Sourced guides to doing business in each market, and the status of every service there. Partners are in place in 35 markets so far.
One WONE Global Partner for each service in each market. Start from what you need to do, or go straight to a service.
Describe what you need. WONE Global names the service and the professional before any work begins.
Bring a requirement →Licences, value chains and the questions businesses in each industry ask first, with the services that usually apply.
What one country changes for the other, worked journeys step by step, and who handles each side.
When cross-border business becomes a dispute, UNIONE™, also part of the UNBOUNDED™ Global Ecosystem, prevents it, resolves it, arbitrates it and plans enforcement. 334 Fellows in 58 countries.
41 jurisdictions, each with primary sources and the date last checked.
Named senior professionals, each admitted as the one firm for a service in their country, and the firms they lead.
One Partner per service, per jurisdiction, admitted by review against published criteria.
Every statement is labelled: source-checked, professionally reviewed or not yet checked, with its source and date where checked.
Answers cite WONE Global's sourced statements and show how each one was checked. Research, not advice.
Accomplished regional specialists and international cross-border intelligence, across 100 countries, with one contact and one published Standard.
Service · Protect and resolve
Data, cyber and technology rules for running a digital business internationally. Led by a WONE Global Partner where one is named. Elsewhere, WONE Global confirms on request whether a vetted Associate firm can act.
Professional knowledge centre
Technology, data and cyber law now shapes where a business can host data, how fast it must report an incident and what it must document about its AI. A group selling across borders is usually subject to several data protection laws for the same customers, and each regulates transfers abroad differently. Much has changed recently: India's DPDP Rules were notified in November 2025 with main duties from May 2027, the UK's data reforms took effect in February 2026, the EU reset its AI Act timeline in July 2026, Cyber Resilience Act reporting began in September 2026, and Saudi Arabia is consulting on data localisation. The practical goal is one map of data flows, systems and incidents that satisfies every regulator involved.
Source-checked research100% of statements checked against a source55 checked against an official source11 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed
The area covers four layers that interact. Data protection laws decide what personal data may be collected and where it may go; cyber security laws decide how systems must be protected and incidents reported; AI rules add duties for particular uses of data and models; and digital services rules, including e-invoicing mandates, govern online platforms and transactions. One cloud migration or one breach can engage all four.
This centre compares the EU (with Germany and France), the UK, India, Saudi Arabia, the UAE, Singapore and the US, where federal and state rules differ. The EU and UK models of adequacy and standard clauses are widely copied, but India, Saudi Arabia and the UAE are building their own regimes with different transfer tools and deadlines. Dates, thresholds and fines are claims with sources; points we could not confirm are listed as gaps.
Most of the main markets now have a general data protection law, but they differ in reach, maturity and enforcement. The EU GDPR and UK GDPR are the longest established; India's DPDP Act and Saudi Arabia's PDPL reach businesses outside the country that target local individuals; the UAE has a federal law alongside separate regimes in the DIFC and ADGM; and in the US the general privacy rules researched are state laws such as California's CCPA. India's main obligations start on 13 May 2027, so the months before then are the preparation window.
Questions on this topic
11 statements on data protection laws compared
Moving personal data to another country, including to a cloud region abroad, needs a legal basis under the exporting country's law. The EU and UK use adequacy findings first and standard clauses second; Saudi Arabia has its own standard clauses; Singapore requires comparable protection; and India currently allows transfers unless the government restricts a destination, with stricter sector rules for payment data. The tool chosen should be recorded per data flow.
Questions on this topic
12 statements on cross-border data transfers
Most markets now require a personal data breach to be reported to the regulator within days, and to affected individuals where the risk is high. The EU, Saudi Arabia and India (from May 2027) work to 72 hours; Singapore allows 3 calendar days after a breach is assessed as notifiable; the US relies on state laws and, for listed companies, SEC disclosure. A single incident can therefore trigger several clocks at once.
Questions on this topic
11 statements on personal data breach notification
Cyber security law has moved from guidance to statutory duties with registration, incident reporting and management accountability. In the EU, NIS2 covers medium and large entities in 18 sectors, but transposition is uneven: Germany's law is in force while France's was still a bill in October 2026. Product makers face the Cyber Resilience Act, whose reporting duties began on 11 September 2026. Singapore, Saudi Arabia and the US regulate critical infrastructure and, increasingly, cloud and digital infrastructure providers.
