Outside the EU, US and India, national privacy and data laws still reach IT companies that serve customers in those countries. Each has its own regulator, legal bases, breach rules and cross-border transfer limits. This category covers the laws software exporters run into most often, starting with Canada, Brazil, China, Singapore and Australia.
5 items in this category
2 related from other categories
Oct 30, 2026 statuses last checked
At a glance
International IT regulations compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
PIPEDA
Law
Mandatory by law for organizations in scope
Canada (private sector, outside provinces with similar laws)
Still in force: Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025.
LGPD
Law
Mandatory by law for organizations in scope
Brazil, plus processing of data collected in Brazil
In force since September 2020, with ANPD sanctions since August 2021.
China PIPL
Law
Mandatory by law for organizations in scope
China, plus processing abroad of data about people in China
PIPL in force since 1 November 2021.
Singapore PDPA
Law
Mandatory by law for organizations in scope
Singapore
Amended in 2020, including mandatory breach notification since February 2021.
Australia Privacy Act
Law
Mandatory by law for organizations in scope
Australia
Amended in December 2024 (first tranche of reforms), with some changes phased in to December 2026.
Directory
What each one covers and who needs it
Law Canada (private sector, outside provinces with similar laws)
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada)
PIPEDA governs how private sector organizations collect, use and disclose personal information in commercial activity in Canada, based on ten fair information principles, including accountability, consent, limiting collection and safeguards. Organizations must report breaches of security safeguards that pose a real risk of significant harm to the OPC and affected people, and keep records of all breaches for 24 months. Quebec, Alberta and British Columbia have their own private sector laws.
What it covers, who needs it and why
What it covers
Personal information handled in commercial activities, and employee data of federally regulated businesses.
Who needs it
Companies with Canadian customers or users, including foreign SaaS providers with a real connection to Canada.
Why it matters
Canadian buyers expect PIPEDA-aligned privacy terms, and breach reporting is mandatory.
Key objectives
Meaningful consent
Accountability for personal information
Breach reporting and record keeping
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of Canada; Office of the Privacy Commissioner of Canada (OPC)
Current version
Still in force: Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025.
Law Brazil, plus processing of data collected in Brazil
LGPD
Lei Geral de Proteção de Dados Pessoais, Brazil Law 13.709/2018
The LGPD is Brazil's general data protection law, modeled partly on the GDPR. It applies to processing carried out in Brazil, to offering goods or services to people in Brazil, and to data collected there. It sets ten legal bases, data subject rights, a data protection officer (encarregado), incident reporting to the ANPD and international transfer rules. Fines reach 2% of revenue in Brazil, capped at 50 million reais per infraction.
What it covers, who needs it and why
What it covers
Personal data of people in Brazil processed by public and private organizations, online and offline.
Who needs it
Companies with users or customers in Brazil, including foreign SaaS providers.
Why it matters
The ANPD is active, and Brazilian customers expect LGPD clauses and transfer tools.
Key objectives
Protect fundamental rights of privacy
Set legal bases for processing
Create accountability and enforcement
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Brazil; Autoridade Nacional de Proteção de Dados (ANPD)
Current version
In force since September 2020, with ANPD sanctions since August 2021.
Law China, plus processing abroad of data about people in China
China PIPL
Personal Information Protection Law of the People's Republic of China, with the Cybersecurity Law and the Data Security Law
The PIPL is China's comprehensive personal information law. It requires a legal basis such as consent (with separate consent for sensitive data and transfers abroad), personal information protection impact assessments, and one of the approved mechanisms for cross-border transfer: a CAC security assessment, the standard contract or certification. It reaches processing outside China aimed at people in China. With the Cybersecurity Law and the Data Security Law it forms China's data regime. Fines reach 50 million yuan or 5% of the previous year's turnover.
What it covers, who needs it and why
What it covers
Personal information of people in China, data localization for some operators, and cross-border transfers.
Who needs it
Companies with users, employees or operations in China, and foreign companies receiving data from China.
Why it matters
Transfer rules decide whether you can serve Chinese users from servers abroad.
Key objectives
Protect personal information rights
Control cross-border data flows
Assign duties to processors
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
National People's Congress; Cyberspace Administration of China (CAC)
The PDPA governs how private organizations collect, use and disclose personal data in Singapore. Its obligations include consent, purpose limitation, notification, access and correction, accuracy, protection, retention limits, transfer limits and accountability. Since 2021 organizations must notify the PDPC of notifiable breaches within three calendar days of assessing them. Financial penalties reach 10% of Singapore turnover for organizations with annual turnover above 10 million Singapore dollars, or 1 million dollars otherwise.
