Data privacy laws by country vary widely in scope, penalties, and transfer rules, but most modern frameworks share a common skeleton inherited from the European Union’s General Data Protection Regulation: a legal basis (usually consent) for processing personal information, a defined set of individual rights, breach notification duties, and restrictions on sending data abroad. More than 160 countries have enacted some form of data privacy legislation, and whether your organization faces a minor compliance task or a multimillion-dollar penalty often depends on which of those jurisdictions your data touches.
What follows is a working comparison of the major regimes, organized so you can see where they align and where they diverge on the points that actually drive compliance work: who the law reaches, what it costs to get wrong, and how it treats data leaving the country.
European Union: The GDPR Benchmark
The GDPR applies to any organization that processes personal data belonging to people in the EU, regardless of where that organization is based. A company in the United States or Japan that sells to EU residents or tracks their online behavior falls under the regulation. That extraterritorial reach is what made the GDPR a de facto global standard: comply with it, and you are likely close to compliance in most other jurisdictions.
Penalties come in two tiers. Less severe violations can cost up to ten million euros or two percent of worldwide annual turnover, whichever is higher. For the most serious breaches, fines reach twenty million euros or four percent of global turnover.1General Data Protection Regulation (GDPR). Fines and Penalties Those ceilings are not theoretical. Regulators across member states have collectively issued billions of euros in fines since enforcement began in May 2018.
Individuals can request a full copy of the personal data a company holds about them, demand deletion when it is no longer necessary or when consent is withdrawn (the “right to be forgotten”), require the data in a machine-readable format to move to a competitor, and object to decisions based solely on automated processing when those decisions produce legal or similarly significant effects.
Organizations must report qualifying breaches to the relevant supervisory authority within seventy-two hours of discovery.2EUR-Lex. Regulation (EU) 2016/679 of the European Parliament and of the Council Companies whose core activities involve large-scale monitoring or processing of sensitive data must appoint a Data Protection Officer. Parental consent is required for data of children under sixteen, though member states can lower the threshold to thirteen. Transfers to countries without an EU adequacy decision require safeguards such as Standard Contractual Clauses or participation in the EU-U.S. Data Privacy Framework.
One requirement often catches foreign companies off guard. Organizations outside the EU that regularly process EU residents’ data must appoint a written representative physically located in an EU member state where those data subjects reside.3General Data Protection Regulation (GDPR). Art. 27 GDPR Representatives of Controllers or Processors Not Established in the Union That representative is the local point of contact for both regulators and individuals.
United Kingdom
When the UK left the European Union on January 1, 2021, it retained the GDPR’s core provisions through the Data Protection Act 2018, creating what is commonly called the UK GDPR. The substantive rules closely mirror the EU version: the same individual rights, breach notification requirements, and accountability obligations apply. The Information Commissioner’s Office enforces the regime and can impose fines of up to £17.5 million or four percent of global annual turnover, whichever is higher.
The EU granted the UK an adequacy decision in June 2021, allowing personal data to flow from the EU to the UK without additional safeguards. That decision is subject to periodic review. The UK government has signaled interest in diverging from certain GDPR provisions, but as of 2026 the two frameworks remain largely aligned.
United States: Federal Sector Laws Plus a State Patchwork
The United States has no single federal privacy law equivalent to the GDPR. Protection comes from a combination of sector-specific federal statutes and a growing number of state-level comprehensive privacy laws. The protections available depend on where you live, what kind of data is involved, and which industry holds it.
State Comprehensive Laws
Roughly twenty states have enacted comprehensive consumer privacy laws, with California’s framework the most established. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents the right to know what personal information businesses collect, request its deletion, and opt out of the sale or sharing of their data. The California Privacy Protection Agency handles enforcement and rulemaking, and penalties for intentional violations reach $7,988 per violation after annual inflation adjustments.4California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Administrative Fines
Virginia, Colorado, Connecticut, Texas, and more than a dozen other states have followed with their own frameworks. Details vary, but most grant consumers access to their data, the ability to delete it, and the option to opt out of targeted advertising. Several states also require data protection assessments for processing activities that present a heightened risk. Thresholds differ sharply. Florida’s Digital Bill of Rights applies only to companies generating more than one billion dollars in annual revenue, while most other state laws kick in at much lower thresholds tied to the number of consumer records processed.
