1---2name: multi-jurisdiction-matrix3description: Guides building a multi-jurisdiction privacy compliance matrix for organisations operating across multiple countries. Covers common requirements identification, jurisdiction-specific deltas, gap analysis, and harmonised control frameworks. Keywords: multi-jurisdiction, compliance matrix, harmonised controls, gap analysis, jurisdiction mapping.4license: Apache-2.05---67# Multi-Jurisdiction Privacy Compliance Matrix89## Overview1011Organisations operating across multiple jurisdictions face the challenge of complying with overlapping, divergent, and sometimes conflicting privacy requirements. A multi-jurisdiction compliance matrix provides a structured approach to identifying common requirements across all applicable privacy laws, mapping jurisdiction-specific variations (deltas), identifying gaps between current compliance posture and legal requirements, and designing harmonised controls that satisfy the most stringent requirements across all jurisdictions.1213## Compliance Matrix Structure1415### Dimension 1: Requirement Categories1617| Category | Sub-Categories |18|----------|---------------|19| Lawful basis for processing | Consent, legitimate interest, contract, legal obligation, vital interests, public interest |20| Individual rights | Access, correction, deletion/erasure, portability, restriction, objection, automated decision review |21| Consent management | Form, withdrawal, children, sensitive data, separate consent |22| Data collection and notice | Notice content, timing, language, format |23| Cross-border transfers | Mechanisms, adequacy, contractual safeguards, data localisation |24| Data protection officer | Appointment criteria, qualifications, independence, functions |25| Breach notification | Authority notification, individual notification, timelines, content |26| Impact assessment | When required, contents, review cycle |27| Security safeguards | Technical measures, organisational measures, encryption, access control |28| Retention and deletion | Limitation periods, destruction methods, legal holds |29| Enforcement and penalties | Administrative fines, criminal penalties, civil liability |30| Record-keeping | Processing records, consent records, transfer records, breach records |3132### Dimension 2: Jurisdictions3334For Zenith Global Enterprises, the compliance matrix covers:3536| Jurisdiction | Primary Law | Regulator |37|-------------|-------------|-----------|38| European Union | GDPR | National DPAs / EDPB |39| United Kingdom | UK GDPR + DPA 2018 | ICO |40| Brazil | LGPD (Lei 13.709/2018) | ANPD |41| China | PIPL | CAC |42| South Korea | PIPA | PIPC |43| India | DPDP Act 2023 | DPBI |44| Thailand | PDPA B.E. 2562 | PDPC |45| Singapore | PDPA 2012 | PDPC |46| Japan | APPI | PPC |47| Australia | Privacy Act 1988 | OAIC |48| United States | State laws (CCPA/CPRA, etc.) | State AGs / CPPA (California) |4950## Cross-Jurisdiction Requirement Comparison5152### Lawful Bases Comparison5354| Jurisdiction | Consent | Contract | Legitimate Interest | Legal Obligation | Vital Interests | Other Unique Bases |55|-------------|---------|----------|-------------------|-----------------|-----------------|-------------------|56| EU (GDPR) | Art. 6(1)(a) | Art. 6(1)(b) | Art. 6(1)(f) | Art. 6(1)(c) | Art. 6(1)(d) | Public interest (Art. 6(1)(e)) |57| Brazil (LGPD) | Art. 7, I | Art. 7, V | Art. 7, IX | Art. 7, II | Art. 7, VII | Credit protection (Art. 7, X); Research (Art. 7, IV); Public policy (Art. 7, III); Health (Art. 7, VIII); Exercise of rights (Art. 7, VI) |58| China (PIPL) | Art. 13(1) | Art. 13(2) | None | Art. 13(3) | Art. 13(4) | Publicly disclosed (Art. 13(6)); Other statutory (Art. 13(7)) |59| Korea (PIPA) | Art. 15(1)(1) | Art. 15(1)(4) | Art. 15(1)(6) (2023) | Art. 15(1)(2) | Art. 15(1)(5) | Public institution duty (Art. 15(1)(3)) |60| India (DPDP) | Section 6 | N/A (under legitimate uses) | N/A | Section 7(c) | Section 7(d) | Employment (Section 7(f)); State functions (Section 7(b)) |61| Japan (APPI) | Implied consent | Permitted purpose | None (use limitation approach) | Statutory basis | Life protection | Pseudonymous processing (relaxed rules) |6263### Breach Notification Timeline Comparison6465| Jurisdiction | Authority Timeline | Individual Timeline | Threshold |66|-------------|-------------------|--------------------|-----------|67| EU (GDPR) | 72 hours from awareness | Without undue delay | Risk to rights and freedoms |68| UK GDPR | 72 hours from awareness | Without undue delay | Risk to rights and freedoms |69| Brazil (LGPD) | 3 business days | 3 business days | Relevant risk or damage |70| China (PIPL) | Promptly (no fixed deadline) | Promptly | Any PI security incident |71| Korea (PIPA) | 72 hours (1,000+ individuals) | Without delay | Any breach |72| India (DPDP) | 72 hours (draft rules) | 72 hours (draft rules) | Likely harm to data principal |73| Thailand (PDPA) | 72 hours | Without delay if high risk | Affects rights and freedoms |74| Singapore (PDPA) | 3 calendar days after assessment | As soon as practicable | Significant harm OR 500+ individuals |75| Japan (APPI) | 3-5 business days (preliminary) | Promptly | PPC-defined thresholds |76| Australia (Privacy Act) | As soon as practicable (30-day assessment) | As soon as practicable | Likely serious harm |7778### Children's Age