One framework. Every jurisdiction you answer to.
Each guide explains the law in plain language, maps every obligation to the control that satisfies it, and sets out what implementation actually looks like on the ground. Written for the people who have to act on it, not only for lawyers.
- 22in-depth guides in this library
- 50+jurisdictions covered across the guides
- 4regions, plus standards and AI
- 1common control set behind every guide
Privacy law guides by jurisdiction
DPDP Act, 2023
Consent and certain legitimate uses, notice, Data Fiduciary duties, Significant Data Fiduciary obligations, breach intimation, and the phased commencement of the DPDP Rules, 2025.
Open guide ChinaPIPL, DSL & CSL
Separate consent, data classification and grading, localisation duties, and the three routes out of the country: security assessment, standard contract, and certification.
Open guide JapanAPPI
Purposes of use, third-party provision records, pseudonymised and anonymised data, breach reporting to the PPC, and cross-border transfer consent.
Open guide South KoreaPIPA
One of Asia's strictest consent regimes, the chief privacy officer role, PIPC enforcement, breach notification and the rules for overseas transfers.
Open guide South East AsiaASEAN privacy laws
Singapore, Malaysia, Indonesia, the Philippines, Thailand and Vietnam, compared side by side so a regional programme stays coherent rather than fragmented.
Open guide Australia & New ZealandPrivacy Act 1988 & 2020
The Australian Privacy Principles, the Notifiable Data Breaches scheme, the reform programme in progress, and New Zealand's Privacy Act 2020.
Open guide European UnionGDPR
Lawful bases, data subject rights, DPIAs, records of processing, international transfers, and the accountability principle that underpins all of it.
Open guide United KingdomUK GDPR & DPA 2018
Where the UK regime still tracks the EU and where it has diverged, ICO expectations, and the transfer routes available after adequacy.
Open guide Switzerland & EEARevised FADP
A GDPR-adjacent modernised regime with its own records, impact assessment and transfer requirements, plus how the EEA states adopted the GDPR.
Open guide Türkiye & wider EuropeKVKK and neighbours
Turkish KVKK registration and transfer rules, alongside the regimes of Serbia, Ukraine and Russia, where localisation duties often decide the architecture.
Open guide United States · CaliforniaCCPA / CPRA
Notice at collection, opt-out of sale and sharing, limits on sensitive personal information, consumer rights, and the enforcement posture of the CPPA.
Open guide United StatesState privacy laws
Virginia, Colorado, Connecticut, Utah, Texas, Oregon and the rest, plus the federal sectoral rules, HIPAA, GLBA and COPPA, that sit underneath them.
Open guide CanadaPIPEDA & Law 25
Ten fair-information principles, meaningful consent, breach records and reporting, and Quebec's Law 25 with its privacy impact assessments.
Open guide BrazilLGPD
Ten legal bases, the encarregado, ANPD incident communication, data subject rights and international transfer clauses.
Open guide Latin AmericaMexico, Argentina, Chile, Colombia & more
The region's fast-modernising regimes, from Mexico's LFPDPPP to Chile's Law 21.719, compared on consent, rights, regulators and transfers.
Open guide United StatesSarbanes-Oxley
Financial reporting law, but the IT general controls, access governance and audit discipline it demands underpin any privacy programme.
Open guide Middle EastGCC data protection laws
The UAE federal PDPL alongside the DIFC and ADGM regimes, Saudi Arabia's PDPL, and the laws of Qatar, Bahrain, Oman, Kuwait, Israel and Jordan.
Open guide AfricaNDPA, POPIA & beyond
Nigeria's NDPA 2023 and the NDPC, South Africa's POPIA and its eight conditions, plus Kenya, Ghana, Egypt, Morocco, Rwanda, Uganda and Tanzania.
Open guide NigeriaNDPA 2023
The Nigeria Data Protection Act 2023, the Commission it created, and the principles, lawful bases and data subject rights it sets out.
Open guide South AfricaPOPIA
The Protection of Personal Information Act, its eight conditions for lawful processing, and the Information Regulator’s expectations.
Open guide European UnionEU AI Act
Prohibited practices, high-risk classification, transparency duties, and the points where the AI Act and the GDPR overlap in a single control set.
Open guide StandardsInternationalISO/IEC 27001, 27701 & 42001
The management-system standards that carry the evidence, how the privacy and AI extensions build on 27001, and what certification actually tests.
Open guideNo guides match that search yet. , or ask us directly.
From statute to working control, in four steps
Every guide follows the same structure, so once you have read one you can read any of them, and compare laws side by side.
- Step 01
Scope and reach
Who the law applies to, the thresholds and exemptions, and when it reaches organisations based outside the country.
- Step 02
Obligations in plain language
Lawful bases, notice, rights, security, transfers and breach duties, explained without legal shorthand and with the key provisions cited.
- Step 03
Mapped to controls
Each obligation is tied to the control that satisfies it, so you can see what you already have from other laws and what is genuinely new.
