How

By filing a complaint (denuncia) for breach of Law 25.326 with the AAIP, online through the remote procedures platform, free of charge, in Spanish, attaching a copy of the original request to the controller and any reply.

Contact the organisation first?

Yes in practice: the AAIP asks for proof that the right was first exercised with the controller. The controller must answer an access request within 10 calendar days (art. 14) and act on rectification, update or deletion within 5 working days.

Deadlines

Not confirmed; no published deadline for the AAIP to decide a complaint was found.

The complainant's position

Not confirmed. The sanctioning procedure is an administrative inquiry (sumario) between the AAIP and the controller; the complainant's party status was not confirmed.

Procedure

1. Complaint, or own-initiative action (for example the April 2026 investigation into debt collection calls by 5 ON LINE S.R.L.).
2. Administrative inquiry (sumario) under art. 31, section 3 of Decree 1558/2001, with notice of the charges and a right of defence.
3. Decision classifying the infringement as minor, serious or very serious and imposing sanctions under Resolution 126/2024.
4. Voluntary payment within 20 working days of notification reduces the fine by 50%.
5. Final sanctions are entered in a public register of infringers (sanciones firmes) on the AAIP website.

Who decides

The AAIP (head of the agency), acting through its National Directorate for Personal Data Protection.

Limitation

Not confirmed. Resolution 126/2024 counts recidivism over 3 years from notification of a prior sanction.

Fines

Who imposes them

The AAIP imposes fines itself by administrative decision (art. 31 Law 25.326), so who_penalises is regulator. The statutory range is ARS 1,000 to ARS 100,000 per infringement; Resolution 126/2024 splits it into minor (ARS 1,000 to 80,000), serious (ARS 80,001 to 90,000) and very serious (ARS 90,001 to 100,000) bands, and caps accumulated fines for the same conduct at 500 times the band maximum (so at most ARS 50 million).

Public bodies

Not confirmed. The law covers public and private databases, but whether the AAIP fines public bodies in practice was not confirmed.

National specifics

Other sanctions: warnings, suspension (up to 30 days for serious, 31 to 365 days for very serious), closure or cancellation of the database, plus orders to comply and to train staff. The fine amounts were set in 2000 and never indexed, so with inflation they are very small in real terms. Art. 32 added criminal offences to the Penal Code (arts. 117 bis and 157 bis): 1 month to 2 years' prison for knowingly inserting false data or unlawfully accessing or disclosing data in a database, and up to 3 years for knowingly supplying false information from a database to third parties.

Appeals

First court

Not confirmed. Under general federal administrative law (Law 19.549) AAIP decisions can be challenged by administrative remedies and then before the federal contentious-administrative courts.

Deadline

Not confirmed.

Does it hold payment?

Not confirmed.

Further appeal

Not confirmed; ordinary federal appeals end at the National Supreme Court of Justice on federal or constitutional questions.

If the authority does nothing

The data subject does not need the AAIP: the habeas data action (art. 43 Constitution, arts. 33 to 43 Law 25.326) goes directly to a judge to obtain access, rectification, update, confidentiality or deletion.

Suing the organisation directly

Courts

Habeas data is a fast judicial action in which the judge orders the controller to report within a maximum of 5 working days and then rules on deletion, rectification or confidentiality (arts. 38 to 43). The competent judge can be at the plaintiff's or defendant's domicile or where the effects occur, with federal courts for national bodies and interjurisdictional networks (art. 36).

Compensation

Habeas data does not award damages. Compensation for privacy harm is claimed separately in the civil courts under general civil liability rules, with no statutory damages (so private_action is limited).

Collective actions

Argentina's Supreme Court recognised collective actions for homogeneous individual rights in the Halabi case (2009), which concerned telecommunications data retention; collective claims are possible but there is no specific data protection class action statute (case details not confirmed against a primary source).

The authority

Name

Personal Data Protection Authority (decisions taken by the Personal Data Protection Board) (Kişisel Verileri Koruma Kurumu (Kişisel Verileri Koruma Kurulu), KVKK) Website

How it is organised

Public legal entity with administrative and financial autonomy, related to the Presidency. Its decision-making body is the nine-member Board (Kurul), which handles complaints, runs ex officio examinations and imposes administrative fines (Art. 22).

Regional authorities

No regional authorities. Public prosecutors and criminal courts handle the data offences in the Turkish Penal Code (Arts. 135 to 140), and sector regulators (for example the ICT Authority for electronic communications and the banking regulator) apply their own confidentiality rules.

National law

Law No. 6698 on the Protection of Personal Data (2016), amended by Law No. 7499 published on 12 March 2024 (new rules on special category data and cross-border transfers, a new fine for failing to notify standard contracts, and fines to be challenged before administrative courts, in force 1 June 2024) Text

Complaining

How

Written complaint to the Board, including through the Authority's online complaint system; no fee is reported. Complaints are in Turkish.

Contact the organisation first?

Yes, mandatory. The data subject must first apply to the data controller (Art. 13), which has 30 days to answer free of charge; only then may they complain to the Board (Art. 14(2)).

Deadlines

The complaint must be lodged within 30 days of learning the controller's answer, and in any case within 60 days of the original application (Art. 14(1)). If the Board does not answer within 60 days of the complaint, the complaint is deemed refused (Art. 15(4)).

The complainant's position

The complainant receives the Board's answer but the Board's fine is an administrative sanction, not compensation; compensation claims under general law are reserved (Art. 14(3)).

Procedure

1. Application to the data controller (Art. 13), or the Board learns of an alleged violation and acts ex officio (Art. 15(1))
2. Complaint to the Board within the Art. 14 deadlines
3. Examination: the controller must provide information and documents within 15 days and allow on-site inspection (Art. 15(3))
4. Board decision ordering the controller to remedy the violation within 30 days of notification (Art. 15(5)), possibly a public principle decision for widespread violations (Art. 15(6)), and an administrative fine (Art. 18)
5. Where damage would be difficult or impossible to remedy and the violation is clear, the Board may order processing or transfers abroad to stop (Art. 15(7))

Who decides

The Personal Data Protection Board.

Limitation

General limitation periods of the Law on Misdemeanours No. 5326 apply to administrative fines (specific periods not confirmed this session).

Fines

Who imposes them

Regulator: the Board imposes administrative fines itself by decision (Arts. 18 and 22). Fines are fixed bands per violation type, revalued every January; for 2026 the bands are about TRY 85,437 to 1,709,200 for breach of the duty to inform (Art. 10), TRY 256,357 to 17,092,242 for data security failures (Art. 12), TRY 427,263 to 17,092,242 for not complying with Board decisions, TRY 341,809 to 17,092,242 for registry (VERBIS) breaches, and about TRY 90,308 to 1,806,177 for failing to notify standard transfer contracts.

Public bodies

Public institutions are not fined: where a violation occurs within a public institution or a professional organisation with public status, disciplinary proceedings are applied to the officials concerned on the Board's notice, and the result is reported to the Board (Art. 18).

National specifics

Criminal offences are prosecuted separately: Art. 17 applies Turkish Penal Code Arts. 135 to 140 (unlawful recording, unlawful disclosure or acquisition, failure to destroy data), and failure to erase or anonymise data is punishable under TPC Art. 138. The Board also publishes decision summaries that name sectors and sometimes companies.

Appeals

First court

Since 1 June 2024, administrative courts (idare mahkemeleri), under Art. 18 as amended by Law No. 7499. Before that, objections to fines went to criminal judgeships of peace (sulh ceza hakimlikleri) under the Law on Misdemeanours.

Deadline

Not confirmed; the general time limit for annulment actions before administrative courts under the Administrative Procedure Law is 60 days from notification (not confirmed for this law specifically).

Does it hold payment?

Not confirmed.

Further appeal

Regional administrative courts and the Council of State (Danıştay) under ordinary administrative procedure; the Constitutional Court by individual application for rights violations.

If the authority does nothing

A complaint not answered within 60 days is deemed refused (Art. 15(4)); Board decisions on complaints are administrative acts that can be challenged before administrative courts.

Suing the organisation directly

Courts

Yes, through general law: KVKK creates no specific damages action, but Art. 14(3) reserves compensation for anyone whose personal rights are violated, so individuals can sue in the civil courts under the Turkish Code of Obligations and the Civil Code's personality rights provisions, without first going to the Board.

Compensation

Material and moral (non-pecuniary) damages under general civil law; no statutory or minimum damages.

Collective actions

No class action mechanism; associations can bring limited collective claims under general procedure (not confirmed for data cases).

The authority

Name

Privacy Protection Authority (הרשות להגנת הפרטיות (HaRashut LeHaganat HaPratiyut), PPA) Website

How it is organised

A unit within the Ministry of Justice, headed by the Registrar of Databases, rather than a separate independent statutory body. Since Amendment 13 it supervises, inspects, investigates (including criminal investigation of privacy offences) and imposes financial sanctions.

Regional authorities

No regional authorities. The State Attorney and police prosecute criminal privacy offences; sector regulators (Bank of Israel, Capital Markets Authority, Ministry of Health) apply sectoral confidentiality rules. The European Commission has recognised Israel as adequate since 2011.

National law

Protection of Privacy Law, 5741-1981, with Amendment 13 (published 14 August 2024, in force 14 August 2025) and the Protection of Privacy (Data Security) Regulations 2017 Text

Complaining

How

Online complaint form on the PPA pages of gov.il; no fee reported. Complaints can be filed in Hebrew; availability of other languages not confirmed.

Contact the organisation first?

Not confirmed as a formal requirement.

Deadlines

No statutory deadline for the PPA to decide complaints was found.

The complainant's position

The complainant is a source of information, not a party: the PPA decides whether to open an inspection or investigation. Individual redress is pursued in the civil courts.

Procedure

1. Complaint, breach report, media report or own-initiative audit (sectoral audits are common)
2. Administrative inspection: inspectors can demand documents and system logs and enter premises; in serious cases a criminal investigation
3. Findings, and where a financial sanction is intended a notice of intent giving the controller the right to respond (procedural details not confirmed)
4. Decision: administrative warning, orders to remedy or stop processing, suspension of a database, financial sanction, and publication of the sanction; or referral for criminal prosecution

Who decides

The head of the Privacy Protection Authority for administrative measures and financial sanctions; criminal courts for offences.

