Data Privacy Laws Beyond GDPR

Introduction

Data privacy laws now influence how organizations collect customer information, manage employee records, use digital platforms, select technology vendors and transfer information across borders. The General Data Protection Regulation (GDPR) remains one of the world's most influential privacy frameworks, but it is no longer the only major law organizations need to understand.

Countries and regions around the world have introduced privacy legislation with different rules on consent, transparency, individual rights, security, international transfers and enforcement. For Canadian organizations, this international landscape can become particularly important when serving customers, employing staff or using service providers in other jurisdictions.

A Canadian organization may therefore need to consider Canadian privacy legislation alongside laws such as the California Consumer Privacy Act, Brazil's LGPD, the UK GDPR, India's Digital Personal Data Protection framework or China's Personal Information Protection Law.

This guide explains major data privacy laws beyond GDPR, how they compare, when they may affect Canadian organizations and what businesses can do to manage international privacy compliance in 2026.

What Are Data Privacy Laws?

Data privacy laws regulate how organizations collect, use, store, disclose, retain and protect information relating to individuals.

They generally aim to give individuals greater control over their information while requiring organizations to handle that information responsibly. Depending on the jurisdiction and circumstances, organizations may need consent or another recognized legal basis, authority or justification before processing personal information.

Although privacy frameworks differ significantly, common areas of regulation include:

• Transparency about how information is collected and used
• Limits on unnecessary data collection
• Appropriate security safeguards
• Individual access and correction rights
• Rules governing retention and deletion
• Responsibilities when using service providers
• Data breach requirements
• Cross-border transfers
• Regulatory oversight and enforcement

These concepts overlap with the principles discussed in Key Principles of Data Protection, which explains the foundations organizations can use when building a privacy-management framework.

Importantly, however, organizations should not assume that satisfying one privacy law automatically means they comply with every other law. Similar principles can be implemented differently across jurisdictions.

GDPR remains one of the world's most influential privacy frameworks, but organizations operating internationally may now encounter several different data privacy laws.

Canada, California, Brazil, the United Kingdom, Switzerland, India and China all have significant privacy frameworks with their own rules on processing, individual rights, international transfers and enforcement.

Although many share principles such as transparency, accountability and security, their legal requirements are not identical. Organizations should therefore determine which laws apply to their activities rather than assuming GDPR compliance automatically satisfies every jurisdiction.

For a clear introduction to the European framework, see our What Is GDPR and Why It Matters guide.

Major Data Privacy Laws Beyond GDPR

Canada's PIPEDA and Provincial Privacy Laws

For Canadian organizations, the starting point is often the Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA applies to many private-sector organizations that collect, use or disclose personal information in the course of commercial activities. It also continues to apply in particular circumstances involving federally regulated organizations and personal information moving across provincial or international borders.

Canada's privacy structure is more complex than a single federal law.

Alberta, British Columbia and Quebec have private-sector privacy legislation that has been declared substantially similar to PIPEDA. Consequently, the applicable law may depend on where an organization operates, the nature of its activities and whether personal information crosses provincial or national boundaries.

Organizations therefore need to determine jurisdiction rather than automatically assuming PIPEDA applies to every Canadian privacy issue.

The Office of the Privacy Commissioner of Canada explains how PIPEDA interacts with substantially similar provincial laws and when more than one privacy regime may need to be considered.

PIPEDA itself is based around ten fair-information principles, including:

• Accountability
• Identifying purposes
• Consent
• Limiting collection
• Limiting use, disclosure and retention
• Accuracy
• Safeguards
• Openness
• Individual access
• Challenging compliance

Canadian privacy law is also undergoing significant modernization.

In June 2026, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, which proposes reforms to Canada's private-sector privacy framework.

Because Bill C-36 is proposed legislation rather than simply another name for existing PIPEDA requirements, organizations should distinguish carefully between current legal obligations and potential future requirements.

For a structured review of existing controls, organizations can also use our GDPR Compliance Checklist alongside any jurisdiction-specific Canadian assessment.

California Consumer Privacy Act — CCPA and CPRA Amendments

California has one of the most influential state privacy frameworks in the United States.

The California Consumer Privacy Act (CCPA) gives California consumers rights concerning personal information held by businesses. The California Privacy Rights Act (CPRA) subsequently amended and expanded the CCPA rather than creating an entirely separate privacy law.

