GDPR · DPDP · CCPA · LGPD

Which Privacy Laws Apply to My Business?

Answer five questions and get a list of the privacy regimes that likely apply to you - and why.

It depends on where your customers are

Most modern privacy laws reach beyond their own borders. They apply because of whose data you handle, not just where your company is registered. A company in India selling to customers in Europe is covered by GDPR; a US company selling to customers in India is covered by the DPDP Act.

Law	What brings a foreign business in
India: DPDP Act 2023	Processing connected with offering goods or services to people in India (s.3)
EU GDPR	Offering goods or services to, or monitoring the behaviour of, people in the EU (Art 3(2))
UK GDPR	The same tests, for people in the UK (Art 3)
Brazil: LGPD	Processing personal data of individuals located in Brazil, or offering goods or services to them (Art 3)
Canada: PIPEDA	Personal information collected, used or disclosed in the course of commercial activities (s.4)
California: CCPA/CPRA	Doing business in California and meeting a revenue, volume or data-sales threshold (1798.140(d))

Other US states have their own thresholds. See the US state privacy law checker.

The good news: the security work overlaps

These laws differ on legal bases, notices and rights, which is work for privacy counsel. But they all expect reasonable security and a working breach response. One set of controls (encryption, access control, logging, tested backups, a breach runbook) covers the security duty in all of them.

The checker above tests two things: where you are incorporated and where your customers are. It ignores exemptions, revenue tests and sector rules, so use it as a starting list. Read about the DPDP Act and GDPR Article 32.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Each regime is tested against two answers only: where you are incorporated and where your customers are. The DPDP Act (India), EU GDPR, UK GDPR, PIPEDA (Canada) and LGPD (Brazil) are flagged when you are incorporated in, or have customers in, that territory. That mirrors how these laws reach foreign businesses that serve local residents (DPDP Act s.3(b), GDPR and UK GDPR Art. 3(2), LGPD Art. 3).
California is tested against the CCPA/CPRA thresholds in Cal. Civ. Code 1798.140(d). The checker can only test the volume prong: it says "likely applies" when you both handle data of more than 100,000 people a year and sell or share personal data. Otherwise it spells out the revenue test (over US$26,625,000 after the 2025 inflation adjustment), because it never asks for your revenue.
Customers elsewhere in the US produce a pointer to the state privacy laws rather than a verdict, because each state sets its own thresholds.
The number of flagged regimes drives the headline and colour: 0 or 1 is low, 2 or 3 is medium, 4 or more is high. Your sector and data-selling answers add notes but never change the count.

Worked example

The calculator run on its default inputs:

Where is your business incorporated?: India
Where are your customers / users located? (select all): India; EU / EEA
How many individuals’ data do you process per year?: 10,000-100,000
Sector: SaaS / software
Do you sell or share personal data with third parties (incl. ad-tech)?: No

2 privacy regimes likely apply to your business

DPDP Act 2023 (India): Likely applies - processing digital personal data of individuals in India, including foreign companies offering goods or services into India, is in scope (s.3(b)).
EU GDPR: Likely applies - Art. 3(2) extends GDPR extraterritorially to anyone offering goods or services to data subjects in the EU/EEA, regardless of where the company is based.

With the defaults (incorporated in India, customers in India and the EU/EEA) the checker flags two regimes: the DPDP Act, because you process personal data of people in India, and the EU GDPR, because you offer services to people in the EU. UK GDPR, CCPA/CPRA, PIPEDA and LGPD are listed as likely out of scope until you serve those markets. The data-volume answer does not change this result; it only matters for the California test.

Sources

Digital Personal Data Protection Act, 2023 - s.3 (MeitY) - applies to processing outside India connected with offering goods or services to people in India
GDPR Art. 3 - Regulation (EU) 2016/679 (EUR-Lex) - territorial scope, including non-EU businesses offering goods or services to people in the EU
UK GDPR Art. 3 (legislation.gov.uk) - territorial scope for people in the UK
Cal. Civ. Code 1798.140 (California Legislative Information) - the three "business" thresholds in subsection (d)
PIPEDA s.4 (Justice Laws Website) - personal information collected, used or disclosed in the course of commercial activities
LGPD Art. 3 - Lei 13.709/2018 (Planalto) - processing of personal data of individuals located in Brazil

Sources last checked September 2026.

Limitations

The checker ignores establishments, targeting, revenue, exemptions and sector carve-outs, and it covers seven regimes only (not, for example, China’s PIPL or Canada’s provincial laws). A "likely applies" means check it properly, not that you are in breach. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.