Data Privacy and Data Protection Laws for IT Companies
Laws and standards that govern how personal data is collected, used, shared, stored and deleted. 15 entries, 5 with a full guide.
Privacy laws regulate personal data, meaning any information that identifies a person. Unlike most security standards, they are mandatory: if you are in scope, you must comply and a regulator can fine you.
Scope usually depends on whose data you process, not where your company is. A software company in India with EU users can fall under the GDPR, and from 13 May 2027 an EU company serving Indian users falls under India's DPDP Act. In the US there is no single federal privacy law; California's CCPA as amended by the CPRA is the most detailed of the state laws.
IT service providers are usually processors (GDPR) or act on behalf of a data fiduciary (DPDP), so the contract with each client sets many of your duties. ISO/IEC 27701 is a voluntary, certifiable privacy management system that helps show you have the controls these laws expect.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)
LawMandatory by lawIndia, extraterritorial
India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. Data fiduciaries must give clear notice, obtain free, specific and informed consent (or rely on a listed legitimate use), protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, honour rights to access, correction, erasure and grievance redress, and delete data when no longer needed. The DPDP Rules 2025 phase most duties in from 13 May 2027. Penalties reach INR 250 crore.
Covers, who needs it and key requirements
What it covers
Digital personal data (and non-digital data later digitised): notice and consent, legitimate uses, consent managers, data fiduciary duties, processors, security safeguards, breach notification, children's and disabled persons' data, data principal rights, Significant Data Fiduciaries, cross-border transfers and the Data Protection Board.
Who needs it
Every Indian IT company, SaaS provider, app and IT service provider that processes personal data, and foreign companies offering goods or services to people in India. IT service providers acting for clients are data processors bound by contract.
Why it matters
It replaces the limited SPDI Rules with a full privacy regime, has penalties up to INR 250 crore per breach, and Indian and foreign clients will expect DPDP-ready processors.
Applies in
India; applies extraterritorially to processing connected with offering goods or services to data principals in India
General Data Protection Regulation, Regulation (EU) 2016/679
LawMandatory by lawEU / EEA, extraterritorial
The GDPR is the EU's data protection law. It applies to any organisation that processes personal data in the context of an EU establishment, and to non-EU companies that offer goods or services to people in the EU or monitor their behaviour. It requires a lawful basis for processing, transparency, data minimisation, security, records of processing, data subject rights and breach notification within 72 hours. Fines reach EUR 20 million or 4% of global turnover.
Covers, who needs it and key requirements
What it covers
Personal data of people in the EU: principles, lawful bases, consent, transparency, data subject rights, controller and processor duties, data protection by design, DPIAs, DPOs, security, breach notification, international transfers and enforcement.
Who needs it
EU companies and any IT, SaaS or outsourcing company worldwide with EU users, customers or clients, including processors acting for EU clients.
Why it matters
It is the global benchmark for privacy law, carries some of the highest fines, and EU clients will not sign without a GDPR-compliant data processing agreement.
Applies in
European Union and EEA; applies extraterritorially to non-EU companies targeting or monitoring people in the EU
ISO/IEC 27701:2025 Information security, cybersecurity and privacy protection: Privacy information management systems (PIMS) requirements and guidance
Certifiable standardVoluntaryGlobal
ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) that governs how an organisation processes personally identifiable information (PII), as a controller, a processor or both. The 2025 edition is a standalone standard that no longer has to sit on top of ISO 27001, with controls for PII controllers and processors that map well to the GDPR and similar laws. It is voluntary and certifiable.
Covers, who needs it and key requirements
What it covers
Privacy governance, roles of PII controller and processor, privacy risk assessment, lawful basis and consent records, data subject rights, privacy by design, transfers, sub-processors, breach handling and records of processing.
Who needs it
SaaS and cloud providers, IT service providers and BPOs that process client personal data, and any company that wants independent proof of privacy controls for GDPR, DPDP or customer audits.
Why it matters
Enterprise clients and regulators look for evidence of privacy accountability. A certified PIMS answers privacy due diligence questions and supports processor obligations in data processing agreements.
