Major Legal Frameworks and Jurisdiction

Introduction

Data privacy law regulates how information relating to identifiable people is collected, used, disclosed, stored, transferred and deleted. It also allocates responsibilities among organisations, data subjects, regulators and service providers. Modern privacy law is not confined to the country in which a company is incorporated. A business may be subject to several regimes because it offers services to people abroad, monitors their behaviour, processes data through cloud infrastructure, or participates in a regulated sector such as banking or healthcare.

This chapter examines four important regulatory fields: the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and selected Indian sectoral requirements. The emphasis is on structure, territorial reach, exemptions, enforcement and conflicts of law. The objective is not to treat these laws as interchangeable. Each uses different concepts, rights, institutions and compliance techniques.

Learning Objectives

After studying this chapter, a learner should be able to:

1. Describe the scope and architecture of the GDPR, CCPA/CPRA and DPDP Act.
2. Distinguish controllers, processors, businesses, service providers, data fiduciaries and data processors.
3. Analyse when a law may apply to an organisation located outside the jurisdiction.
4. Identify important exemptions, enforcement mechanisms and sectoral overlays.
5. Explain how conflicts of law arise in cross-border data operations.
6. Apply a structured method to a practical privacy-compliance problem.

1. A Framework for Comparing Privacy Laws

A useful comparison begins with six questions:

Privacy laws generally distinguish the organisation deciding why and how data is processed from the organisation performing processing on instructions. The GDPR calls these parties the controller and processor. California commonly uses business, service provider and contractor. The DPDP Act uses data fiduciary and data processor. Although the labels differ, the central question is similar: who determines the purpose and essential means of processing?

A privacy programme should therefore begin with a data map rather than a jurisdictional guess. It should record the categories of personal data, individuals concerned, purposes, systems, recipients, locations, retention periods, vendors and legal bases or permissions.

2. The GDPR

2.1 Structure and regulatory philosophy

The GDPR is Regulation (EU) 2016/679. As an EU regulation, it applies directly within Member States, subject to the distribution of responsibilities between EU institutions and national supervisory authorities. It is built around principles, individual rights, organisational accountability and risk-sensitive governance.

Personal data means information relating to an identified or identifiable natural person. It includes obvious identifiers such as names and identification numbers, but may also include location data, online identifiers and factors relating to physical, genetic, economic or social identity. Special categories of personal data—such as health, biometric data used for uniquely identifying a person, racial or ethnic origin, political opinions and religious or philosophical beliefs—receive enhanced protection.

The core principles in Article 5 include lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. These principles are not merely policy statements. They guide the interpretation of specific duties and may support enforcement even where an organisation has completed a formal checklist.

2.2 Legal bases and responsibility

Processing must generally rely on one of the legal bases in Article 6: consent; performance of a contract or steps requested before entering a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest or official authority; or legitimate interests, subject to balancing against the interests and rights of the individual. Special-category processing normally requires an additional condition under Article 9.

Consent must be freely given, specific, informed and unambiguous. It should not be treated as a universal solution where a contract, legal duty or legitimate-interest assessment is more appropriate. Organisations must be able to demonstrate accountability, including records of processing, privacy notices, security measures, processor contracts and, where required, data protection impact assessments.

Controllers determine purposes and means. Processors act on documented instructions and must provide appropriate guarantees. A processor may become a controller, or share controller responsibility, if it independently determines purposes or essential means. Controllers can be required to appoint a data protection officer where the statutory conditions are met, including certain large-scale regular monitoring or large-scale processing of special categories.

2.3 Rights and governance duties

Data subjects may exercise rights including access, rectification, erasure, restriction, data portability and objection. Automated decision-making and profiling are subject to specific safeguards. Rights are important, but they are not absolute: legal obligations, freedom of expression, public interests and the rights of others can justify restrictions under defined conditions.

A personal-data breach must be documented and, where it presents a risk to individuals, notified to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches may also require communication to affected individuals. The 72-hour period is not a general deadline for solving the incident; it is a notification standard subject to the GDPR’s conditions.

