Operating across borders (or simply serving customers abroad) now almost always means handling personal data in more than one legal regime. The challenge is that international data protection laws are not harmonised, even when they use similar language like “personal data”, “controller”, or “breach”. A marketing email, HR database, or customer support ticket can trigger different obligations depending on where the individual is located, where your business is established, and where processing actually occurs.

This guide offers a practical, country-by-country view of major data protection frameworks and the compliance themes that tend to matter most in cross-border operations. It is general information, not legal advice.

How to use this country-by-country view

Two points make international privacy compliance easier to manage:

First, most modern privacy laws share a common “spine”, even if the details vary. That means you can build a global baseline programme, then add local requirements where needed.

Second, enforcement is increasingly coordinated. Regulators commonly share intelligence, and global businesses often face overlapping obligations (for example, GDPR plus a US state privacy law plus an Asia-Pacific breach notification rule).

If you want to get value from this guide quickly, focus on:

• Where the law applies (territorial and extraterritorial reach)

• The legal basis for processing (especially consent and legitimate interests style grounds)

• Cross-border transfer rules

• Breach notification triggers and timelines

• Individuals’ rights (access, deletion, portability, etc.)

The common building blocks found in many privacy laws

Even with different terminology, most regimes address the same risk areas.

Europe

European Union and EEA: GDPR (EU)

The EU General Data Protection Regulation (GDPR) remains the most influential modern privacy framework and is often the benchmark used in global contracting.

Key traits:

• Broad definition of personal data and stringent rules for “special category” data

• Strong rights (access, erasure, portability, objection)

• Detailed accountability obligations (records of processing, DPIAs for high-risk processing)

• Well-developed cross-border transfer regime (adequacy, Standard Contractual Clauses, and transfer risk assessments)

Official text and resources: EU GDPR.

United Kingdom: UK GDPR and Data Protection Act 2018

Post-Brexit, the UK retained a GDPR-based regime (the “UK GDPR”), supplemented by the Data Protection Act 2018. For most organisations, the practical approach is GDPR-aligned compliance, plus attention to UK-specific guidance.

A dependable reference point is the UK regulator: ICO guidance.

Switzerland: FADP (revised)

Switzerland modernised its privacy regime via the revised Federal Act on Data Protection (FADP). It is not the GDPR, but it is GDPR-adjacent in many operational areas (governance, transparency, processor controls). If you have EU ties, it is often efficient to treat Switzerland as part of your “European compliance set”, then verify Swiss-specific documentation requirements.

North America

United States: sectoral federal rules plus state privacy laws

The US does not have a single comprehensive federal privacy law equivalent to the GDPR. Instead:

• Sector-specific federal rules exist (health, children, financial services, etc.)

• States regulate privacy and breaches through a patchwork of statutes

For many businesses, the centre of gravity is:

• State consumer privacy laws (notably California’s framework)

• State breach notification laws (all states have breach notification statutes)

California’s consumer privacy regime is often used as a baseline because it is mature and frequently amended through regulation. A practical starting point is the California Privacy Protection Agency.

Operational implications for cross-border businesses:

• “Sale” and “sharing” concepts can be broader than expected (especially in ad tech contexts)

• Opt-out mechanisms can be as important as consent

• Contracting with service providers and data processors is central

Canada: PIPEDA (plus provincial laws)

Canada’s federal private-sector regime is primarily the Personal Information Protection and Electronic Documents Act (PIPEDA), with provincial laws also relevant in some contexts.

A key point for many organisations is breach reporting: PIPEDA includes obligations to report certain breaches to the regulator and notify individuals where there is a real risk of significant harm.

Reference: Office of the Privacy Commissioner of Canada.

Latin America

Brazil: LGPD

Brazil’s Lei Geral de Proteção de Dados (LGPD) is a comprehensive privacy law influenced by GDPR concepts while remaining distinctly Brazilian in implementation.

Common compliance focal points:

• Appointing a data protection officer-like role (where applicable)

• Vendor governance and controller-processor contracting

• Lawful bases for processing (including consent and legitimate interest style grounds)

• Cross-border transfer mechanisms

Regulatory reference: ANPD (Brazilian data protection authority).

Africa

South Africa: POPIA

South Africa’s Protection of Personal Information Act (POPIA) is a major compliance driver for organisations operating in or targeting South African residents.

Practical themes:

• Conditions for lawful processing, including purpose and minimisation principles

• Accountability obligations and governance expectations

• Security safeguards and breach-related responsibilities

Regulatory reference: Information Regulator (South Africa).

Asia-Pacific

China: PIPL (plus related cybersecurity and data rules)

China’s Personal Information Protection Law (PIPL) sits within a broader data regulatory environment that can include localisation expectations, security assessments, and strict rules for sensitive personal information.

