468 articles · page 6 of 8
NJ Gov. Sherrill signed A5328 on June 30, 2026, banning sensitive-data sales and creating a data-broker registry with fees up to $1.5 million and $50,000 per-record penalties.
New Mexico protects biometric data through its Data Breach Notification Act, requiring 45-day notification and AG reporting. No standalone biometric privacy law exists.
New Mexico requires data breach notification within 45 days of discovery under N.M. Stat. 57-12C. Learn about biometric data coverage, AG reporting, HIPAA/GLBA exemptions, and enforcement.
New Mexico's Data Breach Notification Act (NMSA 57-12C) requires 45-day notice. In March 2026, a jury ordered Meta to pay $375M under the Unfair Practices Act.
Guide to New York biometric privacy laws including the SHIELD Act, NYC Local Law 3, pending Biometric Privacy Act (S1422), and employer obligations for 2026.
New York requires data breach notification within 30 days under the SHIELD Act. Learn who must be notified, safeguard requirements, and penalties up to $250K.
Guide to New York data privacy laws including the SHIELD Act, breach notification rules, biometric protections, employee monitoring law, and pending NY Privacy Act.
New Zealand Privacy Act 2020: 13 IPPs, IPP 3A indirect-collection rule (May 2026), Biometric Code 2025, breach notification, IPP 12 cross-border transfer, and enforcement powers.
NHDPA (RSA 507-H) compliance: 35,000-consumer test, privacy notice, opt-in sensitive data, universal opt-out, assessments. Cure period sunset Dec 31, 2025.
Under RSA 507-H:4, NH residents can access, correct, delete, and port data and opt out of sales and ads. Controllers must respond within 45 days; appeals in 60.
Complete guide to Nigeria data privacy laws: the NDPA 2023, GAID 2025, NDPC enforcement, DCPMI registration, data subject rights, breach notification, penalties up to 2% annual revenue.
NJDPA compliance steps (N.J.S.A. 56:8-166.4 et seq.): applicability, notice, sensitive-data consent, GPC, assessments; 30-day cure sunsets ~July 2026.
NJDPA rights (N.J.S.A. 56:8-166.4 et seq.): access, correct, delete, port, and opt out, with a 45-day response, GPC opt-out, and appeals to Consumer Affairs.
North Carolina protects biometric data through breach notification laws with treble damages. Learn about NC fingerprint laws, employer rules, and pending privacy legislation.
North Carolina requires breach notification without unreasonable delay. Violations are UDTP offenses with treble damages and a private right of action under N.C. Gen. Stat. 75-65.
Learn about North Carolina data privacy laws including the Identity Theft Protection Act, breach notification requirements, SSN protections, and proposed legislation.
North Dakota has no standalone biometric privacy law. Learn how the state's identity theft statute, breach notification law, and insurance regulations address biometric data.
North Dakota requires breach notification without unreasonable delay and AG notice at 250+ affected individuals. Penalties up to $5,000 per violation under N.D. Cent. Code 51-30.
North Dakota data privacy laws: breach notification under N.D. Cent. Code Ch. 51-30, HB 1127 financial data security, identity theft protections, and federal TAKE IT DOWN Act coverage as of May 2026.
Norway applies the full GDPR through the EEA Agreement. The Personal Data Act 2018 supplements it with national rules. Datatilsynet enforces with fines up to EUR 20 million. Updated 2026.
Comply with Oregon's OCPA (ORS 646A.570 to 646A.589): applicability, privacy notice, sensitive-data opt-in, universal opt-out by Jan 1 2026, $7,500 penalties.
Oregon's OCPA (ORS 646A.574) gives access, deletion, opt-out, and a rare specific-third-party-list right. Controllers must respond within 45 days; appeals allowed.
Ohio has no biometric privacy law. Learn how the Ohio Data Protection Act safe harbor, breach notification rules, and insurance regulations affect biometric data.
Ohio requires data breach notification within 45 days. Escalating penalties reach $10,000/day. The Ohio Data Protection Act offers a cybersecurity safe harbor under ORC 1349.19.
Guide to Ohio data privacy laws including the Data Protection Act safe harbor, breach notification requirements under ORC 1349.19, and consumer protections.
Oklahoma protects biometric data through its amended breach notification law (SB 626) and the Consumer Data Privacy Act (SB 546). No standalone biometric law exists.
Oklahoma requires breach notification without unreasonable delay. SB 626 (effective Jan 2026) adds biometric data, 60-day AG deadline, and $150K penalty cap.
Oklahoma enacted the Consumer Data Privacy Act (SB 546) on March 20, 2026, effective Jan. 1, 2027. Learn breach notification rules, AG enforcement, and federal overlay.
Onsite Mammography's claim window closed August 11, 2026. The final approval hearing was held September 9, 2026 and no order has issued; the administrator posts updates.
Oppenheimer's $70M cash sweep settlement has preliminary approval only. Claim deadline is Sept. 17, 2026. See who may be eligible and how to file.
Oregon biometric privacy laws under the OCPA require opt-in consent for biometric data. Portland bans facial recognition in public spaces with $1,000/day penalties.
Oregon requires data breach notification within 45 days. AG notice at 250+, CRA at 1,000+. Penalties up to $500,000 for continuing violations under ORS 646A.604.
