Last updated on August 6th, 2026 at 07:17 pm
TL;DR: Data protection laws govern how organisations collect, use, store, and share personal data, and they now exist almost everywhere. As of 2026, more than 170 countries have enacted data protection legislation, covering around 79% of the world’s population. The EU’s GDPR remains the global benchmark, and most newer laws, including India’s DPDP Act, Brazil’s LGPD, China’s PIPL, and dozens of US state laws, borrow heavily from it. For any business with users in more than one country, the practical challenge is no longer whether a law applies, but how to comply with several at once. This guide maps the major regimes, what they share, where they differ, and what it means for your business.
Quick overview: Since GDPR took effect in 2018, data protection has gone from a European concern to a permanent global reality. The core ideas are converging everywhere: get a lawful basis to process data, tell people what you are doing, give them rights over their data, secure it, and report breaches. The differences that matter are in the detail: the consent model, cross-border transfer rules, penalties, and how aggressively each regulator enforces. This guide gives a current, country-by-country reference and explains how a business should think about compliance across borders in 2026.
What are data protection laws?
Data protection laws (also called data privacy laws) are statutes that regulate how personal data, any information relating to an identifiable person, is handled by organisations. They set rules on what data can be collected, the legal grounds for processing it, how long it can be kept, who it can be shared with, how it must be secured, and what rights individuals have over their own information.
Almost all modern data protection laws share a common architecture, largely inherited from GDPR: a lawful basis requirement (you need a legal justification to process data), transparency obligations (you must tell people what you do with their data, usually through a privacy policy), individual rights (access, correction, deletion, and often portability), security obligations, breach notification duties, and penalties for non-compliance.
The reason a business needs to understand more than one of these laws is simple: most of them apply extraterritorially. They cover any organisation processing the data of people in that territory, regardless of where the organisation is based. A company in India with customers in the EU is subject to GDPR. A US company with Indian users is subject to the DPDP Act. If your platform has international users, you have international legal obligations, and data protection is the clearest example.
The global picture in 2026
Data protection has become nearly universal. As of 2026, more than 170 countries have data protection or privacy legislation in force, and the pace of adoption keeps accelerating. Several developments define the current landscape.
GDPR remains the benchmark, and enforcement keeps intensifying. Cumulative GDPR fines passed 7 billion euros by early 2026, with the largest single penalty being the 1.2 billion euro fine against Meta for transferring EU user data to the US without adequate safeguards.
India’s DPDP Act moved from statute to operation. The implementing rules were notified in November 2025, triggering a phased rollout through 2026 that turned the 2023 Act into an enforceable regime.
New comprehensive laws keep arriving. Vietnam’s Personal Data Protection Law took effect on 1 January 2026, China completed its cross-border transfer framework under PIPL, and multiple US states brought new consumer privacy laws into force.
The direction of travel is clear: a business operating online in 2026 should assume that a data protection law applies to it in every market where it has users, and that the number of such laws is still growing.
The major data protection laws, region by region
European Union: GDPR
The General Data Protection Regulation, in force since May 2018, is the most influential data protection law in the world. It applies to any organisation processing the personal data of people in the EU, wherever the organisation is located. It requires a lawful basis for processing (consent, contract, legal obligation, legitimate interests, and others), grants strong individual rights including the right to erasure (the right to be forgotten) and data portability, mandates breach notification within 72 hours, and carries penalties of up to 20 million euros or 4% of global annual turnover, whichever is higher. The EU-UK adequacy decision was renewed in December 2025, allowing data to keep flowing between the two until 2031.
United Kingdom: UK GDPR and the Data Protection Act 2018
After Brexit, the UK retained GDPR as “UK GDPR,” supplemented by the Data Protection Act 2018. The substance is very close to the EU regime. The UK has been reforming its framework through the Data Use and Access Act, aimed at reducing some compliance burdens while keeping core protections and its EU adequacy status.
