40 cybersecurity and privacy laws, regulations and standards across 13 jurisdictions: who each one applies to, what it requires, when breaches must be reported and what the penalties look like. Built for the legal and compliance questions on CISSP, CISM, CISA, CIPP, Security+ and AI governance exams.
Not legal advice - laws change
These are study summaries, not legal advice. Laws are amended, new rules and guidance are issued, and courts reinterpret them. Where a deadline or penalty figure is not certain and stable we describe it in words rather than quote a number. Before relying on anything here, read the official source linked on each page and check the dated, consolidated text that applies to you.
Jurisdiction
Type
Showing 40 of 40
GDPR
General Data Protection Regulation (Regulation (EU) 2016/679)
The EU's core privacy law. It sets the principles for processing personal data, gives individuals enforceable rights and applies outside the EU to organisations that target or monitor people in the EU.
NIS2
NIS2 Directive (Directive (EU) 2022/2555)
The EU's horizontal cybersecurity law. It replaced the original NIS Directive, widened the sectors covered and made senior management directly accountable for cybersecurity risk management.
DORA
Digital Operational Resilience Act (Regulation (EU) 2022/2554)
A single rulebook for ICT risk in EU financial services. It treats operational resilience as a regulatory requirement and brings critical ICT third-party providers, such as major cloud providers, under EU oversight.
EU CRA
Cyber Resilience Act (Regulation (EU) 2024/2847)
Product security law for hardware and software sold in the EU. It makes security a condition of the CE marking, across the whole support period of a product.
EU AI Act
Artificial Intelligence Act (Regulation (EU) 2024/1689)
The first broad AI law. It regulates AI systems by risk level, bans a short list of practices outright and places the heaviest obligations on high-risk systems and their providers.
ePrivacy
ePrivacy Directive (Directive 2002/58/EC)
The 'cookie law'. It protects the confidentiality of electronic communications and sits alongside the GDPR for cookies, tracking and electronic marketing.
CER Directive
Critical Entities Resilience Directive (Directive (EU) 2022/2557)
The physical and all-hazards companion to NIS2. Where NIS2 covers cyber risk, CER covers the resilience of critical entities against natural hazards, terrorism, sabotage and other disruptions.
EU Cybersecurity Act
EU Cybersecurity Act (Regulation (EU) 2019/881)
Gave ENISA, the EU Agency for Cybersecurity, a permanent mandate and created the EU-wide cybersecurity certification framework for ICT products, services and processes.
UK GDPR / DPA 2018
UK GDPR and Data Protection Act 2018
The UK's retained version of the GDPR, read together with the Data Protection Act 2018, which adds exemptions, law enforcement and intelligence processing rules, and the ICO's powers.
UK NIS Regulations
Network and Information Systems Regulations 2018
The UK's implementation of the original EU NIS Directive, kept after Brexit. The UK did not adopt NIS2.
Computer Misuse Act
Computer Misuse Act 1990
The UK's main hacking law. It criminalises unauthorised access to computer material and related acts, and is the reason penetration testers need written authorisation.
PECR
Privacy and Electronic Communications Regulations 2003
The UK implementation of the ePrivacy Directive: rules on cookies, electronic marketing and the security of communications services, enforced by the ICO.
HIPAA
Health Insurance Portability and Accountability Act
US health privacy and security law. Its Security Rule is the classic exam example of administrative, physical and technical safeguards for electronic protected health information (ePHI).
GLBA
Gramm-Leach-Bliley Act
US financial privacy law. It requires financial institutions to explain their information-sharing practices and to protect customer information with a written security program.
SOX
Sarbanes-Oxley Act (IT general controls)
US corporate accountability law passed after the Enron and WorldCom scandals. It is about reliable financial reporting, which in practice drives IT general controls over the systems that produce financial data.
FISMA
Federal Information Security Modernization Act
Requires US federal agencies to run risk-based information security programs. It is why NIST's Risk Management Framework, SP 800-53 controls and authorisations to operate (ATO) exist in their current form.
CIRCIA
Cyber Incident Reporting for Critical Infrastructure Act of 2022
Directs CISA to require critical infrastructure entities to report substantial cyber incidents and ransom payments, so the government can spot campaigns and warn others.
