This article is general information, not legal advice. Laws change, differ by place and depend on the facts of each situation. For a decision that matters, such as running a business that handles customer data, consult a qualified professional.
Why these laws exist
Organizations collect large amounts of personal information, and individuals usually cannot see what happens to it. Privacy and data protection laws try to correct that imbalance by setting rules for how personal information may be collected, used, stored and shared, and by giving people some rights in return.
“Personal data” is generally defined broadly: any information that relates to an identifiable person. That can include a name, an email address, an account number, a photo, an online identifier or, in some laws, a location or device identifier. Some laws treat certain categories, such as health information, financial information or data about children, as especially sensitive and apply stricter conditions.
There is no single global law
Rules vary widely. Some regions have a broad, comprehensive law covering most organizations and most personal data. Others rely on a patchwork of laws that apply to specific sectors (health care, finance, education) or to specific groups, such as children. Some places have laws at a regional level, such as individual states, rather than nationally.
Well-known examples include the European Union’s General Data Protection Regulation, which took effect in 2018, and California’s consumer privacy law, which began applying in 2020. Many other countries and several US states have passed their own laws, and the details change often, so check current official sources rather than relying on a summary.
A law often applies based on where the people whose data is collected are located, not only where the company is based. That means a small online business can be affected by rules from places it has never visited.
What organizations are typically required to do
Different laws word things differently, but several obligations appear again and again.
- Have a reason for collecting data. Many laws expect a stated purpose, a legal basis such as consent or a contract, and a limit on collecting more than is needed.
- Be transparent. Organizations are usually expected to explain what they collect, why, and who receives it, typically in a privacy policy written in understandable language.
- Use data only for the stated purposes. Using information for something quite different may require fresh notice or consent.
- Keep it secure. Laws commonly require “reasonable” or “appropriate” safeguards, without prescribing exact tools.
- Keep it only as long as needed. Retention limits and deletion practices are a frequent expectation.
- Report certain breaches. Many laws require notifying regulators, affected people or both after a serious data breach, sometimes within a short deadline.
- Be careful with sharing. Passing data to service providers or other companies often requires contracts or disclosures. This links to third-party risk, which matters to any business that relies on outside suppliers.
Rights individuals often have
Depending on where you live, you may be able to:
- ask whether an organization holds data about you and request a copy
- ask for inaccurate information to be corrected
- ask for data to be deleted, with exceptions, for example where records must be kept for legal or accounting reasons
- object to or opt out of certain uses, such as direct marketing, or the sale or sharing of your data for advertising
- withdraw consent you previously gave
- ask for your data in a portable format
- complain to a regulator if a request is ignored
Rights are rarely absolute. Organizations may refuse in some circumstances, but they are generally expected to explain why. Making a request usually means finding the company’s contact point for privacy matters, which a privacy policy normally lists, and describing what you want. Keep a copy of the request and the date.
Consent, cookies and marketing
Consent rules are among the most visible parts of privacy law. Some regions require clear agreement before non-essential cookies or similar tracking tools run, which is why many sites show consent banners. Rules on unsolicited marketing also vary: some places expect opt-in consent, others require an easy way to opt out. Anyone doing email marketing should check which rules apply to their audience rather than assuming one standard.
Children’s data
Many laws add protections for children, such as requiring parental consent before collecting data from young children. In the United States, for instance, a federal law addresses online services directed to children under 13. Age thresholds and requirements differ elsewhere. For families, these rules support but do not replace conversations at home and the tools discussed under family online safety.
Enforcement and its limits
Regulators can investigate, issue orders and, in some systems, impose fines, and individuals may have routes to seek remedies in certain circumstances. In practice, enforcement is uneven, and a company breaking the rules is not always noticed quickly. Laws set a floor for organizations; they do not remove the value of your own habits, such as sharing less and reviewing your settings.
Practical takeaways
- Check which rights exist where you live, using an official government or regulator website.
- Read the sections of a privacy policy about sharing, retention and how to contact the company.
- If you run a site or shop, learn which rules might apply to your visitors and customers, and consider professional advice before collecting sensitive data.
- Treat the law as one layer of protection among several.