United States: no federal law, a patchwork of state laws
The US remains the major outlier: it has no single comprehensive federal data protection law. Instead, protection comes from sector-specific federal laws (such as HIPAA for health data) and a growing patchwork of state laws. California’s CCPA, as strengthened by the CPRA, is the most prominent, giving consumers rights to know, delete, correct, and opt out of the sale of their data. By 2026, around 20 US states have comprehensive consumer privacy laws in effect, with more arriving each year, which means US compliance is itself a multi-law exercise. Our contract lawyers in the USA advise on US-facing data terms.
India: the Digital Personal Data Protection Act, 2023
India’s DPDP Act is the country’s first comprehensive data protection law. It imposes duties on data fiduciaries (the entities that decide how personal data is processed), requires consent or another lawful basis for processing, gives data principals rights of access, correction, and erasure, mandates breach reporting, requires verifiable parental consent for processing the data of anyone under 18, and carries penalties of up to Rs 250 crore for serious violations. Its implementing rules were notified in November 2025, moving it into active enforcement through 2026. It is narrower than GDPR in some respects, with no general right to data portability, but its reach is enormous, covering 1.4 billion people and applying to foreign businesses that offer goods or services to people in India. Our detailed guides on the DPDP Act and its implications and consent management under the DPDP Act go deeper, and our contract lawyers in India advise on compliance.
Brazil: LGPD
Brazil’s Lei Geral de Proteção de Dados, in force since 2020, closely mirrors GDPR’s structure: lawful bases for processing, a full set of data-subject rights, and a national regulator, the ANPD, which has grown increasingly active. Penalties reach up to 2% of Brazilian revenue, capped at 50 million reais per violation.
China: PIPL
China’s Personal Information Protection Law, in force since November 2021, is sometimes called China’s GDPR, but it goes further in key respects. It imposes strict cross-border transfer controls, requiring security assessments and, for certain data, localisation within China. It sits alongside the Data Security Law and Cybersecurity Law in a layered regime, and penalties can reach 50 million yuan or 5% of prior-year revenue. Enforcement has been significant, including a fine of over 1 billion US dollars against a single ride-hailing company.
Other significant regimes
Canada’s PIPEDA (with provincial laws and a pending federal reform), Australia’s Privacy Act 1988 (undergoing reform on automated decision-making transparency), Japan’s APPI, South Africa’s POPIA, South Korea’s PIPA, and Saudi Arabia’s and the UAE’s data protection laws all impose GDPR-influenced obligations. Notably, Argentina and Uruguay hold EU adequacy status, meaning the European Commission recognises their protections as equivalent to GDPR for the purpose of data transfers, a significant advantage for businesses operating there. Our legal services in Argentina cover data and commercial compliance there.
What these laws share, and where they differ
The convergence is real. Almost every comprehensive data protection law now built anywhere shares the same skeleton: a lawful basis to process, transparency through notice, individual rights over data, security obligations, breach notification, and accountability. If you build your data practices to a high standard, you will satisfy the core of most regimes.
The differences that actually drive compliance decisions are narrower but important. The consent model varies: GDPR and the DPDP Act lean toward opt-in consent, while US state laws often use an opt-out model. Cross-border transfer rules differ sharply: the EU relies on adequacy decisions and standard contractual clauses, China requires security assessments and localisation, and India has powers to restrict transfers to specified countries. Penalties range from a percentage of global turnover (GDPR) to fixed caps (DPDP Act, LGPD). And enforcement intensity differs enormously, with the EU and China among the most active.
For a business, the practical implication is to build to the highest applicable standard, usually GDPR, and then layer on the specific local requirements for each market where you have users.
What this means for your business
For most businesses, the take-away is not to memorise every law, but to put the right documents and practices in place so that you meet the shared core and can adapt to local specifics.
Every business that collects personal data needs a compliant privacy policy that reflects the laws applicable to its users. This is the single most important document, and it is legally required under the DPDP Act, GDPR, and most other regimes. Our privacy policy drafting service prepares policies that address the jurisdictions your business actually touches.
