Data privacy laws decide what personal data you may collect, why, for how long, and what you owe the people it describes. Unlike security standards, these are laws: if you process personal data of people in the jurisdiction, they apply whether or not a customer asks. Many reach across borders, so a SaaS company in one country can be in scope of several at once.
7 items in this category
10 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Data privacy and protection compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
EU and EEA, plus non-EU companies that target or monitor people there
In force since 25 May 2018. Digital Omnibus amendments proposed in November 2025 have a Council position (21 October 2026) but are not law, so the current text still applies.
UK GDPR
Law
Mandatory by law for organizations in scope
United Kingdom, plus non-UK companies that target or monitor people there
Amended by the Data (Use and Access) Act 2025, whose changes are commencing in stages.
CCPA / CPRA
Law
Mandatory by law for organizations in scope
California, United States
CPPA regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect 1 January 2026, with later compliance dates for each.
US state privacy laws
Law
Mandatory by law for organizations in scope
About 20 US states
New laws keep taking effect; the list in the guide is re-checked at every review.
ISO 27701
Certifiable standard
Voluntary, with independent certification
Global
ISO/IEC 27701:2025, now a standalone management system standard instead of an extension that required ISO 27001.
COPPA
Law
Mandatory by law for organizations in scope
United States
The amended COPPA Rule published in April 2025 had a compliance date of 22 April 2026.
ePrivacy Directive
Law
Mandatory by law for organizations in scope
EU and EEA, through national laws
Directive 2002/58/EC as amended in 2009. The proposed ePrivacy Regulation was withdrawn by the Commission in 2025.
Directory
What each one covers and who needs it
Law EU and EEA, plus non-EU companies that target or monitor people there
General Data Protection Regulation, Regulation (EU) 2016/679
The GDPR is the EU law on processing personal data. It applies to organizations established in the EU, and to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior. It requires a lawful basis for each processing purpose, transparency, data minimization, security, breach notification within 72 hours, and respect for individual rights. Processors such as SaaS vendors have direct duties too. Fines reach 20 million euros or 4% of worldwide annual turnover.
What it covers, who needs it and why
What it covers
Any processing of personal data: customer and user data, employee data, marketing, analytics, AI training data and data you process for customers as a processor.
Who needs it
Every company with EU users, customers or employees, including software and SaaS companies outside the EU that sell into it.
Why it matters
It is binding law with large fines, and EU customers will not sign without a data processing agreement and proof of GDPR-ready processes.
Key objectives
Lawful, fair and transparent processing
Purpose limitation, minimization and storage limits
Security and accountability you can demonstrate
Rights for individuals, including access, erasure and objection
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national data protection authorities and the EDPB
Current version
In force since 25 May 2018. Digital Omnibus amendments proposed in November 2025 have a Council position (21 October 2026) but are not law, so the current text still applies.
Law United Kingdom, plus non-UK companies that target or monitor people there
UK GDPR and Data Protection Act 2018
United Kingdom General Data Protection Regulation and the Data Protection Act 2018
After Brexit the UK kept the GDPR as domestic law (the UK GDPR), alongside the Data Protection Act 2018. The core rules match the EU GDPR: lawful bases, transparency, security, breach notification within 72 hours and individual rights. The Data (Use and Access) Act 2025 adds changes, including recognized legitimate interests, more cookie exemptions and higher fines under the electronic marketing rules. The ICO can fine up to 17.5 million pounds or 4% of worldwide turnover.
What it covers, who needs it and why
What it covers
Processing of personal data of people in the UK, international transfers out of the UK, and, through PECR, cookies and electronic marketing.
Who needs it
Companies established in the UK and companies elsewhere that offer goods or services to people in the UK.
Why it matters
UK customers expect UK-specific contract terms and transfer tools, and the UK and EU rules are starting to diverge.
Key objectives
Keep EU-equivalent privacy protection in UK law
Set UK-specific transfer and enforcement rules
Ease some processing burdens through the 2025 Act
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
UK Parliament; enforced by the Information Commissioner's Office (ICO)
Current version
Amended by the Data (Use and Access) Act 2025, whose changes are commencing in stages.
California Consumer Privacy Act, as amended by the California Privacy Rights Act
The CCPA gives California residents rights over personal information that businesses collect: to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data. It applies to for-profit businesses that meet a revenue threshold or handle large volumes of California data, and it binds their service providers by contract. Regulations finalized in 2025 add duties for automated decision-making, risk assessments and annual cybersecurity audits, phased in over the next few years.
What it covers, who needs it and why
What it covers
Personal information of California consumers, including employees and B2B contacts, plus contracts with service providers and contractors.
Who needs it
Businesses doing business in California above the thresholds, and the SaaS and IT vendors that process data for them as service providers.
