EU and other cross-border technology laws that reach IT companies outside their home country: NIS2, the EU Data Act, Digital Services Act, Accessibility Act, PIPL and Gulf privacy laws.
An IT company that sells abroad takes on the laws of the markets it serves. The European Union is the most active rule-maker for technology, and its laws usually apply because of where the customer or user is, not where the supplier is based. Other regions, including China and the Gulf states, have their own data laws with cross-border reach.
European Union
NIS2 sets cybersecurity risk management and incident reporting duties for medium and large organisations in a long list of sectors, including managed service providers and digital infrastructure. The EU Data Act sets rules on access to data from connected products and on switching between cloud and other data processing services. The Digital Services Act regulates online intermediaries and platforms. The European Accessibility Act sets accessibility requirements for certain products and services, including e-commerce. Separate guides cover the GDPR, DORA, the Cyber Resilience Act and the AI Act in their own categories.
Other regions
China's Personal Information Protection Law governs personal data of people in China, with strict rules on cross-border transfer. Saudi Arabia and the United Arab Emirates have general personal data protection laws with their own regulators, and the UAE's financial free zones have separate regimes.
Directives and regulations
An EU regulation applies directly in every member state. A directive must be written into each country's national law, so the exact duties and the authority you deal with can differ by country. The guides say which applies and where to find the national law.
At a glance
Mandatory or voluntary: international it regulations
European Union. Applies to intermediary services offered to recipients in the EU, wherever the provider is established.
European Parliament and Council; enforced by the European Commission (for very large platforms and search engines) and national Digital Services Coordinators
European Union. Applies to manufacturers and data holders of connected products and related services placed on the EU market, cloud and edge providers serving EU customers, and others, wherever they are established.
European Parliament and Council; enforced by national competent authorities and data coordinators
European Union member states, through national laws transposing the directive. Non-EU providers of certain digital services offering them in the EU must designate a representative.
European Parliament and Council; enforced by national competent authorities and CSIRTs, coordinated by the NIS Cooperation Group and ENISA
United Arab Emirates, outside the DIFC and ADGM financial free zones, which have their own data protection laws. Applies to controllers and processors in the UAE and to those outside processing data of people in the UAE.
UAE federal government; regulated by the UAE Data Office (being consolidated into a new federal AI and data authority in 2026)
Australia. Applies to Australian Government agencies and to organisations with an Australian link, including foreign businesses carrying on business in Australia, subject to the small business exemption.
Parliament of Australia; regulated by the Office of the Australian Information Commissioner (OAIC)
Germany, with growing use across Europe. Required by German federal administration and, by law, for cloud processing of health data in the German healthcare system.
Bundesamt für Sicherheit in der Informationstechnik (BSI), Germany's Federal Office for Information Security
European Union. Applies directly to EU financial entities and reaches ICT third-party providers worldwide through contracts and, for critical providers, direct oversight.
European Parliament and Council; supervised by national competent authorities and the European Supervisory Authorities (EBA, EIOPA, ESMA)
European Union and EEA, implemented through national laws in each member state. Applies to websites and apps accessing devices of users in the EU, wherever the provider is based.
European Parliament and Council; enforced by national data protection or telecom authorities
Australia. Mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework; widely used voluntarily by Australian businesses and their suppliers.
Australian Signals Directorate (ASD) and its Australian Cyber Security Centre (ACSC)
Transfers of personal data from the EU and EEA (and, through extensions, the UK and Switzerland) to US organisations that self-certify with the US Department of Commerce.
European Commission (adequacy decision) and US Department of Commerce (program administration); enforced by the FTC and the Department of Transportation
European Union. Also applies to providers and deployers outside the EU when they place AI systems on the EU market or the output of their AI is used in the EU (Article 2).
European Parliament and Council of the EU; the European AI Office (European Commission) and national market surveillance authorities
European Union and EEA; also organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Article 3).
European Parliament and Council of the EU; enforced by national supervisory authorities, coordinated by the European Data Protection Board
Brazil. Applies to processing carried out in Brazil, processing aimed at offering goods or services to people in Brazil, and data collected in Brazil, wherever the organisation is based.
National Congress of Brazil; enforced by the Autoridade Nacional de Proteção de Dados (ANPD)
Canada. Applies to private sector organisations collecting, using or disclosing personal information in commercial activity, except where a substantially similar provincial law applies, and to federally regulated employers.
Parliament of Canada; overseen by the Office of the Privacy Commissioner of Canada (OPC)
People's Republic of China (mainland). Also applies to processing outside China of personal information of people in China, for providing products or services to them or analysing their behaviour.
Standing Committee of the National People's Congress; enforced by the Cyberspace Administration of China (CAC) and sector regulators
Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act, DSA)
The Digital Services Act sets EU-wide rules for online intermediaries, from internet access and hosting to social networks, marketplaces and app stores. It keeps liability exemptions for user content but adds tiered due diligence duties: points of contact and transparent terms for all, notice and action and statements of reasons for hosts, complaint handling, dark pattern bans, ad transparency and trader checks for platforms, and risk assessments and audits for very large platforms. Fines can reach 6 percent of global turnover.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)
The EU Data Act gives users of connected products, such as smart devices, vehicles and industrial machines, the right to access and share the data their use generates, and requires manufacturers to design products so data is accessible. It also makes switching between cloud providers easier, bans unfair data contract terms imposed on businesses, lets public bodies request data in exceptional need, protects non-personal data from unlawful foreign access, and sets interoperability rules. It has applied since 12 September 2025.
