Privacy and data protection
A cross-sector regime that applies to any organisation handling personal data, from technology and healthcare to financial services, retail and telecoms.
Overview
Privacy law is cross-sector: the same customer data can fall under several regimes depending on where the customer lives and what the business does.
Typical authorities and frameworks: PIPEDA, provincial privacy laws, US state privacy laws, GDPR, ePrivacy, UK GDPR; OPC, ICO, CNIL, Irish DPC, EDPB.
Authorities in this glossary active in it include FTC, State attorneys general, State privacy agencies, OPC, CAI and Provincial privacy commissioners.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
Regulators increasingly look at activities and outcomes in this space, so obligations follow the business model rather than the label.
Who it affects
Organisations operating in privacy and data protection, and the vendors who serve them.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Hierarchy
Connections
The terms most closely tied to Privacy and data protection. Select one to open it.
What to do about it
- 1List the activities you actually perform.
- 2Identify the authorities and licences those activities trigger.
- 3Scope your obligation library to the sector and its activities.
- 4Set up controls and evidence for the highest-risk obligations first.
From requirement to evidence.
Tag your organisation with this industry and Regulation Layer scopes the obligation library to it.
Request early access →