---
# === IDENTITY ===
id: compliance/startup-legal/data-privacy-compliance-decision-tree/2026
canonical_question: "Which data privacy regulations apply — GDPR, CCPA, PIPEDA, LGPD, HIPAA — based on users, data type, business model?"
aliases:
  - "Data privacy compliance decision tree for startups"
  - "Which privacy laws apply to my startup — GDPR vs CCPA vs PIPEDA"
  - "Global data privacy regulation applicability framework for startups"
entity_type: execution_recipe
domain: compliance > startup-legal > data privacy compliance decision tree
region: global
jurisdiction: global
temporal_scope: 2024-2026

# === VERIFICATION ===
last_verified: 2026-03-11
confidence: 0.87
version: 1.0
first_published: 2026-03-11

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: evolving
  last_breaking_change: null
  next_review: 2026-09-07
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "Privacy laws apply based on WHERE users are located, not where the company is incorporated"
  - "Multiple regulations can apply simultaneously — comply with the strictest standard"
  - "New US state privacy laws effective 2025-2026 — landscape changes frequently"
  - "Sector-specific laws (HIPAA, COPPA, GLBA) layer on top of general privacy laws"
  - "This card provides a framework — privacy counsel should review final compliance plan"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "Need industry-specific regulatory compliance (not just privacy)"
    use_instead: "compliance/startup-legal/industry-specific-regulatory-map/2026"
  - condition: "Need ToS and privacy policy drafting"
    use_instead: "compliance/startup-legal/terms-of-service-privacy-policy-requirements/2026"
  - condition: "Only operating in one US state with no international users"
    use_instead: "compliance/startup-legal/startup-legal-checklist-by-jurisdiction/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: user_locations
    question: "Where are your users located?"
    type: choice
    options: ["US only", "US + EU/UK", "US + Canada", "Global", "EU only", "Not sure"]
  - key: data_types
    question: "What types of personal data do you collect?"
    type: choice
    options: ["Basic (name, email)", "Financial data", "Health data (PHI)", "Children's data", "Biometric data", "Location data"]
  - key: business_model
    question: "What is your business model regarding data?"
    type: choice
    options: ["SaaS (data processor)", "Ad-supported (data seller/sharer)", "Marketplace (both sides)", "B2B (enterprise data)", "Consumer app"]
  - key: annual_revenue
    question: "Expected annual revenue?"
    type: choice
    options: ["Under $1M", "$1M-$25M", "Over $25M", "Pre-revenue"]

# === EXECUTION METADATA ===
execution:
  required_inputs:
    - name: "User location data"
      source: "Analytics or market research"
      format: "List of countries/states where users are located"
    - name: "Data inventory"
      source: "Product/engineering team"
      format: "Categories of personal data collected, stored, and processed"
  outputs:
    - name: "Privacy regulation applicability matrix"
      format: "Structured checklist"
      description: "Which privacy laws apply, why, and key requirements for each"
    - name: "Compliance gap analysis"
      format: "Document"
      description: "Current state vs required state for each applicable regulation"
    - name: "Implementation priority list"
      format: "Prioritized checklist"
      description: "Ordered compliance tasks with effort estimates and deadlines"
  tools_required:
    - name: "Consent management platform"
      purpose: "Cookie consent, preference management, consent records"
      tier: paid
      cost: "$0-$50/mo for small sites; $200-$1,000/mo for enterprise"
      alternatives: ["Cookiebot ($12/mo)", "OneTrust ($0 starter)", "Termly ($10/mo)", "Custom implementation ($0)"]
    - name: "Privacy policy generator"
      purpose: "Generate compliant privacy policy"
      tier: paid
      cost: "$10-$50/mo"
      alternatives: ["Termly ($10/mo)", "Iubenda ($29/yr)", "Attorney ($2K-$5K)"]
  credentials_needed:
    - service: "ICO (UK) or DPA registration"
      type: "Registration"
      where_to_get: "https://ico.org.uk/for-organisations/register/ (UK) or local DPA"
      free_tier_limits: "UK: GBP 40/yr for small orgs; GDPR: no registration fee for most"
  estimated_duration: "2-4 hours for mapping; 2-8 weeks for implementation"
  estimated_cost: "$0-$500 for mapping; $1,000-$50,000 for full implementation"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/compliance/startup-legal/data-privacy-compliance-decision-tree/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-11)"

