Securiti Named a 2022 Cool Vendor in Data Security by Gartner
Download NowDiscover the predominant legal compliance requirements that businesses must adhere to avoid legal challenges and adapt to a modernized approach towards data privacy regulations. Whether you’re a local or a multinational organization, ensuring compliance with local and international privacy laws should be your top priority and a critical element of your organization’s policies.
To comply with local and international data protection laws, our experts have compiled a compliance checklist that addresses the critical components of each regulation around the world.
California Consumer Privacy Act (CCPA) | |
---|---|
Notice at Point of Collection |
Businesses are required to inform consumers of the categories of PI being collected and the purpose of processing at or before the time of collection. |
Consent |
It mandates opt-out consent for the selling of collected PI of consumers and opt-in consent for selling PI of minors (consumers below 16 years of age). |
Data Subject Requests |
It gives limited rights to consumers such as right to access, deletion, data portability, and right to opt-out of selling of PI. |
Storage |
NA |
Lawful Basis for Processing Data |
It doesn't define any lawful basis for the collection and processing of PI. |
Cross Border Data |
It doesn't restrict any cross-border data transfer requirements but requires businesses to enter into written agreements with service providers which restrict retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract including selling the PI. |
Data Security |
It doesn't specifically discuss any security measures but it does specify penalties in the event of a breach due to failure of the business to implement reasonable and appropriate security measures as per Section 1798.81.5 of the California Civil Code. |
Breach Response |
It doesn't specify any data breach notification. However, as per Section 1798.82 of the California Civil Code, a Californian resident must be notified immediately as soon as the breach of PI is discovered by the business. |
California Privacy Rights Act (CPRA) | |
---|---|
Notice at Point of Collection |
Businesses are required to inform consumers about the categories of PI and sensitive PI being collected and the purpose of processing, whether the PI and sensitive PI will be sold or shared and the length of time it shall be stored/retained, or the criteria used to determine such a period. |
Consent |
It mandates opt-out consent for the selling and sharing of collected PI of consumers, as well as for automated decision making, and allows consumers to limit the use or disclosure of their sensitive PI. Opt-in consent is required for selling PI of minors (consumers below 16 years of age). It also requires that consent needs to be specific and clear, and it should be taken freely without using any dark patterns. |
Data Subject Requests |
It gives extended rights to data subjects, such as the right to access, rectification, deletion, data portability, opt-out of selling or sharing of PI, limit use or disclosure sensitive PI, and opt-out of automated decision making. |
Storage |
It doesn't specify any exact retention time period, except that the PI can be retained for as long as it is reasonably necessary for the purpose for which it was collected and processed. |
Lawful Basis for Processing Data |
It mandates that business's collection, use, retention, and sharing of a consumer's personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes. |
Cross Border Data |
It doesn't have any cross-border data transfer requirements but requires businesses to enter into written agreements with service providers, contractors, and third parties to comply which obligates them to provide the same level of privacy protection to the transferred PI as is required by the CPRA. |
Data Security |
It specifies that businesses shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure as well as requires businesses to conduct Annual Cybersecurity Audits and Regular Risk Assessments to monitor privacy and security risks to the PI. |
Breach Response |
It doesn't specify any data breach notification. However, as per Section 1798.82 of the California Civil Code, a Californian resident must be notified immediately as soon as the breach of PI is discovered by the business. |
General Data Protection Regulation (GDPR) | |
---|---|
Notice at Point of Collection |
Data controllers are required to inform data subjects of the collection of personal data categories of collected PD, the purpose of processing, data recipients as well as the rights of data subjects. Additional information is required to be communicated to data subjects to ensure fair and transparent processing |
Consent |
Where consent is used as a lawful ground of data processing, it must be freely given, specific, informed, and an unambiguous indication of data subjects' wishes. |
Data Subject Requests |
It gives several rights to data subjects such as the right of access, data portability, to deletion/erasure, rectification, restrict processing, object to processing, and object to automated decision-making. |
Storage |
It doesn't specify any storage limitation except the condition that data can be retained as long as it is required for the purpose it was collected. |
Lawful Basis for Processing Data |
It requires that data can only be collected and processed if it meets any of the 6 lawful grounds (consent, performance of contract, compliance with a legal obligation, vital interests, legitimate interests, public task). |
Cross Border Data |
It imposes specific conditions for cross-border data transfers. Personal data can be transferred outside the EU only when adequate protection is ensured or there are safeguards in place to ensure the level of protection is essentially equivalent to that currently guaranteed in the EU. |
Data Security |
It requires organizations to adopt appropriate technical and organizational measures taking into consideration the nature, scope, context, purpose of the processing as well as the risks. |
