GDPR, PDPL, POPIA, DPDP: One Platform, Four Rulebooks

One product, many privacy laws

If your platform has users in Europe, the Gulf, Africa, India and South East Asia, you already answer to at least five privacy regimes. GDPR, the UAE and Saudi PDPLs, South Africa's POPIA, India's DPDP Act and laws like Singapore's PDPA all apply to the same database.

Most founders react in one of two ways. Some ignore it until an enterprise customer's security questionnaire or a regulator's letter arrives. Others build a separate stack per country and pay for it every month.

In 26+ years of building platforms across these markets, I've found a better path. The laws share most of their core. Build that core once, then add a thin, region-aware layer for the parts that differ.

This post covers what the laws agree on, where they differ, and the architecture that lets one platform meet all of them.

This is a technology and architecture guide, not legal advice. Confirm your obligations with a qualified lawyer in each market.

The four rulebooks at a glance

Every law below is in force or has a fixed start date, and fines now run to millions of dollars.

Market	Law	Status (Oct 2026)	Regulator	Maximum penalty	Breach report to regulator
Europe (EU and UK)	GDPR and UK GDPR	In force since May 2018	National data protection authorities (ICO in the UK)	€20 million or 4% of global turnover, whichever is higher	Within 72 hours
UAE	PDPL (Federal Decree-Law 45 of 2021)	In force since Jan 2022; executive regulations still pending	UAE Data Office	AED 50,000 to 5 million per violation (about $1.4 million at the top)	Required; detailed timing awaits the regulations
Saudi Arabia	PDPL	Fully enforceable since 14 Sep 2024; 48 enforcement decisions by Jan 2026	SDAIA	SAR 5 million (about $1.3 million), doubled for repeat violations	Within 72 hours
South Africa	POPIA	Fully in force since July 2021	Information Regulator	R10 million (about $610,000) and up to 10 years in prison	As soon as reasonably possible, through the Regulator's eServices portal
India	DPDP Act 2023 and DPDP Rules 2025	Rules notified 13 Nov 2025; core duties apply from 13 May 2027	Data Protection Board of India	Up to ₹250 crore (about $26 million) per breach of duty	Without delay, then a detailed report within 72 hours

In the UAE, the DIFC and ADGM free zones run their own data protection laws, so check where your entity is registered. In wider Africa, Nigeria's NDPA and Kenya's Data Protection Act follow a similar GDPR-style model.

USD figures use October 2026 exchange rates and are rounded.

What they all agree on: build it once

Most of what these laws ask for is the same. Build these once, for every user, and you are most of the way there in every market.

• Know your data. A record of what personal data you hold, where it lives, why you hold it and who can see it.
• A clear purpose and a lawful reason for each use, shown in a plain-language privacy notice.
• Consent that is specific, recorded and as easy to withdraw as to give.
• User rights on request: access, correction and deletion of their data, with a deadline you can track.
• Collect only what you need, and delete it when the purpose ends.
• Reasonable security: encryption, access control, audit logs and tested backups.
• A breach plan: detect, assess and report within days, not weeks.
• Contracts with every vendor that touches personal data, from your cloud provider to your SMS gateway.
• Extra care for sensitive data such as health, financial, biometric and children's data.

If your platform already does this well for GDPR, adding the other markets is mostly configuration. If it doesn't, no single market's checklist will save you.

Where they differ: the parts to make configurable

The differences sit in a handful of places. These are the rules your platform should read from a per-region setting, not hard-code.

Rule	Europe (GDPR)	Middle East (UAE, Saudi PDPL)	Africa (POPIA)	India (DPDP)
Lawful basis	Six bases, including legitimate interests	Consent by default; other bases are narrower	Several bases, including legitimate interests	Consent, or a short list of "legitimate uses"; no general legitimate-interest basis
Data leaving the country	Adequacy decisions or standard contractual clauses	Saudi: adequacy, safeguards and a transfer risk assessment	Allowed to countries with adequate protection, or with consent or a contract	Allowed, except to countries the government restricts; some data may be kept in India for large platforms
Who you must appoint	A DPO for large-scale monitoring or sensitive data; an EU representative if you have no EU office	Saudi: a DPO for large-scale monitoring or sensitive data	An Information Officer registered with the Regulator, for every organisation	A DPO in India for Significant Data Fiduciaries
Children	Parental consent under 13 to 16, depending on the country	Guardian consent for minors	Competent-person consent for under-18s	Verifiable parental consent for under-18s
Keeping data	As long as the purpose needs	As long as the purpose needs	As long as the purpose needs	Large e-commerce, social and gaming platforms delete after 3 years of inactivity, with notice; some logs kept at least 1 year

Two differences catch founders most often. India's DPDP has no general "legitimate interest" basis, so marketing and analytics usually need consent. And Saudi Arabia's transfer rules make your cloud region a compliance decision, not just a latency one.

South East Asia: the fifth rulebook, in six languages

South East Asia has no single regional law. Each country has its own, and several tightened their rules in 2025 and 2026.