SEC cyber disclosure rules
SEC Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rules
Requires US public companies to disclose material cybersecurity incidents quickly and to describe their cyber risk management and governance every year.
COPPA
Children's Online Privacy Protection Act
US law protecting the personal information of children under 13 online, enforced through the FTC's COPPA Rule.
FERPA
Family Educational Rights and Privacy Act
US law protecting the privacy of student education records at schools that receive US Department of Education funding.
CFAA
Computer Fraud and Abuse Act (18 U.S.C. 1030)
The main US federal anti-hacking statute. It criminalises accessing a computer without authorisation or exceeding authorised access, and gives victims a civil cause of action.
CCPA / CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
The most comprehensive US state privacy law. It gives California residents rights over their personal information and created the California Privacy Protection Agency to enforce it.
NYDFS Part 500
New York DFS Cybersecurity Regulation (23 NYCRR 500)
A prescriptive cybersecurity regulation for financial services firms licensed in New York, often used as a model by other regulators.
201 CMR 17.00
Massachusetts Standards for the Protection of Personal Information (201 CMR 17.00)
One of the first US state rules to require a written information security program (WISP) with specific technical controls for residents' personal information.
DPDP Act
Digital Personal Data Protection Act, 2023
India's first comprehensive data protection law. It is consent-centred and uses its own vocabulary: Data Fiduciaries, Data Processors, Data Principals and Consent Managers.
CERT-In Directions 2022
CERT-In Directions under Section 70B(6) of the IT Act (28 April 2022)
Directions from India's national CERT that set one of the world's shortest incident reporting windows, plus log retention and clock synchronisation duties.
IT Act 2000
Information Technology Act, 2000
India's foundational cyber law. It gives legal recognition to electronic records and signatures, defines cyber offences and creates CERT-In and protected-system powers.
PIPEDA
Personal Information Protection and Electronic Documents Act
Canada's federal private-sector privacy law, built around ten fair information principles and overseen by the Office of the Privacy Commissioner.
Privacy Act 1988 / NDB
Privacy Act 1988 and the Notifiable Data Breaches scheme
Australia's main privacy law. The 13 Australian Privacy Principles govern personal information, and the NDB scheme makes serious breaches reportable.
SOCI Act
Security of Critical Infrastructure Act 2018
Australia's critical infrastructure law, covering eleven sectors after its expansion. It adds asset registration, mandatory cyber incident reporting, risk management programs and government assistance powers.
Singapore PDPA
Personal Data Protection Act 2012
Singapore's general data protection law for the private sector, administered by the Personal Data Protection Commission (PDPC).
Singapore Cybersecurity Act
Cybersecurity Act 2018
Singapore's framework for protecting Critical Information Infrastructure (CII), administered by the Cyber Security Agency of Singapore (CSA).
APPI
Act on the Protection of Personal Information
Japan's main privacy law, overseen by the Personal Information Protection Commission (PPC). The EU and Japan have mutual adequacy arrangements built on it.
PIPL
Personal Information Protection Law of the People's Republic of China
China's comprehensive personal information law. It shares ideas with the GDPR but adds strict cross-border transfer controls and localisation for some handlers.
China CSL
Cybersecurity Law of the People's Republic of China
China's foundational cybersecurity law. It created the Multi-Level Protection Scheme obligations, special duties for critical information infrastructure operators and early data localisation rules.
China DSL
Data Security Law of the People's Republic of China
Covers all data, not only personal data. It introduces a national data classification system with special controls for 'important data' and 'core data'.
LGPD
Lei Geral de Protecao de Dados Pessoais (Law No. 13,709/2018)
Brazil's general data protection law, closely modelled on the GDPR and enforced by the national data protection authority (ANPD).
POPIA
Protection of Personal Information Act 4 of 2013
South Africa's data protection law, enforced by the Information Regulator and built around eight conditions for lawful processing.
PCI DSS
Payment Card Industry Data Security Standard
Not a law. PCI DSS is a contractual industry standard from the PCI Security Standards Council, enforced through card brand rules and merchant and acquirer agreements. Some laws reference it, but its force comes from contracts.
Budapest Convention
Council of Europe Convention on Cybercrime (Budapest Convention, ETS No. 185)
The first international treaty on cybercrime. It harmonises the offences countries criminalise, gives investigators procedural powers and sets up international cooperation, including a 24/7 contact network.