2.4 Territorial reach

Article 3 gives the GDPR significant extraterritorial effect. It may apply to a non-EU organisation when it offers goods or services to individuals in the Union, whether payment is required or not, or monitors their behaviour as far as that behaviour takes place within the Union. Mere accessibility of a website from Europe does not automatically establish an offering. Evidence such as language, currency, targeted advertising, delivery arrangements or deliberate market activity may be relevant.

The GDPR may also apply to processing by an establishment of an organisation in the Union, even if the processing occurs elsewhere. International transfers require an appropriate mechanism, such as an adequacy decision, standard contractual clauses, binding corporate rules or a permitted derogation. Transfer analysis also considers the legal environment and practical safeguards in the destination country.

2.5 Enforcement and exemptions

National supervisory authorities investigate, issue warnings and reprimands, order compliance or deletion, limit processing, and impose administrative fines. The maximum level can reach €20 million or, for undertakings, 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for specified categories of infringement. The applicable amount depends on factors such as nature, gravity, duration, intent, mitigation, cooperation and prior history.

The GDPR contains exemptions and special rules for activities including national security, law enforcement governed by separate instruments, personal or household activity, journalism, academic or artistic purposes, and certain archiving, research and statistical activities. These provisions must be read carefully; an exemption for one activity does not necessarily remove all duties from the organisation.

3. CCPA and CPRA

3.1 Structure and scope

The CCPA is a California privacy statute amended substantially by the CPRA. It regulates certain for-profit businesses doing business in California that meet statutory thresholds, generally involving annual gross revenue, the volume of personal information processed, or revenue derived from selling or sharing personal information. Thresholds and definitions should be checked against the current statutory text and regulations before making a compliance decision.

The CCPA defines personal information broadly as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household. It includes categories such as identifiers, commercial information, internet or network activity, geolocation, professional information and inferences. Sensitive personal information receives additional treatment.

The CCPA is a consumer-rights statute with disclosure, choice and governance features. It is not identical to the GDPR. In particular, California’s concepts of “sale” and “sharing” can include transfers for monetary or other valuable consideration, and “sharing” is relevant to cross-context behavioural advertising.

3.2 Rights and duties

Subject to statutory limits, California consumers may have rights to know or access information, delete information, correct inaccurate information, opt out of sale or sharing, limit use and disclosure of sensitive personal information, and receive equal treatment for exercising rights. Businesses must provide notices at collection and respond to verified requests within prescribed periods, subject to extensions and exceptions.

The CPRA created the California Privacy Protection Agency, which shares enforcement responsibility with the California Attorney General. Covered organisations should maintain data inventories, notices, contracts with service providers and contractors, request-verification procedures, retention policies and opt-out mechanisms. The law also addresses risk assessments and automated decision-making through evolving regulations and rulemaking.

3.3 Territorial reach and exemptions

The CCPA may apply to businesses outside California when they do business in California and satisfy the statutory coverage requirements. The relevant analysis focuses on the business and its activities, not simply where the server is located. A company should examine California customers, advertising, data monetisation, corporate relationships and revenue.

The statute includes exclusions for certain information regulated by other laws, including specified health, financial and motor-vehicle information, as well as exemptions for contexts such as employment-related information and certain business-to-business communications, although the exact status of exemptions can change through legislation. Excluding a category from one CCPA provision does not necessarily remove all obligations concerning the organisation or other data.

A limited private right of action applies to certain data breaches involving specified categories of personal information when statutory conditions are met. Much broader enforcement is undertaken by public authorities. Contractual restrictions on service providers, contractors and third parties are therefore central to compliance.

4. India’s Digital Personal Data Protection Act, 2023

4.1 Basic architecture

The DPDP Act regulates digital personal data. It uses the term “Data Principal” for the individual to whom personal data relates and “Data Fiduciary” for the person who determines the purpose and means of processing. A “Data Processor” processes personal data on behalf of a Data Fiduciary. The Act also recognises Consent Managers and provides for a Data Protection Board of India.

