Global Privacy Compliance Checklist [Updated 2022]
Discover the predominant legal compliance requirements that businesses must adhere to avoid legal challenges and adapt to a modernized approach towards data privacy regulations. Whether you’re a local or a multinational organization, ensuring compliance with local and international privacy laws should be your top priority and a critical element of your organization’s policies.
To comply with local and international data protection laws, our experts have compiled a compliance checklist that addresses the critical components of each regulation around the world.
| California Consumer Privacy Act (CCPA) | |
|---|---|
Notice at Point of Collection |
Businesses are required to inform consumers of the categories of PI being collected and the purpose of processing at or before the time of collection. |
Consent |
It mandates opt-out consent for the selling of collected PI of consumers and opt-in consent for selling PI of minors (consumers below 16 years of age). |
Data Subject Requests |
It gives limited rights to consumers such as right to access, deletion, data portability, and right to opt-out of selling of PI. |
Storage |
NA |
Lawful Basis for Processing Data |
It doesn't define any lawful basis for the collection and processing of PI. |
Cross Border Data |
It doesn't restrict any cross-border data transfer requirements but requires businesses to enter into written agreements with service providers which restrict retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract including selling the PI. |
Data Security |
It doesn't specifically discuss any security measures but it does specify penalties in the event of a breach due to failure of the business to implement reasonable and appropriate security measures as per Section 1798.81.5 of the California Civil Code. |
Breach Response |
It doesn't specify any data breach notification. However, as per Section 1798.82 of the California Civil Code, a Californian resident must be notified immediately as soon as the breach of PI is discovered by the business. |
| California Privacy Rights Act (CPRA) | |
|---|---|
Notice at Point of Collection |
Businesses are required to inform consumers about the categories of PI and sensitive PI being collected and the purpose of processing, whether the PI and sensitive PI will be sold or shared and the length of time it shall be stored/retained, or the criteria used to determine such a period. |
Consent |
It mandates opt-out consent for the selling and sharing of collected PI of consumers, as well as for automated decision making, and allows consumers to limit the use or disclosure of their sensitive PI. Opt-in consent is required for selling PI of minors (consumers below 16 years of age). It also requires that consent needs to be specific and clear, and it should be taken freely without using any dark patterns. |
Data Subject Requests |
It gives extended rights to data subjects, such as the right to access, rectification, deletion, data portability, opt-out of selling or sharing of PI, limit use or disclosure sensitive PI, and opt-out of automated decision making. |
Storage |
It doesn't specify any exact retention time period, except that the PI can be retained for as long as it is reasonably necessary for the purpose for which it was collected and processed. |
Lawful Basis for Processing Data |
It mandates that business's collection, use, retention, and sharing of a consumer's personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes. |
Cross Border Data |
It doesn't have any cross-border data transfer requirements but requires businesses to enter into written agreements with service providers, contractors, and third parties to comply which obligates them to provide the same level of privacy protection to the transferred PI as is required by the CPRA. |
Data Security |
It specifies that businesses shall implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure as well as requires businesses to conduct Annual Cybersecurity Audits and Regular Risk Assessments to monitor privacy and security risks to the PI. |
Breach Response |
It doesn't specify any data breach notification. However, as per Section 1798.82 of the California Civil Code, a Californian resident must be notified immediately as soon as the breach of PI is discovered by the business. |
| General Data Protection Regulation (GDPR) | |
|---|---|
Notice at Point of Collection |
Data controllers are required to inform data subjects of the collection of personal data categories of collected PD, the purpose of processing, data recipients as well as the rights of data subjects. Additional information is required to be communicated to data subjects to ensure fair and transparent processing |
Consent |
Where consent is used as a lawful ground of data processing, it must be freely given, specific, informed, and an unambiguous indication of data subjects' wishes. |
Data Subject Requests |
It gives several rights to data subjects such as the right of access, data portability, to deletion/erasure, rectification, restrict processing, object to processing, and object to automated decision-making. |
Storage |
It doesn't specify any storage limitation except the condition that data can be retained as long as it is required for the purpose it was collected. |
Lawful Basis for Processing Data |
It requires that data can only be collected and processed if it meets any of the 6 lawful grounds (consent, performance of contract, compliance with a legal obligation, vital interests, legitimate interests, public task). |
Cross Border Data |
