Why One Privacy Policy No Longer Works

A single privacy policy once covered a whole business. Those days are over. More than 140 countries now have data protection laws, and they do not agree with each other. The European Union enforces the General Data Protection Regulation, known as GDPR. California runs the California Consumer Privacy Act, or CCPA. Brazil applies the Lei Geral de Proteção de Dados, or LGPD. China enforces the Personal Information Protection Law, or PIPL, which took effect in 2021. Each law sets its own rules on consent, storage, and transfer.

These frameworks share a common root. LGPD and PIPL both borrow structure from GDPR. Yet the details diverge sharply. GDPR treats privacy as a fundamental right and demands a legal basis for every use of personal data. The CCPA focuses on consumer choice and the right to opt out of data sales. PIPL adds state access provisions and strict controls on moving data out of China. A policy written for one market can breach the rules of another.

The Cost of Getting It Wrong

Penalties make the gap expensive. GDPR allows fines of up to 20 million euros or 4 percent of a company’s global annual turnover, whichever is higher. Regulators have issued fines running into hundreds of millions of euros against large technology firms. PIPL also carries heavy penalties and can suspend a company’s ability to process data inside China. The financial risk scales with the size of the business, so global firms face the largest exposure.

Enforcement now reaches across borders. GDPR applies to any company that processes the data of people in the EU, even if the company sits outside Europe. This extraterritorial reach means a business in the United States or Asia can fall under EU rules simply by serving EU users. Courts and regulators continue to test how far this reach extends, but the practical effect is clear. Location no longer shields a company from foreign privacy law.

Data Localisation and the Transfer Problem

Many laws now restrict where data can physically sit. Data localisation rules require certain information to stay inside national borders or to move only to approved countries. GDPR limits transfers to non-EU countries unless those countries offer adequate protection. A 2025 study that measured server infrastructure across 19 EU countries found that, on average, only 2.3 percent of servers serving users in each country sat in non-adequate destinations. This suggests most content providers already comply, though exceptions remain.

Localisation carries an economic price. Research on cross-border data flows estimated that open data movement raised world output by around 10 percent compared with a scenario without such flows. In contrast, one study estimated that data localisation rules in Indonesia could reduce national output by about 0.7 percent. These figures show the tension at the centre of the debate. Governments want control over citizen data, while companies want the efficiency of global infrastructure.

Building a Policy That Travels

Firms respond by dropping the single global policy and adopting a regional approach. A common method is to build one strong baseline that meets the strictest standard, usually GDPR, then add local terms for each market. This layered structure covers consent language, retention periods, and the specific rights each law grants. It also names a local contact or representative where a law requires one.

Practical steps reduce the risk. Map where data is collected, stored, and sent. Identify which laws apply to each data flow. Set transfer mechanisms, such as approved contract clauses, before moving data across borders. Review the policy on a fixed schedule, since new laws appear each year and existing ones change. The global privacy puzzle has no single solution, but a clear map of obligations and a layered policy give a business a workable path through it.