Privacy Law Across Borders: A Developer's Guide to US, Canadian, and UK Data Regulations

Privacy law is not a single global standard. The United States, Canada, and the United Kingdom each operate under distinct frameworks built on different philosophical foundations, enforced by different regulators, and carrying different consequences for non-compliance. A software product that is fully compliant in one jurisdiction may be in active violation in another — not because the developers acted carelessly, but because they optimised for the rules they knew and underestimated the rules they didn't.

This matters most when you are building products that touch users across borders — a SaaS platform with customers in multiple countries, an AI system trained on data from different jurisdictions, or a healthcare or fintech product expanding internationally. The developers and product leaders who understand the structural differences between these frameworks make better architecture decisions, catch compliance gaps earlier, and build products that can scale internationally without costly retrofitting.

This guide covers each framework clearly, surfaces the key differences that matter most for software teams, and explains what operating across all three jurisdictions actually requires.

Key Takeaways

• The United States has no comprehensive federal privacy law — instead, a patchwork of sector-specific federal laws and increasingly stringent state laws apply depending on your industry and your users' location.
• Canada's federal privacy law (PIPEDA) applies to most private-sector organisations and is being replaced by the Consumer Privacy Protection Act (CPPA) — while Quebec has already enacted significantly stricter rules under Law 25 that are already in force.
• The UK operates under UK GDPR — a post-Brexit domestication of EU GDPR that remains substantially equivalent to the EU version for now, but is diverging through proposed reform legislation.
• Consent models, breach notification timelines, data subject rights, and cross-border transfer mechanisms differ meaningfully across all three jurisdictions.
• AI-specific obligations are emerging in all three frameworks, with the UK and Canada advancing AI governance rules that directly affect how AI products handle personal data.
• Software teams building for all three markets need jurisdiction-aware data architecture from the start — not compliance retrofitted after international expansion begins.

---

The United States: A Patchwork Without a Centre

The defining characteristic of US privacy law is fragmentation. Unlike the EU, Canada, or the UK, the United States has no comprehensive federal privacy statute governing the general collection and use of personal data by private-sector companies. Instead, privacy regulation in the US is distributed across a constellation of sector-specific federal laws, an expanding body of state law, and FTC enforcement authority derived from general consumer protection powers.

The Federal Sector-Specific Framework

Federal privacy law in the US applies to specific industries and data types rather than to personal data broadly. The frameworks most relevant to software developers are:

• HIPAA (Health Insurance Portability and Accountability Act) — governs Protected Health Information (PHI) held by covered entities and their business associates. Applies to software that creates, receives, maintains, or transmits PHI on behalf of healthcare providers, insurers, or clearinghouses. Enforced by the Department of Health and Human Services Office for Civil Rights.
• GLBA (Gramm-Leach-Bliley Act) — governs the collection and disclosure of non-public personal financial information by financial institutions. If your product integrates with banks, insurance companies, or other financial institutions, your data handling obligations may flow through GLBA-governed contracts.
• FERPA (Family Educational Rights and Privacy Act) — governs educational records. Relevant to edtech products used by schools receiving federal funding.
• COPPA (Children's Online Privacy Protection Act) — governs online collection of personal information from children under 13. Applies to any product that knowingly collects data from children, regardless of industry.
• FCRA (Fair Credit Reporting Act) — governs consumer reporting agencies and the use of consumer reports. Relevant to credit decisioning, background check, and employment screening products.

The critical point for software teams: federal sector laws apply based on what your product does and what data it handles — not based on geography. A Canadian or UK company building a healthcare AI product for US hospital customers is subject to HIPAA. A fintech startup serving US consumers falls under GLBA and potentially FCRA regardless of where the startup is incorporated.

State Privacy Laws: The New Regulatory Centre

In the absence of federal omnibus privacy legislation, the states have moved aggressively. California's CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act) is the most stringent and has become the practical de facto national standard for US privacy for companies above the applicability thresholds.

