There are well over a hundred data protection authorities in the world, but a typical software company deals with only a handful of them. Which ones depends on where you are established, whose data you process, and what sector you sell into. This piece explains how the regulatory systems differ, so you can work out your own short list.
For names, laws and official websites, use the privacy regulators directory. This article covers the structure behind it: who leads, who can step in, and who expects a form or a fee from you before anything goes wrong.
Start from your facts, not from the list
Most privacy laws decide whether they apply based on one of two links: you are established in the territory, or you target or monitor people there. The GDPR uses both (Article 3). The US state laws use revenue and volume thresholds tied to residents of the state.
So before you look up any regulator, write down three things. Where are your legal entities and offices? Where do the people whose data you handle live (customers, end users of your customers, employees)? And which sectors are you in? A data map that records systems, data categories and data subject locations answers most of this. Without one, people tend to guess, and they usually guess too narrowly.
Europe: one law, many authorities, one lead
All 27 EU member states, plus Iceland, Liechtenstein and Norway, apply the GDPR. Each has its own supervisory authority. Germany has a federal authority plus authorities for each state, and Bavaria has two. In principle any of them could act against you. The one-stop-shop mechanism exists to stop that from happening.
How the lead authority is chosen
If you have a "main establishment" in the EU and your processing is cross-border, the authority where that establishment sits becomes your lead supervisory authority (GDPR Article 56). Cross-border means you have establishments in more than one member state, or your processing substantially affects people in more than one. Main establishment generally means your place of central administration in the EU. If decisions about the processing are taken in another EU establishment, that establishment counts instead (Article 4(16)). In practice that is why so many US technology companies deal mainly with Ireland's Data Protection Commission: their European headquarters are in Dublin.
The lead authority runs the investigation and drafts the decision. The other "concerned" authorities can object. A complaint can still be filed anywhere: a French user can complain to the CNIL, and the CNIL passes it to your lead authority under the cooperation procedure in Article 60. If the authorities cannot agree, the European Data Protection Board settles the dispute with a binding decision (Article 65). Local matters that only affect one country can still be handled by that country's authority (Article 56(2)).
From April 2, 2027, Regulation (EU) 2025/2518 adds common procedural rules for these cross-border cases. They cover admissibility of complaints, the right to be heard, and access to the file. The regulation does not change who your lead authority is, but it should make cases more predictable from one country to the next.
No EU establishment, no one-stop-shop
This is the part non-European companies miss. If you sell into the EU from the US or Asia with no establishment in the EU, the GDPR still applies to you under Article 3(2). But you get no lead authority. Every authority in a country where you have users can act on its own. You also generally need an EU representative under Article 27, a person or firm in a member state who acts as your contact point for authorities and individuals. The exemption is narrow. It covers occasional processing that does not include large-scale special-category data and is unlikely to create risk.
A representative does not make you "established" in the EU. It does not give you a lead authority either. Some groups set up a real EU entity partly for this reason. If you do, the entity has to actually take decisions about the processing. Otherwise authorities will not treat it as your main establishment.
The UK: same rules, separate regulator
Since Brexit the UK has its own version of the GDPR (the UK GDPR), its own regulator and its own representative requirement. A company with an Irish lead authority still answers separately to the UK regulator for UK data. Non-UK companies that fall under the UK GDPR generally need a UK representative, mirroring Article 27.
The regulator itself changed legal form on September 30, 2026. Under the Data (Use and Access) Act 2025, the Information Commissioner became the Information Commission, a body led by a board. The ICO says it keeps the ICO name and its responsibilities do not change. The UK also charges most controllers an annual fee just for processing personal data (more on that below).
The United States: no data protection authority, many enforcers
The US has no general federal privacy law and no single data protection authority. Enforcement is split several ways:
- The Federal Trade Commission uses Section 5 of the FTC Act, which bans unfair or deceptive practices. If you break a promise in your privacy policy, or your security is unreasonably weak, that is the hook. The FTC also enforces specific statutes and rules, including COPPA for children's data, the GLBA Safeguards Rule for non-bank financial firms, and the Health Breach Notification Rule. Its business guidance collects all of these.
- State attorneys general enforce the state comprehensive privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the rest), along with state breach-notification and consumer-protection laws. Most of these laws have no private right of action, so the attorney general is the only enforcer. Our Utah article shows a typical setup, including the cure period.
- California is the exception, with a dedicated agency: the California Privacy Protection Agency, which now calls itself CalPrivacy. It shares CCPA enforcement with the attorney general. It also runs the data broker registry and the Delete Request and Opt-out Platform (DROP) under the Delete Act. See California's CPRA and the 2026 regulations.
- Sector regulators cover their own industries. The Department of Health and Human Services' Office for Civil Rights enforces HIPAA. Banking regulators and the CFPB cover financial privacy rules for banks. The FCC handles telecoms customer data.
The practical result is that a US company rarely has a "home" regulator relationship of the kind European companies have. It deals with whichever agency or attorney general opens an inquiry.
