An organisation with customers, staff or suppliers in more than one country is usually subject to several privacy laws at once, each with its own scope test, breach clock, transfer rules and regulator. This map summarises the main data protection laws outside and alongside the GDPR: Brazil's LGPD, China's PIPL, Japan's APPI, Korea's PIPA, India's DPDP Act, Singapore's PDPA, Australia's Privacy Act, Canada's PIPEDA, South Africa's POPIA and the California Consumer Privacy Act, with cross-border transfer and localisation rules by region. It is written for privacy, security and identity leads who need one view of where obligations differ, so they can design a single programme and handle the local exceptions. Facts in the at-a-glance table were checked against the regulator or the official legal text in October 2026; items that change often carry an "as of" date.
Key takeaways
- Extraterritorial scope is the norm. The GDPR, LGPD and PIPL all reach organisations abroad that offer goods or services to people in their territory, and PIPL requires an in-country entity or representative.
- Breach clocks range from hours to "as soon as practicable". Brazil allows three working days, the GDPR and India's DPDP Rules 72 hours, China "immediately", while Australia, Canada, Singapore and South Africa use practicability tests with assessment windows.
- Transfers follow three models. Adequacy plus contracts (EU, UK, Brazil), consent or equivalence (Japan, Korea), and state approval with localisation for the largest processors (China).
- Penalties are increasingly turnover-based. 4% under the GDPR, 5% under the PIPL and 2% (capped per infraction) under the LGPD; Korea raised its cap for major breaches in 2026.
- Several regimes are moving in 2026 and 2027. India's DPDP Rules phase in over 18 months, the EU's Digital Omnibus is in Parliament and US state laws keep adding effective dates; check the "as of" notes before relying on this map.
Regulations and frameworks at a glance
| Law | Jurisdiction | Scope | Key obligations | Breach notice timing | Regulator | Maximum penalty |
|---|---|---|---|---|---|---|
| GDPR (Regulation (EU) 2016/679) | EU and EEA | Processing in the context of an EU establishment, or offering goods or services to, or monitoring, people in the EU | Lawful basis, transparency, data subject rights, Art. 32 security, DPIAs, DPOs, transfer rules | To the supervisory authority without undue delay and where feasible within 72 hours (Art. 33) | National supervisory authorities; EDPB for consistency | EUR 20 million or 4% of worldwide annual turnover (Art. 83(5)) |
| UK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025 | United Kingdom | As the GDPR, for the UK | As the GDPR, with DUAA changes such as recognised legitimate interests, a "reasonable and proportionate search" for access requests and a "not materially lower" transfer test | 72 hours, as the GDPR | Information Commissioner's Office | £17.5 million or 4% (higher tier) |
| LGPD (Lei 13.709/2018) | Brazil | Processing in Brazil, offering goods or services to people in Brazil, or data collected in Brazil (Art. 3) | Legal bases, data subject rights, encarregado (DPO, Art. 41), transfer conditions (Art. 33) | Three working days to the ANPD and data subjects under ANPD Resolution 15/2024, implementing Art. 48 | Autoridade Nacional de Proteção de Dados (ANPD) | 2% of revenue in Brazil, capped at R$50 million per infraction (Art. 52) |
| PIPL | China (in force 1 November 2021) | Processing in China, and processing abroad to provide products or services to, or analyse, people in China | Consent and other bases, separate consent for sensitive data and transfers, in-country representative for foreign handlers (Art. 53), transfer conditions (Art. 38) | "Immediately" adopt remedial measures and notify the authorities and individuals (Art. 57) | Departments with personal information protection duties, coordinated by the state cybersecurity and informatisation department (CAC) | RMB 50 million or 5% of annual revenue for grave violations (Art. 66) |
| APPI | Japan | Personal information handling business operators, including foreign operators handling data of people in Japan | Purpose specification, security control, third-party provision records, consent for foreign transfers (Art. 28) | Report leaks to the PPC and notify the person (Art. 26); detailed timing is set in PPC rules | Personal Information Protection Commission (PPC) | Criminal fines and orders under the APPI penal provisions |
| PIPA (amended in force 15 September 2023) | Republic of Korea | Personal information controllers, public and private | Consent and other bases, transfer conditions, data portability (phased), suspension of unlawful transfers | Reporting and notification timelines unified for online and offline businesses in 2023 | Personal Information Protection Commission (PIPC) | Penalty surcharges calculated on total revenue, excluding unrelated revenue |
| Digital Personal Data Protection Act 2023 and DPDP Rules 2025 | India | Digital personal data processed in India, and abroad when offering goods or services to people in India | Notice and consent, consent managers, children's data, extra duties for Significant Data Fiduciaries (audits, DPIAs) | Individuals without delay; the Board without delay with a detailed report within 72 hours (Rule 7) | Data Protection Board of India | Rs 250 crore for security safeguard failures; Rs 200 crore for breach notification or children's data failures |