Federal Sector Laws
Medical records fall under the Health Insurance Portability and Accountability Act, which assesses civil penalties per violation across four culpability tiers, with criminal exposure for intentional misuse of health information. Children’s data online is governed by the Children’s Online Privacy Protection Act, which requires verifiable parental consent before collecting any personal information from children under thirteen.5Office of the Law Revision Counsel. 15 USC 6502 – Regulation of Unfair and Deceptive Acts and Practices in Connection With Collection and Use of Personal Information From and About Children on the Internet The Federal Trade Commission enforces COPPA, with civil penalties adjusted to $53,088 per violation as of early 2025.6Federal Register. Adjustments to Civil Penalty Amounts
Financial data is covered by the Gramm-Leach-Bliley Act, which requires banks, lenders, and other financial institutions to explain their information-sharing practices and safeguard customer data.7Federal Trade Commission. Gramm-Leach-Bliley Act The Fair Credit Reporting Act limits the purposes for which credit reports can be pulled and gives consumers the right to dispute inaccuracies.8Federal Trade Commission. Fair Credit Reporting Act
The FTC as Gap-Filler
In the absence of a comprehensive federal privacy statute, the Federal Trade Commission uses Section 5 of the FTC Act to pursue companies engaged in unfair or deceptive data practices. A company that promises to protect your information in its privacy policy and then fails to do so can face enforcement.9Federal Trade Commission. Privacy and Security Enforcement The agency has used this authority to reach consent decrees with major technology companies, imposing operational requirements that can last twenty years.
Canada
Canada’s federal privacy law, the Personal Information Protection and Electronic Documents Act, is built around ten fair information principles covering accountability, consent, purpose limitation, and safeguards.10Office of the Privacy Commissioner of Canada. PIPEDA Fair Information Principles Organizations must obtain meaningful consent before collecting, using, or disclosing personal information and appoint a privacy officer responsible for compliance.11Justice Laws Website. Personal Information Protection and Electronic Documents Act The Office of the Privacy Commissioner of Canada investigates complaints, though its enforcement powers have historically been limited compared with European regulators.
Quebec is the outlier. Its provincial regime, significantly modernized by Law 25, imposes penal fines of up to twenty-five million Canadian dollars or four percent of worldwide turnover for serious offenses such as collecting personal information in violation of the law or failing to report a confidentiality incident. Administrative penalties reach up to ten million Canadian dollars or two percent of worldwide turnover.12Légis Québec. Act Respecting the Protection of Personal Information in the Private Sector These are among the stiffest penalties in North America and apply to any organization processing personal information of Quebec residents.
Brazil
Brazil’s General Data Protection Law, the LGPD, is modeled in many ways on the GDPR and recognizes ten distinct legal bases for processing personal data, including consent, contract performance, and protection of life or physical safety. The National Data Protection Authority oversees implementation.
Fines reach two percent of a company’s revenue in Brazil for the preceding fiscal year, capped at fifty million reais (roughly ten million U.S. dollars) per infraction. The law also authorizes daily fines that accrue until a violation is corrected, subject to the same ceiling. Organizations must maintain records of their processing activities, appoint a data protection officer, and perform impact assessments for high-risk processing. The LGPD applies regardless of where the data controller is located, as long as the processing involves data collected in Brazil or concerns Brazilian residents.
China
China’s Personal Information Protection Law, effective November 2021, created one of the world’s most demanding regimes. Organizations must obtain specific consent before processing personal information and separate consent for handling sensitive data or transferring information outside the country.13National People’s Congress of China. Personal Information Protection Law of the People’s Republic of China Consent must be voluntary, explicit, and fully informed, and individuals can withdraw it at any time.
Penalties for serious violations reach up to fifty million yuan (approximately seven million U.S. dollars) or five percent of the preceding year’s annual revenue. Regulators can also suspend or terminate a company’s data processing activities entirely. Responsible individuals within the organization face personal fines ranging from 100,000 to one million yuan.
Cross-border transfers face especially tight restrictions. Companies that process data for more than one million individuals must pass a security assessment conducted by the Cyberspace Administration of China before sending personal information abroad. Smaller processors can use a government-issued Standard Contract, but only if they have cumulatively transferred data on fewer than 100,000 individuals (or fewer than 10,000 for sensitive personal information) since the start of the previous year. Splitting data volumes to dodge the assessment requirement is explicitly prohibited.
Japan
Japan’s Act on the Protection of Personal Information applies to both private businesses and government agencies, making it broader in scope than many comparable laws that exempt the public sector.14Japanese Law Translation. Act on the Protection of Personal Information The law centers on transparency and purpose limitation: organizations must clearly notify individuals of why their data is being collected and cannot use it for unrelated purposes without fresh consent.
The Personal Information Protection Commission is the independent enforcement authority.15Personal Information Protection Commission, Japan. Personal Information Protection Commission, Japan Japan has achieved mutual adequacy recognition with the EU, allowing personal data to flow relatively freely between the two jurisdictions without the supplementary safeguards required for transfers to most other countries.