The Act is organised around notice, consent, certain legitimate uses, duties of Data Fiduciaries, rights and duties of Data Principals, children’s data, significant Data Fiduciaries, cross-border transfers, exemptions and penalties. It is deliberately different from the GDPR: it does not reproduce the GDPR’s full catalogue of legal bases, and its terminology reflects an Indian legislative design.

Processing generally requires consent or a specified legitimate use. Consent should be free, specific, informed and capable of being withdrawn. Notices should explain the personal data and purpose in clear terms. A Data Fiduciary remains responsible for processing performed by a Data Processor on its behalf and should use contractual and technical controls to manage that relationship.

4.2 Rights, duties and children

Data Principals receive rights including access to information about personal data and processing, correction and erasure, grievance redressal, and nomination of another person in specified circumstances. They also have duties, such as complying with applicable law and not impersonating another person or suppressing material information in specified contexts.

The Act imposes obligations concerning reasonable security safeguards, breach notification, erasure when retention is no longer necessary subject to legal requirements, and grievance handling. It provides additional protections for children, including restrictions concerning tracking, behavioural monitoring and targeted advertising directed at children, subject to the statutory framework and exemptions.

The Central Government may notify Data Fiduciaries or classes as Significant Data Fiduciaries based on factors such as volume and sensitivity of data, risk to sovereignty and integrity, risk to electoral democracy, security of the State, and public order. Additional obligations may then apply, including appointment of responsible officers, independent data audits and impact assessments.

4.3 Territorial reach and exemptions

The DPDP Act applies to processing of digital personal data within India, including data collected in digital form and data collected offline and subsequently digitised. It may also apply to processing outside India when connected with offering goods or services to Data Principals within India. The Central Government may restrict transfers to specified countries or territories through notification. Organisations must therefore monitor subordinate legislation and official notifications rather than rely only on the Act’s principal text.

Exemptions may apply to the State and its instrumentalities in specified circumstances, legal rights and claims, courts and regulatory functions, crime prevention and investigation, mergers and corporate restructuring, loan assessment, and notified classes of processing. Exemptions are purpose-specific and should be documented; they are not a blanket permission to disregard security or governance.

The Data Protection Board may inquire into non-compliance, impose monetary penalties and issue directions according to the Act. The schedule provides potentially substantial penalties, including a maximum penalty that can extend to ₹250 crore for certain failures to take reasonable security safeguards. The actual amount depends on the statutory framework and circumstances.

5. Indian Sectoral and Complementary Regulation

A general privacy law does not displace every sectoral rule. Organisations operating in India may need to comply simultaneously with the Information Technology Act, 2000 and rules made under it, sectoral directions, contractual duties and rules governing cybersecurity or records.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 historically supplied requirements for sensitive personal data, privacy policies, consent and security practices. Their continuing relevance must be assessed alongside the DPDP Act, subsequent rules and government notifications. They should not be treated as a substitute for current legal analysis.

The Reserve Bank of India regulates aspects of payment data, outsourcing, cybersecurity, digital lending and information systems. Financial entities must also consider banking secrecy, fraud monitoring, record retention and incident-reporting duties. The Insurance Regulatory and Development Authority of India and the Securities and Exchange Board of India issue sector-specific requirements for regulated entities and intermediaries.

Health information may be affected by clinical, medical-record, telemedicine and health-data requirements, as well as contractual and professional confidentiality. Telecommunications entities may face licence conditions and sectoral security directions. Government systems can be subject to public-record, national-security and access-to-information rules. In every sector, the compliance question is cumulative: which rule imposes the stricter or more specific obligation, and can all duties be performed together?

6. Jurisdiction and Conflicts of Law

6.1 A practical jurisdictional method

A cross-border assessment can be organised into seven steps:

1. Identify the persons, data and processing operations.
2. Locate the organisation, establishments, individuals and systems.
3. Determine whether the organisation offers, sells, monitors or targets services in another jurisdiction.
4. Classify the organisation’s role under each applicable law.
5. Check sectoral laws, contractual obligations and public-authority requirements.
6. Map transfers, access from abroad, vendors and onward disclosures.
7. Compare retention, disclosure, access, security and government-request duties, then document the control that satisfies each requirement.

