Applies to businesses meeting revenue or data volume thresholds that handle California residents' data.
UK has its own adequacy decisions separate from the EU. Transfers from the UK follow UK-specific rules.
Any US-incorporated provider or subsidiary may be compelled to disclose data regardless of where it is stored.
Cross-border transfers require consent or equivalent protection standards recognized by Japan's PPC.
Cross-border transfers require comparable protection standards in the receiving country.
Cross-border transfers to non-adequate countries require SCCs, BCRs, or other safeguards.
US providers may be subject to surveillance orders targeting non-US persons, creating risk for EU data subjects.
Organizations must take reasonable steps to ensure overseas recipients handle personal information in accordance with the APPs.