Breach Response |
It requires that the breach should be notified to the relevant supervisory authority within 72 hours of its discovery if the breach is likely to result in a risk to the rights and freedoms of natural persons. The breach must be communicated to impacted data subjects without undue delay in case of high risk. |
Personal Information Protection Law (PIPL) | |
---|---|
Notice at Point of Collection |
Personal information processors are required to provide individuals an explicit privacy notice before processing their personal information. This notice should include name and contact, collection of PI and its retention period, any subsequent third-party personal information processors, categories of processed PI, the purpose of processing, and individuals' rights on PI. |
Consent |
"Consent is one of the lawful bases of processing under the PIPL. It requires separate consent at different instances, such as while data transfer, processing of sensitive PI, or data sharing, etc. Where the individual consents to the processing of personal information, the individuals have the right to withdraw their consent." |
Data Subject Requests |
It provides individuals the rights to access, restriction, objection, rectification, access, portability, deletion, and the right to object automated decision-making. |
Storage |
It doesn't specify the retention period except that it needs to be the shortest possible period required to fulfill the desired data processing purpose. |
Lawful Basis for Processing Data |
It defines seven lawful basis for processing the personal information of individuals (consent, contract, statutory obligations, public health and security, journalism for public interest, publicly available personal information, and other laws). |
Cross Border Data |
PIPL requires that the critical information infrastructure operators (CIIOs) and personal information processors that process personal information above the number prescribed by the CAC shall store personal information collected and generated within China. To transfer personal information outside of China, the personal information processors need to fulfill stricter obligations provided under the PIPL. |
Data Security |
It specifies a set of security measures for data protection, such as data categorization, encryption, de-identification, internal security training, and emergency plans. |
Breach Response |
It doesn't specify any exact deadline except that the breach needs to be notified immediately to the supervisory authority and the affected individual. |
Protection of Personal Information Act (POPIA) | |
---|---|
Notice at Point of Collection |
POPIA requires companies to inform data subjects that their personal data is collected, the purposes, the intended recipients, and other relevant details. |
Consent |
Where consent is used as a lawful ground of processing, it must be voluntary, specific, and informed expression of the data subject's will. |
Data Subject Requests |
Data subjects have several rights such as rights to confirmation, access, correction, withdraw consent, object to direct marketing, restrict processing of personal information, and rights in relation to automated decision-making including profiling. |
Storage |
Personal data must not be retained any longer than is necessary for the purposes it was collected or subsequently processed. |
Lawful Basis for Processing Data |
The processing of data can take place on one of the six legal basis, each of which has certain limitations (consent, contract, compliance with a legal obligation, legitimate interests of the data subject, public task, and legitimate interests of the controller). |
Cross Border Data |
It specifies certain conditions under which cross-border data transfer is permitted, such as consent of the data subject, an adequate level of protection of PI, etc. |
Data Security |
It requires organizations to take security measures to prevent loss, damage, unauthorized destruction, or unlawful access of data. |
Breach Response |
It doesn't declare any specific time period for breach notification but that the regulator and affected data subject must be notified as soon as reasonably possible. |
Brasil’s Lei Geral de Proteção de Dados (LGPD) | |
---|---|
Notice at Point of Collection |
Data subjects should be informed about the specific purpose of the processing, the type, and duration of the processing, the identification of the controller along with contact information, information regarding the shared use of data by the controller and others as well as the purpose for such sharing, the responsibilities of the agents that will carry out the stated processing and the data subject’s rights under the law, |
Consent |
Consent is one of the legal basis for data processing under this regulation and it shall refer to specific purposes. Consent given for generic purposes is considered void and if the purpose of the processing changes, consent will have to be regained. Consent should be written and documented and should be revocable at all times. |
Data Subject Requests |
It entitles data subjects with the right to revoke consent, confirmation, access, correction, portability, deletion, information about third parties with whom their personal data has been shared with, and information about the possibility of denying consent |
Storage |
It requires that the data needs to be deleted upon the termination of its processing period, unless it is required to fulfill any legal obligation, or use in any research while ensuring data anonymization. |
Lawful Basis for Processing Data |
It establishes ten legal basis for processing of data, such as consent of data subject, compliance with legal obligation, execution of public policies by public administration, carrying out research studies, execution of a contract, for exercise of rights in judicial, legal or arbitration proceedings, for protection of life or physical safety, to protect health, fulfillment of the legitimate interest of the controller, for protection of credit etc. |
Cross Border Data |
