Global Privacy Laws and Regulatory Frameworks
The Global Laws domain tests whether you can map a fact pattern onto the right statute, identify the regulator and the transfer mechanism, and spot when more than one regime applies. Expect scenario questions such as "which law applies to a Singapore company monitoring EU users," "what is the maximum fine," and "which mechanism permits this transfer."
Core frameworks
- GDPR (EU) 2016/679: extraterritorial under Article 3 - establishment-based processing, or targeting or monitoring EU data subjects. Six lawful bases (Article 6), special category conditions (Article 9), DPO rules, fines up to €20 million or 4% of global annual turnover, whichever is higher. The UK GDPR runs in parallel.
- CCPA/CPRA (California): applies to for-profit businesses doing business in California that meet a threshold - gross annual revenue over $25 million (as adjusted), buying, selling or sharing personal information of 100,000+ consumers or households, or deriving 50% or more of revenue from selling or sharing. CPRA created the California Privacy Protection Agency and added rights to correct and to limit use of sensitive personal information.
- Brazil LGPD (Lei 13.709/2018): ten legal bases, ANPD as regulator, international transfers via adequacy, clauses or BCRs.
- China PIPL (2021): consent, contract, legal duty and other bases; cross-border transfers require a CAC security assessment, certification, or a standard contract.
- Others to recognise: Japan APPI, South Korea PIPA, Singapore PDPA, India DPDP Act 2023, South Africa POPIA, Australia Privacy Act, Quebec Law 25, revised Swiss FADP.
Worked example
A Berlin-headquartered analytics firm has no EU users, but a US client sends it EU visitor data for processing. Article 3(1) applies because the processing occurs in the context of the activities of an establishment in the Union - the German entity. The US client may also be a controller subject to Article 3(2) if it monitors EU behaviour. Both need a lawful basis and an Article 28 contract; the transfer needs an Article 45 or 46 mechanism.
Traps that cost marks
- Assuming GDPR follows data everywhere; territorial scope turns on establishment, targeting and monitoring.
- Reading "sale" under CCPA as only money-for-data; it includes sharing for cross-context behavioural advertising.
- Believing consent is always the required basis; most regimes offer alternatives.
- Mixing up fine maxima, thresholds and regulator names across regimes.