Global privacy landscapeالمشهد العالمي للخصوصية

Privacy laws differ between countries in their detail and agree in their skeleton. Most ask the same questions: what is the lawful basis, what rights does the person have, and what happens when the data leaves the country.

The privacy map looks complicated when read country by country and much simpler when read as data flows.

Does this mean memorising every country's law?

If the answer were yes, building any global product would be impossible. More than a hundred and forty countries have privacy laws and all of them change.

The answer is no. You do not need to know what the laws say. You need to know when one of them has started to apply to you.

That is a large difference in daily work. The useful question is not "what does Brazil's law say?" but "have we just done something that made Brazil's law apply to us?". The first is legal research you buy when needed. The second is an alertness that has to live inside your team.

There is a reason this is workable: most of these laws are alike underneath. The European idea was copied with modifications, so you find the same rights and the same principles in the majority of them. The differences sit in details: how long you have to answer a customer request, the conditions for moving data out of the country, and when a data protection officer must be appointed.

So if you built your product on the six principles seriously, you are roughly aligned with most of the world, and what remains is tuning details when you enter a specific market.

Three signals change your scope

The first signal is where customers live or are located while using the service. A country may extend its law to a foreign company offering services to people inside it. The company, servers, and contract can all be elsewhere. Ask where the user is before stopping at where the company was incorporated.

The second signal is where data is stored and who can access it. Moving a customer record to an overseas data centre can turn local processing into an international transfer. Financial or cloud rules may require a local copy, approval for transfer, specified contracts, or an assessment of the destination country's law.

The third signal is where the company advertises and targets. An English page available worldwide does not always amount to an offer in every country. Buying ads aimed at India, pricing in rupees, and providing local support show a deliberate entry into that market. Targeting can trigger a law that a passing visitor would not.

No signal settles the result in every country. Each one is an alarm opening a short review of scope, sector rules, and transfers. When a customer lives in a new country, data moves to a new country, or a campaign enters a new market, escalate before launch.

Brazil builds on familiar principles

Brazil's General Data Protection Law, or LGPD, has applied since 2020. It covers processing in Brazil, activity intended to offer goods or services to people there, and data collected there. A foreign business can enter scope through its customers or activity rather than through an office.

The law uses familiar ideas including purpose, necessity, transparency, security, and accountability. It gives people rights of access, correction, and deletion in defined cases and requires a legal basis for processing. It is not a word-for-word copy of Europe. Its ten bases and enforcement details are local.

Brazil's National Data Protection Authority provides guidance and enforcement. A fine can reach 2 per cent of the entity's revenue in Brazil for an infringement, capped at BRL 50 million. The ceiling applies per infringement, and other measures include publicising the violation or blocking affected data.

A beginner does not need to memorise ten bases. Notice the signal: a campaign aimed at São Paulo, a customer living there, or data collected there. Then ask a specialist about basis, notice, rights, and transfers and convert the answer into product requirements.

India connects scope to offering the service

India's Digital Personal Data Protection Act 2023 governs digital personal data. It covers processing in India and extends to processing abroad when connected to offering goods or services to people in India. A Gulf FinTech can therefore enter scope through accounts and campaigns directed at the Indian market.

The government can designate a Significant Data Fiduciary according to processing scale and risk. A designated organisation receives extra duties such as a data protection officer, impact assessment, and audit. The law also imposes stronger rules for children's data and initially treats anyone under eighteen as a child, subject to defined exemptions.

Do not make a final implementation decision from a summary published when the Act passed. Rules and government notifications determine commencement dates, details, and exemptions. Check the version in force at market entry, then record requirements that alter registration, consent, or suppliers.

China makes transfer a separate decision

China's Personal Information Protection Law, or PIPL, has applied since 2021. It reaches some processing outside China involving services to people inside the country or analysis of their behaviour. Other cases can be set by law. A foreign organisation in scope may need a designated representative or establishment in China.

Overseas transfers require a legal route and safeguards. Depending on the controller and volume, this may be a security assessment, protection certification, or standard contract. The controller also conducts a protection impact assessment and informs the person about the recipient, purpose, and method.

China requires localisation for critical information infrastructure operators and organisations passing defined data thresholds. Covered data is stored in China and additional requirements apply before it leaves. This does not mean every Chinese record is forbidden from leaving, and it does not mean an ordinary contract is enough for every transfer.

Localisation is not one rule

Data localisation means keeping defined data inside a country's borders, but it takes different forms. A law may prohibit exporting one category. It may allow transfer while requiring a local copy. It may cover banks and payment systems while allowing an ordinary retail app to use foreign cloud infrastructure.

The restriction can come from a sector regulator rather than the general privacy law. A central bank may require payment records or primary copies to remain in the country, while a health authority creates another rule for medical files. A cloud provider's claim of global compliance does not answer those sector questions.

Choosing a local data centre does not solve everything. A support team abroad might be able to open the record, making access a cross-border transfer or disclosure. Monitoring software may copy logs to a global platform. An analytics team may send identifiers to a central warehouse. Follow access and copying, not only the server's postal address.

Engineers should map the path from phone to interface, database, logs, backups, suppliers, and support. Write the country at every stop and identify who can access it. This map exposes hidden transfers faster than reading a one-hundred-page cloud contract.

Other countries, recurring patterns

Singapore applies its Personal Data Protection Act with rules for consent, purpose, notice, transfers, and incidents. South Africa applies the Protection of Personal Information Act, or POPIA, with processing conditions, individual rights, and transfer restrictions. Canada, Australia, Japan, South Korea, and many others have their own frameworks.

The right beginner instinct

Do not memorise every country's law before it is relevant. That consumes time and creates false confidence because legislation, regulations, and commencement dates change. Build a sound privacy baseline, a register of customers, countries, and vendors, and a gate that reviews every new market or transfer.

Growth should identify target countries, currencies, and languages before a campaign. Engineering should record hosting, access, and support locations. Procurement should report every subprocessor and processing country. The three signals then reach one accountable owner who can request legal review.

Escalation should be specific. State that the product will advertise in Brazil and collect identity, address, and transaction data. Add that storage is in the United States and a supplier is in Ireland. Ask about scope, basis, notice, transfer, localisation, local representation, and timing.

Do not wait for the first customer if the campaign itself brings the company into scope. Do not stop an entire expansion because someone recognised a law's name, since exemptions and thresholds may exclude the activity. The right instinct is to detect the trigger early and obtain an answer connected to a real flow.

A runbook for a changing map

When adding a country, identify where the customer lives and will be when the service is offered. Map where data is collected, stored, copied, and accessed. Check whether the product is regulated finance or handles identity, health, biometrics, or children's data.

Then identify the applicable law, authority, transfer mechanism, and any localisation, registration, or representation requirement. Turn the answer into an owner, date, and product test. Keep the scope decision so the team does not repeat the same research after every update.