Privacy laws around the world: a plain-language overview for 2026

By the Privacyboard teamPublished 4 November 202610 min read

Short answer

There is no single global privacy law. Each country, and in the US each state, has its own, and what applies to you depends on whose data you handle, not only where you are based. In practice you follow the GDPR for people in Europe, a US state law above its thresholds, and a national law for customers in places like Canada, Brazil or Australia.

There is no single worldwide privacy law. Each country has its own, the United States has a growing patchwork of state laws, and the ones that matter to a business are those that protect the people whose data it handles, wherever the business is based. This guide covers the main laws as of 4 November 2026: what they give people, how fast you must answer them, and how a small business can work out which ones apply.

#What are the main privacy laws in 2026?

Most modern privacy laws share the same core: people can ask what you hold about them, ask for corrections or deletion, and complain to a regulator. They differ in who is covered, in the deadline for replying and in the penalties. The table summarises the laws small businesses meet most often.

Law	Region	Who it protects, and when it applies to you	Headline rights	Reply deadline	Regulator
GDPR (and the ePrivacy Directive for cookies)	EU and EEA	People in the EU. Also applies to businesses outside the EU that offer goods or services to people there, or monitor their behaviour (Article 3)	Access, correction, erasure, restriction, portability, objection, no solely automated decisions (Articles 15 to 22)	One month, extendable by two further months (Article 12(3))	National data protection authorities
UK GDPR and Data Protection Act 2018	United Kingdom	People in the UK; same structure as the GDPR	Same core rights	One month, plus two months if complex	ICO
Federal Act on Data Protection (FADP)	Switzerland	Individuals; the revised Act has applied since 1 September 2023	Information and access, correction and deletion	Generally 30 days	FDPIC
State comprehensive laws	19 US states in force	Residents of the state, above each law's thresholds	Know or access, correct, delete, opt out of sale, targeted ads and profiling	Commonly 45 days, plus 45	State attorney general
CCPA/CPRA	California	Residents of California, if you meet a threshold	Know, delete, correct, opt out of sale or sharing, limit sensitive data	45 days, plus 45; opt-outs within 15 business days	Attorney General and the privacy agency
PIPEDA	Canada (outside Alberta, British Columbia and Québec for most private businesses)	People whose data you handle in commercial activity	Access and correction, plus consent rules	30 days, plus up to 30	Privacy Commissioner (OPC)
Law 25 (Québec Private Sector Act)	Québec	People in Québec	Access, correction, de-indexing and more	30 days; silence counts as a refusal	CAI
LGPD	Brazil	Processing in Brazil, or aimed at people in Brazil	Confirmation, access, correction, deletion, portability	Full answer within 15 days	ANPD
Privacy Act 1988	Australia	Businesses with more than AUD 3 million yearly turnover, and some smaller ones	Access and correction	A reasonable period; the regulator treats 30 days as reasonable	OAIC
Law 21.719	Chile	People in Chile, including from foreign businesses that offer them goods or services	Access, rectification, erasure, portability and more	30 days (secondary source)	Personal Data Protection Agency
DPDP Act 2023	India	People in India	Information about your data, correction and erasure, grievance redress, nominating someone	Not yet in force; main duties scheduled for 12 May 2027	Data Protection Board

Sources for each row are listed at the end. Where a figure comes from a law firm summary instead of the law itself, the section below says so.

#What is settled law, and what is still pending?

Settled and in force today:

The GDPR and the ePrivacy Directive in the EU, and the Swiss FADP since 1 September 2023.
The UK GDPR as amended by the Data (Use and Access) Act 2025. The ICO said the main remaining provisions took effect on 5 February 2026, and the duty to have a data protection complaints procedure on 19 June 2026.
California's CCPA, the other 18 US state laws in force, Canada's PIPEDA, Québec's Law 25, Brazil's LGPD and the Australian Privacy Act.

Passed but not yet in force:

Chile's Law 21.719 is due to apply from 1 December 2026. On 28 October 2026 the Senate approved a bill to postpone that to 15 October 2027. It still has to pass the Chamber of Deputies, so until it is published the December 2026 date stands, according to the law firm Garrigues.
India's DPDP Act. The rules were notified on 13 November 2025. Consent manager rules start on 12 November 2026 and most duties on 12 May 2027, per a law firm summary. India's ministry has floated shortening that schedule, and we found no official notice doing so.
Four US states (Oklahoma and Louisiana on 1 January 2027, Alabama on 1 May 2027, Vermont on 1 January 2028).

Proposed and uncertain:

EU Digital Omnibus. The European Commission proposed changes to the GDPR and the ePrivacy rules on 19 November 2025. As of 9 October 2026, neither the Council nor the Parliament had agreed its position, so none of it is law.
Canada's Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 15 June 2026 to replace Part 1 of PIPEDA. It had passed first reading only.
A US federal law. There is still no comprehensive federal privacy law. House Republicans released the SECURE Data Act (H.R. 8413) as a discussion draft on 22 April 2026, and it would override most state laws. It has not passed.

#How many US states have a privacy law?

As of 4 November 2026, 23 states have enacted a comprehensive privacy law, counting as most trackers do (Vermont was the 23rd, signed on 16 June 2026). Nineteen are in force: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Some trackers also count Florida, whose full duties reach only very large platforms, which is why you will see 20 or 24 in other places.

