Coverage by country
The same control can operate differently from one country to the next. These are the laws and regulators most commonly relevant to IT controls, data protection and employee monitoring in each country FindingFirst covers, with links to the official source so you always read the current version.
Across the European Union
GDPR applies in every EU country listed below. The NIS2 cybersecurity directive and the EU AI Act also apply EU wide, and DORA covers EU financial firms. National laws add to these, especially for employee monitoring. See Compliance updates for EU dates in 2026 and 2027.
United States
- Sarbanes-Oxley section 404: management and the auditor report on internal control over financial reporting, including IT general controls.
- FTC Act section 5: the FTC acts against unfair or deceptive data practices, including weak security.
- Electronic Communications Privacy Act: the federal baseline for intercepting and accessing communications, relevant to employee monitoring.
- State privacy laws: these vary by state. California's CCPA and its regulations are the most developed.
SEC · PCAOB · FTC · California Privacy Protection Agency
There's no single national data protection authority.
New California rules on cybersecurity audits, risk assessments and automated decisions took effect January 1, 2026, with deadlines phasing in through 2030. See Compliance updates.
Canada
- PIPEDA: the federal private sector privacy law.
- Quebec Law 25: modernized Quebec's private sector privacy law.
- Ontario Employment Standards Act: employers with 25 or more staff need a written electronic monitoring policy.
Office of the Privacy Commissioner of Canada
Bill C-36, which would replace the private sector part of PIPEDA, was introduced June 15, 2026 and isn't law yet.
Mexico
- Federal Law on Protection of Personal Data Held by Private Parties (2025): the new private sector data protection law, in force since March 21, 2025.
- Federal Labor Law: general employer obligations that affect workplace monitoring.
Secretaría Anticorrupción y Buen Gobierno (role summary) law firm summary
The former regulator, INAI, was dissolved in 2025. Its private sector role moved to the Secretaría Anticorrupción y Buen Gobierno.
United Kingdom
- UK GDPR and Data Protection Act 2018: the core data protection rules.
- Data (Use and Access) Act 2025: amends UK GDPR and restructures the regulator.
- Investigatory Powers Act 2016 and Lawful Business Practice Regulations: govern interception of workplace communications.
Information Commission (formerly the ICO) · Data (Use and Access) Act 2025
On September 30, 2026 the ICO's functions moved to the new Information Commission. The ico.org.uk site may still show ICO branding.
Germany
- GDPR plus the Federal Data Protection Act (BDSG): the national framework, including employee data.
- Works Constitution Act: the works council must co-decide on technical tools that can monitor employees. Engage it before deployment.
Most private companies answer to their state (Land) data protection authority.
France
- GDPR plus Loi Informatique et Libertés: the national framework.
- Labour Code: employees must be told about monitoring in advance, and the works council (CSE) consulted.
Netherlands
- GDPR plus the GDPR Implementation Act (UAVG): the national framework.
- Works Councils Act: the works council must consent to systems that monitor staff.
Ireland
- GDPR plus Data Protection Act 2018: the national framework.
Lead EU authority for many US technology companies.
Spain
- GDPR plus Organic Law 3/2018 (LOPDGDD): the national framework.
- Workplace digital rights in the LOPDGDD: cover device use, video surveillance, geolocation and the right to disconnect.
Italy
- GDPR plus the Privacy Code: the national framework.
- Workers' Statute: remote monitoring tools need a union agreement or labour inspectorate authorization.
Poland
- GDPR plus Personal Data Protection Act 2018: the national framework.
- Labour Code: sets rules for video and email monitoring of employees.
Japan
- Act on the Protection of Personal Information (APPI): the national privacy law.
- J-SOX (Financial Instruments and Exchange Act): internal control reporting, with scope and testing that differ from SOX 404.
Personal Information Protection Commission
APPI amendments were promulgated July 17, 2026. Tougher criminal penalties start January 17, 2027, with administrative fines to follow by July 2028.
China
- Personal Information Protection Law (PIPL): the national privacy law.
- Cybersecurity Law: network security duties, including the Multi-Level Protection Scheme.
- Data Security Law: data classification and security duties.
Cyberspace Administration of China
Data localization and transfer approval can prevent moving logs or access exports out of the country.
Cybersecurity Law amendments took effect January 1, 2026, and network data security risk assessment measures took effect August 20, 2026.
India
- Digital Personal Data Protection Act 2023 and DPDP Rules 2025: the new national privacy framework.
- IT Act 2000 and CERT-In Directions 2022: cyber incident reporting and log retention.
DPDP Rules 2025 (Government of India)
The Data Protection Board of India was constituted in November 2025.
Consent manager rules start November 13, 2026. Core obligations, including security safeguards and breach reporting, start May 13, 2027.
Singapore
- Personal Data Protection Act 2012: the national privacy law.
- Cybersecurity Act 2018: duties for critical information infrastructure.
South Korea
- Personal Information Protection Act (PIPA): the national privacy law, strict on employee data and cross border transfer.
- AI Basic Act: AI transparency and high impact AI duties, in force January 22, 2026.
PIPA amendments passed February 12, 2026 allow fines of up to 10% of total revenue for severe breaches.
Australia
- Privacy Act 1988 and the Australian Privacy Principles: the national framework.
- Security of Critical Infrastructure Act 2018: risk management duties for critical assets.
- State workplace surveillance laws: notice rules for monitoring staff vary by state, for example New South Wales.
From December 10, 2026, privacy policies must disclose automated decision making.
Brazil
- LGPD (Law 13.709/2018): the national privacy law, closely modeled on GDPR.
ANPD became a national agency in 2026 and kept its acronym.
United Arab Emirates
- Federal Decree-Law 45 of 2021 (PDPL): the federal data protection law. Its executive regulations are still pending.
- DIFC Data Protection Law 2020: applies inside the DIFC free zone.
- ADGM Data Protection Regulations 2021: apply inside the ADGM free zone.
UAE data protection laws (government portal) · DIFC Commissioner · ADGM Office of Data Protection
In June 2026 the UAE announced a Federal Authority for Artificial Intelligence and Data, which absorbs the Emirates Data Office.
See how your issue plays out by country
Describe a control issue, pick every country it touches, and the free preview shows which rules may apply and where the answer changes.
Check an issue free