The CPRA applies to for-profit businesses doing business in California that meet any one of three thresholds: annual gross revenue exceeding $25 million, buying or selling the personal information of 100,000 or more consumers or households annually, or deriving 50% or more of annual revenue from selling consumers' personal information. For most growth-stage software companies with California users, the thresholds are reached earlier than expected.

Key CPRA rights and obligations include:

• Right to know — consumers can request disclosure of what personal information a business has collected about them and how it is used and shared
• Right to delete — consumers can request deletion of their personal information, subject to specific exceptions
• Right to correct — consumers can request correction of inaccurate personal information
• Right to opt out of sale or sharing — businesses must provide a "Do Not Sell or Share My Personal Information" mechanism; the definition of "sharing" is deliberately broad and captures targeted advertising
• Right to limit use of sensitive personal information — consumers can restrict use of sensitive categories (precise geolocation, race, religion, health, financial, biometric, and sexual orientation data) to what is necessary to provide the requested service
• Opt-in consent for minors — businesses must obtain opt-in consent before selling or sharing the personal information of consumers under 16
• Data minimisation and purpose limitation — personal information must be collected only to the extent reasonably necessary for the disclosed purpose

Beyond California, comprehensive state privacy laws are now in force in Virginia, Colorado, Connecticut, Utah, Texas, Florida, Montana, Oregon, and several others, with more enacted annually. While most are less stringent than CPRA, they each have distinct provisions on consent, data subject rights, and applicability thresholds that require individual review.

FTC Enforcement

Where no specific statute applies, the Federal Trade Commission exercises privacy enforcement authority under Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. Companies that make privacy commitments in their privacy policies and then fail to honour them face FTC enforcement risk regardless of whether a specific privacy law applies. The FTC has also used this authority to impose requirements on companies whose data security practices it deems unreasonably lax, even without a specific breach.

---

Canada: PIPEDA, Quebec Law 25, and the Coming CPPA

Canada has operated under a comprehensive federal private-sector privacy law since 2000 — the Personal Information Protection and Electronic Documents Act (PIPEDA). Unlike the US, Canada starts from the premise that organisations must have a lawful basis to collect, use, and disclose personal information, and that individuals have rights over their information regardless of what industry the organisation operates in.

PIPEDA: The Current Framework

PIPEDA applies to private-sector organisations engaged in commercial activities in Canada, and to personal information collected in the course of those activities. It is grounded in ten Fair Information Principles derived from the Canadian Standards Association model code:

• Accountability — organisations must designate an individual responsible for privacy compliance
• Identifying purposes — purposes for collection must be identified before or at the time of collection
• Consent — meaningful consent is required for collection, use, and disclosure
• Limiting collection — collection limited to what is necessary for the identified purposes
• Limiting use, disclosure, and retention — information used only for purposes for which it was collected, retained only as long as necessary
• Accuracy — information must be accurate, complete, and current as required
• Safeguards — appropriate security safeguards proportionate to the sensitivity of the information
• Openness — policies and practices for managing personal information must be readily available
• Individual access — individuals can access their personal information and challenge its accuracy
• Challenging compliance — individuals can challenge the organisation's compliance with the principles

PIPEDA's consent model is more nuanced than a simple opt-in requirement. Consent can be express or implied, and the appropriate form depends on the sensitivity of the information and the reasonable expectations of the individual. Implied consent is acceptable for less sensitive data in contexts where a reasonable person would expect the use — but for sensitive data categories, express consent is required.

PIPEDA includes mandatory breach notification: organisations must report to the Office of the Privacy Commissioner (OPC) any breach of security safeguards that creates a real risk of significant harm to an individual, and must notify the affected individuals directly. Records of all breaches must be maintained for 24 months.

Quebec Law 25: Canada’s Strictest Privacy Regime

Quebec enacted Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) in stages between September 2022 and September 2023. For companies operating in Quebec or handling personal information of Quebec residents, Law 25 represents the most stringent privacy requirements currently in force in Canada — stricter than PIPEDA and broadly comparable to GDPR in several respects.

