Data Privacy

Global Data Protection Regulations: An Overview

By Samaksh·2026-10-05·10 min read

Short answer: More than 170 countries have enacted data protection or privacy legislation. While GDPR is the most far-reaching, organisations operating globally must also navigate CCPA/CPRA (California), LGPD (Brazil), PDPA (Singapore and Thailand), PIPEDA (Canada), and a growing number of sector-specific and state-level laws. Each framework shares core principles but differs in scope, rights, and penalty structure.

TL;DR: There is no single global data protection law, but there is a strong family resemblance across frameworks — most require a lawful basis, transparency, data subject rights, and security measures. The key differences lie in territorial scope, consent standards, cross-border transfer rules, and maximum penalties.

Key Takeaways - GDPR is the benchmark: it has the broadest extraterritorial reach and the highest maximum penalties (€20 million or 4% of global turnover). - Over 170 countries have enacted privacy legislation; the landscape is expanding, not stabilising (UNCTAD Data Protection and Privacy Legislation Worldwide). - GDPR fines reached €1.2 billion in 2024 with an average of 363 breach notifications per day (DLA Piper, 2025). - Multi-jurisdictional compliance requires mapping which laws apply to each data flow, not assuming GDPR covers everything. - A formal training programme on global privacy law reduces the risk of gaps when entering new markets.

Why the global landscape matters now

The era when a single regional compliance programme covered most business risk is over. As of 2026, organisations face concurrent obligations under multiple frameworks whenever they:

have customers, employees, or suppliers in more than one country;
use cloud infrastructure that stores data in multiple regions;
transfer personal data across borders through standard business operations.

Understanding each major framework — where it applies, what it requires, and how it is enforced — is a prerequisite for building a programme that is both legally compliant and commercially sustainable. These laws govern the privacy dimension of data protection; the technical controls that protect that data are a separate discipline, as we explain in data privacy vs data security.

Figure 1. The number of countries with data protection legislation has grown from roughly 30 in 2000 to over 170 today. Source: UNCTAD, Data Protection and Privacy Legislation Worldwide.

The major frameworks

Jurisdiction: Any organisation processing personal data of individuals in the EU or EEA, regardless of where the organisation is based (extraterritorial reach under Article 3).

Key obligations: Lawful basis for every processing activity; transparent privacy notices; data subject rights (access, rectification, erasure, portability, restriction, objection); Data Protection Impact Assessments for high-risk processing; 72-hour breach notification to supervisory authority; Data Processing Agreements with processors.

Enforcement: Up to €20 million or 4% of global annual turnover, whichever is higher. In 2024, total fines reached €1.2 billion. The European Data Protection Board coordinates enforcement across 27+ supervisory authorities.

Cross-border transfers: Strict — requires adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or another Article 46 mechanism.

CCPA/CPRA — California (USA)

Jurisdiction: For-profit businesses that collect personal information of California residents and meet at least one threshold: over $25 million in annual gross revenue; buy/sell/receive/share personal information of 100,000+ consumers/households; or derive 50%+ of revenue from selling personal information.

Key obligations: Right to know, right to delete, right to opt out of the sale/sharing of personal information, right to correct, right to limit use of sensitive personal information, non-discrimination for exercising rights. The CPRA (effective January 2023) added stricter data minimisation and purpose limitation requirements.

Enforcement: Civil penalties up to $2,500 per unintentional violation and $7,500 per intentional violation. The California Privacy Protection Agency took over enforcement from the Attorney General in 2023.

LGPD — Brazil

Jurisdiction: Any processing of personal data collected in Brazil, or processing of data of individuals located in Brazil, or processing for the offer of goods and services to individuals in Brazil.

Key obligations: Similar structure to GDPR — legal bases for processing (ten bases available), transparency, data subject rights, mandatory data breach notification, and data protection officer appointment for certain controllers.

Enforcement: Administrative fines up to 2% of Brazilian gross revenue (limited to R$50 million per infraction). The Autoridade Nacional de Proteção de Dados (ANPD) is the supervisory authority.

PDPA — Singapore

Jurisdiction: Organisations collecting, using, or disclosing personal data of individuals in Singapore.

Key obligations: Consent, purpose, and notification obligations; data protection and retention limitation obligations; mandatory breach notification for breaches likely to cause significant harm; data portability obligation (for certain organisations).

Enforcement: Financial penalties up to S$1 million or 10% of annual Singapore turnover (for organisations with turnover exceeding S$10 million). Enhanced under the 2020 amendments.

PIPEDA — Canada

Jurisdiction: Private-sector organisations engaged in commercial activities in Canada, covering personal information collected, used, or disclosed in the course of commercial activity.

Key obligations: Ten Fair Information Principles (accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, challenging compliance). Mandatory breach notification for breaches creating real risk of significant harm.