Country	Law	Status (Oct 2026)	Breach report to regulator	What to watch
Singapore	PDPA	In force; higher fines since Oct 2022	Within 3 calendar days if over 500 people or significant harm	Fines up to 10% of Singapore turnover for firms above S$10 million
Indonesia	PDP Law 27 of 2022, with Regulation 33 of 2026	Implementing regulation takes effect 16 Jan 2027	Within 3 × 24 hours, to the agency and affected people	Fines up to 2% of annual revenue; strict order of transfer conditions
Vietnam	Personal Data Protection Law	In force since 1 Jan 2026	72 hours under the current decree	Cross-border violations fined up to 5% of prior-year revenue; transfer impact assessments; a 5-year grace period for small firms and startups
Malaysia	PDPA, amended 2024	Main changes in force since 1 Jun 2025	Within 72 hours; affected people within 7 days	DPO must live in Malaysia; new data portability right
Thailand	PDPA	In force since Jun 2022; fines issued since 2024	Within 72 hours for high-risk breaches	Active enforcement, with multi-million-baht fines in 2025
Philippines	Data Privacy Act 2012	In force	Within 72 hours	Registration with the National Privacy Commission for larger processors

For most platforms, the practical answer is a Singapore cloud region as the regional hub. Then check Vietnam and Indonesia separately, because both now have their own transfer rules and revenue-based fines.

The architecture: one platform, a region-aware privacy layer

The design that works is one codebase with a shared privacy core, a small table of region settings, and data stored in the right region.

The router reads each user's region and sends their data to that region's store. The privacy core works the same everywhere, and it reads its rules from the region settings.

1. Tag every user and tenant with a region at sign-up, and never guess it later from an IP address.
2. Keep the privacy core in one place: consent records, rights requests, the data map, retention jobs and audit logs.
3. Put the differences in configuration: lawful basis per purpose, transfer rules, breach deadline, retention period and required officers.
4. Store personal data in-region for markets that expect it, and keep sensitive data (KYC, payments, health) in a separate encrypted vault.
5. Keep analytics and logs free of raw personal data, so they can live in one central region.
6. Set the breach clock to the shortest deadline you face, 3 days for Singapore and 72 hours for most others, so one runbook fits all.

This builds directly on a service-ready modular monolith: the privacy core is one module, and a region is a deployment setting, not a fork of the code.

In practice: privacy decisions on real platforms

On the platforms I've architected, the privacy layer was shaped by the market and the kind of data, not by a template.

Platform	Main market and law	Sensitive data	Design choice that mattered
iGaming talent marketplace with escrow payments	Africa first (POPIA), with global freelancers	Identity (KYC) documents and payment details	KYC files kept in a separate encrypted store with tight access, apart from the profile and job data the rest of the product uses
Creative services marketplace	Europe (GDPR)	Contact details, portfolios and client briefs	Consent and data-export tools built in from launch, so access and deletion requests are handled in the product, not by email
Community matrimony platform	India (DPDP)	Family, community and personal details in a conservative community	Profile visibility controlled by the member, with shared profiles opening only what the member chose to show
EV charging management SaaS	India, white-labelled for operators	Driver accounts, vehicle and payment data	Each operator's data separated by tenant, so one brand's admins never see another's drivers

The pattern: decide early which data is sensitive, keep it apart, and give users control in the product itself. Those three choices make every new market cheaper to enter.

What it costs to get right

Built in from the start, a region-aware privacy layer is a few weeks of work. Retrofitted after launch, it usually costs several times more, because data is already mixed across tables, logs and backups.

Item	Typical range for an early-stage platform (USD)	Notes
Privacy layer built into the MVP	2 to 4 extra weeks of engineering	Consent records, rights requests, data map, region setting
An extra cloud region	$300 to $1,500 per month	Depends on traffic and how much of the stack each region runs
Consent and cookie tooling	$0 to $500 per month	Open-source or a managed platform
Outsourced DPO or local representative	$500 to $2,500 per month, per market	Only where the law or your customers require one
Penetration test and security review	$3,000 to $15,000 per year	Often asked for by enterprise customers anyway

These are indicative ranges from my own projects, not quotes. Compare them with the penalties in the first table: a single fine can exceed years of this spend.

One platform, five markets: a checklist

• A data map: every personal field, where it is stored, why, and who can see it.
• A region setting on every user and tenant, decided at sign-up.
• Data stored in the right cloud region for markets that expect it (EU, Saudi Arabia, India for large platforms, Singapore as the SEA hub).
• Consent recorded per purpose, with time, version and region, and easy to withdraw.
• Access, correction, deletion and export requests handled in the product, with deadlines tracked.
• Sensitive data (KYC, payments, health, children's data) kept in a separate, encrypted store.
• A breach runbook with the shortest deadline as the default: 3 days for Singapore, 72 hours for most others.
• Retention rules per region, including India's inactivity deletion for large platforms.
• Vendor contracts and transfer safeguards for every service that touches personal data.
• Named owners: DPO, Information Officer or local representative, where each market requires one.
• A legal review in each market before launch.

Sources

• GDPR Article 33: breach notification
• UAE PDPL overview (ConsentStack)
• Enforcement of the Saudi PDPL is live (Clyde & Co, Mar 2026)
• Saudi Arabia's PDPL in force (DLA Piper)
• POPIA compliance requirements (GDPR Local)
• South Africa mandatory e-portal breach reporting (Covington)
• India's DPDP Act brought into force (Hogan Lovells)
• Singapore 10% turnover penalty (Reed Smith)
• Indonesia Regulation 33 of 2026 (RSM)
• Vietnam Personal Data Protection Law (Tilleke & Gibbins)
• Malaysia PDPA changes from June 2025 (ASEAN Briefing)
• Thailand PDPA enforcement timeline (Mondaq)