Physical storage is only one fact. A company in Singapore may be subject to the GDPR because it monitors EU residents, to California law because it meets Californian thresholds, and to Indian law because it offers services in India. A cloud provider’s data centre location does not by itself decide jurisdiction.

6.2 Common conflicts

Conflicts arise when one law requires disclosure and another restricts it; when retention is required by financial law but deletion is requested under privacy law; when employee monitoring is permitted in one country but restricted in another; or when a transfer mechanism is legally available but surveillance risks make it inadequate in practice.

The usual response is not to choose one law informally. Organisations should identify the exact obligation, determine whether an exception or lawful process resolves the conflict, consult local counsel for high-risk matters, and use technical separation where necessary. Data localisation may reduce some transfer risks but does not automatically remove extraterritorial application.

A useful governance principle is “highest common standard where feasible, local variation where necessary.” One global baseline can cover security, minimisation, access control, retention governance and incident response. Local supplements can address notices, rights, consent language, representatives, regulator contacts and transfer rules.

7. Applied Case: A Global Health-Technology Platform

Illustrative case. MedConnect operates a telehealth platform incorporated in the United States. It offers appointments to residents of France, California and India. It uses a cloud processor in Singapore, a customer-support vendor in the Philippines and an analytics provider that creates advertising audiences. Doctors upload health information; the platform records device identifiers, appointment history, billing information and approximate location.

Background and problem

MedConnect initially used one short privacy notice and a single marketing-consent box. It retained all records indefinitely, allowed the analytics provider to reuse pseudonymised data for its own advertising, and permitted support staff to access entire patient files. A French patient requests access and deletion. A California user opts out of sharing. An Indian customer complains that a breach was not communicated. The company asks whether one law governs all operations.

Analysis

The GDPR is likely relevant because MedConnect offers services to individuals in the Union and processes health data, a special category. The organisation must establish appropriate legal conditions, minimise access, assess high-risk processing, control processors and analyse international transfers. The California law may apply if the business meets statutory thresholds; the advertising disclosure may constitute sharing or sale depending on the facts, while health-information exclusions must be examined carefully. The DPDP Act may apply to services offered in India and creates duties regarding notice, security, rights and breach response.

Sectoral health and professional-confidentiality rules may add requirements. The analytics provider’s independent advertising use may mean it is not merely a processor or service provider. The company must also distinguish medical-record retention required by law from unnecessary indefinite retention.

Approach and solution

MedConnect should create jurisdiction-specific data maps and role classifications; separate clinical care, billing, support and advertising purposes; obtain appropriate consent or rely on another valid legal basis where permitted; and prohibit secondary use without a lawful and transparent basis. It should implement role-based access, encryption, logging, retention schedules, deletion or restriction workflows, verified rights-request procedures, processor contracts and transfer assessments.

The company should stop using health data for advertising unless a lawful, ethically defensible and clearly disclosed basis exists. It should configure an opt-out mechanism for California sale or sharing where applicable, provide GDPR rights channels, and establish Indian grievance and breach procedures. Incident response should assess notification duties under every applicable law rather than wait for one regulator’s direction.

Outcome and learning points

The correct result is not “the country where the company is incorporated wins.” Multiple frameworks apply to different aspects of the same operation. A defensible programme links each data flow to a purpose, role, legal condition, recipient, retention period, transfer safeguard and rights process. The case also shows why pseudonymisation does not automatically make data anonymous, why vendors can change legal roles through their actual conduct, and why sectoral law must be analysed alongside general privacy law.