Important consumer rights include the ability to:

• Know what personal information a business collects and how it is used or shared
• Request deletion in qualifying circumstances
• Request correction of inaccurate information
• Opt out of the sale or sharing of personal information
• Limit certain uses and disclosures of sensitive personal information
• Exercise privacy rights without unlawful discrimination

Not every business dealing with a California customer automatically falls under the CCPA.

The legislation applies to qualifying for-profit businesses doing business in California that meet specified criteria, including revenue and personal-information processing thresholds.

Canadian businesses offering products or digital services to California residents should therefore determine whether the law applies instead of assuming that either geography alone or having a US customer automatically creates CCPA obligations.

The California Attorney General provides guidance explaining current CCPA consumer rights and business responsibilities.

Brazil's Lei Geral de Proteção de Dados — LGPD

Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD) is another major international privacy framework.

Although it shares several concepts with GDPR, organizations should avoid treating the LGPD simply as the “Brazilian GDPR.”

The law regulates the processing of personal information and establishes principles, individual rights, lawful grounds for processing and organizational responsibilities.

Its territorial scope can also extend beyond organizations physically established in Brazil in circumstances defined by the legislation.

Like GDPR, the LGPD recognizes multiple legal grounds for processing rather than treating consent as the only permissible mechanism.

Potential administrative penalties can include fines calculated at up to 2% of relevant revenue in Brazil, subject to the statutory cap of R$50 million per infraction, as well as other regulatory measures depending on the circumstances.

For Canadian organizations expanding into Latin America, the practical lesson is straightforward: GDPR knowledge can provide a useful foundation, but local LGPD requirements still need to be assessed independently.

Switzerland's Federal Act on Data Protection — FADP

Switzerland's revised Federal Act on Data Protection (FADP) came into force on 1 September 2023.

The Swiss framework includes requirements concerning transparency, information security, privacy governance and higher-risk processing.

One area where precision matters is data-breach reporting.

Not every security incident automatically requires notification to the Swiss regulator. A controller must notify the Federal Data Protection and Information Commissioner when a data-security breach is likely to result in a high risk to the personality or fundamental rights of affected individuals.

Organizations may also need to inform affected individuals when doing so is necessary for their protection.

This differs from simplified claims that Switzerland requires every personal-data breach to be reported.

Canadian organizations working with Swiss customers, employees, partners or processing activities should therefore assess the actual FADP criteria that apply to the relevant situation.

UK GDPR After Brexit

The United Kingdom retained a separate data-protection framework after leaving the European Union.

The UK GDPR, together with the Data Protection Act 2018 and subsequent reforms, continues to govern significant areas of personal-data processing in the UK.

The UK's Data (Use and Access) Act 2025, commonly referred to as the DUAA, introduced a number of changes to UK data-protection law. Its data-protection provisions were brought into force in stages, with all of those provisions in force by June 2026.

One important development is the introduction of recognized legitimate interests.

Where the statutory requirements are met, organizations relying on one of these recognized legitimate interests do not have to perform the same balancing exercise used for the standard legitimate-interests basis.

However, organizations should not assume that UK reforms eliminated the Data Protection Officer role.

UK GDPR still requires organizations to appoint a DPO in specified circumstances, including where:

• The organization is a public authority or body, subject to relevant exceptions
• Core activities involve large-scale regular and systematic monitoring
• Core activities involve large-scale processing of special-category data or criminal-offence information

The UK Information Commissioner's Office continues to provide guidance on DPO appointment, independence and responsibilities.

UK and EU privacy rules therefore remain closely connected but should no longer be treated as permanently identical.

Another important development involves international data transfers.

In December 2025, the European Commission renewed the UK's adequacy decision under GDPR, supporting the continued flow of personal data covered by that decision from the European Economic Area to the UK without additional transfer safeguards solely because the destination is the UK.

Organizations operating in both markets should nevertheless continue monitoring the separate development of EU and UK requirements.

India's Digital Personal Data Protection Framework

India enacted the Digital Personal Data Protection Act 2023, creating a national framework for processing digital personal data.

The Digital Personal Data Protection Rules 2025 were subsequently notified in November 2025, providing the implementation framework for the Act.