Federal and provincial systems: Canada and others
Canada splits jurisdiction between levels of government. The Office of the Privacy Commissioner of Canada oversees PIPEDA. Quebec, Alberta and British Columbia have their own private-sector laws and commissioners, and these apply instead of PIPEDA to activities within those provinces. Quebec's Commission d'accès à l'information can impose administrative monetary penalties under Law 25. Federal reform has been tried since 2020; the latest attempt, Bill C-36, was tabled in June 2026. The two Canada articles cover the details: Canada's privacy law after Bill C-11 and Quebec's Law 25.
Other countries with layered systems include Germany (state authorities supervise private companies) and China. In China the Cyberspace Administration coordinates, but industry regulators also enforce the PIPL within their sectors. The UAE is another case: the DIFC and ADGM free zones have their own data protection regulators, separate from the federal regime.
Which regulators a typical SaaS company actually deals with
Here is how this plays out for a few common company setups. These are starting points, not conclusions. Your own facts, such as a sales office, an employee in another country, or a health customer, can add authorities.
| Setup | Regulators you are most likely to deal with | Formalities to set up |
|---|---|---|
| US company, US customers only | FTC; attorneys general of states where thresholds are met; CalPrivacy if California law applies | None with regulators in general. Data broker registration in California if you are a data broker |
| US company selling into the EU and UK, no EU entity | The above, plus any EU authority where you have users (no lead authority), plus the UK regulator | EU representative (Art. 27), UK representative, UK data protection fee if you are a UK controller |
| US company with a real EU headquarters (for example in Ireland or the Netherlands) | The above US set, plus a lead authority where the EU headquarters is, plus the UK regulator | Notify the DPO's contact details to the lead authority (Art. 37(7)); UK representative if no UK establishment |
| EU-based company | Its home authority as lead; other EU authorities only through cooperation; UK regulator for UK users | DPO notification where a DPO is required; UK representative if no UK establishment |
| Any of the above with Canadian customers | OPC, plus the CAI if you carry on business in Quebec (and the Alberta or BC commissioner for activity in those provinces) | Quebec: name a person in charge of protecting personal information and publish their title and contact details |
One more category is easy to miss: if you are a processor for your customers (most B2B SaaS is), many regulators will never contact you directly. They contact your customers, who then send you a questionnaire with a deadline. Keeping your DPA and sub-processor list current is how you make those requests routine.
Registration, fees and filings
The GDPR abolished the old EU-wide system of registering processing with authorities, so most European authorities expect nothing from you until there is a complaint or a breach. The main standing duties are telling the authority who your DPO is (where you must have one) and reporting breaches within 72 hours (Article 33). Several countries outside the EU do require registration or payment up front:
| Jurisdiction | Obligation | Detail |
|---|---|---|
| United Kingdom | Annual data protection fee for controllers, unless exempt | Tier 1 £52 (turnover up to £632,000 or no more than 10 staff); tier 2 £78 (up to £36 million or 250 staff); tier 3 £3,763 for everyone else. £5 off by direct debit. Charities pay tier 1. Source: ICO fee guide |
| California | Data broker registration | Data brokers must register with CalPrivacy each year between January 1 and 31. Since August 1, 2026 they must also process deletion requests submitted through DROP. Source: CalPrivacy data broker registry |
| South Africa | Register the information officer | Under POPIA section 55(2), information officers take up their duties only after they are registered with the Information Regulator. Registration is done through its eServices portal |
| Kenya | Register as a data controller or processor | Required under the Data Protection Act 2019, with thresholds and exemptions set in the 2021 registration regulations. It also applies to controllers outside Kenya that process data of people in Kenya |
| Turkey | Register in VERBIS, the data controllers registry | Required unless exempted by the Personal Data Protection Board. Exemptions depend on headcount, balance sheet size and whether processing sensitive data is your main activity. Check the current criteria with the KVKK |
| Nigeria | Register as a data controller or processor "of major importance" | Required under the Nigeria Data Protection Act 2023 for organizations the NDPC classes as being of major importance. Fees and annual filings depend on the tier |
Two practical notes. First, fees and thresholds change. The UK raised its fees on February 17, 2025 (SI 2025/63), for example. Calendar a yearly check rather than relying on what someone set up three years ago. Second, registration usually needs your data inventory: purposes, data categories, recipients and transfers. If your records of processing are current, filings take an afternoon. If they are not, the filing turns into a mapping project. Our guide to data maps and ROPAs covers the fields regulators tend to ask for.
What regulators actually see from you
For most companies, contact with a regulator comes from one of three places: a breach notification you file, a complaint from an individual, or an inquiry after press coverage. Complaints are the most common route, and many start as a data subject request that was ignored, answered late, or answered badly. A reliable request process is the cheapest way to avoid meeting the regulators in the directory at all.
This article explains structures, not your specific obligations, and it is not legal advice. When a decision turns on jurisdiction, such as where your main establishment is or whether a fee exemption applies, get advice from someone qualified in that country.
- Privacy regulators directory
Authorities, laws and official websites by region, with a filter.
- California's CPRA and the 2026 regulations
CalPrivacy, the ADMT and risk assessment rules, and DROP.
- Canada's privacy law after Bill C-11
PIPEDA, the failed reform bills, and the provinces.
- Quebec's Law 25, fully in force
Obligations and penalties under the CAI.