Global Privacy Law Experts · GDPR · UK GDPR · CCPA · DPDP
Privacy advice for businesses that handle personal data in more than one country. We cover GDPR and UK GDPR in Europe, the CCPA and other US state laws, India’s DPDP Act, Argentina’s data protection law, and the main privacy laws of Asia, the Middle East and beyond.
Share the countries your customers and staff are in, the kind of data you collect, the vendors that touch it, and what you need: an audit, a policy, a data processing agreement or breach help. An attorney from our team replies with a fixed quote and a clear plan.
Yes, if you collect, store or share personal data about people in more than one country, or if a regulator, investor or large customer has started asking how you handle that data. Even a single website with analytics, a mailing tool and a payment provider handles personal data, and that puts it under at least one privacy law.
This page answers the questions businesses ask us most. Each heading is a question and each answer starts with the short version, then explains. If your question is only about India, go to our page for a data protection lawyer in India. If you need the contract that governs a vendor handling your data, see data processing agreement drafting.
On this page: Why a specialist · Laws we advise on · One programme or many · What we do · Who hires us · Cost of getting it wrong · How it works · FAQ
No. There is no single global privacy law. Each country or state has its own definitions, deadlines and penalties. A business with customers in Europe, California and India does not face one rulebook. It faces three at the same time, and they do not always agree.
That is why privacy advice is a specialist job. A lawyer has to tell you which laws reach your business, what each one asks of you in practice, and how to meet all of them with one set of documents and processes, not three. Getting this wrong is also a trust problem: customers choose brands they believe will look after their data.
My Legal Pal’s privacy work sits between law, business and technology. We explain what the rules mean for your product and your vendors, then draft the documents and set up the steps to keep you compliant as the rules change.
We advise on GDPR and UK GDPR, the CCPA and other US state laws, India’s DPDP Act, Argentina’s Law 25,326, and the main privacy laws of Canada, Singapore, Thailand, South Africa, Australia, Brazil, the UAE and Saudi Arabia. The sections below say when each one applies to you.
Yes. GDPR applies to businesses outside the EU that offer goods or services to people in the EU or monitor their behaviour, and we advise on the full compliance programme. A company in New York, Mumbai or Sydney can be covered. Tracking EU visitors with analytics or ad pixels counts as monitoring. You may also need to appoint an EU representative under Article 27.
The main duties are a lawful basis for each use of data, valid consent where consent is the basis, individual rights (access, erasure, portability), a written contract with every processor, a breach notice to the regulator within 72 hours where individuals are at risk, and a Data Protection Officer in some cases. Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher.
We advise on GDPR frameworks, privacy notices, DPA drafting, cross-border transfers under Standard Contractual Clauses, and breach response. For a plain explanation of who each national law covers, see data protection laws around the world.
Yes, and you usually need both if you serve UK and EU customers. After Brexit the UK kept its own version, the UK GDPR, which sits with the Data Protection Act 2018 and was updated by the Data (Use and Access) Act 2025. The regulator is the Information Commissioner’s Office (ICO), and fines can reach £17.5 million or 4% of worldwide turnover. Data moving between the UK and the EU needs a valid transfer tool.
Yes. The first question is whether the CCPA applies to you: it does if you do business in California, run for profit and meet one of three tests. The tests are: annual gross revenue above $26.625 million (the figure adjusted from 1 January 2025), personal information of 100,000 or more California consumers or households, or at least 50% of revenue from selling or sharing personal information.
California residents can ask what you collect, ask you to delete or correct it, opt out of its sale or sharing, and limit the use of sensitive data. Fines are up to $2,663 per violation and up to $7,988 per intentional violation or violation involving a child under 16. More than twenty other US states, including Virginia, Colorado, Connecticut, Texas and Oregon, now have their own laws. They overlap but differ, so we build one programme that covers several states at once instead of answering each state separately.
Yes. The DPDP Act reaches businesses outside India that process data of people in India while offering them goods or services. It is being brought into force in phases: the Rules were notified in November 2025, the Data Protection Board is in place, consent manager rules start in November 2026, and the main business duties apply from May 2027. Penalties run up to ₹250 crore.
For the detail, start with our DPDP Act compliance guide and test where you stand with the free DPDP compliance checker and website scanner. For hands-on help in India, see our data protection lawyer in India page. Deeper guides: consent rules, DPIAs, data mapping and DPDP contract compliance.
