Passenger data

Data protection laws by country

Most countries now have a general data protection law. UNCTAD counts 137 of 194 countries with such legislation ¹. These laws set rules for how passport, biometric and passenger data is collected and kept. Border and police work often sits under separate rules or exemptions. The EU GDPR, for example, does not cover criminal law enforcement by competent authorities ³. Some countries have a law on the books but no working regulator yet ².

Last checked: 19 October 202615 sources

How many countries have a data protection law

UNCTAD tracks data protection laws around the world. Its tracker says 137 out of 194 countries have put legislation in place. It gives regional shares of 61 percent for Africa and 57 percent for Asia. Among least developed countries the share is 48 percent ¹.

A law on paper is only part of the picture. A regulator needs staff, funds and legal powers to act. The table below notes where a law exists but its regulator has not been set up, as of 19 October 2026 ².

Country table

The table draws on the DLA Piper Data Protection Laws of the World country pages, checked on 19 October 2026, and on national government and press sources where DLA Piper has no page ². It covers the general law and the main regulator. The last column notes a rule that bears on border or travel data where we found one. Laws change often. Check the national regulator before relying on any entry.

Country	Main law and year	Regulator	General data protection law?	Border or travel data note
European Union (27 states)	General Data Protection Regulation, Regulation (EU) 2016/679, adopted 27 April 2016 ³	A national data protection authority in each state. The EDPS covers EU bodies. A joint committee covers EU border databases ¹⁵	Yes	PNR Directive covers air passenger records on flights from and to non-EU countries ⁴. The Entry/Exit System stores fingerprints and face images of short-stay non-EU visitors ⁷
United Kingdom	UK GDPR and Data Protection Act 2018, changed by the Data (Use and Access) Act 2025 ²	Information Commissioner's Office ²	Yes	Courts ruled the immigration exemption in the 2018 Act unlawful, most recently on 18 December 2023 ⁸
United States	No single federal privacy law. Sector laws and state laws apply ²	No single authority. The Federal Trade Commission and state attorneys general enforce many rules ²	No	CBP says US citizens can ask for manual document checks instead of a face photo, and their photos are kept no more than 12 hours ⁹
Canada	PIPEDA for the private sector, plus provincial laws. Bill C-27 died when Parliament was prorogued on 6 January 2025 ²	Office of the Privacy Commissioner of Canada, plus provincial commissioners ²	Yes	No border-specific rule checked for this table
Brazil	General Data Protection Law (LGPD), in force from 18 September 2020 ²	National Data Protection Authority (ANPD) ²	Yes	The LGPD does not apply to public safety, national security or criminal investigation. A separate law is meant to cover these ²
India	Digital Personal Data Protection Act, 2023, published 11 August 2023 ^2,10	Data Protection Board of India, still being set up. A notification of 13 November 2025 set its size at 4 members ²	Yes	Section 17 lets the government exempt notified state bodies for security and public order, and covers crime investigation ¹⁰
China	Personal Information Protection Law, in force 1 November 2021, with the Cybersecurity Law and Data Security Law ²	Cyberspace Administration of China leads, with other ministries ²	Yes	No border-specific rule checked for this table
Japan	Act on the Protection of Personal Information (APPI), first enacted 2003. Public sector rules merged into it on 1 April 2022 ²	Personal Information Protection Commission ²	Yes	No border-specific rule checked for this table
South Korea	Personal Information Protection Act (PIPA). Amended 10 March 2026, with most changes in force from 11 September 2026 ²	Personal Information Protection Commission ²	Yes	No border-specific rule checked for this table
Singapore	Personal Data Protection Act 2012, amended 2020 ²	Personal Data Protection Commission ²	Yes, for the private sector	The Act does not apply to the public sector. Government rules (IM8 and the Public Sector (Governance) Act) apply instead ²