Why it matters
It is the most detailed US privacy law, with an active regulator, and its contract terms flow down to every vendor in the chain.
Key objectives
Give consumers control over their personal information
Require notice and opt-outs for selling and sharing
Set security, risk assessment and audit duties for higher-risk processing
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
State of California; enforced by the California Privacy Protection Agency (CPPA) and the Attorney General
Current version
CPPA regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect 1 January 2026, with later compliance dates for each.
Comprehensive consumer privacy laws in Virginia, Colorado, Connecticut, Texas and other US states
Beyond California, roughly 20 US states have passed comprehensive consumer privacy laws, starting with Virginia in 2021. Most follow a similar model: thresholds based on the number of residents whose data you handle, rights to access, delete, correct and opt out of targeted advertising and sale, consent for sensitive data, data protection assessments, and processor contracts. Details differ, including thresholds, cure periods and children's data rules, so a multi-state program maps each one.
What it covers, who needs it and why
What it covers
Personal data of state residents acting as consumers. Most exclude employee and B2B data, unlike California.
Who needs it
Companies with customers or users across the US above each state's thresholds, and their processors.
Why it matters
There is no federal privacy law, so a national US business has to meet a patchwork of state rules.
Key objectives
Give residents core privacy rights
Require assessments for high-risk processing
Set processor contract terms
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Individual state legislatures; enforced mainly by state attorneys general
Current version
New laws keep taking effect; the list in the guide is re-checked at every review.
Privacy information management systems: requirements and guidance
ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) for organizations that act as PII controllers, PII processors or both. The 2019 edition was an extension of ISO 27001; the 2025 edition can be certified on its own, though many companies still combine the two. It translates privacy principles into management system clauses and controls that map to laws such as the GDPR. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
How you govern personal data as a controller or processor: roles, records of processing, privacy risk, rights requests, processor obligations, transfers and breach handling.
Who needs it
SaaS companies, data processors and IT service providers that want an auditable, international proof of privacy management.
Why it matters
It gives customers and regulators a structured way to see privacy accountability, and its mapping to GDPR helps in procurement.
Key objectives
Run privacy as a managed system
Define controls for controllers and processors
Demonstrate accountability under privacy laws
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27701:2025, now a standalone management system standard instead of an extension that required ISO 27001.
Children's Online Privacy Protection Act and the FTC COPPA Rule
COPPA requires operators of websites, apps and online services directed to children under 13, or that knowingly collect their personal information, to give notice and get verifiable parental consent before collecting it. It also sets limits on retention, security duties and parents' rights to review and delete. The 2025 amendments add separate consent for disclosure to third parties such as advertisers, a written security program and a written retention policy. The FTC enforces it with civil penalties per violation.
What it covers, who needs it and why
What it covers
Personal information from children under 13, including persistent identifiers, photos, voice and geolocation.
Who needs it
Edtech, gaming, apps and any online service aimed at children or used by them with the operator's knowledge, plus vendors serving schools.
Why it matters
Penalties are per violation and the FTC regularly brings cases against apps and platforms.
Key objectives
Put parents in control of children's data
Limit collection, use and retention
Require reasonable security
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Federal Trade Commission (FTC)
Current version
The amended COPPA Rule published in April 2025 had a compliance date of 22 April 2026.
Directive 2002/58/EC on privacy and electronic communications (the "cookie law")
The ePrivacy Directive sets EU rules on confidentiality of communications, cookies and similar technologies, and electronic direct marketing. Its best-known rule, Article 5(3), requires consent before storing or reading information on a user's device unless it is strictly necessary for the service the user asked for. Each EU country implements it in national law, so details and enforcers vary. It sits alongside the GDPR and often decides what analytics and advertising tags a SaaS website may load.
What it covers, who needs it and why
What it covers
Cookies, SDKs, pixels and device fingerprinting, plus email and SMS marketing and the confidentiality of communications.
Who needs it
Any website, app or SaaS product used by people in the EU, and any company sending them electronic marketing.
Why it matters
Cookie consent is one of the most actively enforced areas of EU privacy law.
Key objectives
Protect the confidentiality of communications
Require consent for non-essential device access
Limit unsolicited electronic marketing
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national authorities
Current version
Directive 2002/58/EC as amended in 2009. The proposed ePrivacy Regulation was withdrawn by the Commission in 2025.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018 is a code of practice for public cloud providers that process personal data on behalf of customers. It extends ISO 27002 controls with privacy commitments a processor should make: process PII only on customer instructions, do not use it for marketing without consent, disclose sub-processors and government access requests where allowed, notify breaches, and return or delete data at the end of the contract. Like 27017 it is usually certified as part of an ISO 27001 scope.
What it covers, who needs it and why
What it covers
Personal data that a public cloud provider processes for its customers, and the transparency and control the customer gets.