Yes. Argentina’s Personal Data Protection Law No. 25,326, in force since 2000, is enforced by the Agency for Access to Public Information (AAIP). The European Union treats Argentina as providing an adequate level of protection, so personal data can move from the EU to Argentina without extra transfer tools. Argentina’s rules still differ from GDPR and the CCPA in several ways. Read our guide on how Argentina data protection law differs from GDPR and CCPA.
Yes. We advise on the laws below, and on how they fit together.
PIPEDA (Canada). Governs how private-sector organisations collect, use and disclose personal information in commercial activity. Some provinces, such as Quebec, have stricter rules.
PDPA (Singapore and Thailand). Both countries have a Personal Data Protection Act with rules on collection, use, disclosure and cross-border transfers.
POPIA (South Africa). Sets conditions for lawful processing and is enforced by the Information Regulator.
Privacy Act (Australia). The Australian Privacy Principles apply to government agencies and many private organisations. The law is being reformed in stages.
LGPD (Brazil). Mirrors GDPR in structure and covers personal data of people in Brazil.
PDPL (UAE and Saudi Arabia). Both Gulf countries have national personal data protection laws for businesses processing data in, or aimed at residents of, those countries.
Mostly yes. Most businesses build one baseline and add short country-specific steps on top. This is cheaper and easier to run than separate programmes. It works in three steps:
1. Map your data. List what personal data you hold, where it comes from, which vendors touch it and which countries it moves between.
2. Set one strong baseline. Use the strictest common rules for notices, consent, security, retention and breach handling, so one process satisfies most laws.
3. Add the local parts. These include an EU representative where needed, India’s consent notices, California’s opt-out links and country-specific transfer terms.
If you only learned about this because you have users abroad, start with what having international users means for your legal obligations.
A data protection lawyer works out which privacy laws apply to you, finds the gaps between those laws and what you actually do, and writes or fixes the documents and processes that close them. The questions below show what that work looks like.
Yes, if you have never mapped your data, you are entering a new market, or an investor or customer has sent a privacy questionnaire. We compare your real practices with each law that applies and give you a ranked list: what is urgent, what can wait and what to fix first. For a quick first look at India’s law, use the free DPDP compliance checker.
Yes. We draft them as one consistent set for websites, apps and SaaS, so what you tell people matches what your site really does. Almost every privacy law requires this notice. See privacy policy drafting and cookie policy drafting. To learn the basics first, read what a privacy policy must contain and cookie compliance across jurisdictions.
Yes, and you need one whenever a vendor, partner or customer handles personal data on your behalf or you handle it on theirs. GDPR Article 28 requires a written contract, and US state laws and the DPDP Act expect one too. We run this as a separate service: see data processing agreement drafting. You can also read a sample data processing agreement template first. For India, see which agreements need DPDP clauses.
No. Under GDPR, consent is only one of six lawful bases, and contract, legal duty and legitimate interests are often better fits. Under the DPDP Act, consent is the main ground, with a limited list of “legitimate uses”. The skill is choosing the right basis for each use of data and building consent flows that meet the standard where consent is needed. See why consent is becoming the foundation of data protection and the Indian consent management rules.
Yes, if the law allows the transfer and you use a valid transfer tool. Under GDPR the tools are an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or the EU-US Data Privacy Framework for certified US companies. The DPDP Act allows transfers out of India except to countries the government restricts. See how businesses legally transfer personal data with SCCs.
Yes, and act fast: in most laws the clock starts when you become aware. Under GDPR and UK GDPR you must tell the regulator within 72 hours unless the breach is unlikely to put individuals at risk. India’s DPDP Rules require notice to the Data Protection Board and affected individuals, with a detailed report to the Board within 72 hours. Singapore has its own three-day rule once a breach is assessed as notifiable, and many US states have breach laws. Our legal playbook for the first 72 hours covers the steps, and the Indian position is in India’s two breach reporting regimes.
Only in some cases. Under GDPR a DPO is mandatory for public authorities, for organisations that monitor people on a large scale, and for those that process special categories of data on a large scale. Under the DPDP Act only significant data fiduciaries must appoint one, and they must be based in India. Where a DPO is not required, naming one is still good practice for businesses with a lot of personal data. We advise on whether you need one and can support you as an outsourced DPO where the law allows it.