For many multinationals, the highest-risk issues are:

• Cross-border transfer compliance pathways (which may involve assessments, certifications, or standard contracts depending on the scenario)

• Local storage and data export governance for certain data categories

• Enhanced obligations for “important” or high-volume processing (depending on applicable rules and thresholds)

Because requirements can be detailed and sector-sensitive, organisations often treat China as a jurisdiction requiring dedicated analysis rather than a simple add-on to a global GDPR programme.

India: Digital Personal Data Protection Act (DPDP)

India’s Digital Personal Data Protection Act, 2023 introduced a national framework for personal data protection. Implementation details can depend on rules and guidance as they evolve, so organisations should track regulatory updates and avoid assuming “GDPR identical” obligations.

A common cross-border planning point is understanding how India approaches transfers and the role of consent in common processing scenarios.

Japan: APPI

Japan’s Act on the Protection of Personal Information (APPI) is a mature regime with strong rules around international transfers and sharing with third parties.

Cross-border compliance often focuses on:

• Disclosures and transparency for overseas recipients

• Contractual and organisational safeguards when transferring data

• Governance and breach response expectations

Singapore: PDPA

Singapore’s Personal Data Protection Act (PDPA) is widely encountered in regional operations and outsourcing structures.

Key operational issues commonly include:

• Consent and exceptions

• Data breach notification requirements (where applicable)

• Contracting and accountability for service providers

Regulatory reference: Personal Data Protection Commission (Singapore).

Australia: Privacy Act and Notifiable Data Breaches (NDB) scheme

Australia’s privacy regime is often discussed alongside breach response because the Notifiable Data Breaches scheme creates clear notification expectations when certain thresholds are met.

Regulatory reference: Office of the Australian Information Commissioner.

New Zealand: Privacy Act 2020

New Zealand’s Privacy Act 2020 includes mandatory breach notification obligations in defined circumstances and is a frequent consideration for businesses providing services into New Zealand or using New Zealand-based vendors.

Regulatory reference: Office of the Privacy Commissioner (NZ).

Caribbean perspective: what Jamaica-based organisations should watch

For Jamaica-based companies, two realities tend to shape strategy:

First, you may need to comply with more than one law at the same time. If you serve EU or UK customers, GDPR or UK GDPR obligations can apply regardless of where your headquarters are located.

Second, cross-border contracting often drives compliance in practice. Even when a foreign law does not technically apply, your clients, banks, insurers, and platform providers may require GDPR-style terms, audit rights, security assurances, and breach notification commitments.

A sensible approach is to build a baseline privacy governance programme (policies, notices, vendor controls, breach playbooks, training) and then layer in jurisdiction-specific requirements depending on where your customers, employees, and processing operations sit.

Quick comparison table (high-level)

This table is intentionally simplified. Many details depend on your role (controller vs processor), data type (health, children, biometrics), and industry.

A practical way to manage multi-country compliance

A “country-by-country” view is useful, but organisations still need an operating model. In most cases, a workable method is:

Build a global baseline

A baseline programme typically includes:

• A clear privacy notice set (customer, employee, vendor)

• A lawful basis assessment framework (when consent is required, when it is not)

• Vendor due diligence and data processing agreements

• A data map (what you collect, where it goes, how long you keep it)

• A breach response plan with decision-making authority and communications templates

Add jurisdiction-specific modules

Common modules include:

• EU/UK transfer compliance (SCCs and transfer risk assessments where required)

• US state opt-out and “do not sell/share” style mechanisms where applicable

• China-specific transfer and localisation assessments

• Sector-specific rules (financial services, health, children)

Keep evidence, not just policies

Regulators and counterparties increasingly ask for proof of compliance, for example:

• Training logs

• Incident response tabletop exercises

• Vendor audit outcomes

• DPIAs or similar risk assessments

Frequently Asked Questions

Which country’s data protection law applies to my business? It can be more than one. Applicability depends on where you are established, where individuals are located, and whether your activities target or monitor people in that jurisdiction.

Is GDPR compliance enough for international data protection laws? GDPR is a strong baseline, but it is not universally sufficient. US state privacy rules, China’s cross-border transfer requirements, and sector laws can impose additional or different obligations.

Do all countries require breach notification within 72 hours? No. The 72-hour concept is strongly associated with the GDPR, but other jurisdictions use different triggers and timelines, and some require notification to individuals in different circumstances.

Are cross-border transfers always allowed if I use a contract? Not always. Some regimes rely heavily on contracts, but others (notably in certain scenarios in China and parts of Europe) may require additional steps, assessments, or approved mechanisms.

What is the biggest mistake companies make in cross-border privacy compliance? Treating privacy as a one-time policy exercise. In practice, ongoing governance, vendor oversight, and tested incident response matter as much as the wording of a notice.

Need help aligning your operations with international data protection laws?

If your organisation operates in Jamaica while serving customers, partners, or employees abroad, a country-by-country approach can quickly become complex. Henlin Gibson Henlin can help you assess which privacy laws apply, prioritise your highest-risk gaps, and put defensible governance and contracting in place.

Learn more about the firm at Henlin Gibson Henlin.