8. Professional Practice, Technology and AI

Privacy compliance is increasingly supported by data-discovery tools, consent-management platforms, automated rights-request systems, access analytics and artificial-intelligence systems. These tools can identify records and detect unusual access, but they do not determine legal responsibility by themselves. An AI classifier may misidentify a person, fail to recognise sensitive data, or reproduce biased decisions. Human review, testing, audit logs and escalation procedures remain necessary.

Organisations should apply privacy by design and by default: collect less, restrict default visibility, separate purposes, limit retention, test deletion, protect keys, monitor vendors and document decisions. A data protection impact assessment or equivalent risk assessment should address necessity, proportionality, threats, affected groups, controls and residual risk. It should be revisited when a model, purpose, vendor or jurisdiction changes.

Important limitations should be recognised. Statutes change; regulator guidance may be non-binding but influential; terms such as “doing business,” “monitoring,” “sale,” “sharing” and “offering services” depend on facts; and enforcement practice may differ from formal text. A compliance matrix is therefore a management tool, not a legal opinion.

Best-Practice Checklist

• Maintain a current inventory of personal-data flows.
• Record the jurisdictional trigger for each relevant law.
• Classify organisations as controller, processor, business, service provider, fiduciary or processor according to actual functions.
• Use clear, layered and jurisdiction-appropriate notices.
• Separate clinical, operational, security and marketing purposes.
• Keep a register of vendors, onward transfers and government-access risks.
• Apply minimisation, retention limits, encryption, access control and monitoring.
• Provide tested rights-request and grievance procedures.
• Document breach decisions and notification timelines.
• Review sectoral requirements before launching a regulated service.
• Reassess the programme when entering a new market or deploying AI.

Chapter Summary

The GDPR, CCPA/CPRA and DPDP Act share a concern with responsible handling of personal data but differ in terminology, scope, rights, legal conditions, exemptions and enforcement. The GDPR is principle-based and strongly accountability-oriented, with broad territorial reach and detailed rules for special-category data and international transfers. The CCPA/CPRA focuses on Californian consumers, business thresholds, transparency, access, deletion, correction and choices concerning sale, sharing and sensitive personal information. India’s DPDP Act establishes Data Principals, Data Fiduciaries and Data Processors, regulates digital personal data, creates a Data Protection Board and operates alongside sectoral rules.

Territorial application depends on facts such as targeting, monitoring, establishment, data subjects and processing activities—not simply server location. Sectoral laws can add duties concerning finance, health, telecommunications and cybersecurity. Effective compliance requires data mapping, role classification, purpose limitation, contractual controls, rights procedures, transfer analysis, security and documented governance. In a conflict, organisations should analyse the precise duties, applicable exceptions and lawful processes rather than select one jurisdiction informally.

Key Terms

Personal data: Information relating to an identified or identifiable person.

Data subject: An individual to whom personal data relates; called a Data Principal under India’s DPDP Act.

Controller: An organisation that determines the purposes and means of processing under the GDPR.

Processor: An organisation processing data on behalf of a controller or Data Fiduciary.

Data Fiduciary: The person determining the purpose and means of processing under the DPDP Act.

Business: A covered organisation regulated by the CCPA.

Service provider: A CCPA-regulated recipient processing information for a business under contractual restrictions.

Processing: An operation performed on personal data, including collection, use, disclosure, storage or deletion.

Special-category data: GDPR data receiving enhanced protection, such as health, biometric or political-opinion data.

Sensitive personal information: California information subject to additional rights and controls.

Consent: A voluntary, informed and specific indication of an individual’s wishes.

Data minimisation: Limiting collection and use to what is necessary for a stated purpose.

Purpose limitation: Using data consistently with specified and legitimate purposes.

Data breach: A security incident involving unauthorised or accidental destruction, loss, alteration, disclosure or access.

Territorial scope: The geographical and activity-based circumstances in which a law applies.

Data Protection Impact Assessment: A structured assessment of high-risk processing and mitigation measures.

Cross-border transfer: Making personal data available across national or regional boundaries.

Data Protection Board of India: The statutory Indian body responsible for specified inquiries and penalties under the DPDP Act.

Sectoral regulation: Rules applying to a particular industry or activity, such as banking or healthcare.

