Data Privacy Laws / Regulations Around The World

Photo by Tim Mossholder on Unsplash.

Disclosures: AI (ChatGPT) assisted with summarizing this information.

Over the last nine years, I’ve had many clients outside the United States. I’ve had to become familiar with a number of countries’ data privacy laws, regulations, and standards. I’ve wanted to put together this summary of laws, rules, regulations, and standards on the topic for a while.

In the digital era, privacy is the ability of an individual to control how their personal information is collected, used, shared, stored, analyzed, and retained in digital systems. It is no longer just about “being left alone.” It’s about control, transparency, and power in a world where nearly every action generates data. Digital Privacy is the right and practical ability of a person to determine what personal data about them is collected, how it is processed, who has access to it, and how long it is retained across digital networks, platforms, and systems. This is a distinct concept from security. A system may be very secure, but then its operator turn around and sell every byte of data it gathers / generates about you to third-parties (ie, no privacy).

We’re going to focus on G20 nations, EU, Singapore, and the Philippines. If this post proves popular, I can add details about other countries later.

Yes, AI (ChatGPT) assisted with summarizing this information. I did edit the text and attempted to verify the information. For several of these laws, I have first-hand experience with implementing policies to address requirements for clients.

Medium.com, as always, doesn’t support tables directly; so, I had to get a little creative. For those who have read my prior posts, I do all coding and text editing in VI/VIM; so, we’re starting with an ASCII table.

GLOBAL DATA PROTECTION COMPARISON (2026 OVERVIEW)

Country / Region | Primary Law                     | Comp? | Key Individual Rights                  | Breach | Cross-Border Rules         | Regulator    | Penalties
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
EU               | GDPR                            | Yes   | Access, Rectify, Erase, Portability    | 72 hrs | Adequacy / SCCs            | DPAs         | Up to 4% global revenue
United Kingdom   | UK GDPR + DPA 2018              | Yes   | Similar to GDPR                        | Yes    | Adequacy / safeguards      | ICO          | Up to 4% global revenue
United States    | Sectoral + State (e.g. CCPA)    | No    | Access, Delete (varies by state)       | State  | No federal adequacy        | FTC + States | Varies by state
Canada           | PIPEDA                          | Yes   | Access, Correction                     | Yes    | Accountability model       | OPC          | Moderate fines
Australia        | Privacy Act 1988                | Yes   | Access, Correction                     | Yes    | Comparable protection      | OAIC         | Multi-million AUD
Brazil           | LGPD                            | Yes   | Access, Correct, Delete                | Yes    | Adequacy / safeguards      | ANPD         | Up to 2% revenue (cap)
Argentina        | Law 25,326                      | Yes   | Access, Correction                     | Yes    | Adequacy framework         | AAIP         | Moderate fines
Mexico           | Federal Privacy Law             | Yes   | Access, Rectify, Cancel, Oppose        | Yes    | Contract safeguards        | INAI         | Administrative fines
China            | PIPL                            | Yes   | Access, Correct, Delete                | Yes    | Strict export controls     | CAC          | Significant fines
India            | DPDP Act 2023                   | Yes   | Access, Correct, Erase                 | Yes    | Govt-controlled transfers  | DP Board     | Heavy financial fines
Japan            | APPI                            | Yes   | Access, Correct, Suspend               | Yes    | Adequacy / safeguards      | PPC          | Fines + orders
South Korea      | PIPA                            | Yes   | Broad (GDPR-like)                      | Yes    | Adequacy / safeguards      | PIPC         | Up to 3% revenue
Indonesia        | PDP Law 2022                    | Yes   | Access, Correct, Delete                | Yes    | Consent + safeguards       | Govt body    | Admin + criminal
Saudi Arabia     | PDPL                            | Yes   | Access, Correct                        | Yes    | Transfer restrictions      | SDAIA        | Significant fines
Turkey           | KVKK                            | Yes   | Access, Correct, Delete                | Yes    | Adequacy / consent         | KVKK Auth    | Administrative fines
South Africa     | POPIA                           | Yes   | Access, Correct                        | Yes    | Adequacy / safeguards      | Info Reg     | Fines + criminal
Philippines      | Data Privacy Act 2012           | Yes   | Access, Correct, Erase                 | Yes    | Comparable protection      | NPC          | Fines + imprisonment
Singapore        | PDPA 2012                       | Yes   | Access, Correct                        | Yes    | Comparable protection      | PDPC         | Up to 10% SG turnover

Comp? = Comprehensive Law?