The Indian government adopted a phased implementation timetable rather than bringing every substantive obligation into effect on the same date.

This makes implementation timing important for organizations operating in India or serving individuals there.

The framework addresses matters including:

• Notice and consent
• Individual rights
• Organizational responsibilities
• Personal-data breaches
• Children's information
• Significant Data Fiduciaries
• Security safeguards
• Cross-border data issues

Organizations should therefore check which provisions are currently effective rather than relying solely on the date the original Act received presidential assent.

The DPDP framework can also apply to certain processing outside India where processing relates to offering goods or services to individuals within India.

For Canadian technology companies, SaaS providers and international e-commerce businesses, India should consequently form part of international privacy-mapping exercises where relevant.

China's Personal Information Protection Law — PIPL

China's Personal Information Protection Law (PIPL) is one of the world's most significant privacy laws outside Europe.

PIPL applies to the processing of personal information within China and can also apply to certain processing outside China involving individuals located there.

Examples include processing carried out for:

• Providing products or services to individuals in China
• Analysing or evaluating the behaviour of individuals in China
• Other circumstances specified by Chinese law

PIPL establishes requirements governing personal-information processing, sensitive personal information, individual rights, processor obligations and international transfers.

The law also contains specific mechanisms for certain transfers of personal information outside China.

Depending on the circumstances, these can involve security assessments, certification, standard contractual mechanisms or other legally recognized arrangements.

For organizations outside China, PIPL demonstrates why international privacy compliance cannot simply be built by copying a GDPR policy and applying it globally.

The terminology, legal mechanisms and regulatory expectations need to be assessed in their own jurisdictional context.

GDPR vs Other Global Data Privacy Laws

Privacy legislation around the world shares important ideas, but the legal details differ.

Key Similarities

Common themes frequently include:

• Transparency about processing
• Security safeguards
• Limits on unnecessary collection or use
• Individual privacy rights
• Organizational accountability
• Rules governing third-party processing
• Regulatory supervision
• Cross-border data considerations

These similarities can help multinational organizations create a common privacy-governance foundation.

However, the organization's controls then need to account for jurisdiction-specific requirements.

Important Differences

Differences can arise in several areas.

Scope

Some laws apply because an organization is established within a jurisdiction. Others can apply based on where individuals are located, whether goods or services are offered into the jurisdiction or whether statutory business thresholds are met.

Processing grounds

GDPR uses specified lawful bases. Other frameworks may structure processing permissions around consent, statutory exceptions, consumer rights or other legal mechanisms.

Individual rights

Access, correction, deletion and objection rights are common, but their precise scope and applicable exceptions vary.

Breach reporting

Reporting thresholds, deadlines and the authorities that must be notified differ between jurisdictions.

International transfers

GDPR uses mechanisms such as adequacy decisions and appropriate safeguards. Other jurisdictions have their own systems, conditions and restrictions.

Enforcement

Regulatory powers, administrative fines, private rights of action and available remedies differ considerably.

More than one privacy law can apply to the same organization. For example, a Canadian company serving customers in the EU, UK and California may need to assess Canadian privacy requirements alongside GDPR, UK GDPR and CCPA. The applicable rules depend on the organization's activities, customers, processing operations and the territorial scope of each law. 

Understanding who should oversee this work is also important. Our guide to the Role of a Data Protection Officer (DPO) explains the responsibilities, independence and compliance role associated with the DPO function.

Cross-Border Data Transfers

International transfers are among the most complex areas of modern privacy compliance.

Businesses routinely move information between countries through:

• Cloud hosting
• International payroll systems
• Customer relationship management platforms
• Marketing technology
• Analytics tools
• Payment providers
• Outsourced support services
• Corporate group systems
• AI platforms

A transfer that appears operationally simple may create legal requirements in multiple jurisdictions.

Under GDPR, for example, transfers to countries outside the European Economic Area may require an adequacy decision or another recognized safeguard where the relevant transfer rules apply.

The UK operates its own international-transfer regime.

China has specific mechanisms for qualifying international transfers.

Canada takes a different approach, emphasizing organizational accountability for personal information transferred to third parties for processing.

