Privacy laws and privacy standards that decide how personal data may be collected, used, shared, transferred and erased: GDPR, CCPA, DPDP, ISO/IEC 27701 and more.
Privacy laws regulate personal data: anything that identifies a person directly or indirectly. Unlike most security standards, they are mandatory. They apply because of who your users are and where they live, not because of where your company is registered. An Indian or US software company with users in the European Union can fall under the GDPR. A company anywhere that offers services to people in India can fall under the DPDP Act.
Your role decides your duties
Most privacy laws separate the organisation that decides why and how data is processed (a controller under the GDPR, a data fiduciary under the DPDP Act, a business under the CCPA) from the organisation that processes it on that party's behalf (a processor, a data processor, a service provider). IT service companies and SaaS vendors are often processors for their clients' data and controllers for their own customer and employee data. The duties differ, and so do the contracts you need.
What the laws have in common
Almost every modern privacy law asks for a lawful reason to process data, clear notice to the people concerned, limits on what you collect and how long you keep it, security safeguards, a way for people to see, correct and delete their data, rules for sending data abroad, and breach notification within a set time. The details, deadlines and penalties differ, which is why each law has its own guide.
Standards that help
ISO/IEC 27701 is a certifiable privacy management standard and the NIST Privacy Framework is a voluntary risk framework. Neither replaces a law, but both give you a structured way to show how you meet several laws at once.
What it means for the software you build
Privacy laws turn into product features: consent capture and records, preference centres, data export, deletion that reaches backups and logs on a schedule, retention jobs, access logging and regional data storage. Building them in early is far cheaper than retrofitting them after a client's privacy review.
Australia. Applies to Australian Government agencies and to organisations with an Australian link, including foreign businesses carrying on business in Australia, subject to the small business exemption.
Parliament of Australia; regulated by the Office of the Australian Information Commissioner (OAIC)
United States. Applies to operators of websites and online services directed to children under 13, or with actual knowledge of collecting from them, including foreign operators serving US children.
US Congress; the Federal Trade Commission makes and enforces the COPPA Rule, with state attorneys general
European Union and EEA, implemented through national laws in each member state. Applies to websites and apps accessing devices of users in the EU, wherever the provider is based.
European Parliament and Council; enforced by national data protection or telecom authorities
Transfers of personal data from the EU and EEA (and, through extensions, the UK and Switzerland) to US organisations that self-certify with the US Department of Commerce.
European Commission (adequacy decision) and US Department of Commerce (program administration); enforced by the FTC and the Department of Transportation
United States. Applies to educational agencies and institutions that receive funds from US Department of Education programs, and reaches their vendors through contracts.
US Congress; administered and enforced by the US Department of Education, Student Privacy Policy Office
European Union and EEA; also organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Article 3).
European Parliament and Council of the EU; enforced by national supervisory authorities, coordinated by the European Data Protection Board
Brazil. Applies to processing carried out in Brazil, processing aimed at offering goods or services to people in Brazil, and data collected in Brazil, wherever the organisation is based.
National Congress of Brazil; enforced by the Autoridade Nacional de Proteção de Dados (ANPD)
Canada. Applies to private sector organisations collecting, using or disclosing personal information in commercial activity, except where a substantially similar provincial law applies, and to federally regulated employers.
Parliament of Canada; overseen by the Office of the Privacy Commissioner of Canada (OPC)
People's Republic of China (mainland). Also applies to processing outside China of personal information of people in China, for providing products or services to them or analysing their behaviour.
Standing Committee of the National People's Congress; enforced by the Cyberspace Administration of China (CAC) and sector regulators
European Union. Applies to intermediary services offered to recipients in the EU, wherever the provider is established.
European Parliament and Council; enforced by the European Commission (for very large platforms and search engines) and national Digital Services Coordinators
European Union. Applies to manufacturers and data holders of connected products and related services placed on the EU market, cloud and edge providers serving EU customers, and others, wherever they are established.
