Guides building a multi-jurisdiction privacy compliance matrix for organisations operating across multiple countries. Covers common requirements identification, jurisdiction-specific deltas, gap analysis, and harmonised control frameworks. Keywords: multi-jurisdiction, compliance matrix, harmonised controls, gap analysis, jurisdiction mapping.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Organisations operating across multiple jurisdictions face the challenge of complying with overlapping, divergent, and sometimes conflicting privacy requirements. A multi-jurisdiction compliance matrix provides a structured approach to identifying common requirements across all applicable privacy laws, mapping jurisdiction-specific variations (deltas), identifying gaps between current compliance posture and legal requirements, and designing harmonised controls that satisfy the most stringent requirements across all jurisdictions.
| Category | Sub-Categories |
|---|---|
| Lawful basis for processing | Consent, legitimate interest, contract, legal obligation, vital interests, public interest |
| Individual rights | Access, correction, deletion/erasure, portability, restriction, objection, automated decision review |
| Consent management | Form, withdrawal, children, sensitive data, separate consent |
| Data collection and notice | Notice content, timing, language, format |
| Cross-border transfers | Mechanisms, adequacy, contractual safeguards, data localisation |
| Data protection officer | Appointment criteria, qualifications, independence, functions |
| Breach notification | Authority notification, individual notification, timelines, content |
| Impact assessment | When required, contents, review cycle |
| Security safeguards | Technical measures, organisational measures, encryption, access control |
| Retention and deletion | Limitation periods, destruction methods, legal holds |
| Enforcement and penalties | Administrative fines, criminal penalties, civil liability |
| Record-keeping | Processing records, consent records, transfer records, breach records |
For Zenith Global Enterprises, the compliance matrix covers:
| Jurisdiction | Primary Law | Regulator |
|---|---|---|
| European Union | GDPR | National DPAs / EDPB |
| United Kingdom | UK GDPR + DPA 2018 | ICO |
| Brazil | LGPD (Lei 13.709/2018) | ANPD |
| China | PIPL | CAC |
| South Korea | PIPA | PIPC |
| India | DPDP Act 2023 | DPBI |
| Thailand | PDPA B.E. 2562 | PDPC |
| Singapore | PDPA 2012 | PDPC |
| Japan | APPI | PPC |
| Australia | Privacy Act 1988 | OAIC |
| United States | State laws (CCPA/CPRA, etc.) | State AGs / CPPA (California) |
| Jurisdiction | Consent | Contract | Legitimate Interest | Legal Obligation | Vital Interests | Other Unique Bases |
|---|---|---|---|---|---|---|
| EU (GDPR) | Art. 6(1)(a) | Art. 6(1)(b) | Art. 6(1)(f) | Art. 6(1)(c) | Art. 6(1)(d) | Public interest (Art. 6(1)(e)) |
| Brazil (LGPD) | Art. 7, I | Art. 7, V | Art. 7, IX | Art. 7, II | Art. 7, VII | Credit protection (Art. 7, X); Research (Art. 7, IV); Public policy (Art. 7, III); Health (Art. 7, VIII); Exercise of rights (Art. 7, VI) |
| China (PIPL) | Art. 13(1) | Art. 13(2) | None | Art. 13(3) | Art. 13(4) | Publicly disclosed (Art. 13(6)); Other statutory (Art. 13(7)) |
| Korea (PIPA) | Art. 15(1)(1) | Art. 15(1)(4) | Art. 15(1)(6) (2023) | Art. 15(1)(2) | Art. 15(1)(5) | Public institution duty (Art. 15(1)(3)) |
| India (DPDP) | Section 6 | N/A (under legitimate uses) | N/A | Section 7(c) | Section 7(d) | Employment (Section 7(f)); State functions (Section 7(b)) |
| Japan (APPI) | Implied consent | Permitted purpose | None (use limitation approach) | Statutory basis | Life protection | Pseudonymous processing (relaxed rules) |
| Jurisdiction | Authority Timeline | Individual Timeline | Threshold |
|---|---|---|---|
| EU (GDPR) | 72 hours from awareness | Without undue delay | Risk to rights and freedoms |
| UK GDPR | 72 hours from awareness | Without undue delay | Risk to rights and freedoms |
| Brazil (LGPD) | 3 business days | 3 business days | Relevant risk or damage |
| China (PIPL) | Promptly (no fixed deadline) | Promptly | Any PI security incident |
| Korea (PIPA) | 72 hours (1,000+ individuals) | Without delay | Any breach |
| India (DPDP) | 72 hours (draft rules) | 72 hours (draft rules) | Likely harm to data principal |
| Thailand (PDPA) | 72 hours | Without delay if high risk | Affects rights and freedoms |
| Singapore (PDPA) | 3 calendar days after assessment | As soon as practicable | Significant harm OR 500+ individuals |