Limitation

Not confirmed.

Fines

Who imposes them

Regulator: since 14 August 2025 the PPA imposes financial sanctions itself, without going to court. Under Amendment 13 sanctions are calculated per violation from base amounts that vary by provision (secondary sources cite ILS 150,000 for key breaches and ILS 320,000 for some security breaches), scaled by the number of data subjects in the database and doubled for very large databases or repeat violations, with an overall ceiling reported as 5% of annual turnover. Secondary sources differ on the figures and the statute was not checked. Before Amendment 13 the PPA could only impose small fines (around ILS 10,000 to 25,000).

Public bodies

Public bodies are within the regime and must appoint data protection officers; secondary sources indicate they can receive financial sanctions, but this was not confirmed from the statute.

National specifics

Criminal offences: wilful infringement of privacy under s 5 carries up to 5 years imprisonment, and Amendment 13 raised database offences (such as unauthorised processing, misleading the PPA or obstructing an investigation) to up to 3 years (secondary sources). Reductions are available for having a DPO and self-reporting (secondary).

Appeals

First court

Magistrates' Court, according to a 2026 practice guide (not confirmed from the statute).

Deadline

45 days, according to a 2026 practice guide (not confirmed from the statute).

Does it hold payment?

No, unless the head of the PPA agrees or the court orders a stay, according to a 2026 practice guide (not confirmed from the statute).

Further appeal

Not confirmed. Administrative decisions of government bodies can also be challenged before the Supreme Court sitting as High Court of Justice or the administrative affairs courts, depending on the matter.

If the authority does nothing

Not confirmed; a complainant would rely on general administrative law petitions, but no specific route was found.

Suing the organisation directly

Courts

Yes. Infringement of privacy is a civil wrong under the Protection of Privacy Law (s 4), actionable in the Magistrates' or District Courts depending on value, and individuals can sue without going to the PPA.

Compensation

Statutory compensation without proof of harm: for general privacy infringements under s 29A, reported as up to about ILS 50,000 (index-linked, around ILS 65,000) and doubled where the infringement was intended to harm, giving the ILS 100,000 figure cited by some sources; Amendment 13 added statutory damages of up to ILS 10,000 for certain database breaches such as failure to notify or correct data. Exact current amounts not confirmed from the statute.

Collective actions

Class actions are available under the Class Actions Law 2006 and are a significant risk for breaches; representative and personal actions are both used (secondary source).

The authority

Name

Saudi Data and Artificial Intelligence Authority (الهيئة السعودية للبيانات والذكاء الاصطناعي (سدايا), SDAIA) Website

How it is organised

Government authority reporting to the Prime Minister, designated as the competent authority under the PDPL. Enforcement decisions are taken by its Committees for Reviewing Violations; the National Data Management Office (NDMO) sits within SDAIA and the PDPL contemplated a possible later transfer of the role to it, which had not been announced as at 2026 (secondary).

Regional authorities

No regional authorities. The Public Prosecution investigates and prosecutes the PDPL's criminal offences; sector regulators such as the Saudi Central Bank, the Communications, Space and Technology Commission and the National Cybersecurity Authority apply their own data rules.

National law

Personal Data Protection Law (Royal Decree M/19 of 1443H, amended by Royal Decree M/148 of 1444H) and its Implementing Regulations and Regulation on Personal Data Transfer; in force 14 September 2023 with a one-year grace period, fully enforceable since 14 September 2024 Text

Complaining

How

Complaints and breach notifications go through SDAIA's National Data Governance Platform; no fee reported. Arabic is the working language; English availability not confirmed.

Contact the organisation first?

Not confirmed as a formal requirement, though data subject rights must first be exercised against the controller.

Deadlines

The deadline for lodging complaints and SDAIA's handling deadline are set in the Implementing Regulations; exact periods not confirmed this session. Controllers must notify SDAIA of breaches within 72 hours.

The complainant's position

The complainant is not a party to the violation proceedings; damages must be claimed separately in court (Art. 40).

Procedure

1. Complaint, breach notification or own-initiative inspection by SDAIA staff
2. Referral to a Committee for Reviewing Violations, which notifies the controller and hears its response (secondary sources report short response windows of about 5 days)
3. Committee decision: warning or fine of up to SAR 5 million, doubled for repeat violations (Art. 36), with possible publication at the violator's expense
4. Separately, the Public Prosecution investigates criminal offences under Art. 35 and prosecutes before the competent criminal court, which may also order confiscation of proceeds (Art. 38)

Who decides

SDAIA's Committees for Reviewing Violations for administrative penalties; the competent criminal court for Art. 35 offences.

Limitation

Not confirmed.

Fines

Who imposes them

Regulator: SDAIA's Committees for Reviewing Violations impose warnings and fines themselves (Art. 36), up to SAR 5 million per violation, which may be doubled for a repeat violation. Criminal penalties under Art. 35 (disclosure or publication of sensitive data with intent to harm or for personal benefit: up to 2 years imprisonment and/or a fine up to SAR 3 million) are imposed by courts after Public Prosecution proceedings.

Public bodies

Public entities are subject to the PDPL; whether committees fine public entities in practice was not confirmed.

National specifics

In January 2026 SDAIA announced that its committees had issued 48 enforcement decisions (covering processing without a legal basis, unauthorised disclosure, inadequate security and unsolicited marketing) but published no names, amounts or decision texts.

Appeals

First court

The competent court, which for administrative decisions of government bodies is the administrative judiciary of the Board of Grievances (Diwan al-Mazalim); secondary sources state appeals go to the competent court.

Deadline

Reported as 60 days from notification of the committee decision (secondary source; consistent with Board of Grievances procedure but not confirmed from the PDPL text).

Does it hold payment?

Not confirmed.

Further appeal

Administrative Court of Appeal and the High Administrative Court within the Board of Grievances (not confirmed for PDPL cases specifically).

If the authority does nothing

Not confirmed; no specific route against SDAIA inaction was found.

Suing the organisation directly

Courts

Yes: Art. 40 lets anyone who suffers damage from a PDPL violation claim compensation before the competent court. Damage must be proved and there is no published case law.

Compensation

Compensation for material or moral damage as assessed by the court; no statutory damages.

Collective actions

No class action mechanism.

The authority

Name

UAE Data Office (federal); DIFC Commissioner of Data Protection; ADGM Office of Data Protection (مكتب الإمارات للبيانات (UAE Data Office), UAE Data Office / DIFC Commissioner / ADGM ODP) Website

How it is organised

Three separate regimes. The federal UAE Data Office was created by Federal Decree-Law No. 44 of 2021 but is not yet fully operational, with transitional administrative support from the TDRA. The Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) financial free zones each have their own data protection Commissioner, which is the operational enforcement in practice.

Regional authorities

Federal PDPL does not apply in the DIFC and ADGM, nor to government data, health data and banking and credit data covered by their own laws. Sector regulators (Central Bank of the UAE, TDRA, health authorities) enforce sectoral confidentiality rules, and the Public Prosecution prosecutes privacy and data crimes under Federal Decree-Law No. 34 of 2021 on cybercrimes and the Penal Code.

National law

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (in force 2 January 2022; Executive Regulations still not issued as at September 2026, and compliance is due six months after they are issued under Art. 29); DIFC Data Protection Law No. 5 of 2020 (amended by DIFC Law No. 1 of 2025, effective 15 July 2025); ADGM Data Protection Regulations 2021 Text

Complaining

How

Federal: the PDPL allows complaints to the UAE Data Office (Art. 24), but no operational complaint channel or procedure has been confirmed. DIFC and ADGM: complaints to the respective Commissioner through their websites, free of charge, in English.

Contact the organisation first?

Not confirmed for any of the three regimes.

Deadlines

Federal: a grievance against a Data Office decision can be filed with its Director General within 30 days (Art. 25, secondary source). DIFC and ADGM complaint deadlines not confirmed.

The complainant's position

In DIFC the complainant can appeal a Commissioner decision to the DIFC Courts and, since July 2025, sue directly; in ADGM the complainant can seek compensation in the ADGM Courts.

Procedure

1. Federal: complaint to the UAE Data Office, investigation, and administrative sanctions to be defined by Cabinet decision (Art. 26); not yet operating in practice
2. DIFC: complaint or own-initiative inquiry by the Commissioner, directions to remedy or restrict processing, and administrative fines
3. ADGM: complaint or investigation by the Commissioner of Data Protection, directions including temporary or permanent bans on processing, and fines
4. Appeals to the DIFC Courts or ADGM Courts respectively

Who decides

Federal: the Cabinet on the proposal of the Data Office Director General (sanctions not yet defined). DIFC: the Commissioner of Data Protection. ADGM: the Commissioner of Data Protection.

Limitation

Not confirmed.

Fines

Who imposes them

None-yet at federal level: Art. 26 of the PDPL leaves violations and administrative penalties to a Cabinet decision that had not been issued as at September 2026, so the federal regulator has no fine schedule to apply. In the free zones the Commissioners fine directly by decision without going to court: DIFC fines follow fixed amounts per contravention in Schedule 2 of the DP Law (reported up to USD 100,000 each), and ADGM fines can reach USD 28 million.

Public bodies

Federal government data is excluded from the federal PDPL; public bodies in the free zones not confirmed.

National specifics

Criminal liability for privacy invasions and unlawful data disclosure exists under Federal Decree-Law No. 34 of 2021 on combating rumours and cybercrimes and the Penal Code, prosecuted by the Public Prosecution; specific articles and penalties were not confirmed this session.

Appeals

First court

Federal: grievance to the Data Office Director General (Art. 25), then presumably the federal courts (not confirmed). DIFC: appeal to the DIFC Courts. ADGM: reference to the ADGM Courts.

Deadline

DIFC: 30 days from the Commissioner's decision (secondary). ADGM: within three months of the penalty notice (stated in ADGM penalty notices). Federal grievance: 30 days (secondary).

Does it hold payment?

Not confirmed.

