Most of the main markets now have a general data protection law, but they differ in reach, maturity and enforcement. The EU GDPR and UK GDPR are the longest established; India's DPDP Act and Saudi Arabia's PDPL reach businesses outside the country that target local individuals; the UAE has a federal law alongside separate regimes in the DIFC and ADGM; and in the US the general privacy rules researched are state laws such as California's CCPA. India's main obligations start on 13 May 2027, so the months before then are the preparation window.
Which law applies to a business abroad
Extraterritorial reach is now common. India's DPDP Act applies to processing outside India connected with offering goods or services to individuals in India, and Saudi Arabia's PDPL applies to organisations outside the Kingdom that process the data of individuals located there. A group selling online into these markets can therefore be subject to several laws for the same customer database.
The UAE federal PDPL has been in force since 2 January 2022 but does not apply to free zones with their own data protection laws, such as the DIFC and ADGM, nor to health or banking data covered by sector laws. Singapore's PDPA sets a baseline for private-sector organisations. In the UK, the Data (Use and Access) Act 2025 amends the UK GDPR rather than replacing it. In the US, California's CCPA applies to businesses above revenue or data-volume thresholds; it is a state law, not federal.1234567
Dates and pending changes
India's DPDP Rules 2025 were phased: consent manager rules start on 13 November 2026 and most operational duties on 13 May 2027. In January 2026 the ministry consulted on cutting the transition to 12 months, which was a proposal only. In Saudi Arabia, SDAIA opened consultation on 6 October 2026, running to 5 November 2026, on draft amendments that would require controllers to store personal data in the Kingdom.
Enforcement risk is highest in Europe. Under the GDPR as applied in France, fines reach EUR 10 million or 2% of worldwide turnover, and EUR 20 million or 4% for the most serious breaches, whichever is higher.891011
| Market | Law | Reach or status | Source |
|---|---|---|---|
| EU (France, Germany) | GDPR | Fines up to EUR 20 million or 4% of worldwide turnover | CNIL |
| United Kingdom | UK GDPR and Data Protection Act 2018, amended by the Data (Use and Access) Act 2025 | Amended, not replaced | GOV.UK |
| India | Digital Personal Data Protection Act 2023 and Rules 2025 | Applies to offshore processing targeting India; main duties from 13 May 2027 | India Code; Rules |
| Saudi Arabia | Personal Data Protection Law | Applies to processing abroad of data of individuals in the Kingdom; localisation amendments in consultation | Secondary sources |
| United Arab Emirates | Federal Decree-Law No. 45 of 2021 | In force since 2 January 2022; excludes DIFC, ADGM and sector-regulated data | UAE Legislation |
| Singapore | Personal Data Protection Act 2012 | Baseline for private-sector organisations | PDPC |
| United States (state) | State laws such as the CCPA (California) | California thresholds: USD 25 million revenue or 100,000 consumers or households | California Attorney General |
Decisions to make
- Do we offer goods or services to individuals in India or Saudi Arabia, even from abroad?12Both laws reach offshore processing of local individuals' data.
- In the UAE, are we onshore, in the DIFC or ADGM, or in another free zone?4The federal PDPL does not apply in free zones with their own data protection law.
- Are we ready for India's 13 May 2027 commencement, and could it come earlier?89A January 2026 proposal would have moved the deadline to 13 November 2026.
- Which US states' thresholds do we meet?7The CCPA is a state law that applies by revenue or data volume thresholds.
Documents usually needed
- Record of processing activities by market and data category
- Privacy notices tailored to each law's content requirements
- Data protection officer or local representative appointment where required
- Data processing agreements with service providers
- Gap analysis against the DPDP Rules and the Saudi PDPL
Common mistakes
- Assuming the GDPR programme automatically satisfies India, Saudi Arabia or the UAE
- Ignoring extraterritorial reach because the company has no local office
- Applying the UAE federal law to a DIFC or ADGM entity, or the reverse
- Treating US privacy as only federal
- Waiting for India's final deadline instead of preparing during the transition
Questions businesses ask
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- The operative articles of the GDPR (including Article 3 on territorial scope and Article 27 on representatives) could not yet be checked from EUR-Lex.
- The number of US states with comprehensive privacy laws was not confirmed on an official source.
- The UAE federal PDPL executive regulations were not confirmed as issued, so its compliance deadline is uncertain.
- Germany-specific rules (for example the BDSG data protection officer threshold) are in the Germany market guide and were not repeated here.