What it covers, who needs it and why
What it covers
Personal data handled by organizations in Singapore, including data intermediaries that process for others.
Who needs it
Companies with Singapore customers or operations, including SaaS providers acting as data intermediaries.
Why it matters
Singapore is a regional hub, and the PDPC publishes its enforcement decisions.
Key objectives
Balance individual rights with organizational needs
Require reasonable protection
Mandate breach notification
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Personal Data Protection Commission (PDPC)
Current version
Amended in 2020, including mandatory breach notification since February 2021.
Privacy Act 1988 (Cth) and the Australian Privacy Principles
The Privacy Act regulates how Australian government agencies and most businesses with annual turnover above 3 million Australian dollars handle personal information, through 13 Australian Privacy Principles. The Notifiable Data Breaches scheme requires notice to the OAIC and affected people for eligible breaches. The 2024 amendments added a statutory tort for serious invasions of privacy, a children's online privacy code and transparency duties for automated decisions. Penalties for serious interference reach the greater of 50 million dollars, three times the benefit, or 30% of turnover.
What it covers, who needs it and why
What it covers
Personal information handled by APP entities, including overseas organizations with an Australian link.
Who needs it
Companies with Australian customers above the threshold, and some smaller businesses such as health service providers.
Why it matters
Penalties rose sharply after major Australian breaches, and reform is continuing.
Key objectives
Open and transparent handling of personal information
Security and breach notification
Individual access and correction
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Office of the Australian Information Commissioner (OAIC)
Current version
Amended in December 2024 (first tranche of reforms), with some changes phased in to December 2026.
General Data Protection Regulation, Regulation (EU) 2016/679
The GDPR is the EU law on processing personal data. It applies to organizations established in the EU, and to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior. It requires a lawful basis for each processing purpose, transparency, data minimization, security, breach notification within 72 hours, and respect for individual rights. Processors such as SaaS vendors have direct duties too. Fines reach 20 million euros or 4% of worldwide annual turnover.
What it covers, who needs it and why
What it covers
Any processing of personal data: customer and user data, employee data, marketing, analytics, AI training data and data you process for customers as a processor.
Who needs it
Every company with EU users, customers or employees, including software and SaaS companies outside the EU that sell into it.
Why it matters
It is binding law with large fines, and EU customers will not sign without a data processing agreement and proof of GDPR-ready processes.
Key objectives
Lawful, fair and transparent processing
Purpose limitation, minimization and storage limits
Security and accountability you can demonstrate
Rights for individuals, including access, erasure and objection
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national data protection authorities and the EDPB
Current version
In force since 25 May 2018. Digital Omnibus amendments proposed in November 2025 have a Council position (21 October 2026) but are not law, so the current text still applies.
Law United Kingdom, plus non-UK companies that target or monitor people there
UK GDPR and Data Protection Act 2018
United Kingdom General Data Protection Regulation and the Data Protection Act 2018
After Brexit the UK kept the GDPR as domestic law (the UK GDPR), alongside the Data Protection Act 2018. The core rules match the EU GDPR: lawful bases, transparency, security, breach notification within 72 hours and individual rights. The Data (Use and Access) Act 2025 adds changes, including recognized legitimate interests, more cookie exemptions and higher fines under the electronic marketing rules. The ICO can fine up to 17.5 million pounds or 4% of worldwide turnover.
What it covers, who needs it and why
What it covers
Processing of personal data of people in the UK, international transfers out of the UK, and, through PECR, cookies and electronic marketing.
Who needs it
Companies established in the UK and companies elsewhere that offer goods or services to people in the UK.
Why it matters
UK customers expect UK-specific contract terms and transfer tools, and the UK and EU rules are starting to diverge.
Key objectives
Keep EU-equivalent privacy protection in UK law
Set UK-specific transfer and enforcement rules
Ease some processing burdens through the 2025 Act
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
UK Parliament; enforced by the Information Commissioner's Office (ICO)
Current version
Amended by the Data (Use and Access) Act 2025, whose changes are commencing in stages.
Train your team on international it regulations requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