# === RELATED UNITS ===
related_kos:
  depends_on:
    - id: "compliance/startup-legal/startup-legal-checklist-by-jurisdiction/2026"
      label: "Entity formation checklist"
  feeds_into:
    - id: "compliance/startup-legal/terms-of-service-privacy-policy-requirements/2026"
      label: "ToS and privacy policy requirements"
  related_to:
    - id: "compliance/startup-legal/industry-specific-regulatory-map/2026"
      label: "Industry-specific regulatory map"
  alternative_to: []

# === SOURCES ===
sources:
  - id: src1
    title: "Global Data Privacy Laws: Your 2025 Guide"
    author: Usercentrics
    url: https://usercentrics.com/guides/data-privacy/data-privacy-laws/
    type: industry_report
    published: 2025-06-01
    reliability: high
  - id: src2
    title: "CCPA Requirements 2026: Complete Compliance Guide"
    author: Secure Privacy
    url: https://secureprivacy.ai/blog/ccpa-requirements-2026-complete-compliance-guide
    type: technical_blog
    published: 2025-12-01
    reliability: high
  - id: src3
    title: "Writing a GDPR-Compliant Privacy Notice"
    author: GDPR.eu
    url: https://gdpr.eu/privacy-notice/
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
  - id: src4
    title: "Privacy Laws Compared: CCPA, GDPR, and LGPD"
    author: ComplianceHub
    url: https://compliancehub.wiki/privacy-laws-compared-ccpa-gdpr-and-lgpd-compliance-requirements-2025-update/
    type: technical_blog
    published: 2025-08-01
    reliability: high
  - id: src5
    title: "Privacy Laws 2026: Global Updates & Compliance Guide"
    author: Secure Privacy
    url: https://secureprivacy.ai/blog/privacy-laws-2026
    type: technical_blog
    published: 2025-12-15
    reliability: high
  - id: src6
    title: "Tracking Global Data Protection Laws in 2026"
    author: Forcepoint
    url: https://www.forcepoint.com/blog/insights/tracking-global-data-protection-laws-2026
    type: industry_report
    published: 2025-11-01
    reliability: high
  - id: src7
    title: "PIPEDA vs GDPR, CCPA, LGPD, and Other Privacy Laws"
    author: Enzuzo
    url: https://www.enzuzo.com/blog/pipeda-vs-other-privacy-laws
    type: technical_blog
    published: 2025-05-01
    reliability: high
---

# Data Privacy Compliance Decision Tree

## Purpose

This recipe determines which data privacy regulations apply to a startup based on user locations, data types collected, business model, and revenue thresholds. The output is a prioritized compliance matrix with applicable laws, key requirements per regulation, implementation tasks, and a gap analysis — enabling the startup to build privacy compliance into product architecture from day one.

## Prerequisites

- [ ] **User location data** — countries and US states where users are or will be located
- [ ] **Data inventory** — categories of personal data collected (names, emails, financial, health, biometric, location)
- [ ] **Business model clarity** — how data is used (product delivery only, advertising, data sharing/selling)
- [ ] **Revenue estimate** — determines threshold-based regulations (CCPA requires $26.6M+ or 100K+ consumers)
- [ ] **Entity formed** — completed [Startup Legal Checklist](/compliance/startup-legal/startup-legal-checklist-by-jurisdiction/2026)

## Constraints

- Privacy laws apply based on user location, not company location. A Delaware LLC with EU users must comply with GDPR. [src1]
- Multiple regulations apply simultaneously. A global SaaS company may face GDPR + CCPA + PIPEDA + LGPD + 20 US state laws. Comply with the strictest standard for overlapping requirements. [src4]
- 20 US states enforce comprehensive privacy laws by 2026, with 3 additional states effective in 2026 (Rhode Island, Indiana, Kentucky). Landscape changes annually. [src5]
- CCPA applies to for-profit businesses meeting ANY threshold: $26.6M+ revenue, 100K+ consumers processed, OR 50%+ revenue from data sales. Meeting any single threshold triggers full CCPA. [src2]
- GDPR fines reach up to 4% of global annual turnover or EUR 20M (whichever is greater). As of 2025, 2,679 fines totaling over EUR 6.7B have been issued. [src6]