| Japan (APPI) | 3-5 business days (preliminary) | Promptly | PPC-defined thresholds |
| Australia (Privacy Act) | As soon as practicable (30-day assessment) | As soon as practicable | Likely serious harm |
| Jurisdiction | Age Threshold | Parental Consent Mechanism |
|---|---|---|
| EU (GDPR) | 16 (Member States may lower to 13) | Art. 8: Parental consent for ISS |
| Brazil (LGPD) | Best interest standard | At least one parent's consent |
| China (PIPL) | Under 14 = minor PI | Parent/guardian consent |
| Korea (PIPA) | Under 14 | Legal representative consent |
| India (DPDP) | Under 18 | Verifiable parental consent |
| Thailand (PDPA) | Under 10 for parental consent | Parent/guardian consent |
| Singapore (PDPA) | No specific age (reasonable expectations) | Not specified |
| Japan (APPI) | No specific threshold | General consent rules apply |
| Australia | Under 18 (reform amendments) | Best interests standard; children's code |
The harmonised control framework applies the most stringent requirement from any jurisdiction as the baseline control, ensuring compliance across all operating jurisdictions.
| Control Area | Harmonised Standard | Driven By |
|---|---|---|
| Consent | Free, specific, informed, unambiguous, separate per purpose, with easy withdrawal | EU GDPR + China PIPL separate consent |
| Breach notification | 72 hours to authority + individuals simultaneously | EU GDPR / Korea PIPA / India DPDP |
| Children's consent | Parental consent for all processing of under-18 data | India DPDP (18 threshold) |
| DPO appointment | Appoint in all jurisdictions with >500 employees or significant processing | EU GDPR / Thailand PDPA / Brazil LGPD |
| Impact assessment | Conduct for all high-risk processing, cross-border transfers, automated decisions | EU GDPR + China PIPL + Australia (2024) |
| Retention | Delete within 5 days of purpose fulfilment | Korea PIPA (most stringent) |
| Security | AES-256 encryption at rest and TLS 1.3 in transit | Cross-jurisdiction best practice |
| Cross-border transfer | Contractual safeguards + TIA + consent where required | EU GDPR SCCs + China PIPL mechanisms |
| Record-keeping | 7-year retention for consent records, processing records, transfer records | India DPDP (7-year consent manager), extended by statutory requirements |
| Automated decisions | Transparency notice + human review + impact assessment | EU GDPR Art. 22 + Australia 2024 |
| Delta | Jurisdiction | Requirement | Harmonised Approach |
|---|---|---|---|
| Credit protection basis | Brazil | Art. 7, X — lawful basis for credit protection | Document where Brazil-specific basis is relied upon |
| Separate consent (单独同意) | China | Five specific separate consent triggers | Implement separate consent globally where any trigger is met |
| Pre-transfer information | Japan | Provide destination country PI protection system info before consent | Include in all cross-border consent forms globally |
| DNC Registry check | Singapore | Mandatory check before telephone/SMS marketing | Implement DNC checking in Singapore; voluntary in other jurisdictions |
| Data localisation | China (CIIO) | CIIO must store data in PRC | Local storage for PRC data; process copies abroad |
| Resident registration number encryption | Korea | Mandatory encryption for RRN | Encrypt all government identifiers in all jurisdictions |
| Consent Manager | India | Registered intermediary for consent management | Integrate with consent manager in India; optional elsewhere |
| Pseudonymisation framework | Korea / Japan | Statutory pseudonymisation frameworks | Implement pseudonymisation programme meeting both PIPA and APPI standards |
| Element | Detail |
|---|---|
| Matrix owner | Chief Privacy Officer, Zenith Global Enterprises |
| Update frequency | Quarterly for law changes; annual comprehensive review |
| Change trigger | New jurisdiction entry, significant law amendment, enforcement action |
| Review committee | Privacy Steering Committee (CPO, regional DPOs, Legal, IT Security) |
| Tool | Compliance matrix maintained in GRC platform with automated law change alerts |
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.
日本語の概要は準備中です。原文の説明を表示しています。
Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.
日本語の概要は準備中です。原文の説明を表示しています。
Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.
日本語の概要は準備中です。原文の説明を表示しています。
Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.
日本語の概要は準備中です。原文の説明を表示しています。
Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.
日本語の概要は準備中です。原文の説明を表示しています。