European Parliament and Council; enforced by national competent authorities and data coordinators
India. Applies to body corporates handling sensitive personal data or information in computer resources, until section 43A of the IT Act is omitted by the DPDP Act.
Ministry of Electronics and Information Technology (then the Department of Information Technology), under section 43A and section 87 of the IT Act, 2000
United Arab Emirates, outside the DIFC and ADGM financial free zones, which have their own data protection laws. Applies to controllers and processors in the UAE and to those outside processing data of people in the UAE.
UAE federal government; regulated by the UAE Data Office (being consolidated into a new federal AI and data authority in 2026)
Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the Notifiable Data Breaches scheme and 2024 amendments
The Privacy Act 1988 is Australia's main privacy law. It requires government agencies and most businesses with turnover above A$3 million to follow 13 Australian Privacy Principles on open handling, collection, use, disclosure, cross-border transfers, quality, security, access and correction of personal information. The Notifiable Data Breaches scheme requires notifying the OAIC and individuals of breaches likely to cause serious harm, and penalties reach A$50 million or more for serious interferences.
California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 and following), and CPPA regulations
The CCPA, as amended by the CPRA, is California's general consumer privacy law. It gives California residents the right to know, delete and correct personal information, to opt out of its sale or sharing for cross-context behavioural advertising, and to limit the use of sensitive personal information. It applies to for-profit businesses meeting revenue or data volume thresholds, requires specific contracts with service providers, and is enforced by a dedicated agency with fines per violation and a private right of action for some data breaches.
Children's Online Privacy Protection Act of 1998 and the FTC Children's Online Privacy Protection Rule (16 CFR Part 312), as amended in 2025
COPPA is the US law that protects the personal information of children under 13 online. Operators of websites, apps, games and services directed to children, or that knowingly collect data from them, must give clear notice, obtain verifiable parental consent before collecting, using or disclosing children's data, keep it secure and limit retention. The FTC amended its rule in 2025, adding separate consent for third-party disclosures, written security programmes and retention policies, with compliance required from April 2026.
Directive 2002/58/EC on privacy and electronic communications, as amended by Directive 2009/136/EC (the "cookie law")
The ePrivacy Directive is the EU law behind cookie banners. Article 5(3) requires prior consent before storing or accessing information on a user's device, such as cookies, pixels, local storage and fingerprinting, unless strictly necessary for a service the user requested. It also restricts unsolicited electronic marketing and protects the confidentiality of communications, traffic and location data. It sits alongside the GDPR and is enforced through national laws, often by data protection authorities.
EU-U.S. Data Privacy Framework (DPF), with the UK Extension and the Swiss-U.S. DPF
The EU-U.S. Data Privacy Framework lets EU and EEA organisations transfer personal data to US companies that self-certify to it, without standard contractual clauses or transfer impact assessments for those transfers. US organisations commit to the DPF Principles on notice, choice, onward transfer, security, data integrity, access and recourse, under FTC or Department of Transportation enforcement. It replaced the invalidated Privacy Shield, has UK and Swiss counterparts, and faces a pending legal challenge.
Family Educational Rights and Privacy Act of 1974 (20 U.S.C. 1232g; 34 CFR Part 99)
FERPA is the US federal law that protects the privacy of student education records held by schools, districts and colleges that receive federal education funding. It gives parents, and students once they turn 18 or attend college, rights to access and correct records, and generally requires consent before personally identifiable information from records is disclosed. Ed-tech and LMS vendors typically receive student data under the school official exception, which limits how they can use and redisclose it.
General Data Protection Regulation, Regulation (EU) 2016/679
The GDPR is the European Union's data protection law. It sets the rules for processing personal data of people in the EU: lawful bases, transparency, data minimisation, security, individual rights, breach notification within 72 hours, and limits on transfers outside the EU. It applies to EU organisations and to companies elsewhere that offer goods or services to people in the EU or monitor them. Fines can reach 20 million euros or 4 percent of worldwide annual turnover.