Further appeal

DIFC Court of Appeal within the DIFC Courts; ADGM Court of Appeal within the ADGM Courts (not confirmed for data protection matters specifically).

If the authority does nothing

Not confirmed for any regime.

Suing the organisation directly

Courts

Limited: under the federal PDPL there is no specific damages action and general civil law would apply (not confirmed). In the DIFC, since 15 July 2025 data subjects can sue controllers and processors directly in the DIFC Courts without first going to the Commissioner. In ADGM, data subjects can seek compensation in the ADGM Courts.

Compensation

DIFC: compensation for material and non-material loss, including distress (secondary). ADGM: compensation as assessed by the court. No statutory damages.

Collective actions

Not confirmed; no class action regime identified.

The authority

Name

Nigeria Data Protection Commission (Nigeria Data Protection Commission, NDPC) Website

How it is organised

Federal commission established by the Nigeria Data Protection Act 2023, succeeding the Nigeria Data Protection Bureau; headed by a National Commissioner. It investigates, issues compliance and enforcement orders and imposes remedial sanctions itself.

Regional authorities

No regional regulators. In practice the Federal Competition and Consumer Protection Commission (FCCPC) also enforces privacy as a consumer protection matter under the Federal Competition and Consumer Protection Act 2018 and imposed the largest privacy-related fine (Meta, USD 220 million); sector regulators such as the Central Bank also set data rules.

National law

Nigeria Data Protection Act 2023 (NDPA), signed and in force June 2023, which replaced the Nigeria Data Protection Regulation 2019 (NDPR) as the main framework; detailed by the NDPA General Application and Implementation Directive (GAID) 2025, reported as issued in March 2025 and effective 19 September 2025. Text

Complaining

How

A data subject aggrieved by a controller's or processor's conduct may complain to the NDPC (NDPA s.46, as described in secondary sources); the Commission may also act on its own initiative. Complaint form, fee and language were not confirmed.

Contact the organisation first?

Not confirmed.

Deadlines

Not confirmed.

The complainant's position

Not confirmed beyond the right to complain and to seek judicial review or damages in court.

Procedure

1. Complaint or own-initiative investigation (NDPA s.46); in the Fidelity Bank case the NDPC sent an investigation notice and held a pre-action meeting with the bank.
2. Compliance order (s.47) requiring the controller to remedy the breach, which may include a remedial fee or payment.
3. Enforcement order and sanction (s.48), including a remedial fine set by reference to annual gross revenue, typically with a 14-day payment deadline in published cases.

Who decides

The Nigeria Data Protection Commission.

Limitation

Not confirmed.

Fines

Who imposes them

The NDPC imposes remedial fines itself by enforcement order (s.48), so 'regulator'. The FCCPC separately imposes administrative penalties under consumer and competition law, reviewable by the Competition and Consumer Protection Tribunal.

Public bodies

The NDPA applies to public and private controllers, but whether the NDPC has fined a public body was not confirmed.

National specifics

The maximum is the greater of a fixed sum and 2% of annual gross revenue in the preceding financial year: NGN 10 million or 2% for data controllers and processors of major importance, and (per secondary sources) NGN 2 million or 2% for others, so the cap is turnover based. The NDPC has also used negotiated 'remedial fees'. Criminal offences exist for failing to comply with Commission orders, but the penalty details were not confirmed from the statute text.

Appeals

First court

The Federal High Court, which has jurisdiction over actions against federal agencies; the NDPA provides for judicial review of Commission orders (reported as s.50, not confirmed from the statute text). Meta's challenge to the NDPC's USD 32.8 million fine was heard there by Justice James Omotosho, who entered the parties' settlement as a consent judgment on 3 November 2025.

Deadline

Not confirmed (reported in secondary sources as 30 days for judicial review, not verified).

Does it hold payment?

Not confirmed.

Further appeal

Court of Appeal and Supreme Court under the ordinary hierarchy. For FCCPC penalties the route is the Competition and Consumer Protection Tribunal, with further appeal to the Court of Appeal.

If the authority does nothing

Not confirmed; judicial review at the Federal High Court is the general route for challenging a federal agency's decision or inaction.

Suing the organisation directly

Courts

Yes: the NDPA gives a data subject who suffers injury, loss or harm from a breach a right to recover damages in civil proceedings (reported as s.51), and fundamental rights enforcement actions for the constitutional right to privacy are common in Nigeria, so 'yes'. The statute text of this section was not confirmed directly.

Compensation

Not confirmed; no statutory damages amount was confirmed.

Collective actions

Representative actions are possible under court rules and civil society groups such as SERAP have threatened litigation on behalf of users, but no collective privacy damages outcome was confirmed.

The authority

Name

Office of the Data Protection Commissioner (Office of the Data Protection Commissioner, ODPC) Website

How it is organised

State office headed by the Data Commissioner, created by the Data Protection Act 2019. It registers controllers and processors, determines complaints, issues enforcement and penalty notices, and orders compensation to complainants in its determinations.

Regional authorities

No regional regulators. Criminal offences under the Act are tried in the ordinary criminal courts; the High Court also hears constitutional privacy petitions under Article 31 of the Constitution.

National law

Data Protection Act, 2019 (Act No. 24 of 2019), commenced 25 November 2019; supported by the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 and the other 2021 regulations. No major amendment to the enforcement chapter was confirmed. Text

Complaining

How

A data subject aggrieved by a decision of any person under the Act may lodge a complaint with the Data Commissioner orally or in writing; oral complaints are recorded in writing by the Office (s.56). The detailed form and channels are set by the Complaints Handling Procedure and Enforcement Regulations 2021; no fee was confirmed.

Contact the organisation first?

Not required by s.56 as far as confirmed; whether the 2021 Regulations require prior contact with the controller was not confirmed.

Deadlines

The ODPC must investigate and conclude a complaint within 90 days (s.56(5)). No time limit for filing was confirmed.

The complainant's position

The complainant is a party to the determination and can be awarded compensation by the ODPC itself (s.65). Protections apply to natural persons, not companies, according to ODPC determinations.

Procedure

1. Complaint (s.56) or own-initiative inquiry; the ODPC notifies the respondent and investigates, gathering its own evidence rather than relying only on the parties' submissions (s.57).
2. Determination within 90 days, which may find liability, order remedial action and award compensation to the complainant (s.65).
3. Enforcement notice specifying the contravention and remedial measures, with at least 21 days to comply and a statement of the right of appeal (s.58).
4. Penalty notice if the ODPC is satisfied the person has failed or is failing as described in s.58, with the amount set by reference to listed aggravating and mitigating factors (s.62, s.63).

Who decides

The Data Commissioner.

Limitation

Not confirmed.

Fines

Who imposes them

The Data Commissioner imposes administrative fines directly by penalty notice (s.62), so 'regulator'. Penalty notices have typically followed failure to comply with an enforcement notice.

Public bodies

The Act applies to public bodies as controllers, but whether the ODPC has fined a public body was not confirmed.

National specifics

The cap is up to KES 5 million or, for an undertaking, 1% of the previous year's annual turnover, whichever is lower (s.63), so the turnover figure can only reduce the maximum, which is why the cap is classed as 'fixed'. Separately, ignoring an enforcement notice is a criminal offence (fine up to KES 5 million or up to 2 years' imprisonment, s.58(3)), and the general penalty for other offences is a fine up to KES 3 million or up to 10 years' imprisonment, plus forfeiture or stop orders (s.73).

Appeals

First court

The High Court: a person against whom any administrative action is taken by the Data Commissioner, including enforcement and penalty notices, may appeal to it (s.64). In 2025 the High Court dismissed a lender's constitutional petition against its penalty because it had bypassed this statutory appeal.

Deadline

No deadline is stated in s.64; a specific deadline in the regulations was not confirmed.

Does it hold payment?

Not confirmed.

Further appeal

Court of Appeal and then the Supreme Court under the ordinary hierarchy. The High Court has held it will interfere with the ODPC's assessment of compensation only if it was arrived at injudiciously (Muthoni v Solpia, as reported).

If the authority does nothing

The complainant can appeal an adverse determination to the High Court under s.64 or, where there is no decision, seek judicial review; a constitutional petition is possible but courts expect the statutory route to be used first.

Suing the organisation directly

Courts

Yes. A person who suffers damage by a contravention is entitled to compensation from the controller or processor (s.65); this is usually obtained through an ODPC complaint, and civil claims or constitutional petitions in the High Court are also possible, so 'yes'.

Compensation

Damage includes financial loss and non-financial damage, including distress (s.65). The ODPC itself awards compensation in its determinations: an independent tracker counts over 180 determinations with compensation orders and a median award of about KES 350,000 (for example KES 450,000 against Whitepath in 2024).

Collective actions

No class action mechanism in the Act was confirmed; representative constitutional petitions under the Constitution are possible in principle but no data protection outcome was confirmed.

The authority

Name

Information Regulator (South Africa) (Information Regulator, IR / InfoReg) Website

How it is organised

Independent statutory body established under POPIA, accountable to the National Assembly, with jurisdiction over both public and private sectors. It enforces POPIA and also the Promotion of Access to Information Act (PAIA). Investigated matters can be referred to its internal Enforcement Committee (s.92), which makes findings and recommendations before the Regulator decides.

Regional authorities

No regional regulators. Criminal offences under POPIA are prosecuted through the South African Police Service and the ordinary criminal courts; Magistrates' Courts have jurisdiction to impose any POPIA penalty (s.108).

National law

Protection of Personal Information Act 4 of 2013 (POPIA). Assented to 19 November 2013; main provisions commenced 1 July 2020 with a one-year grace period, so full compliance has been enforceable since 1 July 2021. Text

Complaining

How

Any person may complain to the Regulator 'in the prescribed manner and form' (s.74), using the form prescribed in the POPIA Regulations, lodged with the Regulator by email or its online channels. No fee was confirmed. Complaints may also be lodged against the determination of an adjudicator under an industry code of conduct (s.74(2)).

Contact the organisation first?

POPIA does not require the complainant to approach the responsible party first. However, the Regulator may decide to take no action where the complainant has not exhausted a complaints procedure under an applicable code of conduct when it was reasonable to do so (s.77).