Directive (EU) 2019/882 on the accessibility requirements for products and services (European Accessibility Act)
The European Accessibility Act is an EU directive that sets common accessibility requirements for key products and services, including e-commerce, consumer banking, e-books, electronic communications, passenger transport services, computers, smartphones and self-service terminals. Since 28 June 2025, businesses offering these to EU consumers must make them accessible, usually by meeting the harmonised standard EN 301 549, which incorporates WCAG 2.1 AA for web content. It applies to non-EU companies selling into the EU.
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)
NIS2 is the EU directive that sets cybersecurity risk-management, incident reporting and governance duties for medium and large organisations in a long list of sectors, including digital infrastructure, managed IT and security service providers, cloud and data centre services, and online platforms. It replaced the 2016 NIS Directive, applies through national laws from October 2024, holds management bodies accountable, requires a 24-hour early warning for significant incidents, and allows fines up to 10 million euros or 2 percent of turnover.
Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 2021, as amended by Royal Decree M/148 of 2023), with its Implementing Regulations and Transfer Regulations
Saudi Arabia's Personal Data Protection Law governs how organisations collect, use, share and transfer personal data of people in the Kingdom, including foreign companies processing their data. It requires a legal basis for processing, privacy notices, data subject rights, security measures, records of processing, breach notification to SDAIA, impact assessments and controlled cross-border transfers. It has been fully enforceable since September 2024, SDAIA has issued dozens of enforcement decisions, and fines reach SAR 5 million per violation.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates)
The UAE Personal Data Protection Law is the country's federal privacy law, in force since January 2022. It requires consent or another lawful basis for processing, gives individuals rights to access, correct, erase, restrict and port data, and imposes duties on security, breach notification, DPOs and cross-border transfers. It does not apply in the DIFC and ADGM, which have their own GDPR-style laws, or to some sectors with specific rules. Its Executive Regulations, which set details and penalties, had still not been issued as of October 2026.
Privacy Act 1988 (Cth) and the Australian Privacy Principles, including the Notifiable Data Breaches scheme and 2024 amendments
The Privacy Act 1988 is Australia's main privacy law. It requires government agencies and most businesses with turnover above A$3 million to follow 13 Australian Privacy Principles on open handling, collection, use, disclosure, cross-border transfers, quality, security, access and correction of personal information. The Notifiable Data Breaches scheme requires notifying the OAIC and individuals of breaches likely to cause serious harm, and penalties reach A$50 million or more for serious interferences.
Cloud Computing Compliance Criteria Catalogue (C5) of the German Federal Office for Information Security (BSI)
BSI C5 is the German Federal Office for Information Security's catalogue of minimum security requirements for cloud services. Independent auditors test a provider against the criteria and issue an attestation report, much like a SOC 2 report, which customers use to assess the service. C5 is expected by German public bodies and enterprises and is legally required for cloud processing of health data in the German healthcare system. A new version, C5:2026, adds criteria on areas such as key management, confidential computing and post-quantum cryptography.
Cyber Essentials and Cyber Essentials Plus, the UK government-backed certification scheme (Requirements for IT Infrastructure v3.3)
Cyber Essentials is the UK government-backed certification that shows an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. It is required for many UK government contracts and is common in supply chains. The April 2026 version 3.3 confirmed that cloud services can never be excluded from scope and that cloud logins must use MFA. Cyber Essentials Plus adds independent technical testing.
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
The Cyber Resilience Act is the EU law that makes cybersecurity a legal requirement for hardware and software products sold in the EU. Manufacturers must design products to essential security requirements, handle vulnerabilities throughout a support period, provide security updates, keep a software bill of materials, carry out conformity assessment and apply CE marking. From 11 September 2026 they must report actively exploited vulnerabilities and severe incidents within 24 hours, and most other duties apply from December 2027.
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA is the EU regulation on digital operational resilience for the financial sector. Since January 2025 it has required banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and other financial entities to manage ICT risk, report major ICT incidents, test resilience and manage ICT third-party providers under strict contract rules. Software, cloud and IT service providers to these firms must accept DORA contract terms, and critical providers are overseen directly by EU supervisors.
Directive 2002/58/EC on privacy and electronic communications, as amended by Directive 2009/136/EC (the "cookie law")
The ePrivacy Directive is the EU law behind cookie banners. Article 5(3) requires prior consent before storing or accessing information on a user's device, such as cookies, pixels, local storage and fingerprinting, unless strictly necessary for a service the user requested. It also restricts unsolicited electronic marketing and protects the confidentiality of communications, traffic and location data. It sits alongside the GDPR and is enforced through national laws, often by data protection authorities.
