PrivacyBuilt / Knowledge
Global privacy crosswalk
Compare the obligation—not just the acronym. Scope, role and commencement come first.
PrivacyBuilt Editorial · Reference edition 3 November 2026
| Duty / decision | EU GDPR | California CCPA / CPRA | Singapore PDPA | India DPDP |
|---|---|---|---|---|
| Applicability & roles | Processing in an EU/EEA establishment context, or defined targeting/monitoring of people there. Distinguish controller and processor; exemptions and national rules matter. | Covered businesses meeting statutory criteria; service-provider, contractor and third-party roles have separate conditions. CPRA amends CCPA, not a second standalone regime. | Organisations handling personal data within PDPA scope, with role-specific duties for data intermediaries; exclusions and exceptions matter. | Enacted Act addresses specified digital personal data processing and certain extraterritorial offerings. Data Fiduciary and Data Processor roles; substantive applicability provisions are phased, not universally operative today. |
| Processing grounds | Six Article 6 bases; Article 9 adds conditions for special categories. A contract with a vendor is not itself a lawful basis for every processing purpose. | Not a GDPR-style six-basis model. Transparency, purpose limitation, proportionality, relevant consent duties and opt-outs must be assessed for the particular activity. | Consent, deemed consent and statutory exceptions, together with purpose, notification and other duties; do not import GDPR legitimate interests as a universal basis. | Act sets consent and specified legitimate uses, not GDPR’s six bases. Check commencement of sections 4–7 and rules before treating these as current operational duties. |
| Individual rights | Access, correction, erasure, restriction, portability, objection and qualifying automated-decision protections, subject to conditions and exceptions. | Know/access, deletion, correction, opt-out of sale/sharing and qualifying limits on sensitive information use; non-discrimination and request-specific rules apply. | Access, correction and withdrawal of consent, subject to qualifications. Do not assume an identical GDPR erasure or portability framework; verify operative provisions. | Act provides access information, correction/erasure, grievance and nomination rights when corresponding provisions apply. Do not promise currently operative rights from enactment alone. |
| Rights-response timing | Without undue delay, normally one month from receipt; possible further two months for complexity/number, with notice and reasons within initial month. Validate specific clock treatment. | Access, deletion and correction generally 45 calendar days; possible further 45 with notice. Other request types, including opt-out, have different clocks under the regulations. | Access and correction: respond as soon as reasonably possible; if unable within 30 days, inform the person in writing when a response can be expected, subject to relevant rules. | Do not substitute GDPR deadlines. Validate commencement, applicable Rules and the right concerned before assigning an operational deadline. |
| Breach notification | Authority: without undue delay and, where feasible, within 72 hours of awareness unless unlikely risk. Individuals: likely high risk, without undue delay, subject to Article 34 exceptions. | California general breach notification duties are in separate statutes, including Civil Code sections 1798.29 and 1798.82, not simply a CCPA 72-hour clock. Validate current text and facts. | PDPC: significant harm OR significant scale (500+); as soon as practicable, within three calendar days after notifiable determination. Individuals: significant harm, subject to exceptions. Assessment must be expeditious. | The Act and Rules include breach obligations in phased substantive provisions. Do not treat the full regime as commenced or infer a universal GDPR-style clock; verify current notifications and other applicable laws. |
| Transfers & supplier contracts | Article 28 governs relevant processor contracts. Chapter V routes include adequacy, SCCs or approved BCRs where applicable. Evaluate effective protection and supplementary measures for relevant safeguarded transfers. | Qualifying contracts restrict service-provider/contractor use and impose obligations. No general GDPR-equivalent adequacy/SCC regime; other laws and contract commitments may apply. | Transfer Limitation Obligation requires comparable protection using legally enforceable obligations or an applicable exception. Contractual and intermediary duties need role-specific assessment. | Section 16 enables notified transfer restrictions subject to other laws; do not describe GDPR SCCs as the Act’s universal requirement. Check commencement, notified restrictions and sector rules. |
| Retention & disposal | Keep identifiable data no longer than necessary for purposes, with lawful exceptions. Define evidence-based periods and technical enforcement; there is no universal duration. | Disclose retention periods or criteria and limit retention to what is reasonably necessary and proportionate for disclosed purposes, subject to statutory conditions. | Cease retention or remove association with individuals when purpose is no longer served and legal/business retention is no longer necessary. | Act contains erasure/retention duties and exceptions subject to phased commencement. Prepare purpose-led records, but verify operative duties and sector retention laws. |
Official source trail
- EU GDPR — official text
- California Privacy Protection Agency — current statute and regulations
- California Civil Code — breach notification section 1798.82
- Singapore PDPC — PDPA and obligations
- Singapore PDPC — breach guidance
- MeitY — official DPDP Rules and commencement materials
- India DPDP Act commencement notification — G.S.R. 843(E)
Not exhaustive. National, sector, employment and other laws can add duties. Similar labels do not mean equivalent legal rights or mechanisms.