It imposes specific conditions restrictions for cross border data transfers. Personal data can be transferred outside Brazil only when adequate protection is ensured or there are safeguards in place to ensure the level of protection is essentially equivalent to that currently guaranteed by the LGPD. |
Data Security |
It requires both the data controller and operator to take security, technical and administrative measures to protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication or any type of improper or unlawful processing. |
Breach Response |
It demands data controllers or operators to notify the National Authority and the affected data subject of breach and damages within a reasonable time period. |
New Zealand Privacy Act | |
---|---|
Notice at Point of Collection |
It instructs agencies to inform individuals about the collection of their data, purpose of processing, the intended recipients, the consequences of not providing the information, and the data subjects' rights to access and correction of their data. |
Consent |
It does not depend on consent as the primary authority for collecting, using and disclosing personal information (legitimate business purpose is the main driver). |
Data Subject Requests |
It gives individuals the rights to access to and correct information, and legally binds agencies to cater to the request within 20 working days. |
Storage |
It doesn't declare any specific retention period except that the data should be retained no longer than the purpose for which it may lawfully be used. |
Lawful Basis for Processing Data |
It establishes that there should be a valid lawful purpose for the collection, sharing and disclosure of information, and it restricts an agency from requiring collection of personal information if the lawful purpose doesn't require it. |
Cross Border Data |
It permits agencies to transfer data outside New Zealand only if the destination country provides comparable safeguards to those in New Zealand's Privacy Act, the destination country is part of a prescribed binding scheme issued by the government of New Zealand, or if the data subject expressly authorizes the disclosure of personal information after having been informed of the inadequate data protection standards of the foreign country. |
Data Security |
It mandates agencies to take security measures that prevent data loss, disclosure, or any other misuse of personal information. |
Breach Response |
It establishes that as soon as practicable after becoming aware of the breach, the organisation must notify the affected individual and the Privacy Commissioner if it is reasonable to believe that the breach has caused serious harm to the affected individual or is likely to do so. |
China’s Cybersecurity Law (CSL) | |
---|---|
Notice at Point of Collection |
It provides that network providers must inform individuals about the purpose, scope, and methods of data collection and processing. |
Consent |
It requires network providers to acquire the consent of individuals for the collection and sharing of information to any third-party in a manner that doesn't identify a specific individual. |
Data Subject Requests |
It gives individuals limited rights over their data, such as the right to data correction and erasure. |
Storage |
It doesn't specify retention time period but that it states that data should be retained for the minimum possible period until it helps the organization realize the purpose for which it is collected. |
Lawful Basis for Processing Data |
It defines certain principles of lawfulness and legitimacy for the collection of data, and it restricts network operators from stealing the data or acquiring it through illegal methods. |
Cross Border Data |
It demands network operators and critical infrastructure information operators to go through necessary standard security assessments for cross-border data transfer of personal information and important data. |
Data Security |
It lays out a comprehensive list of security requirements for both the network operators as well as CIIOs that range from ensuring encryption to establishing emergency response plans. |
Breach Response |
It requires that in the event of a breach, network providers must notify the breach to the relevant authorities and the affected individuals, and take necessary actions to remediate the breach. |
Virginia Consumer Data Protection Act (CDPA) | |
---|---|
Notice at Point of Collection |
It requires businesses to provide consumers with clear and accessible privacy notice containing specific information about the purpose and categories of personal information for processing |
Consent |
It mandates consumers' consent for collection and processing of sensitive personal information, and parental consent in case of a minor's data collection. |
Data Subject Requests |
It gives six rights (confirm, access, rectify, delete, port, opt-out) to consumers over their data and requires organizations to fulfil or deny the request within 45 days. |
Storage |
It doesn't specifically outline any data retention period. |
Lawful Basis for Processing Data |
It restricts businesses from collecting unnecessary personal information or processing the information for unintended purposes without gaining their consent. |
Cross Border Data |
It doesn't specify any cross-border data transfer regulations. |
Data Security |
It mandates that the business must ensure technical, administrative, and physical security measures appropriate to the volume and nature of the personal data at issue. |
Breach Response |
It doesn't specify any breach response requirements but as per §18.2-186.6. of the Code of Virginia, a resident of Virginia must be notified in case their unencrypted personal information has been compromised in a security incident |
Colorado Privacy Act (CPA) | |
---|---|
Notice at Point of Collection |
It requires consumers to be provided with a reasonably accessible, clear, and meaningful privacy notice containing specific information including categories of data it shares or sells (including for targeted advertising) and means for consumers to exercise their rights and how they can appeal against the denial of their DSRs. |