International organizations should therefore document:

• What data leaves a jurisdiction
• Where it goes
• Why the transfer occurs
• Which processor or recipient receives it
• Which contractual safeguards apply
• Whether local transfer mechanisms are required
• How individuals are informed

International data flows should be mapped before an organization decides that its transfer arrangements are compliant.

AI and Data Privacy Laws

Artificial intelligence introduces new privacy questions, but AI does not make existing privacy law disappear.

Where an AI system processes personal information, organizations still need to consider the privacy rules that already apply.

For example, organizations may need to determine:

• Why personal information is being processed
• Whether the processing is compatible with the original purpose
• Whether individuals have received adequate information
• Whether sensitive information is involved
• Whether automated decision-making rules apply
• Whether the data is being transferred internationally
• Whether training data has been obtained and used lawfully
• Whether individuals can exercise applicable privacy rights

Generative AI also creates practical information-governance risks.

Employees can unintentionally disclose personal or confidential information by entering it into public AI tools. Organizations should therefore establish clear policies covering approved AI systems, data classifications and acceptable use.

How the EU AI Act Interacts With Privacy Regulation

The EU AI Act creates a separate risk-based regulatory framework for artificial intelligence and should not be treated as a replacement for GDPR. Depending on the system and processing activity, an organization may need to comply with both AI-specific requirements and applicable data-protection rules. 

Build Stronger Privacy Compliance Knowledge

Managing privacy across multiple jurisdictions requires more than memorizing the names of different laws. Professionals need to understand privacy principles, accountability, risk assessment, individual rights, governance and the role of privacy leadership.

Our GDPR / Data Protection Officer (DPO) Certification provides structured training for professionals who want to strengthen their understanding of GDPR, data-protection responsibilities and the DPO role.

Explore the GDPR / Data Protection Officer (DPO) Certification and develop practical privacy-compliance knowledge at your own pace. 

Common Challenges in Global Data Privacy Compliance

Determining Which Laws Apply

The first challenge is jurisdiction. An organization's location is only one factor; customers, employees, processing activities and target markets may also affect which laws apply. Organizations therefore need to understand the applicability tests under each relevant framework. 

Managing Different Individual Rights

Privacy teams also need processes for receiving and responding to requests.

The type of rights available, verification requirements, permitted exceptions and response periods can vary.

A centralized request-management process can help, but it must still recognize local legal requirements. 

Maintaining Accurate Data Inventories

An organization cannot effectively govern information it cannot locate.

A practical privacy program should identify:

• Categories of personal information
• Sources
• Purposes
• Systems
• Recipients
• Storage locations
• Retention periods
• Transfer destinations
• Applicable legal requirements

This information should be reviewed whenever business processes or technology change.

Managing Regulatory Change

Privacy legislation is not static.

Canada's Bill C-36 illustrates the issue well. UK data-protection law changed through the Data (Use and Access) Act 2025. India is implementing its DPDP framework through staged requirements.

Organizations therefore need a process for identifying changes and determining whether policies, notices, contracts, systems or training need to be updated.

Best Practices for Managing Global Data Privacy Compliance

1. Map Personal Data

Identify what information your organization holds, where it comes from and how it moves through systems and vendors.

Include customer, employee, applicant, supplier and website-user information where relevant.

2. Identify Applicable Jurisdictions

Do not determine applicability solely from headquarters location.

Consider customers, workers, processing operations, targeted markets and statutory extraterritorial rules.

3. Create a Common Privacy Baseline

Organizations can establish baseline controls around:

• Transparency
• Security
• Data minimization
• Retention
• Individual rights
• Vendor management
• Incident response
• Accountability

Local requirements can then be layered onto that framework.

4. Review Privacy Notices

Privacy notices should accurately describe current processing practices.

They should not simply reproduce legal terminology copied from another jurisdiction.

5. Assess Vendors

Vendor due diligence should occur before personal information is shared, not after an incident.

Contracts should address privacy, security, confidentiality, international transfers, subcontracting and breach responsibilities where applicable.

6. Conduct Regular Privacy Assessments

Organizations should periodically examine whether controls continue to reflect actual business activities.

A review may include:

• Data inventories
• Privacy notices
• Consent processes
• Retention practices
• Vendor contracts
• International transfers
• Security controls
• Incident-response processes

Our GDPR Compliance Checklist can provide a useful starting structure for organizations reviewing GDPR-related controls.