It imposes specific conditions for cross-border data transfers. Personal data can be transferred outside the EU only when adequate protection is ensured or there are safeguards in place to ensure the level of protection is essentially equivalent to that currently guaranteed in the EU. |
Data Security |
It requires organizations to adopt appropriate technical and organizational measures taking into consideration the nature, scope, context, purpose of the processing as well as the risks. |
Breach Response |
It requires that the breach should be notified to the relevant supervisory authority within 72 hours of its discovery if the breach is likely to result in a risk to the rights and freedoms of natural persons. The breach must be communicated to impacted data subjects without undue delay in case of high risk. |
| Personal Information Protection Law (PIPL) | |
|---|---|
Notice at Point of Collection |
Personal information processors are required to provide individuals an explicit privacy notice before processing their personal information. This notice should include name and contact, collection of PI and its retention period, any subsequent third-party personal information processors, categories of processed PI, the purpose of processing, and individuals' rights on PI. |
Consent |
"Consent is one of the lawful bases of processing under the PIPL. It requires separate consent at different instances, such as while data transfer, processing of sensitive PI, or data sharing, etc. Where the individual consents to the processing of personal information, the individuals have the right to withdraw their consent." |
Data Subject Requests |
It provides individuals the rights to access, restriction, objection, rectification, access, portability, deletion, and the right to object automated decision-making. |
Storage |
It doesn't specify the retention period except that it needs to be the shortest possible period required to fulfill the desired data processing purpose. |
Lawful Basis for Processing Data |
It defines seven lawful basis for processing the personal information of individuals (consent, contract, statutory obligations, public health and security, journalism for public interest, publicly available personal information, and other laws). |
Cross Border Data |
PIPL requires that the critical information infrastructure operators (CIIOs) and personal information processors that process personal information above the number prescribed by the CAC shall store personal information collected and generated within China. To transfer personal information outside of China, the personal information processors need to fulfill stricter obligations provided under the PIPL. |
Data Security |
It specifies a set of security measures for data protection, such as data categorization, encryption, de-identification, internal security training, and emergency plans. |
Breach Response |
It doesn't specify any exact deadline except that the breach needs to be notified immediately to the supervisory authority and the affected individual. |
| Protection of Personal Information Act (POPIA) | |
|---|---|
Notice at Point of Collection |
POPIA requires companies to inform data subjects that their personal data is collected, the purposes, the intended recipients, and other relevant details. |
Consent |
Where consent is used as a lawful ground of processing, it must be voluntary, specific, and informed expression of the data subject's will. |
Data Subject Requests |
Data subjects have several rights such as rights to confirmation, access, correction, withdraw consent, object to direct marketing, restrict processing of personal information, and rights in relation to automated decision-making including profiling. |
Storage |
Personal data must not be retained any longer than is necessary for the purposes it was collected or subsequently processed. |
Lawful Basis for Processing Data |
The processing of data can take place on one of the six legal basis, each of which has certain limitations (consent, contract, compliance with a legal obligation, legitimate interests of the data subject, public task, and legitimate interests of the controller). |
Cross Border Data |
It specifies certain conditions under which cross-border data transfer is permitted, such as consent of the data subject, an adequate level of protection of PI, etc. |
Data Security |
It requires organizations to take security measures to prevent loss, damage, unauthorized destruction, or unlawful access of data. |
Breach Response |
It doesn't declare any specific time period for breach notification but that the regulator and affected data subject must be notified as soon as reasonably possible. |
| Brasil’s Lei Geral de Proteção de Dados (LGPD) | |
|---|---|
Notice at Point of Collection |
Data subjects should be informed about the specific purpose of the processing, the type, and duration of the processing, the identification of the controller along with contact information, information regarding the shared use of data by the controller and others as well as the purpose for such sharing, the responsibilities of the agents that will carry out the stated processing and the data subject’s rights under the law, |
Consent |
Consent is one of the legal basis for data processing under this regulation and it shall refer to specific purposes. Consent given for generic purposes is considered void and if the purpose of the processing changes, consent will have to be regained. Consent should be written and documented and should be revocable at all times. |
Data Subject Requests |
It entitles data subjects with the right to revoke consent, confirmation, access, correction, portability, deletion, information about third parties with whom their personal data has been shared with, and information about the possibility of denying consent |