Health Insurance Portability and Accountability Act of 1996 (Privacy, Security, Breach Notification and Enforcement Rules)
LawMandatory if in scopeUnited States
HIPAA is the US federal law that protects health information. Its Privacy Rule limits how protected health information (PHI) is used and disclosed, its Security Rule requires administrative, physical and technical safeguards for electronic PHI, and its Breach Notification Rule sets deadlines for telling patients and HHS. It applies to covered entities and to business associates such as software vendors, cloud hosts and IT support firms that handle PHI on their behalf.
Covers, who needs it and key requirements
What it covers
Protected health information held or transmitted by covered entities and business associates: permitted uses and disclosures, patient rights, security risk analysis, safeguards for ePHI, business associate agreements and breach notification.
Who needs it
Health tech and EHR vendors, telehealth apps, medical billing and transcription providers, cloud and managed service providers, and offshore IT teams that create, receive, maintain or transmit PHI for US healthcare clients.
Why it matters
US healthcare clients cannot share PHI without a signed business associate agreement, and OCR fines and corrective action plans apply directly to business associates.
California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020
LawMandatory if in scopeCalifornia, US
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information, and to limit use of sensitive personal information. It applies to for-profit businesses that meet revenue or data-volume thresholds, wherever they are based. Service providers and contractors must sign specific contract terms. New 2026 regulations add risk assessments, cybersecurity audits and automated decision-making rules.
Covers, who needs it and key requirements
What it covers
Personal information of California residents, including employees and B2B contacts: notices at collection, privacy policy, consumer rights, opt-out of sale or sharing, sensitive data limits, service provider contracts, data security, risk assessments, cybersecurity audits and ADMT.
Who needs it
For-profit businesses that do business in California and meet a threshold, and the SaaS, IT and data vendors that act as their service providers or contractors.
Why it matters
It is the most detailed US privacy law, it is actively enforced by a dedicated agency, and US clients pass its service provider terms down to their vendors.
Applies in
California, USA; applies to businesses anywhere that meet the thresholds
Notice at collection and a privacy policy updated every 12 months
Honour requests to know, delete, correct and opt out within 45 days
Do Not Sell or Share link and recognition of opt-out preference signals (Global Privacy Control)
Limit use of sensitive personal information where required
Service provider and contractor contracts with the terms in section 1798.100(d)
Reasonable security; risk assessments and cybersecurity audits where the 2026 rules apply
ISO 27018
ISO/IEC 27018:2025 Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
Certifiable standardVoluntaryGlobal
ISO/IEC 27018 sets privacy controls for public cloud providers that process personal data on behalf of customers. It covers processing only on customer instructions, transparency about sub-processors and data locations, support for data subject requests, return and deletion of data, breach notification and restrictions on using customer data for marketing. A new edition was published in 2025. It is usually certified alongside ISO 27001 and helps cloud vendors meet GDPR processor duties.
Covers, who needs it and key requirements
What it covers
Public cloud PII processing: customer instructions, consent and purpose limits, transparency, sub-processor disclosure, data location, return and deletion, breach notification and audit rights.
Who needs it
Public cloud, SaaS and hosting providers that process customer personal data.
Why it matters
It is a recognised way for cloud processors to show privacy controls to customers and regulators.
Process PII only on documented customer instructions
Disclose sub-processors and processing locations
Support customers with data subject requests
Notify customers of breaches involving their PII
Return or delete PII at the end of the contract
UK GDPR
UK General Data Protection Regulation and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
LawMandatory by lawUnited Kingdom
The UK GDPR and the Data Protection Act 2018 form the UK's data protection law after Brexit. They closely follow the EU GDPR but are enforced by the Information Commissioner's Office. The Data (Use and Access) Act 2025 amends them in stages, for example on recognised legitimate interests, automated decision-making, cookies and complaints. Companies outside the UK that offer services to people in the UK or monitor them must comply, and fines reach GBP 17.5 million or 4% of turnover.
Covers, who needs it and key requirements
What it covers
Personal data of people in the UK: principles, lawful bases, rights, controller and processor duties, international transfers (UK IDTA and addendum), breach reporting and PECR rules on cookies and marketing.
Who needs it
UK companies and non-UK companies with UK users or clients, including processors serving UK clients.
Why it matters
UK clients require UK GDPR terms and transfer safeguards, and the ICO enforces it independently of the EU.
