Privacy laws
Global privacy laws, explained for people who have to implement them
Evergreen overviews of the frameworks that shape privacy programmes worldwide. Each page covers scope, principles, rights, obligations, transfers, enforcement and a practical checklist — with links to the official source text.
Europe
EU General Data Protection Regulation (GDPR)
European Union / EEA · National supervisory authorities, coordinated by the European Data Protection Board
The reference point for modern data protection law: a principles-based regime covering any processing of personal data in the EU/EEA context, with defined lawful bases, individual rights and accountability duties.
Read the overviewUK GDPR and the Data Protection Act 2018
United Kingdom · Information Commissioner's Office (ICO)
The UK's retained version of the GDPR, read together with the Data Protection Act 2018. Structurally close to the EU regime, with UK-specific exemptions, transfer tools and a single national regulator.
Read the overviewAmericas
US State Privacy Laws (CCPA/CPRA as the anchor)
United States — state level · California Privacy Protection Agency and state attorneys general
The United States has no single general privacy statute. A growing set of state laws — with California's CCPA as amended by the CPRA as the most developed — creates consumer rights and business duties that apply above defined thresholds.
Read the overviewCanada — Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada (federal, private sector) · Office of the Privacy Commissioner of Canada
Canada's federal private-sector privacy law, built on ten fair information principles and a consent-centred model, with an ombudsman-style regulator and substantially similar provincial regimes in some provinces.
Read the overviewAsia-Pacific
India Digital Personal Data Protection Act, 2023
India · Data Protection Board of India
India's general data protection statute, built around consent and specified legitimate uses, with duties for Data Fiduciaries, rights for Data Principals and an administrative penalty regime.
Read the overviewAustralia — Privacy Act 1988 and the Australian Privacy Principles
Australia · Office of the Australian Information Commissioner (OAIC)
Australia's federal privacy regime, structured around thirteen Australian Privacy Principles, applying to agencies and to organisations above a small-business threshold, with a mandatory notifiable data breach scheme.
Read the overviewSingapore — Personal Data Protection Act (PDPA)
Singapore · Personal Data Protection Commission (PDPC)
Singapore's private-sector data protection law: a set of clearly enumerated obligations covering consent, purpose, notification, access, accuracy, protection, retention, transfer, accountability and breach notification, plus the Do Not Call registry.
Read the overviewMiddle East
Privacy Practice Lab publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.