Wondering what rights you have over your personal data? Under data privacy laws around the world, you can usually access, correct and delete your data, but the details depend on where you live.
This guide is part of our coverage of technology and society.
| Item | Value |
|---|---|
| Countries with a data privacy law in force (Privacy Laws & Business count, March 2025) | 172 |
| US states with comprehensive consumer privacy laws (as of July 2026) | 24 enacted, 20 in effect |
| Maximum GDPR fine | Up to €20 million or 4% of global revenue |
| GDPR data breach reporting window | 72 hours |
| China’s PIPL effective date | November 1, 2021 |
| California CCPA revenue threshold (as of January 1, 2025) | $26,625,000 |
These figures come from CDP’s glossary on data privacy regulations and Sherpa’s guide to global data protection laws. Laws and thresholds change, so check the source before you rely on them.
How many countries have data privacy laws?
The answer depends on who is counting. Privacy Laws & Business counted 172 countries with a law in force as of March 2025, according to CDP. A Forcepoint post updated in November 2026 points to an IAPP overview of laws in effect in 144 countries.
Other trackers land lower. A September 2025 guide reports 137 countries with national laws, covering 79.3% of the world’s population. A guide updated in March 2026 says over 140 countries have enacted laws.
Whichever count you trust, the direction is the same: most countries now have some form of privacy law, and many borrow ideas from Europe.
The EU’s GDPR: the model many laws copy
The General Data Protection Regulation took effect in May 2018. As a Forcepoint post puts it, since 2018 data protection has shifted from a European event to a permanent global reality.
Its reach goes beyond Europe. According to Sherpa, it applies to organizations anywhere that target or collect data related to people in the EU.
The rules rest on a few core principles, as described by CDP:
- The purpose of processing must be specified when the data is collected.
- Organizations should only collect as much data as needed for that purpose.
- Data can’t be kept any longer than needed for that purpose.
For you, the main rights include access to your information and the ability to seek compensation for damages. Companies face fines of up to €20 million or 4% of global revenue, and breaches must be reported within 72 hours, per Sherpa.
The EU and UK share a common origin, but the Forcepoint post notes that, as of its November 2026 update, their data protection laws are beginning to move on slightly different paths.
The United States: your rights depend on your state
The United States has no federal comprehensive privacy law. Instead, 24 states have enacted comprehensive consumer privacy laws, and 20 of them were in effect as of July 2026, according to CDP.
California led the way. Its CCPA took effect on January 1, 2020, and the CPRA, effective January 1, 2023, created the California Privacy Protection Agency as a dedicated enforcement body, per Kindatechnical. The CCPA gives California consumers five primary rights:
- Know what personal information is collected, used, shared or sold.
- Delete personal information.
- Opt out of the sale or sharing of personal information.
- Non-discrimination for exercising these rights.
- Correct inaccurate personal information.
Most other states follow the Virginia model, which grants rights to access, correct, delete and opt out of sale, targeted advertising and profiling, according to CDP. Whether a state law applies to a business usually depends on how many residents’ data it handles, not where it is based: most state laws set the line at 100,000 residents, or 25,000 if the business earns revenue from selling data.
California’s revenue threshold is $26,625,000 as of January 1, 2025, rather than the $25 million in the original statute. A CCPA regulation package that took effect January 1, 2026 also requires businesses to give consumers a way to confirm that an opt-out request, including one sent through the Global Privacy Control, was honored. In CDP’s October 2026 page, the automated decision-making provisions become operative January 1, 2027.
Brazil, China, India and Canada: similar ideas, local rules
Many non-European countries now have GDPR-inspired laws, including Brazil’s LGPD, South Africa’s POPIA, China’s PIPL and India’s DPDP, according to Forcepoint. They share familiar ideas such as lawful bases, access and deletion rights and breach notification, but scope, definitions and penalties differ.
Brazil
The LGPD establishes ten legal bases for processing. Data subjects have rights including confirmation of processing, access, correction, anonymization or deletion of unnecessary data, and data portability. The national authority, the ANPD, has seen its administrative sanctions regulation take effect in 2023, per Kindatechnical.
China
China’s PIPL is a comprehensive data protection framework that was effective November 1, 2021, according to Kindatechnical. The same guide says it lists seven legal bases for processing.
Its cross-border transfer rules are notably stricter than the GDPR’s. Organizations need a security assessment, filed standard contractual clauses or certification, and they must also obtain separate consent for transfers.
Canada
PIPEDA applies to private-sector organizations operating in Canada that conduct commercial activity and handle personal information. Businesses must follow 10 principles similar to those under the GDPR, and Canada also has a separate Privacy Act, per CDP.
How your rights differ by region
Across regions, the common core is a right to know what is held about you and to ask for corrections or deletion. The differences lie in who enforces the law, how strict transfer rules are and whether you must opt in or opt out.
| Law | Region | Distinctive feature |
|---|---|---|
| GDPR | European Union | Purpose must be specified when data is collected |
| CCPA and CPRA | California, US | Dedicated regulator, the California Privacy Protection Agency |
| LGPD | Brazil | Ten legal bases for processing |
| PIPL | China | Separate consent for cross-border transfers |
| PIPEDA | Canada | 10 principles for private-sector organizations |
The table draws on CDP’s glossary and Kindatechnical’s guide, updated in March 2026. Laws change, so check the sources before you rely on it.
Forcepoint describes stronger enforcement as a global trend, with authorities gaining more powers, higher penalty ceilings and broader definitions of personal data. It also notes that data localisation rules are increasingly prescriptive.
AI is now part of the picture too: the same post says new AI regulations, including the EU AI Act, are tightly linked to data protection obligations. How AI uses personal data also feeds wider debates such as the ai impact on jobs.
Privacy laws govern how your data is handled, not whether online content is true, which is a separate issue covered in misinformation vs disinformation.
How to use your privacy rights
The exact process varies, but these steps apply in most places:
- Work out which law covers you, starting with where you live. For US state laws, remember that coverage also depends on the business’s size and customer footprint.
- Ask the organization what personal data it holds about you, since access rights appear in the GDPR, the CCPA and Brazil’s LGPD.
- Request correction or deletion where your local law grants it.
- In California, use an opt-out preference signal such as the Global Privacy Control, which must be honored as a valid opt-out request.
- Check the regulator’s current guidance, because these laws are updated often.
Frequently asked questions
Do all countries have a data privacy law?
Show answer
No. Counts range from 137 to 172 countries depending on the tracker and date, so a large share of countries have laws, but not all. Check a recent tracker for your country.
Does the GDPR apply to companies outside Europe?
Show answer
Yes, if they target or collect data related to people in the EU. Its scope is not limited by where the company is located.
Is there a US federal privacy law?
Show answer
As of CDP’s October 2026 page, the United States has no federal comprehensive privacy law. Rules come from the states, where 24 had enacted comprehensive laws and 20 were in effect as of July 2026.
How fast must a data breach be reported under the GDPR?
Show answer
Within 72 hours, according to Sherpa’s September 2025 guide. Fines can reach €20 million or 4% of global revenue.
