Global Privacy Laws and Penalties for Infringement: A Comprehensive Guide for Businesses

Global Privacy Laws and Penalties for Infringement: A Comprehensive Guide for Businesses

1. Introduction

Personal data has become one of the most valuable assets in the global economy. Businesses collect and process customer information, employee records, payment details, online identifiers, location data and other personal information to support their operations, improve customer experiences and develop new products.

However, collecting personal data also creates legal and operational responsibilities. Governments around the world have introduced privacy and data protection laws to regulate how organisations collect, use, store, disclose and transfer personal information.

Non-compliance can result in regulatory fines, restrictions on data processing, compensation claims, investigations, business interruption and reputational damage.

For multinational businesses, the challenge is particularly significant because there is no single global privacy law. An organisation may need to comply with several regimes simultaneously, depending on where it operates, whose data it processes, the services it provides and where the processing takes place.

This guide compares major privacy laws across Europe, the Americas, Asia-Pacific and the Middle East, explains their potential penalties, and provides a practical framework for building a global privacy compliance programme.

Important: The penalty amounts below are statutory maximums or significant penalty limits, not predictions of the fines a business will receive. Actual penalties depend on the applicable legislation, the nature of the infringement, the regulator’s powers and the circumstances of the case. The guide reflects legislation and official information reviewed in October 2026. Businesses should verify the current law and commencement dates before relying on it for legal decisions.

2. What is a data protection law?

A data protection law establishes rules governing the processing of personal data and the rights of the individuals to whom that data relates.

Personal data generally means information relating to an identified or identifiable individual. Depending on the applicable law, examples may include:

• Names, addresses, telephone numbers and email addresses.

• Government-issued identification numbers.

• Customer account details and transaction histories.

• Employee information, payroll records and recruitment data.

• IP addresses, device identifiers and online activity.

• Location data, photographs and biometric information.

• Health information and other sensitive personal data.

The precise legal definition differs between jurisdictions. Information about a company is not necessarily personal data, although information about an identifiable director, employee or sole trader may qualify.

Key roles in data protection

Data controller: An organisation or person that determines why and how personal data is processed.

Data processor: An organisation that processes personal data on behalf of a controller, subject to the applicable law and contractual arrangements.

Data subject: The individual whose personal data is being processed.

Supervisory authority or regulator: The public authority responsible for enforcing relevant data protection legislation.

The distinction between controllers and processors matters because their legal obligations are not always identical.

3. Major global privacy laws and potential penalties

3.1 European Union — General Data Protection Regulation (GDPR)

The EU GDPR is one of the most influential privacy frameworks in the world. It applies to relevant processing by organisations established in the EU and can also apply to organisations outside the EU that offer goods or services to individuals in the EU or monitor their behaviour there, subject to the Regulation’s territorial rules.

Key obligations include having a lawful basis for processing, providing transparent privacy information, respecting individual rights, implementing appropriate security, managing processors and handling international data transfers lawfully.

The GDPR also establishes requirements concerning data protection impact assessments, records of processing and the appointment of a Data Protection Officer in specified circumstances.

Potential penalties: The GDPR provides two principal administrative fine tiers. The higher tier can reach €20 million or 4% of the undertaking’s total worldwide annual turnover in the preceding financial year, whichever is higher. The applicable tier depends on the infringement.

Regulators may also issue warnings, reprimands, orders to comply and restrictions or bans on processing. A fine is not automatic whenever a breach occurs. https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/enforcement-and-sanctions/sanctions/what-if-my-companyorganisation-fails-comply-data-protection-rules_it

3.2 United Kingdom — UK GDPR and Data Protection Act 2018

The United Kingdom operates a separate data protection regime following its departure from the EU. The UK GDPR and Data Protection Act 2018 form core parts of this framework, alongside subsequent legislative amendments.

The UK regime covers matters such as lawful processing, transparency, security, individual rights, accountability and international transfers. The Information Commissioner's Office (ICO) is a principal regulator.

