Data Privacy Regulations: GDPR, CCPA, DPDP Act

Learning outcome: By the end of this lesson, you will be able to explain what data privacy regulation requires of a business, name the major regional regulations a global marketer needs to be aware of, and describe the practical steps a business takes to stay compliant.

What Do Data Privacy Regulations Actually Require?

Data privacy regulation sets rules for how a business collects, uses, and stores personal information about the people it markets to, separate from data security, which is about keeping that same data safe from unauthorised access or breaches. The EU’s General Data Protection Regulation, GDPR (Regulation (EU) 2016/679, 2016), is the most influential example, and its core principles recur, in some form, across most regulations that followed it: a business needs a genuine, informed basis for collecting personal data in the first place, should collect only what a specific purpose actually requires rather than gathering data speculatively for later use, and must keep what it does hold accurate and reasonably secure. Cavoukian (2009) frames this as a design question rather than a compliance afterthought: her “Privacy by Design” principles argue that privacy protections should be built into a product or campaign from the outset, not bolted on once a regulator raises a concern, since retrofitting privacy into an existing system is consistently more difficult and more error-prone than designing for it from the start.

The Regulations a Global Marketer Should Know

The GDPR applies not only to businesses based in the EU but to any organisation, anywhere, that processes the personal data of EU residents, which is why it shaped global practice well beyond Europe’s own borders. In the United States, California’s Consumer Privacy Act, since substantially expanded by the California Privacy Rights Act (California Civil Code, 2018, as amended), gives California residents specific rights, including the right to know what data a business holds on them and the right to opt out of its sale, and several other US states have since passed similar laws of their own. India’s Digital Personal Data Protection Act, passed in 2023, brings a large, fast-growing digital market under its own comprehensive data protection regime for the first time, following broadly similar consent-and-purpose principles to the GDPR. Brazil’s Lei Geral de Proteção de Dados and China’s Personal Information Protection Law follow the same general pattern in their own regions. A business marketing to customers in more than one of these regions needs to treat this as a genuinely layered compliance picture, since meeting the requirements of one regulation does not automatically satisfy another.

Global Data Privacy Regulations timeline: GDPR 2016, CCPA/CPRA 2018, LGPD 2020, PIPL 2021, DPDP Act 2023

What Non-Compliance Actually Costs

Regulators under these laws can issue fines calculated as a percentage of a company’s global revenue rather than a small fixed penalty, which is what makes non-compliance a board-level financial risk rather than a narrow legal technicality. Beyond the direct fine, a publicised data privacy failure tends to damage customer trust in a way that outlasts the financial penalty itself, since a data breach or a heavy-handed regulatory finding becomes a lasting part of how a brand is perceived. Many regulations, GDPR among them, also require a business above a certain size, or handling certain categories of data, to appoint a named Data Protection Officer responsible for compliance, giving accountability a specific owner inside the organisation rather than leaving it diffused across departments.

Example: A Growing E-Commerce Brand Expands Into New Markets

Millbrook Skincare, an e-commerce brand that has traded only within the United States, begins shipping to customers in the European Union and India for the first time. Before launching its email marketing programme in these new markets, it audits its checkout and sign-up forms and finds that its existing “opt-out” checkbox, pre-ticked by default, would not meet GDPR’s requirement for clear, informed, opt-in consent, so it rebuilds the checkbox as unticked by default with plain-language wording about what the email list will be used for. It also reviews what customer data it actually collects at checkout and removes two fields, a marketing preference survey and a full date of birth, that were being gathered speculatively without a specific, current use, which is exactly the “purpose limitation” and “data minimisation” principle both the GDPR and Cavoukian’s design approach call for. The changes take longer to implement than simply translating the existing checkout page, but they let Millbrook launch in both new markets without needing to build a separate, market-specific compliance process later.

Building Compliance Into Everyday Practice

A practical starting point is a data inventory: a clear record of what personal data a business actually collects, where it is stored, and how it flows between systems and teams, since a business cannot properly protect or govern data it cannot first account for. From there, applying Cavoukian’s design principle in practice usually means reviewing new marketing tools, forms, and campaigns for privacy implications before launch, rather than treating a privacy review as a final check once a campaign is already built. Ongoing staff training matters too, since a policy sitting in a compliance document has little effect if the people running day-to-day marketing activity are not aware of what it actually requires of them in practice. Because regulations in this area continue to be updated and new ones continue to be introduced, revisiting this compliance picture on a regular schedule, not only when a new market launch forces the question, is what keeps a business ahead of the requirement rather than reacting to it after the fact.

Key idea: Data privacy regulation is not one global rulebook but a growing set of regional ones, the GDPR, the CCPA/CPRA, and India’s DPDP Act among them, built on broadly similar principles of consent, purpose limitation, and data minimisation. Cavoukian’s Privacy by Design approach argues these principles work best when built into marketing systems from the start, since a business that only reacts to regulation after a problem arises is already behind it.

Summary

Data privacy regulations govern how a business collects, uses, and stores personal information, and the GDPR’s principles of consent, purpose limitation, and data minimisation have shaped most of the regional laws that followed it, from California’s CCPA/CPRA to India’s DPDP Act. Non-compliance carries real financial and reputational cost, calculated in some regulations as a share of global revenue rather than a fixed penalty. Cavoukian’s Privacy by Design approach offers a practical response: build privacy into marketing systems and campaigns from the outset, supported by a clear data inventory and regular staff training, rather than treating compliance as a one-off reaction to a specific market launch or regulatory scare.