IT Compliance Hub

Data Privacy & Protection

Privacy laws and standards for companies that handle personal data: GDPR, UK GDPR, CCPA/CPRA, US state laws, COPPA and FERPA for EdTech, ISO 27701, and the main laws outside Europe and the US.

  • 5 guides in this area
  • Mandatory and voluntary clearly labelled
  • Official sources in every guide
Where to start

Which one do you need?

Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.

If this is youStart withType
You have users or customers in the EUGDPR Law / regulation
You have users in California or other US statesCCPA / CPRA Law / regulation
You process personal data of people in IndiaDPDP Act Law / regulation
You want a certificate for your privacy programmeISO 27701 Certifiable standard
All guides

Data Privacy & Protection guides

Law / regulation USA

CCPA / CPRA

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020

The CCPA, as amended by the CPRA, is California's comprehensive privacy law. It applies to for-profit businesses anywhere that collect California residents' personal information and meet a revenue or data-volume threshold. It gives consumers rights to know, delete, correct and opt out of the sale or sharing of their data, requires specific contracts with service providers, and since 2026 adds rules on automated decision-making, risk assessments and cybersecurity audits.

Mandatory: Mandatory for businesses that meet the thresholds

Quick facts
What it covers
Personal information about California residents, including employees and B2B contacts, collected by businesses and handled by their service providers and contractors.
Who needs it
For-profit businesses above revenue/data thresholds handling California residents' data
Why it matters
Many SaaS and IT companies either meet the thresholds themselves or act as service providers to businesses that do, and US customers expect CCPA-compliant contract terms.
Key requirements
  • Notice at collection and a privacy policy updated at least yearly
  • Rights to know, delete, correct, and opt out of sale or sharing
  • Right to limit use of sensitive personal information
  • Honour Global Privacy Control browser signals as opt-outs
  • Service provider and contractor contracts with required terms
  • Reasonable security; data breach private right of action
  • Risk assessments, cybersecurity audits and ADMT rules phased in from 2026
Where it applies
California, USA (applies to businesses anywhere that handle California residents' data)
Category
Data Privacy & Protection
Read the CCPA / CPRA guide
Law / regulation EU, Global

GDPR

General Data Protection Regulation (Regulation (EU) 2016/679)

The GDPR is the EU's main data protection law. It applies to any organisation established in the EU that processes personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. It sets principles, lawful bases, individuals' rights, security and breach duties, rules for processors and international transfers, and fines of up to EUR 20 million or 4% of global annual turnover.

Mandatory: Mandatory law for organisations in scope, including many outside the EU

Quick facts
What it covers
Collection, use, storage, sharing, transfer and deletion of personal data about people in the EU, by controllers and processors.
Who needs it
Any business processing personal data of people in the EU
Why it matters
Any IT or SaaS company with EU users or EU business customers is likely in scope, and EU customers will not sign without a data processing agreement and evidence of compliance.
Key requirements
  • Follow the 7 principles in Article 5, including data minimisation and accountability
  • Have a lawful basis for every processing purpose (Article 6)
  • Give clear privacy information (Articles 13 and 14)
  • Honour data subject rights, usually within one month
  • Sign processor contracts that meet Article 28
  • Keep records of processing activities (Article 30)
  • Apply appropriate security (Article 32)
  • Report qualifying breaches to the authority within 72 hours
  • Carry out DPIAs for high-risk processing
  • Use a valid mechanism for transfers outside the EEA
Where it applies
EU/EEA, plus non-EU organisations offering goods or services to, or monitoring, people in the EU
Category
Data Privacy & Protection
Read the GDPR guide
Certifiable standard Global

ISO 27701

ISO/IEC 27701: Information security, cybersecurity and privacy protection. Privacy information management systems. Requirements and guidance

ISO/IEC 27701 sets the requirements for a privacy information management system (PIMS): a structured way to manage personal data as a controller, a processor, or both. Since the 2025 edition it is a standalone management system standard, so it can be certified without ISO 27001, although many companies certify to both together. It is voluntary, and it provides strong evidence for privacy laws such as the GDPR and India's DPDP Act.

