Data protection laws around the world share a common backbone: organizations that collect personal information owe enforceable duties to the people that information describes, and those duties usually follow the person across borders. More than 130 countries now have some version of such a law on the books. The European Union’s General Data Protection Regulation set the template, and most later frameworks in Latin America, Asia, and beyond adapted it to local legal traditions. The United States is the notable outlier, relying on a mix of federal sector laws and a growing patchwork of state statutes rather than a single omnibus rule.
What follows is a region-by-region view of the major regimes, the rights they grant you, and the rules that govern moving data between them.
Why These Laws Reach Foreign Companies
The most consequential feature of modern privacy law is that it follows the person, not the company. If a business is based in one country but collects data from residents of another, it is likely subject to the privacy rules where those residents live. This principle, known as extraterritorial application, prevents companies from dodging strict requirements simply by incorporating overseas or hosting servers in a permissive jurisdiction.
Article 3 of the GDPR is the clearest example. It applies to any organization that processes data belonging to people in the EU when that processing relates to offering them goods or services, whether or not the transaction involves a payment.1General Data Protection Regulation (GDPR). Art. 3 GDPR – Territorial Scope Using the local language or currency of an EU member state on a website is treated as evidence of targeting. Monitoring behavior triggers the same obligations. An app that tracks browsing habits or builds advertising profiles of EU residents must comply with the GDPR even if the company behind it has no office, employee, or server anywhere in Europe.2European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
China’s PIPL, Brazil’s LGPD, and South Korea’s PIPA all contain similar provisions applying their rules to foreign companies handling domestic residents’ data. The practical effect is that any company with an international customer base has to comply with the strictest law that reaches its operations, not just the law where its headquarters sits.
Rights You Have Almost Everywhere
Despite their differences, virtually every modern data protection law grants individuals the same basic toolkit of rights.
- Access. You can ask what personal data an organization holds about you, why it has that data, and who it has shared it with. Companies generally must respond within one month.3Information Commissioner’s Office. A Guide to Subject Access
- Correction. If your data is inaccurate or incomplete, you can demand it be fixed. This matters especially in credit scoring or medical records, where a single error can cascade.
- Deletion. Often called the “right to be forgotten,” this lets you request erasure when the data is no longer needed, when you withdraw consent, or when it was collected unlawfully. The right is not absolute; organizations can refuse when they need the data to comply with a legal obligation, defend legal claims, or serve the public interest.4General Data Protection Regulation (GDPR). Art. 17 GDPR – Right to Erasure (Right to Be Forgotten)
- Portability. You can obtain your data in a machine-readable format and move it to a competing service.
- Objection. You can object to certain kinds of processing, particularly direct marketing. Under the GDPR, once you object to marketing use of your data, the organization must stop immediately with no exceptions.5General Data Protection Regulation (GDPR). Art. 21 GDPR – Right to Object
- Protection from purely automated decisions. When an algorithm makes a decision with legal or similarly significant consequences, such as denying a loan or an insurance claim, you can generally request human review and an explanation.6General Data Protection Regulation (GDPR). Art. 22 GDPR – Automated Individual Decision-Making, Including Profiling
Not every country’s law includes all of these rights, and the details vary. Portability is well developed in the GDPR and Brazil’s LGPD but weaker elsewhere. The right to an explanation of automated decisions is gaining traction in China and the EU but barely exists in American law. Still, if you interact with a major international company, you can almost certainly exercise access, correction, and deletion rights regardless of where you live.
Europe: The General Data Protection Regulation
The GDPR remains the most influential data protection law in the world, and it created the blueprint that dozens of other countries later adapted. It applies across all 27 EU member states plus the European Economic Area, and its extraterritorial reach extends to virtually any company doing business with European residents.
Organizations subject to the GDPR must appoint a Data Protection Officer if their core activities involve large-scale processing of sensitive data such as health records or biometrics, or require regular, systematic monitoring of individuals.7GDPR-Text. Article 37 GDPR – Designation of the Data Protection Officer Before launching any processing activity that poses a high risk to individual privacy, they must conduct a Data Protection Impact Assessment analyzing whether the collection is necessary, proportionate, and adequately safeguarded.
The financial penalties are what get headlines. The most serious violations, including ignoring core processing principles or violating data subject rights, carry fines of up to €20 million or 4% of total worldwide annual turnover from the preceding financial year, whichever is higher.8General Data Protection Regulation (GDPR). Art. 83 GDPR – General Conditions for Imposing Administrative Fines Each member state maintains a Supervisory Authority empowered to investigate complaints, order companies to stop processing, and impose those fines. Regulators have not been shy about using that authority; penalties in the hundreds of millions of euros have been levied against major technology companies for issues ranging from inadequate consent mechanisms to unlawful data transfers.