Pseudonymisation: Processing that separates identifying information from data while allowing re-linkage using additional information.

Review Questions

Short Answer Questions

1. What is the difference between a GDPR controller and processor?
2. Identify two factors that may establish GDPR territorial reach for a non-EU organisation.
3. What is the purpose of a CCPA notice at collection?
4. Name two rights available to Data Principals under the DPDP Act.
5. Why does server location not by itself determine jurisdiction?

Long Answer Questions

1. Compare the principles and legal structure of the GDPR, CCPA/CPRA and DPDP Act.
2. Explain how exemptions can alter privacy-law analysis without eliminating all organisational duties.
3. Discuss the importance of processor, service-provider and Data Processor contracts.
4. Analyse the role of sectoral regulation in Indian privacy compliance.
5. Explain how an organisation should prepare for international data transfers.

Analytical / Application Questions

1. A Canadian application monitors users in France and targets them with behavioural advertising. Analyse whether the GDPR may apply and identify the main compliance issues.
2. A financial company operating in California and India receives a deletion request for records that financial law requires it to retain. Explain how the company should analyse the apparent conflict.
3. A health platform uses a vendor that reuses pseudonymised patient data for its own advertising. Determine what facts are relevant to role classification, lawful processing, transparency and risk control.

Multiple Choice Questions with Answers

Question 1

Which GDPR role determines the purposes and means of processing personal data?

A. Controller

B. Processor

C. Data Protection Officer

D. Supervisory authority

Correct Answer: A. Controller

Question 2

Which activity can trigger GDPR application to a non-EU organisation under Article 3?

A. Having an internet server anywhere in the world

B. Offering services to individuals in the Union

C. Employing a person who has travelled to Europe

D. Using encryption software developed in Europe

Correct Answer: B. Offering services to individuals in the Union

Question 3

Which is a core GDPR principle?

A. Unlimited retention

B. Purpose limitation

C. Mandatory public disclosure of all data

D. Collection of every potentially useful attribute

Correct Answer: B. Purpose limitation

Question 4

Under the CCPA/CPRA, which activity may be relevant to the concept of sharing?

A. Cross-context behavioural advertising disclosure

B. Deleting a consumer record

C. Internal password rotation

D. Physical destruction of obsolete hardware

Correct Answer: A. Cross-context behavioural advertising disclosure

Question 5

Which institution is associated with California privacy enforcement after the CPRA?

A. European Data Protection Board

B. California Privacy Protection Agency

C. Data Protection Board of India

D. Reserve Bank of India

Correct Answer: B. California Privacy Protection Agency

Question 6

What is the Indian DPDP Act’s term for the individual to whom personal data relates?

A. Consumer Controller

B. Data Principal

C. Data Custodian

D. Registered Subject

Correct Answer: B. Data Principal

Question 7

Which statement best describes India’s DPDP Act territorial reach?

A. It applies only to companies incorporated in India

B. It can cover processing outside India connected with offering goods or services in India

C. It applies only when data is stored on Indian servers

D. It excludes all digital data collected outside India

Correct Answer: B. It can cover processing outside India connected with offering goods or services in India

Question 8

Why are sectoral laws important in privacy compliance?

A. They automatically replace every general privacy law

B. They may impose additional duties on regulated activities

C. They apply only to social-media companies

D. They eliminate the need for vendor contracts

Correct Answer: B. They may impose additional duties on regulated activities

Question 9

Which is the best first step in a cross-border privacy assessment?

A. Delete all data immediately

B. Identify data flows, people, purposes and locations

C. Assume the company’s incorporation country controls

D. Move every database to one country

Correct Answer: B. Identify data flows, people, purposes and locations

Question 10

Why may a pseudonymised dataset still require privacy controls?

A. Pseudonymisation always makes data public

B. The data may be re-linked using additional information

C. Pseudonymisation prohibits encryption

D. Pseudonymised data cannot be processed

Correct Answer: B. The data may be re-linked using additional information