## Tool Selection Decision

```
Where are your users?
├── EU/EEA residents
│   └── GDPR applies (regardless of company location)
├── UK residents
│   └── UK GDPR applies (separate from EU GDPR post-Brexit)
├── California residents + meet thresholds
│   └── CCPA/CPRA applies
├── Canadian residents
│   └── PIPEDA applies (or provincial equivalents)
├── Brazilian residents
│   └── LGPD applies
├── US residents (non-CA) + state has privacy law
│   └── Check state-specific law (20 states by 2026)
└── Children under 13 anywhere
    └── COPPA applies (in addition to above)
```

| Regulation | Applies When | Key Threshold | Max Penalty | Consent Model |
|-----------|-------------|---------------|-------------|---------------|
| GDPR (EU) | Any EU/EEA user data processing | No revenue threshold | 4% global revenue or EUR 20M | Opt-in |
| UK GDPR | Any UK user data processing | No revenue threshold | GBP 17.5M or 4% turnover | Opt-in |
| CCPA/CPRA (CA) | $26.6M revenue OR 100K+ consumers OR 50%+ data revenue | Revenue or volume | $7,988/intentional violation | Opt-out |
| PIPEDA (Canada) | Commercial activity in Canada | No revenue threshold | CAD 100K per violation | Opt-in (meaningful) |
| LGPD (Brazil) | Processing data of Brazil residents | No revenue threshold | 2% revenue, max BRL 50M | Opt-in |
| US State Laws | Processing data of state residents above thresholds | Typically 100K+ consumers | Varies by state | Mostly opt-out |

## Execution Flow

### Step 1: Map User Locations to Applicable Regulations

**Duration**: 30 minutes
**Tool**: Analytics data, market research

Identify every jurisdiction where you have or plan to have users. For each jurisdiction, determine if a privacy law applies:

**Always applies (no threshold):**
- EU/EEA users → GDPR
- UK users → UK GDPR
- Canadian users → PIPEDA
- Brazilian users → LGPD
- Children under 13 (US) → COPPA

**Threshold-based (US):**
- California: CCPA if $26.6M+ revenue OR 100K+ CA consumers OR 50%+ data revenue
- 19 other states with comprehensive privacy laws (2026): most apply at 100K+ consumers or 25K+ with 50%+ data revenue
- States effective 2025: CA, VA, CO, CT, UT, MT, OR, TX, DE, IA, NE, NH, NJ, TN, MN, MD, IN
- States effective 2026: RI (Jan), KY (Jan), IN (Jan)

**Verify**: All user jurisdictions mapped. Applicable regulations identified with threshold analysis.
**If failed**: When unsure about user locations, assume broadest applicability. Use analytics geo data.

### Step 2: Assess Data Types and Processing Activities

**Duration**: 30-60 minutes
**Tool**: Data inventory spreadsheet

For each applicable regulation, determine if special categories of data trigger enhanced requirements:

**GDPR special categories** (Article 9 — require explicit consent):
- Health data, biometric data, genetic data
- Racial/ethnic origin, political opinions, religious beliefs
- Trade union membership, sexual orientation
- Criminal convictions data

**CCPA sensitive personal information** (require right to limit):
- SSN, driver's license, passport numbers
- Financial account details (with credentials)
- Precise geolocation
- Racial/ethnic origin, religious beliefs
- Biometric data, health data, sexual orientation
- Mail/email/text contents (private communications)

**Cross-regulation data handling:**
- Health data → HIPAA (US) + GDPR Art. 9 (EU) + state health privacy laws
- Financial data → GLBA (US) + PCI DSS + applicable privacy laws
- Children's data → COPPA (US) + GDPR Art. 8 (EU, under 16/13-16 varies by member state)

**Verify**: All data categories mapped to applicable enhanced requirements. No special categories missed.
**If failed**: Audit every data collection point in the product. Include third-party SDKs and analytics.

