PrivacyTerrainStructured privacy law intelligence
Privacy law comparison table
FieldAustraliaBrazilCalifornia
Effective statusIdentity
in-forceReviewed 15/04/2026in-forceReviewed 15/04/2026in-forceReviewed 15/04/2026
Law statusIdentity
activeReviewed 15/04/2026activeReviewed 15/04/2026activeReviewed 15/04/2026
Effective dateIdentity
2014-03-12Reviewed 15/04/20262020-09-18Reviewed 15/04/20262023-01-01Reviewed 15/04/2026
Last amendedIdentity
2024-11-29Reviewed 15/04/20262023-04-24Reviewed 15/04/20262023-03-29Reviewed 15/04/2026
Extraterritorial applicationScope
YesReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Territorial scopeScope
Applies to APP entities and certain overseas organizations carrying on business in Australia.Reviewed 15/04/2026Applies to processing operations carried out in Brazil or targeting individuals in Brazil.Reviewed 15/04/2026Applies to covered businesses doing business in California and meeting statutory thresholds.Reviewed 15/04/2026
Private sector coverageScope
YesReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Public sector coverageScope
YesReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Personal data definitionDefinitions
Information or an opinion about an identified individual, or an individual who is reasonably identifiable.Reviewed 15/04/2026Information regarding an identified or identifiable natural person.Reviewed 15/04/2026Information that identifies, relates to, describes, or could reasonably be linked with a consumer or household.Reviewed 15/04/2026
Sensitive data recognizedDefinitions
YesReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Legal basesLegal Basis
Reviewed 15/04/2026consent, legal obligation, public task, legitimate interestsReviewed 15/04/2026Reviewed 15/04/2026
Requires legal basisLegal Basis
NoReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Right of accessRights
YesReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Right to deletionRights
NoReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Right to objectRights
NoReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Right to portabilityRights
NoReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Breach deadline (hours)Breach
720Reviewed 15/04/202648Reviewed 15/04/2026Immediate / without undue delayReviewed 15/04/2026
Breach notification requiredBreach
YesReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
DPO requiredGovernance
NoReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Impact assessment requiredGovernance
NoReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Maximum fineEnforcement
Serious or repeated interferences can trigger penalties exceeding AUD 50 million under recent reforms.Reviewed 15/04/2026Up to 2% of a private legal entity's revenue in Brazil, capped at BRL 50 million per infraction.Reviewed 15/04/2026Agency enforcement up to $2,500 per violation or $7,500 for intentional or children's-data violations.Reviewed 15/04/2026
Records of processing requiredGovernance
NoReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Right to appealRights
YesReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Cross-border transfer restrictedTransfers
YesReviewed 15/04/2026YesReviewed 15/04/2026NoReviewed 15/04/2026
Private right of actionEnforcement
NoReviewed 15/04/2026YesReviewed 15/04/2026YesReviewed 15/04/2026
Cookie consent ruleMarketing
No single cookie law, but consent expectations arise under privacy and marketing guidance.Reviewed 15/04/2026Consent is expected for many tracking scenarios, with ANPD guidance evolving.Reviewed 15/04/2026No blanket cookie consent rule, but sharing and sale opt-out signals matter.Reviewed 15/04/2026
Data localization requiredTransfers
NoReviewed 15/04/2026NoReviewed 15/04/2026NoReviewed 15/04/2026