Who needs it
Public cloud and SaaS providers acting as processors, especially those selling into Europe.
Why it matters
It turns processor promises into audited controls, which shortens privacy reviews in procurement.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data
The EU Data Act gives users of connected products access to the data they generate and sets rules for data sharing between businesses. For IT companies its biggest effect is Chapter VI on switching between data processing services: cloud and SaaS providers must let customers move to another provider or on premises, with set notice periods, data export, contract terms and the end of switching charges from January 2027. It also limits unfair data clauses in B2B contracts.
What it covers, who needs it and why
What it covers
Data from connected products and related services, B2B data sharing terms, switching and interoperability for cloud and edge services, and safeguards against unlawful government access.
Who needs it
Cloud, SaaS, PaaS and IaaS providers serving EU customers, and makers of connected products.
Why it matters
It rewrites standard cloud contract terms on exit, data portability and fees.
Key objectives
Fair access to data from connected products
Easier switching between cloud providers
Balanced B2B data contracts
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national competent authorities
Current version
Applies from 12 September 2025. Switching charges for cloud services must end by 12 January 2027.
FTC Standards for Safeguarding Customer Information, 16 CFR Part 314, under the Gramm-Leach-Bliley Act
The Safeguards Rule requires non-bank financial institutions under FTC jurisdiction (lenders, tax preparers, car dealers that finance, fintechs and others) to run a written information security program. It names a qualified individual, requires a risk assessment, access controls, encryption, multi-factor authentication, secure development, monitoring and testing, staff training, service provider oversight and a written incident response plan. Breaches affecting 500 or more consumers must be reported to the FTC within 30 days.
What it covers, who needs it and why
What it covers
Customer information held by covered financial institutions and their service providers.
Who needs it
Non-bank financial institutions in the US, broadly defined, and the IT and software vendors they use.
Why it matters
The FTC enforces it, and service provider oversight is an explicit requirement that reaches vendors.
Key objectives
Protect customer information
Require a documented security program
Notify the FTC of significant breaches
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Federal Trade Commission (FTC)
Current version
Updated rule in force since June 2023; breach notification to the FTC since 13 May 2024.
Health Insurance Portability and Accountability Act, with the Privacy, Security and Breach Notification Rules
HIPAA sets national rules for protecting protected health information (PHI). The Privacy Rule limits uses and disclosures, the Security Rule requires administrative, physical and technical safeguards for electronic PHI, and the Breach Notification Rule requires notice to individuals, HHS and sometimes the media. Software and IT vendors that handle PHI for healthcare clients are business associates: they must sign a business associate agreement and comply with the Security Rule directly.
What it covers, who needs it and why
What it covers
PHI held by covered entities (health plans, clearinghouses, most providers) and their business associates, in any form, with the Security Rule focused on electronic PHI.
Who needs it
Healthcare providers, health plans, and every SaaS, cloud, IT and software vendor that creates, receives, stores or transmits PHI for them.
Why it matters
OCR enforces it with tiered civil penalties, and hospitals will not buy from a vendor that cannot sign a BAA.
Key objectives
Protect the privacy of health information
Secure electronic PHI
Notify people when their data is breached
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Department of Health and Human Services (HHS), Office for Civil Rights (OCR)
Current version
Security Rule amendments proposed in January 2025 are listed on HHS's regulatory agenda for a final rule in July 2027. The current rule still applies.
Law Canada (private sector, outside provinces with similar laws)
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada)
PIPEDA governs how private sector organizations collect, use and disclose personal information in commercial activity in Canada, based on ten fair information principles, including accountability, consent, limiting collection and safeguards. Organizations must report breaches of security safeguards that pose a real risk of significant harm to the OPC and affected people, and keep records of all breaches for 24 months. Quebec, Alberta and British Columbia have their own private sector laws.
What it covers, who needs it and why
What it covers
Personal information handled in commercial activities, and employee data of federally regulated businesses.
Who needs it
Companies with Canadian customers or users, including foreign SaaS providers with a real connection to Canada.
Why it matters
Canadian buyers expect PIPEDA-aligned privacy terms, and breach reporting is mandatory.
Key objectives
Meaningful consent
Accountability for personal information
Breach reporting and record keeping
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of Canada; Office of the Privacy Commissioner of Canada (OPC)
Current version
Still in force: Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025.
Law Brazil, plus processing of data collected in Brazil
LGPD
Lei Geral de Proteção de Dados Pessoais, Brazil Law 13.709/2018
The LGPD is Brazil's general data protection law, modeled partly on the GDPR. It applies to processing carried out in Brazil, to offering goods or services to people in Brazil, and to data collected there. It sets ten legal bases, data subject rights, a data protection officer (encarregado), incident reporting to the ANPD and international transfer rules. Fines reach 2% of revenue in Brazil, capped at 50 million reais per infraction.