Potential penalties: For relevant infringements, the higher maximum is £17.5 million or 4% of worldwide annual turnover, whichever is higher. A lower statutory tier can reach £8.7 million or 2% of worldwide annual turnover, whichever is higher. The applicable maximum depends on the type of infringement and the legal provisions involved. https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/statutory-background/the-maximum-amount-of-a-fine-under-uk-gdpr-and-dpa-2018/

Businesses should not assume that EU GDPR compliance automatically resolves every UK requirement. UK and EU obligations, transfer mechanisms and regulatory guidance should be reviewed separately where both regimes apply.

3.3 United States — Federal and state privacy laws

The United States does not have one comprehensive federal privacy law covering all private-sector personal data in the same way as the EU GDPR. Instead, it has a combination of federal sector-specific laws, state privacy laws, consumer protection rules and data breach notification requirements.

Examples include:

• California Consumer Privacy Act (CCPA), as amended by the CPRA: Provides qualifying California consumers with rights and imposes obligations on covered businesses.

• Health Insurance Portability and Accountability Act (HIPAA): Regulates protected health information within its scope.

• Gramm-Leach-Bliley Act (GLBA): Establishes privacy and safeguarding requirements for covered financial institutions.

• Children’s Online Privacy Protection Act (COPPA): Addresses certain online collection of personal information from children under 13.

• Other state privacy laws: May impose additional obligations depending on the state, organisation and processing activity.

Potential penalties: Under the California CCPA framework, administrative civil penalties are subject to statutory limits that are adjusted periodically. The 2025 adjusted figures were up to US$2,663 per violation and US$7,988 for each intentional violation or violation involving a consumer known to be under 16. The precise applicable amount should be checked against the current statutory adjustment and the type of enforcement action. Other US laws have different penalties and remedies. https://cppa.ca.gov/regulations/cpi_adjustment.html

A company operating in the US should therefore assess the specific states, sectors and categories of data relevant to its business rather than assuming a single national standard applies.

3.4 China — Personal Information Protection Law (PIPL)

China’s Personal Information Protection Law establishes requirements for processing personal information. It regulates matters including consent and other legal conditions for processing, transparency, individual rights, sensitive personal information, cross-border transfers and the responsibilities of personal information handlers.

PIPL can have extraterritorial application in certain circumstances involving the provision of products or services to individuals in China or analysing their behaviour.

Potential penalties: For serious violations, the law permits fines of up to RMB 50 million or 5% of the previous year's turnover. Authorities may also confiscate illegal gains, order business suspension or suspend business operations for rectification. Directly responsible individuals can face separate penalties and other restrictions. The serious-violation threshold and other statutory conditions matter; the maximum does not apply automatically to every infringement. https://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_3.htm

Businesses processing personal information in China should pay particular attention to localisation or transfer requirements where applicable, cross-border data transfers, security assessments, contractual mechanisms and the legal basis for processing.

3.5 Brazil — General Data Protection Law (LGPD)

Brazil’s Lei Geral de Proteção de Dados, or LGPD, regulates the processing of personal data by public and private organisations within its scope.

The law addresses legal bases for processing, transparency, data subject rights, security measures, incident handling and international data transfers. The National Data Protection Authority (ANPD) is responsible for important regulatory and enforcement functions.

Potential penalties: The LGPD allows a simple fine of up to 2% of a private legal entity’s, group’s or conglomerate’s revenue in Brazil in its last financial year, excluding taxes, subject to a maximum of R$50 million per infringement. Other sanctions may include warnings, daily fines, public disclosure of the infringement, blocking or deletion of personal data, and restrictions on data processing. https://www.gov.br/anpd/pt-br/assuntos/noticias/sancoes-administrativas-o-que-muda-apos-1o-de-agosto-de-2021

The applicable sanction depends on the legal conditions and circumstances of the case.

3.6 India — Digital Personal Data Protection Act 2023

India enacted the Digital Personal Data Protection Act 2023 (DPDP Act) to establish a framework for processing digital personal data. The Act covers matters including notice, consent and specified legitimate uses, data fiduciary obligations, individual rights and enforcement.

Potential penalties: The Act’s Schedule provides for monetary penalties of up to ₹250 crore for certain specified contraventions. Different contraventions have different maximum amounts; ₹250 crore is not a universal penalty for every breach.

