A note before starting
This article describes the general shape of data protection laws. It is not legal advice, and it does not tell you what applies to your organization. Laws differ by country, region and industry, they are amended, and courts and regulators interpret them over time. For a real decision, ask someone qualified in your jurisdiction.
Why so many laws exist
There is no single worldwide privacy law. Many countries have a comprehensive law covering most personal data, some regions have their own, and others rely on a patchwork of rules for particular sectors such as health, finance or children’s services. A few well-known examples are the European Union’s General Data Protection Regulation (GDPR) and various state laws in the United States, but dozens of other national and regional laws exist, and the details differ.
Despite the variety, many of these laws borrow from the same older ideas, such as fair information principles developed in the second half of the twentieth century. That is why a team that understands the common structure can read most new laws without starting from zero.
Who and what a law covers
Most laws start by defining their scope. Three questions come up repeatedly.
Whose data? Some laws protect people who are in a certain place, some protect residents or citizens, and some apply to anyone whose data is processed by a covered organization. Rules about location can lead to an organization being covered by a law from a place where it has no office.
Which organizations? Some laws apply to nearly every organization that handles personal data. Others apply only above certain size or data-volume thresholds, or to specific kinds of business. Exemptions often exist for purely personal or household activity, and sometimes for government or law enforcement.
What kind of data? Laws turn on a definition of personal data or personal information. The definitions vary in detail, but most cover information that identifies a person or could reasonably be linked to one. Many also create a stricter tier for sensitive categories. The article on what counts as personal data goes through the idea in more depth.
Common roles
Many laws distinguish between the organization that decides why and how data is used and the organization that processes it on that organization’s behalf. The first is often called a controller (or a business), and the second a processor (or a service provider). The distinction matters because duties differ: the decision-maker usually carries primary responsibility, while processors must follow instructions and protect the data. When data is handled by outside vendors, a written contract is typically expected, which is where IT outsourcing and third-party sharing arrangements meet privacy law.
Typical obligations
Without quoting any one law, the duties placed on organizations tend to fall into familiar groups.
- A lawful reason to use data. Some laws require a recognized legal basis, such as consent, a contract or a legitimate interest. Others focus more on notice and the right to opt out.
- Transparency. Telling people what is collected, why and who it is shared with.
- Purpose limits and data minimization. Using data only for stated purposes and collecting no more than needed.
- Security. Taking reasonable or appropriate measures to protect data. Laws rarely list specific technologies, which is why general good practice such as data encryption and access management is usually the reference point.
- Retention limits. Not keeping data longer than necessary.
- Records and accountability. Documenting what is done and, for higher-risk activity, carrying out impact assessments.
- Breach notification. Telling regulators and sometimes affected people when certain incidents occur, often within a set time. Your incident response process needs to account for these deadlines.
- Rules for transfers. Some laws restrict sending data across borders unless safeguards are in place.
Rights for individuals
Modern laws often grant people rights over their own information. The exact list varies, but commonly includes the right to:
- know what data is held and receive a copy
- correct inaccurate data
- request deletion in some circumstances
- object to or limit certain uses, such as direct marketing
- move data to another provider in some cases
Organizations usually must respond within a set period, and may refuse in specific situations. The practical side of this is covered in the article on handling data subject requests.
Enforcement
Regulators typically oversee compliance. Their powers may include investigating complaints, ordering changes, and imposing fines, with the maximum amounts varying widely between laws. Individuals may also be able to bring claims in some places. Consequences are not only financial: loss of customer trust and operational disruption can matter just as much.
Sector rules and contracts
Beyond general privacy laws, some industries face their own rules, for example for health records, payment card data or education records. Customers may also impose requirements by contract, such as security questionnaires or audit rights. Together these form the compliance picture an organization has to manage under its IT governance and risk assessment work.
What this means for IT staff
You do not need to memorize statutes. It is more useful to:
- Know who in your organization is responsible for privacy and legal questions.
- Know where personal data lives, so requests and incidents can be handled.
- Build good habits, such as least privilege, deletion on schedule and careful vendor choices, which satisfy the spirit of nearly every regime.
- Bring privacy questions into projects early, before systems are built.
Regulations change, so treat any summary, including this one, as a starting point for asking better questions.