Global data protection and privacy regulations: a status update for multinational companies

As data protection regulations continue to evolve across the globe, multinational companies face an increasingly complex compliance landscape. From the EU’s General Data Protection Regulation (GDPR) to emerging privacy laws in the U.S., Asia, and beyond, keeping pace with these frameworks is both a legal necessity and a strategic imperative. This article provides an in-depth status update on key regulations, practical strategies for compliance, and insights into future trends shaping the data privacy landscape.

1. Overview of key regulations

EU: GDPR – The Gold Standard

Since its implementation in 2018, the General Data Protection Regulation (GDPR) has set the benchmark for data privacy laws worldwide. It mandates strict requirements on data handling, transparency, and consumer rights, with fines reaching up to €20 million or 4% of annual global turnover, whichever is higher. Enforcement trends show increasing scrutiny, with over €4 billion in fines issued as of 2025, including major penalties against Meta and Amazon.

Key elements include:

• Data subject rights: access, rectification, erasure, and portability.
• Accountability: documentation of processing activities and Data Protection Impact Assessments (DPIAs).
• Cross-border data transfers: Standard Contractual Clauses (SCCs) and the new EU-U.S. Data Privacy Framework.

UK: Post-Brexit Divergence

Following Brexit, the UK Data Protection Act 2018 (mirroring GDPR) governs data privacy in the region. However, the UK is increasingly charting its own course. The Data Use and Access Bill is the second attempt at modernising the UK’s data protection regime to grant more flexibility (e.g. simplifying compliance for SMEs or providing more certainty for the use of LIAs) and better balance the facilitation of data-driven innovation with the safeguarding of individual rights.

U.S.: State-level privacy patchwork

In the absence of a federal privacy law, the U.S. privacy landscape is fragmented, with state-level regulations leading the charge.

Key frameworks include:

• The California Consumer Privacy Act (CCPA): grants consumers rights over their data and imposes disclosure and opt-out obligations on businesses.
• The California Privacy Rights Act (CPRA): enhances CCPA protections (e.g. around sensitive information), introduces new consumer rights (e.g. to correct inaccurate records), and creates the California Privacy Protection Agency (CPPA).

Other states: Virginia, Colorado, Connecticut, and Utah have implemented their own privacy laws, with more states following suit in 2025. Enforcement actions have resulted in multi-million-dollar settlements, with companies facing increased legal risks.

Brazil: LGPD – Latin America’s GDPR

Brazil’s Lei Geral de Proteção de Dados (LGPD) mirrors GDPR principles, requiring lawful, transparent data processing. Enforcement by the National Data Protection Authority (ANPD) is ramping up, with fines reaching 2% of a company’s revenue, capped at 50 million BRL per violation.

Asia and the Middle East: emerging frameworks

China’s Personal Information Protection Law (PIPL): Regulates cross-border data transfers and mandates stringent consent requirements, but grants broad state access to data.

The UAE’s Federal Data Protection Law is aligned with GDPR principles but includes sectoral exemptions and shows business -friendly compliance requirements.

India’s Digital Personal Data Protection Act is a much lighted framework than GDPR, which is therefore less protective of individual rights for now.

2. Cross-border compliance challenges

Navigating the patchwork of global regulations poses significant challenges for multinational companies.

Data transfer mechanisms

• Standard Contractual Clauses (SCCs): they are essential for EU-based data transfers to third countries. Companies should conduct Transfer Impact Assessments (TIAs) to evaluate the risk of data interception and processing in recipient countries. Regularly updating SCC templates in line with the latest guidance is recommended.
• Binding Corporate Rules (BCRs) are a robust but resource-intensive mechanism for internal corporate data transfers. Companies should prepare for multi-year approval processes and allocate sufficient legal resources.
• The EU-U.S. Data Privacy Framework was introduced in 2023 and facilitates compliant data flows between the EU and U.S., replacing the invalidated Privacy Shield. Companies relying on this framework should establish internal monitoring mechanisms to ensure ongoing compliance (and the current validity of the framework !).