Storage |
It requires that the data needs to be deleted upon the termination of its processing period, unless it is required to fulfill any legal obligation, or use in any research while ensuring data anonymization. |
Lawful Basis for Processing Data |
It establishes ten legal basis for processing of data, such as consent of data subject, compliance with legal obligation, execution of public policies by public administration, carrying out research studies, execution of a contract, for exercise of rights in judicial, legal or arbitration proceedings, for protection of life or physical safety, to protect health, fulfillment of the legitimate interest of the controller, for protection of credit etc. |
Cross Border Data |
It imposes specific conditions restrictions for cross border data transfers. Personal data can be transferred outside Brazil only when adequate protection is ensured or there are safeguards in place to ensure the level of protection is essentially equivalent to that currently guaranteed by the LGPD. |
Data Security |
It requires both the data controller and operator to take security, technical and administrative measures to protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication or any type of improper or unlawful processing. |
Breach Response |
It demands data controllers or operators to notify the National Authority and the affected data subject of breach and damages within a reasonable time period. |
| New Zealand Privacy Act | |
|---|---|
Notice at Point of Collection |
It instructs agencies to inform individuals about the collection of their data, purpose of processing, the intended recipients, the consequences of not providing the information, and the data subjects' rights to access and correction of their data. |
Consent |
It does not depend on consent as the primary authority for collecting, using and disclosing personal information (legitimate business purpose is the main driver). |
Data Subject Requests |
It gives individuals the rights to access to and correct information, and legally binds agencies to cater to the request within 20 working days. |
Storage |
It doesn't declare any specific retention period except that the data should be retained no longer than the purpose for which it may lawfully be used. |
Lawful Basis for Processing Data |
It establishes that there should be a valid lawful purpose for the collection, sharing and disclosure of information, and it restricts an agency from requiring collection of personal information if the lawful purpose doesn't require it. |
Cross Border Data |
It permits agencies to transfer data outside New Zealand only if the destination country provides comparable safeguards to those in New Zealand's Privacy Act, the destination country is part of a prescribed binding scheme issued by the government of New Zealand, or if the data subject expressly authorizes the disclosure of personal information after having been informed of the inadequate data protection standards of the foreign country. |
Data Security |
It mandates agencies to take security measures that prevent data loss, disclosure, or any other misuse of personal information. |
Breach Response |
It establishes that as soon as practicable after becoming aware of the breach, the organisation must notify the affected individual and the Privacy Commissioner if it is reasonable to believe that the breach has caused serious harm to the affected individual or is likely to do so. |
| China’s Cybersecurity Law (CSL) | |
|---|---|
Notice at Point of Collection |
It provides that network providers must inform individuals about the purpose, scope, and methods of data collection and processing. |
Consent |
It requires network providers to acquire the consent of individuals for the collection and sharing of information to any third-party in a manner that doesn't identify a specific individual. |
Data Subject Requests |
It gives individuals limited rights over their data, such as the right to data correction and erasure. |
Storage |
It doesn't specify retention time period but that it states that data should be retained for the minimum possible period until it helps the organization realize the purpose for which it is collected. |
Lawful Basis for Processing Data |
It defines certain principles of lawfulness and legitimacy for the collection of data, and it restricts network operators from stealing the data or acquiring it through illegal methods. |
Cross Border Data |
It demands network operators and critical infrastructure information operators to go through necessary standard security assessments for cross-border data transfer of personal information and important data. |
Data Security |
It lays out a comprehensive list of security requirements for both the network operators as well as CIIOs that range from ensuring encryption to establishing emergency response plans. |
Breach Response |
It requires that in the event of a breach, network providers must notify the breach to the relevant authorities and the affected individuals, and take necessary actions to remediate the breach. |
| Virginia Consumer Data Protection Act (CDPA) | |
|---|---|
Notice at Point of Collection |
It requires businesses to provide consumers with clear and accessible privacy notice containing specific information about the purpose and categories of personal information for processing |
Consent |
It mandates consumers' consent for collection and processing of sensitive personal information, and parental consent in case of a minor's data collection. |
Data Subject Requests |
It gives six rights (confirm, access, rectify, delete, port, opt-out) to consumers over their data and requires organizations to fulfil or deny the request within 45 days. |