| PDPA | Singapore | Private sector organisations collecting, using or disclosing personal data in Singapore | Eleven obligations including consent, purpose limitation, protection, retention, transfer limitation and accountability (DPO) | Assess, then notify the PDPC and individuals as soon as practicable where significant harm or significant scale | Personal Data Protection Commission (PDPC) | Financial penalties under the PDPA |
| Privacy Act 1988 | Australia | Agencies and organisations with annual turnover over AU$3 million, plus listed entities such as credit providers | Australian Privacy Principles, including APP 8 for overseas disclosure | Assess a suspected breach within 30 days (s 26WH); notify the OAIC and individuals as soon as practicable | Office of the Australian Information Commissioner (OAIC) | Court-ordered civil penalties for serious or repeated interference with privacy (s 13G) |
| PIPEDA | Canada (federal, private sector) | Commercial activity, except where substantially similar provincial laws apply | Ten fair information principles, accountability for transfers to service providers | Report breaches with a real risk of significant harm; notify individuals as soon as feasible; keep breach records for two years | Office of the Privacy Commissioner of Canada (OPC) | Fines for knowingly failing to report or keep records, prosecuted by the Attorney General |
| POPIA | South Africa | Responsible parties processing personal information in South Africa | Eight conditions for lawful processing, information officers, prior authorisation for some processing | Regulator and data subject as soon as reasonably possible after discovery (s 22) | Information Regulator | Administrative fines (s 109) and criminal penalties (s 107) |
| CCPA as amended by the CPRA | California, United States | Businesses over the adjusted US$25 million revenue threshold, or handling 100,000 or more consumers or households, or earning 50% of revenue from selling or sharing data | Notice, rights to know, delete, correct and opt out, contracts with service providers, risk assessments | Set by California's separate breach notification statute, not the CCPA | California Privacy Protection Agency and the Attorney General | Per-violation administrative fines, adjusted for inflation |
Other laws to track
The laws below were not re-verified against official text for this edition, so the table gives only scope and regulator; check the regulator's site for breach timing and penalties.
| Law | Jurisdiction | Regulator | Note |
|---|---|---|---|
| Revised Federal Act on Data Protection (FADP) | Switzerland | Federal Data Protection and Information Commissioner (FDPIC) | In force since 1 September 2023; EU adequacy recognised |
| Personal Data Protection Act B.E. 2562 (2019) | Thailand | Personal Data Protection Committee | GDPR-style rights, DPOs and breach notification |
| Federal Decree-Law No. 45 of 2021 (PDPL) | United Arab Emirates | UAE Data Office | Free zones such as DIFC and ADGM run their own data protection laws |
| Personal Data Protection Law (PDPL) | Saudi Arabia | Saudi Data and AI Authority (SDAIA) | Transfer and localisation conditions in implementing regulations |
| Data Protection Act 2019 | Kenya | Office of the Data Protection Commissioner | Registration of controllers and processors |
| Nigeria Data Protection Act 2023 | Nigeria | Nigeria Data Protection Commission | Joined the Global CBPR Forum as an Associate in 2025 |
| US state comprehensive privacy laws | Many US states | Usually the state Attorney General | Different thresholds and effective dates; most lack a private right of action |
Cross-border transfers and data localisation
A transfer usually happens whenever data is sent to, or made accessible from, another country, including remote administrator access. The main mechanisms by regime:
| Regime | Transfer mechanisms | Localisation |
|---|---|---|
| EU GDPR | Adequacy decisions; standard contractual clauses (Decision 2021/914); binding corporate rules; derogations | None general |
| UK GDPR | UK adequacy regulations; International Data Transfer Agreement or the UK Addendum to the EU SCCs; data protection test of "not materially lower" | None general |
| Brazil LGPD | Adequacy, standard contractual clauses, global corporate rules, certification, specific consent and other Art. 33 grounds | None general |
| China PIPL | One of: CAC security assessment, certification or the standard contract (Art. 38) | Critical information infrastructure operators and handlers above state thresholds store data in China and pass a security assessment before export (Art. 40) |
| Japan APPI | Consent, a country with equivalent standards, or a recipient with a conforming system (Art. 28) | None general |
| Korea PIPA | Consent and other grounds, equivalent countries or certified recipients; PIPC can order transfers suspended | None general |
| India DPDP | Transfers permitted unless restricted by the government | Significant Data Fiduciaries may be directed to keep restricted data categories in India |
| Singapore PDPA | Transfer only according to requirements prescribed under the regulations | None general |
Adequacy decisions and transfer frameworks
- EU adequacy list (as of October 2026): Andorra, Argentina, Brazil, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (organisations in the EU-US Data Privacy Framework only), Uruguay and the European Patent Organisation. The Commission lists mutual adequacy decisions with Brazil (February 2026), renewed the UK decisions in December 2025 and concluded its first review of the Korea decision on 23 July 2026.
