European Union
GDPR
The General Data Protection Regulation applies to processing the personal data of people in the EU, wherever the business is based.
- Requests
- Answer within one month; two more months for complex requests, if you tell the person.
- Breaches
- Notify the supervisory authority within 72 hours of becoming aware.
- Cookies
- Non-essential cookies need prior opt-in consent (with the ePrivacy Directive).
- Fines
- Up to €20 million or 4% of worldwide annual turnover, whichever is higher.
In Pexpy: Requests tracked against the one-month clock, extensions logged, erasure and exports across every module.
Türkiye
KVKK (Law No. 6698)
Türkiye’s Personal Data Protection Law, amended in 2024 for transfers abroad, overseen by the Personal Data Protection Board.
- Requests
- Answer within 30 days, free of charge as a rule.
- Breaches
- Notify the Board within 72 hours (Board decision 2019/10) and the people affected as soon as possible.
- Cookies
- Non-essential cookies need explicit consent; the Board’s cookie guide expects an equal option to refuse.
- Registry
- Controllers above the Board’s thresholds register in VERBİS.
- Transfers abroad
- Adequacy decisions or appropriate safeguards; standard contracts must be notified to the Authority within five business days of signing.
In Pexpy: KVKK’s 30-day clock, Turkish request e-mails, İYS for commercial messages, a VERBİS field and Turkish readiness questions.
United Kingdom
UK GDPR & PECR
The UK version of the GDPR, with the Privacy and Electronic Communications Regulations for cookies and marketing.
- Requests
- One month, extendable by two months for complex requests.
- Breaches
- Report to the ICO within 72 hours where there is a risk to people.
- Cookies
- Consent for non-essential cookies under PECR.
- Fines
- Up to £17.5 million or 4% of worldwide annual turnover.
In Pexpy: The same request workflow and cookie banner as for the EU.
California, United States
CCPA / CPRA
California’s consumer privacy law, as amended by the CPRA, enforced by the California Privacy Protection Agency and the Attorney General.
- Requests
- Respond within 45 days, extendable once by 45 days.
- Opt-out
- A “Do Not Sell or Share My Personal Information” link, and Global Privacy Control honoured as an opt-out.
- Sensitive data
- A right to limit the use of sensitive personal information.
- Fines
- Civil penalties per violation, higher for intentional violations and those involving minors.
In Pexpy: The cookie banner switches US visitors to an opt-out model with “Do Not Sell or Share” and honours GPC.
United States
Other US state laws
A growing number of states — Virginia, Colorado, Connecticut, Texas, Oregon and more — have comprehensive privacy laws with similar rights.
- Model
- Mostly opt-out for sale, targeted advertising and profiling; opt-in for sensitive data in many states.
- Universal opt-out
- Several states require honouring signals such as GPC.
- Requests
- Typically 45 days, extendable.
In Pexpy: One opt-out banner model with GPC for all US visitors.
Brazil
LGPD
Brazil’s General Data Protection Law, overseen by the ANPD.
- Requests
- A simplified answer at once, or a full report within 15 days.
- Breaches
- Notify the ANPD within three business days.
- Fines
- Up to 2% of revenue in Brazil, capped at R$50 million per infraction.
In Pexpy: Opt-in banner model, request workflow with your own deadline setting.
Canada
PIPEDA & Québec Law 25
Canada’s federal private-sector privacy law, with Québec’s stricter Law 25 for organisations there.
- Requests
- 30 days, extendable in some cases.
- Breaches
- Report breaches that create a real risk of significant harm as soon as feasible.
- Consent
- Meaningful consent; Québec requires opt-in for most tracking.
In Pexpy: Opt-in banner model and request workflow.
European Union
EU AI Act
The EU’s law on artificial intelligence, applying in stages since 2025.
- Transparency
- Since 2 August 2026, people must be told when they are interacting with an AI system (Art. 50).
- Prohibited practices
- Banned since February 2025, with fines up to €35 million or 7% of worldwide turnover.
In Pexpy: The website assistant says it is an AI by default and hands over to a person; copilot actions are logged and undoable.
Reviewed 29 October 2026. A summary for orientation, not legal advice — laws and guidance change; check the current text and take advice where the stakes require it. See also the glossary.