The Intersection of U.S. and Non-U.S. Privacy Laws: What Privacy Professionals Need to Know 2026

In today’s global digital economy, personal data rarely stays within one country. U.S. organizations therefore increasingly have to deal not only with U.S. privacy laws, but also with foreign data protection laws such as the EU General Data Protection Regulation (GDPR) and Switzerland’s Federal Act on Data Protection (FADP). For privacy professionals, especially those preparing for the CIPP/US exam, it is important to understand both the differences and the overlap between these legal frameworks.

One key difference is how privacy regulation is structured. Outside the United States, privacy laws are usually comprehensive and apply across all sectors. The GDPR, for example, covers almost all personal data of individuals in the European Union, regardless of industry. The U.S. approach is very different. It relies on a mix of sector-specific federal laws, such as health or financial regulations, and an increasing number of state privacy laws. As a result, a U.S. company operating internationally may face one strict and consistent set of rules in Europe, while dealing with a fragmented or incomplete framework at home. To simplify compliance, many multinational organizations choose to apply GDPR-level protections worldwide, even when U.S. law does not require it.

Another important area of overlap is extraterritorial reach. Both the GDPR and the Swiss FADP can apply to U.S. companies with no physical presence in Europe or Switzerland. Simply offering goods or services to EU or Swiss residents, or tracking their online behavior, can trigger legal obligations. This means that a single website may have to offer GDPR rights such as access, correction, and deletion to European users, while U.S. users are subject to different rights under state or federal law.

There are also major differences around legal bases and consent. Under the GDPR, every processing activity must be based on a lawful ground, such as consent, a contract, or a legitimate interest. U.S. privacy laws generally do not require this. Outside specific regulated areas, companies in the U.S. are often free to process data as long as their practices are not unfair or misleading. This creates additional compliance work for U.S. companies handling European data, as they must implement GDPR-style consent mechanisms and documentation. The Swiss FADP is largely aligned with the GDPR, but it allows more flexibility by permitting processing by default, except in higher-risk cases such as sensitive data or profiling.

Cross-border data transfers are often the most complex issue. Under the GDPR and FADP, personal data may not be transferred to countries without adequate protection, including the United States, unless safeguards are in place. These safeguards include Standard Contractual Clauses, transfer impact assessments, or participation in the EU–U.S. and Swiss–U.S. Data Privacy Frameworks introduced in 2023. U.S. law does not have a similar concept, as data can generally flow out of the country freely. However, failing to comply with European transfer rules can expose U.S. companies to significant enforcement actions and fines.

Finally, enforcement and legal convergence are changing the privacy landscape. GDPR penalties are much higher than those typically imposed under U.S. law. At the same time, many GDPR principles, such as data minimization, transparency, and privacy by design, are increasingly reflected in U.S. state privacy laws. States like California and Colorado now provide consumer rights that closely resemble those found in European law.

For privacy students, the message is clear. Privacy compliance is global by nature. Strong privacy programs are often designed to meet the strictest legal standard that applies. Understanding how U.S. and non-U.S. privacy laws interact is no longer optional. It is a core skill for today’s privacy professionals.