A key implementation consideration is that the Act’s provisions have phased commencement dates. Rules were published in November 2025, with different provisions scheduled to take effect at different times. Businesses must therefore confirm which provisions are in force on the relevant date rather than treating every requirement as having commenced simultaneously. https://www.meity.gov.in/documents/act-and-policies

Organisations should review the commencement notifications, applicable rules and implementation timelines when assessing their current obligations.

3.7 Singapore — Personal Data Protection Act (PDPA)

Singapore’s PDPA governs the collection, use and disclosure of personal data by organisations within its scope. It includes obligations relating to consent, notification, purpose limitation, protection, retention, access and correction, and overseas transfers.

The Personal Data Protection Commission (PDPC) is a key enforcement authority.

Potential penalties: For covered data protection contraventions, the maximum financial penalty for an organisation whose annual Singapore turnover exceeds S$10 million can reach 10% of its annual turnover in Singapore. The applicable cap and calculation depend on the statutory provisions and relevant conditions. Other organisations are subject to the applicable statutory monetary limit. https://sso.agc.gov.sg/Act/PDPA2012?ProvIds=pr48J-&ValidDate=20251205

Companies operating in Singapore should maintain appropriate security controls, review third-party arrangements and ensure that overseas transfers meet the PDPA’s requirements.

3.8 Japan — Act on the Protection of Personal Information (APPI)

Japan’s APPI regulates the handling of personal information by covered businesses. It addresses matters including purpose specification, appropriate acquisition, security management, third-party provision and cross-border disclosure.

The Personal Information Protection Commission (PPC) oversees important aspects of the regime.

Penalties and enforcement: APPI enforcement is not accurately described by one simple, universal fine figure. The law provides different measures and penalties depending on the conduct, the person responsible and the applicable provision. These can include orders, reporting-related obligations and criminal penalties for specified conduct.

Businesses should consult the current APPI and PPC guidance when assessing the consequences of a particular violation.

3.9 South Korea — Personal Information Protection Act (PIPA)

South Korea’s PIPA establishes comprehensive obligations for processing personal information. Requirements address lawful processing, transparency, security, data subject rights, outsourcing, cross-border transfers and the handling of sensitive information.

The Personal Information Protection Commission (PIPC) is the principal regulator.

Penalties and enforcement: Potential consequences vary according to the infringement and applicable provisions. Administrative fines, corrective orders and other sanctions may apply, and some conduct may also trigger criminal liability. A single fixed penalty figure would not adequately represent the Korean regime.

Organisations should review the applicable provisions, current enforcement rules and sector-specific requirements before calculating exposure.

3.10 Australia — Privacy Act 1988

Australia’s Privacy Act 1988 and Australian Privacy Principles regulate the handling of personal information by covered organisations and agencies. The Office of the Australian Information Commissioner (OAIC) oversees important aspects of the framework.

The Act addresses matters including collection, use, disclosure, security, access and correction, and eligible data breach notification.

Potential penalties: For serious or repeated interferences with privacy, the maximum civil penalty for a body corporate is the greatest of:

• A$50 million;

• three times the value of the benefit obtained that is reasonably attributable to the conduct; or

• if that benefit cannot be determined, 30% of adjusted turnover during the relevant breach turnover period.

This formula applies to the specified statutory contravention and should not be interpreted as a universal penalty for every privacy incident. https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/guide-to-privacy-regulatory-action/chapter-7-privacy-assessments

Australian privacy reform and the current consolidated legislation should be checked when assessing obligations and exposure.

3.11 United Arab Emirates — Federal Personal Data Protection Law

The UAE’s Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data establishes a federal framework for personal data protection. It addresses the processing of personal data, confidentiality, security, data subject rights and international transfers.

The law came into force on 2 January 2022. Its scope and application must be assessed alongside applicable exclusions, implementing rules and other relevant UAE legislation. https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws

Penalties: It is misleading to assign the federal law one simple, universally applicable fine figure without reference to the applicable provisions and implementing framework. The consequences of non-compliance should be assessed under the relevant legislation and applicable decisions. Businesses should not assume that the DIFC or ADGM penalty limits automatically apply to the federal regime.

