Key takeaways
- We cover 30+ privacy regulations from a single point of contact
- This is a senior-led network, not a large in-house team: your DPO leads, with a partner bench for continuity and trusted local counsel where needed
- For regulations where jurisdiction-specific legal advice is required, we coordinate with trusted local counsel
- Your DPO has deep expertise across EU, UK, US, and working knowledge of APAC, Middle East, and Latin America
- One retainer covers everything; you don’t pay separately for each jurisdiction
- We work with companies wherever they are based, including anyone offering goods or services to people in the EU or UK, not only European companies
Regulations we cover
Europe:
- EU GDPR
- UK GDPR
- ePrivacy Directive
- NIS2
- DORA (financial sector)
- EU AI Act. The EU AI Act has been in staged implementation since August 1, 2024. GPAI model obligations entered into force August 2, 2025. Under the Digital Omnibus provisional agreement (7 May 2026, pending formal adoption), the high-risk deadline moves to 2 December 2027 (stand-alone systems) and 2 August 2028 (embedded systems). Until formal adoption, the original 2 August 2026 date remains in law. Companies operating across the EU and serving EU residents face dual compliance obligations under GDPR and the AI Act.
- Country-specific implementations and guidance
Americas:
- US: CCPA/CPRA, HIPAA, GLBA, state privacy laws (Virginia, Colorado, Connecticut, Texas, and others. Twenty US states now have comprehensive privacy laws in effect as of January 2026 (Indiana, Kentucky, and Rhode Island joined the list on January 1, 2026). Connecticut, Arkansas, and Utah amendments take effect July 1, 2026).
- Brazil: LGPD
- Canada: PIPEDA (note: federal reform proposals including the proposed CPPA under Bill C-27 did not complete the legislative process; PIPEDA remains the current federal law)
Asia-Pacific:
- Thailand: PDPA
- China: PIPL
- India: DPDPA (DPDP Rules 2025 notified, marking operationalization of the framework)
- Japan: APPI
- South Korea: PIPA
- Singapore: PDPA
- Australia: Privacy Act
Middle East and Africa:
- UAE: Federal Data Protection Law
- Saudi Arabia: PDPL
- South Africa: POPIA
Frameworks and standards:
- ISO 27001 / ISO 27701
- SOC 2
- NIST Privacy Framework
What each regulation requires
A quick reference to the core obligations behind the regulations above. This is a summary, not a substitute for scoped advice on your specific processing.
| Regulation | Key obligations |
|---|---|
| EU GDPR | A lawful basis for every processing activity, records of processing (Article 30), DPIAs for high-risk processing, data subject requests answered within one month, breach notification to the supervisory authority within 72 hours, a DPO where required, and safeguards for international transfers |
| UK GDPR | The same core obligations as EU GDPR under the ICO; organizations outside the UK that target UK individuals may need a UK representative |
| ePrivacy Directive | Prior consent for non-essential cookies and similar tracking, and consent for electronic direct marketing |
| NIS2 | Cybersecurity risk-management measures and incident reporting: early warning within 24 hours, notification within 72 hours, and a final report within one month, for major incidents whether or not personal data is involved |
| DORA | ICT risk management, operational resilience testing, and third-party ICT provider oversight for financial entities, with major-incident reporting (initial notification within 4 hours of classification, intermediate report within 72 hours, final report within one month). In application since 17 January 2025 |
| EU AI Act | Risk-based obligations: prohibited practices banned since February 2025, GPAI model obligations since August 2025, Article 50 transparency and provider marking from 2 August 2026, and high-risk system requirements (risk management, documentation, post-market monitoring) on the provisional 2 December 2027 / 2 August 2028 timeline pending formal adoption |
| US state laws (CCPA/CPRA and others) | Consumer rights of access, deletion, and opt-out of sale or sharing, a compliant privacy notice, a Do Not Sell or Share link, and recognition of Global Privacy Control signals. Twenty US states have comprehensive laws in effect as of January 2026 |
| HIPAA | Safeguards for Protected Health Information, Business Associate Agreements with downstream processors, and breach notification to regulators and affected individuals |
| Brazil LGPD | Legal bases for processing, data subject rights, and appointment of a data protection officer (encarregado), under the ANPD |
| China PIPL | Consent-based processing, data localization for certain operators, and a cross-border transfer mechanism (CAC security assessment, certification, or the CAC standard contract) |
How multi-jurisdictional compliance works in practice
We don’t pretend to be local experts in every country. Here’s how it actually works:
Deep expertise (we handle directly): EU GDPR, UK GDPR, US state privacy laws (CCPA/CPRA, other US state requirements, HIPAA, GLBA), and frameworks like ISO 27001 and SOC 2. These are jurisdictions where our DPO has direct, hands-on experience across many organizations.
Working knowledge + local counsel (we lead, counsel supports): Brazil LGPD, Canada PIPEDA, Thailand PDPA, China PIPL, India DPDPA, Japan APPI, South Korea PIPA, UAE, Saudi Arabia. We have working knowledge of these frameworks and can conduct initial gap assessments and adapt core elements of your privacy program for them. For specific legal questions or full implementation, we coordinate with trusted local counsel.
Assessment and coordination (we assess, counsel delivers): For less common jurisdictions, we assess your obligations and coordinate with local counsel to deliver. You still have a single point of contact.
The key difference from hiring separate consultants per jurisdiction: you have one person who understands your entire privacy program and coordinates everything. That means consistency, no gaps between jurisdictions, and no duplication of effort.
Common multi-jurisdictional scenarios
US SaaS company expanding to EU: GDPR compliance, EU Representative appointment, international data transfers, cookie consent. Most common scenario we handle. See US to EU Privacy Compliance.
EU company expanding to US: Adding CCPA/CPRA compliance, state privacy law assessment, US-specific privacy notices. Usually straightforward on top of existing GDPR compliance. See GDPR vs CCPA. Twenty US states now have comprehensive privacy laws in effect as of January 2026 (Indiana, Kentucky, and Rhode Island joined the list on January 1, 2026). Connecticut, Arkansas, and Utah amendments take effect July 1, 2026.
Global SaaS with customers everywhere: GDPR + UK GDPR + CCPA + LGPD + PDPA + any other applicable laws. Single privacy framework with jurisdiction-specific modules. One retainer covers everything.
HealthTech operating in US and EU: GDPR (health data as special category) + HIPAA. Different scopes, different requirements, one coordinated approach. See DPO for HealthTech.
Investment
Most companies needing multi-jurisdictional coverage start with DPO Premium (From €5,000 per month). Companies operating primarily in EU + US may start with DPO Essentials (From €2,000 per month).