Deadlines

No fixed time limit for filing, but the Regulator may decline a complaint where so much time has passed that an investigation is 'no longer practicable or desirable' (s.77). No statutory deadline for the Regulator to decide was confirmed; it must inform both parties of its chosen course of action 'as soon as is reasonably practicable' (s.76).

The complainant's position

The complainant is informed of the outcome and may appeal to the High Court within 180 days of receiving the result of the investigation (s.97(2)). The Regulator must give reasons if it decides to take no action (s.77).

Procedure

1. Complaint (s.74) or own-initiative investigation (s.76(2)); the Regulator may conduct a pre-investigation (s.79), act as conciliator, decide to take no action (s.77), or open a full investigation.
2. Optional referral to the Enforcement Committee (s.92), which makes findings and recommends action to the Regulator (s.93).
3. Enforcement notice (s.95) requiring specified steps or a stop to processing within a set period (31 days in published cases); compliance is suspended during the 30-day appeal window and any appeal, unless the notice is marked urgent, in which case compliance can be required after no less than 3 days.
4. Failure to comply with an enforcement notice is an offence; the Regulator may then serve an infringement notice with an administrative fine of up to ZAR 10 million (s.109).
5. Within 30 days the infringer pays, agrees instalments, or elects to be tried in court, in which case the matter goes to the South African Police Service for criminal prosecution (s.109).

Who decides

The Information Regulator (its members), acting on recommendations of the Enforcement Committee where a matter was referred.

Limitation

No POPIA-specific limitation period confirmed; the Regulator has a discretion to decline stale complaints (s.77).

Fines

Who imposes them

The Regulator imposes the administrative fine itself by infringement notice (s.109), so 'regulator'. In practice fines have followed non-compliance with an enforcement notice rather than the original breach. The infringer can refuse and elect to be tried in court, which turns the matter into a criminal prosecution; an unpaid fine becomes recoverable through the courts.

Public bodies

Yes. The first fines were imposed on national government departments (Justice and Constitutional Development, Basic Education), and fines have also been reported against the Electoral Commission and a local municipality.

National specifics

Fixed cap of ZAR 10 million per infringement notice, not turnover based (s.109). Separate criminal offences carry a fine or imprisonment of up to 10 years (for example obstructing the Regulator, failing to comply with an enforcement notice or misusing account numbers) or up to 12 months for lesser offences such as breach of confidentiality (s.107). Other sanctions are enforcement notices ordering specific steps, including a stop to processing (s.95).

Appeals

First court

The High Court having jurisdiction (s.97). On appeal the court may review findings of fact and may set aside or substitute the notice or decision if it was not in accordance with the law or the Regulator's discretion ought to have been exercised differently (s.98). Departments have also used review applications to challenge both notices.

Deadline

30 days from receipt of an information or enforcement notice for the responsible party (s.97(1)); 180 days from receiving the result for a complainant (s.97(2)).

Does it hold payment?

Yes for enforcement notices: a notice need not be complied with until the appeal period ends and, if an appeal is brought, until it is determined or withdrawn, unless the Regulator declared the notice urgent (s.95(3)-(4)). For the fine itself, electing trial in court within 30 days stops it becoming recoverable (s.109).

Further appeal

Ordinary appeal route from the High Court, with leave, to a full bench or the Supreme Court of Appeal, and then the Constitutional Court on constitutional matters.

If the authority does nothing

A complainant informed of the result of an investigation, or of a decision to take no action, may appeal to the High Court within 180 days (s.97(2)). Judicial review of administrative action is also available in principle.

Suing the organisation directly

Courts

Yes. A data subject, or the Regulator at the data subject's request, may sue the responsible party for damages in the civil courts (s.99), so 'yes' for private action.

Compensation

Strict liability: damages are recoverable whether or not there was intent or negligence, subject to limited defences such as vis major, the plaintiff's consent or fault, compliance not being reasonably practicable, or a Regulator exemption (s.99). The court may award a just and equitable amount covering patrimonial and non-patrimonial loss, aggravated damages, interest and costs.

Collective actions

POPIA has no class action provision of its own. Where the Regulator sues for a data subject, awards go into a trust account and are paid to the data subject after costs (s.99). No POPIA-based class action outcome was confirmed.

The authority

Name

Data Protection Board of India (भारतीय डेटा संरक्षण बोर्ड, DPBI)

How it is organised

Statutory board established by the central government (DPDP Act section 18) on 13 November 2025, with four members under the DPDP Rules, seated in the National Capital Region and designed as a digital office; section 28 says it functions as an independent body, but members are appointed by the central government. It adjudicates complaints and penalties rather than issuing guidance; rule-making stays with the Ministry of Electronics and Information Technology (MeitY).

Regional authorities

No state authorities. Until 13 May 2027, section 43A of the IT Act 2000 and the 2011 SPDI Rules remain the operative privacy regime, with compensation claims before IT Act adjudicating officers; CERT-In enforces cyber incident reporting, and sector regulators (for example the Reserve Bank of India) impose data rules on their sectors.

National law

Digital Personal Data Protection Act 2023 (DPDP Act) and DPDP Rules 2025 (notified 13 November 2025, G.S.R. 846(E)). Phased commencement: from 13 November 2025 sections 1(2), 2, 18 to 26, 35, 38 to 43 and 44(1) and (3) (definitions, Board set-up, RTI and TRAI Act amendments) and Rules 1, 2 and 17 to 21; from 13 November 2026 section 6(9) and 27(1)(d) (consent manager registration and the Board's powers over consent managers) and Rule 4; from 13 May 2027 the substantive duties and enforcement (sections 3 to 17, the rest of 27, 28 to 34, 36, 37, 44(2)) and Rules 3, 5 to 16, 22 and 23. A January 2026 MeitY consultation on compressing the timeline to 12 months was reported, but no change has been notified. Text

Complaining

How

From 13 May 2027, a data principal complains to the Board online through a portal and mobile app (the Board is a digital office); any fee was not confirmed. A data principal who files a false or frivolous complaint breaches their own duties (section 15) and risks a penalty of up to INR 10,000.

Contact the organisation first?

Yes: under section 13(3) the data principal must first exhaust the grievance redress mechanism of the data fiduciary or consent manager; the Rules give fiduciaries up to 90 days to respond to grievances (secondary source).

Deadlines

No statutory deadline for the Board to decide a complaint was confirmed. As of 2 October 2026 the Board exists but the substantive duties and its complaint and inquiry powers (section 27 except 27(1)(d), and section 28) are not yet in force; some commentators say complaints can already be filed, which is hard to reconcile with the commencement notification.

The complainant's position

The complainant is a party to a Board proceeding conducted under principles of natural justice (section 28), but penalties go to the Consolidated Fund of India, not to the complainant.

Procedure

1. Complaint by a data principal, breach intimation by a data fiduciary, reference from the central or a state government, or a court direction (section 27).
2. Board determines whether there are sufficient grounds to inquire; it may close the matter or proceed (section 28), with the powers of a civil court to summon and examine.
3. During or instead of inquiry: direction to attempt mediation (section 31) or acceptance of a voluntary undertaking, which ordinarily bars further proceedings on its contents (section 32); urgent remedial directions are possible.
4. After a hearing, a penalty order (section 33) taking account of factors such as nature, gravity, duration and mitigation. Repeat penalised fiduciaries can be referred to the central government for blocking (section 37).

Who decides

The Data Protection Board of India (chairperson and members).

Limitation

Not confirmed.

Fines

Who imposes them

Once section 33 commences on 13 May 2027, the Board imposes monetary penalties itself by order, per the Schedule: up to INR 250 crore for failing to take reasonable security safeguards, INR 200 crore for failing to notify a breach and for children's data violations, INR 150 crore for significant data fiduciary obligations, INR 50 crore for other breaches, and INR 10,000 for data principals. Until then no body can penalise under the DPDP Act (map: none-yet), apart from Board powers over consent managers from 13 November 2026.

Public bodies

Not confirmed whether penalties apply to government bodies in practice: the State acting as a data fiduciary is within the Act, but the central government can exempt its instrumentalities wholly or partly by notification (section 17(2)).

National specifics

The maximums are fixed amounts per breach category, not turnover-based. The DPDP Act creates no criminal offences; penalties are civil.

Appeals

First court

The Telecom Disputes Settlement and Appellate Tribunal (TDSAT) as Appellate Tribunal (section 29).

Deadline

60 days from receipt of the Board's order, with power to condone delay for sufficient cause; the Tribunal is to endeavour to dispose of appeals within six months.

Does it hold payment?

Not confirmed.

Further appeal

Further appeal to the Supreme Court (via the TRAI Act framework; not confirmed against the text).

If the authority does nothing

No route under the Act; a person could seek a writ in a High Court under Article 226 of the Constitution against the Board as a public authority.

Suing the organisation directly

Courts

Section 39 bars civil courts from any matter the Board is empowered to determine, so there is no private damages action under the DPDP Act once it is in force. Until 13 May 2027, section 43A of the IT Act allows compensation claims against a body corporate negligent in protecting sensitive personal data (before adjudicating officers or civil courts depending on value); section 44(2) omits 43A from that date.

Compensation

None under the DPDP Act: penalties go to the government and the Board cannot award compensation to data principals.

Collective actions

No class action mechanism under the Act. Public interest litigation in the High Courts and Supreme Court on the constitutional right to privacy remains available against the State.

The authority

Name

Cyberspace Administration of China (国家互联网信息办公室, CAC) Website

How it is organised

Government office under the State Council (it shares its leadership with the Communist Party's Central Cyberspace Affairs Commission office); it is not an independent authority. Under PIPL Article 60 the CAC coordinates personal information protection, while relevant State Council departments supervise within their own sectors.

Regional authorities

Provincial and municipal cyberspace administrations enforce locally. In practice the Ministry of Industry and Information Technology (MIIT, mobile app rectification campaigns), the State Administration for Market Regulation (SAMR, consumer protection), the Ministry of Public Security and local police (criminal cases), and sector regulators also enforce; procuratorates bring public interest litigation (PIPL Article 70).