Varying enforcement and Penalties

• EU fines: large-scale fines (e.g. Meta’s €1.2 billion fine for data transfers to the U.S. without adequate safeguards) demonstrate stringent enforcement.
• U.S. class actions: under the CCPA, companies face the risk of costly class-action lawsuits, especially for data breaches. Average settlements range between $5 million and $10 million.
• APAC and LATAM: increasing regulatory scrutiny and enforcement activity in these regions pose growing compliance risks. Companies should monitor local court decisions for evolving interpretations.

Practical strategies for multinational compliance

To maintain compliance across jurisdictions, multinational companies can implement the following strategies.

Conduct Global Compliance Audits

Regular audits help identify data privacy gaps. Key steps include:

• Mapping data flows across regions, including hidden or shadow data repositories, which companies often overlook.
• Assessing third-party contracts for compliance with regional laws, with specific attention to vendor sub-processors and their jurisdictions.
• Using data discovery tools: automated solutions (e.g., OneTrust, BigID) can help identify unstructured data, such as email attachments, which are often missed in manual audits.
• Verifying access controls: ensure that privileged access rights are properly restricted and regularly reviewed to prevent unauthorized data access.
• Testing incident response plans: simulate data breaches during audits to assess the organisation’s readiness and identify weaknesses.

Maintain a Centralized Data Inventory

A unified data inventory ensures visibility into data processing activities across jurisdictions. Benefits include:

• Efficient reporting for regulatory inquiries.
• Enhanced tracking of cross-border data flows.
• Tagging data by sensitivity levels (e.g. personal data, health data, sensitive data) to prioritise protection efforts.
• Automated tools (e.g., OneTrust, TrustArc) can streamline inventory management.

Appoint Local Data Protection Officers (DPOs)

Having local DPOs or privacy representatives ensures jurisdiction-specific compliance expertise and enables rapid responses to regulatory requests. Establishing clear lines of communication between DPOs and legal and operational teams improves coordination efforts and timely responses to regulators.

Implement Privacy by Design

Embedding privacy into product and service development reduces compliance risks. Key practices include:

• Data anonymisation and pseudonymisation.
• Regular privacy impact assessments (PIAs).
• Embedding consent management platforms (CMPs) into websites and apps.
• Redacting personal data in development and testing environments to minimise risk.

Ongoing Staff Training and Awareness

Regular privacy training ensures employees understand data handling obligations. Best practices include:

• Scenario-based training for realistic application.
• Frequent updates on evolving regulations.
• Simulated breach exercises to enhance incident response preparedness.
• Future regulatory trends and insights.

Future regulatory trends

Expansion of AI Regulations

The growing adoption of AI is driving new regulatory frameworks. The 2025 EU’s AI Act has introduced compliance obligations, including:

• Risk-based categorization of AI systems.
• Transparency and Accountability principles, with specific disclosure requirements.
• Human oversight requirements.

In case of breach, penalties of up to €30 million or 6% of turnover can be imposed !

Industry-Specific Regulations

Sectors such as healthcare, finance, and technology face increasing scrutiny. For instance, the U.S. FTC’s Health Breach Notification Rule applies stricter reporting obligations and Fintech firms have been under enhanced supervision for their data privacy practices.

Convergence of Privacy and Cybersecurity

Privacy and cybersecurity regulations are increasingly intertwined. Companies are integrating privacy-by-design principles with robust security protocols to reduce breach risks and enhance compliance.

Conclusion

As global data protection regulations continue to evolve, multinational companies must adopt proactive compliance strategies. By conducting thorough audits, streamlining cross-border data transfers, and implementing privacy-first practices, organisations can effectively navigate this complex regulatory landscape. Looking ahead, keeping pace with emerging trends such as AI regulations and industry-specific privacy frameworks will be key to maintaining compliance and fostering consumer trust.