Philippines	Data Privacy Act of 2012 (Republic Act No. 10173) ²	National Privacy Commission, created 2016 ²	Yes	No border-specific rule checked for this table
Bangladesh	Personal Data Protection Ordinance, 2025, gazetted in November 2025 ¹¹	A national data authority is proposed under the National Data Governance Ordinance, 2025 ¹¹	Yes, new	Regulator not yet confirmed as working
Pakistan	No data protection law. The Prevention of Electronic Crimes Act 2016 (amended 2025) covers some misuse. A Personal Data Protection Bill 2023 is in draft ²	No data protection authority ²	No	None
United Arab Emirates	Federal Decree-Law No. 45 of 2021 (PDPL), issued 26 September 2021 ²	The UAE Data Office named in the law had not been set up when DLA Piper last updated its page. Free zones have their own regimes ²	Yes	Executive regulations were still unpublished as of 6 January 2025 ²
Saudi Arabia	Personal Data Protection Law (Royal Decree M/19 of 16 September 2021, amended 27 March 2023), in force 14 September 2023 ²	Saudi Data and Artificial Intelligence Authority (SDAIA) ²	Yes	Separate regulations govern transfers of personal data outside the Kingdom ²
Turkey	Law on the Protection of Personal Data No. 6698 of 7 April 2016 ²	Personal Data Protection Authority (KVKK) and its Board ²	Yes	No border-specific rule checked for this table
South Africa	Protection of Personal Information Act 4 of 2013 (POPIA) ²	Information Regulator ²	Yes	No border-specific rule checked for this table
Nigeria	Nigeria Data Protection Act 2023, signed 13 June 2023 ²	Nigeria Data Protection Commission ²	Yes	A General Application and Implementation Directive was issued on 20 March 2025 ²
Kenya	Data Protection Act, 2019, in force 25 November 2019 ²	Office of the Data Protection Commissioner. The first Commissioner took office on 16 November 2020 ²	Yes	Civil Registration Regulations, 2020 apply to registries that handle passport and other civil records ²
Ghana	Data Protection Act, 2012 (Act 843) ²	Data Protection Commission ²	Yes	No border-specific rule checked for this table
Senegal	Act No. 2008-12 of 25 January 2008 on personal data protection ²	Commission de Données Personnelles (CDP) ²	Yes	No border-specific rule checked for this table
The Gambia	Personal Data Protection and Privacy Bill passed by the National Assembly. It was awaiting presidential assent on 6 October 2025 ¹²	None confirmed	No law in force confirmed	Status after October 2025 not confirmed
Sierra Leone	No data protection law. Cabinet approved a policy and a planned Data Protection and Right to Access Information Act, announced 21 April 2026 ¹³	None. The plan would give the Right to Access Information Commission data protection powers ¹³	No	None
Gabon	Act No. 001/2011, amended by Act No. 025/2023. Gabon ratified the African Union data protection convention on 17 October 2024 ²	Authority for the Protection of Personal Data and Privacy (APDPVP) ²	Yes	No border-specific rule checked for this table
DR Congo	Digital Code, Law No. 23-010 of 13 March 2023 ²	The Data Protection Authority (APD) has not been created by the required decree. A ministerial decree of 17 August 2024 moved its tasks to another body for now ²	Yes	Law exists but the planned regulator is not set up
Mali	Law No. 2013-015 of 21 May 2013, amended by Law No. 2017-070 ¹⁴	Autorité de protection des données à caractère personnel (APDP), launched 2016 ¹⁴	Yes	Data Protection Africa lists no national security exclusion in the law ¹⁴

Where a law exists but no regulator is active

Several countries have passed a law and not yet set up the body that enforces it. People there may hold rights on paper with no body to enforce them ².

United Arab Emirates: the 2021 federal law names a Data Office. DLA Piper reports it had not been set up when it last updated its page ².
DR Congo: the 2023 Digital Code calls for a Data Protection Authority created by decree of the Prime Minister. No such decree had been adopted when DLA Piper last updated its page ².
India: the 2023 Act creates a Data Protection Board. The government was still setting it up after a notification of 13 November 2025 ².
Bangladesh: the 2025 ordinance is in force on paper. The national authority meant to oversee data was described as proposed in November 2025 ¹¹.
The Gambia and Sierra Leone: neither had a data protection law confirmed in force as of the latest sources we found ^12,13.

