## 2 Related Work  
Cataloguing and/or comparing legislation between countries can be very difficult, especially when done on any larger scale. The subject itself is very complex and, at times, convoluted. When this is done internationally, the complexity of local languages (often national legislations are not translated or easily accessible) makes it almost impossible for a small group to achieve. Therefore, these types of research are usually done by large organisations which either have contacts in many countries or are reputable enough to get help in any country they need. The alternative approach we used is to survey people for each of the required locations to get them to give you the wanted information, which is not difficult to obtain for them. For the specific field of data protection, there has not been much study of relevant legislation on a large scale (i.e., including many countries) or comparison between them. However, we have found three [2; 3; 4] such collections that include many countries. Two of the three studies are worldwide in scope and cover many countries, albeit with limited scope as they only link privacy legislation to each of the included countries. The third study remains at the same level of legislation identification but with fewer discussed countries from around the world. While in these studies, the GDPR is mentioned in the EU member states, it is not the focus of the studies and is not discussed in any detail. These studies, therefore, only contain a list of relevant legislation and not much information on what the laws themselves dictate. They are not targeting GDPR issues (and are not centred on the EU) and do not give the users anything to compare policies across multiple countries. [PERSON] et al. [5] surveyed the state of data protection legislation in the selected countries in relation to the implementation of digital forensic readiness. The authors looked at, among others, the EU as a unit and at Germany as a specific representative. For the EU, the focus was the GDPR with additional legislation present in Germany and its effects. The French supervisory authority, CNIL, has prepared a solution for a very specific condition set by the GDPR (Article 45), under which the transfer of personal data to third countries is allowed if the European Commission has confirmed a suitable level of data protection provided by the receiving country's national laws. The CNIL's map [6] on data protection around the world illustrates which countries have adequate data protection laws and for which other means of sufficiently protecting the data must be guaranteed before transferring the data. The possibility of adapting and modifying the GDPR by each of the member states with national law derogations was purposefully a part of the GDPR (e.g., Chapter III Section 5 and Chapter IX) to allow for greater flexibility. [PERSON] and [PERSON] [7], [PERSON] and [PERSON] [8], and [PERSON] and [PERSON] [9] discuss the most probable areas for derogations in GDPR. A comparison of privacy and data protection legislation and policies in the EU (looking at eight member states, including the United Kingdom) was performed by [PERSON] et al. [10]. The study also considered the importance/situation of data protection in a country by looking at the general public's awareness, media coverage, its importance in political debates, etc. However, the research was conducted shortly before the GDPR came into force. While the study did consider the upcoming regulation, it could not predict the changes in national legislation. Finally, three studies are the closest to the work of this paper. All three are centred on identifying derogations from the GDPR and how it is supplemented in the EU. The first [11] covers 16 current member states. The second study [12] included 13 member states, while the third survey [13] collected information for 21 member states. All three were made before the UK's exit from the EU and, as a result, also include data for the UK.