Yes. HR files, payroll, background checks and workplace monitoring all involve personal data, and many laws give employees their own rights. We advise on lawful use of employee data, monitoring policies and HR vendors, and align them with your employment contracts.
Yes. It is cheaper than fixing a launched product. GDPR requires a data protection impact assessment for high-risk processing, and the DPDP Act requires one for significant data fiduciaries. We review product designs, data flows and AI features before launch. See what a DPIA is and when you need one and our technology lawyers for startups, SaaS and AI platforms.
Any business that handles personal data can use one, but these groups usually need one first.
Startups and scale-ups in fintech, health tech and SaaS, where data is part of the product. See the legal documents every SaaS startup needs and our SaaS agreement drafting service.
Multinational companies managing duties in several countries and needing one consistent approach.
E-commerce and digital businesses collecting customer data at scale under GDPR, the CCPA and local laws in their markets.
Healthcare and financial services firms handling sensitive data under both general privacy law and sector rules.
Technology and AI companies whose models or analytics products raise new questions about personal data.
Up to €20 million or 4% of worldwide turnover under GDPR, and up to ₹250 crore under India’s DPDP Act. The maximums are real. Regulators have used them.
GDPR: up to €20 million or 4% of worldwide annual turnover, whichever is higher. A DLA Piper survey puts total GDPR fines at about €7.1 billion from May 2018 to January 2026, with about €1.2 billion issued in 2025 alone (DLA Piper, January 2026).
UK GDPR: up to £17.5 million or 4% of worldwide turnover.
CCPA: up to $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16, adjusted from 1 January 2025 (California Privacy Protection Agency).
DPDP Act (India): up to ₹250 crore for failure to keep reasonable security safeguards, with other penalties for failing to report a breach.
The money is only part of it. A breach or a regulator’s inquiry can damage trust, slow a funding round or lower a company’s value. Businesses that treat privacy as part of how they are built, not a late clean-up, scale with fewer surprises.
Four mistakes come up again and again when we review startups and growing businesses.
A copied privacy policy. It names the wrong law, lists rights the business cannot honour, or describes tools the company does not use.
Vendors with no data processing agreement. Analytics, CRM, email and payroll tools hold personal data, but nobody signed the contract the law expects.
Tracking before consent. Cookie banners that let analytics and ad scripts load before the visitor chooses.
No breach plan. The team learns the 72-hour rule while the incident is already running.
Each one is quick to fix when found early and costly when a customer, investor or regulator finds it first.
In four online steps at a fixed fee: you tell us, we quote, we draft, you approve.
The countries you serve, the personal data you collect, your main vendors and what you need.
A clear recommendation and a fixed quote within 2 hours. No hourly billing.
A data protection lawyer audits the gaps and drafts the policies, agreements and notices, with a short plain-language note on the choices that matter.
We update the drafts until they fit your business, and tell you what to do next, such as vendor signatures, banner settings or regulator filings.
This page is general information and is not legal advice for your situation. The law of your country and your facts decide the detail. An attorney-client relationship begins only when we confirm an engagement in writing. Figures and dates were checked against official and published sources in November 2026.
Services and guides that go deeper on the points above.
Controller and processor terms for GDPR, US state laws and DPDP.
DPDP gap work, consent, breach response and Board proceedings.
Policies for websites, apps and SaaS.
Cookie notices that match what your site really does.
Rules, timeline and what Indian and foreign businesses must do.
A quick check of where you stand on India’s law.
Scan your live site against a 12-point DPDP checklist.
How Law 25,326 differs from GDPR and CCPA.
How to move personal data across borders lawfully.
The first 72 hours, step by step.
A map of national privacy laws.
A sample data processing agreement to read first.
This page is reviewed by Prakhar Rai, an attorney enrolled with the Bar Council of India, an alumnus of the National Law School of India University (NLSIU), Bangalore, with a Master of Business Laws, and the founder of My Legal Pal. His practice covers technology, data protection and commercial contracts for companies in India and abroad.
Law checked as of 12 November 2026 against statutes, regulator guidance and published surveys. Reviewed for legal accuracy by Prakhar Rai, Attorney (Bar Council of India). Last updated: November 2026.
Audits, privacy policies, data processing agreements and breach support from experienced data protection attorneys. Fixed fee, fully online.
Call +91 8004800100
