Privacy law is no longer one jurisdiction’s problem. A single online business can collect data from customers in Europe, the UK, California, Canada, Brazil, and Australia on the same day, and each of those customers brings their own law with them. The good news: the laws share the same DNA, so one well-built privacy program covers most of the work. This hub maps the six major regulations, shows how they overlap, and points to a full step-by-step guide for each one.
The Privacy Law Map
Before diving into any single law, understand the logic of the whole system. Every major privacy law follows the same pattern: it protects the residents of its jurisdiction, no matter where your business sits. You trigger GDPR by having customers in the EU, not by being in the EU. You trigger LGPD by serving people in Brazil, not by being in Brazil.
That extra-territorial reach is why a small online store can owe obligations to five different regulators. The second pattern is convergence: consent, transparency, data minimization, breach notification, and individual access rights appear in every regime. Learn one law properly and the others become translation exercises, with local variations on legal bases, deadlines, and penalties.
GDPR (EU and EEA)
The EU General Data Protection Regulation is the strictest major privacy law and the model most others copied. It applies to any business offering goods or services to people in the EU or monitoring their behavior, regardless of location.
- Six lawful bases for processing, with consent, contract, and legitimate interests doing most of the work
- Strong data subject rights: access, erasure, portability, objection
- Breach notification to authorities within 72 hours when there is a risk to people
- Fines up to 4% of global turnover or EUR 20 million, whichever is higher
- International transfers via EU adequacy decisions, the EU-US Data Privacy Framework, or standard contractual clauses
If you build your compliance to GDPR standard, every other law in this hub is an adjustment rather than a rebuild.
UK-GDPR
Brexit forked the GDPR. Since January 1, 2021, the UK-GDPR has protected UK residents separately, enforced by the ICO, and it evolves independently from EU law. The rules look familiar, but the transfer mechanics are different: the UK has its own adequacy list, its own International Data Transfer Agreement, and the UK-US Data Bridge for certified US companies. If you serve both EU and UK customers, you comply with both laws at once. Full walkthrough: UK-GDPR Compliance Guide.
CCPA and CPRA (California)
California’s regime is the closest thing the US has to GDPR, with its own character. It applies to for-profit businesses that meet a size test: annual gross revenue above roughly $25-27 million (adjusted each year), or handling personal information of 100,000 or more California consumers or households, or making 50% or more of revenue from selling or sharing personal information. Most small businesses are exempt today, but the thresholds deserve a yearly check.
- Rights to know, delete, correct, and opt out of sale or sharing
- A visible “Do Not Sell or Share My Personal Information” link for covered businesses
- 45 days to respond to requests, extendable to 90
- Enforced by the California Privacy Protection Agency
California does not have a dedicated guide here yet; the platform guides below cover the CCPA setup for Shopify, WooCommerce, and Webflow stores.
PIPEDA and Quebec Law 25 (Canada)
Canada’s PIPEDA has protected private-sector personal data since 2004 and organizes everything around ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use and retention, accuracy, safeguards, openness, individual access, and challenging compliance. Breaches that pose a real risk of significant harm must be reported to the OPC and affected individuals as soon as feasible, and records of every breach are required.
Watch the provincial layer: Alberta and British Columbia have their own private-sector laws, and Quebec’s Law 25 is widely considered the strictest privacy regime in Canada, with privacy officers, impact assessments, and tougher consent rules. Full walkthrough: PIPEDA Compliance Guide.
LGPD (Brazil)
Brazil’s LGPD, effective since September 2020 and enforced by the ANPD, applies to any organization processing data of people in Brazil, including foreign businesses. Its biggest difference from GDPR is the legal basis list: ten bases under Article 7 instead of six, including credit protection, which is unique to Brazil. Controllers must designate and publish an encarregado (DPO) with no size exemption, and fines reach 2% of revenue earned in Brazil, capped at BRL 50 million per violation. Full walkthrough: LGPD Compliance Guide.
Australian Privacy Act and APPs
Australia’s Privacy Act 1988 organizes compliance around 13 Australian Privacy Principles covering openness, collection, use, disclosure, direct marketing, cross-border transfers, security, access, and correction. The Notifiable Data Breaches scheme requires notifying the OAIC and affected individuals when a breach is likely to result in serious harm.
The key 2026 development: the small business exemption (turnover under AUD 3 million) is scheduled to end, with recent reporting pointing to December 10, 2026, bringing roughly 2.5 million more businesses under the full 13 APPs. Plan as if the APPs apply to you today. Full walkthrough: Australian Privacy Act Guide.
Platform-Specific Setup Guides
Laws set the rules, but compliance happens inside your tools. If your business runs on one of the major e-commerce or website platforms, start with the guide that matches your stack:
- Shopify GDPR and CCPA guide: consent banner, customer privacy settings, DSAR handling, app audits
- WooCommerce GDPR guide: WordPress core tools, personal data retention, plugin audits, erasure vs retention
- Webflow privacy guide: consent management, forms and CMS data, controller vs processor roles
Which Laws Apply to You?
Run this quick self-assessment:
- Do you sell to or track people in the EU or EEA? Then GDPR applies to you.
- Do you sell to or track people in the UK? Then UK-GDPR applies to you, even if you already comply with GDPR.
- Do you have California customers and meet the size thresholds? Then CCPA/CPRA applies.
- Do you do business with Canadians? PIPEDA, or a provincial law where you operate or they live.
- Do you serve people in Brazil? LGPD applies, no matter where you are.
- Do you handle Australians’ personal information? The Privacy Act applies, and the small business exemption is going away.
Multiple answers of “yes” are normal. That is the point of this hub: the same underlying program, adjusted per jurisdiction.
Compliance Order of Operations for a New Business
Do not try to comply with six laws at once. The order that works:
- Map where your customers actually are. This determines which laws you truly owe.
- Inventory the personal data you collect and where it lives.
- Collect less. Cut fields, old lists, and tracking you do not need. This one step reduces every other obligation.
- Build GDPR-grade processes first: privacy policy, consent, access and erasure workflows, breach plan. GDPR is the strictest common denominator.
- Adjust for the other regimes you triggered: UK transfer rules, LGPD’s legal bases and encarregado, California’s opt-out link, Australia’s APP notices.
- Sign DPAs with your platforms and tools, and audit what each one does with data.
- Revisit quarterly. Laws, thresholds, and your own data flows all change.
Privacy compliance is not a certificate you earn once. It is a small set of habits, and the businesses that treat it that way are the ones that sleep well when the next enforcement headline drops.
Not sure where to start?
Start with the platform you actually run. Each setup guide walks through the exact settings, in order, with checklists you can finish in an afternoon.
About The Author