Thresholds7980| Jurisdiction | Age Threshold | Parental Consent Mechanism |81|-------------|--------------|---------------------------|82| EU (GDPR) | 16 (Member States may lower to 13) | Art. 8: Parental consent for ISS |83| Brazil (LGPD) | Best interest standard | At least one parent's consent |84| China (PIPL) | Under 14 = minor PI | Parent/guardian consent |85| Korea (PIPA) | Under 14 | Legal representative consent |86| India (DPDP) | Under 18 | Verifiable parental consent |87| Thailand (PDPA) | Under 10 for parental consent | Parent/guardian consent |88| Singapore (PDPA) | No specific age (reasonable expectations) | Not specified |89| Japan (APPI) | No specific threshold | General consent rules apply |90| Australia | Under 18 (reform amendments) | Best interests standard; children's code |9192## Harmonised Control Framework9394### Principle: Highest Common Denominator9596The harmonised control framework applies the most stringent requirement from any jurisdiction as the baseline control, ensuring compliance across all operating jurisdictions.9798### Harmonised Controls for Zenith Global Enterprises99100| Control Area | Harmonised Standard | Driven By |101|-------------|-------------------|-----------|102| Consent | Free, specific, informed, unambiguous, separate per purpose, with easy withdrawal | EU GDPR + China PIPL separate consent |103| Breach notification | 72 hours to authority + individuals simultaneously | EU GDPR / Korea PIPA / India DPDP |104| Children's consent | Parental consent for all processing of under-18 data | India DPDP (18 threshold) |105| DPO appointment | Appoint in all jurisdictions with >500 employees or significant processing | EU GDPR / Thailand PDPA / Brazil LGPD |106| Impact assessment | Conduct for all high-risk processing, cross-border transfers, automated decisions | EU GDPR + China PIPL + Australia (2024) |107| Retention | Delete within 5 days of purpose fulfilment | Korea PIPA (most stringent) |108| Security | AES-256 encryption at rest and TLS 1.3 in transit | Cross-jurisdiction best practice |109| Cross-border transfer | Contractual safeguards + TIA + consent where required | EU GDPR SCCs + China PIPL mechanisms |110| Record-keeping | 7-year retention for consent records, processing records, transfer records | India DPDP (7-year consent manager), extended by statutory requirements |111| Automated decisions | Transparency notice + human review + impact assessment | EU GDPR Art. 22 + Australia 2024 |112113## Jurisdiction-Specific Deltas114115### Requirements Unique to Specific Jurisdictions116117| Delta | Jurisdiction | Requirement | Harmonised Approach |118|-------|-------------|-------------|-------------------|119| Credit protection basis | Brazil | Art. 7, X — lawful basis for credit protection | Document where Brazil-specific basis is relied upon |120| Separate consent (单独同意) | China | Five specific separate consent triggers | Implement separate consent globally where any trigger is met |121| Pre-transfer information | Japan | Provide destination country PI protection system info before consent | Include in all cross-border consent forms globally |122| DNC Registry check | Singapore | Mandatory check before telephone/SMS marketing | Implement DNC checking in Singapore; voluntary in other jurisdictions |123| Data localisation | China (CIIO) | CIIO must store data in PRC | Local storage for PRC data; process copies abroad |124| Resident registration number encryption | Korea | Mandatory encryption for RRN | Encrypt all government identifiers in all jurisdictions |125| Consent Manager | India | Registered intermediary for consent management | Integrate with consent manager in India; optional elsewhere |126| Pseudonymisation framework | Korea / Japan | Statutory pseudonymisation frameworks | Implement pseudonymisation programme meeting both PIPA and APPI standards |127128## Gap Identification Process129130### Step 1: Map Current Controls1311. Document existing privacy controls, policies, and procedures.1322. Map each control to the requirements of each applicable jurisdiction.1333. Identify controls that satisfy requirements in multiple jurisdictions.134135### Step 2: Identify Gaps1361. For each jurisdiction, identify requirements not met by existing controls.1372. Classify gaps as: critical (legal non-compliance), significant (enforcement risk), or minor (best practice deficit).1383. Prioritise gaps based on: regulatory activity in the jurisdiction, potential penalty exposure, data subject volume.139140### Step 3: Design Remediation1411. Where possible, design a single harmonised control that addresses the gap across all jurisdictions.1422. Where harmonisation is not possible (conflicting requirements), design jurisdiction-specific controls.1433. Estimate remediation effort and timeline.1444. Assign ownership and track implementation.145146## Compliance Matrix Governance147148| Element | Detail |149|---------|--------|150| Matrix owner | Chief Privacy Officer, Zenith Global Enterprises |151| Update frequency | Quarterly for law changes; annual comprehensive review |152| Change trigger | New jurisdiction entry, significant law amendment, enforcement action |153| Review committee | Privacy Steering Committee (CPO, regional DPOs, Legal, IT Security) |154| Tool | Compliance matrix maintained in GRC platform with automated law change alerts |
mukul975