Key Law 25 requirements that exceed PIPEDA obligations:

• Privacy impact assessments (PIAs) — required before any technology acquisition, development, or redesign that involves personal information, and before any cross-border disclosure of personal information
• Privacy by default — only the personal information necessary for the stated purpose may be collected, and the highest level of confidentiality must be the default setting
• Right to data portability — individuals have the right to receive their personal information in a structured, commonly-used technological format
• Right to de-indexation — individuals can require that hyperlinks connecting their name to information that causes them harm be de-indexed from a technology-based product
• Mandatory DPO equivalent — organisations must publish the name or title of the person responsible for personal information protection
• 72-hour breach notification — breaches presenting a risk of serious injury must be reported to the Commission d'accès à l'information (CAI) within 72 hours of becoming aware of the breach — significantly tighter than PIPEDA
• Explicit consent for sensitive uses — explicit opt-in consent required for sensitive information and for automated decision-making with legal or significant effects on individuals

Penalties under Law 25 are substantial: administrative monetary penalties of up to 25 million CAD or 4% of worldwide turnover, whichever is greater — directly mirroring GDPR's penalty structure. For software companies accustomed to PIPEDA's historically modest enforcement, Law 25 represents a significant escalation.

Bill C-27: The Federal Reform Coming

The federal government introduced Bill C-27 in 2022, which would replace PIPEDA with three new federal statutes: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA).

The CPPA modernises Canada's federal privacy framework significantly — introducing stronger consent requirements, expanded individual rights (including data portability and the right to de-index), enhanced enforcement with penalties up to 5% of global revenue, and specific provisions for automated decision-making. AIDA would create the first federal AI regulatory framework in Canada, requiring impact assessments for high-impact AI systems and imposing transparency and human oversight obligations. Bill C-27 was still progressing through Parliament as of early 2026 — it has not yet received Royal Assent, but its direction is clear and worth designing for now.

---

The United Kingdom: UK GDPR After Brexit

When the UK left the European Union, it faced an immediate question about its data protection framework: the EU GDPR, which had applied directly in the UK as EU law, no longer had legal effect after Brexit. The UK's solution was to domesticate GDPR into UK law through the Data Protection Act 2018 (DPA 2018) and the retained version of EU GDPR, now referred to as UK GDPR. The result is a framework that is, for now, substantially equivalent to EU GDPR — but is beginning to diverge.

UK GDPR: The Core Framework

UK GDPR applies to the processing of personal data in the context of activities carried out by a controller or processor established in the UK, and to processing of personal data of individuals located in the UK by organisations outside the UK when that processing relates to offering goods or services to UK individuals or monitoring their behaviour.

The lawful bases for processing under UK GDPR mirror those under EU GDPR:

• Consent — freely given, specific, informed, and unambiguous
• Contract performance — processing necessary for a contract with the individual
• Legal obligation — processing necessary to comply with a legal requirement
• Vital interests — processing necessary to protect life
• Public task — processing necessary for a task in the public interest or official authority
• Legitimate interests — processing necessary for the legitimate interests of the controller or a third party, where those interests are not overridden by the individual's rights

Individual rights under UK GDPR include: right to be informed, right of access, right to rectification, right to erasure, right to restrict processing, right to data portability, right to object, and rights relating to automated decision-making and profiling. Controllers must respond to subject access requests within one calendar month.

Breach notification under UK GDPR requires notifying the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. If the breach is likely to result in a high risk to individuals, those individuals must also be notified without undue delay.

The ICO as Regulator

The Information Commissioner's Office (ICO) is the UK's independent data protection regulator. The ICO has demonstrated a willingness to use its enforcement powers — imposing fines up to £17.5 million or 4% of global annual turnover, whichever is higher, for serious violations. Importantly, the ICO also issues detailed guidance on specific topics (AI, cookies, children's data, biometrics, employment) that functions as a practical compliance resource beyond the statutory text.