Storage |
It doesn't specifically outline any data retention period. |
Lawful Basis for Processing Data |
It restricts businesses from collecting unnecessary personal information or processing the information for unintended purposes without gaining their consent. |
Cross Border Data |
It doesn't specify any cross-border data transfer regulations. |
Data Security |
It mandates that the business must ensure technical, administrative, and physical security measures appropriate to the volume and nature of the personal data at issue. |
Breach Response |
It doesn't specify any breach response requirements but as per §18.2-186.6. of the Code of Virginia, a resident of Virginia must be notified in case their unencrypted personal information has been compromised in a security incident |
| Colorado Privacy Act (CPA) | |
|---|---|
Notice at Point of Collection |
It requires consumers to be provided with a reasonably accessible, clear, and meaningful privacy notice containing specific information including categories of data it shares or sells (including for targeted advertising) and means for consumers to exercise their rights and how they can appeal against the denial of their DSRs. |
Consent |
Controllers cannot process data of minors unless the express consent of the consumer or of the parents/guardians of a minor child has been obtained. |
Data Subject Requests |
It gives consumers the rights to confirm, access, rectify, delete, portability, and opt-out of processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.and requires organizations to fulfil or deny the requests within 45 days. |
Storage |
It doesn't specify data retention requirements but requires data processors to delete or return the data at the end of its provisioning unless otherwise required by law. |
Lawful Basis for Processing Data |
It forbids data controllers from collecting unnecessary data, processing the sensitive data of consumers or for processing for purposes beyond the ones initially disclosed to the consumer at the time of collection, without obtaining their consent. |
Cross Border Data |
It doesn't specify any cross-border data transfer regulations. |
Data Security |
It requires data controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data during both storage and use. Such data security practices shall be appropriate to the volume and nature of the personal data at issue. |
Breach Response |
It doesn't specify any breach response requirements but as per Colo. Rev. Stat. § 6-1-716 data controllers must immediately investigate any security incident and notify all affected Colorado's resident about the breach of their unencrypted computerized personal information as soon as possible to the affected CO resident unless if after a good-faith, prompt and reasonable investigation, the Entity determines that misuse of PI about the resident/s has not occurred and is not likely to occur. |
| Thailand’s Personal Data Protection Act 2019 (PDPA) | |
|---|---|
Notice at Point of Collection |
"It requires privacy notices, prior to or at the time of the collection of the personal data, by data controllers stating the purpose of collection of data, its use, its retention period, and data subjects rights over the data. " |
Consent |
It demands explicit consent from the data subject for the purpose of processing information, except in certain specific situations. For minors, data controllers need to take parental consent to process their personal data. |
Data Subject Requests |
It lays out six data subjects' rights, such as right to access, information, object, erasure, restriction, rectification, and portability. |
Storage |
It requires data controllers to inform data subjects, prior to or at the time of the collection of personal data, about the retention period of their personal data or an expected time period if stating the exact retention period isn't possible. |
Lawful Basis for Processing Data |
PDPA outlines six legal bases for the collection and processing of personal data. These bases include, among other things, consent, the performance of a contract or legal obligations, or by legitimate interest of the Data Controller. The legal bases of processing personal data and sensitive personal data are different. |
Cross Border Data |
PDPA prescribes that personal data may not be transferred outside of Thailand, unless the recipient country has adequate personal data protection standards in the Commission's view and the transfer is in accordance with the rules prescribed by the Commission. There is no specific data localization requirement under the PDPA. |
Data Security |
"It requires data controllers to ensure appropriate security measures for the protection of data against loss, misuse, alteration, edit or disclosure by means of unlawful access. Such security measures must be subject to periodic review. " |
Breach Response |
It demands data controllers and processors to notify the breach of the Commission within 72 hours, and to the affected individuals in case of high risk to their rights and freedom. |
| Singapore’s Personal Data Protection Act (PDPA) | |
|---|---|
Notice at Point of Collection |
It requires organizations to provide individuals with privacy notices, notifying them about the collection and processing of their data, purpose of processing, and their respective rights. |
Consent |
PDPA requires express consent or deemed consent by individuals to process their personal data. There are certain exceptions to the consent requirements. An individual may at any time withdraw any consent given, or deemed given under the PDPA, upon giving reasonable notice to the organization. |
Data Subject Requests |