3.12 Dubai International Financial Centre (DIFC)

The DIFC is a financial free zone in Dubai with its own data protection regime. DIFC Law No. 5 of 2020, as amended, applies to relevant DIFC entities and processing activities within its scope.

The regime covers matters including lawful processing, transparency, individual rights, security, data breach obligations, accountability and international transfers. DIFC entities should also assess whether they have notification and other regulatory obligations to the Commissioner of Data Protection.

Penalties: The DIFC regime sets administrative fines for specified contraventions. The amounts depend on the relevant provision and applicable amendments; it is incorrect to treat a single figure such as US$50,000 as the maximum for every DIFC infringement. Some specific penalties have been amended, and certain contraventions carry different limits. Individuals may also have remedies where the legal conditions are met. https://www.difc.com/Business/registrars-and-commissioners/commissioner-of-data-protection

DIFC-registered organisations should check the current law, schedules and amendments rather than relying on a summary of older penalty limits.

3.13 Abu Dhabi Global Market (ADGM)

ADGM is a financial free zone in Abu Dhabi and operates under its own Data Protection Regulations 2021. The regime imposes requirements concerning lawful processing, individual rights, security, accountability and international transfers.

Penalties: ADGM’s official guidance states that administrative fines can reach up to US$28 million, depending on the applicable contravention and the circumstances. This is a maximum under the ADGM framework, not an automatic fine for every infringement. https://www.adgm.com/documents/office-of-data-protection/resources/brochures-flyers/adgm-penalties-of-non-compliance-infographic.pdf

Businesses should distinguish ADGM’s regime from both the UAE federal law and the DIFC framework. Registration in one jurisdiction does not, by itself, establish which other laws may apply.

4. Comparing privacy penalties: what businesses should understand

The following table summarises selected headline limits discussed above. It is intended as a comparison aid, not a complete statement of every sanction in each jurisdiction.

Jurisdiction	Law or framework	Selected statutory maximum or penalty limit
European Union	GDPR	Up to €20 million or 4% of worldwide annual turnover for the higher tier
United Kingdom	UK GDPR / Data Protection Act 2018	Up to £17.5 million or 4% of worldwide annual turnover for the higher tier
United States — California	CCPA, as amended	Adjusted per-violation penalties; 2025 amounts included US$2,663 and US$7,988 for specified categories
China	PIPL	For serious violations, up to RMB 50 million or 5% of previous year's turnover
Brazil	LGPD	Up to 2% of relevant Brazil revenue, capped at R$50 million per infringement
India	DPDP Act	Up to ₹250 crore for certain specified contraventions, subject to commencement and applicable rules
Singapore	PDPA	For covered organisations meeting the turnover condition, up to 10% of annual Singapore turnover
Australia	Privacy Act 1988	For specified serious or repeated interference, the greatest of A$50 million, three times attributable benefit, or 30% of adjusted turnover if benefit cannot be determined
UAE — federal	Federal Decree-Law No. 45 of 2021	Must be assessed under applicable federal provisions and implementing rules
Dubai — DIFC	DIFC Data Protection Law No. 5 of 2020, as amended	Fines vary by contravention and current schedule
Abu Dhabi — ADGM	Data Protection Regulations 2021	Up to US$28 million under the applicable framework

Why the figures are not directly comparable: Some laws calculate penalties using global turnover, others use local turnover or revenue, and others prescribe amounts for individual contraventions. The definition of turnover, the relevant financial period, the number of violations and the regulator’s discretion can all affect the result. Some laws also provide non-financial sanctions, compensation or separate criminal penalties.

A company should therefore calculate its exposure by mapping the facts of the incident to the exact provisions of each applicable law.

5. Common types of privacy infringement

Privacy infringements can arise from routine business activities, not only cyberattacks. Common examples include:

5.1 Collecting data without a valid legal basis

A business collects personal data without meeting the relevant consent, contractual, legal obligation or other applicable legal requirements.