Voluntary: Voluntary, increasingly requested by customers

Quick facts
What it covers
Governance, risk management and controls for processing personally identifiable information (PII), with separate control sets for controllers and processors.
Who needs it
Controllers and processors wanting certifiable privacy governance
Why it matters
Customers increasingly want independent proof that a vendor handles personal data properly, not just securely. ISO 27701 gives that proof in a format auditors and procurement teams recognise.
Key requirements
  • Define the PIMS scope and your role as PII controller, processor or both
  • Leadership commitment, privacy policy, roles and responsibilities
  • Privacy risk assessment and treatment, with a Statement of Applicability
  • Controls for controllers (lawful basis, notices, rights, DPIAs, transfers)
  • Controls for processors (customer instructions, sub-processors, return and deletion)
  • Internal audit, management review and continual improvement
Where it applies
Global
Category
Data Privacy & Protection
Read the ISO 27701 guide

Also relevant to data privacy & protection

Law / regulation USA

HIPAA

Health Insurance Portability and Accountability Act of 1996

HIPAA is the US law that protects health information. Its rules apply to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to business associates, the vendors that create, receive, maintain or transmit protected health information for them. SaaS, cloud and IT providers serving US healthcare are usually business associates and must sign a business associate agreement, implement the Security Rule, and report breaches. HHS proposed a major Security Rule update in January 2025; the final rule is now targeted for July 2027.

Mandatory: Mandatory for covered entities and their business associates

Quick facts
What it covers
Uses and disclosures of protected health information (PHI), security of electronic PHI, individuals' rights, and breach notification.
Who needs it
Healthcare SaaS, telehealth, health IT vendors (business associates)
Why it matters
Any IT or SaaS company handling patient data for US healthcare organisations is directly liable under HIPAA as a business associate, and healthcare buyers won't sign without a BAA.
Key requirements
  • Sign business associate agreements (BAAs) with covered entities and subcontractors
  • Conduct and document a security risk analysis
  • Administrative, physical and technical safeguards for ePHI
  • Use and disclose PHI only as permitted, under the minimum necessary standard
  • Notify breaches of unsecured PHI within the required time limits
  • Policies, training, and six-year retention of documentation
Where it applies
USA
Category
Healthcare IT
Read the HIPAA guide
Law / regulation India

DPDP Act

Digital Personal Data Protection Act, 2023, with the Digital Personal Data Protection Rules, 2025

The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to digital personal data processed in India, and to processing abroad connected with offering goods or services to people in India. Organisations (data fiduciaries) need consent or a legitimate use, must give clear notices, protect data with reasonable security safeguards, report breaches, honour individuals' rights and take extra care with children's data. The Rules were notified in November 2025, and most obligations apply from May 2027. Penalties reach INR 250 crore.

Mandatory: Mandatory law; main obligations apply from May 2027

Quick facts
What it covers
Collection, use, storage, sharing, transfer and erasure of digital personal data by data fiduciaries and data processors.
Who needs it
Every Indian IT company and any business processing digital personal data of people in India
Why it matters
Every Indian IT, SaaS and edtech company handles personal data, and global companies serving Indian users are in scope too. Customers will expect DPDP-ready contracts and security well before May 2027.
Key requirements
  • Process personal data only with valid consent or for a legitimate use
  • Give a clear, standalone notice in plain language
  • Reasonable security safeguards, including encryption, access control and one-year log retention
  • Report personal data breaches to the Board and affected individuals
  • Verifiable parental consent for children under 18; no tracking or targeted ads to children
  • Honour rights to access, correction, erasure, grievance redressal and nomination
  • Extra duties for Significant Data Fiduciaries - DPO in India, annual DPIA and audit
Where it applies
India, and processing outside India connected with offering goods or services to people in India
Category
Indian IT Laws & Regulations
Read the DPDP Act guide
Other areas

More IT compliance categories

Information Security Cybersecurity IT Governance & Risk Management Cloud Security Secure Software Development Payment & Financial Data Security Healthcare IT AI Governance & Compliance Business Continuity & Disaster Recovery International IT Regulations Indian IT Laws & Regulations All IT compliance guides
IT compliance help

Not sure which data privacy & protection rules apply to you?

Tell us what you build, where your customers are and what they ask for. We reply with suggested next steps.

  • No obligation
  • NDA on request
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp iamvishavjeet@gmail.com

Get an IT compliance assessment

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Need a custom Tutor LMS solution?

Tell us what you are building or what is broken. A Tutor LMS developer reads every inquiry and replies with next steps and a free estimate.

Get a free consultation Book a call

Get a free Tutor LMS consultation

Tell us what you are building or fixing. A Tutor LMS developer replies with honest advice and next steps.

  • No obligation
  • Tutor LMS and Pro specialists
  • Your details stay private

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.