Consent |
Controllers cannot process data of minors unless the express consent of the consumer or of the parents/guardians of a minor child has been obtained. |
Data Subject Requests |
It gives consumers the rights to confirm, access, rectify, delete, portability, and opt-out of processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.and requires organizations to fulfil or deny the requests within 45 days. |
Storage |
It doesn't specify data retention requirements but requires data processors to delete or return the data at the end of its provisioning unless otherwise required by law. |
Lawful Basis for Processing Data |
It forbids data controllers from collecting unnecessary data, processing the sensitive data of consumers or for processing for purposes beyond the ones initially disclosed to the consumer at the time of collection, without obtaining their consent. |
Cross Border Data |
It doesn't specify any cross-border data transfer regulations. |
Data Security |
It requires data controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data during both storage and use. Such data security practices shall be appropriate to the volume and nature of the personal data at issue. |
Breach Response |
It doesn't specify any breach response requirements but as per Colo. Rev. Stat. § 6-1-716 data controllers must immediately investigate any security incident and notify all affected Colorado's resident about the breach of their unencrypted computerized personal information as soon as possible to the affected CO resident unless if after a good-faith, prompt and reasonable investigation, the Entity determines that misuse of PI about the resident/s has not occurred and is not likely to occur. |
Thailand’s Personal Data Protection Act 2019 (PDPA) | |
---|---|
Notice at Point of Collection |
"It requires privacy notices, prior to or at the time of the collection of the personal data, by data controllers stating the purpose of collection of data, its use, its retention period, and data subjects rights over the data. " |
Consent |
It demands explicit consent from the data subject for the purpose of processing information, except in certain specific situations. For minors, data controllers need to take parental consent to process their personal data. |
Data Subject Requests |
It lays out six data subjects' rights, such as right to access, information, object, erasure, restriction, rectification, and portability. |
Storage |
It requires data controllers to inform data subjects, prior to or at the time of the collection of personal data, about the retention period of their personal data or an expected time period if stating the exact retention period isn't possible. |
Lawful Basis for Processing Data |
PDPA outlines six legal bases for the collection and processing of personal data. These bases include, among other things, consent, the performance of a contract or legal obligations, or by legitimate interest of the Data Controller. The legal bases of processing personal data and sensitive personal data are different. |
Cross Border Data |
PDPA prescribes that personal data may not be transferred outside of Thailand, unless the recipient country has adequate personal data protection standards in the Commission's view and the transfer is in accordance with the rules prescribed by the Commission. There is no specific data localization requirement under the PDPA. |
Data Security |
"It requires data controllers to ensure appropriate security measures for the protection of data against loss, misuse, alteration, edit or disclosure by means of unlawful access. Such security measures must be subject to periodic review. " |
Breach Response |
It demands data controllers and processors to notify the breach of the Commission within 72 hours, and to the affected individuals in case of high risk to their rights and freedom. |
Singapore’s Personal Data Protection Act (PDPA) | |
---|---|
Notice at Point of Collection |
It requires organizations to provide individuals with privacy notices, notifying them about the collection and processing of their data, purpose of processing, and their respective rights. |
Consent |
PDPA requires express consent or deemed consent by individuals to process their personal data. There are certain exceptions to the consent requirements. An individual may at any time withdraw any consent given, or deemed given under the PDPA, upon giving reasonable notice to the organization. |
Data Subject Requests |
It gives individuals the right to give or withdraw consent, to access, correct, and data portability. |
Storage |
It specifies no exact time period for data retention except that organizations must remove any personal data if it has fulfilled its intended purpose. |
Lawful Basis for Processing Data |
PDPA provides the following legal bases for the processing of personal data of individuals: consent or deemed consent, contractual obligations, legal obligations, interests of individuals, public interests, legitimate interests of individuals, etc. |
Cross Border Data |
It states that organizations must not transfer personal data to a country or territory outside Singapore except in accordance with the requirements prescribed under the PDPA. |
Data Security |
It requires organizations to implement necessary security measures to protect data from harm and unauthorized access, modification, copying, and duplication. |
Breach Response |
It requires organizations to conduct assessment in a reasonable manner if the data breach is notifiable or not and in case if it is notifiable, the organization must notify relevant authorities and affected individuals. |
Canadian Privacy Law (PIPEDA) | |
---|---|
Notice at Point of Collection |
PIPEDA requires that identified purposes for the collection of personal information should be specified to the individual concerned at the time or before the time of collection, in writing or orally, depending on the way in which information is collected. |
Consent |