I put the same data in LibreOffice Calc (their spreadsheet program) and exported it as a JPEG image to get the following. It’s certainly easier to read, but the text cannot be copied.

That represents the end of my 2026 medium.com table definition research. We’ll look into that again ~2031.

More Details

Here’s more detail about each jurisdiction’s privacy/data protection standards for those who are interested. The summaries focus on the core legal frameworks, what individual rights exist, and each jurisdiction’s regulatory approach (as of the time of this writing).

Please note, many nuances and sector-specific rules exist within each country’s system. This post does not attempt to capture those details. When in doubt, contact a lawyer experienced with these topics in the relevant jurisdiction.

I go into more detail for the places that I have lived or spend a lot of time.

European Union (EU)

EU-based members of the G20 are addressed here and not specifically mentioned elsewhere in this post.

Framework: General Data Protection Regulation (GDPR) — comprehensive, rights-based data protection law providing robust privacy rights (access, correction, deletion, portability, consent requirements) and strong obligations on data controllers/processors. GDPR applies across all EU member states and has extraterritorial effect on organizations worldwide processing EU residents’ data.

Enforcement & Standards: Independent Data Protection Authorities in each member state enforce GDPR. Personal data transfers outside the EU require safeguards unless the destination has an adequacy decision.
Status: Considered a global “gold standard” but currently subject to proposed reforms that may relax some requirements. Especially, around AI, cookie consent, and anonymized data use.

GDPR, Article 4 defines personal data as “Any information relating to an identified or identifiable natural person.” Note the term “personal data” rather than the US-term “Personally Identifiable Information.” An identifiable person is someone who can be identified:

• Directly (by name or ID number), or
• Indirectly (by combining data points)

If someone can reasonably figure out who the person is, it counts.

The following constitutes personal data under GDPR:

• Full name
• Home address
• Email address
• Phone number
• Passport number
• National ID number
• Social security–type numbers
• IP addresses (yes, even dynamically allocated IPs)
• Cookie identifiers
• Device IDs
• Advertising IDs
• Location data

Information that can identify someone when combined with other data is also included, such as:

• Job title + company + city
• Unique behavioral patterns
• Transaction history
• Metadata

If profiling can reasonably link the data back to a person, it’s personal data.

GDPR provides extra protection for “special category” data, including:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (for identification)
• Health data
• Sex life or sexual orientation

Processing “special category” data requires a specific legal basis beyond ordinary consent.

Data that replaces identifiers (pseudonymized data) such as username instead of a name is still personal data if it can be relinked. Note, truly irreversible anonymization is difficult regardless of what your development team or QA testers tell you.

GDPR uses a risk-based identifiability test: If someone can reasonably identify the person using available means, it’s personal data. That’s why GDPR’s definition is considered broader than many U.S. privacy laws.

GDPR tends to place a heavy checklist and paperwork burden on organizations in my experience, but it does mean well. I’ve spent the last five years with an EU-based client where one of my responsibilities was maintaining the Business Impact Assessment, security architecture checklist, risk analysis catalog, and other required documentation for several applications.

United States

The United States has no single, comprehensive federal data privacy law. Privacy protections are sectoral (e.g., COPPA, HIPAA) and state-driven (e.g., California Consumer Privacy Act, CCPA).

Children’s Online Privacy Protection Act (COPPA): U.S. federal privacy law enacted in 1998 (effective 2000) designed to protect the personal information of children under 13 collected online. It applies to websites and online services directed to children under 13 and general-audience sites that knowingly collect personal information from children under 13. It broadly defines personal data — see question #3. COPPA is enforced by the Federal Trade Commission (FTC).