The Americas: Brazil and Canada
Brazil’s General Data Protection Law
Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD) closely mirrors the GDPR in structure and philosophy. It applies to data processing carried out in Brazil or involving data belonging to individuals located in the country, regardless of where the processing company is based. Like the GDPR, the LGPD requires a clear legal basis for every instance of processing, whether that is explicit consent, fulfillment of a contract, or a legitimate interest.
The National Data Protection Authority (ANPD) oversees enforcement. Companies must maintain records of their processing activities and report security breaches. Fines can reach 2% of the company’s revenue in Brazil for the preceding fiscal year, capped at 50 million reais (roughly $9 million) per violation.9LGPD-Brazil. Article 52 – Administrative Sanctions by the National Authority The LGPD also mandates a “privacy by design” approach, meaning organizations must build data protection into their systems from the start.
Canada’s PIPEDA
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) takes a principles-based approach rather than prescribing granular rules. Organizations must follow ten fair information principles covering accountability, consent, limiting collection and retention, accuracy, and safeguards, among others.10Office of the Privacy Commissioner of Canada. PIPEDA Requirements in Brief The law applies to private-sector organizations engaged in commercial activity, defined broadly to include transactions, bartering, and fundraising lists.
The Privacy Commissioner of Canada investigates complaints and can make recommendations, though the office historically lacked the power to issue binding orders or levy fines comparable to EU regulators. Canada is working to replace PIPEDA with modernized legislation that would bring its enforcement tools closer to the GDPR model.
Asia-Pacific: China, Japan, South Korea, and India
China’s Personal Information Protection Law
China’s PIPL, which took effect in November 2021, is one of the most assertive privacy laws anywhere. It places particular emphasis on sensitive personal information, a category that includes biometrics, religious beliefs, medical records, financial accounts, and location tracking. Organizations must obtain separate, specific consent before processing any sensitive data.11National People’s Congress of the People’s Republic of China. Personal Information Protection Law of the People’s Republic of China
The PIPL also contains detailed rules on automated decision-making. Companies that use algorithms to push personalized content or set individualized pricing must be transparent about how those systems work and cannot impose unreasonable differential treatment. Individuals whose rights are significantly affected by an automated decision can demand an explanation and refuse to be bound by it.
Penalties for serious violations can reach 50 million yuan (about $7 million) or 5% of the company’s annual revenue, and regulators can order a company to suspend or shut down operations entirely. Responsible individuals within the company can face personal fines and bans from holding senior management positions.
Japan’s Act on the Protection of Personal Information
Japan’s APPI, overseen by the Personal Information Protection Commission (PPC), takes a more moderate approach.12Personal Information Protection Commission, Japan. Personal Information Protection Commission, Japan The law distinguishes between fully anonymized data, which can be used freely, and pseudonymized data, which still carries protection obligations. Japan was one of the first Asian countries to receive a GDPR adequacy decision from the European Commission, enabling free data flows between Japan and the EU.
The PPC issues detailed guidelines on handling personal identifiers and “special care-required” information such as medical history, criminal records, and racial or ethnic origin. Companies must report breaches and notify affected individuals when their rights may be at risk. Japan has progressively strengthened the APPI through amendments, bringing its requirements closer to the GDPR standard with each revision.
South Korea’s Personal Information Protection Act
South Korea’s PIPA is widely considered one of the strictest privacy regimes globally. The Personal Information Protection Commission (PIPC) has broad authority to investigate violations and impose administrative fines calculated as a percentage of the company’s relevant revenue. PIPA requires a clear legal basis for every act of data collection and mandates strict data destruction protocols once the original purpose has been fulfilled. In cases of intentional data theft or unauthorized disclosure, criminal penalties including imprisonment can apply.
India’s Digital Personal Data Protection Act
India’s DPDPA, enacted in 2023, brought the world’s most populous country into the modern privacy landscape. The law applies to digital personal data processed within India and to processing outside India if it relates to offering goods or services to people in the country. Consent must be “free, specific, informed, unconditional and unambiguous” and can be withdrawn at any time with the same ease it was given.13Ministry of Electronics and Information Technology, Government of India. The Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
The DPDPA introduces the concept of “Significant Data Fiduciaries,” large organizations designated by the government that face heightened obligations. These entities must appoint a Data Protection Officer based in India, conduct periodic Data Protection Impact Assessments, and submit to independent data audits. Penalties are tiered by severity, reaching up to ₹250 crore (approximately $30 million) for the most serious failures, such as systematic non-compliance with orders from the Data Protection Board of India.
The United States: Federal Sector Laws and a Growing State Patchwork
The United States stands out among major economies for having no single comprehensive federal privacy law. Instead, it operates a layered system: a handful of federal statutes covering specific industries and a rapidly expanding collection of state-level laws trying to fill the gaps.