The ICO's approach to enforcement has historically been more measured than some EU supervisory authorities — but its enforcement posture has tightened, and high-profile enforcement actions against major platforms have demonstrated that the maximum penalty tier is not theoretical.

UK Divergence: The Data (Use and Access) Bill

The UK government has been pursuing reform of its data protection framework since 2022, seeking to differentiate from EU GDPR while maintaining adequacy — the EU's designation that the UK provides equivalent privacy protection, which is essential for free data flows between the EU and UK. The Data (Use and Access) Bill (the successor to the failed Data Protection and Digital Information Bill) is advancing through Parliament and would introduce a number of changes from EU GDPR: a more flexible accountability regime, changes to cookie consent requirements, reforms to the legitimate interests basis, and a revised scientific research exemption. While the changes are presented as simplification rather than weakening, their compatibility with EU adequacy is actively monitored by the European Commission.

---

Jurisdiction-by-Jurisdiction Comparison

The table below compares the key dimensions that matter most for software teams operating across all three markets.

Dimension	United States	Canada (Federal / Quebec)	United Kingdom
Governing framework	Sector-specific federal laws + state omnibus laws (CCPA/CPRA most significant)	PIPEDA (federal) / Law 25 (Quebec); CPPA forthcoming	UK GDPR + Data Protection Act 2018
Applies to	Varies by law; CCPA applies to for-profit businesses above defined thresholds doing business in California	Private-sector organisations in commercial activities; Law 25 applies to Quebec residents' data	Controllers/processors established in UK; organisations outside UK targeting UK individuals
Legal basis for processing	Primarily notice-and-opt-out model (CCPA); sector laws vary (HIPAA uses different model)	Consent-based (express or implied); Law 25 requires explicit consent for sensitive data	Six lawful bases including consent, legitimate interests, contract performance
Breach notification timeline	Varies by state (typically 30–72 hours to regulator, individuals promptly); HIPAA: 60 days	PIPEDA: "as soon as feasible"; Quebec Law 25: 72 hours to CAI	72 hours to ICO; individuals notified without undue delay if high risk
Data subject rights	CCPA: know, delete, correct, opt out of sale/sharing, limit sensitive data use; varies by state	PIPEDA: access, correction; Law 25 adds portability, de-indexation	Full GDPR rights: access, rectification, erasure, portability, restriction, objection
Max penalties	CCPA: $2,500–$7,500 per violation; FTC/HIPAA/GLBA: significant but case-specific	PIPEDA: $100,000 CAD; Law 25: 25M CAD or 4% global revenue; CPPA: 5% global revenue	£17.5M or 4% global annual turnover, whichever is higher
Private right of action	CCPA: limited private right for data breaches; varies by state and federal law	No private right under PIPEDA or Law 25; complaint-based enforcement	No direct private right under UK GDPR; individuals may seek compensation through courts
Cross-border transfer mechanism	No specific transfer restriction mechanism; sector laws may impose requirements	PIPEDA requires comparable protection; Law 25 requires PIA and consent for cross-border transfers	Adequacy decisions, SCCs, binding corporate rules, or other approved mechanisms
Automated decision-making	Limited explicit regulation federally; CCPA provides opt-out rights for profiling	Law 25 requires disclosure and right to human review; CPPA would expand this	Article 22 right not to be subject to solely automated decisions with significant effects; must be able to request human review
Regulator	FTC + sector regulators (HHS/OCR for HIPAA, CFPB for financial); state AGs for state laws	Office of the Privacy Commissioner (OPC); CAI in Quebec	Information Commissioner's Office (ICO)

---

Cross-Border Data Transfers

For software teams building products that move personal data between jurisdictions, cross-border transfer rules are among the most operationally consequential privacy obligations. The three frameworks approach this very differently.

UK to Other Countries

UK GDPR restricts transfers of personal data to countries outside the UK unless an appropriate safeguard is in place. The ICO maintains a list of countries recognised as providing adequate protection — the UK has issued its own adequacy regulations for a number of countries post-Brexit. Where no adequacy decision exists, organisations must use an approved transfer mechanism such as International Data Transfer Agreements (IDTAs) — the UK's equivalent of EU Standard Contractual Clauses — or binding corporate rules.