It demands opt-in consent for the processing of personal information unless the personal information of the individual is publicly available and organizations must obtain a fresh consent for a separate purpose of processing. |
Data Subject Requests |
It lays out limited rights such as the right to access personal information, the right to challenge accuracy, right to erasure, right to object, right to data portability, and right to not be discriminated against due to the exercise of their rights. |
Storage |
As per Principle 5 of PIPEDA, personal information must only be kept as long as required to serve those purposes. PI that is no longer required to fulfill the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information. |
Lawful Basis for Processing Data |
It doesn't define any legal basis for data collection but it requires organizations to collect consent prior to the collection, use, or disclosure of personal information, unless an exception applies. |
Cross Border Data |
It establishes a comprehensive set of rules governing international data transfer, such as security standards, accountability, and transparency for providing the transferred personal information retains a comparable level of protection and the transferring organizations remain responsible for personal information transferred to third parties. |
Data Security |
PIPEDA Principle 7 demands organizations to ensure security measures to protect data from unauthorized copying, duplication, theft, and alteration of data. |
Breach Response |
It requires organisations to notify the OPC and affected individuals as soon as possible after a breach has been discovered which creates a real risk of significant harm to the individual. |
Saudi Arabia’s Personal Data Protection Law (PDPL) | |
---|---|
Notice at Point of Collection |
PDPL requires that data controllers must adopt a personal data privacy policy (notice), and make it available to data subjects to review before collecting their personal data. |
Consent |
PDPL requires that data controllers must not process personal data without the consent of its owner except for the cases stipulated under the Regulations (yet to be issued). Data subjects may withdraw their consent to the processing of personal data at any time. |
Data Subject Requests |
It provides data subjects the rights to be informed, to object, to restrict or limit the processing, to access, to correct or update, or to require destruction of data if it is no longer required. |
Storage |
It doesn't specify any storage limitation regulations. |
Lawful Basis for Processing Data |
It doesn't define any legal basis for data collection but it requires organizations to choose and outline the purposes for which the data will be collected and processed. |
Cross Border Data |
It lays out a stringent cross-border data transfer regulations restricting data controllers from any international data transfer unless it meets certain conditions. |
Data Security |
Data controllers are required to take appropriate technical and organisational measures to safeguard personal data. |
Breach Response |
It requires data controllers to notify the supervising authority and the affected data subject about any data leakage, breach or unauthorized access. |
The potential downsides of non-compliance can have severe consequences for a business. As companies grow and begin to cater to additional customers from across the globe, the wide range of complex and ever-changing data privacy regulations means companies must stay compliant to avoid penalties.
Complying with global data privacy regulations is crucial if you’re serious about growing your business, gaining user trust, and adapting to a modernized approach towards the company’s internal and external processes.
Get all the latest information, law updates and more delivered to your inbox
[email protected]
PO Box 13039,
Coyote CA 95013
Break Silos of Sensitive Data & Risk Understanding across Multicloud and self managed systems. Common grammar, policies and reporting
Key Features
Find data assets, and discover personal and sensitive data in structured and unstructured data systems, across on-premises and multi-cloud.
Key Features
Classify & label data to ensure appropriate security controls are enabled on most sensitive data in your organization
Key Features
Collect, organize, enrich and build a data catalog to address privacy, security and governance solutions
Key Features
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
Assess risk scores for every data asset, asset location, or personal data category
Key Features
Auto discover personal data in Snowflake and enforce access governance
Key Features
Auto discover personal data in Snowflake and enforce access governance
Key Features
Discover, classify, manage and protect sensitive data in Workday. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Box. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Slack. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more
Key Features
Discover, classify, manage and protect sensitive data in Github. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Jira. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Dropbox. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in SAP Successfactors. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Servicenow. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Zendesk. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Apache Hive. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Apache Spark SQL. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Cassandra. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Discover, classify, manage and protect sensitive data in Couchbase. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
Enable privacy by design through the AI driven PrivacyOps platform
Key Features
Maintain your Data Catalog with continuous automated updates
Key Features
Automate data subject rights request fulfillment and maintain proof of compliance
Key Features
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
Audit once and comply with many regulations. Collaborate and track all internal assessments in one place.