Federal Laws
The Federal Trade Commission serves as the closest thing to a national privacy regulator, using its authority under Section 5 of the FTC Act to pursue companies engaged in unfair or deceptive data practices. When a company violates its own privacy policy or fails to maintain reasonable security, the FTC can investigate and impose penalties.14Federal Trade Commission. Privacy and Security Enforcement That authority is reactive, though; the FTC typically acts after harm has occurred rather than setting detailed rules in advance.
Two sector-specific laws fill some of the gaps. HIPAA establishes national standards for protecting medical records and health information held by healthcare providers, insurers, and their business associates.15U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule The Gramm-Leach-Bliley Act requires financial institutions to explain their data-sharing practices to customers and maintain safeguards for sensitive financial information.16Federal Trade Commission. Gramm-Leach-Bliley Act These laws provide strong protection within their domains but leave the majority of consumer data, the kind collected by social media platforms, retailers, and data brokers, without dedicated federal coverage.
The Children’s Online Privacy Protection Act (COPPA) adds a further layer by restricting how websites and apps can collect data from children under 13. Operators must obtain verifiable parental consent and must give parents access to that data and the ability to delete it.17Federal Trade Commission. COPPA Safe Harbor Program
State Privacy Laws
California led the state-level movement with the California Consumer Privacy Act, later strengthened by the California Privacy Rights Act. Together they grant residents the right to opt out of the sale of their personal information, limit the use of sensitive data like precise geolocation, and request deletion. The CPRA also created the California Privacy Protection Agency as a dedicated enforcement body.18State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Businesses that violate the CCPA face civil penalties of up to $2,500 per unintentional violation or $7,500 per intentional violation.19California Privacy Protection Agency. California Consumer Privacy Act of 2018 The law also includes a private right of action for data breaches; consumers can sue for statutory damages of $100 to $750 per person per incident, or actual damages, whichever is greater, when a breach results from the company’s failure to maintain reasonable security.20California Legislative Information. Cal. Civ. Code 1798.150 That private right of action is unusual in American privacy law and gives the statute real teeth beyond what regulators alone can do.
As of 2026, roughly twenty states have enacted comprehensive consumer privacy laws. Each carries its own definitions of personal information, timelines for responding to consumer requests, and exemptions for small businesses. Every state plus the District of Columbia also has a data breach notification law requiring companies to alert residents when their personal information is compromised, with deadlines ranging from 30 to 60 days depending on the state.
Rules for Moving Data Across Borders
Collecting data legally in one country does not automatically mean it can be sent to another. Most major privacy frameworks restrict international transfers unless the receiving country offers adequate protections or the transferring organization puts specific safeguards in place.
Adequacy Decisions and Contractual Safeguards
The simplest mechanism is an adequacy decision, in which one government formally recognizes that another country’s legal framework provides an essentially equivalent level of protection. When such a decision exists, data flows freely between the two jurisdictions without additional paperwork. The European Commission has issued adequacy decisions for a limited number of countries, and the status is periodically reviewed and can be revoked if protections weaken.
When no adequacy decision exists, organizations typically rely on Standard Contractual Clauses, pre-approved contract terms that obligate the data recipient to uphold the privacy standards of the sending jurisdiction. The EU adopted modernized SCCs in June 2021, replacing three earlier versions with a modular set of clauses covering various transfer scenarios.21European Commission. Standard Contractual Clauses (SCC) Large multinationals can alternatively adopt Binding Corporate Rules, an internal code of conduct reviewed and approved by data protection authorities that permits transfers between the company’s global offices.
The EU-U.S. Data Privacy Framework
The current mechanism between the EU and the United States, the EU-U.S. Data Privacy Framework adopted in July 2023, allows U.S. companies to self-certify their compliance with a set of privacy principles administered by the Department of Commerce.22EUR-Lex. Commission Implementing Decision (EU) 2023/1795 Once certified, a company is placed on the Data Privacy Framework List, and personal data can flow to it from the EU without additional safeguards. Participation is voluntary, but once a company self-certifies, compliance becomes legally enforceable by the FTC, and the company must re-certify annually.23Data Privacy Framework. Data Privacy Framework (DPF) Overview
China’s Approach
China is more restrictive. Under the PIPL, organizations that need to send personal data outside the country must follow one of several prescribed pathways: pass a security assessment organized by the Cyberspace Administration of China, obtain certification from an authorized professional institution, or sign a government-approved standard contract with the foreign recipient. Before any transfer, the organization must conduct a personal information protection impact assessment evaluating the risks and the legal environment of the receiving country. Operators of critical information infrastructure and companies transferring data above certain volume thresholds face the most rigorous requirements.
Cross-border transfer rules are among the most actively evolving areas of privacy law worldwide. Companies that transfer data internationally without a valid legal mechanism risk immediate suspension of those transfers and substantial fines from multiple regulators at once.