- Step 04
Evidence and next steps
What a regulator or auditor will ask to see, the common mistakes, and where to start if you need to move quickly.
Key laws compared
Regulators, breach-reporting windows and maximum penalties for the laws our clients ask about most. Open a guide for the detail and the exceptions.
| Law | Regulator | Breach notice to the regulator | Maximum penalty |
|---|---|---|---|
| DPDP Act 2023India | Data Protection Board of India | Without delay, with a detailed report within 72 hours (DPDP Rules, 2025) | Up to ₹250 crore per instance |
| GDPREuropean Union | National supervisory authorities, coordinated by the EDPB | Within 72 hours where feasible, unless the breach is unlikely to pose a risk | Up to €20 million or 4% of worldwide annual turnover, whichever is higher |
| UK GDPR & DPA 2018United Kingdom | Information Commissioner’s Office (ICO) | Within 72 hours where feasible, unless the breach is unlikely to pose a risk | Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher |
| CCPA / CPRACalifornia, United States | California Privacy Protection Agency and the Attorney General | Under California’s breach law, without unreasonable delay; Attorney General notice if more than 500 residents are affected | About $2,500 per violation, or $7,500 if intentional or involving minors under 16 (adjusted for inflation) |
| PIPLChina | Cyberspace Administration of China and sector regulators | Immediately, to the regulator and generally to the people affected | Up to RMB 50 million or 5% of the previous year’s turnover |
| LGPDBrazil | National Data Protection Authority (ANPD) | Within 3 working days where the incident may cause relevant risk or harm | Up to 2% of revenue in Brazil, capped at R$50 million per infraction |
| APPIJapan | Personal Information Protection Commission (PPC) | Preliminary report promptly (about 3 to 5 days), final report within 30 days, or 60 for malicious attacks | Criminal fines of up to ¥100 million for companies that breach PPC orders |
| PIPASouth Korea | Personal Information Protection Commission (PIPC) | Within 72 hours in specified cases | Up to 3% of total revenue, excluding revenue unrelated to the violation |
| POPIASouth Africa | Information Regulator | As soon as reasonably possible after discovery | Administrative fines of up to R10 million, with criminal penalties for some offences |
A summary only, current as of . Thresholds, exemptions and how penalties are calculated vary by law; the relevant guide sets them out. For the latest changes, see the regulatory tracker.
Know the problem, not the law?
Start from what you need to get done. Each path pulls in the laws, tools and services that apply.
Where the laws meet in practice
Privacy law, answered briefly
The questions we hear most often before a programme starts.
Which privacy laws apply to my organisation?
Usually more than you expect. Most modern privacy laws follow the people whose data you process, not where your company is based. The GDPR, India’s DPDP Act, China’s PIPL and Brazil’s LGPD can all apply to organisations abroad that offer goods or services to people in their territory, and several also cover monitoring of behaviour. Start with where your customers, employees and users are, then check each law’s thresholds and exemptions. Our understand a law path walks you through it.
Is a GDPR programme enough for the DPDP Act and other laws?
It is a strong foundation, not a finished answer. The DPDP Act has no general legitimate-interests basis, requires verifiable parental consent for anyone under 18, and lets people read consent notices in English or any language listed in the Eighth Schedule of the Constitution. China’s PIPL requires separate consent for several activities and has its own transfer routes. Map the differences once and run them as local additions to one control set. See consent under the GDPR and the DPDP Act.
How quickly do I have to report a personal data breach?
It depends on the law. The GDPR and UK GDPR expect notice to the regulator within 72 hours of becoming aware, where the breach poses a risk to people. India’s DPDP Rules, 2025 require intimation without delay and a detailed report to the Data Protection Board within 72 hours. South Korea’s PIPA sets 72 hours in specified cases, and Brazil’s ANPD expects three working days. Many laws also require you to tell the people affected. Our 72-hour breach playbook sets out what to do first.
Can one programme cover several jurisdictions at once?
Yes, and it should. Most obligations repeat across laws: notice, a lawful basis or consent, rights handling, security, vendor contracts, breach response and records. We build one common control set and add local requirements on top, so evidence is collected once and reused everywhere. See consultancy and DPO as a service.
How current are these guides?
Guides are reviewed when a law, its implementing rules or regulator guidance changes. This index was last reviewed on 9 October 2026. To follow changes as they happen, use the regulatory tracker or read news and updates.
My country is not listed. Can you still help?
Probably. The regional guides cover more than fifty jurisdictions between them, including several that do not yet have their own card. If you need a law we have not covered, tell us and we will say honestly whether we can help.
Is this legal advice?
No. The guides are general information to help you understand the law and plan your programme. They are not legal advice and do not create a client relationship. For decisions about your organisation, take advice on your specific facts, or talk to us.
Not legal advice. These guides are general information about the law as it stood when they were last reviewed. They do not replace advice on your organisation’s specific facts.
Find out which laws you actually answer to
Applicability rarely follows your head office. It follows your data subjects, your processing, and your vendors. We will map it with you.