Different rules in different places

Privacy laws govern how organisations handle personal information. Examples include:

  • EU and UK: The General Data Protection Regulation (GDPR) and UK GDPR require covered organisations to have a lawful reason to use personal data. They must explain how they use it, collect only what they need, keep it accurate and secure, and avoid keeping it longer than necessary. People can ask to see or correct their data, although their rights depend on the circumstances.
  • California: The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives residents rights against covered businesses, including access, correction, deletion, and opting out of certain sharing.
  • Brazil: The Lei Geral de Proteção de Dados (LGPD) gives people rights over their personal data, including access and correction.
  • Australia: The Privacy Act includes the Australian Privacy Principles for covered organisations and agencies.
  • Singapore: The Personal Data Protection Act (PDPA) sets rules for organisations and includes rights to request access to and correction of personal data.

Consent is one lawful reason to use personal data under GDPR, but others may apply, such as fulfilling a contract or a legal duty. A cookie banner alone does not fulfil GDPR duties. Organisations need to choose the right reason for each use and show that they follow the rules.

These laws differ in who is covered, what counts as personal information, which rights apply, and what an organisation must do. A website’s location alone does not settle which rules apply to it.

Teams should check current regulator guidance for the places and activities involved before making legal decisions.