National law

Personal Information Protection Law of the PRC (PIPL), adopted 20 August 2021, in force 1 November 2021 (Article 74). It sits alongside the Cybersecurity Law 2017 (first amendment in force 1 January 2026), the Data Security Law 2021, the Network Data Security Management Regulations (in force 1 January 2025) and the Personal Information Protection Compliance Audit Measures (in force 1 May 2025). Text

Complaining

How

Anyone may complain about or report unlawful processing to the departments with personal information protection duties (PIPL Article 65), in Chinese; in practice through the CAC's online illegal and harmful information reporting centre (12377) or MIIT complaint channels. No fee is charged as far as confirmed.

Contact the organisation first?

Not required for a complaint or report to an authority. For a court action under Article 50, the individual first makes a rights request to the handler and may sue if it is rejected.

Deadlines

PIPL Article 65 only says the department shall handle complaints promptly and according to law and tell the complainant the outcome; no fixed statutory deadline for the regulator or for the complainant was confirmed.

The complainant's position

A complainant is a reporter, not a party: they are told the outcome (Article 65) but have no formal role in the penalty proceedings.

Procedure

1. Complaint, report, security review or sector-wide inspection campaign (for example MIIT app rectification campaigns).
2. Investigation with powers to question parties, inspect records and premises, and seal or seize equipment (PIPL Article 63).
3. Regulatory interview (yuetan) with the handler's legal representative or principal person in charge, and orders to rectify or to commission a compliance audit (Article 64).
4. Administrative penalty procedure under the Administrative Penalty Law: notice of proposed penalty, right to make representations and, for large fines, to request a hearing; then a written penalty decision. Violations are entered in credit records and published (Article 67).

Who decides

The competent department (CAC or sector regulator) decides. Penalties in the serious tier of Article 66(2) may only be imposed by a department at provincial level or above.

Limitation

Under the Administrative Penalty Law (Article 36) the general limitation period is two years, extended to five years where the violation involves citizens' life, health or financial security and has harmful consequences.

Fines

Who imposes them

The CAC and other competent departments impose fines themselves by administrative decision (map: regulator). Ordinary tier (Article 66(1)): rectification order, warning, confiscation of illegal gains, suspension of apps, and a fine up to CNY 1 million if the handler refuses to rectify, plus CNY 10,000 to 100,000 on directly responsible individuals. Serious tier (Article 66(2)): fine up to CNY 50 million or 5% of the previous year's turnover, suspension of business, revocation of licences, and CNY 100,000 to 1 million on responsible individuals, who can also be barred from serving as director, supervisor, senior manager or personal information protection officer.

Public bodies

No fines on state organs: under PIPL Article 68 the superior authority orders rectification and the directly responsible officials are disciplined.

National specifics

Criminal liability runs in parallel: Criminal Law Article 253-1 (infringing citizens' personal information) carries up to three years' imprisonment, or three to seven years in particularly serious cases. Large cases are often decided under several laws at once (PIPL, Cybersecurity Law, Data Security Law), as in the Didi decision.

Appeals

First court

A penalty decision can be challenged by administrative reconsideration (to the reviewing authority under the Administrative Reconsideration Law) or by administrative litigation in the people's courts under the Administrative Litigation Law.

Deadline

Generally 60 days to apply for reconsideration and six months to sue in court from the time the party knew of the decision (general administrative law rules; not confirmed for every CAC decision).

Does it hold payment?

Generally not suspensive: the decision remains enforceable during reconsideration or litigation unless the authority or court orders a stay.

Further appeal

Two-instance court system: first instance in an intermediate or basic people's court, appeal to the higher court. Contested administrative appeals against CAC penalties are rarely reported.

If the authority does nothing

Not confirmed. A complainant has no specific PIPL route to challenge a regulator's refusal to act; general administrative litigation for failure to perform a statutory duty may be possible in principle.

Suing the organisation directly

Courts

Individuals can sue handlers in the people's courts for infringement of personal information rights (PIPL Article 69, Civil Code Articles 1032 to 1039) and, under Article 50, for refusal of rights requests.

Compensation

Fault is presumed: a handler that cannot prove it was not at fault must compensate, measured by the individual's loss or the handler's gain, or as the court determines (Article 69). No statutory minimum damages; awards reported so far are small.

Collective actions

Article 70 lets the people's procuratorates, consumer organisations designated by law and organisations designated by the CAC bring public interest litigation where many individuals' rights are infringed. Procuratorates are the most active claimants; there is no opt-out damages class action.

The authority

Name

Personal Information Protection Commission (개인정보보호위원회, PIPC) Website

How it is organised

Central administrative agency under the Prime Minister with a chair, vice-chair and commissioners deciding as a collegial commission; since August 2020 it is the single privacy regulator for both public and private sectors.

Regional authorities

No regional authorities. The Korea Internet and Security Agency (KISA) runs the Personal Information Infringement Report Center (phone 118) and supports investigations; the PIPC's Personal Information Dispute Mediation Committee handles individual and collective mediation; the Korea Consumer Agency's Consumer Dispute Settlement Commission also mediates mass claims; police and prosecutors handle criminal offences.

National law

Personal Information Protection Act (PIPA, 2011), with major amendments in force 15 September 2023 (turnover-based surcharge, single regime for online and offline) and an amendment dated 10 March 2026 whose main provisions took effect on 11 September 2026 (surcharge up to 10% in aggravated cases). Sector laws such as the Credit Information Act and Location Information Act also apply. Text

Complaining

How

Individuals report infringements online to the Personal Information Infringement Report Center run by KISA (privacy.kisa.or.kr) or by calling 118, free of charge and in Korean (PIPA Article 62). For compensation they can instead apply to the Personal Information Dispute Mediation Committee.

Contact the organisation first?

Not required for a report to the PIPC or KISA.

Deadlines

No statutory deadline for handling infringement reports was confirmed. The Dispute Mediation Committee must prepare a draft mediation within a fixed period (60 days under Article 44, extendable; not confirmed against the current text).

The complainant's position

The reporter is not a party to PIPC enforcement proceedings; in mediation the applicant is a party and decides whether to accept.

Procedure

1. Report to KISA, breach notification, media reports or the PIPC's own initiative.
2. Fact-finding and investigation with requests for materials and on-site inspections (Article 63).
3. Plenary commission deliberation and decision: corrective recommendation or corrective order (Article 64), penalty surcharge (Article 64-2), administrative fine (Article 75), publication of the violation and the measures (Article 66).
4. Referral of criminal offences to investigative authorities and recommendation of disciplinary action against responsible officers (Article 65).

Who decides

The PIPC plenary meeting decides surcharges and orders.

Limitation

Not confirmed.

Fines

Who imposes them

The PIPC imposes penalty surcharges itself by administrative decision (map: regulator). Since 15 September 2023 the cap is 3% of total turnover, excluding revenue unrelated to the violation (Article 64-2), with a fixed cap (understood to be KRW 2 billion) where turnover is absent or hard to calculate. Since 11 September 2026 the cap rises to 10% of total turnover for repeated wilful or grossly negligent violations within three years, violations affecting 10 million or more data subjects, or failure to comply with a corrective order.

Public bodies

Public institutions are subject to corrective orders, publication and administrative fines; whether surcharges can be imposed on central government bodies was not confirmed.

National specifics

Administrative fines (gwataeryo, Article 75) are separate from surcharges and capped in the tens of millions of won (for example up to KRW 30 million for breach of a corrective order). Criminal offences carry up to five years' imprisonment or KRW 50 million for unlawful provision of personal information to third parties.

Appeals

First court

An administrative appeal under the Administrative Appeals Act, or an administrative lawsuit in the Seoul Administrative Court under the Administrative Litigation Act.

Deadline

90 days from receipt of the written decision.

Does it hold payment?

Not suspensive by default; the company must apply to the court for a stay of execution.

Further appeal

Seoul High Court on appeal, then the Supreme Court.

If the authority does nothing

Not confirmed. In practice individuals who are dissatisfied turn to dispute mediation or civil suits rather than challenging the PIPC.

Suing the organisation directly

Courts

Civil courts. Article 39 reverses the burden of proof: the controller must show it was not intentional or negligent.

Compensation

Actual damages, punitive damages of up to five times the loss for intentional or negligent leaks (Article 39(3)), or statutory damages of up to KRW 3 million per person without proof of loss (Article 39-2).

Collective actions

Collective dispute mediation through the Dispute Mediation Committee (Article 49), whose accepted outcome has the effect of a court settlement; a group action (Article 51) can be brought by qualifying consumer or non-profit organisations, but only for an injunction and only after collective mediation fails. There is no damages class action, so victims bring mass joint lawsuits.

The authority

Name

Personal Information Protection Commission (個人情報保護委員会, PPC) Website

How it is organised

Independent administrative commission (chair and commissioners) attached to the Cabinet Office; since 2022 to 2023 it supervises both the private sector and public bodies under a single APPI.

Regional authorities

No regional DPAs for the private sector. Other bodies matter in practice: the Ministry of Internal Affairs and Communications issues administrative guidance under the Telecommunications Business Act (as with LY Corporation in 2024), the Japan Fair Trade Commission handles platform conduct, accredited personal information protection organisations handle complaints for member businesses, and police and public prosecutors handle APPI offences.

National law

Act on the Protection of Personal Information (APPI, Act No. 57 of 2003), fully in force April 2005, with major amendments in force 2017, April 2022 (2020 amendment) and 2022 to 2023 (public sector integration). A further amendment introducing an administrative surcharge was passed by the Diet on 10 July 2026 and promulgated on 17 July 2026; it enters into force within two years of promulgation and was not yet in force on 2 October 2026. Text

Complaining

How

There is no formal complaint-and-decision procedure. Individuals can call the PPC's APPI consultation line, in Japanese, free of charge, and the PPC uses the information to decide whether to act; complaints can also go to an accredited personal information protection organisation if the business is a member.

Contact the organisation first?

Not a legal precondition for contacting the PPC, but the system expects it: businesses must endeavour to handle complaints properly and promptly (APPI complaint-handling duty), and a court claim for disclosure, correction or cessation of use requires a prior request to the business.

