Free tool
Medical data privacy by country.
Before you travel for care, see how your destination’s law treats your health data: consent, sending it abroad, breach deadlines and fines.
Independent research from the law itself. No destination or clinic pays to appear. Checked on 23 September 2026; for your own case, ask a lawyer in that country.
Destinations
12 destinations, one question: who protects your records?
South Korea
Personal Information Protection Act (PIPA)
- Health data
- Sensitive: separate consent
- Breach notice
- 72 hours
- EU adequacy
- Yes
Turkey
Law No. 6698 on the Protection of Personal Data (KVKK), amended by Law No. 7499 in force since 1 June 2024
- Health data
- Special category
- Breach notice
- 72 hours
- EU adequacy
- No
Thailand
Personal Data Protection Act B.E. 2562 (2019)
- Health data
- Sensitive: explicit consent
- Breach notice
- 72 hours
- EU adequacy
- No
China
Personal Information Protection Law (PIPL), in force since November 2021
- Health data
- Sensitive: separate consent
- Breach notice
- Immediately
- EU adequacy
- No
Vietnam
Law on Personal Data Protection No. 91/2025/QH15, in force since 1 January 2026
- Health data
- Sensitive: consent
- Breach notice
- 72 hours
- EU adequacy
- No
Indonesia
Law No. 27 of 2022 on Personal Data Protection (UU PDP)
- Health data
- Specific personal data
- Breach notice
- 3 × 24 hours
- EU adequacy
- No
United Kingdom
UK GDPR and the Data Protection Act 2018
- Health data
- Special category
- Breach notice
- 72 hours
- EU adequacy
- Yes, to 2031
Switzerland
Revised Federal Act on Data Protection (FADP), in force since 1 September 2023
- Health data
- Sensitive personal data
- Breach notice
- As soon as possible
- EU adequacy
- Yes
France
GDPR, applied in France alongside the Public Health Code
- Health data
- Special category (GDPR)
- Breach notice
- 72 hours
- EU adequacy
- EU member
Germany
GDPR, with the Federal Data Protection Act (BDSG)
- Health data
- Special category (GDPR)
- Breach notice
- 72 hours
- EU adequacy
- EU member
Spain
GDPR, with Organic Law 3/2018 (LOPDGDD)
- Health data
- Special category (GDPR)
- Breach notice
- 72 hours
- EU adequacy
- EU member
Hungary
GDPR, with the Info Act (Act CXII of 2011) and the Health Data Act (Act XLVII of 1997)
- Health data
- Special category (GDPR)
- Breach notice
- 72 hours
- EU adequacy
- EU member
Side by side
All 12, compared.
The short version of each law. The country pages carry the full wording and the sources.
| Country | Main law | Health data | Sending it abroad | EU adequacy | Breach notice | Maximum fine |
|---|---|---|---|---|---|---|
| South Korea | PIPA | Sensitive: separate consent | Five legal routes | Yes | 72 hours | Up to 10% of revenue |
| Turkey | KVKK (Law 6698) | Special category | Adequacy or standard contracts | No | 72 hours | Set yearly (Art. 18) |
| Thailand | PDPA | Sensitive: explicit consent | Adequacy, safeguards or consent | No | 72 hours | Up to THB 5 million |
| China | PIPL | Sensitive: separate consent | Assessment, contract or certification | No | Immediately | Up to 5% of turnover |
| Vietnam | Law 91/2025 | Sensitive: consent | Impact assessment | No | 72 hours | Up to 5% of revenue |
| Indonesia | UU PDP (Law 27/2022) | Specific personal data | Equal protection, safeguards or consent | No | 3 × 24 hours | Up to 2% of revenue |
| United Kingdom | UK GDPR | Special category | Adequacy or safeguards | Yes, to 2031 | 72 hours | Up to 4% of turnover |
| Switzerland | Revised FADP | Sensitive personal data | Adequacy or safeguards | Yes | As soon as possible | CHF 250,000 (personal) |
| France | GDPR | Special category (GDPR) | Free within the EEA | EU member | 72 hours | Up to 4% of turnover |
| Germany | GDPR + BDSG | Special category (GDPR) | Free within the EEA | EU member | 72 hours | Up to 4% of turnover |
| Spain | GDPR + LOPDGDD | Special category (GDPR) | Free within the EEA | EU member | 72 hours | Up to 4% of turnover |
| Hungary | GDPR + Info Act | Special category (GDPR) | Free within the EEA | EU member | 72 hours | Up to 4% of turnover |
How we research
From the law, with the source beside it.
Each entry starts from the law itself, the regulator’s own guidance and the European Commission’s adequacy list. Where only a law firm’s summary was available, the reference list says so. Where sources disagree or stay silent, we leave the point out.
No destination, clinic or insurer pays to appear, and nothing here is ranked. The full method is in our editorial policy.
Your own records
The law covers the clinic. Your phone covers you.
Your destination
Travelling somewhere else?
We are adding destinations in the order people ask for them. Tell us where you are going, and we will research it from the law itself.