Data Privacy Laws 2026: GDPR, CCPA and Beyond Explained

GDPR is the template. The EU’s GDPR applies to any organisation processing the data of EU residents, regardless of where the company sits. Its core ideas - consent, purpose limitation, data minimisation, the right to access and delete, and mandatory breach notification - have been copied into laws around the world.

CCPA/CPRA set the US baseline. California’s privacy law gives residents rights to know what data companies collect, delete it, and opt out of sale or sharing. It applies to any business meeting its thresholds, which captures many companies outside California. A growing number of US states have passed their own versions, creating a compliance patchwork where the strictest rules effectively set the standard.

The global wave. Dozens of countries now have GDPR-style laws, from Brazil (LGPD) to Japan, South Korea and Canada’s evolving framework. The pattern is consistent: transparency, individual rights and accountability. For companies operating internationally, the practical approach is to design one compliant baseline and apply it everywhere.

What businesses must actually do. The operational core: publish a clear privacy policy, keep an accurate record of what data you collect and why, honour access and deletion requests, obtain proper consent where required, and report breaches promptly. For small companies the burden is mostly organisational; for large ones it is systemic.

Privacy is now a product feature. Beyond compliance, privacy has become a selling point and a design constraint. Data minimisation - collecting less rather than more - is both a legal strategy and a cost strategy, since every byte you store is a byte you must protect. Companies that treat privacy as a feature rather than a tax are finding it pays back in trust.

The outlook: privacy law keeps expanding, and the trend is toward more rights, not fewer. The smart approach is to build privacy into products from the start - document data flows, minimise collection, honour rights automatically - rather than retrofitting compliance later, when the cost is always higher.

US state laws share a pattern but not a text.

Build to the common core, then check the deltas. The expanding set of US state privacy laws converges on a recognisable skeleton: notice about data practices, consumer rights to access, delete and correct, opt-outs for targeted advertising and certain data sales, and data protection assessments for higher-risk processing. The divergences are in the details - thresholds that decide who is covered, cure periods, specifics of sensitive-data consent. The efficient compliance strategy for a multi-state business: implement the common core once, then track the deltas per state in a maintained matrix, rather than building twenty bespoke programmes.

Sensitive data is the expanding perimeter. The category - health, biometrics, precise location, children's data, and in some states citizenship and religious belief - carries stricter consent requirements (opt-in rather than opt-out) across the new laws. Product teams should treat sensitive-data flows as a design-time flag: any feature that collects precise location, health signals or biometric identifiers triggers the stricter regime and the documentation that goes with it. Discovering the classification after launch converts a settings change into a redesign.

Privacy notices need maintenance, not just existence.

The notice that lies is worse than no notice. Regulators increasingly test the gap between what the privacy policy says and what the product does - and enforcement actions for notice violations are now a standard category. The maintenance habit that prevents it: a living data inventory (what is collected, why, where it flows, who receives it) that the notice is generated from, reviewed whenever the product changes what it collects. A notice written once and forgotten drifts out of truth within a year of normal product development; the inventory keeps it anchored.

Vendor contracts are half of compliance. When personal data flows to a processor - analytics, hosting, support tools - the law expects a data processing agreement with defined purposes, security expectations and deletion duties. The practical workflow: a standard DPA template for vendor onboarding, a review of what data each tool actually receives (tools often receive more than their marketing admits), and an annual sweep of tools that are still connected but no longer used. The annual sweep routinely turns up third parties still receiving data for products the company no longer operates - each one a standing liability nobody noticed.