### Step 3: Determine Consent and Legal Basis Requirements

**Duration**: 30 minutes
**Tool**: Decision matrix

Each regulation has different consent models:

**GDPR (opt-in):**
- Legal bases: consent, contract, legitimate interest, legal obligation, vital interest, public task
- Consent must be freely given, specific, informed, unambiguous, and easily withdrawable
- Cookie consent required before any non-essential cookies/tracking
- Children under 16 (or 13-16 per member state): parental consent required

**CCPA/CPRA (opt-out):**
- No consent needed to collect; must honor opt-out requests
- "Do Not Sell or Share My Personal Information" link required
- Global Privacy Control (GPC) must be honored as valid opt-out
- Right to limit use of sensitive personal information

**PIPEDA (meaningful consent):**
- Consent appropriate to sensitivity of data
- Express consent for sensitive data; implied consent for less sensitive
- Must be able to withdraw consent

**Implementation priority:**
1. If GDPR applies → build opt-in consent by default (satisfies most other laws too)
2. If CCPA only → build opt-out mechanism with "Do Not Sell" link
3. If multiple → use opt-in (strictest standard covers all)

**Verify**: Consent mechanism identified for each applicable law. Legal basis documented per processing activity.
**If failed**: Default to opt-in consent (strictest standard). Engage privacy counsel for legitimate interest assessments.

### Step 4: Map Required Rights and Mechanisms

**Duration**: 30-60 minutes
**Tool**: Compliance checklist

Build a matrix of data subject rights required by each applicable law:

| Right | GDPR | CCPA | PIPEDA | LGPD |
|-------|------|------|--------|------|
| Access/Know | Yes | Yes | Yes | Yes |
| Deletion | Yes | Yes | Yes | Yes |
| Correction/Rectification | Yes | Yes | Yes | Yes |
| Portability | Yes | Yes | No | Yes |
| Opt-out of sale | N/A | Yes | N/A | N/A |
| Restrict processing | Yes | Yes (limit) | Withdraw consent | Yes |
| Object to processing | Yes | N/A | Withdraw consent | Yes |
| Non-discrimination | Yes | Yes | N/A | Yes |
| Appeal | N/A | Yes (some states) | Complaint to OPC | Yes |

Implementation requirements:
- Verifiable request mechanism (web form, email, or toll-free number)
- Response timeline: GDPR 30 days, CCPA 45 days, PIPEDA 30 days
- Identity verification before fulfilling requests
- Record-keeping of all requests and responses

**Verify**: All required rights identified. Response timelines documented. Implementation plan for each mechanism.
**If failed**: Prioritize access and deletion rights first (universal across all laws).

### Step 5: Build Compliance Implementation Roadmap

**Duration**: 30-60 minutes
**Tool**: Project planning tool or spreadsheet

Prioritize compliance tasks by deadline and risk:

**Week 1-2 (Critical):**
- Draft/update privacy policy covering all applicable jurisdictions
- Implement cookie consent mechanism (if GDPR applies)
- Add "Do Not Sell" link (if CCPA applies)
- Set up data subject request intake process

**Week 3-4 (High):**
- Complete data processing records (GDPR Article 30)
- Implement data subject rights fulfillment workflow
- Review and update vendor/processor agreements (DPAs)
- Appoint DPO if required (GDPR: public authority or large-scale monitoring)

**Month 2-3 (Medium):**
- Conduct Data Protection Impact Assessment (DPIA) for high-risk processing
- Implement data retention and deletion policies
- Set up breach notification procedures
- Train team on privacy obligations

**Ongoing:**
- Monitor regulatory changes (subscribe to IAPP, state AG updates)
- Annual privacy impact assessments
- Vendor compliance audits

**Verify**: Roadmap complete with owners, deadlines, and dependencies. Critical items scheduled for immediate action.
**If failed**: Start with privacy policy and consent mechanism — these are visible to regulators and users immediately.