Key Features
Automation of privacy assessment collection from third parties, collaboration among stakeholders, follow-ups and compliance analytics.
Key Features
Automate global cookie consent compliance.
Key Features
Simplify and automate universal consent management.
Key Features
Automate the incident response process by gathering incident details, identifying the scope and optimizing notifications to comply with global privacy regulations.
Key Features
Keeping privacy notices up-to-date made easy
Key Features
Operationalize GDPR compliance with the most comprehensive PrivacyOps platform
Key Features
Operationalize CCPA compliance with the most comprehensive PrivacyOps platform
Key Features
Revolutionize LGPD compliance through PrivacyOps
Key Features
Identify data risk & enable protection and control
Key Features
Discover data assets, detect & catalog sensitive data in it
Key Features
Classify and label data to ensure appropriate security controls
Key Features
Monitor data security posture and identify external and internals risks to data security
Key Features
Policy based alerts and remediations to protect data from external and internal threats
Key Features
Investigate data security issues and take remediation actions
Key Features
Snowflake is a cloud based data warehouse that allows organizations to run large scale data analytics projects to uncover business insights, run or train machine learning models, and modernize their data infrastructure.
Key Features
Microsoft O365 is the ubiquitous productivity suite for every business worker. Users rely on Office products such as OneDrive and SharePoint to collaborate with their co-workers.
Key Features
Organizations want to migrate their on-premises data to cloud data stores to take advantage of scale and flexibility while reducing operational cost of managing on-premises infrastructure. However, due to privacy regulations such as GDPR, CCPA administrators have to ensure that data is migrated in compliance with these laws.
Key Features
Protecting sensitive content is a priority for all organizations, however, due to volume of sensitive content and
Key Features
While data aids in business decision making, global privacy regulations such as GDPR, CPRA require organization to identify personal & sensitive data & use only for its intended purpose and implement adequate protection.
Key Features
The CDMC Framework sets up controls that companies should put in place, and establishes clear guidelines around data accountability, governance, classification, usage, protection and privacy.
CDMC Framework
Securiti enables organizations to meet multiple regulations around the world and helps with compliance requirements through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities and AI-driven process automation.
Securiti is a complete PrivacyOps Solution.
View all solutionsThe California Consumer Privacy Act (CCPA) was signed into law on June 28, 2018 and is scheduled to come into effect on January 01, 2020. Often compared to GDPR, CCPA protects consumers from mismanagement of their personal data and gives the consumer control over what data is collected, processed, shared or sold.
Key Features
The California Privacy Rights Act (CPRA) will take effect from January 1, 2023, and will apply to personal information collected on or after January 1, 2022. Enforcement of the CPRA will start six months later (July 1, 2023). The CPRA builds upon the CCPA, strengthening user privacy for California residents.
Key Features
The EU General Data Protection Regulation (GDPR) came into effect on May 25, 2018 and changed the global privacy landscape. It has broadened the definition of processing activities and personal data, impacting companies worldwide, and has tightened the rules to obtain consent before processing information.
Key Features
The Lei Geral de Proteção de Dados (LGPD) is modeled with similarities to the General European Data Protection Regulation (GDPR) and contains sixty-five articles. It was approved on August 14, 2018 and its validity has undergone several changes, the last relevant fact being MPV 959. LGPD is in effect since September 18, 2020. The sanctions by the ANPD (Brazilian Data Protection Authority) were postponed to August 2021. The LGPD allows people have more rights over their data and expects organizations to comply with their regulations or face heavy penalties or fines.
Key Features
China has complex data protection and data security regime, however, the following are three main laws that primarily cover China’s data protection and data security regulatory framework. These laws are:
Frameworks
UAE have number of laws in place that govern privacy as well as data security in the UAE. Some of those includes:
Frameworks
The government of New Zealand has recently replaced its long-existing Privacy Act of 1993 with a modernized version, the Privacy Act 2020. The New Zealand Privacy Act 2020 (NZPA) will take effect from December 1, 2020.