Deadlines

No statutory deadline for the PPC to deal with a consultation or complaint was confirmed.

The complainant's position

The individual is an information source, not a party; the PPC does not issue a decision on the individual's complaint.

Procedure

1. Information gathering from consultations, breach reports (mandatory since April 2022) or the PPC's own monitoring.
2. Request for reports and on-site inspection (APPI Article 146).
3. Guidance and advice (Article 147), the most common outcome, sometimes published.
4. Recommendation (Article 148(1)) to stop the violation or take corrective measures, usually with periodic progress reports.
5. Order (Article 148(2)) if a recommendation is not followed without justifiable grounds and serious infringement is imminent, or an emergency order (Article 148(3)); orders can be published. Breach of an order is a criminal offence referred for prosecution.

Who decides

The PPC as a collegial commission; criminal penalties are decided by the criminal courts after prosecution by public prosecutors.

Limitation

Not confirmed: no specific APPI limitation period for PPC action was found; criminal offences follow the general rules of the Code of Criminal Procedure.

Fines

Who imposes them

Today the PPC cannot impose monetary penalties. Money penalties come only through criminal prosecution: breach of a PPC order carries up to one year's imprisonment or a fine up to JPY 1 million for individuals (Article 178) and a fine up to JPY 100 million for the company (Article 184); false reporting carries a fine up to JPY 500,000 (map: court). The 2026 amendment adds an administrative surcharge imposed by the PPC itself (new Articles 148-3 to 148-17), equal to the financial benefit from certain designated serious violations, with exemptions for small-scale cases (reported as fewer than 1,000 individuals affected), reasonable care or insignificant harm; it will start within two years of 17 July 2026.

Public bodies

Administrative organs and local governments are covered by the APPI since the 2021 reform took effect, but the PPC's tools against them are requests for reports and recommendations rather than penalties (article numbers not confirmed).

National specifics

Unlawfully providing a personal information database for illicit gain is itself an offence (up to one year or JPY 500,000 for individuals, up to JPY 100 million for companies). The 2026 amendment also raises criminal maxima and adds offences such as obtaining personal information by fraud or violence (Articles 178 to 180 as amended; amounts not confirmed).

Appeals

First court

A PPC order is an administrative disposition: it can be challenged by a request for review under the Administrative Complaint Review Act or by a revocation suit in the district court under the Administrative Case Litigation Act. Whether guidance and recommendations are challengeable dispositions is doubtful (not confirmed).

Deadline

Generally three months for a request for review and six months for a revocation suit from knowledge of the disposition (general administrative law rules).

Does it hold payment?

Not suspensive by default; a stay of execution must be requested separately.

Further appeal

High court appeal and final appeal to the Supreme Court. No reported court challenge to a PPC order was found.

If the authority does nothing

No specific remedy: since there is no complaint decision, an individual cannot appeal PPC inaction and must instead sue the business directly.

Suing the organisation directly

Courts

District courts (summary courts for small claims). Individuals sue in tort under Civil Code Article 709 for privacy infringement, and can sue to enforce APPI rights to disclosure, correction and cessation of use after first making the request to the business.

Compensation

Ordinary compensatory and consolation damages only; no statutory or punitive damages. Awards in data leak cases are typically small per person (for example the Benesse leak litigation; amounts not confirmed here).

Collective actions

No general privacy class action. Japan's consumer collective redress scheme is narrow; giving qualified consumer organisations injunction and damages claims for APPI breaches was discussed in the triennial review, but its adoption was not confirmed in the 2026 amendment.

The authority

Name

Personal Data Protection Committee, supported by the Office of the Personal Data Protection Commission and expert committees (คณะกรรมการคุ้มครองข้อมูลส่วนบุคคล (สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล), PDPC) Website

How it is organised

A committee chaired by an appointed expert with ex officio government members, working within the remit of the Ministry of Digital Economy and Society, served by a government office. Complaints and fines are handled by expert committees appointed by the PDPC, which can order remedies and impose administrative fines.

Regional authorities

No regional regulators. The police and public prosecutors handle the criminal offences; the PDPC runs a 'PDPC Eagle Eye' unit that works with police and other authorities on breaches and data leaks.

National law

Personal Data Protection Act B.E. 2562 (2019), published 27 May 2019, fully in force 1 June 2022 after two postponements Text

Complaining

How

Complaint to the Office of the PDPC, which passes it to an expert committee; details of the form, fee and language were not confirmed.

Contact the organisation first?

Not confirmed.

Deadlines

Not confirmed.

The complainant's position

Not confirmed; the expert committee can mediate between the parties or order the controller to act.

Procedure

1. Complaint, breach notification (72 hours) or own-initiative inquiry, including through the PDPC Eagle Eye unit.
2. Examination by an expert committee, which may mediate or reject the complaint.
3. Expert committee order to the controller or processor (for example to remedy security or stop processing) and administrative fine.
4. Separate criminal prosecution and civil claims in the courts.

Who decides

The expert committees decide complaints and impose administrative fines; the PDPC announces the outcomes.

Limitation

Not confirmed for administrative fines.

Fines

Who imposes them

Expert committees under the PDPC impose administrative fines themselves (sections 82 to 90), so the map value is regulator. Fines are fixed amounts per violation in tiers up to THB 1 million, 3 million and 5 million (THB 5 million for the most serious, such as sensitive data breaches), but several violations can be stacked: a 2024 fine reached THB 7 million.

Public bodies

Yes: in August 2025 a government agency and its software contractor were each fined over THB 150,000 after a breach of about 200,000 records.

National specifics

Criminal offences (section 79 onwards) cover unlawful use or disclosure of sensitive data likely to cause harm (up to 6 months and/or THB 500,000) or for unlawful gain (up to 1 year and/or THB 1 million), and directors or managers can be personally liable. Processors are fined directly and sometimes more heavily than controllers.

Appeals

First court

Not confirmed from the statute; as administrative orders of state officials, expert committee orders and fines are generally challengeable in the Administrative Court.

Deadline

Not confirmed.

Does it hold payment?

Not confirmed.

Further appeal

Supreme Administrative Court (general route; not confirmed in a PDPA case).

If the authority does nothing

Not confirmed.

Suing the organisation directly

Courts

Yes: controllers and processors are liable in civil courts for damage caused by non-compliance unless they prove force majeure or the data subject's own act (section 77).

Compensation

Actual damages plus punitive damages of up to twice the actual damages (section 78); limitation reported as 3 years from knowledge of the damage and the liable person or 10 years from the violation (not confirmed from the statute text).

Collective actions

Class actions are available under the Civil Procedure Code; no PDPA class action confirmed.

The authority

Name

Ministry of Public Security, Department of Cybersecurity and High-Tech Crime Prevention (Bộ Công an, Cục An ninh mạng và phòng, chống tội phạm sử dụng công nghệ cao, MPS / A05) Website

How it is organised

A police ministry department, not an independent authority. The MPS is the state management focal point for personal data protection (Article 36 PDPL); A05 receives impact assessments and transfer filings, runs the national personal data protection portal and investigates.

Regional authorities

Provincial police units act under the MPS. The police also investigate the criminal offence of illegally trading or using personal data, and sector ministries keep their own rules.

National law

Law on Personal Data Protection No. 91/2025/QH15, adopted 26 June 2025, in force 1 January 2026; implementing Decree 356/2025/ND-CP (in force 1 January 2026, replacing Decree 13/2023/ND-CP of 17 April 2023, which applied from 1 July 2023); sanctions Decree 330/2026/ND-CP dated 19 August 2026 Text

Complaining

How

Data subjects may file complaints and denunciations, sue and claim compensation (Article 4 PDPL). Violations can be reported to the MPS, including through the national personal data protection portal; general complaints follow the Law on Complaints and Law on Denunciations.

Contact the organisation first?

Not confirmed as a requirement before going to the MPS.

Deadlines

Not confirmed for data protection complaints specifically.

The complainant's position

Not confirmed; under Vietnamese administrative law a denouncer is informed of the outcome but is not a party to the sanction proceedings.

Procedure

1. Report, denunciation or own-initiative inspection by the MPS (A05 or provincial police), often triggered by an incident or a filed impact assessment.
2. Record of administrative violation drawn up by a competent officer.
3. Sanction decision under Decree 330/2026/ND-CP, with fines and remedial measures such as deletion of data or suspension of processing.
4. Where the conduct is a crime, transfer for criminal investigation and prosecution under the Penal Code.

Who decides

Competent officers of the MPS and police impose administrative fines by decision under the Law on Handling of Administrative Violations; the full list of competent officers in Decree 330 was not confirmed.

Limitation

1 year for administrative sanctions in cybersecurity and personal data protection (Decree 330/2026/ND-CP, Article 3(1)).

Fines

Who imposes them

The MPS imposes fines itself by administrative decision under Decree 330/2026/ND-CP (issued and in force 19 August 2026), so the map value is regulator. Maximums (Article 8 PDPL): 5% of the previous year's revenue for unlawful cross-border transfers, 10 times the proceeds for buying or selling personal data, and VND 3 billion for other violations by organisations, with individuals facing half; Decree 330 sets lower bands for specific breaches (for example up to VND 70 million for consent failures).

Public bodies

Not confirmed.

National specifics

Before Decree 330 the PDPL and Decree 13/2023 had no penalty schedule of their own; only scattered personal information breaches were fineable under the older telecoms and information sanctions decree (Decree 15/2020). Criminal liability for illegal provision or use of information on networks (Penal Code Article 288) carries fines of VND 30 million to 1 billion or 6 months to 7 years' imprisonment per secondary sources. Small enterprises and start-ups get a five-year deferral of some assessment duties.

Appeals

First court

A sanctioned party can file an administrative complaint with the official who issued the decision under the Law on Complaints, or sue in the People's Court under the Law on Administrative Procedure (the court level after the 2025 court reorganisation was not confirmed).

Deadline

Not confirmed for data protection decisions; general administrative law gives 1 year to sue, not confirmed specifically here.

Does it hold payment?

Not confirmed; under general Vietnamese administrative law a complaint or lawsuit normally does not suspend execution.