## Output Schema

```json
{
  "output_type": "privacy_compliance_matrix",
  "format": "structured_document",
  "fields": [
    {"name": "regulation", "type": "string", "description": "Name of privacy law", "required": true},
    {"name": "applies", "type": "boolean", "description": "Whether this regulation applies", "required": true},
    {"name": "trigger_reason", "type": "string", "description": "Why it applies (user location, threshold)", "required": true},
    {"name": "consent_model", "type": "string", "description": "opt-in|opt-out|meaningful", "required": true},
    {"name": "key_requirements", "type": "array", "description": "Top requirements for this regulation", "required": true},
    {"name": "deadline", "type": "string", "description": "Compliance deadline", "required": false},
    {"name": "max_penalty", "type": "string", "description": "Maximum penalty amount", "required": true},
    {"name": "implementation_tasks", "type": "array", "description": "Specific tasks to achieve compliance", "required": true}
  ]
}
```

## Quality Benchmarks

| Quality Metric | Minimum Acceptable | Good | Excellent |
|---------------|-------------------|------|-----------|
| Regulation coverage | All major laws identified | State-level laws included | Attorney-validated |
| Data inventory completeness | Core data types mapped | All collection points | Third-party SDKs included |
| Rights mechanism coverage | Access + deletion | All applicable rights | Automated fulfillment |
| Consent implementation | Basic consent banner | Jurisdiction-specific | Preference center |

**If below minimum**: Engage privacy counsel. Use compliance platform (OneTrust, Termly) for automated jurisdiction detection.

## Error Handling

| Error | Likely Cause | Recovery Action |
|-------|-------------|----------------|
| Missed jurisdiction | Users from unexpected region | Add regulation to matrix, implement within 30 days |
| Incorrect threshold assessment | Revenue or user count changed | Reassess quarterly, implement before threshold is reached |
| Data subject request timeout | No process in place | Set up intake immediately, respond within legal deadline |
| Cookie consent not capturing consent | Technical implementation error | Audit consent mechanism, ensure no cookies fire before consent |
| Vendor processing data without DPA | Oversight in vendor management | Execute DPA immediately, audit vendor data practices |

## Cost Breakdown

| Component | DIY | Privacy Tool | Full Legal |
|-----------|-----|-------------|-----------|
| Regulation mapping | $0 (this card) | $0 | $3K-$10K |
| Privacy policy | $10-$50/mo (generator) | $10-$50/mo | $2K-$5K |
| Consent management | $0-$12/mo | $50-$200/mo | Custom ($5K+) |
| Rights fulfillment | Manual ($0) | $100-$500/mo | $5K-$20K |
| DPO (if required) | N/A | N/A | $60K-$120K/yr or outsourced $5K-$15K/yr |
| **Total Year 1** | **$120-$600** | **$2K-$10K** | **$15K-$80K+** |

## Anti-Patterns

### Wrong: Assuming GDPR doesn't apply because you're a US company
GDPR applies to any organization processing data of EU/EEA residents, regardless of where the company is located. A US startup with EU website visitors is subject to GDPR. [src1]

### Correct: Map regulations by user location, not company location
Run analytics to identify user jurisdictions. If you have or plan to have EU users, build GDPR compliance from the start.

### Wrong: Using a single privacy policy template for all jurisdictions
A GDPR privacy policy has different requirements than CCPA. Combining them without addressing jurisdiction-specific disclosures creates compliance gaps for both. [src3]

### Correct: Create a unified policy with jurisdiction-specific sections
Build one comprehensive privacy policy that addresses shared requirements globally, with clearly labeled sections for GDPR-specific rights (EU users), CCPA-specific rights (California users), and other jurisdiction-specific provisions.

## When This Matters

Use this recipe after entity formation and before launching any product that collects personal data. Privacy compliance must be built into product architecture — retrofitting is 5-10x more expensive. Every web form, analytics integration, cookie, and third-party SDK must be evaluated against applicable privacy laws.

## Related Units

- [Startup Legal Checklist by Jurisdiction](/compliance/startup-legal/startup-legal-checklist-by-jurisdiction/2026)
- [Industry-Specific Regulatory Map](/compliance/startup-legal/industry-specific-regulatory-map/2026)
- [Terms of Service & Privacy Policy Requirements](/compliance/startup-legal/terms-of-service-privacy-policy-requirements/2026)