Key takeaways

  • Location of the company does not decide which privacy law applies. The location of the people whose data you handle often does.
  • The GDPR and Brazil's LGPD can apply to a U.S. company that offers goods or services to people in the EU or Brazil, or monitors people in the EU, even with no office there.
  • Florida's Digital Bill of Rights has a narrow definition of controller, but its rule against selling sensitive data without consent reaches any for-profit business that meets the first three controller criteria in the statute.
  • The laws differ in detail but share a core: know your data, limit what you collect, secure it, honor people's rights, control your vendors, and be ready to report a breach.

Why geography no longer decides

A decade ago, a Chicago manufacturer could reasonably ask only about Illinois and federal law. Today the question is different: whose data do you hold? A law firm with clients in Madrid, a software company with customers in São Paulo, a medical device distributor with patients in several states, and an online retailer shipping to California all handle personal data that other jurisdictions claim to protect. Those laws are written to follow the data subject, not the company. The result is a patchwork, but one with a recognizable pattern.

This article walks through four sets of rules that U.S. businesses with international or out-of-state clients meet most often: Florida's privacy and breach laws, California's CCPA as amended by the CPRA, the European Union's General Data Protection Regulation, and Brazil's Lei Geral de Proteção de Dados, the LGPD. It is a map, not a compliance opinion. Thresholds and exemptions matter, and they change.

Florida: a narrow privacy law and a broad breach law

Florida's comprehensive privacy statute is the Florida Digital Bill of Rights, in Chapter 501, Part V of the Florida Statutes. It gives consumers rights over their personal data, and it is enforced by the Department of Legal Affairs as an unfair and deceptive trade practice. Civil penalties can reach $50,000 per violation, and the statute allows them to be tripled for certain violations, such as those involving a known child, failing to delete or correct data after an authenticated request, or continuing to sell or share data after a consumer opts out.

The law's main obligations apply to a "controller," and that definition is narrow. A controller must operate for profit, do business in Florida, collect consumers' personal data, determine the purposes and means of processing, and make more than $1 billion in global gross annual revenue. It must also meet one of three additional tests: deriving at least 50 percent of global revenue from online advertising, operating a consumer smart speaker and voice assistant service, or operating an app store with at least 250,000 applications. Most small and mid-sized Florida businesses are therefore not controllers under this definition. The statute also exempts, among others, HIPAA-regulated covered entities and business associates, financial institutions subject to the Gramm-Leach-Bliley Act, nonprofits and state agencies.

One provision reaches further. Section 501.715 says a person who meets only the first three elements of the controller definition (a for-profit business that does business in Florida and collects personal data) may not sell sensitive personal data without the consumer's prior consent, and a business engaged in such sales must display the notice "NOTICE: This website may sell your sensitive personal data." The $1 billion revenue test does not apply to that provision. If your business collects sensitive data and shares it with data brokers or advertising partners in return for value, review this section with counsel.

Separately, the Florida Information Protection Act in Section 501.171 requires security measures and breach notification for any covered entity that holds personal information of Florida residents, regardless of size. We cover its notice deadlines in a separate article. For many small Florida businesses, the breach law is the one that matters most.

California: CCPA and CPRA

The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet any one of three thresholds, according to the California Attorney General: gross annual revenue over $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling California residents' personal information. The CCPA has no requirement of a California office. A Florida company with an online store that sells to enough California residents can be covered.

California voters approved the California Privacy Rights Act in 2020. It amended the CCPA, and its added protections began on January 1, 2023. Consumers have the right to know what personal information a business collects and how it is used and shared, the right to delete it, the right to opt out of its sale or sharing (including through the Global Privacy Control browser signal), the right to non-discrimination, the right to correct inaccurate information and the right to limit the use and disclosure of sensitive personal information. The Attorney General notes that consumers generally cannot sue for most violations, but they can sue after certain data breaches involving nonencrypted and nonredacted personal information.

Practical consequences include a privacy notice that lists categories of data collected and purposes, a method for people to submit requests, a way to honor opt-out signals, contracts with service providers that limit how they use the data, and a process to find and return or delete a person's data within the legal time limits.

The GDPR: when Europe's law reaches a U.S. company

The General Data Protection Regulation applies in two ways. It covers processing in the context of the activities of an establishment in the Union, wherever the processing takes place. And, under Article 3(2), it covers a controller or processor not established in the Union when its processing relates to offering goods or services to people in the Union (whether or not they pay) or monitoring their behavior in the Union. A U.S. firm that markets to European clients, accepts euro payments, ships to EU addresses, or tracks European website visitors for analytics or advertising should assume the GDPR may apply.

