Global privacy laws directory

Official statutes and regulatory guidance are the source of truth. These pages summarize scope, consumer rights, and practical compliance themes so you can orient faster—then validate details with counsel and your regional authority.

No. Compliance depends on your processing activities, contracts, technical controls, and documentation. Use this directory to prioritize work; pair it with a consent management platform, governance workflows, and expert review where risk is high.

Start where you have users, employees, or paid acquisition: EU GDPR (and EEA markets such as Norway) where you have visitors in those countries, UK GDPR separately if you have UK users, US state laws where applicable, LGPD for Brazil, and sector-specific rules if you handle health or financial data. Your analytics and signup locations usually signal the first pass.

No. The United Kingdom left the European Union (Brexit). EU GDPR governs processing in the EU and, through the EEA Agreement, in the EEA. The UK operates its own framework: UK GDPR (retained and amended EU law) together with the Data Protection Act 2018. If you have users in both the EU/EEA and the UK, you should treat them as separate compliance scopes and validate transfers and roles (e.g. importer/exporter) with counsel.

Review at least when you launch new products, enter new markets, change data flows, or when regulators publish major updates. Subscribing to a compliance blog and maintaining an internal change log makes revisits much easier.