Startup compliance, country by country.

What a startup’s AI policy should contain, how to tier tools and data, and a plain-English template.

The DPDP Act, IT Act and Rules, CERT-In directions, consumer and e-commerce rules, sector regulators and crypto rules: what Indian and global startups need to do, and when.

The Personal Data Protection Act No. 9 of 2022 (as amended in 2025), with core controller and processor duties from 1 January 2027 and an already established Data Protection Authority.

GDPR, the AI Act, the DSA, the Data Act, NIS2, the Cyber Resilience Act, DORA and MiCA: which apply to your startup, what they require and in what order to tackle them.

UK GDPR and the Data (Use and Access) Act 2025, PECR, the Online Safety Act, the Children’s Code, product security rules and the UK’s regulator-led approach to AI.

The revised Federal Act on Data Protection in force since September 2023, personal criminal liability, the Swiss–US Data Privacy Framework and Switzerland’s approach to AI.

No federal privacy or AI law, but the FTC, sector statutes, around twenty state privacy laws, state AI laws in California, Colorado and Texas, children’s rules and breach laws in all fifty states.

Federal PIPEDA, provincial laws in Québec, Alberta and BC, Canada’s Anti-Spam Legislation, and the pending Bill C-36 privacy reform.

The LGPD and the ANPD’s regulations on transfers, incidents and DPOs, the ECA Digital children’s online law in force since March 2026, consumer law and the pending AI bill.

The new Federal Law on the Protection of Personal Data Held by Private Parties in force since March 2025, the new supervisory authority, privacy notices, consent and the right to object to automated processing.

The PDPA, the Spam Control and Do Not Call rules, the Cybersecurity Act, online safety laws, MAS rules for fintech and crypto, and Singapore’s voluntary AI governance frameworks.

The Privacy Act and Australian Privacy Principles after the 2024 reforms, the Notifiable Data Breaches scheme, the Online Safety Act and under-16 social media rules, the Spam Act, Australian Consumer Law and cyber reporting.

The Act on the Protection of Personal Information (APPI) and its 2026 amendments, cookie rules under the Telecommunications Business Act, the AI Promotion Act, and consumer and e-commerce rules.

The Personal Information Protection Act (PIPA) and its 2026 amendments, the AI Basic Act in force since January 2026, domestic representative rules, and the Network Act, location and e-commerce laws.

PIPL, the Data Security Law, the Cybersecurity Law, cross-border data rules, generative AI measures, algorithm filing and AI-content labelling.

The Personal Data (Privacy) Ordinance and its six data protection principles, PCPD guidance on AI, direct marketing rules and the critical infrastructure cybersecurity law in force since January 2026.

The Personal Data Protection Law (UU PDP), the GR 33/2026 implementing regulation taking effect January 2027, electronic system operator registration and sector rules.

The Personal Data Protection Law in force since January 2026 and its sanctions decree, the Digital Technology Industry Law covering AI and digital assets, and cybersecurity and data localisation rules.

The PDPA as amended in 2024 (DPOs, breach notification, portability), the Online Safety Act 2025 in force since January 2026, platform licensing and sector rules.

Thailand’s GDPR-style Personal Data Protection Act in force since June 2022, cross-border transfer rules, the digital platform services decree and cybersecurity law.

The Data Privacy Act of 2012, NPC registration of DPOs and systems, 72-hour breach notification, and e-commerce and cybercrime laws.

The Privacy Act 2020 and its information privacy principles, mandatory breach notification, the new IPP 3A on indirect collection from May 2026, and the Unsolicited Electronic Messages Act.

The federal PDPL, the DIFC and ADGM data protection regimes, the 2025 Child Digital Safety Law, cybercrime and content rules, and virtual-asset licensing under VARA, ADGM and DIFC.

The Personal Data Protection Law enforced by SDAIA since September 2024, its transfer regulation, NCA cybersecurity controls and sector rules for fintech and health.

The Privacy Protection Law as transformed by Amendment 13 in August 2025, the Data Security Regulations, DPO duties and enforcement by the Privacy Protection Authority.

The Nigeria Data Protection Act 2023, the General Application and Implementation Directive in force since September 2025, registration of major data controllers and compliance audit returns.

The Data Protection Act 2019, mandatory registration of data controllers and processors with the ODPC, breach notification and cross-border transfer rules.

The Protection of Personal Information Act (POPIA), information officer registration, breach notification, PAIA manuals, direct marketing rules and the Cybercrimes Act.