Enforcement: The Office of the Privacy Commissioner of Canada investigates complaints and can take matters to the Federal Court, which may order remedies and award damages. PIPEDA itself does not grant the Commissioner direct administrative fining power comparable to GDPR.

Reform status (as of October 2026): PIPEDA remains the operative federal private-sector privacy law. The reform package known as Bill C-27 (the Digital Charter Implementation Act, 2022), which would have enacted the Consumer Privacy Protection Act (CPPA) with GDPR-style penalties, did not become law: it died on the Order Paper when Parliament was prorogued in January 2025 and was not carried over. Any future replacement would need to be reintroduced and pass anew, so organisations should continue to comply with PIPEDA and monitor the Office of the Privacy Commissioner of Canada for legislative updates.

Side-by-side comparison

Framework	Jurisdiction	Max fine	Breach notification	Lawful basis required	Data subject rights
GDPR	EU/EEA + extraterritorial	€20M or 4% global turnover	72 hours to authority	Yes (6 bases)	Access, rectification, erasure, portability, objection
CCPA/CPRA	California residents	$7,500 per intentional violation	No statutory deadline	No (opt-out model)	Know, delete, opt-out, correct, limit
LGPD	Brazil (broad extraterritorial)	2% Brazil revenue, max R$50M	ASAP (severity-dependent)	Yes (10 bases)	Access, correction, deletion, portability, objection
PDPA (Singapore)	Singapore individuals	S$1M or 10% Singapore turnover	3 days for significant breaches	Consent primary	Access, correction, portability
PIPEDA	Canada commercial	CAD $100,000	"As soon as feasible"	Consent (primary)	Access, correction
Thailand PDPA	Thailand individuals	Up to 5M THB (criminal/civil)	72 hours	Yes (6 bases, GDPR-aligned)	Access, deletion, portability, objection

Cross-border data transfers: the compliance pinch point

For most global organisations, cross-border data transfers are where multi-framework compliance becomes operationally complex.

GDPR imposes the strictest transfer regime. Data flowing outside the EU/EEA requires an adequacy decision, Standard Contractual Clauses (SCCs — updated in 2021), Binding Corporate Rules, or a derogation. The EU–US Data Privacy Framework (DPF), adopted in 2023, provides an adequacy mechanism for qualifying US organisations.

LGPD also restricts transfers, requiring an adequacy decision, contractual clauses, or binding corporate rules.

PDPA Singapore prohibits transfers to territories that do not provide a comparable standard of protection, unless contractual arrangements (such as the ASEAN Model Contractual Clauses) are in place.

The practical consequence: a global organisation transferring personal data between the EU, the US, Brazil, and Singapore simultaneously needs transfer mechanisms in place for each distinct data flow — and must map which mechanism applies to each.

For guidance on building a programme that manages these obligations together, see our post on building a data privacy compliance programme and the GDPR principles explained breakdown.

Sector-specific overlays

In some jurisdictions, sector-specific laws sit alongside general data protection frameworks and impose additional obligations.

Healthcare: HIPAA (USA) governs protected health information; the EU's Medical Device Regulation includes data protection requirements.

Finance: The Gramm-Leach-Bliley Act (GLBA, USA), PSD2 (EU), and MAS TRM Guidelines (Singapore) all include data handling requirements for financial service providers.

Telecommunications: Sector regulators in most jurisdictions have separate requirements for subscriber data.

These sector overlays do not replace the general framework — they add requirements on top. Any compliance programme must identify both.

Frequently asked questions

GDPR is an EU law with broad extraterritorial reach and a consent-plus-five-other-lawful-bases model. CCPA is a California law with a revenue/volume threshold, using an opt-out model for data sales rather than requiring a positive lawful basis. GDPR generally imposes stricter obligations and higher fines.

Yes. Under Article 3(2), GDPR applies to any organisation that offers goods or services to individuals in the EU/EEA, or that monitors the behaviour of individuals in the EU/EEA — regardless of where the organisation is established.

Which countries have the strictest data protection laws?

The EU's GDPR is widely considered the most comprehensive, with the highest fines and broadest extraterritorial reach. Brazil's LGPD and Singapore's PDPA are closely modelled on GDPR principles. Canada regulates the private sector through PIPEDA; a proposed GDPR-style replacement (the CPPA under Bill C-27) did not pass before Parliament was prorogued in January 2025.

How do organisations manage compliance with multiple frameworks simultaneously?

Most large organisations build a "privacy by design" baseline that satisfies the strictest applicable framework (typically GDPR) and then layer jurisdiction-specific requirements on top. A unified data inventory (Record of Processing Activities), centralised consent management, and a single data breach response process provide the shared infrastructure.

Navigating global privacy obligations requires both legal knowledge and operational practice. ThreatBlock's Global Data Privacy course covers the major frameworks with practical compliance exercises.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity compliance and risk management. Read more on the author page · Editorial policy.