Beyond the privacy policy, a compliant data operation typically needs a cookie compliance mechanism for consent to tracking, a data processing agreement with every vendor that processes data on your behalf (required under GDPR and expected under the DPDP Act), and clear terms and conditions and an acceptable use policy governing how the service is used. For the full set of documents a website needs, see our guide on legal documents your website cannot ignore, and for SaaS businesses, the legal documents every SaaS startup needs.
Two areas deserve special attention in 2026. If your business uses AI tools that process personal data, most of these laws now expect you to disclose that and, in some cases, provide safeguards around automated decision-making, an area we cover in our guide on AI vendor contracts. And if your data practices are complex or cross-border, specialist advice is worth it: our technology lawyers for tech, SaaS, and AI platforms advise on building compliant, multi-jurisdiction data operations.
Frequently asked questions
What are data protection laws?
Data protection laws are statutes that regulate how organisations collect, use, store, and share personal data. They typically require a lawful basis for processing data, transparency about what is done with it, individual rights over one’s own data (such as access, correction, and deletion), security measures, and breach notification. Most modern data protection laws are modelled on the EU’s GDPR and apply extraterritorially, covering any organisation that processes the data of people in that territory.
How many countries have data protection laws in 2026?
As of 2026, more than 170 countries have enacted data protection or privacy legislation, covering roughly 79% of the world’s population. The number has grown rapidly since GDPR took effect in 2018, with new comprehensive laws continuing to arrive, including Vietnam’s law effective January 2026 and the phased rollout of India’s DPDP Act rules from late 2025.
Which data protection law is the strictest?
The EU’s GDPR is generally considered the global benchmark and carries the largest turnover-based penalties (up to 4% of global annual revenue). China’s PIPL is arguably stricter on cross-border data transfers, requiring security assessments and localisation of certain data. Which law is “strictest” depends on the dimension: GDPR on fines and individual rights, PIPL on data export controls. For most businesses, building to GDPR standards covers the core of nearly every regime.
Does GDPR apply to businesses outside the EU?
Yes. GDPR applies to any organisation that processes the personal data of people in the EU, regardless of where the organisation is located. A business based in India, the US, or anywhere else that offers goods or services to people in the EU, or monitors their behaviour, is subject to GDPR and its penalties. This extraterritorial reach is a feature of most modern data protection laws, including India’s DPDP Act.
What is the DPDP Act and who does it apply to?
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data protection law. It applies to the processing of digital personal data in India and to foreign businesses that offer goods or services to people in India. It requires consent or another lawful basis for processing, gives individuals rights over their data, mandates breach reporting, requires parental consent for children’s data, and carries penalties up to Rs 250 crore. Its implementing rules were notified in November 2025, moving it into active enforcement through 2026.
How can a business comply with multiple data protection laws at once?
The practical approach is to build data practices to the highest applicable standard, usually GDPR, which satisfies the shared core of most regimes, and then layer on the specific local requirements for each market where the business has users. In practice this means having a compliant, jurisdiction-aware privacy policy, obtaining valid consent, signing data processing agreements with vendors, honouring individual rights requests, meeting breach-notification timelines, and taking specialist advice where data flows are complex or cross-border.
Authored and reviewed by Prakhar Rai, Advocate, founder of My Legal Pal. Prakhar is enrolled with the Bar Council of India and has over ten years of experience advising businesses on data protection, technology, and cross-border compliance. He is an alumnus of the National Law School of India University, Bangalore, where he completed his Master of Business Laws, and of La Martiniere. Connect on LinkedIn.
This article is general information, not legal advice. Data protection law is complex, varies by jurisdiction, and changes frequently. For advice on your own compliance obligations, speak to a qualified lawyer.
If you need help complying with data protection laws in the markets your business serves, our team can help. Start with our privacy policy drafting service, or speak to our technology lawyers for multi-jurisdiction compliance.
