Data Protection Law around the world
Personal data protection is a worldwide subject, but it is not governed by one worldwide statute. The European GDPR, California’s CCPA, Japan’s APPI and laws in other countries use different territorial rules, definitions, rights and exceptions. This guide explains those differences and connects them with practical questions about an affiliate.institute account. A country or language appearing here does not, by itself, establish that its law applies to every website activity.
Start with the relevant country, the organisation involved, the information and the purpose for using it. Establishment, a service directed at people in a territory, commercial activity, processing location and statutory thresholds can matter in different ways. More than one framework may be relevant, while a particular rule may not apply at all. Official legislation and regulator guidance provide the detail needed to assess a specific situation.
You can ask about this site’s information handling through the linked LINE Official Account, @078khjbn. Identify the account or record, explain the concern and state the result you want. The privacy notice describes actual site information; the terms describe feature conditions. Use this guide to understand which legal rules and request routes may be relevant to your concern, including the conditions and exceptions that can differ between countries.
Explore data protection laws24 Topics
Start with scope rather than a country label
Data protection laws usually define who is protected, which organisations and activities are covered, and when a connection with the territory is sufficient. These tests differ. Being a citizen, living in a country, visiting a translated page and receiving a service directed at a territory are not interchangeable facts. An organisation’s location can matter, but some laws also reach specified processing by organisations established elsewhere.
For a useful assessment, identify the service, the person’s relevant location or residence, the purpose and the organisation deciding how information is used. A public page being accessible worldwide does not automatically make every law listed here apply. Conversely, an overseas address does not automatically remove local obligations. The comparisons below explain common differences; the applicable text, exceptions and circumstances remain necessary when deciding a particular legal question.
- Identify the activity and territorial connection before relying on a named law.
- A language choice supports reading; it does not select the governing privacy law.
Relate the law to the information and organisation
affiliate.institute handles different information for sign-in, preferences, learning progress, notifications, referrals and withdrawals. A member code or receiving address can be personal when it is linked to an identifiable person. An account record is not necessarily anonymous because the full name is absent. Read the privacy notice to identify the record and purpose relevant to your question instead of assuming all information is held in one place.
The party deciding purposes and handling is commonly called a controller, although laws also use terms such as organisation, business, personal information handler or data fiduciary. A provider working on instructions may have a different role from a provider operating its own account service. Ask about the actual relationship. A website request does not automatically reach every provider, and a provider’s independent records may need a separate request through its published channel.
- Distinguish website records from information inside a sign-in, messaging or wallet provider.
- Use a member or request reference to explain the record you want reviewed.
European Union and EEA: GDPR
The General Data Protection Regulation concerns processing connected with an establishment in its territorial scope and certain processing by organisations outside that scope. For the latter, offering goods or services to people in the Union, or monitoring their behaviour there, can be relevant. The EEA framework also matters. This is not a test of EU citizenship alone, and mere worldwide website accessibility is not enough to establish that an overseas service is targeting that market.
Where applicable, the GDPR requires an appropriate lawful basis, transparency, purpose limitation, data minimisation and safeguards. Rights include access and correction, with erasure, restriction, objection and portability subject to their particular conditions. Consent is one basis, not permission to combine every unrelated purpose. A request about a referral record should identify its purpose and data, rather than assume that every historical reward or payment entry must be deleted on demand.
- Check establishment, offering and monitoring facts instead of treating every EU visitor identically.
- Use the relevant supervisory authority’s guidance when examining a specific GDPR right.
United Kingdom: UK GDPR and the updated framework
The United Kingdom has its own framework, including the UK GDPR and Data Protection Act 2018. It should not be treated as automatically identical to the EU framework. Territorial connections and the activity involved matter. The Data (Use and Access) Act 2025 amended parts of the framework; the ICO’s guidance updated in June 2026 explains that its data protection provisions are in force. An older summary may therefore omit relevant changes.
Access, accuracy, transparency and safeguards remain important, but the current rules for a particular request, basis or automated decision should be checked against UK guidance. The ICO’s role and the organisation’s complaint arrangements are relevant when raising a concern. Do not infer that a learning checklist or a referral total is a legally significant automated decision without examining what is actually decided, its effects and the applicable definition.
- Use current ICO guidance rather than assuming every EU explanation also describes UK law.