HIPAA: HIPAA is a U.S. federal law enacted in 1996 that protects the privacy and security of individuals’ medical information and regulates how healthcare data is handled. HIPAA is enforced primarily by the U.S. Department of Health and Human Services (HHS) through its Office for Civil Rights (OCR). It applies to:

• Healthcare providers (doctors, hospitals, clinics)
• Health plans (insurance companies, HMOs, employer health plans)
• Healthcare clearinghouses
• Business associates (vendors handling protected health data on behalf of covered entities)

California Consumer Privacy Act (CCPA): CCPA) is a state-level privacy law that went into effect in 2020. It gives California residents significantly more control over how businesses collect, use, and sell their personal information than residents of the other forty nine states. It was later expanded and strengthened by the California Privacy Rights Act (CPRA), which amended the CCPA to add additional consumer protections. The CCPA applies to for-profit businesses that operate in California, collect personal data from California residents, and meet certain revenue or data-volume thresholds. This includes many large tech companies — even those headquartered outside California — if they handle California residents’ data. It provides the following rights to California residents:

1. Know what personal information is being collected.
2. Access the data a company has about them.
3. Delete personal information (with some exceptions).
4. Opt out of the sale or sharing of personal data.
5. Correct inaccurate personal data (added under CPRA).
6. Limit use of sensitive personal information (CPRA addition).
7. Non-discrimination for exercising their rights.

CCPA defines personal information broadly as:

• Names, addresses, email addresses
• IP addresses
• Geolocation data
• Biometric information
• Browsing history
• Inferences used to build consumer profiles

If a company can reasonably link it to a person or household, it probably counts as personal information under CCPA.

In comparison to the EU GDPR, CCPA is:

• More consumer-choice focused (opt-out model)
• Less strict than the EU’s consent-heavy approach
• Primarily about transparency and sale of data

The US stands out as the only developed economy and the only member of the G20 that does not have a comprehensive data privacy law for its citizens (other than California’s residents). The profit margins of big tech, data brokers, and advertising platforms must be protected. One or more of the previous statements may have been sarcastic in nature.

There are a hodge podge of other privacy-related regulations and laws, but we’re not going to attempt to cover them here. These are generally sector-specific. Other states have their own privacy laws, but none are as comprehensive as California’s.

There is no one US government agency that is responsible for enforcing citizen’s privacy. Instead, each individual law has a different federal agency (or state agency) responsible for enforcement and each has their own set of rules and auditors that organizations must satisfy. The end result is hardly ideal for accomplishing the intended goal.

Canada

Canada’s Privacy Act protects personal data handled by federal institutions; the Personal Information Protection and Electronic Documents Act (PIPEDA) governs private sector data in many provinces.

Argentina

The Personal Data Protection Act №25,326 requires informed consent; rights to access, correct, & delete personal data; and regulates data usage broadly.

Brazil

The General Personal Data Protection Law (LGPD) closely mirrors the EU GDPR emphasizing consent, lawful basis for processing, transparency, and data subject rights.

Mexico

The Federal Law on Protection of Personal Data Held by Individuals requires disclosure of data practices, rights to access / delete data, and imposes sanctions for non-compliance.

United Kingdom (UK)

After Brexit, the UK retained GDPR principles in the UK GDPR. This combined with the Data Protection Act 2018 is largely aligned with EU standards and recognized as adequate by the EU.

China

The Personal Information Protection Law (PIPL) is China’s comprehensive data privacy law with many GDPR-like requirements (consent, rights for individuals, data export controls) but operates within a different enforcement and state security framework.

India

The Digital Personal Data Protection Act, 2023 (DPDP/DPDPA) provides rights similar to GDPR (ie, consent, access, correction, erasure) and mandates breach reporting, but with evolving implemention rules.

Japan

The Personal Information Protection Act (PIPA) regulates data processing and ensures individual rights, with amendments over time to strengthen protections. Japan is recognized by the EU as adequate.

Indonesia

Indonesia has a data protection law (Personal Data Protection Law) with GDPR-inspired provisions for consent and data subject rights; although, enforcement is still maturing.