Key Features
The Personal Data Protection Act, B.E. 2562 (2019) ('PDPA') is Thailand's first consolidated data protection law, which was published in the Thai Government Gazette on 27 May 2019. This law was said to go into effect on 27 May 2020. However, in May 2020, the Thai Cabinet through a Royal Decree has deferred the enforcement of certain data protection provisions of the PDPA until 31 May 2021.
Key Features
In order to protect the data of individuals in South Africa, Parliament assented to the Protection of Personal Information Act (POPIA) on 19th November 2013. The commencement date of section 1, Part A of Chapter 5, section 112 and section 113 was 11 April 2014. The commencement date of the remaining sections (excluding section 110 and 114(4)) was 1st July 2020. As per the Regulator’s Operational Readiness Plan the Regulator will be able to take enforcement actions for the violation of POPIA by July 1st 2021.
Key Features
Singapore’s Personal Data Protection Act (PDPA) comprises various provisions governing the collection, disclosure, use, and care of personal data. It recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate and reasonable purposes.
Key Features
The Canadian data laws aim to give consumers control over their data and promote greater transparency about how organizations use data containing personal identifiers.
Frameworks
The Australian data laws aim to give consumers control over their data and promote greater transparency about how organizations use data containing personal identifiers.
Frameworks
After the invalidation of Privacy Shield, many companies are relying on the SCCs in order to continue transferring data of EU citizens to companies based in countries who are not deemed adequate for data transfer.
After the CJEU judgement, it is clear that these companies have to conduct Risk Assessments with the data recipients in these countries in order to ensure they have enough controls to mitigate any potential data or regulatory risk.
Key Features
On January 31, 2020, the government of Saudi Arabia issued the Executive Regulations to the Saudi E-Commerce Law 2019 (“ECL”) that was in effect since October 2019. The Executive Regulations together with the ECL (“Law”) aim to protect consumers’ personal data by requiring organizations to take appropriate technical and administrative measures.
Key Features
Turkey was one of the first countries to start the trend of legislating data protection. Turkey published “Law on the Protection of Personal Data No. 6698 (LPPD) covering personal data protection on April 07, 2016.” The LPPD is based on the European Union Data Protection Directive 95/46/EC and has several similarities with the GDPR. It aims to give data subjects’ control over their personal data and outlines obligations that organizations and individuals dealing with personal data must comply with. The LPPD has also provided comprehensive guidelines for the transfer of personal data to the third parties.
Key Features
In December 2019, India, following several other countries' footsteps on the privacy laws' developments, introduced the Personal Data Protection Bill (PDPB) to regulate the processing, collection, and storage of personal data. However, in November 2021, the bill’s name was amended to now be called the Data Protection Bill 2021 (DPB).
Key Features
The Irish Data Protection Act, 2018 (Irish DPA) implements the General Data Protection Regulation (GDPR) and transposes the European Union Law Enforcement Directive in Ireland. Since it incorporates most of the provisions from the GDPR and the Law Enforcement Directive with limited additions and deletions as per the national law, it is considered to be the principal data protection legislation in Ireland.
Key Features
The Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012 (the “PDPO) is the primary legislation in Hong Kong which was enacted to protect the privacy of individuals’ personal data, and regulate the collection, holding, processing, disclosure, or use of personal data by the organizations.. The Data Protection Principles ( the “DPPs or DPP ''), which are contained in Schedule 1 to the PDPO, outline how entities should collect, handle, disclose, and use personal data.
Key Features
In 2012, the Philippines passed the comprehensive privacy law, Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA"). The DPA recognizes the rights of individuals to have more control over their personal data while ensuring a free flow of information to promote innovation and growth.
Key Features
South Korea has a general law and several special laws that cover data protection and individuals' privacy. South Korea's data protection regime is considered one of the strictest data protection regimes owing to its notification requirements, opt-in consent, extensive data subject rights, mandatory data breach notifications, and heavy sanctions in case of non-compliance.
Key Features
The Act on the Protection of Personal Information (the "APPI'') regulates personal related information and applies to any Personal Information Controller (the “PIC''), that is a person or entity providing personal related information for use in business in Japan. The APPI also applies to the foreign PICs which handle personal information of data subjects (“principals”) in Japan for the purpose of supplying goods or services to those persons.
