Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014)
Marketing

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) AL-DPA-14: Direct Marketing

Direct marketing communications require prior consent and a simple opt-out mechanism in every communication.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 304 controls across 120 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 7 controls

  • CH-FADP-19 Transparency and proactive information
  • CH-FADP-21 Data protection impact assessments
  • CH-FADP-24 Cross-border transfer safeguards
  • FADP-10 Cross-Border Disclosure (Articles 16-18)
  • FADP-16 FDPIC Independence and Functions
  • FADP-7 Data Protection Impact Assessment (Articles 9-10)
  • FADP-9 Data Protection Advisor (Articles 14-15)

GDPR · 5 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 4 controls

Nebraska Data Privacy Act · 4 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-4 Sensitive Data Processing Consent and Childrens Protections
  • NDPA-7 Data Protection Assessments and Processor Contracts
  • NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties

Nigeria Data Protection Act 2023 (NDPA) · 4 controls

  • NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission
  • NG-NDPA-4 Data Subject Rights and Automated Decision-Making
  • NG-NDPA-7 Cross-Border Data Transfers and International Cooperation
  • NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

Azerbaijan Law on Personal Data (2010) · 3 controls

  • AZ-DPA-12 Article 13 - Cross-border transfer
  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

Bahrain PDPL · 3 controls

Barbados Data Protection Act 2019 · 3 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-17 Section 24 - Appropriate Safeguards
  • BB-DPA-4 Section 4 - Principles Relating to Processing

FDA 21 CFR Part 11 · 3 controls

  • Part11.30 Controls for open systems (21 CFR §11.30)
  • Part11.AuditTrail Audit trail requirements - secure computer-generated time-stamped (21 CFR §11.10(e))
  • Part11.RecordRetention Record protection + retention + readiness for inspection (21 CFR §11.10(b) + (c))

Family Educational Rights and Privacy Act (FERPA) · 3 controls

ISO 13485 · 3 controls

ISO 27017 · 3 controls

ISO 27018 · 3 controls

ISO 27799 · 3 controls

ISO/IEC 27011:2024 · 3 controls

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 3 controls

Iowa Consumer Data Protection Act · 3 controls

Jamaica Data Protection Act 2020 · 3 controls

MTCS (Singapore) · 3 controls

Maryland Online Data Privacy Act of 2024 · 3 controls

Mauritius DPA · 3 controls

Mexico LFPDPPP · 3 controls

NIST Privacy Framework · 3 controls

  • NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)
  • NISTPF-8 Protect-P Information Protection Processes (PR.PO-P)

NIST SP 800-190 · 3 controls

Nigeria Data Protection Regulation (NDPR) · 3 controls

  • NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security
  • NGNDPR-6 Data Protection Officer, DPCOs, and Processor Obligations
  • NGNDPR-7 Cross-Border Transfer of Personal Data under NDPR Section 2.7-CBT

Oregon Consumer Privacy Act · 3 controls

  • OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices
  • OREGONCPA-7 Processor Contracts, Cross-Border Transfers, DPAs
  • OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring

PDPA Singapore · 3 controls

  • PDPASG-1 Accountability, Records, DPO Appointment, and Training
  • PDPASG-4 Children's Data, DPIA, and Privacy by Design
  • PDPASG-6 Transfer Limitation, Cross-Border Safeguards, and Data Intermediary Oversight

PDPA Thailand · 3 controls

  • PDPATH-4 DPIA, Privacy by Design, Children's Data
  • PDPATH-6 Cross-Border Transfer and Processor Engagement
  • PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training

POPIA · 3 controls

  • POPIASA-4 Special Personal Information, Children, Information Quality, Documentation
  • POPIASA-6 Transborder Information Flows, Direct Marketing
  • POPIASA-7 Information Officer, Records of Processing, Notification, Training

Personal Data Act (personopplysningsloven) · 3 controls

  • NORWAY-4 DPIA, Privacy by Design, Records of Processing
  • NORWAY-6 International Transfers and Processor Agreements
  • NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training

Privacy Act 1988 (Australia) · 3 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-3 APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children

Privacy Act 2020 · 3 controls

  • NZPRV-5 IPP 11-12 Disclosure, Cross-Border Disclosure (Schedule 8)
  • NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design
  • NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training

Regulation on the European Health Data Space (EHDS) · 3 controls

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)
  • EHDSREG-4 Digital Health Authorities, Governance, MyHealth@EU
  • EHDSREG-5 Cross-Border Health Data Flows

Saudi Arabia PDPL · 3 controls

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

Trinidad and Tobago Data Protection Act 2011 · 3 controls

Uganda Data Protection and Privacy Act (2019) · 3 controls

  • UGA-3 Accountability Principle
  • UGA-6 Personal Data Protection Office
  • UGA-7 Data Protection Officer

Belgium Data Protection Act (Wet van 30 juli 2018, Loi du 30 juillet 2018) · 2 controls

  • BE-DPA-14 Criminal penalties
  • BE-DPA-7 Processing of criminal conviction and offence data

