Personal data across borders — United States
Every requirement in the theme as a row, with the provision, the deadline and the supervisor in this jurisdiction.
The question this page answers
We move personal data between the EU, the United States and China, which legal basis, which assessment and which notification applies in each jurisdiction?
Requirement rows
- Legal basis for the transfer
California Consumer Privacy Act, som ändrad genom CPRA
Cal. Civ. Code § 1798.100(d)
Federal law does not restrict the transfer as such. State law requires a contract with the recipient binding purpose and onward transfer.
- Deadline:
- Before the transfer begins
- Penalty:
- Civil penalty per violation
- Supervision:
- California Privacy Protection Agency och delstatens justitiekansler
Read 2026-08-22
- Assessment before processing begins
California Consumer Privacy Act, som ändrad genom CPRA
Cal. Civ. Code § 1798.185(a)(15)
A risk assessment is required for processing that presents significant risk, and is submitted to the regulator under its rules.
- Deadline:
- No deadline stated
- Penalty:
- Civil penalty per violation
- Supervision:
- California Privacy Protection Agency
Read 2026-08-22
- Notice and consent
California Consumer Privacy Act, som ändrad genom CPRA
Cal. Civ. Code § 1798.100(a)
Notice is given at collection, and the reader must be able to opt out of sale and sharing. Consent is required for minors.
- Deadline:
- Ongoing, for as long as the processing continues
- Penalty:
- Civil penalty per violation
- Supervision:
- California Privacy Protection Agency
Read 2026-08-22
- Individual rights
California Consumer Privacy Act, som ändrad genom CPRA
Cal. Civ. Code §§ 1798.100, 1798.105, 1798.106 och 1798.120
Rights to know, delete, correct and opt out of sale and sharing, and to limit the use of sensitive data.
- Deadline:
- 45 days, extendable by a further 45 days
- Penalty:
- Civil penalty per violation
- Supervision:
- California Privacy Protection Agency
Read 2026-08-22
- Personal data breach
California Civil Code, delstatlig anmälningsplikt
Cal. Civ. Code § 1798.82
Notice to affected residents in the most expedient time possible. There is no general federal duty, sectoral rules apply alongside.
- Deadline:
- Without unreasonable delay, no fixed hour limit
- Penalty:
- Civil penalty per violation
- Supervision:
- Delstatens justitiekansler
Read 2026-08-22
- Supervision and penalty
California Consumer Privacy Act och Federal Trade Commission Act
Cal. Civ. Code § 1798.155 och 15 U.S.C. § 45
The state regulator sets a penalty per violation, and the federal regulator acts against deceptive and unfair practice.
- Deadline:
- No deadline stated
- Penalty:
- Order and civil penalty for deceptive or unfair practice
- Supervision:
- California Privacy Protection Agency och Federal Trade Commission
Read 2026-08-22
Connections
Sources and review
Register version crossover-v1.0.0 · Read 2026-08-22
This page restates written law with the provision and the official source. It is not legal advice in an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.