Applies in
United Kingdom; extraterritorial for organisations targeting or monitoring people in the UK
Breach reporting to the ICO within 72 hours where required
UK transfer mechanisms (IDTA or Addendum) for restricted transfers
A UK representative if you have no UK establishment but are in scope
SPDI Rules 2011
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
RegulationMandatory by lawIndia
The SPDI Rules 2011 under Section 43A of the IT Act are India's current data protection rules for sensitive personal data such as passwords, financial and health information and biometrics. They require a privacy policy, consent for collection, purpose limits, consent for disclosure and transfers, and reasonable security practices, with ISO/IEC 27001 named as one recognised standard. They will be replaced when the DPDP Act's main provisions start on 13 May 2027.
Covers, who needs it and key requirements
What it covers
Sensitive personal data or information: privacy policy, consent, collection limits, disclosure, transfers, grievance officer and reasonable security practices.
Who needs it
Body corporates in India that collect or handle sensitive personal data, including IT and BPO companies.
Why it matters
They are the data protection rules that apply today, until the DPDP Act takes over.
Applies in
India (until the DPDP Act's main provisions start on 13 May 2027)
Obtain written consent for collecting sensitive data
Use data only for the stated purpose and allow withdrawal
Implement reasonable security practices (for example ISO 27001)
Appoint a grievance officer
LGPD
Lei Geral de Proteção de Dados Pessoais (Brazil's General Data Protection Law), Law No. 13,709/2018
LawMandatory by lawBrazil
The LGPD is Brazil's comprehensive data protection law, in force since September 2020 with sanctions enforceable since August 2021 by the national authority ANPD. Modelled on the GDPR, it requires a legal basis for processing, transparency, data subject rights, security, a data protection officer (encarregado) and incident reporting. It applies to processing in Brazil and to companies abroad offering goods or services to people in Brazil. Fines reach 2% of Brazilian revenue, capped at BRL 50 million per infraction.
Covers, who needs it and key requirements
What it covers
Personal data processing in Brazil or of people in Brazil: legal bases, rights, controllers and processors, DPO, security, incident reporting and international transfers.
Who needs it
Companies with users or clients in Brazil, including foreign SaaS and IT providers.
Why it matters
Brazil is a large digital market and ANPD actively enforces the law.
Applies in
Brazil; extraterritorial for processing of data collected in Brazil or offering goods or services there
Report security incidents to ANPD and data subjects
Safeguards for international transfers
PIPL
Personal Information Protection Law of the People's Republic of China
LawMandatory by lawChina
China's Personal Information Protection Law, in force since 1 November 2021, regulates personal information processing in China and processing abroad that targets people in China. It requires a legal basis (often separate consent), notices, impact assessments for sensitive data and transfers, local representatives for foreign processors, and strict cross-border transfer mechanisms such as CAC security assessments, standard contracts or certification. Fines reach CNY 50 million or 5% of the previous year's turnover.
Covers, who needs it and key requirements
What it covers
Personal information processing, sensitive information, cross-border transfers, individual rights, processor duties, and obligations for large platforms.
Who needs it
Companies processing personal information of people in China, including foreign SaaS and IT providers serving Chinese users.
Why it matters
Cross-border transfer rules can block data flows without the right mechanism.
Applies in
China; extraterritorial for processing of personal information of people in China
Personal information protection impact assessments
Cross-border transfer mechanism (CAC assessment, standard contract or certification)
Local representative for foreign processors
Honour individual rights
PIPEDA
Personal Information Protection and Electronic Documents Act (Canada)
LawMandatory by lawCanada
PIPEDA is Canada's federal private-sector privacy law. It applies to organisations that collect, use or disclose personal information in commercial activities, built around ten fair information principles including accountability, consent, limiting use and safeguards. Breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals. Quebec's Law 25, Alberta and British Columbia have their own laws for local private-sector activity.
Covers, who needs it and key requirements
What it covers
Ten fair information principles, consent, access and correction, safeguards, breach reporting and record keeping.
Who needs it
Organisations handling personal information of Canadians in commercial activity, including foreign SaaS and IT providers.
Why it matters
Canadian clients expect PIPEDA-compliant processing and breach reporting.