- Identify the decision or data use at issue when asking about an automated process.
California: CCPA as amended by CPRA
The California Consumer Privacy Act applies to covered businesses and protects California residents under its conditions. Coverage includes statutory business criteria and exceptions; it is not a rule applying to every website simply because it has a Californian visitor. The California Privacy Rights Act amended the CCPA. It is therefore useful to read the current combined framework rather than treat CCPA and CPRA as two unrelated privacy policies.
Relevant rights can include knowing or accessing information, deletion, correction, opting out of sale or sharing, limiting certain uses of sensitive information and protection against unlawful discrimination for exercising rights. Sale and sharing have legal meanings, including the specific context of cross-context behavioural advertising. A provider relationship should be examined on its facts rather than labelled a sale automatically. A request should explain the information or practice concerned, and any authorised-agent process needs appropriate verification.
- Residence, business coverage and the particular practice all matter to a CCPA assessment.
- An opt-out request is different from a request to close an account or reverse a payment.
Japan: Act on the Protection of Personal Information
Japan’s APPI governs relevant personal information handling by covered operators and can reach certain overseas handling connected with providing goods or services to people in Japan. Its concepts distinguish personal information, personal data and retained personal data, so the category of the record can affect the relevant obligation or request. The Personal Information Protection Commission publishes official material and reference translations; the authoritative Japanese text remains important.
The framework addresses specifying purposes, appropriate handling, security, third-party provision and conditions for foreign transfers. Disclosure, correction and suspension-related requests have defined scope and grounds. They should not be described as an unrestricted right to delete any record immediately. For a member enquiry, identify whether the concern is an inaccurate profile, unnecessary use, an external disclosure or a historical financial record, because these may involve different questions under the applicable rules.
- Check the information category and purpose when identifying an APPI request.
- Consult PPC materials for current conditions rather than importing a GDPR right by name.
Singapore: Personal Data Protection Act
Singapore’s PDPA provides a framework for personal data handled by organisations within its scope. It has its own coverage, exceptions and terminology; the same initials used by another country do not make their laws identical. Requirements concerning consent, notification, purposes, accuracy, protection, retention and accountability must be considered for the actual activity. Separate rules can also matter for particular marketing communications.
Individuals can have access and correction rights and can withdraw consent under the applicable conditions. The effect on a requested service should be explained, while continued handling may depend on another permitted ground or obligation. Overseas transfers involve the relevant protection requirements, not an assumption that using an international provider is enough. A Singapore-related enquiry should identify the organisation, record and purpose rather than rely only on a Singapore language setting or a provider’s regional branding.
- Use the current Singapore Act and PDPC guidance for Singapore-specific conditions.
- Browser notification permission and statutory consent questions should be examined separately.
Malaysia: Personal Data Protection Act and amendments
Malaysia’s Personal Data Protection Act 2010 addresses personal data processing within its defined commercial and territorial scope. The 2024 amendments and their commencement arrangements are part of the current framework. A description based only on the original 2010 wording can miss important developments. Coverage, exemptions and the relationship between the organisation and the processing must be assessed instead of assuming that every Malaysian reader creates the same obligations.
The framework covers principles including notice and choice, disclosure, security, retention, integrity and access. Amendments affect areas such as accountability, breach handling and data portability, with the applicable provisions and official requirements needing attention. Consult the commissioner’s current guidance when checking officer responsibilities and the procedures that apply to an organisation. Use the confirmed contact channel to ask about the relevant information and consult the official commissioner’s material for the Malaysian procedure.
- Read the amended framework and commencement information together with the original Act.
- Use official commissioner guidance to understand the responsibilities and request procedure relevant to the activity.
Brazil: Lei Geral de Proteção de Dados
Brazil’s LGPD can apply where processing occurs in Brazil, concerns offering goods or services or processing data of individuals located there, or involves data collected there, subject to the statutory rules and exceptions. The organisation’s headquarters and the location of a server are therefore not the only factors. The law also recognises several legal grounds; consent is not the exclusive explanation for every activity.
Rights include confirmation of processing, access and correction, with other rights concerning unnecessary or improperly processed data, consent and portability under their conditions. Commercial and industrial secrecy and other legal limits can matter. A request to understand a referral attribution is different from demanding that a valid historical payment never existed. The ANPD provides official information and regulatory guidance; check the applicable procedure when escalating a concern after identifying the controller and the particular use involved.