Questions on this topic
11 statements on cyber security obligations
The EU AI Act is the only comprehensive AI law among the main markets, and its timeline was reset in July 2026: high-risk rules now apply from 2 December 2027, or 2 August 2028 for AI built into regulated products. Prohibitions and general-purpose AI obligations already apply, and enforcement powers have run since 2 August 2026. In the other markets researched, the operative rules found are data protection rules on automated decisions, such as the UK's 2026 reforms and California's automated decision-making regulations.
Questions on this topic
11 statements on ai regulation
Online businesses face rules beyond data protection: platform duties under the EU Digital Services Act, data-sharing and cloud-switching rules under the Data Act, cookie consent rules, child online safety laws and, increasingly, mandatory e-invoicing. The e-invoicing deadlines are the most immediate: France from September 2026, the UAE from January 2027 for larger businesses and Saudi Arabia's next wave by February 2027. These are system changes that need lead time.
Questions on this topic
10 statements on digital services, e-commerce and e-invoicing rules
Worked example, from official sources
A group with customer databases in an EU subsidiary and an Indian subsidiary wants to consolidate them in a third-party cloud region in Singapore or the US. Which transfer tool is needed for each flow, and which breach notifications would apply?
| Data flow | Transfer tool | Extra conditions | Breach notice to regulator | Official source |
|---|---|---|---|---|
| EU to US, provider certified under the DPF | Adequacy decision (EU-US Data Privacy Framework, 10 July 2023) | Confirm certification covers the data | Within 72 hours where feasible | European Commission; GDPR |
| EU to US, provider not certified | Commission standard contractual clauses or BCRs | No CNIL authorisation needed for Commission SCCs | Within 72 hours where feasible | CNIL; GDPR |
| EU to Singapore | Commission SCCs or BCRs (no adequacy decision) | No CNIL authorisation needed for Commission SCCs | Within 72 hours where feasible | European Commission; CNIL |
| India to Singapore or US | None required unless the destination is restricted by notification | Government orders on foreign-state access; SDF data categories; RBI payment data must stay in India | Initial report, then detailed report within 72 hours (from 13 May 2027) | India Code; DPDP Rules (secondary); RBI |
Result on these facts
On these facts, EU data can go to a US region with the least paperwork if the provider is certified under the Data Privacy Framework; otherwise, and for Singapore in every case, the EU subsidiary needs standard contractual clauses or binding corporate rules. Indian data can go to either destination without a specific transfer tool today, subject to future restricted-country notifications, government orders and sector rules such as RBI payment data localisation. Breach notification clocks are 72 hours in both the EU and, from May 2027, India, so a single incident response process should be built to meet both.
Confirm the provider's DPF certification, whether EU regulators expect a documented transfer assessment for SCC transfers, any Indian restricted-country notification or government order issued after October 2026, whether the Indian entity is or may become a significant data fiduciary or handles RBI-regulated data, and whether Singapore or US law imposes duties on the provider as processor. The India points rest partly on secondary summaries of the DPDP Rules.
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The European Commission has adopted adequacy decisions for Andorra, Argentina, Brazil, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States (commercial organisations participating in the EU-US Data Privacy Framework), Uruguay and the European Patent Organisation. Singapore, India, the UAE and Saudi Arabia are not on the list. The EU-US Data Privacy Framework decision is dated 10 July 2023; the UK decisions were renewed on 19 December 2025; mutual adequacy with Brazil was adopted in early 2026.
Personal data can flow from the EU to a country covered by a Commission adequacy decision without further safeguards, including US companies certified under the EU-US Data Privacy Framework. Transfers to other countries need GDPR transfer tools.
Reused from market guide claim it-data-003.
Transfers of personal data outside the EEA based on European Commission standard contractual clauses, binding corporate rules, approved codes of conduct or approved certification need no CNIL authorisation; transfers based on bespoke contractual clauses require CNIL authorisation. Applies where no Commission adequacy decision covers the destination. Derogations under GDPR Article 49 are available only in specific situations.
Page notes that the Commission updated its standard contractual clauses on 4 June 2021. Reused from market guide claim fr-data-006.
Under the GDPR a controller should notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. Applies to the Czech Republic as an EU member state.
Confirmed from Recital 85; the operative provision is Article 33(1), which was not reached in the fetched text. Reused from market guide claim cz-data-001.
