Regional Privacy Addenda

Start with the Privacy Policy, then read only the section for your region. Each section states the controller identity, notice items, consent rule, rights with timelines, breach rule, transfer rule, children rule and complaint path for that region, with source_id, effective date and last_verified_at 2026-10-02. Unverified points are marked UNVERIFIED — LEGAL REVIEW REQUIRED.

Controller + DPO (once appointed) + Art.13/14 items; Art.6 bases + Art.7 proof; Arts.15-22 rights (one month); Art.33 72-hour authority + Art.34 high-risk individual notice; Art.5(1)(e) minimisation; Art.44-50 transfers (adequacy or 2021/914 SCCs + TIA); Art.8 child age 16 (member states 13-16); Art.22 ADM; EAA from 28 Jun 2025; AI Act Art.50 transparency from 2 Aug 2026 (grace to 2 Dec 2026 for pre-existing generative marking).

Same as EU adapted to UK GDPR/PECR regs.6/22; ICO 72-hour rule; DUAA staged commencement — do not rely on new bases until commenced; Children's Code if likely accessed by children; DMCC Act 2024 subscription rules before paid launch.

See /legal/california-notice and /legal/your-privacy-choices. FTC §5 substantiation for every claim; CAN-SPAM header/subject/address/10-day opt-out; COPPA verifiable parental consent if child-directed (blocking decision). Other US states (CO/CT/VA/TX etc.) not yet modelled — add via registerJurisdiction before marketing there; GPC already covers the common opt-out.

Canada: PIPEDA meaningful consent + 30-day access + real-risk-of-significant-harm breach report to OPC + individuals; CASL CEM consent + 10-day unsubscribe; Quebec Law 25 portability phased. Brazil: LGPD Art.18 rights + 15-day confirmation/access + 3-business-day ANPD breach (confirm). Australia: APP 5 notice + APP 12/13 access/correction + eligible-breach ASAP notification + Spam Act. Japan: APPI purpose notice + disclosure/correction/suspension + PPC + individual breach notice. Singapore: PDPA ss.20-22 + DNC + 3-calendar-day PDPC breach notice + portability.

China: PIPL Arts.44-50 rights + separate consents (sensitive/sharing/cross-border) + CAC transfer assessment/certification/contract; generative-AI/algorithm filing LEGAL REVIEW REQUIRED. India: DPDP ss.5-6 notice/consent + ss.11-15 rights + 90-day response + Board + Data Principal plain-language breach notice + 72-hour Board update + 7-year consent records + 18-month phased Rules (Board immediate, Consent Managers 13 Nov 2026, fiduciary/rights/transfer 13 May 2027) + CERT-In 6-hour/180-day duties (confirm). UAE: DL 45/2021 + DIFC/ADGM variants. South Africa: POPIA ss.11-25 + s.69 marketing opt-in + ASAP regulator + subject notice. Nigeria: NDPA rights + 72-hour NDPC notice (confirm directive).

NZ: IPPs 1-13 (incl. 3A from 1 May 2026) + 20-working-day access + ss.114-115 breach. KR: PIPA Arts.15/17/23 consents + Arts.35-37 rights + prompt breach (expanded forgery/alteration/damage from 11 Sep 2026) + EU adequacy 3 Sep 2025 + LIA for location. TH: PDPA ss.19/23/26 consents + ss.30-36 rights + 2026 DSAR procedure from 14 Sep 2026 + s.37(4) 72-hour PDPC + high-risk subject notice + s.28 transfers. ID: UU PDP Arts.5-13/20/23-25 + 3x24-hour breach + Art.62 transfers + Art.34 DPIA (authority gap noted). MY: Act 709 + 2024 amendments (DPO/portability/biometric) + s.12B breach (72h Commissioner / 7-day subjects per 2025 guideline) + s.129 transfers + TIA.

PH: RA 10173 ss.12-13/16-18/21 + Circular 16-03 72-hour NPC + subject notice + outsourcing clauses + registration. IL: PPL ss.13-14 + Security Regs s.11 severe-incident prompt PPA notice (PPA may order subject notice; first failure-to-report fine 21 Jul 2026) + Transfer Regs adequacy + Amendment-13 enforcement + EEA-data duties. MX: LFPDPPP 2025 Arts.22-26 ARCO (20+15 working days, free first request/12m, bloqueo for cancelación) + tiered consents + Arts.36-37 transfers + Art.19/Reg.63 immediate subject breach notice (no fixed deadline) + Art.30 department + automated-decision objection. AR: Ley 25.326 Arts.5-6/9-12 duties + Arts.13-16/19-20 rights + Art.21 registration + Art.12 transfer adequacy/consent; reform bill pending (FUTURE).

Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01, LEGAL REVIEW REQUIRED. Where this page and the Privacy Policy disagree for your region, this page prevails for you.