- Consider the territorial processing and collection facts, not only the organisation’s address.
- State the requested action clearly: confirmation, access, correction or review of a particular use.
China: Personal Information Protection Law
China’s PIPL applies to personal information handling within its scope and specified overseas processing of people in China, including offering products or services or analysing their behaviour. Its rules on lawful handling, necessity, transparency and information quality should be read in that context. Sensitive personal information and children’s information can involve additional conditions. Choosing a Chinese display language alone does not resolve this territorial assessment.
Individuals have relevant rights to know, decide, limit or refuse handling, and to request access, copies, correction or deletion within the law’s conditions. Cross-border provision has additional requirements and must be considered alongside current implementing measures. A general statement that information is encrypted does not establish that every transfer condition is satisfied. For an enquiry, describe the information, overseas recipient or use concerned, and seek an explanation of the relevant arrangements rather than sending further private records unnecessarily.
- Examine the actual service and processing connection with people in China.
- A foreign-transfer question should identify the recipient and information, not just the website language.
India: DPDP Act and phased rules
India’s Digital Personal Data Protection Act 2023 concerns digital personal data within its defined scope, including certain overseas processing connected with offering goods or services to people in India. It uses the terms Data Fiduciary and Data Principal for relevant organisational and individual roles. The 2025 rules introduce phased implementation. Publication of the rules should not be interpreted as every substantive provision becoming enforceable on exactly the same day.
The framework includes provisions on notice, consent and specified legitimate uses, safeguards, children’s data, grievance handling and individual rights. These categories should not be replaced with a generic GDPR description of legitimate interests. Check the applicable commencement notification and rule for the action and date concerned. A member can still contact the site about information now, while the legal basis and procedure for a formal statutory claim must be assessed under the provisions then in force.
- Distinguish the enacted framework from the commencement date of a particular duty or right.
- Use official government notifications when checking the phased implementation timetable.
South Korea: Personal Information Protection Act
South Korea’s PIPA can be relevant to overseas businesses as well as domestic processing. The PIPC’s foreign-business guidance explains application criteria and obligations, so incorporation abroad is not a complete answer to scope. Consent, transparency, safeguards, children’s information and cross-border transfer requirements should be assessed for the service and people involved. An overseas provider’s standard policy does not automatically settle every obligation under PIPA.
The framework recognises rights concerning access, correction, deletion and suspension, subject to the applicable conditions and exceptions. Current rules also need to be considered for transfers and legally relevant automated decisions. A request should identify the record and result sought; a question about a stored notification result is different from an objection to a specific consequential decision. Use current PIPC guidance for the relevant procedure rather than assume that the deadlines or thresholds of another country apply.
- Consult the PIPC’s foreign-business guidance when an organisation operates from another country.
- Specify the account, use or decision instead of making an unsupported claim that every process is unlawful.
Vietnam: Personal Data Protection Law effective in 2026
Vietnam’s Law 91/2025/QH15 on Personal Data Protection took effect on 1 January 2026. It should be distinguished from earlier explanations dealing only with prior instruments. The official law addresses personal data and the rights, duties and responsibilities of relevant people and organisations. Its scope also includes specified foreign organisations and people involved in processing the data of protected Vietnamese individuals, so the exact statutory connection matters.
Use the current law and relevant implementing requirements when examining purposes, consent, protected categories, overseas handling and a person’s request. The fact that a law is effective does not mean every record can be erased without considering its conditions or other lawful requirements. A Vietnamese-related enquiry should identify the activity, data and organisation involved. Avoid assuming that an older consent template, an international server location or the language selected on a page is a complete explanation of compliance.
- Check the 2026 framework rather than relying only on material about an earlier decree.
- Identify the protected person and processing connection when assessing overseas application.
Indonesia: Personal Data Protection Law
Indonesia’s Law 27 of 2022 on Personal Data Protection regulates personal data rights, processing, controllers and processors, transfers and related obligations. The official text distinguishes general and specific personal data, with categories including children’s and personal financial information among the latter. Classification therefore cannot be assumed identical to the sensitive-data terminology used by every other framework.
