- Home
- Privacy compliance
GDPR · HIPAA · PIPEDA · Australia · NZ · DPDPA · UAE PDPL
Privacy compliance consulting for GDPR, HIPAA, PIPEDA, DPDPA and the Australian and NZ Privacy Acts
If you handle personal data from customers in Europe, the US, Canada, Australia, New Zealand, India or the UAE, each law sets its own rules. We build one privacy programme that meets the ones that apply to you, without running a separate project for each.
- Laws covered
- GDPR, HIPAA, PIPEDA, Privacy Act 1988 (AU), Privacy Act 2020 (NZ), DPDPA, UAE PDPL
- Management system
- ISO/IEC 27701 privacy information management
- Key outputs
- Data map, records of processing, DPIAs, policy set, breach playbook
- Works with
- ISO 27001 and ISO 42001 programmes
Coverage
The privacy laws we work with
The applicability notes below are a summary. Your exact obligations depend on your role, the data you process and where your customers are.
| Law | Jurisdiction | Who it applies to | What we help you put in place |
|---|---|---|---|
| GDPR | EU / EEA | Organisations in the EU, and those outside it that offer goods or services to, or monitor, people in the EU | Lawful basis, records of processing, DPIAs, data subject rights, 72-hour breach notification, international transfers |
| HIPAA | United States | Covered entities and business associates that handle protected health information | Security Rule risk analysis, administrative, physical and technical safeguards, BAAs, breach notification |
| PIPEDA | Canada | Private-sector organisations handling personal information in commercial activity | The 10 fair information principles, meaningful consent, safeguards, breach reporting and record-keeping |
| Privacy Act 1988 | Australia | Australian Government agencies and organisations with annual turnover above AUD 3 million, plus some smaller businesses such as health service providers | The 13 Australian Privacy Principles, privacy policies, cross-border disclosure, Notifiable Data Breaches scheme |
| Privacy Act 2020 | New Zealand | Agencies in New Zealand, and overseas agencies carrying on business there | The Information Privacy Principles, overseas disclosure rules, notifiable privacy breach reporting to the Privacy Commissioner |
| DPDPA | India | Processing digital personal data in India, and outside India when offering goods or services to people there | Notice and consent, Data Principal rights, breach intimation, additional duties for Significant Data Fiduciaries |
| PDPL | UAE | Processing personal data in the UAE (DIFC and ADGM have their own regimes) | Lawful processing, data subject rights, security measures, cross-border transfer conditions |
What's included
Building a privacy programme that works
- Applicability assessmentWhich laws apply to you, in what role, and for which data.
- Privacy gap assessmentWhere you stand against each applicable law, with a prioritised plan.
- Data mappingWhat personal data you hold, where it flows and who can access it.
- Records of processingRoPA maintained in a format regulators and clients expect.
- DPIAs and privacy impact assessmentsFor high-risk processing, new products and AI use cases.
- Notices and consentPrivacy notices and consent flows that meet each law's requirements.
- Data subject requestsA workable process for access, correction, deletion and other rights.
- Breach responseA playbook that meets each regime's notification rules, including Australia's Notifiable Data Breaches scheme and NZ breach reporting.
- Vendor and transfer contractsDPAs, BAAs and cross-border transfer mechanisms reviewed and in place.
- HIPAA risk analysisThe Security Rule risk analysis and safeguard review for health data.
FAQ
Privacy questions
We're based in the UAE. Does GDPR apply to us?
It can. GDPR applies to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour. Selling to EU customers, running EU-targeted marketing or processing data for an EU client can all bring you into scope. We'll help you work out where you stand.
Does HIPAA apply to companies outside the US?
HIPAA applies to covered entities and their business associates. A non-US company that handles protected health information for a US healthcare client is typically a business associate under a Business Associate Agreement and has to meet the Security Rule's safeguards in practice.
Is there a HIPAA certification?
No. There is no official government HIPAA certification. What you can show is a documented risk analysis, implemented safeguards, policies, training records and signed BAAs. An independent assessment against the rules is a common way to give clients assurance.
Can one programme cover several privacy laws?
Yes, and it's usually the most efficient approach. Data mapping, records of processing, rights handling, breach response and vendor management are common to all of them. We build these once and add the specific requirements each law sets.
Does the Australian Privacy Act apply to small businesses?
Currently, most small businesses with annual turnover of AUD 3 million or less are exempt, but there are important exceptions, including health service providers and businesses that trade in personal information. The Act is being reformed and the exemption may narrow, so it's worth checking where you stand now.
We're outside New Zealand. Can the NZ Privacy Act still apply?
Yes. The Privacy Act 2020 applies to overseas agencies carrying on business in New Zealand, even without a physical presence there, for personal information collected or held in the course of that business.
Are you a law firm?
No. We're privacy and compliance consultants, focused on building the processes, controls and documentation that make compliance work day to day. Where you need a formal legal opinion, we work alongside your legal counsel.
Not sure which privacy laws apply to you?
Tell us where your customers are and what data you handle. We'll map your obligations and show you what a single programme would look like.