ہوم › قوانین کا ساتھ ساتھ موازنہ
قوانین کا ساتھ ساتھ موازنہ
زیادہ سے زیادہ چار قوانین منتخب کریں۔ ہر ایک کے لیے ایک جیسے موضوعات دکھائے جاتے ہیں۔
| موضوع | EU GDPR European Union (EEA) ✓ دو ذرائع سے تصدیق شدہ | UK GDPR / DPA 2018 United Kingdom ✓ دو ذرائع سے تصدیق شدہ |
|---|---|---|
| حیثیت | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ | In force since 1 Jan 2021 (retained from EU GDPR); DUAA 2025 data protection changes fully in force by 19 June 2026.✓ |
| یہ کن پر لاگو ہوتا ہے | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ | Organisations processing personal data in the context of a UK establishment, and non-UK organisations offering goods/services to, or monitoring the behaviour of, people in the UK.✓ |
| سائز کی حدیں | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ | None — applies regardless of size.✓ |
| ریگولیٹر | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ | Information Commission (replaced the Information Commissioner's Office on 30 Sep 2026; still uses the 'ICO' name)✓ |
| خلاف ورزی یا واقعے کی رپورٹنگ | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ | Report notifiable breaches to the Information Commission without undue delay and, where feasible, within 72 hours. Tell affected individuals without undue delay if high risk. PECR breaches by telecoms providers: without undue delay and, where feasible, within 72 hours (PECR reg 5A(2), since 20 Aug 2025).✓ |
| ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ | 1 month, extendable by 2 months for complex or numerous requests. For access requests the clock pauses while you seek info needed to scope the request (Art 12A, requests from 5 Feb 2026). Searches need only be reasonable and proportionate.✓ |
| ڈیٹا پروٹیکشن آفیسر | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ | DPO mandatory for public authorities and where core activities involve large-scale systematic monitoring or large-scale special-category/criminal data (same tests as EU GDPR).✓ |
| مقامی نمائندہ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ | Non-UK organisations with no UK establishment that target or monitor people in the UK must appoint a UK representative in writing, unless processing is occasional and low-risk or they are a public authority.✓ |
| ڈیٹا بیرونِ ملک بھیجنا | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ | Transfers need UK adequacy regulations (data bridges), or the IDTA / UK Addendum to EU SCCs, or BCRs. Since 5 Feb 2026 the adequacy test is whether protection is 'not materially lower'; existing TRAs remain usable.✓ |
| کوکیز اور رضامندی | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ | PECR: consent needed for non-essential cookies, but since 5 Feb 2026 low-risk statistical/analytics and functionality cookies can be set without consent if users get clear info and an opt-out. Ad/tracking cookies still need consent.✓ |
| زیادہ سے زیادہ سزا | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ | Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher (lower tier £8.7m or 2%). PECR fines raised to the same level from 5 Feb 2026.✓ |
= دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔
جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔
Start here
Each law in the library compared with the EU GDPR, the benchmark most privacy laws are measured against. Listed by law, not ranked by visitor counts.