The Central Government may by notification restrict the transfer of personal data by a Data Fiduciary for processing to countries or territories outside India that it notifies, and any other Indian law providing a higher degree of protection or restriction on transfers continues to apply. Section 16(1) and (2) of the DPDP Act; commences 13 May 2027. No restricted-country notification was confirmed as at 18 October 2026.
Reused from market guide claim in-data-012.
Under the DPDP Rules 2025, personal data processed by a Data Fiduciary may be transferred outside India subject to requirements the Central Government may set by general or special order on making the data available to a foreign State or its agencies. Central rules; commences with most operational rules on 13 May 2027. No such order was confirmed as issued.
Secondary summary of the Rules; the gazette text could not yet be checked.
The DPDP Rules require significant data fiduciaries to ensure that personal data identified by the Central Government on a committee's recommendation is not transferred outside India. Applies only to entities designated as significant data fiduciaries; commences 13 May 2027 under the current Rules. No identified data categories were confirmed as notified.
Secondary; the PIB backgrounder confirms in general terms that SDFs may have to follow government directions including local storage where needed. Reused from market guide claim in-data-016.
The Reserve Bank of India requires the entire payment data of authorised payment system operators to be stored in systems located only in India; processing abroad is permitted if the data is deleted abroad and brought back to India within one business day or 24 hours of processing, whichever is earlier. RBI circular DPSS.CO.OD.No 2785/06.08.005/2017-18 of 6 April 2018 and FAQs; applies to payment system operators, banks as operators or participants, and their third-party service providers.
FAQ page dated 26 June 2019. Reused from market guide claim in-data-013.
The DPDP Rules require a Data Fiduciary to give the Board an initial description of a breach followed by a detailed report within 72 hours. Breach rules commence on 13 May 2027; the 72-hour period may be extended on written request according to secondary commentary.
Secondary source; the official PIB backgrounder mentions notice to individuals 'without delay' but not the 72-hour report. Confirm against the Gazette text of the Rules. Reused from market guide claim in-data-006.
Under rule 1 of the DPDP Rules 2025, rules 1, 2 and 17 to 21 took effect on publication (13 November 2025), rule 4 takes effect one year later (13 November 2026) and rules 3, 5 to 16, 22 and 23 take effect eighteen months later (13 May 2027). Central rules. Rule 4 concerns consent managers; rules 3 and 5 to 16 contain most operational duties of data fiduciaries.
Secondary source used because the MeitY and Gazette pages could not yet be checked. Consistent with the PIB 18-month statement and the India Code commencement footnotes. Reused from market guide claim in-data-003.
In January 2026 MeitY consulted stakeholders on shortening the DPDP compliance window from 18 to 12 months, which would move the main deadline to 13 November 2026; this was a proposal and had not been reported as notified. Proposal only. The same consultation proposed bringing significant data fiduciary transfer restrictions into effect immediately.
Secondary. A law-firm article updated 8 September 2026 still gave 13 May 2027 as the main commencement date. MeitY's 7 October 2026 Removal of Difficulties Order made only textual corrections to sections 9 and 10 and did not change dates (India Briefing). Pending change: check the Gazette. Reused from market guide claim in-data-014.
WONE Global Intelligence
Ask in your own words. Answers come from WONE Global's checked records, with every source shown, and end with the named Partner who can act. Go deeper on any point, or build a decision file.
Scope
Key questions
You don’t need the answers before you talk to us. Working through them is the first thing we do together.
Coverage
A named WONE Global lead in 2 markets today. In every other featured market, WONE Global arranges qualified local expertise on request and tells you who it is before work begins.
WONE Global Partners
Each is responsible for this service in their own jurisdiction, under their own professional rules.
Tel Aviv · IsraelWONE Global Partner · Israel
Adv. Karin Horev has been practicing corporate and commercial law for more than 20 years, with a focus on complex technology-related matters. Over the years, Karin has led a large number of complex and wide-ranging tran…
Kampala · UgandaWONE Global Partner · Uganda
Tony Kiire is the Founding and Managing Partner of Diamond Advocates, where he leads the Technology, Innovation, and Intellectual Property Law practice. He is also the founder of Lawtech Associates and Consult, the comp…
Who does what
WONE Global is not a law, tax or audit firm. Each firm is independent and regulated where it practises.
Cases
The cases this service leads or joins, in the words clients use. Each sets out what is at stake, how WONE Global handles it and who handles it in each market.
Contact WONE Global
Save your questions, decisions and WONE activity in one account.
Forgot your password? Reset it securely.
Partner workspaces are for Partner firms. Explore partnership →