South Korea
South Korea’s Personal Information Protection Act is widely regarded as one of the strictest in Asia. The law requires explicit consent for each distinct processing activity, making it difficult for companies to rely on broad or bundled permissions. A 2025 amendment overhauled the penalty structure, raising the maximum administrative fine to ten percent of total turnover and introducing personal supervisory liability for chief executives. Criminal sanctions remain available for individuals directly responsible for breaches. Data subjects can request the suspension of processing and the destruction of their personal information.
India
India’s Digital Personal Data Protection Act, enacted in August 2023, brought the world’s most populous country into the modern data privacy landscape. Data fiduciaries (essentially any organization handling personal data) must obtain free, specific, informed, and unambiguous consent before processing. Individuals can withdraw consent at any time, and the process for doing so must be as simple as the process for granting it.16Ministry of Electronics and Information Technology, India. The Digital Personal Data Protection Act, 2023
Penalties are structured by violation type rather than as a percentage of revenue. Failing to implement reasonable security safeguards can bring up to ₹250 crore (approximately $30 million). Failing to notify the Data Protection Board or affected individuals of a breach, or violations involving children’s data, each carry up to ₹200 crore. Breach of obligations by significant data fiduciaries carries up to ₹150 crore, and other violations up to ₹50 crore.
The Data Protection Board of India investigates complaints, orders remedial measures, and imposes penalties.16Ministry of Electronics and Information Technology, India. The Digital Personal Data Protection Act, 2023 The law’s implementing rules were still being finalized as of early 2026, so full enforcement is still ramping up.
South Africa
South Africa’s Protection of Personal Information Act establishes eight conditions for lawful processing, including accountability, purpose specification, and security safeguards. The Information Regulator enforces the act and can impose administrative fines of up to ten million rand. Criminal penalties are steep. Conviction for the most serious offenses, such as obstruction of the regulator or unlawful processing after being ordered to stop, carries imprisonment of up to ten years.17POPIA. Section 107 Penalties Lesser offenses carry up to twelve months. Personal data must generally be collected directly from the individual unless specific exceptions apply, and organizations must maintain both physical and digital security measures.
United Arab Emirates
Federal Decree-Law No. 45 of 2021 is the UAE’s primary data protection framework, governing the processing of personal data for all residents. Individuals have rights to access, correct, and delete their information. The UAE Data Office oversees compliance, manages registration of data controllers, and sets requirements for cross-border transfers.18The Official Platform of the UAE Government. Data Protection Laws Enforcement expectations are still maturing, and organizations operating in the region should anticipate that regulatory scrutiny will tighten as the infrastructure develops.
Cross-Border Data Transfers
The practical challenge for most businesses is not any single country’s law in isolation but moving data between jurisdictions. Nearly every major framework restricts transfers of personal data to countries that lack equivalent protections, and the mechanisms for authorizing those transfers differ.
The European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework on July 10, 2023, creating a legal pathway for transferring personal data from the EU to participating U.S. organizations.19Data Privacy Framework. EU-U.S. Data Privacy Framework Program Overview Participation is voluntary but binding once an organization self-certifies through the International Trade Administration, with annual re-certification required. The framework also includes a UK extension.
For transfers to countries without an adequacy decision, organizations typically rely on Standard Contractual Clauses. Under the GDPR, using SCCs requires a Transfer Impact Assessment to evaluate whether the destination country’s legal environment provides meaningful protection in practice. If the assessment reveals significant risks, such as broad government surveillance powers, the transferring organization must implement supplementary safeguards like encryption or pseudonymization before the transfer can proceed.
Several countries take a more restrictive approach by requiring certain data to remain stored on domestic servers. China’s cross-border rules effectively mandate localization for organizations processing data at scale. Russia requires personal data of Russian citizens to be stored on servers located within the country. India’s framework gives the government authority to restrict cross-border transfers of certain data categories. These mandates create logistical challenges for global cloud providers and multinational companies operating on centralized infrastructure.
Artificial Intelligence and Automated Decisions
Privacy laws increasingly address the use of personal data in AI systems and automated profiling. The GDPR’s existing right to object to purely automated decisions has served as a template, but newer legislation goes further. The EU’s AI Act, which began phased implementation in 2025, imposes specific data protection obligations on high-risk AI systems, including strict limits on using sensitive personal data for bias detection and mandatory documentation of how training data is sourced and processed.
In the United States, at least eighteen states have enacted provisions giving consumers the right to opt out of automated decision-making when those decisions produce legal or similarly significant effects, such as the approval or denial of financial services. The scope varies. Some states limit the opt-out to decisions made with zero human involvement, while others use broader language that could reach decisions where a human merely rubber-stamps an algorithm’s recommendation. For organizations deploying AI across multiple jurisdictions, these overlapping requirements add another layer on top of an already fragmented privacy map.