Key Features
Qatar is the first gulf country that has passed a national data privacy law and has paved the way for all other gulf countries to follow suit. In 2016, Qatar enacted Law no. 13 Concerning Personal Data Protection (the “DPL”). Qatar became the first Gulf Cooperation Council (GCC) member state to issue an “European Style” applicable data protection law. The DPL establishes a certain degree of personal data protection, provides data subject rights, and prescribes the guidelines for organizations for the processing of personal data within Qatar.
Key Features
Bahrain has become a part of the countries that have enacted a data privacy regulation to protect the rights of their residents. On 12 July 2018, Bahrain drafted its law on data protection regulation, Law No. 30. This then went on to go into effect on the 1st of August 2019 as the Bahrain Personal Data Protection Law (PDPL) and supersedes all other laws. The PDPL recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate purposes.
Key Features
After the Success of the California Consumer Privacy Act (CCPA) in California, Virginia is now following the same path. The Virginia Consumer Data Protection Act (VCDPA) has been passed and will go into effect on 1st of January 2023. This law is closely designed after the newer California Privacy Rights Act (CPRA) but with a few significant and important differences.
Key Features
After the VCDPA in Virginia, Colorado has closely followed suit and has passed their own comprehensive data privacy law to protect the personal data of the residents of Colorado.The Colorado Privacy Act (CPA) was signed into law on the 8th of July, 2021 and has been modelled closely after the VCDPA.
Key Features
Saudi Arabia has drafted a data privacy regulation to protect the personal data of individuals in Saudi Arabia. This law was approved by the Council of Ministers in Saudi Arabia and is named the Personal Data Protection Law (the “PDPL”).
Key Features
Uganda’s Data Protection and Privacy Act 2019 seeks to protect Uganda’s citizens and their personal data by outlining and implementing rules for processing personal data and sensitive personal data by entities within or outside the country.
Key Features
Ghana Data Protection Act 2012 establishes a comprehensive set of provisions governing the collection, processing, use, and protection of personal data by the data controller or data processor.
Key Features
Kenya’s Data Protection Act, 2019 (DPA) is based on the framework of the EU’s General Data Protection Regulation (GDPR), making it the third region in East Africa to have enacted and enforced data protection regulations.
Key Features
Malaysia’s Personal Data Protection Act (PDPA) was passed by the Parliament of Malaysia on 2 June 2010. The PDPA sets out a complete cross-sectoral framework to protect the personal data of individuals with respect to commercial transactions.
Key Features
Although there is no comprehensive data protection law in Indonesia, however, there are several regulations that regulate the Indonesia's draft Personal Data Protection Bill (PDPB) & Personal Data Protection Regulations (PDP Regulations)
Frameworks
Oman’s Personal Data Protection Law (Oman’s PDPL) has been published in the country’s official gazette, and it will come into force by February 9, 2023, one year after its issuance which was February 9, 2022. The law applies to any natural person’s personal data including but not limited to their name, location data, identification number, and health-related information.
Key Features
Kuwait’s Data Privacy Protection Regulations (DPPR) applies to all public and private Telecommunication Services Providers and related industry sectors who collect, process, and store personal data and user-related content in whole or in part of a data storage system, whether processed inside or outside the State of Kuwait.
Key Features
The Personal Data Protection Act (PDPA) protects Sri Lankan residents’ data while regulating how organizations collect, process, store, and maintain this data. The PDPA also grants users a wide range of data subject rights, meant to give them more control over their data.
Key Features
Issued on 27 July 2006, the Russian Federal Law on Personal Data (No. 152-FZ) remains one of the oldest data protection laws in effect today. Moreover, it is one of the few laws enacted before the EU's landmark General Data Protection Regulation (GDPR).
Key Features
Germany’s Bundesdatenschutzgesetz (BDSG) in German, or the Federal Data Protection Act in English, was enacted in May 2018 to implement the GDPR in Germany.
Key Features
The Data Protection Act (DPA) of 2018 was passed in April 2016 and came into effect on May 25, 2018. This was the same day the General Data Protection Regulation (GDPR) came into effect.
Key Features
Directive 2002/58/EC on Privacy and Electronic Communications, known more prominently as the ePrivacy Directive, is a key set of instructions released to ensure the privacy and confidentiality of all electronic communications within the European Union (EU).
Key Features
The New York State Department of Financial Service Cybersecurity Regulations or 23 NYCRR 500 is a set of 23 cybersecurity requirements mandatory for all financial institutions registered in New York working under its Banking Law, Insurance Law, or Financial Services Law.
Key Features