5.2 Using personal data for an incompatible purpose

Information collected to deliver a service is later used for unrelated marketing, profiling or disclosure without satisfying the applicable requirements.

5.3 Failing to provide transparent information

A privacy notice omits important information about purposes, legal bases, recipients, retention, transfers or individual rights.

5.4 Inadequate security

Weak access controls, unpatched systems, insecure storage, exposed databases or poor credential management can lead to unauthorised access or disclosure.

5.5 Unlawful data sharing or international transfers

An organisation discloses information to a vendor, affiliate or overseas recipient without satisfying applicable legal, contractual or transfer requirements.

5.6 Excessive retention

Personal information is retained for longer than necessary or permitted, without an appropriate legal, regulatory or operational justification.

5.7 Failure to respond to individual rights requests

An organisation does not properly handle valid requests to access, correct, erase, restrict or otherwise exercise rights under the relevant law.

5.8 Inadequate vendor management

A business shares personal data with a service provider without appropriate due diligence, contractual safeguards, security requirements or oversight.

5.9 Mishandling employee and sensitive data

Payroll, recruitment, health, biometric or identity information is accessed or shared without appropriate authority, safeguards or controls.

5.10 Improper use of artificial intelligence

Staff upload personal or confidential information to AI tools without approval, or an organisation uses personal data for model training, profiling or automated decisions without satisfying applicable legal requirements.

The legality of a particular activity depends on the applicable law, the purpose, the data involved and the safeguards in place.

6. Key principles shared by many privacy frameworks

Although privacy laws differ, several principles recur across jurisdictions.

Lawfulness and transparency: Organisations should identify the applicable legal basis and explain their processing clearly.

Purpose limitation: Personal data should be collected for specified purposes and not reused in ways prohibited by the relevant law.

Data minimisation: Collect only information that is relevant and necessary for the intended purpose.

Accuracy: Take reasonable steps to maintain accurate personal information where required.

Storage limitation: Retain data only for as long as justified by the applicable purpose, law or other permitted basis.

Security and confidentiality: Use appropriate technical and organisational measures to protect personal information.

Individual rights: Establish processes to handle rights requests within the applicable legal requirements and deadlines.

Accountability: Maintain evidence that the organisation has identified, implemented and reviewed the controls required by the law.

These principles should not be treated as identical legal tests in every country. Each applicable statute must be considered on its own terms.

7. How to build a global privacy compliance programme

A practical privacy programme begins with understanding what data the business processes, where it flows and which laws apply.

Step 1: Map personal data

Identify the personal data collected from customers, employees, suppliers and other individuals. Record where it comes from, why it is used, where it is stored, who can access it and when it is deleted.

Step 2: Identify applicable jurisdictions

Assess the organisation’s establishment, customer locations, business activities, data subjects, processing locations and transfer arrangements. Determine whether laws such as the EU GDPR, UK GDPR, US state laws, PIPL, LGPD, DPDP Act, PDPA or UAE regimes apply.

Step 3: Establish a lawful basis and clear purposes

Document the applicable legal basis for each processing activity. Where consent is relied upon, ensure that it meets the relevant legal standard and that records and withdrawal mechanisms are maintained as required.

Step 4: Review privacy notices and individual rights

Ensure privacy information is accurate, accessible and consistent with actual practices. Create procedures to receive, verify, assign and respond to requests within applicable legal deadlines.

Step 5: Implement security controls

Use risk-appropriate safeguards such as encryption, multi-factor authentication, role-based access, logging, backups, vulnerability management, secure development and incident response testing.

Step 6: Manage vendors and international transfers

Assess suppliers that process personal data. Use appropriate contractual provisions, due diligence, transfer mechanisms and ongoing oversight where required.

Step 7: Establish a retention and deletion policy

Define retention periods by data category and purpose. Ensure that information is securely deleted or anonymised when retention is no longer justified, subject to applicable legal holds and retention duties.

Step 8: Prepare for data incidents

Maintain a response plan covering containment, investigation, evidence preservation, risk assessment, remediation and communications. Determine whether notification to regulators or affected individuals is required, and follow the specific deadlines in each applicable regime.