- EU-US Data Privacy Framework and FISA Section 702: the DPF rests on US surveillance safeguards. Section 702 was reauthorised in April 2024 for two years; press reports describe short-term extensions by Congress in April 2026, including a 45-day extension passed around 1 May 2026. Its status after that is not confirmed here, so check it before relying on DPF transfers, and keep SCCs ready as a fallback.
- Global CBPR: the Global CBPR Forum runs the Global Cross-Border Privacy Rules and Privacy Recognition for Processors systems, in which third-party Accountability Agents certify company practices. It grew out of the APEC CBPR system and established its Global CAPE enforcement arrangement in October 2023.
- Convention 108 and 108+: the Council of Europe Convention 108, opened for signature on 28 January 1981, was "the first legally binding international instrument in the data protection field" and is open to non-European states. Its modernised version, Convention 108+ (CETS 223), takes effect only as states ratify it; check the Council of Europe Treaty Office for its current status before relying on it.
Breach clocks and where identity fits
A single credential compromise can start several clocks at once. Brazil counts three working days from the moment the controller learns the incident affected personal data, doubled for small processing agents, and requires a five-year incident record under ANPD Resolution 15/2024. India's Rule 7 asks for a detailed report to the Board within 72 hours. Australia allows up to 30 days to assess, and the OAIC treats that as a maximum. Run one incident process with a jurisdiction lookup, and start the most demanding clock when you first suspect personal data was affected.
- Machine identities move data across borders: service accounts, API keys and AI agents that copy data to a SaaS region or an offshore support tool create transfers that need a mechanism. Inventory them in the record of processing. See the Data Mapping and ROPA Guide.
- Administrator access is a transfer: remote access by cloud or support staff in another country counts. Restrict privileged access by region where localisation applies, using conditional access and just-in-time grants. See the JIT Access Guide.
- Identity data is personal data: directory, authentication and log data are covered by every law in the table; access, deletion and retention duties apply to identity platforms too. See the Identity Data Privacy and Consent Guide.
Time-sensitive items to watch
- India DPDP Rules (as of October 2026): notified on 14 November 2025 with an 18-month phased compliance period, so most obligations bite around May 2027. Confirm which rules are already in force for your activities.
- EU Digital Omnibus (as of August 2026): the Commission's November 2025 proposals to amend the GDPR, including clarifying when pseudonymised data falls outside the definition of personal data, treating AI development as a legitimate interest and changing cookie consent, were at European Parliament committee stage with a vote targeted before February 2027. The current GDPR text applies until any amendment is adopted.
- Korea PIPA (as of September 2026): Korea JoongAng Daily reported that a revised PIPA from 11 September 2026 raises the maximum surcharge for major breaches from 3% to 10% of total revenue, and requires notifying users within 72 hours where exposure is highly likely.
- UK Data (Use and Access) Act 2025: provisions commence in stages; for example the new access request time limits took effect on 5 February 2026. Check commencement before updating procedures.
- US state privacy laws: new state laws and amendments take effect on different dates, often 1 January or 1 July. Track effective dates and thresholds per state rather than assuming California's rules apply.
Standards and references
- European Commission: Adequacy decisions
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- Presidência da República: Lei 13.709/2018 (LGPD)
- Stanford DigiChina: Personal Information Protection Law of the PRC (translation)
- Japanese Law Translation: Act on the Protection of Personal Information
- Press Information Bureau, Government of India: Digital Personal Data Protection Rules, 2025
- OAIC: Part 4, Notifiable Data Breach (NDB) Scheme
- Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · Privacy Programme Guide for Security Teams · AI and Privacy Guide · Identity Security Regulatory Map. This guide summarises global privacy and data protection laws as of October 2026 and is not legal advice.