It gives individuals the right to give or withdraw consent, to access, correct, and data portability. |
Storage |
It specifies no exact time period for data retention except that organizations must remove any personal data if it has fulfilled its intended purpose. |
Lawful Basis for Processing Data |
PDPA provides the following legal bases for the processing of personal data of individuals: consent or deemed consent, contractual obligations, legal obligations, interests of individuals, public interests, legitimate interests of individuals, etc. |
Cross Border Data |
It states that organizations must not transfer personal data to a country or territory outside Singapore except in accordance with the requirements prescribed under the PDPA. |
Data Security |
It requires organizations to implement necessary security measures to protect data from harm and unauthorized access, modification, copying, and duplication. |
Breach Response |
It requires organizations to conduct assessment in a reasonable manner if the data breach is notifiable or not and in case if it is notifiable, the organization must notify relevant authorities and affected individuals. |
| Canadian Privacy Law (PIPEDA) | |
|---|---|
Notice at Point of Collection |
PIPEDA requires that identified purposes for the collection of personal information should be specified to the individual concerned at the time or before the time of collection, in writing or orally, depending on the way in which information is collected. |
Consent |
It demands opt-in consent for the processing of personal information unless the personal information of the individual is publicly available and organizations must obtain a fresh consent for a separate purpose of processing. |
Data Subject Requests |
It lays out limited rights such as the right to access personal information, the right to challenge accuracy, right to erasure, right to object, right to data portability, and right to not be discriminated against due to the exercise of their rights. |
Storage |
As per Principle 5 of PIPEDA, personal information must only be kept as long as required to serve those purposes. PI that is no longer required to fulfill the identified purposes should be destroyed, erased, or made anonymous. Organizations shall develop guidelines and implement procedures to govern the destruction of personal information. |
Lawful Basis for Processing Data |
It doesn't define any legal basis for data collection but it requires organizations to collect consent prior to the collection, use, or disclosure of personal information, unless an exception applies. |
Cross Border Data |
It establishes a comprehensive set of rules governing international data transfer, such as security standards, accountability, and transparency for providing the transferred personal information retains a comparable level of protection and the transferring organizations remain responsible for personal information transferred to third parties. |
Data Security |
PIPEDA Principle 7 demands organizations to ensure security measures to protect data from unauthorized copying, duplication, theft, and alteration of data. |
Breach Response |
It requires organisations to notify the OPC and affected individuals as soon as possible after a breach has been discovered which creates a real risk of significant harm to the individual. |
| Saudi Arabia’s Personal Data Protection Law (PDPL) | |
|---|---|
Notice at Point of Collection |
PDPL requires that data controllers must adopt a personal data privacy policy (notice), and make it available to data subjects to review before collecting their personal data. |
Consent |
PDPL requires that data controllers must not process personal data without the consent of its owner except for the cases stipulated under the Regulations (yet to be issued). Data subjects may withdraw their consent to the processing of personal data at any time. |
Data Subject Requests |
It provides data subjects the rights to be informed, to object, to restrict or limit the processing, to access, to correct or update, or to require destruction of data if it is no longer required. |
Storage |
It doesn't specify any storage limitation regulations. |
Lawful Basis for Processing Data |
It doesn't define any legal basis for data collection but it requires organizations to choose and outline the purposes for which the data will be collected and processed. |
Cross Border Data |
It lays out a stringent cross-border data transfer regulations restricting data controllers from any international data transfer unless it meets certain conditions. |
Data Security |
Data controllers are required to take appropriate technical and organisational measures to safeguard personal data. |
Breach Response |
It requires data controllers to notify the supervising authority and the affected data subject about any data leakage, breach or unauthorized access. |
Conclusion
The potential downsides of non-compliance can have severe consequences for a business. As companies grow and begin to cater to additional customers from across the globe, the wide range of complex and ever-changing data privacy regulations means companies must stay compliant to avoid penalties.
Complying with global data privacy regulations is crucial if you’re serious about growing your business, gaining user trust, and adapting to a modernized approach towards the company’s internal and external processes.
Join Our Newsletter
Get all the latest information, law updates and more delivered to your inbox
At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.
Copyright © 2022 Securiti · Sitemap · XML Sitemap
Newsletter
Get in touch
[email protected]
3031 Tisch Way Suite 110 Plaza West, San Jose,
CA 95128