Applies in
Canada (private sector, federal; provinces such as Quebec have their own laws)
Report breaches with real risk of significant harm
Keep breach records for 24 months
Singapore PDPA
Personal Data Protection Act 2012 (Singapore)
LawMandatory by lawSingapore
Singapore's Personal Data Protection Act governs collection, use and disclosure of personal data by organisations, enforced by the Personal Data Protection Commission. Amendments in force since 2021 added mandatory breach notification (to the PDPC within three calendar days of assessing a notifiable breach), new consent exceptions and higher fines of up to 10% of Singapore turnover for organisations with turnover above SGD 10 million, or SGD 1 million otherwise.
Covers, who needs it and key requirements
What it covers
Consent, purpose limitation, notification, access and correction, accuracy, protection, retention, transfer limitation, breach notification, data portability and the Do Not Call registry.
Who needs it
Organisations collecting or processing personal data in Singapore, including foreign IT and SaaS vendors serving Singapore clients.
Why it matters
Singapore is a regional hub and PDPC publishes enforcement decisions regularly.
Privacy Act 1988 (Cth), including the Australian Privacy Principles and the Notifiable Data Breaches scheme
LawMandatory if in scopeAustralia
Australia's Privacy Act 1988 and its 13 Australian Privacy Principles govern how government agencies and organisations with annual turnover above AUD 3 million (and some smaller ones) handle personal information. The Notifiable Data Breaches scheme requires notifying the OAIC and affected individuals of eligible breaches. 2022 and 2024 amendments raised maximum penalties to the greater of AUD 50 million, three times the benefit obtained or 30% of adjusted turnover, and added a statutory privacy tort.
Covers, who needs it and key requirements
What it covers
Australian Privacy Principles, cross-border disclosure, notifiable data breaches, OAIC enforcement powers and the statutory tort for serious invasions of privacy.
Who needs it
Organisations with an Australian link that meet the turnover test or are otherwise covered, including foreign IT and SaaS providers.
Why it matters
Penalties are among the highest worldwide and Australian clients expect APP compliance from vendors.
Applies in
Australia; applies to organisations with an Australian link
Collection, use and disclosure according to the APPs
Reasonable steps to secure personal information
Assess and notify eligible data breaches
Accountability for overseas disclosures
GLBA Safeguards Rule
Gramm-Leach-Bliley Act and the FTC Standards for Safeguarding Customer Information (Safeguards Rule, 16 CFR Part 314)
LawMandatory if in scopeUnited States
The Gramm-Leach-Bliley Act requires US financial institutions to protect customers' nonpublic personal information. For non-bank financial institutions such as lenders, fintechs, tax preparers and many others, the FTC's amended Safeguards Rule requires a written information security programme with a qualified individual, risk assessment, encryption, MFA, service provider oversight and, since May 2024, notification to the FTC of security events affecting 500 or more consumers within 30 days.
Covers, who needs it and key requirements
What it covers
Privacy notices and the Safeguards Rule: written information security programme, risk assessment, access controls, encryption, MFA, monitoring, training, vendor oversight, incident response and FTC notification.
Who needs it
US financial institutions in the broad GLBA sense, including fintechs and non-bank lenders, and their IT and SaaS service providers.
Why it matters
The FTC enforces the Safeguards Rule against non-bank financial companies, and requires them to oversee their service providers.
Designate a qualified individual and write an information security programme
Risk assessment and safeguards including encryption and MFA
Oversee service providers by contract and monitoring
Incident response plan
Notify the FTC within 30 days of events affecting 500+ consumers
COPPA
Children's Online Privacy Protection Act and the FTC COPPA Rule (16 CFR Part 312)
LawMandatory if in scopeUnited States
COPPA requires operators of websites, apps and online services directed to children under 13, or that knowingly collect children's personal information, to give notice and obtain verifiable parental consent before collecting it. The FTC's amended COPPA Rule, published in April 2025 with compliance required by 22 April 2026, adds separate consent for third-party disclosure such as targeted advertising, a written information security programme and data retention limits.
Covers, who needs it and key requirements
What it covers
Notice, verifiable parental consent, parental rights, data minimisation, retention, security and third-party disclosures for children's personal information.
Who needs it
Apps, games, edtech and websites directed to US children, and the developers and SaaS providers building them.
Why it matters
The FTC imposes large penalties and requires deletion of unlawfully collected data and models.
Applies in
United States (federal); applies to foreign services directed to US children