Saudi Arabia
Personal Data Protection Law (PDPL) sets out consent-based processing and individual rights; it is aligned in principles with GDPR and regulated by an independent authority.

Turkey

The Personal Data Protection Law (KVKK) is similar in structure to GDPR, with consent, security, and data subject rights; enforcement by a national data protection authority.

South Korea

The Personal Information Protection Act (PIPA) includes strong protections and rights and is recognized as adequate by the EU.

South Africa

The Protection of Personal Information Act (POPIA) provides GDPR-style privacy rights, breach notification requirements, and establishment of an Information Regulator.

Singapore

Singapore’s core data protection law is the Personal Data Protection Act 2012 (PDPA), enforced by the Personal Data Protection Commission (PDPC). It governs how organisations collect, use, disclose, store, and transfer personal data in Singapore. The PDPA complements sector-specific rules (e.g., banking/insurance) but primarily applies to private sector organisations. Public agencies are generally exempt from PDPA but are expected to apply comparable or higher standards under separate governance frameworks.

Under the PDPA, organizations must observe key obligations when handling personal data:

• Consent Obligation: Data may be collected, used, or disclosed only with the individual’s consent (with some exceptions).
• Purpose & Notification Obligations: Personal data must be used only for purposes notified to the individual.
• Access & Correction Rights: Individuals can request access to their data and seek corrections.
• Retention & Protection: Data must be kept no longer than necessary and secured against unauthorized access/disclosure.
• Transfer Limitation: Overseas transfers must ensure recipients offer a comparable level of protection or otherwise comply with PDPA rules.
• Accountability & Openness: Organisations must implement policies demonstrating compliance and designate a Data Protection Officer (DPO) whose contact is made available.
• Breach Notification: Amendments introduced a Data Breach Notification Obligation requiring organisations to notify the PDPC and affected individuals in certain significant breach scenarios.

PDPA applies to data in both electronic and non-electronic forms and covers personal data that can identify an individual. Some data (e.g., business contact information) is excluded from PDPA protections when used in specified business contexts.

The law also governs Do Not Call (DNC) Registries related to unwanted marketing communications.

To enforce these these rules, the PDPC can:

• issue directions, mandate corrective actions (e.g., cease practices, destroy data, provide access), and enforce compliance with court-registered orders.
• Impose financial penalties for breaches are now tied to organisation size:

Up to 10% of annual turnover in Singapore for large entities (annual Singapore turnover > SGD 10 million).

Up to SGD 1 million for other organisations.

• Impose criminal penalties and fines for non-compliance with Do Not Call requirements and obstruction of PDPC functions.

The PDPA shares many of the core principles of the EU GDPR (e.g., consent, purpose limitation, data subject rights) but generally provides a baseline standard focused on organizational accountability rather than the more prescriptive EU approach. The law does not explicitly provide some GDPR rights such as data portability or a broad right to erasure outside specific obligations, though recent updates have introduced some portability elements in certain contexts. The PDPA’s breach notification and data transfer rules are more tailored to Singapore’s regulatory context.

There are other digital laws (e.g., criminal provisions addressing online falsehoods) that influence how data and information are handled in digital environments, although these are separate from the PDPA’s privacy protections.

Philippines

The Republic Act №10173 (Data Privacy Act of 2012) — National Privacy Commission (NPC) site is the core Philippine law regulating personal data protection. It protects individuals’ right to privacy and governs how personal data is collected, processed, stored, and disposed of by both public and private entities. The law applies broadly, including processing activities done outside the Philippines if they relate to Filipino citizens or residents under certain conditions.

The Data Privacy Act sets four cornerstone principles that guide privacy compliance:

• Transparency: Individuals (data subjects) must be informed about what personal data is collected and why.
• Legitimate Purpose: Data must be processed fairly, lawfully, and for clearly defined purposes.
• Proportionality: Data collection and processing must be limited to what is necessary for the stated purpose.
• Accountability: Entities must demonstrate compliance through adequate policies and safeguards.