Further appeal

Appeal within the People's Court system; not confirmed in detail.

If the authority does nothing

Not confirmed.

Suing the organisation directly

Courts

Yes: Article 4 PDPL lets data subjects sue and claim compensation, and Article 8 says violators causing damage must compensate, in the ordinary People's Courts under the Civil Code.

Compensation

Actual damages under the Civil Code rules on non-contractual liability; no statutory damages confirmed.

Collective actions

Not confirmed; Vietnam has no general class action procedure (not confirmed).

The authority

Name

National Privacy Commission (Pambansang Komisyon sa Pagkapribado (National Privacy Commission), NPC) Website

How it is organised

Independent body attached to the Department of Information and Communications Technology for budget purposes, headed by a Privacy Commissioner and two deputies. It adjudicates complaints as a quasi-judicial body, runs own-motion (sua sponte) investigations and compliance checks, and imposes administrative fines.

Regional authorities

No regional regulators. The Department of Justice prosecutes the criminal offences in the Data Privacy Act on NPC recommendation or direct complaint; sector regulators such as the central bank (BSP) supervise data security in finance.

National law

Data Privacy Act of 2012 (Republic Act No. 10173), with its 2016 Implementing Rules and Regulations; NPC Circular 2022-01 on administrative fines in force from 27 August 2022 Text

Complaining

How

Notarised complaints-assisted form or verified complaint with evidence and witness affidavits, filed with the NPC (online channels and email are offered); forms exist in English and Filipino. Applications for a temporary ban on processing can be filed alongside.

Contact the organisation first?

Yes: the complainant must first inform the organisation in writing and may file only if it does not respond within 15 calendar days (or responds inadequately).

Deadlines

No specific filing deadline beyond the Act No. 3326 prescription periods the NPC applies. The investigating officer reports within 30 days of the last memoranda; the Commission must decide breach matters within 30 days, with no fixed deadline for other complaints.

The complainant's position

Full party: the complainant and respondent litigate before an investigating officer and the Commission, and the NPC can award damages, including nominal damages, to the complainant.

Procedure

1. Complaint after exhausting the 15-day step with the organisation, or NPC sua sponte investigation, breach notification or compliance check.
2. Evaluation by an investigating officer: dismissal or continuation; mediation is offered in suitable cases.
3. Adversarial proceedings with submissions, possibly e-hearings, then a decision by the Commission en banc.
4. Orders (compliance, cease and desist, temporary ban), administrative fines after notice and hearing, damages, and recommendation of criminal prosecution to the Department of Justice.
5. Motion for reconsideration to the NPC, then appeal to the courts.

Who decides

The Commission (Privacy Commissioner and deputies) decides and imposes fines by administrative decision.

Limitation

The NPC applies the prescription periods for offences under special laws in Act No. 3326, which vary with the penalty (2021 Rules of Procedure).

Fines

Who imposes them

The NPC imposes administrative fines itself under Circular 2022-01, so the map value is regulator. Grave infractions carry 0.5% to 3% and major infractions 0.25% to 2% of annual gross income, with fixed amounts of PHP 50,000 to 200,000 for other infractions, but the total for a single act may not exceed PHP 5 million, so the binding ceiling is a fixed amount (map value fixed).

Public bodies

Government agencies are personal information controllers under the Act and are not excluded from Circular 2022-01; whether the NPC has fined one was not confirmed. The NPC has recommended prosecution of public officials (COMELEC).

National specifics

Criminal offences in sections 25 to 33 of the Act (unauthorised processing, negligent access, improper disposal, concealment of breaches, malicious disclosure) carry 6 months to 7 years' imprisonment and fines of PHP 100,000 to 5 million, prosecuted by the DOJ before the regular courts; responsible officers of companies can be jailed. The NPC also issues cease and desist orders and temporary bans.

Appeals

First court

After a motion for reconsideration, an NPC decision is appealed 'to the proper courts' (2021 Rules of Procedure, Rule VIII s 7); in practice this is a petition for review to the Court of Appeals, which upheld the NPC in Pieceland Corporation v Manila New Life Church (14 December 2021).

Deadline

NPC decisions become final 15 calendar days after notice unless one motion for reconsideration is filed within that period (2021 Rules of Procedure); a petition for review under Rule 43 is generally due within 15 days (not stated in NPC rules).

Does it hold payment?

No: decisions imposing fines are immediately executory unless restrained by a court, and an appellant must post a bond equal to the fine to stay enforcement (Circular 2022-01).

Further appeal

Supreme Court on a petition for review (general route; not confirmed in an NPC case).

If the authority does nothing

A complainant whose complaint is dismissed may move for reconsideration and then appeal; no specific remedy for inaction confirmed.

Suing the organisation directly

Courts

Yes: data subjects have a statutory right to damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information (section 16(f)), claimable before the NPC or in the regular courts; the writ of habeas data is also available from the courts.

Compensation

Actual, moral and nominal damages under general civil law; the NPC has awarded nominal damages in complaint decisions. No statutory damages.

Collective actions

Class actions are possible but rare according to secondary sources; not confirmed in a decided data privacy case.

The authority

Name

Personal Data Protection Commission (Personal Data Protection Commission, PDPC) Website

How it is organised

Statutory commission administered within the Info-communications Media Development Authority (IMDA), so it is a government body rather than an independent authority in the EU sense. It handles complaints, investigates, issues directions and imposes financial penalties itself, and also enforces the Do Not Call rules.

Regional authorities

No regional regulators. Public agencies are outside the PDPA and are governed by the Public Sector (Governance) Act 2018 and internal government rules; sector regulators such as the Monetary Authority of Singapore impose their own data and technology risk requirements.

National law

Personal Data Protection Act 2012 (PDPA), data protection obligations in force 2 July 2014; amended by the Personal Data Protection (Amendment) Act 2020 (mandatory breach notification and offences from 1 February 2021; higher financial penalty cap of 10% of Singapore turnover from 1 October 2022) Text

Complaining

How

Online 'raise a data protection concern' form on the PDPC website, free of charge, in English. The PDPC assesses each concern and decides whether to facilitate a resolution, refer it to mediation, investigate or take no further action.

Contact the organisation first?

Encouraged in practice: individuals are expected to raise the issue with the organisation first, and the PDPC may redirect concerns that have not been raised with the organisation. A strict statutory requirement was not confirmed.

Deadlines

Not confirmed: no statutory time limit for lodging a concern or for the PDPC to decide was found.

The complainant's position

The complainant is a source of information rather than a party; the investigation and any decision are between the PDPC and the organisation. A person aggrieved by a PDPC direction or decision can seek reconsideration (s 48N) or appeal (s 48Q), which are alternatives (s 48Q(3)), and a final PDPC finding supports a private action under s 48O.

Procedure

1. Concern lodged or PDPC starts its own investigation, often after a mandatory breach notification (Part 6A, 3 calendar days after assessing a notifiable breach).
2. Preliminary assessment: facilitation with the organisation, referral to mediation, or a formal investigation under s 48I.
3. Organisation may offer a voluntary undertaking (s 48L) or accept the expedited decision procedure by admitting the breach.
4. PDPC decision: finding of breach, directions (for example to fix security measures) and, where warranted, a financial penalty under s 48J; most decisions are published.
5. Reconsideration by the PDPC (s 48N) or appeal to the Data Protection Appeal Panel (s 48Q), then the High Court (s 48R).

Who decides

The Commission (in practice the Commissioner and deputy commissioners within IMDA) decides and imposes the penalty by administrative direction, without going to court.

Limitation

Not confirmed: no statutory limitation period for PDPC enforcement was found.

Fines

Who imposes them

The PDPC imposes financial penalties itself by direction under s 48J, so the map value is regulator. Since 1 October 2022 the maximum is SGD 1 million or 10% of the organisation's annual turnover in Singapore where that turnover exceeds SGD 10 million, whichever is higher (turnover-based). Section 48J(6) lists the factors the PDPC must weigh, and the PDPC applied a five-step culpability and harm method in Marina Bay Sands (2025).

Public bodies

No. The PDPA does not apply to public agencies; public officers face criminal offences under the Public Sector (Governance) Act 2018 instead.

National specifics

Individuals commit offences for knowing or reckless unauthorised disclosure, improper use and re-identification of personal data (ss 48D to 48F), with fines of up to SGD 5,000 and/or imprisonment of up to 2 years, prosecuted in the criminal courts. Directions to stop collecting, to destroy data or to comply with obligations are common, and penalty decisions are published by name.

Appeals

First court

An aggrieved organisation or person, including the complainant, may either apply to the PDPC for reconsideration (s 48N) or appeal to an Appeal Committee of the Data Protection Appeal Panel (s 48Q); a reconsideration decision can itself be appealed, and applying for reconsideration withdraws any pending appeal (s 48Q(3)). Appeal Committee decisions go to the General Division of the High Court on a point of law or on the amount of a financial penalty (s 48R).

Deadline

The prescribed period, reported as 28 days, for both a reconsideration application (s 48N(4)) and an appeal to the Appeal Panel (s 48Q); the PDPC may extend the reconsideration period in exceptional circumstances (s 48N(5)).

Does it hold payment?

No for directions, yes for penalties: unless the PDPC or the Appeal Committee decides otherwise, a reconsideration application or appeal does not suspend a direction, but one against a financial penalty does (ss 48N(3), 48Q(4)).

Further appeal

From the High Court a further appeal lies to the Court of Appeal, as in Bellingham v Reed (a private action case).

If the authority does nothing

Any organisation or individual aggrieved by a PDPC direction or decision can seek reconsideration and appeal under ss 48N and 48Q; there is no specific remedy for inaction other than judicial review in the High Court (not confirmed as used).

Suing the organisation directly

Courts

Yes: s 48O gives a statutory right of private action for loss or damage suffered directly from a contravention of the main data protection obligations, heard in the ordinary civil courts (State Courts or High Court depending on value). Where the PDPC has already made a decision on the same matter, the action can only be brought once that decision is final after any appeal.