Learn about Oregon data privacy laws including the OCPA, consumer rights, business obligations, $7,500 penalties, and breach notification rules.
Pakistan has no enacted data protection law as of 2026. PECA 2016 (amended January 2025) and sector rules apply. Full guide to the pending Personal Data Protection Bill.
Panama's Law 81 of 2019 and Executive Decree 285 of 2021 govern personal data protection. Learn about ANTAI oversight, ARCO rights, consent rules, cross-border transfers, sectoral rules, penalties, and 2025 updates.
Pennsylvania lacks a standalone biometric privacy law. Learn how BPINA, the UTPCPL, and pending bills like HB 78 and HB 596 affect biometric data rights.
Pennsylvania requires breach notification without unreasonable delay. The 2024 BPINA amendment adds AG notice at 500+, 12-month credit monitoring, and health insurance data coverage.
Guide to Pennsylvania data privacy laws including breach notification under BPINA, the all-party consent Wiretap Act, pending HB 78 consumer privacy bill, and AG enforcement.
Peru data privacy law explained: Law 29733, DS 016-2024-JUS (March 2025), DPO requirements, 48-hour breach notification, ARCO-PD rights, penalties up to 100 UIT. Updated May 2026.
The Philippines Data Privacy Act of 2012 (Republic Act 10173) explained: NPC registration and enforcement, data subject rights, breach notification, and the IRR, verified current.
How the Philippines' Data Privacy Act differs from GDPR: criminal imprisonment for 8 offenses, mandatory NPC registration, and BPO extraterritorial reach.
Complete guide to Poland data privacy laws: EU GDPR, the Polish Personal Data Protection Act 2018, UODO enforcement record, constitutional basis, penalties, breach notification, and 2024-2026 developments.
Portugal data privacy law explained: GDPR implementation via Lei 58/2019, the CNPD supervisory authority, constitutional basis in Article 35, the 2019 deliberation disapplying national provisions, penalties up to €20M, and 2024–2026 enforcement.
The $17.25M PowerSchool Naviance claim window closed July 27, 2026 and the court granted final approval on August 19, 2026. No payment date is set; Kroll posts updates.
What US and international laws require in a privacy policy. Covers CCPA, GDPR, CalOPPA, COPPA, mandatory disclosures, penalties, and update frequency.
Complete guide to Qatar data privacy laws: Law No. 13 of 2016 (PDPPL), the NCSA/CDP supervisory authority, the QFC Data Protection Regulations 2021, data subject rights, breach notification, cross-border transfers, and penalties up to QAR 5 million.
Rhode Island biometric privacy laws under the RIDTPPA require opt-in consent for fingerprint and biometric data collection, with AG-enforced fines of $100 to $500 for each unlawful disclosure.
Rhode Island requires data breach notification within 45 days (30 for government). Learn about the 128-bit encryption safe harbor, AG reporting at 500+, and per-record penalties.
Guide to Rhode Island data privacy laws and the RIDTPPA effective January 1, 2026. Consumer rights, business obligations, penalties, and breach rules.
RIDTPPA (R.I. Gen. Laws 6-48.1) compliance: coverage at 35,000 customers, the 6-48.1-3 third-party disclosure, opt-in sensitive data, and AG-only enforcement.
Rhode Island's RIDTPPA (6-48.1-5) gives access, correction, deletion, portability, and opt-out rights; controllers must answer within 45 days. AG enforces.
Complete guide to Romania data privacy laws: GDPR implementation via Law 190/2018, ANSPDCP enforcement, public authority fine caps, employee monitoring rules, biometric data restrictions, EU AI Act overlap, and 2024–2025 enforcement actions.
Complete guide to Russia's data privacy laws: Federal Law 152-FZ, Roskomnadzor enforcement, data localization (242-FZ), the 2025 fine increases under 420-FZ (up to 500M rubles), new criminal liability under 421-FZ (up to 10 years), breach notification, and SORM surveillance.
Complete guide to Saudi Arabia's Personal Data Protection Law (PDPL), Royal Decrees M/19 and M/148, SDAIA enforcement, data subject rights, breach notification, penalties up to SAR 5M, cross-border transfer rules, and 2025–2026 regulatory updates.
How Saudi Arabia's PDPL Data Transfer Regulation governs outbound data: the localization myth, SCCs, risk assessments, and penalties.
Compare Saudi Arabia's PDPL to the GDPR: controller registration, the missing adequacy list, rights gaps, and criminal penalties.
Serviceaide's $1.8M claim window closed September 1, 2026. A final approval hearing is set for September 16, 2026; the court and Kroll post status updates.
Singapore PDPA: the 11 data protection obligations, mandatory DPO, breach notification, penalties up to 10% of turnover, and data portability status in 2026.
Slovakia enforces data privacy through GDPR and Act No. 18/2018, overseen by the UOOU. Learn about birth number protections, enforcement, the EU AI Act overlay, and NIS2 compliance.
Slovenia was the last EU member state to adopt a GDPR implementing law. Learn how ZVOP-2 (in force January 2023), the Information Commissioner, Article 38 constitutional protection, biometric restrictions, processing logs, and the EU AI Act shape compliance in Slovenia.