First announced: Data protection laws apply across many jurisdictions, with the EU GDPR applying in certain cases to organisations outside the EU.
Submitted by: NYBACS Compliance Desk
What changed
A business may have privacy obligations based on where it operates, where its customers are located, or how it processes their data. Work email addresses and employee contact details may also count as personal data.
Who’s affected
Companies with international customers, employees, suppliers, websites, or cloud-based data systems.
Immediate actions
- Map personal data collected, stored, accessed, and shared.
- Identify service providers that process data for the business.
- Review privacy notices, retention practices, and data-request procedures.
- Assess cross-border data transfers under the applicable local rules.
Practical note & timeline
Privacy obligations differ by jurisdiction and type of processing. A business should identify the laws applicable to its own operations rather than assume one global approach covers every market.