Step 9: Train employees and monitor compliance

Provide role-specific training for HR, finance, sales, marketing, IT, procurement and management. Review access rights, audit logs, vendor controls, privacy notices and retention practices regularly.

Step 10: Keep the programme current

Monitor legislative amendments, regulatory guidance, enforcement decisions and changes to the business model. Review the compliance programme when launching new products, entering new markets, adopting AI or changing vendors.

8. Privacy risks in artificial intelligence and data analytics

AI and analytics can create additional privacy risks because they may process large datasets, infer sensitive attributes or reuse information in ways individuals did not expect.

Examples include:

• Uploading customer or employee data to an unapproved AI service.

• Using personal data for model training without a valid basis or adequate transparency.

• Exposing personal information through prompts, logs or generated outputs.

• Making consequential decisions through automated systems without appropriate safeguards.

• Retaining input data or outputs longer than permitted.

• Transferring data to a third-party AI provider or another country without assessing the applicable requirements.

Businesses should maintain an inventory of AI systems, review the data each system processes, assess vendors and transfer arrangements, and introduce appropriate human oversight and testing.

An AI system is not automatically unlawful simply because it processes personal data. Its compliance depends on the applicable legal framework, purpose, legal basis, safeguards and effects on individuals.

9. Financial and operational consequences of non-compliance

Regulatory fines are only one part of the potential cost of a privacy incident.

Other consequences can include:

• Investigation and remediation costs: External legal advice, forensic analysis, security improvements and regulator engagement.

• Business interruption: Suspension of systems, restricted processing or the need to redesign operations.

• Compensation and legal claims: Claims from affected individuals or other parties where permitted by law.

• Contractual consequences: Disputes with customers, suppliers, insurers or business partners.

• Reputational damage: Reduced customer confidence and potential loss of commercial opportunities.

• Management and compliance costs: Additional monitoring, audits, reporting and ongoing remediation.

The overall impact depends on the incident, the organisation’s preparedness and the applicable legal remedies. These consequences are possible, not inevitable in every case.

10. Conclusion

Global privacy compliance is not simply a matter of avoiding fines. It requires organisations to understand the personal data they process, establish appropriate legal grounds, protect information, respect individual rights and maintain evidence of accountability.

The EU GDPR and UK GDPR provide prominent examples of turnover-linked penalties. Other jurisdictions use different approaches, including revenue-based limits, fixed or adjusted per-violation amounts, and sanctions tailored to particular infringements. The United States has a varied federal and state framework, while the UAE requires careful distinction between the federal law and the separate DIFC and ADGM regimes.

For international businesses, the most effective approach is to establish a strong global privacy baseline and then adapt it to the specific legal requirements of each jurisdiction. Regular legal reviews, robust security controls, vendor management, employee training and tested incident response procedures can reduce risk and help build lasting trust.

Disclaimer: This article is for general educational purposes and is not legal advice. It is not an exhaustive analysis of all privacy laws or penalties. Before making compliance decisions, confirm the current legislation, commencement dates, amendments, implementing rules and regulator guidance for each relevant jurisdiction, and seek qualified legal advice where appropriate.

Official reference sources

• European Commission — GDPR sanctions: https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/enforcement-and-sanctions/sanctions

• UK Information Commissioner’s Office — UK GDPR maximum fines: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/

• California Privacy Protection Agency — CCPA: https://cppa.ca.gov/

• China — Personal Information Protection Law: https://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_3.htm

• Brazil — National Data Protection Authority: https://www.gov.br/anpd/

• India — Ministry of Electronics and Information Technology: https://www.meity.gov.in/

• Singapore — Personal Data Protection Act: https://sso.agc.gov.sg/Act/PDPA2012

• Australia — Office of the Australian Information Commissioner: https://www.oaic.gov.au/

• UAE Government — Data protection laws: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws

• DIFC — Commissioner of Data Protection: https://www.difc.com/Business/registrars-and-commissioners/commissioner-of-data-protection

• ADGM — Office of Data Protection: https://www.adgm.com/operating-in-adgm/office-of-data-protection

Resources : Internet