- The status of the EU Digital Omnibus proposals affecting the GDPR was not confirmed.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The Digital Personal Data Protection Act 2023 applies to processing of digital personal data within India and to processing outside India if it is connected with offering goods or services to Data Principals in India. Central law. Section 3 of the Act; section 3 is among the provisions commencing on 13 May 2027.
Commencement date per India Code footnote (eighteen months after 13 November 2025). Reused from market guide claim in-data-001.
The PDPL applies to processing of personal data in the Kingdom and to processing by organisations outside the Kingdom of personal data of individuals located in the Kingdom.
Secondary summary of PDPL Article 2; Article 2 of the official translation was not separately extracted. Reused from market guide claim sa-data-007.
The federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since 2 January 2022. Federal (onshore and free zones without their own data protection law).
Arabic text prevails over the English translation. Reused from market guide claim ae-data-001.
The PDPL does not apply to government data, to health data or banking and credit data that have their own protective legislation, or to companies and establishments in free zones that have their own data protection legislation. Federal PDPL scope; free-zone exclusion covers DIFC and ADGM, which have their own laws.
Reused from market guide claim ae-data-002.
The Personal Data Protection Act 2012 (PDPA) sets a baseline standard for the collection, use and disclosure of personal data by private-sector organisations in Singapore, in electronic and non-electronic form. Generally does not apply to individuals acting in a personal or domestic capacity, employees acting in the course of employment, public agencies, or business contact information.
Reused from market guide claim sg-data-001.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations rather than replacing them. UK-wide. Commenced in four stages between August 2025 and 2026.
The commencement page describes amendments to the existing instruments; the factsheets describe changes article by article to the UK GDPR and DPA 2018. Reused from market guide claim gb-data-001.
The California Consumer Privacy Act applies to for-profit businesses doing business in California that have gross annual revenue over 25 million US dollars, or buy, sell or share personal information of 100,000 or more California residents or households, or derive 50% or more of annual revenue from selling California residents' personal information. State law (California), not federal. Any one threshold is enough. Nonprofits and government agencies are generally not covered. The revenue figure is adjusted for inflation by regulation; the current adjusted figure was not confirmed on the source page.
The Attorney General page states the statutory 25 million US dollar figure. The California Privacy Protection Agency adjusts this figure for inflation; check the Agency's current figure before relying on it. Reused from market guide claim us-data-001.
Under rule 1 of the DPDP Rules 2025, rules 1, 2 and 17 to 21 took effect on publication (13 November 2025), rule 4 takes effect one year later (13 November 2026) and rules 3, 5 to 16, 22 and 23 take effect eighteen months later (13 May 2027). Central rules. Rule 4 concerns consent managers; rules 3 and 5 to 16 contain most operational duties of data fiduciaries.
Secondary source used because the MeitY and Gazette pages could not yet be checked. Consistent with the PIB 18-month statement and the India Code commencement footnotes. Reused from market guide claim in-data-003.
In January 2026 MeitY consulted stakeholders on shortening the DPDP compliance window from 18 to 12 months, which would move the main deadline to 13 November 2026; this was a proposal and had not been reported as notified. Proposal only. The same consultation proposed bringing significant data fiduciary transfer restrictions into effect immediately.
Secondary. A law-firm article updated 8 September 2026 still gave 13 May 2027 as the main commencement date. MeitY's 7 October 2026 Removal of Difficulties Order made only textual corrections to sections 9 and 10 and did not change dates (India Briefing). Pending change: check the Gazette. Reused from market guide claim in-data-014.
On 6 October 2026 SDAIA opened public consultation, until 5 November 2026, on draft amendments to the PDPL Implementing Regulations that would require controllers to store personal data in the Kingdom and remove the harm threshold for breach notification to SDAIA. Draft only, not in force. If adopted, the amendments take effect 60 days after publication in the Official Gazette. Transfers abroad would remain possible under the PDPL and its regulations.
Pending change. Secondary source; the consultation documents on the Istitlaa platform could not yet be checked. Reused from market guide claim sa-data-012.
Under the ordinary sanction procedure, the CNIL can impose fines of up to EUR 10 million or 2% of annual worldwide turnover, rising to EUR 20 million or 4% for the most serious breaches, and compliance orders with penalties of up to EUR 100,000 per day of delay. Applies to companies; the higher of the fixed amount and the turnover percentage applies under the GDPR. The CNIL can also restrict or ban processing, suspend data flows to third countries and publish its decision.
Reused from market guide claim fr-data-003.
Questions on this topic
11 statements on data protection laws compared