The National Privacy Commission is the independent regulator established by the Data Privacy Act to administer, implement, and enforce the law. It issues guidelines, investigates complaints, and ensures compliance with international data protection standards. The NPC also issues Circulars and security guidelines to update enforcement and technical requirements (e.g., standards for personal data security for government and private sectors).

Under the law and its implementing rules, individuals have several privacy rights, including:

• Right to be informed about personal data collection and processing.
• Right to access information held about them.
• Right to rectify, erase, or block personal information that is incorrect or unlawfully processed.
• Right to file complaints with the NPC over violations.
• Right to file for damages if their privacy rights are breached.

The Data Privacy Act requires that:

Entities that collect or process personal information must implement reasonable security measures to prevent unauthorized access, breaches, and misuse of data.

Controllers must ensure security when transferring data to third parties or international recipients and designate responsible officers for privacy compliance.

The law includes criminal and administrative penalties for violations, including fines and imprisonment for unauthorized processing, improper disposal, breach concealment, malicious disclosure, and other unlawful acts involving personal or sensitive data.

The Philippines also has other privacy related laws:

The Philippines Constitution guarantees the privacy of communication and correspondence generally, which the Data Privacy Act operationalizes for modern data processing contexts.

Complementary legislation like the Cybercrime Prevention Act of 2012 also interacts with data privacy by addressing unlawful electronic activities

There are ongoing reform efforts to further enhance these laws.

Lawmakers have proposed amendments to expand protections (e.g., clearer definitions of sensitive data, higher penalties, age-of-consent clarifications) to further align Philippine standards with evolving global norms.

Practical enforcement has included NPC actions against improper biometric data use and other compliance failures. (For example, the NPC has issued cease-and-desist orders in cases involving biometric data collection without proper consent.)

Key Themes

Rights & Principles

• Most G20 members’ laws provide consent, notice, access, and data subject rights (e.g., correction, deletion).
• EU’s GDPR (and similar laws like Brazil’s LGPD, South Korea’s PIPA) emphasize accountability and data minimization as core processing principles.

Enforcement Mechanisms

• GDPR/UK GDPR and many newer laws create independent regulators with power to impose fines and corrective measures.
• In the US, enforcement is fragmented — federal FTC and state AGs enforce sector laws, while newer state privacy laws add robust protections.

Cross-Border Transfers

• EU relies on adequacy decisions or safeguards (standard contractual clauses) for data transfer outside its borders.
• Many G20 states (Japan, Canada, Brazil, UK, Argentina) have adequacy or are seeking mechanisms for easier data flows with the EU.

The ability to move user data across borders (or limits on this) is one of the more interesting aspects of these laws. This is at the heart of data sovereignty laws which we will look at in a future post.

Global Convergence

There’s an ongoing trend toward GDPR-like frameworks globally; even jurisdictions without mature laws (India, Saudi Arabia) are strengthening protections and implementing rights similar to the EU.

Again, the US is the outlier here.

Why does China have private-sector privacy laws that seems to be to the benefit of its citizens and the US does not? One theory is that China is using data that is easily available from commercial data brokers, their own hacking activities, and other sources to build databases of every american because one never knows who they’ll need to compromise in the future. In all likelihood, the United States is doing something similar with China’s population. So, it would make sense to make this more difficult for foreign actors to do. Hence, China setup the privacy laws that it has. Why the United States can’t prioritize a similar law at the federal level and all the positive benefits to personal privacy and potential disruption to foreign survillience the US experiences is a topic for another post…commercial concerns, lobbying, those advertising platforms, data broker players. It’s an unfortunate set of priorities that have been chosen.

Summary

• EU (GDPR) remains the most comprehensive and influential privacy regime, shaping global standards and adequacy assessments.
• Many G20 countries (Brazil, Japan, South Korea, Argentina) have data protection laws closely aligned with GDPR principles.
• The US is notable for its sectoral/state-based approach rather than a unified federal privacy law.
• Emerging and evolving laws in countries like India, Indonesia, and Saudi Arabia are enhancing privacy safeguards while balancing economic and security considerations.