What it covers, who needs it and why
What it covers
Personal data of people in Brazil processed by public and private organizations, online and offline.
Who needs it
Companies with users or customers in Brazil, including foreign SaaS providers.
Why it matters
The ANPD is active, and Brazilian customers expect LGPD clauses and transfer tools.
Key objectives
Protect fundamental rights of privacy
Set legal bases for processing
Create accountability and enforcement
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Brazil; Autoridade Nacional de Proteção de Dados (ANPD)
Current version
In force since September 2020, with ANPD sanctions since August 2021.
Law China, plus processing abroad of data about people in China
China PIPL
Personal Information Protection Law of the People's Republic of China, with the Cybersecurity Law and the Data Security Law
The PIPL is China's comprehensive personal information law. It requires a legal basis such as consent (with separate consent for sensitive data and transfers abroad), personal information protection impact assessments, and one of the approved mechanisms for cross-border transfer: a CAC security assessment, the standard contract or certification. It reaches processing outside China aimed at people in China. With the Cybersecurity Law and the Data Security Law it forms China's data regime. Fines reach 50 million yuan or 5% of the previous year's turnover.
What it covers, who needs it and why
What it covers
Personal information of people in China, data localization for some operators, and cross-border transfers.
Who needs it
Companies with users, employees or operations in China, and foreign companies receiving data from China.
Why it matters
Transfer rules decide whether you can serve Chinese users from servers abroad.
Key objectives
Protect personal information rights
Control cross-border data flows
Assign duties to processors
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
National People's Congress; Cyberspace Administration of China (CAC)
The PDPA governs how private organizations collect, use and disclose personal data in Singapore. Its obligations include consent, purpose limitation, notification, access and correction, accuracy, protection, retention limits, transfer limits and accountability. Since 2021 organizations must notify the PDPC of notifiable breaches within three calendar days of assessing them. Financial penalties reach 10% of Singapore turnover for organizations with annual turnover above 10 million Singapore dollars, or 1 million dollars otherwise.
What it covers, who needs it and why
What it covers
Personal data handled by organizations in Singapore, including data intermediaries that process for others.
Who needs it
Companies with Singapore customers or operations, including SaaS providers acting as data intermediaries.
Why it matters
Singapore is a regional hub, and the PDPC publishes its enforcement decisions.
Key objectives
Balance individual rights with organizational needs
Require reasonable protection
Mandate breach notification
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Personal Data Protection Commission (PDPC)
Current version
Amended in 2020, including mandatory breach notification since February 2021.
Privacy Act 1988 (Cth) and the Australian Privacy Principles
The Privacy Act regulates how Australian government agencies and most businesses with annual turnover above 3 million Australian dollars handle personal information, through 13 Australian Privacy Principles. The Notifiable Data Breaches scheme requires notice to the OAIC and affected people for eligible breaches. The 2024 amendments added a statutory tort for serious invasions of privacy, a children's online privacy code and transparency duties for automated decisions. Penalties for serious interference reach the greater of 50 million dollars, three times the benefit, or 30% of turnover.
What it covers, who needs it and why
What it covers
Personal information handled by APP entities, including overseas organizations with an Australian link.
Who needs it
Companies with Australian customers above the threshold, and some smaller businesses such as health service providers.
Why it matters
Penalties rose sharply after major Australian breaches, and reform is continuing.
Key objectives
Open and transparent handling of personal information
Security and breach notification
Individual access and correction
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Office of the Australian Information Commissioner (OAIC)
Current version
Amended in December 2024 (first tranche of reforms), with some changes phased in to December 2026.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)
The DPDP Act is India's first comprehensive data protection law. Data fiduciaries must give clear notice, get free, specific and informed consent or rely on a listed legitimate use, protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, erase data when the purpose ends, and honor data principals' rights. Significant data fiduciaries have extra duties such as a data protection officer, impact assessments and audits. Penalties reach 250 crore rupees.
What it covers, who needs it and why
What it covers
Digital personal data processed in India, and processing outside India connected to offering goods or services to people in India.
Who needs it
Every company that processes digital personal data of people in India, including Indian IT and SaaS companies and the processors they use.
Why it matters
It is binding law with large penalties and a fixed timeline, and Indian enterprise buyers are already asking vendors for DPDP readiness.
Key objectives
Lawful processing with consent or a legitimate use
Reasonable security and breach reporting
Rights for data principals
Accountability for data fiduciaries
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Ministry of Electronics and Information Technology (MeitY); Data Protection Board of India
Current version
Rules notified in November 2025. Board provisions apply now, consent manager rules from about 13 November 2026, and the main duties from about 13 May 2027. A proposal to shorten the 18 months to 12 had not been notified as of our last check.
Train your team on data privacy and protection requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
