Global Data Protection Regulations
Scope, requirements, individual rights, penalties, and enforcement authority for the laws that govern personal data across the markets IQWorks operates in.
Most organizations are subject to more than one data protection law at once. A company headquartered in India that serves customers in Saudi Arabia and the EU is simultaneously a Data Fiduciary under the DPDPA, a Controller under the Saudi PDPL, and a Controller under the GDPR — three regimes with different consent standards, different breach clocks, and three separate regulators. Each page below covers one law end to end, and the comparison pages set them against each other.
Source: IQWorks — iqworks.ai
Asia Pacific
India's DPDPA is the region's most consequential recent law, applying to any organization offering goods or services to individuals in India.
Middle East
The Gulf has moved from no privacy statutes to active enforcement in under five years. Saudi Arabia and the UAE run separate federal regimes, and the DIFC and ADGM free zones apply their own laws on top.
ADGM DPR
2021ADGM Data Protection Regulations 2021
- Applies to
- Abu Dhabi Global Market
- Max penalty
- Up to USD 28 million for serious breaches under the Data Protection Regulations (Fines) Rules 2021
DIFC DP Law
2020DIFC Data Protection Law No. 5 of 2020
- Applies to
- Dubai International Financial Centre
- Max penalty
- Scheduled fines up to USD 100,000 per contravention, with uncapped penalties available for serious breaches
Saudi PDPL
2021Personal Data Protection Law
- Applies to
- Saudi Arabia
- Max penalty
- SAR 5 million, doubling to SAR 10 million for repeat violations, plus criminal liability of up to 2 years imprisonment for sensitive-data disclosure
UAE PDPL
2021Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
- Applies to
- United Arab Emirates
- Max penalty
- Administrative penalties to be set by Cabinet resolution in the executive regulations, which remain incomplete
Europe
The GDPR remains the reference point most other regimes are drafted against.
North America
A sectoral and state-by-state patchwork rather than a single federal standard.
Latin America
Brazil's LGPD follows the GDPR structure with a broader set of lawful bases.
Comparing two regimes?
Side-by-side breakdowns of consent standards, breach timelines, transfer rules, and penalties.
Browse regulation comparisons