Which countries have data protection and identity regulations?

This guide covers 25 major jurisdictions including the European Union, United States, United Kingdom, Canada, India, Singapore, Australia, Japan, China, South Korea, the UAE, Saudi Arabia, South Africa, Nigeria, Brazil, and Mexico, with 66 regulations in total.

How do data protection laws affect identity and access management?

Most modern privacy and security laws shape identity systems directly: they require consent capture and preference management (CIAM), strong authentication and MFA, least-privilege and access governance, identity verification for rights requests, breach notification, and controls on cross-border transfer of identity data.

Do these regulations require multi-factor authentication?

Some name it explicitly, such as the FTC Safeguards Rule, PSD2 Strong Customer Authentication, NIS2, and DORA. Others, like GDPR and HIPAA, require appropriate security measures that regulators increasingly expect to include MFA for protecting identity data.

Which is the strictest data protection regulation?

The EU GDPR is the global benchmark and inspired many others, but China PIPL, South Korea PIPA, and Quebec Law 25 are among the most prescriptive, especially on consent, cross-border transfer, and data localization.

66 regulations across 25 countries

Identity regulations by country

A vendor-neutral guide to the data protection, privacy, and security regulations that shape identity and access management around the world. Pick a country to see its regulations, and open any regulation to see what it requires and how it impacts each identity category: authentication, consent, governance, privileged access, verification, data residency, audit, and breach response.

This is an educational summary, not legal advice. Each regulation links to its official source. Always confirm current requirements with the relevant authority or counsel.

Calendar · subscribable

Identity Compliance Calendar 2026-2028

Every dated identity deadline from these laws on one timeline, with an .ics feed for Outlook and Google Calendar.

Europe

3 countries

North America

2 countries

Asia-Pacific

10 countries

Middle East

4 countries

Africa

3 countries

Latin America

3 countries

Identity regulations: frequently asked questions

Which countries have data protection and identity regulations?: This guide covers 25 major jurisdictions including the European Union, United States, United Kingdom, Canada, India, Singapore, Australia, Japan, China, South Korea, the UAE, Saudi Arabia, South Africa, Nigeria, Brazil, and Mexico, with 66 regulations in total.
How do data protection laws affect identity and access management?: Most modern privacy and security laws shape identity systems directly: they require consent capture and preference management (CIAM), strong authentication and MFA, least-privilege and access governance, identity verification for rights requests, breach notification, and controls on cross-border transfer of identity data.
Do these regulations require multi-factor authentication?: Some name it explicitly, such as the FTC Safeguards Rule, PSD2 Strong Customer Authentication, NIS2, and DORA. Others, like GDPR and HIPAA, require appropriate security measures that regulators increasingly expect to include MFA for protecting identity data.
Which is the strictest data protection regulation?: The EU GDPR is the global benchmark and inspired many others, but China PIPL, South Korea PIPA, and Quebec Law 25 are among the most prescriptive, especially on consent, cross-border transfer, and data localization.

Compliance mapping for frameworks like SOC 2, ISO 27001, and HIPAA lives in our guides. Know a regulation we should add? Tell us.