International Privacy Laws Compared: GDPR, CCPA, LGPD, PIPEDA

GDPR (European Union)

GDPR is the most comprehensive privacy law globally. It applies to any organization processing EU/EEA residents’ data regardless of business location. Key requirements: lawful basis for processing, explicit opt-in consent for non-essential cookies, rights to access/rectify/port/delete data, Data Protection Impact Assessments, mandatory DPO for large-scale processing, 72-hour breach notification, and privacy by design. Maximum penalty: €20 million or 4% of global revenue.

CCPA/CPRA (California)

California’s CCPA/CPRA gives similar rights with different mechanics. It applies to for-profit businesses meeting revenue, data volume, or data sale thresholds. Key differences from GDPR: opt-out model (users must actively opt out), broader ‘sale’ definition (includes sharing for cross-context advertising), required ‘Do Not Sell or Share’ link, no legitimate interest basis, private right of action for breaches. Similar laws enacted in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and growing.

Other Major Privacy Laws

Brazil’s LGPD mirrors GDPR with 10 legal bases (vs 6) and penalties up to 2% of Brazilian revenue. Canada’s PIPEDA is being updated by Bill C-27. UK’s post-Brexit UK GDPR is substantially identical to EU GDPR. India’s Digital Personal Data Protection Act (2023) introduces consent-based processing with government exemptions. Japan, South Korea, Singapore, and Australia all have comprehensive laws. Use the Privacy Policy Generator for multi-jurisdictional policies.

Multi-Jurisdictional Compliance

For multi-jurisdictional compliance, adopt a ‘highest common denominator’ approach: build around GDPR (most demanding) and layer jurisdiction-specific requirements. Get explicit consent for cookies and marketing, provide all user rights, maintain clear privacy policy, implement retention limits and deletion, maintain processing records and DPIAs, appoint a privacy lead. Have a privacy lawyer review for your specific markets.