Australian Signals Directorate (ASD) Essential Eight mitigation strategies and Essential Eight Maturity Model
The Essential Eight is the Australian Signals Directorate's set of eight prioritised mitigation strategies against common cyber attacks: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. The Maturity Model defines levels one to three for each strategy. It is mandatory for many Australian government entities and widely required of suppliers, and ASD began consulting in 2026 on a broader successor series.
EU-U.S. Data Privacy Framework (DPF), with the UK Extension and the Swiss-U.S. DPF
The EU-U.S. Data Privacy Framework lets EU and EEA organisations transfer personal data to US companies that self-certify to it, without standard contractual clauses or transfer impact assessments for those transfers. US organisations commit to the DPF Principles on notice, choice, onward transfer, security, data integrity, access and recourse, under FTC or Department of Transportation enforcement. It replaced the invalidated Privacy Shield, has UK and Swiss counterparts, and faces a pending legal challenge.
Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744
The EU AI Act is the European Union's law on artificial intelligence. It bans certain AI practices, sets strict requirements for high-risk AI systems used in areas such as employment, education, credit and critical infrastructure, imposes transparency duties on chatbots and AI-generated content, and regulates general-purpose AI models. It applies in stages: prohibitions since February 2025, general-purpose AI rules since August 2025, transparency from August 2026, and high-risk rules from December 2027 and August 2028 after the 2026 Digital Omnibus amendments.
General Data Protection Regulation, Regulation (EU) 2016/679
The GDPR is the European Union's data protection law. It sets the rules for processing personal data of people in the EU: lawful bases, transparency, data minimisation, security, individual rights, breach notification within 72 hours, and limits on transfers outside the EU. It applies to EU organisations and to companies elsewhere that offer goods or services to people in the EU or monitor them. Fines can reach 20 million euros or 4 percent of worldwide annual turnover.
Lei Geral de Proteção de Dados Pessoais (Brazil's General Personal Data Protection Law, Law No. 13,709/2018)
The LGPD is Brazil's general data protection law, closely modelled on the GDPR. It applies to public and private organisations processing personal data in Brazil or of people in Brazil, requires one of ten legal bases for processing, grants data subjects rights such as access, correction, deletion and portability, requires a data protection officer, security measures and incident reporting to the ANPD within three business days, regulates international transfers and allows fines of up to 2 percent of Brazilian revenue.
Personal Data Protection Act 2012 (Singapore), as amended in 2020
Singapore's Personal Data Protection Act governs how private sector organisations collect, use and disclose personal data. It sets obligations covering consent, purpose limitation, notification, access and correction, accuracy, protection, retention, cross-border transfers, breach notification and accountability, plus Do Not Call rules. Organisations must appoint a data protection officer, notify the PDPC of notifiable breaches within three calendar days, and face penalties of up to 10 percent of Singapore turnover.
Personal Information Protection and Electronic Documents Act (Canada, S.C. 2000, c. 5)
PIPEDA is Canada's federal private sector privacy law. It requires organisations that collect, use or disclose personal information in commercial activity to follow ten fair information principles, including accountability, meaningful consent, limited collection, safeguards, openness and individual access. Since 2018 it has required reporting of breaches that create a real risk of significant harm. Quebec, Alberta and British Columbia have their own laws, and Bill C-36 proposes to replace PIPEDA's privacy part.
Personal Information Protection Law of the People's Republic of China (2021)
China's Personal Information Protection Law is the country's main privacy law. It applies to processing in China and to foreign organisations that offer products or services to people in China or analyse their behaviour. It requires a legal basis for processing, separate consent for sensitive data and cross-border transfers, impact assessments, security measures and incident notification, and controls transfers abroad through CAC security assessments, standard contracts or certification. Fines reach RMB 50 million or 5 percent of annual revenue.
Trusted Information Security Assessment Exchange (TISAX), based on the VDA Information Security Assessment (VDA ISA) catalogue
TISAX is the automotive industry's shared information security assessment and exchange mechanism. Suppliers, service providers and software vendors that handle sensitive information or prototypes for carmakers are assessed against the VDA ISA catalogue by accredited audit providers, and the results are shared with customers through the ENX platform as TISAX labels. Labels cover information protection, availability, prototype protection and data protection. The new ISA2027 catalogue applies to assessments ordered from 1 January 2027.
UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
The UK GDPR and the Data Protection Act 2018 form the UK's data protection law, kept from the EU GDPR after Brexit and amended by the Data (Use and Access) Act 2025. The core principles, lawful bases, rights and breach reporting match the EU GDPR, but the UK now has recognised legitimate interests, more flexible rules for automated decisions, changes to subject access and complaints, cookie exemptions and its own transfer rules. It applies to UK organisations and to companies abroad that target UK residents.
Many do, when you offer products or services in the EU or process data of people there. Each guide sets out its own territorial scope.
What is the difference between an EU directive and a regulation?
A regulation applies directly in every member state. A directive sets goals that each member state must write into national law, so details vary by country.
Does NIS2 apply to software companies?
It can, depending on size and sector. Managed service providers, managed security service providers and some digital providers are in scope. The NIS2 guide explains the tests.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
