Personal data across borders — Comparison

Dataskyddsförordningen

art. 44 till 46

A transfer to a third country requires an adequacy decision or appropriate safeguards, in practice the Commission's standard contractual clauses.

Deadline:

Before the transfer begins

Penalty:

Up to EUR 20 million or four percent of global turnover

Supervision:

Integritetsskyddsmyndigheten och EDPB

Read 2026-08-22

California Consumer Privacy Act, som ändrad genom CPRA

Cal. Civ. Code § 1798.100(d)

Federal law does not restrict the transfer as such. State law requires a contract with the recipient binding purpose and onward transfer.

Deadline:

Before the transfer begins

Penalty:

Civil penalty per violation

Supervision:

California Privacy Protection Agency och delstatens justitiekansler

Read 2026-08-22

Personal Information Protection Law

art. 38 och 39

An outbound transfer requires one of three routes: a CAC security assessment, certification or the Chinese standard contract, plus separate consent from the individual.

Deadline:

Before the transfer begins

Penalty:

Up to CNY 50 million or five percent of the previous year's turnover

Supervision:

Cyberspace Administration of China

Read 2026-08-22

Dataskyddsförordningen

art. 35

A data protection impact assessment is required where processing is likely to result in high risk, and must be done before processing starts.

Deadline:

Before the transfer begins

Penalty:

Up to EUR 10 million or two percent of global turnover

Supervision:

Integritetsskyddsmyndigheten

Read 2026-08-22

California Consumer Privacy Act, som ändrad genom CPRA

Cal. Civ. Code § 1798.185(a)(15)

A risk assessment is required for processing that presents significant risk, and is submitted to the regulator under its rules.

Deadline:

No deadline stated

Penalty:

Civil penalty per violation

Supervision:

California Privacy Protection Agency

Read 2026-08-22

Personal Information Protection Law

art. 55 och 56

An impact assessment is required for outbound transfers, sensitive data and automated decision-making, and the record is kept for three years.

Deadline:

Before the transfer begins

Penalty:

Order to rectify, warning, suspension of the service and a fine

Supervision:

Cyberspace Administration of China

Read 2026-08-22

Dataskyddsförordningen

art. 6, 13 och 14

Processing requires a legal basis, and the notice is given when the data is collected. Consent is one basis among several, not the default.

Deadline:

Ongoing, for as long as the processing continues

Penalty:

Up to EUR 20 million or four percent of global turnover

Supervision:

Integritetsskyddsmyndigheten

Read 2026-08-22

California Consumer Privacy Act, som ändrad genom CPRA

Cal. Civ. Code § 1798.100(a)

Notice is given at collection, and the reader must be able to opt out of sale and sharing. Consent is required for minors.

Deadline:

Ongoing, for as long as the processing continues

Penalty:

Civil penalty per violation

Supervision:

California Privacy Protection Agency

Read 2026-08-22

Personal Information Protection Law

art. 14, 17 och 39

Consent is the rule, and separate consent is required for outbound transfers, sensitive data and sharing with third parties.

Deadline:

Ongoing, for as long as the processing continues

Penalty:

Up to CNY 50 million or five percent of the previous year's turnover

Supervision:

Cyberspace Administration of China

Read 2026-08-22

Dataskyddsförordningen

art. 15 till 22

Access, rectification, erasure, restriction, portability and objection, with an answer without undue delay.

Deadline:

One month, extendable by two months where complex

Penalty:

Up to EUR 20 million or four percent of global turnover

Supervision:

Integritetsskyddsmyndigheten

Read 2026-08-22

California Consumer Privacy Act, som ändrad genom CPRA

Cal. Civ. Code §§ 1798.100, 1798.105, 1798.106 och 1798.120

Rights to know, delete, correct and opt out of sale and sharing, and to limit the use of sensitive data.

Deadline:

45 days, extendable by a further 45 days

Penalty:

Civil penalty per violation

Supervision:

California Privacy Protection Agency

Read 2026-08-22

Personal Information Protection Law

art. 44 till 50

Rights to know, to decide, to restrict, to obtain a copy, to correct, to delete and to be given an explanation of the processing rules.

Deadline:

Without delay, no fixed deadline in the statute

Penalty:

Up to CNY 50 million or five percent of the previous year's turnover

Supervision:

Cyberspace Administration of China

Read 2026-08-22

Dataskyddsförordningen

art. 33 och 34

The supervisory authority is notified where there is a risk to the individual, and the individual where the risk is high.

Deadline:

72 hours from becoming aware of the breach

Penalty:

Up to EUR 10 million or two percent of global turnover

Supervision:

Integritetsskyddsmyndigheten

Read 2026-08-22

California Civil Code, delstatlig anmälningsplikt

Cal. Civ. Code § 1798.82

Notice to affected residents in the most expedient time possible. There is no general federal duty, sectoral rules apply alongside.

Deadline:

Without unreasonable delay, no fixed hour limit

Penalty:

Civil penalty per violation

Supervision:

Delstatens justitiekansler

Read 2026-08-22

Personal Information Protection Law

art. 57

Immediate measures are taken and the authority and individuals are notified. Notice to individuals may be withheld where measures prevent harm.

Deadline:

Immediately, with further deadlines in the network data regulations

Penalty:

Order to rectify, warning, suspension of the service and a fine

Supervision:

Cyberspace Administration of China

Read 2026-08-22

Dataskyddsförordningen

art. 83

The supervisory authority of the main establishment decides, with cooperation and dispute resolution in the European Data Protection Board.

Deadline:

No deadline stated

Penalty:

Up to EUR 20 million or four percent of global turnover

Supervision:

Integritetsskyddsmyndigheten och EDPB

Read 2026-08-22

California Consumer Privacy Act och Federal Trade Commission Act

Cal. Civ. Code § 1798.155 och 15 U.S.C. § 45

The state regulator sets a penalty per violation, and the federal regulator acts against deceptive and unfair practice.

Deadline:

No deadline stated

Penalty:

Order and civil penalty for deceptive or unfair practice

Supervision:

California Privacy Protection Agency och Federal Trade Commission

Read 2026-08-22

Personal Information Protection Law

art. 66

The authority may order rectification, withdraw permits and impose fines, and responsible individuals may be held personally liable.

Deadline:

No deadline stated

Penalty:

Up to CNY 50 million or five percent of the previous year's turnover

Supervision:

Cyberspace Administration of China

Read 2026-08-22