The laws differ, so there is no single US threshold. A few examples, each from the state's own page or a tracker as noted:

State	Applies to a business that...
California	Does business there and has over USD 26,625,000 in yearly revenue (the 2025 inflation-adjusted figure), or handles data of 100,000 or more consumers or households, or earns 50% or more of revenue from selling or sharing data
Virginia	Handles data of 100,000 consumers, or 25,000 while earning over 50% of revenue from selling data
Colorado	Handles data of 100,000 people a year, or sells data of 25,000 or more for revenue or discounts
Connecticut	Handles data of 35,000 residents since 1 July 2026, per the ComplyJet tracker
Texas and Nebraska	Has no volume threshold; only businesses that count as small under the US Small Business Administration are exempt, per the same tracker

Where the reply period is set out in the state's own text or attorney general page, it is 45 days plus one extension of 45 days (California, Colorado and Virginia). Check each statute before assuming the same for other states. California adds a shorter limit of 15 business days for opt-outs, and several states require businesses to honour browser signals such as Global Privacy Control, covered in our GPC guide. For the full comparison with the EU, see GDPR vs CCPA/CPRA.

#What do Canada, Brazil, Australia, Chile and India require?

Canada. PIPEDA covers private-sector organisations collecting, using or disclosing personal information in commercial activities, and Alberta, British Columbia and Québec have their own laws that are deemed substantially similar. Access requests must be answered within 30 days, which can be extended by up to 30 days in three listed situations, if you tell the person within the first 30 days. Québec's Law 25 is stricter: 30 days with no extension, and a silence is deemed a refusal. Penalties under Law 25 can reach C$10 million or 2% of worldwide turnover as administrative penalties, and C$25 million or 4% in penal proceedings, according to the law firm Osler.

Brazil. The LGPD applies when processing takes place in Brazil, when it aims at offering goods or services to people in Brazil, or when the data was collected in Brazil, wherever the company is based. A simplified answer is due immediately and a complete declaration within 15 days (Article 19). Fines can reach 2% of revenue in Brazil, capped at R$50 million per infraction (Article 52).

Australia. The Privacy Act applies to Australian Government agencies and organisations with more than AUD 3 million in annual turnover, plus some other organisations. A statutory tort for serious invasions of privacy has applied since 10 June 2025 and, according to the OAIC, is broader than the Act. From 10 December 2026, covered entities must describe in their privacy policy decisions made by computer programs that significantly affect people.

Chile and India. Both laws are new and phased. Chile's Law 21.719 creates a Personal Data Protection Agency and, according to the law firm summaries we read, gives people access, rectification, erasure and portability rights with 30 days to answer. India's DPDP Act gives people the right to information about their data, to correction and erasure, to grievance redress and to nominate someone to act for them (sections 11 to 14). India's Data Protection Board was set up in November 2025, but most duties are not yet in force. For small businesses, these are laws to prepare for, not yet laws to be audited under.

#Which laws apply to a small business with customers abroad?

The short rule: laws follow the people, not only the company's address. Most modern laws reach businesses abroad when they offer goods or services to residents or watch their behaviour. A practical way to decide:

List where your customers and visitors are. Use your analytics and your order data, not a guess.
Ask whether you target them. Selling in the local language or currency, shipping there or advertising there points to targeting. A visitor who lands by chance usually does not.
Check size thresholds. California, Virginia, Colorado and the other US states and Australia only apply above a size or volume. The GDPR, the UK GDPR, the Swiss FADP and the LGPD have no turnover threshold.
Note each deadline. Replies range from 15 days (Brazil) to one month (GDPR), with 45 days in many US states.
Pick one baseline. Many small businesses meet the strictest rule they are subject to, usually the GDPR, and add local notices.
Review once a year. Thresholds, dates and new laws change, as the tables above show.

#What this means for a small business

You do not need to study 20 laws. You need to know where your customers are, answer requests quickly, keep an honest privacy policy and handle cookies and breaches properly. Our GDPR checklist for small businesses is a good baseline because most other laws ask for similar things.

Privacyboard lets you choose the countries you serve and then shows each country's rights and reply deadline in the request form and your privacy policy. Switzerland, Canada and Québec, Brazil, Chile and Australia are covered, along with the GDPR and US state laws; India's DPDP Act is not covered yet. See countries with their own privacy law for the details. No tool decides on its own which law applies to you, so confirm unusual cases with a lawyer.

#FAQ

#Is there one privacy law that covers the whole world?

No. Each country and, in the US, each state sets its own rules. The GDPR is the most influential and many laws borrow from it, but they differ on deadlines, thresholds and penalties.

Yes, if it offers goods or services to people in the EU or monitors their behaviour there (GDPR Article 3(2)). Where it is based does not matter.

#How many US states have a comprehensive privacy law?

As of 4 November 2026, 23 states have enacted one and 19 are in force, counting as most trackers do. The count changes as new laws are signed, so check a current tracker.

#What is the usual deadline to answer a privacy request?

It ranges from 15 days under Brazil's LGPD to 30 days in Switzerland, Canada and Québec, one month under the GDPR and 45 days in California, Colorado and Virginia. Use the shortest deadline that applies to the person asking.

#Do small businesses need to follow these laws?

Often yes. The GDPR and the LGPD have no size threshold, while the US state laws and Australia's Privacy Act apply only above set volumes or turnover.

#Are the Chilean and Indian laws in force?

Not yet. Chile's law is due on 1 December 2026, with a bill pending to postpone it to 15 October 2027, and India's main duties are scheduled for 12 May 2027.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.