The EU-UK relationship deserves specific attention: the EU extended adequacy to the UK in 2021 for four years, subject to review. This adequacy is not permanent and is contingent on the UK maintaining equivalent data protection standards. As the UK's reform legislation diverges from EU GDPR, the adequacy determination will come under increasing pressure.

Canada to Other Countries

PIPEDA requires that personal information transferred to a third party for processing — including a processor in another country — receive comparable protection. The organisation transferring the data remains accountable. Under Quebec Law 25, cross-border disclosures require both a prior Privacy Impact Assessment (PIA) and, in many cases, individual consent. The PIA must assess whether the foreign jurisdiction provides an adequate level of protection, and the result must be documented.

US to Other Countries

The United States does not have a general restriction on cross-border transfer of personal data at the federal level. However, where HIPAA applies, PHI crossing borders remains subject to HIPAA's safeguard requirements regardless of destination. CCPA does not restrict data transfers internationally but requires that service provider contracts include certain obligations that flow through to subprocessors, creating some practical equivalence to a transfer mechanism requirement.

For US companies transferring data to the EU or UK — outside the scope of this guide but commonly relevant — the EU-US Data Privacy Framework and the UK Extension provide the primary adequacy mechanism for qualifying US companies.

---

Implications for Software and AI Teams

Understanding the frameworks is necessary but not sufficient. The practical question for engineering and product teams is what multi-jurisdictional compliance actually requires in how you build.

Design for the Strictest Applicable Standard

For most software teams operating across all three markets, the pragmatic approach is to identify the strictest applicable requirement in each dimension — consent, breach notification, data subject rights, cross-border transfer — and build to that standard consistently. In practice, this means:

• Consent: Build explicit, informed, documented consent flows. UK GDPR and Quebec Law 25 both require this for their respective sensitive categories; building it universally eliminates the need to maintain jurisdiction-specific consent logic.
• Breach notification: Build for 72 hours. Quebec Law 25 and UK GDPR both require 72-hour notification. PIPEDA's "as soon as feasible" and most US state laws are satisfied by a faster response.
• Data subject rights: Implement the full set — access, correction, deletion, portability, restriction, objection. UK GDPR's full rights set is the most comprehensive; building it covers the narrower rights in PIPEDA and CCPA simultaneously.
• Data minimisation: Collect only what you need for the stated purpose. This principle appears in every framework and is the single highest-leverage practice for reducing cross-jurisdictional compliance risk.

Jurisdiction-Aware Data Architecture

Multi-jurisdictional compliance is much harder to retrofit than to design for. Key architectural considerations:

• Know where your data lives: Maintain a data map that records what personal data you collect, from users in which jurisdictions, stored in which systems, and processed by which subprocessors. This is required by UK GDPR's Records of Processing Activities (ROPA) obligation and is essential for responding to cross-border transfer inquiries under PIPEDA and Law 25.
• Data residency options: Some enterprise clients in each jurisdiction will require data to remain within their borders — particularly Canadian federal government clients (subject to the Policy on Service and Digital) and UK public sector clients. Design your infrastructure to support regional data residency from the start.
• Subprocessor management: Every third-party vendor you use to process personal data — cloud providers, analytics platforms, AI APIs, logging services — must be covered by an appropriate contract in each jurisdiction. UK GDPR requires Data Processing Agreements; PIPEDA requires contractual protections equivalent to your own obligations; Law 25 requires PIA documentation for cross-border subprocessors.