The law recognises individual rights and sets conditions for processing and protecting information. Its territorial rules can matter where activity outside Indonesia has the specified legal effects. For an account or withdrawal concern, describe the actual record and connection rather than assume that an XMR reference has the same legal treatment in every country. Read the current official law, implementing requirements and any relevant decisions together; an old transition-period summary is not a substitute for that review.
- Check whether information falls within a specifically protected category under the Indonesian framework.
- Ask about the actual use or transfer without sending a complete financial history.
Canada: PIPEDA and the provincial context
Canada’s federal PIPEDA concerns personal information handled in the course of commercial activities within its scope. The commercial character of an activity needs assessment; a service being free does not automatically remove it from coverage. Provincial privacy laws and the organisation or sector involved can also affect which requirements apply. It is therefore too simple to describe all Canadian privacy questions as governed by one identical rule.
Accountability, identifying purposes, appropriate consent, limited collection and retention, accuracy, safeguards and access are central themes. Individuals can ask about information and challenge compliance through the applicable route. The Office of the Privacy Commissioner’s interpretations help explain coverage but recognise that findings depend on facts and evolving law. A useful enquiry identifies the relevant business activity and record, particularly where a service and its provider handle different information or operate across provincial or national borders.
- Consider commercial activity and the provincial or sector context before selecting the legal route.
- A free account or a foreign server does not by itself answer the coverage question.
Australia: Privacy Act and Australian Privacy Principles
Australia’s Privacy Act 1988 and Australian Privacy Principles apply to covered agencies and organisations. Coverage has thresholds, exceptions and special cases, including some small businesses; it should not be assumed that every business is covered or that every small business is exempt. The relevant Australian connection and activity matter when considering an overseas organisation. The OAIC publishes official guidance on rights and responsibilities.
The principles address collection, notification, uses and disclosures, security, access and correction, with specific rules for overseas disclosure. Those rights are not simply a copy of every GDPR remedy. When asking about an account, identify the information and whether the concern is accuracy, access, unnecessary collection or a disclosure. For an overseas provider, examine accountability and the applicable arrangement rather than assume that a provider contract or a list of countries alone proves the transfer is permitted.
- Check actual coverage, including relevant small-business exceptions and special cases.
- Use OAIC guidance for Australian rights and overseas disclosure requirements.
New Zealand: Privacy Act and information privacy principles
New Zealand’s Privacy Act 2020 uses information privacy principles covering collection, storage, use, disclosure, access and correction. Overseas activity and the organisation’s New Zealand business connection can be relevant to coverage. Principle 12 addresses disclosure outside New Zealand and the relevant safeguards or other permitted circumstances. Sending data to an overseas service needs a considered explanation rather than the assumption that all foreign destinations receive the same protection.
Indirect collection also needs current attention: the regulator explains that Principle 3A came into force in May 2026, requiring notification in relevant cases when information is obtained from another source, subject to exceptions. This is useful when asking why a provider-supplied detail appears in an account. Identify the source, purpose and intended recipients. Browser storage controls and a formal access or correction request remain different ways of addressing different parts of the information involved.
- Distinguish overseas disclosure safeguards from a person’s general account preferences.
- Ask about the source and notice when personal information was collected indirectly.
Switzerland: revised Federal Act on Data Protection
Switzerland’s revised Federal Act on Data Protection has applied since September 2023. It concerns personal information about natural persons within its scope and can reach processing with effects in Switzerland even when it originates abroad. The Swiss framework is distinct from the GDPR; a Swiss connection does not automatically make the EU framework apply, although the same organisation may have obligations under more than one law.
Transparency, proportionality, security and rights to information are important, with conditions for overseas disclosure and other specific obligations. Some breach duties use a high-risk assessment, illustrating why one universal notification threshold is misleading. The FDPIC provides official explanations. When making an enquiry, identify the affected information and Swiss connection, and separate a question about the website’s record from a request concerning an independent provider’s own account information.
- Check the effects and processing connection relevant to Switzerland.
- Do not assume Swiss and EU rights, procedures and incident thresholds are interchangeable.
Apply these distinctions to site features
The home page, FAQ and legal information are public. Lessons and project guides require sign-in. Choosing an account, remembering a language, storing browser progress and qualifying a referral involve different information. Clearing lesson progress does not erase account or payment records. A receiving address supports a withdrawal destination; it does not require disclosure of the private keys or recovery words that control a wallet.