What these laws mean for border and travel data

Border systems handle some of the most sensitive data a state holds. This includes passport details, fingerprints, face images and travel history. General data protection laws often apply to airlines, airports and private contractors. Rules for border police and immigration staff can differ ^2,3.

The EU has border-specific laws on top of the GDPR. The PNR Directive requires airlines to send passenger name record data to national Passenger Information Units for flights between the EU and non-EU countries. States may add flights inside the EU. The Directive sets a five-year retention period, with data masked after six months. It bans processing of data that reveals race, ethnic origin and other sensitive traits ⁴.

The EU Entry/Exit System registers non-EU short-stay visitors at the external borders of 29 countries. It records names, travel document data, fingerprints and face images, and replaces passport stamps. Operations began on 12 October 2025 and the system was fully running on 10 April 2026 ⁷. The EES Regulation says data on travellers who kept to their permitted stay is kept for three years. Data on overstayers is kept for five years ⁶.

In the United States, Customs and Border Protection uses face comparison at entry and exit. CBP says US citizens may ask for a manual check instead. It keeps their photos no more than 12 hours. Non-citizens in scope are enrolled in the DHS biometric system called IDENT ⁹.

Law enforcement and national security exemptions

Almost every data protection law carves out police and security work in some way. The GDPR does not apply to processing by competent authorities for the prevention, investigation, detection or prosecution of crime, or for threats to public security ³. A separate EU law, the Law Enforcement Directive (EU) 2016/680, covers that work. The UK copied it into Part 3 of its Data Protection Act 2018 ².

Brazil's LGPD excludes public safety, national security, defence and criminal investigation. A specific law is meant to cover these areas ². India's 2023 Act lets the central government exempt notified state bodies in the interest of sovereignty, security of the state and public order. Core duties are lifted where data is processed to prevent, detect or prosecute offences ¹⁰.

Courts have tested these exemptions. In the UK, the3million and the Open Rights Group challenged the immigration exemption in the 2018 Act. The Court of Appeal found it unlawful in 2021. The Government amended it. The High Court found the new version unlawful in March 2023 and the Court of Appeal upheld that ruling on 18 December 2023 ⁸.

In the EU, the Court of Justice ruled on the PNR Directive on 21 June 2022 in case C-817/19. It upheld the Directive but read it narrowly. It said blanket five-year retention for all passengers is not allowed. After six months, data may be kept only where there is objective evidence of a risk. It barred self-learning AI systems that change risk criteria without human review ⁵.

Who supervises EU border databases

The EU runs shared border databases such as the Schengen Information System, the Visa Information System, Eurodac and the Entry/Exit System. A Coordinated Supervision Committee within the European Data Protection Board oversees these systems. Its members are the national data protection authorities and the European Data Protection Supervisor ¹⁵.

Each national authority checks how its own state uses the data. The EDPS checks EU institutions and bodies and works with national authorities ⁶.

How to check the rules in your country

Start with the national data protection regulator, if one exists. Its website should list the law, guidance and decisions. For a cross-country view, the UNCTAD tracker and the DLA Piper guide are useful starting points ^1,2. For border data, look for rules on passenger records, biometrics and immigration in addition to the general law. Look for court rulings on exemptions too ^5,8.

Common questions

Does the GDPR apply to border police?

Not to their crime and public security work. The GDPR excludes processing by competent authorities for criminal law enforcement and public security ³. The Law Enforcement Directive covers that work ².

Does the United States have a national data protection law?

No. DLA Piper describes US privacy law as a patchwork of federal sector laws and state laws, with no single national authority ².

How long does the EU keep air passenger records?

The PNR Directive sets five years, with data masked after six months ⁴. The EU Court of Justice ruled in 2022 that keeping all passengers' data beyond six months needs objective evidence of risk ⁵.

What happens if a country has a law but no regulator?

People keep the rights the law gives them, but there is no body to take complaints or enforce the rules. DR Congo and the UAE are examples noted by DLA Piper ².

Can I refuse a face scan at a US airport?

CBP says US citizens can ask for alternative processing, which usually means an officer checks documents by hand ⁹.

Sources

Spotted an error? Write to [email protected]. See how we work on the methodology page.