Compensation

Damages, injunctions and declarations are available. In Bellingham v Reed [2022] SGCA 60 the Court of Appeal held that loss of control of data alone is not enough but emotional distress can count as loss; Piper v Singapore Kindness Movement [2025] SGHC 173 stressed a strict causal link. No statutory damages.

Collective actions

No dedicated class action regime; representative actions under the Rules of Court are possible in principle but no PDPA class action was confirmed.

The authority

Name

Personal Data Protection Agency (not yet established); interim: Ministry of Communication and Digital Affairs (Lembaga Pelindungan Data Pribadi (not yet established); interim: Kementerian Komunikasi dan Digital (Komdigi), Lembaga PDP (planned); Komdigi (interim)) Website

How it is organised

The PDP Law foresees an agency set up by the President and answerable to the President (Articles 58 to 61), not an independent authority. As of October 2026 the Presidential Regulation creating it has not been issued and the agency does not exist; Komdigi (the former Kominfo, renamed in October 2024), through its Directorate General of Digital Space Supervision, supervises electronic system operators in the meantime.

Regional authorities

Sector regulators enforce their own confidentiality rules, notably the Financial Services Authority (OJK) for banks and capital markets. The police and public prosecutors enforce the criminal offences in the PDP Law and the Electronic Information and Transactions (ITE) Law.

National law

Law No. 27 of 2022 on Personal Data Protection (UU PDP), enacted 17 October 2022 with a two-year transition, fully applicable from 17 October 2024; implementing Government Regulation No. 33 of 2026, signed 16 July 2026 and in force 16 January 2027 Text

Complaining

How

Not confirmed: with no PDP agency, there is no dedicated PDP complaint channel. In practice individuals complain to Komdigi about electronic system operators, to OJK for financial institutions, or report criminal conduct to the police.

Contact the organisation first?

Not confirmed as a legal requirement; data subjects have rights to request access, correction and erasure from the controller directly (Articles 5 to 13).

Deadlines

Not confirmed.

The complainant's position

Not confirmed; the agency's complaint procedure is to be set out in GR 33/2026 and future agency regulations.

Procedure

1. Today: Komdigi can act against electronic system operators under the older electronic systems rules (GR 71/2019), with warnings, suspension, access blocking or deregistration.
2. Criminal route: police investigation and prosecution under Articles 67 to 70 of the PDP Law, decided by the District Court.
3. Once the agency exists: supervision, investigation and administrative sanctions under Article 57, with an objection to the agency within 14 working days of a sanction decision (GR 33/2026), then the State Administrative Court.

Who decides

Administrative sanctions under the PDP Law will be imposed by the PDP agency; criminal penalties by the District Courts on prosecution.

Limitation

Not confirmed.

Fines

Who imposes them

No body can currently impose the PDP Law's administrative fines because the agency does not exist, so penalties come in practice through criminal prosecution in the courts (map value court). Once operational, the agency may impose fines of up to 2% of annual income or revenue (Article 57; GR 33/2026 Article 185 refers to gross revenue), alongside warnings, suspension of processing and data deletion.

Public bodies

Not confirmed. The PDP Law applies to public bodies as controllers, but whether the agency can fine them is not confirmed.

National specifics

Criminal offences cover unlawful collection, disclosure and use of personal data and creating false personal data (Articles 67 and 68), with 4 to 6 years' imprisonment. Law No. 1 of 2026 (penalty adjustment for the new Criminal Code, in force 2 January 2026) cut the maximum fines from IDR 4 to 6 billion to IDR 200 million, or IDR 500 million for false data; corporations face up to ten times the fine plus measures such as licence revocation or dissolution (Article 70).

Appeals

First court

Sanction decisions of the future agency go first to an objection to the agency, then to the State Administrative Court (PTUN) under GR 33/2026. Criminal convictions follow the ordinary route: District Court, High Court, Supreme Court.

Deadline

Objection within 14 working days of the sanction decision (GR 33/2026, in force 16 January 2027); court deadlines not confirmed.

Does it hold payment?

Not confirmed.

Further appeal

State Administrative High Court and Supreme Court on cassation (general administrative law route; not confirmed specifically for PDP cases).

If the authority does nothing

A Constitutional Court petition (case 236/PUU-XXII/2024) seeking to compel the government to set up the agency was pending as of September 2026. No other remedy for regulator inaction confirmed.

Suing the organisation directly

Courts

Yes: data subjects have a right to sue and receive compensation for breaches (Article 12), through the District Courts, arbitration or other dispute resolution (Article 64), and general tort liability under the Civil Code also applies.

Compensation

Compensation for loss under Article 12 and the Civil Code; no statutory damages.

Collective actions

Class actions are possible under Supreme Court Regulation No. 1 of 2002 on class action procedure; no PDP-specific class action confirmed.

The authority

Name

Office of the Australian Information Commissioner (Office of the Australian Information Commissioner, OAIC) Website

How it is organised

Independent Commonwealth statutory agency headed by the Australian Information Commissioner, with a Privacy Commissioner. It handles complaints, runs investigations, makes determinations and brings civil penalty proceedings in the Federal Court.

Regional authorities

States and territories have their own regulators for state public sector bodies (for example NSW and Victorian information commissioners). Sector schemes also matter in practice: external dispute resolution schemes for finance, telecoms and utilities must usually be used before the OAIC, and the ACCC enforces consumer law against misleading privacy claims.

National law

Privacy Act 1988 (Cth), with the 13 Australian Privacy Principles (APPs) and the Notifiable Data Breaches scheme (Part IIIC); amended by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (higher penalties, in force 13 December 2022) and the Privacy and Other Legislation Amendment Act 2024 (in force 10 December 2024; statutory tort from 10 June 2025; automated decision transparency duties from 10 December 2026) Text

Complaining

How

Online complaint form on the OAIC website, free of charge, in English. The complaint must name the entity, describe the issue with dates and impact, and include evidence of the earlier complaint to the entity.

Contact the organisation first?

Yes. The individual must first complain to the organisation or agency and give it 30 days to respond; where an approved external dispute resolution scheme applies (banking, insurance, superannuation, telecoms, energy and water) that scheme should be used first.

Deadlines

The OAIC may decline a complaint made more than 12 months after the complainant became aware of the act (s 41). There is no statutory deadline for the OAIC; it states it is unlikely to substantially progress new complaints for around 6 to 12 months after lodgement.

The complainant's position

The complainant is a party to conciliation and to any s 52 determination, and can receive a compensation award. The OAIC can decline or stop investigating on discretionary grounds (s 41), for example where the matter is low impact or better dealt with by an EDR scheme.

Procedure

1. Complaint to the entity first, then complaint to the OAIC, or a Commissioner-initiated investigation (s 40(2)) often following a notifiable data breach
2. Preliminary inquiries and assessment; the OAIC may decline under s 41
3. Conciliation between complainant and entity, which resolves most complaints
4. Investigation, which may end in a determination under s 52 (declarations, orders to stop conduct, take steps or pay compensation) or an enforceable undertaking (s 33E)
5. For serious matters, civil penalty proceedings in the Federal Court; since December 2024 the OAIC can also issue infringement notices and compliance notices for specified lower-level breaches

Who decides

The Information Commissioner decides complaints and determinations. Only the Federal Court (or Federal Circuit and Family Court) can order a civil penalty; infringement notices issued by the OAIC are a payable alternative that the entity can instead contest in court.

Limitation

Civil penalty proceedings must generally be brought within 6 years of the contravention under the Regulatory Powers (Standard Provisions) Act 2014 (not confirmed against the primary text this session).

Fines

Who imposes them

Regulator-court: the OAIC investigates but cannot fine for serious breaches itself; it must apply to the Federal Court, which sets the civil penalty. For a serious interference with privacy (s 13G) the maximum for a body corporate is the greatest of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover during the breach period (since 13 December 2022). The 2024 Act added a mid-tier civil penalty for interferences that are not serious (s 13H) and an administrative tier (s 13K) for specified APP and privacy policy failures that the OAIC can enforce by infringement notice without going to court.

Public bodies

Australian Government agencies are bound by the APPs and can be subject to determinations; whether civil penalties are pursued against Commonwealth agencies in practice was not confirmed. Most small businesses with annual turnover of AUD 3 million or less remain exempt.

National specifics

The infringement notice amounts and the s 13H maximum are set in penalty units; exact dollar figures were not confirmed from a primary source this session. The court counts contraventions per affected individual, so exposure in breach cases is cumulative. Doxxing became a criminal offence under the Criminal Code in 2024 (up to 6 or 7 years imprisonment depending on the offence, secondary source).

Appeals

First court

Civil penalties are set by the Federal Court, so a challenge is an appeal to the Full Federal Court and then, with special leave, the High Court. OAIC determinations and other administrative decisions are challenged by judicial review in the Federal Court or Federal Circuit and Family Court.

Deadline

Not confirmed for each route (court rules set the time limits).

Does it hold payment?

Not confirmed. A s 52 determination against a private entity is not self-executing: the complainant or the OAIC must apply to the Federal Court to enforce it (s 55A), and the court hears the matter afresh.

Further appeal

Full Federal Court, then High Court of Australia by special leave.

If the authority does nothing

There is no merits appeal against the OAIC's discretionary decision to decline or stop investigating; the remedy is judicial review on legal grounds, or since June 2025 suing directly under the statutory tort where its conditions are met.

Suing the organisation directly

Courts

Limited. There is no general right to sue for breach of the APPs; compensation comes mainly through OAIC conciliation and determinations. Since 10 June 2025 the Privacy Act (Schedule 2) gives individuals a statutory tort for serious invasions of privacy, intentional or reckless, in the Federal Court, Federal Circuit and Family Court or state and territory courts. The first cases were filed in 2025 (Groth v Herald and Weekly Times, settled; Kurraba Group v Williams, NSW District Court interlocutory injunction).

Compensation

Under the tort, damages including for emotional distress, injunctions and other remedies; non-economic damages are capped (exact cap not confirmed). Under s 52 the OAIC can award compensation, including for injury to feelings.

Collective actions

Representative complaints can be made to the OAIC (s 38). Class actions under Part IVA of the Federal Court of Australia Act are active after major breaches, usually pleaded in contract, negligence or consumer law (for example against Medibank and Optus).