Privacy regulators directory

The data protection authorities that matter for most organizations: every EU and EEA supervisory authority, the UK, Switzerland, and the main regulators in the Americas, Asia-Pacific, the Middle East and Africa. Each row gives the authority's current name, the law it enforces, and its official website. We checked every name and link in October 2026.

This list is selective on purpose. It covers the regulators a company is most likely to meet when it handles customer or employee data across borders. It does not try to list every authority in the world. If you need to know how these bodies relate to each other (lead authorities, one-stop-shop, the US patchwork), read who regulates privacy where alongside this page.

European Union: GDPR supervisory authorities

Every EU member state has at least one independent supervisory authority under Article 51 of the GDPR. All of them enforce the same regulation, plus a national act that fills in the gaps the GDPR leaves to member states (employee data, the age of digital consent, some exemptions). The names below follow the EDPB's member list.

EEA countries and EU-level bodies

Iceland, Liechtenstein and Norway apply the GDPR through the EEA Agreement. Their authorities sit on the European Data Protection Board but have no vote and cannot be elected to chair it.

The EDPB is not a regulator you file complaints with. It is made up of the heads of the national authorities and the EDPS, and it issues guidelines, binding decisions in disputes between authorities, and opinions on adequacy. The EDPS supervises the EU's own institutions and bodies, not private companies.

Europe outside the EU

The Americas

Three points the table cannot show:

• US state attorneys general. Outside California, every state comprehensive privacy law (Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the rest) is enforced by that state's attorney general, not a dedicated agency. In California the attorney general shares enforcement with CalPrivacy. Our pages on California's CPRA and the Utah Consumer Privacy Act cover how that works in practice.
• Mexico. A December 2024 constitutional reform abolished the autonomous INAI. A new federal private-sector data protection law was published on March 20, 2025 and took effect the next day, and the job of supervising companies passed to the Secretaría Anticorrupción y Buen Gobierno, a ministry of the federal executive. The new law names the Secretaría as the authority in its definitions.
• Brazil. The ANPD's site now uses the name Agência Nacional de Proteção de Dados ("agency" rather than "authority"). The change came when it was turned into an independent regulatory agency in 2025-2026. The acronym, the website and the LGPD stay the same.

For Canada's federal reform bills and how the provincial laws fit together, see Canada's privacy law after Bill C-11 and Quebec's Law 25.

Asia-Pacific

China works differently from the other countries in this table. The CAC coordinates personal information protection and handles security assessments for outbound data transfers. But industry regulators, such as those for telecoms, finance and health, also enforce the PIPL within their sectors.

Middle East and Africa

The UAE has a federal data protection law as well, but the two financial free zones have their own regimes and their own regulators, and those are the ones most foreign firms deal with. A company in the DIFC or ADGM answers to that free zone's commissioner. It does not answer to a federal body for the data it processes there.

Gaps and pending changes

We left some countries out because we could not confirm a working regulator and website. A few are worth watching:

• Chile passed Law 21.719 in December 2024. It creates a new Agencia de Protección de Datos Personales, and the law is scheduled to take effect on December 1, 2026. The government has sent Congress a bill to push that date back, and the agency was not yet running when we checked. Check the Biblioteca del Congreso Nacional for the current status.
• The EU has adopted Regulation (EU) 2025/2518, which sets common procedures for cross-border GDPR cases. It applies from April 2, 2027. It changes how authorities cooperate, not who they are.
• India: see the warning above. The Board's real powers over companies start in 2027.

Authorities move websites more often than you would expect. Cyprus moved to the gov.cy portal, Iceland's site now redirects into island.is, and several authorities sit behind bot protection that can block automated link checkers. If a link here breaks, the EDPB member list is the most reliable source for current European addresses.

How to use this list

A directory only tells you who exists. To work out which authorities actually have jurisdiction over you, start from your data map. You need to know where you are established, where the people whose data you handle live, and where the processing happens. Then:

1. Find your lead authority, if you have one. Companies with a main establishment in the EU usually deal with one lead supervisory authority for cross-border processing. Companies without an EU establishment do not get that benefit.
2. Check registration and fee duties. The UK charges an annual data protection fee, South Africa requires information officers to be registered, and Kenya and Nigeria run registration schemes. Our regulator explainer covers these.
3. Note the breach-notification channel for each authority you fall under. Most have an online form, and the 72-hour GDPR clock does not leave time to look for it during an incident.
4. Keep contact details for the authorities next to your data subject request process. Complaints to a regulator often start as a request someone thinks you mishandled.

This page is a reference, not legal advice. Before relying on a regulator's jurisdiction or a filing deadline, check its own site.