A company in that position generally must also designate a representative in the EU in writing under Article 27, unless its processing is occasional, does not involve large-scale sensitive data and is unlikely to result in a risk to individuals. Public authorities are exempt. Article 37 requires a data protection officer in certain cases, including where core activities involve regular and systematic monitoring of people on a large scale.

The GDPR sets out the principles of processing, a requirement for a lawful basis, stronger rules for special categories of data, and a set of individual rights in Articles 12 to 22, such as access, correction, erasure and objection. Controllers must also report a personal data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Processors must notify the controller without undue delay.

Transfers out of Europe are a frequent trap for U.S. businesses. Under Chapter V, personal data may go to a third country such as the United States on the basis of an adequacy decision by the European Commission (Article 45), or, absent one, with appropriate safeguards such as binding corporate rules or standard contractual clauses (Article 46), and in limited cases through the derogations in Article 49. Which mechanism you can rely on depends on your circumstances and on the current status of adequacy decisions, so check before you move data.

Penalties are serious. For infringements of the basic processing principles, data subject rights and international transfer rules, Article 83(5) allows administrative fines of up to 20 million euros or, for an undertaking, up to 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.

Brazil's LGPD

Brazil's LGPD (Law No. 13,709 of 2018) is modeled on the GDPR, and its scope is similar in reach. Article 3 applies the law to any processing operation by a person or entity, regardless of where its headquarters or the data are located, if the processing is carried out in Brazil, if its purpose is to offer or supply goods or services to, or to process the data of, people located in Brazil, or if the data was collected in Brazil. A U.S. company with Brazilian customers or contractors is therefore within reach.

The LGPD requires a legal basis for processing, grants individuals rights over their data, restricts international transfers, and requires a controller to designate a data protection officer (Article 41), whose identity and contact information should be published, preferably on the controller's website. Article 48 requires the controller to notify the national authority, the ANPD, and the affected individuals of a security incident that may result in relevant risk or damage, within a period defined by the authority. Check the ANPD's current regulations for the exact timing, since it can change.

Administrative sanctions in Article 52 range from a warning to fines. The simple fine is up to 2 percent of the sales revenue of the private entity, group or conglomerate in Brazil in its last fiscal year, excluding taxes, capped at 50 million reais per infraction. The law also provides for daily fines, publication of the infraction, blocking of the data and its deletion.

What the four laws have in common

The details differ, but a program built on the common core will satisfy most of each regime's practical requirements.

  • Know your data. Keep a record of what personal data you collect, why, where it is stored, who receives it and where it crosses borders. You cannot protect, delete or report on data you cannot find.
  • Collect less. Only collect what you need, keep it for as long as you need it, and delete it on a schedule.
  • Be clear with people. Publish a privacy notice that matches what you really do, and get consent where the law requires it, especially for sensitive data.
  • Honor rights requests. Build one intake process and one clock for access, correction, deletion and opt-out requests, and verify the requester's identity.
  • Secure it. Use access controls, multi-factor authentication, encryption, logging, patching and tested backups. Every one of these laws and most contracts expect reasonable security.
  • Control your vendors. Put written terms in every contract with a processor or service provider, covering use limits, security, subcontractors, deletion and breach notice.
  • Be ready to report. Write an incident response plan that identifies the strictest deadline you face, such as GDPR's 72 hours to the regulator, and gives your team a single decision path.
  • Plan your transfers. Know which data leaves the EU or Brazil, and which legal mechanism covers it.

A practical order of work

First, map where your clients are and what data you hold about them. A short list of jurisdictions drives everything else. Second, check applicability for each law using its own thresholds, because a small company may fall outside Florida's and California's thresholds but still within the GDPR or LGPD. Third, close the security gaps, because they are common to all of the laws and are also what attackers exploit. Fourth, tighten contracts and vendor reviews. Fifth, document your decisions. Regulators rarely expect perfection, but they do expect evidence that you made reasonable choices and followed them.

Security is the part of this work that is the most technical and the least forgiving. Clayton Secure is our privacy-minded service line for organizations that need to prove protection, not only claim it. Our team assesses your environment, builds the controls, and prepares the records your counsel and your clients will ask for.

Sources

This article is general information, not legal advice. Privacy laws differ by jurisdiction, change often and contain exemptions. Brazilian law is summarized from an unofficial English translation of Law 13,709/2018 (CyberBRICS, FGV Law School); the Portuguese text controls. Confirm your obligations with qualified counsel in each jurisdiction. Last reviewed .

Keep reading

Need help with this?

One view of your entire cybersecurity program, in near real time.

Clayton Secure