AI-Specific Considerations

AI products attract heightened scrutiny under all three frameworks, and the regulatory landscape is moving fast:

• Automated decision-making: UK GDPR Article 22 and Quebec Law 25 both impose specific obligations when automated systems make decisions with significant effects on individuals — including the right to human review. Design your AI workflows with human review mechanisms built in, and ensure individuals are informed when automated decision-making applies to them.
• Training data provenance: Using personal data to train AI models requires a lawful basis in each jurisdiction. Under UK GDPR, the legitimate interests basis is commonly used for research purposes but requires a documented balancing test. Under PIPEDA and Law 25, consent is the primary basis; using personal data for AI training without appropriate consent or de-identification creates material compliance exposure in Canada.
• Canada's forthcoming AIDA: The Artificial Intelligence and Data Act, part of Bill C-27, would impose specific obligations on high-impact AI systems — including mandatory impact assessments, transparency requirements, and human oversight obligations. Canadian AI developers should track this legislation closely as it advances.

---

FAQ

Our company is Canadian — do US privacy laws apply to us?

Yes, if you serve US users or clients. US privacy laws apply based on the data you handle and where your users are located, not solely where your company is incorporated. A Canadian company building a SaaS product used by California residents is subject to CCPA/CPRA if it meets the applicability thresholds. A Canadian company building healthcare software for US hospital clients must comply with HIPAA as a business associate. International incorporation does not create a safe harbour from US privacy obligations.

How does GDPR relate to UK GDPR? Are they the same?

They started from the same text but are now separate laws administered by different regulators. UK GDPR is the retained EU GDPR as modified for the UK domestic context, enforced by the ICO. EU GDPR continues to apply in EU member states and is enforced by EU supervisory authorities. A company processing data of both EU and UK individuals must comply with both — they share most provisions but have diverging details around transfer mechanisms, enforcement procedures, and some derogations. The UK's ongoing reform legislation is increasing the divergence.

We use a US-based AI API to process personal data from UK and Canadian users. What do we need?

For UK users: you need a UK GDPR-compliant transfer mechanism in place before transferring personal data to a US processor — typically an International Data Transfer Agreement (IDTA). Your contract with the AI API provider must include UK GDPR-compliant data processing terms. For Canadian users: under PIPEDA, your contract with the US processor must require equivalent protections to those you owe under PIPEDA. Under Quebec Law 25, you must complete a Privacy Impact Assessment before the cross-border disclosure and, in most cases, obtain consent. In both cases, verify that the AI API provider does not use data submitted via their API for model training, or that they provide contractual guarantees that are compatible with your obligations to your users.

Quebec Law 25 applies to us but we are not based in Quebec. Do we need to comply?

Law 25 applies to any person or organisation that collects personal information from individuals located in Quebec in the course of carrying on an enterprise, regardless of where the organisation is based. If you have Quebec residents as users or customers, and you collect personal information from them in a commercial context, Law 25 applies to you. This includes foreign companies with no physical presence in Quebec.

How should we handle data subject access requests across multiple jurisdictions?

Build a unified request handling process that satisfies the strictest applicable timelines and scope requirements. UK GDPR requires responses within one calendar month (extendable to three with notice in complex cases). PIPEDA requires responses within 30 days (extendable to 60 with notice). CCPA requires responses within 45 days. A 30-day process with structured intake, identity verification, and documented response workflow satisfies all three. The scope of what must be disclosed varies — UK GDPR's access right is the most comprehensive — so build your data retrieval process around the full UK GDPR scope and the narrower jurisdictional obligations are automatically satisfied.

What is the practical difference between PIPEDA consent and UK GDPR consent?

Both require that consent be informed and freely given, but they differ in default assumptions and the alternatives available. PIPEDA allows implied consent for less sensitive data in contexts where a reasonable person would expect the use — making it more permissive in practice. UK GDPR requires that consent be an unambiguous indication of agreement (affirmative action) and prohibits pre-ticked boxes or silence as consent; it is also just one of six lawful bases, and the legitimate interests basis often makes consent unnecessary for processing that PIPEDA would address through implied consent. Quebec Law 25 sits closer to UK GDPR: consent must be manifest, free, and informed, and separate from other information — implied consent is not sufficient for most purposes.

Last updated: April 2026