ISO/IEC 27400:2022 · 2 controls

India DPDP Act · 2 controls

Indiana Consumer Data Protection Act · 2 controls

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 2 controls

Jordan Draft Personal Data Protection Law (2022) · 2 controls

Kentucky Consumer Data Protection Act · 2 controls

LGPD · 2 controls

Law No. 172-13 on the Protection of Personal Data · 2 controls

Ley Orgánica de Protección de Datos Personales (LOPDP) · 2 controls

Liechtenstein DPA · 2 controls

MARS-E · 2 controls

MDS2 (Medical Device) · 2 controls

Malaysia PDPA 2010 · 2 controls

Minnesota Consumer Data Privacy Act · 2 controls

Montana Consumer Data Privacy Act · 2 controls

NIST SP 800-122 · 2 controls

  • NISTSP122-7 PII Sharing, Cross-Border Transfers, and Third-Party Agreements
  • NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance

NIST SP 800-144 · 2 controls

  • NISTSP144-3 Data Classification, Handling, and Sovereignty
  • NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access

NIST SP 800-145 · 2 controls

  • NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management
  • NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition

NIST SP 800-146 · 2 controls

  • NISTSP146-6 Cloud Security and Privacy Recommendations
  • NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability

New Hampshire Data Privacy Act · 2 controls

  • NHPA-7 Data Protection Assessments and Processor Contracts
  • NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties

New Jersey Data Privacy Act · 2 controls

  • NJDPA-7 Data Protection Assessments and Processor Contracts
  • NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO

Qatar DPL · 2 controls

  • QATAR-6 Cross-Border Transfer and Processor Management
  • QATAR-7 DPO, Records, Retention, Marketing, Training

South Korea PIPA · 2 controls

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 2 controls

Taiwan PDPA · 2 controls

UK Age Appropriate Design Code (Children's Code) · 2 controls

UK GDPR (UK General Data Protection Regulation) · 2 controls

Uruguay DPL · 2 controls

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 2 controls

Virginia CDPA · 2 controls

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Armenia Law on Protection of Personal Data (2015) · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-8 APP 8 - Cross-border disclosure of personal information

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • P1-S4 Targeting and Communication

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Florida Digital Bill of Rights (FDBR) · 1 control

Georgia Law on Personal Data Protection (2012) · 1 control

Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act) · 1 control

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-25 Supervisory Cooperation and Coordination

ICH E6(R3) - Good Clinical Practice · 1 control

IEEE 7000 · 1 control

ISMAP (Japan) · 1 control

ISO 26000:2010 · 1 control

ISO/IEC 23894:2023 · 1 control

Indonesia PDP Law · 1 control

Israel Protection of Privacy Law (5741-1981) · 1 control

Japan AI Guidelines · 1 control

Law on Personal Data Protection (Official Gazette No. 42/2020) · 1 control

NIS2 Directive Implementing Acts · 1 control

  • NIS2I-5 Cyber Hygiene, Training, Cryptography, and Human Resources Security

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 1 control

NIST SP 800-66 · 1 control

  • NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management

Nevada Gaming Control Board Cybersecurity Requirements · 1 control

  • NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management

New Zealand Information Security Manual (NZISM) · 1 control

  • NZISM-3 Personnel Security, Physical Security, and Cryptography

OECD AI Principles · 1 control

  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

Oman National Cybersecurity Framework · 1 control

  • OMANCS-4 Data Protection, Cryptography, and Privacy Alignment

Paraguay Law on Protection of Personal Data (Law No. 6534/2020) · 1 control

  • PARAGUAY-5 Security of Processing, Data Integrity, Information Security

Peru DPL · 1 control

  • PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

  • RCEPEC-2 Cross-Border Transfer, Computing Facilities, Localization (12.14-15)

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

South Korea ISMS-P · 1 control

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

Student Privacy Pledge 2020 · 1 control

  • STUDPRV-2 Data Subject Rights for Students and Parents

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEF-2 Openness and Transparency

TISAX - Trusted Information Security Assessment Exchange · 1 control

  • TISAXASS-3 Prototype Protection and Confidentiality

Tanzania Personal Data Protection Act (Draft) · 1 control

Telecommunications Sector Security Reforms (TSSR) · 1 control

Texas Data Privacy Act · 1 control

Turkey KVKK · 1 control

UK AI Regulation Framework · 1 control

  • UKAI-2 Sector-Specific Regulator Engagement

UK Data Protection Act 2018 · 1 control

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.1 Incident Response Planning

UNESCO Recommendation on the Ethics of AI · 1 control

  • UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency

UNICEF Policy Guidance on AI for Children (2021) · 1 control

  • UNICEFAI-4 Transparency, Explanation, Adult Capacity

US Consumer Product Safety Commission (CPSC) - Connected Product Safety · 1 control

US ITAR and EAR - Export Control and Data Security · 1 control

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

Vietnam PDPD · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 304 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) controls