Rome · Italy
Submission received
Your information has been recorded by WONE.
Industries · Technology & Digital
Fintech across borders
What a business in fintech usually needs to sort out when it works in more than one country, and who at WONE Global handles it.
Typical issues
What Fintech businesses check first
- 01Which financial licence the product triggers
- 02Partner-bank and safeguarding arrangements
- 03AML, KYC and consumer-credit rules
General orientation, not advice. How each applies depends on your markets — your WONE Global professional confirms it.
Services
The services involved
Industry experience
WONE Global Partners with Technology & Digital experience
If no professional is listed for your market, WONE Global arranges qualified local expertise and names them before work begins.
Rome · Italy
Edmonton · Canada
Douala · Cameroon
New Delhi · IndiaWONE Global Partner · India
Sandeep Gupta
Kowloon · Hong KongWONE Global Partner · Hong Kong
Yvonne Chow
Ms. Chow, our director, graduated from Smith College (US), and obtained her master's degree in Religion from Yale University. She is an associate member of Hong Kong Institute of Certified Public Accountants and Institu…
What the guides say · Technology, Data & Cyber
Data and technology rules, market by market
Data and technology rules is usually the first thing fintech businesses check. Choose a market to see its rules.
Africa4 markets
| South AfricaEssentials · source-checked | POPIA governs personal information and is enforced by the Information Regulator. Transfers abroad need a lawful basis under section 72, security compromises must be notified, and information officers must be registered. |
|---|---|
| EgyptEssentials · source-checked | |
| KenyaEssentials · source-checked | |
| NigeriaEssentials · source-checked | The Nigeria Data Protection Act 2023 is enforced by the Nigeria Data Protection Commission. Transfers abroad need adequate protection or an approved transfer instrument, annual audit returns are due by 31 March, and the tax authority is… |
Australia1 market
| AustraliaEssentials · source-checked |
|---|
Central & Eastern Europe1 market
| PolandEssentials · source-checked | The GDPR applies directly and is enforced by UODO, which takes breach notifications in Polish. Tax digitalisation adds technical obligations such as KSeF e-invoicing and electronic JPK_CIT ledgers. |
|---|
East Asia4 markets
| ChinaEssentials · source-checked | Personal information is regulated by the Personal Information Protection Law, in force since November 2021, alongside the Data Security Law and the Cybersecurity Law, amended from 1 January 2026. |
|---|---|
| JapanEssentials · source-checked | This research could not open the Personal Information Protection Commission website, so the Act on the Protection of Personal Information is not covered here. |
| South KoreaEssentials · source-checked | The Personal Information Protection Act is enforced by the Personal Information Protection Commission. Overseas transfers need a lawful basis such as separate consent or standard contractual clauses. |
| Hong KongEssentials · source-checked |
GCC5 markets
| United Arab EmiratesFull guide | The UAE runs three separate data protection regimes. Onshore and in most free zones the federal Personal Data Protection Law (Federal Decree-Law No. |
|---|---|
| Saudi ArabiaFull guide | Saudi Arabia's Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024 and reaches foreign organisations that process data about people in the Kingdom. |
| QatarEssentials · source-checked | |
| BahrainEssentials · source-checked | |
| OmanEssentials · partly source-checked |
Latin America3 markets
| BrazilEssentials · source-checked | The LGPD applies to processing in Brazil and to foreign businesses targeting people in Brazil. It restricts international transfers to listed mechanisms, requires a data protection officer and incident notification, and allows fines of up… |
|---|---|
| ChileEssentials · source-checked | Chile is moving from an older data protection law (Law 19.628 of 1999) to a modern regime under Law 21.719, which creates a data protection agency and is due to apply from 1 December 2026. |
| ColombiaEssentials · source-checked |
North America3 markets
| United StatesFull guide | The United States has no single national privacy law of the GDPR type. Federal rules are sector-based and security-driven, while a growing number of states, led by California, have their own consumer privacy laws. |
|---|---|
| CanadaEssentials · source-checked | PIPEDA governs personal information handled in commercial activities, alongside provincial private-sector laws in some provinces. |
| MexicoEssentials · source-checked | Mexico replaced its private-sector data protection law with a new LFPDPPP by decree published on 20 March 2025. The new law's authority, transfer rules and sanctions could not be confirmed. |
South Asia1 market
| IndiaFull guide | India's Digital Personal Data Protection Act 2023 (DPDP Act) is being brought into force in phases under the DPDP Rules 2025. |
|---|
Southeast Asia5 markets
| SingaporeFull guide | Singapore regulates private-sector handling of personal data through the Personal Data Protection Act 2012 (PDPA), enforced by the Personal Data Protection Commission. |