Referral qualification requires the member to use the intended account, choose to receive notifications for it and successfully confirm the verification message received. An ordinary click, raw sign-in or browser permission alone is not completion. Notification permission is separate from normal signed-in lesson access and is not blanket consent for unrelated uses. Earlier confirmation and referral records also do not disappear automatically when delivery permission is later changed; a request about those records should identify them expressly.
- Use the privacy notice to identify each feature’s records and controls.
- Keep verification links and wallet-control information private during an enquiry.
Compare rights and ask for a specific outcome
Many frameworks recognise some form of access and correction, but erasure, objection, restriction, portability and marketing choices differ in scope and conditions. California’s sale-or-sharing opt-out is not a universal account-deletion button. A portability right does not transfer an XMR balance or merge member identities. An access copy may also need protection of other people’s information, lawful confidentiality interests or records outside the recipient organisation’s responsibility.
Describe what you want: inspect a particular entry, receive a copy, correct a detail, understand a source, stop a use or review retention. A genuine historical payment is different from an inaccurate current profile. Relevant legal obligations and legal claims can justify retaining some information even where another use stops. We explain the outcome or applicable limit. Send a request through the confirmed contact channel so the relevant records and requested action can be reviewed.
- Identify the data and requested result instead of relying only on a legal right’s name.
- Ask for the reason when a request is limited, including the relevant continuing purpose.
Sensitive information, children, retention and incidents
Protected categories and children’s rules vary: health, biometric, belief, financial or children’s information do not have identical classifications everywhere. Capacity, parental involvement and age-related conditions need to be assessed under the law applicable to the person and activity. Avoid sending sensitive family or identity material to begin a request. A representative should explain their authority and the concern, with proportionate confirmation before another person’s information is disclosed.
Retention and incident handling also require context. Information should remain only for justified purposes and applicable requirements, with a review when those reasons no longer exist. Suspected exposure should be reported using a minimal reference or redacted example. Laws use different risk tests, recipients and notification periods, so a service interruption is not automatically a reportable personal data breach and one country’s deadline should not be presented as a worldwide rule. Do not investigate by accessing or copying someone else’s records.
- Report the observed facts without spreading another person’s information.
- Separate a browser setting, a retention request and a suspected data incident.
Contact, verification, complaints and keeping up to date
Contact the linked LINE Official Account, @078khjbn, and say that your enquiry concerns affiliate.institute data protection. Include the member or request reference, the relevant dates and the outcome you want. If a particular country’s framework matters, explain the relevant connection without sending unnecessary proof at the outset. We may need proportionate confirmation of identity, authority or scope before disclosing or changing information. Never send passwords, private keys, recovery words or a private verification link.
We will review the request under applicable requirements and explain the result, clarification needed or relevant limitation. You retain available rights to use a competent authority or another lawful remedy; contacting support does not waive them. Use that authority’s current official procedure, since an international forum is not one complaint office for all countries. Laws and guidance change, so consult the linked official sources for an action-specific question and retain the conversation reference when following up.
- Give a concise account of the record, concern and action requested.
- For follow-up, identify the earlier conversation and the issue that remains unresolved.
Official laws, regulators and international guidance
These official sources support the comparisons below. Each framework has its own scope, current amendments and procedures. OECD guidance and the Global Privacy Assembly provide international context. For an individual concern, consult the relevant law and competent authority’s current guidance.
- European Union — GDPR guidance
- United Kingdom — ICO guidance on the 2025 reforms
- California — CCPA and CPRA
- Japan — APPI legislation
- Singapore — Personal Data Protection Act
- Malaysia — Personal Data Protection Act and amendments
- Brazil — LGPD official English text
- China — Personal Information Protection Law
- India — DPDP framework and phased implementation
- South Korea — PIPA guidance for foreign businesses
- Vietnam — Personal Data Protection Law 91/2025/QH15
- Indonesia — Personal Data Protection Law 27/2022
- Canada — PIPEDA and commercial activity
- Australia — Privacy Act rights and responsibilities
- New Zealand — overseas disclosure principle
- Switzerland — federal data protection questions
- OECD — international privacy principles
- Global Privacy Assembly — privacy authorities
- Privacy and your information
- Terms & Conditions