ISO/IEC 27701 Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance
ISO/IEC 27701 is the international standard for a privacy information management system (PIMS): a managed way to protect personal data and meet privacy obligations as a controller, a processor or both. The 2025 edition made it a standalone, certifiable management system standard with its own clauses 4 to 10, no longer an extension that required ISO/IEC 27001. It includes control sets for controllers and processors and is widely used to structure compliance with laws such as the GDPR.
Lei Geral de Proteção de Dados Pessoais (Brazil's General Personal Data Protection Law, Law No. 13,709/2018)
The LGPD is Brazil's general data protection law, closely modelled on the GDPR. It applies to public and private organisations processing personal data in Brazil or of people in Brazil, requires one of ten legal bases for processing, grants data subjects rights such as access, correction, deletion and portability, requires a data protection officer, security measures and incident reporting to the ANPD within three business days, regulates international transfers and allows fines of up to 2 percent of Brazilian revenue.
NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management
The NIST Privacy Framework is a voluntary tool for managing privacy risk across an organisation. Modelled on the NIST Cybersecurity Framework, it organises privacy outcomes into Core functions for identifying, governing, controlling, communicating about and protecting data processing, and uses Profiles and Implementation Tiers to set targets and measure maturity. It is law-neutral, so organisations use it to build one privacy program that supports GDPR, US state laws, DPDP and other regimes.
Personal Data Protection Act 2012 (Singapore), as amended in 2020
Singapore's Personal Data Protection Act governs how private sector organisations collect, use and disclose personal data. It sets obligations covering consent, purpose limitation, notification, access and correction, accuracy, protection, retention, cross-border transfers, breach notification and accountability, plus Do Not Call rules. Organisations must appoint a data protection officer, notify the PDPC of notifiable breaches within three calendar days, and face penalties of up to 10 percent of Singapore turnover.
Personal Information Protection and Electronic Documents Act (Canada, S.C. 2000, c. 5)
PIPEDA is Canada's federal private sector privacy law. It requires organisations that collect, use or disclose personal information in commercial activity to follow ten fair information principles, including accountability, meaningful consent, limited collection, safeguards, openness and individual access. Since 2018 it has required reporting of breaches that create a real risk of significant harm. Quebec, Alberta and British Columbia have their own laws, and Bill C-36 proposes to replace PIPEDA's privacy part.
Personal Information Protection Law of the People's Republic of China (2021)
China's Personal Information Protection Law is the country's main privacy law. It applies to processing in China and to foreign organisations that offer products or services to people in China or analyse their behaviour. It requires a legal basis for processing, separate consent for sensitive data and cross-border transfers, impact assessments, security measures and incident notification, and controls transfers abroad through CAC security assessments, standard contracts or certification. Fines reach RMB 50 million or 5 percent of annual revenue.
UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
The UK GDPR and the Data Protection Act 2018 form the UK's data protection law, kept from the EU GDPR after Brexit and amended by the Data (Use and Access) Act 2025. The core principles, lawful bases, rights and breach reporting match the EU GDPR, but the UK now has recognised legitimate interests, more flexible rules for automated decisions, changes to subject access and complaints, cookie exemptions and its own transfer rules. It applies to UK organisations and to companies abroad that target UK residents.
General consumer data privacy laws of US states, including Virginia, Colorado, Connecticut, Texas, Oregon and others
With no general federal privacy law, US states have passed their own consumer privacy laws. Starting with California and Virginia, around 20 states now have such laws in effect, most following a similar model: thresholds based on the number of state residents, rights to access, correct, delete and port data, opt-outs from targeted advertising, sale and profiling, consent for sensitive data, data protection assessments, processor contracts and enforcement by the attorney general.
Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act, DSA)
The Digital Services Act sets EU-wide rules for online intermediaries, from internet access and hosting to social networks, marketplaces and app stores. It keeps liability exemptions for user content but adds tiered due diligence duties: points of contact and transparent terms for all, notice and action and statements of reasons for hosts, complaint handling, dark pattern bans, ad transparency and trader checks for platforms, and risk assessments and audits for very large platforms. Fines can reach 6 percent of global turnover.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Act, 2023 is India's first general law on personal data. It regulates the processing of digital personal data by data fiduciaries, gives people rights over their data, requires consent or a listed legitimate use, sets security and breach reporting duties, and creates the Data Protection Board of India. Its Rules were notified in November 2025 and are coming into force in phases through May 2027. Penalties reach 250 crore rupees per instance.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)
The EU Data Act gives users of connected products, such as smart devices, vehicles and industrial machines, the right to access and share the data their use generates, and requires manufacturers to design products so data is accessible. It also makes switching between cloud providers easier, bans unfair data contract terms imposed on businesses, lets public bodies request data in exceptional need, protects non-personal data from unlawful foreign access, and sets interoperability rules. It has applied since 12 September 2025.
Gramm-Leach-Bliley Act (1999): FTC Standards for Safeguarding Customer Information (16 CFR Part 314) and privacy requirements
The Gramm-Leach-Bliley Act is the US law governing how financial institutions protect and share consumers' financial information. Its FTC Safeguards Rule requires non-bank financial institutions, a broad group that includes many fintechs, lenders, brokers and tax preparers, to run a written information security program with a qualified individual in charge, risk assessments, encryption, MFA, monitoring, testing, vendor oversight and incident response, and to notify the FTC of certain breaches.
Health Insurance Portability and Accountability Act of 1996: Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164)
HIPAA is the US federal law that protects health information held by health plans, healthcare clearinghouses and most healthcare providers, and by their business associates, which include many software, cloud and IT vendors. Its Privacy Rule limits uses and disclosures of protected health information, its Security Rule requires administrative, physical and technical safeguards for electronic health information, and its Breach Notification Rule sets deadlines for reporting breaches. Compliance is mandatory where it applies.
ISO/IEC 27018 Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018 is the international code of practice for public cloud providers that process personal data on behalf of their customers. It adds privacy-focused guidance and controls to the ISO/IEC 27002 security controls, covering processing only on customer instructions, no use of personal data for the provider's own purposes without consent, transparency about sub-processors and data locations, breach notification, and return or deletion of data. The 2025 third edition aligns it with the 2022 controls.
Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 2021, as amended by Royal Decree M/148 of 2023), with its Implementing Regulations and Transfer Regulations
Saudi Arabia's Personal Data Protection Law governs how organisations collect, use, share and transfer personal data of people in the Kingdom, including foreign companies processing their data. It requires a legal basis for processing, privacy notices, data subject rights, security measures, records of processing, breach notification to SDAIA, impact assessments and controlled cross-border transfers. It has been fully enforceable since September 2024, SDAIA has issued dozens of enforcement decisions, and fines reach SAR 5 million per violation.
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E))
The SPDI Rules 2011 are India's first rules on personal data protection, made under section 43A of the IT Act. They define sensitive personal data such as passwords, financial information, health records and biometrics, and require body corporates handling it to publish a privacy policy, obtain written consent, limit use and disclosure, control transfers, appoint a grievance officer and implement audited reasonable security practices such as IS/ISO/IEC 27001. They remain in force until the DPDP Act removes section 43A.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates)
The UAE Personal Data Protection Law is the country's federal privacy law, in force since January 2022. It requires consent or another lawful basis for processing, gives individuals rights to access, correct, erase, restrict and port data, and imposes duties on security, breach notification, DPOs and cross-border transfers. It does not apply in the DIFC and ADGM, which have their own GDPR-style laws, or to some sectors with specific rules. Its Executive Regulations, which set details and penalties, had still not been issued as of October 2026.
It can. Article 3 of the GDPR applies it to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there. The GDPR guide explains the tests.
We only process data for our clients. Do privacy laws apply to us?
Yes, usually as a processor or service provider. You need a written contract with each client, must follow their instructions, keep the data secure and help them answer requests from the people concerned.
Is there one certification that proves privacy compliance?
No certification proves compliance with a privacy law. ISO/IEC 27701 certifies a privacy management system, which is useful evidence, but the law itself is enforced by regulators and courts.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