7. Train Employees

Privacy failures often originate in everyday operational decisions.

Training should help employees recognize:

• Personal information
• Sensitive data
• Unapproved data sharing
• Phishing and security risks
• Privacy requests
• Vendor risks
• Appropriate use of AI tools
• Internal escalation procedures

8. Assign Clear Accountability

Privacy responsibility should be clearly allocated.

Some laws require formal privacy roles in specified circumstances. Even where a statutory DPO is not mandatory, organizations still need appropriate resources and ownership for privacy compliance.

Professionals interested in developing this expertise can read How to Become a Data Protection Officer for an overview of the skills, qualifications and responsibilities associated with privacy leadership.

Data Privacy Developments to Watch in 2026

Privacy regulation continues to evolve across several major jurisdictions. Canadian organizations should monitor the progress of Bill C-36, while UK organizations should ensure their practices reflect the Data (Use and Access) Act changes now in force. Businesses connected with India should also continue monitoring the phased implementation of the DPDP framework.

Organizations should also watch how established privacy requirements interact with AI systems, automated decision-making and emerging technology governance.

Readers comparing professional learning options can review our Best Data Protection Training Courses guide.

Conclusion

Data privacy laws have become a core part of modern business operations.

GDPR remains a major international benchmark, but organizations working across borders must look beyond Europe. Canada's PIPEDA and provincial privacy laws, California's CCPA, Brazil's LGPD, the UK GDPR, Switzerland's FADP, India's DPDP framework and China's PIPL all illustrate how privacy regulation has developed in different directions.

The similarities between these frameworks can help organizations build a common compliance foundation. Their differences, however, make jurisdiction-specific analysis essential.

Canadian organizations should begin by understanding what personal information they process, where that information travels and which privacy laws may apply. From there, they can strengthen governance, review vendors, improve transparency, train employees and monitor regulatory change.

For compliance professionals, the ability to understand data-protection principles and translate them into practical organizational controls is becoming increasingly valuable.

The GDPR / Data Protection Officer (DPO) Certification provides structured, self-paced training for professionals seeking to strengthen their knowledge of GDPR, privacy governance and the responsibilities associated with the DPO role.

Explore the GDPR / Data Protection Officer (DPO) Certification and build the knowledge needed to support stronger data-protection practices.

Frequently Asked Questions About Data Privacy Laws

What are data privacy laws?

Data privacy laws regulate how organizations collect, use, store, disclose, retain and protect personal information. Depending on the jurisdiction, they may also give individuals rights to access, correct or delete their information and impose requirements concerning security, transparency, data breaches and international transfers.

For a deeper explanation of the underlying concepts, see our guide to Key Principles of Data Protection.

What are the major data privacy laws around the world?

Major privacy frameworks include the EU GDPR, UK GDPR, Canada's PIPEDA and provincial privacy laws, California's CCPA, Brazil's LGPD, Switzerland's FADP, India's DPDP framework and China's PIPL. Which laws apply to an organization depends on its location, activities, customers and processing practices.

How do data privacy laws differ by country?

Data privacy laws differ in their territorial scope, processing requirements, individual rights, breach-notification rules, cross-border transfer requirements and enforcement mechanisms. Organizations operating internationally should therefore assess the requirements of each relevant jurisdiction rather than assuming compliance with one law satisfies every other framework.

Can more than one data privacy law apply to the same business?

Yes. A Canadian organization serving customers in the EU, UK and California, for example, may need to consider Canadian privacy legislation alongside GDPR, UK GDPR and CCPA requirements. Applicability depends on the organization's activities and the territorial rules of each law.

Are there data privacy laws in the United States?

Yes, but the United States does not currently operate under a single comprehensive federal privacy law equivalent to GDPR. Privacy requirements come from a combination of federal sector-specific laws and state laws. California's CCPA is one prominent example of a comprehensive state consumer privacy law.

What is the difference between GDPR and other data privacy laws?

GDPR uses a comprehensive data-protection model that includes defined lawful bases for processing, extensive individual rights, accountability requirements and rules for international transfers. Other privacy laws may share some of these principles but use different applicability tests, consent models, consumer rights, enforcement mechanisms and transfer requirements.

If you need a refresher on the European framework itself, see What Is GDPR and Why It Matters.