|---|---|
| MalaysiaEssentials · source-checked | |
| VietnamEssentials · source-checked | Vietnam's first Law on Personal Data Protection has applied since 1 January 2026. Fines can be revenue-based, including up to 5% of the previous year's revenue for breaches of cross-border transfer rules. |
| IndonesiaEssentials · partly source-checked | |
| ThailandEssentials · source-checked | The Personal Data Protection Act B.E. 2562 (2019) is overseen by the Personal Data Protection Committee. It requires a legal basis for processing, restricts transfers abroad and provides for administrative fines. |
UK & Ireland2 markets
| United KingdomFull guide | The UK runs its own version of the GDPR (the UK GDPR) alongside the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations. |
|---|---|
| IrelandEssentials · source-checked | The GDPR applies directly, supplemented by the Data Protection Act 2018, and the Data Protection Commission is the regulator. Transfers outside the EEA need an adequacy decision or safeguards such as standard contractual clauses. |
Western Europe7 markets
| GermanyFull guide | The EU GDPR applies directly in Germany and is supplemented by the Federal Data Protection Act (BDSG) and the TDDDG for cookies and similar technologies. |
|---|---|
| FranceFull guide | France applies the EU GDPR together with its 1978 Informatique et Libertés law, enforced by the CNIL, which can fine up to EUR 20 million or 4% of worldwide turnover. Breaches that create a risk must be reported to the CNIL within 72… |
| NetherlandsEssentials · source-checked | The GDPR applies directly in the Netherlands, including breach notification within 72 hours where feasible. The national implementing act and the Dutch Data Protection Authority's powers could not be confirmed on an official page. |
| SwitzerlandEssentials · source-checked | The revised Federal Act on Data Protection has applied since 1 September 2023, enforced by the FDPIC, with criminal fines aimed at responsible individuals. Critical infrastructure operators must also report cyberattacks within 24 hours. |
| ItalyEssentials · source-checked | The GDPR applies, supplemented by the Personal Data Protection Code, and the Garante is the supervisory authority. Italy has transposed NIS2, with ACN as the national cybersecurity agency. |
| SpainEssentials · source-checked | The GDPR applies. Spain had not fully notified transposition of NIS2 according to the European Commission's page, and the Verifactu invoicing-software obligation has been deferred to 2027. |
| LuxembourgEssentials · source-checked | The GDPR applies directly in Luxembourg, including 72-hour breach notification where feasible. The national data protection authority (CNPD) and national implementing law were not confirmed. |
Wider Middle East2 markets
| TürkiyeEssentials · source-checked | |
|---|---|
| IsraelEssentials · source-checked | Personal data is protected under the Protection of Privacy Law, 1981, which was substantially updated by Amendment 13 with new enforcement powers for the Privacy Protection Authority. Detailed data security regulations apply to databases. |
Other markets20 markets
| ArgentinaEssentials · source-checked | Data protection is governed by Ley 25.326 of 2000, and Argentina has approved Council of Europe Convention 108. The AAIP acts as the regulator. International transfer rules and penalties were not confirmed. |
|---|---|
| AustriaEssentials · source-checked | |
| BangladeshEssentials · partly source-checked | |
| BelgiumEssentials · partly source-checked | |
| CameroonEssentials · partly source-checked | |
| CyprusEssentials · source-checked | |
| Czech RepublicEssentials · source-checked | The GDPR applies directly in the Czech Republic. The national implementing act, the Office for Personal Data Protection and national cybersecurity law could not yet be confirmed from official sources in this review. |
| DenmarkEssentials · source-checked | |
| EcuadorEssentials · partly source-checked | |
| FinlandEssentials · source-checked | |
| GreeceEssentials · source-checked | |
| HungaryEssentials · source-checked | |
| MoroccoEssentials · source-checked | |
| New ZealandEssentials · source-checked | |
| PanamaEssentials · source-checked | Law 81 of 2019 is Panama's personal data protection law and is enforced by ANTAI through its Directorate for the Protection of Personal Data. It sets consent-based rules, data subject rights and conditions for transfers abroad. |
| PhilippinesEssentials · source-checked | |
| PortugalEssentials · source-checked | The GDPR applies with Act 58/2019 as the national law. According to the European Commission's page, Portugal had not fully notified NIS2 transposition, and CNCS is the national cybersecurity authority. |
| RwandaEssentials · source-checked | |
| UgandaEssentials · source-checked | |
| ZambiaEssentials · partly source-checked |
Our full guides are checked against official sources. Guides drafted with AI are marked as such. None of this is legal or tax advice.
WONE Global Intelligence
Ask about Fintech
Ask in your own words. Answers come from WONE Global's checked records, with every source shown, and end with the named Partner who can act. Go deeper on any point, or build a decision file.