Fundamentals

Data Protection Laws: What They Regulate and How to Identify the Applicable Rules

By Daniel Sardá · Published on October 22, 2026

8 min read1,542 words

Data protection is not only about keeping information secure: it sets limits, responsibilities, and rights governing how information is collected and used.

Giving an email address to receive an invoice or using a ride-hailing app are ordinary acts. In each case, someone collects information connected to an individual. Data protection laws establish when that information may be processed, for what purposes, and subject to which safeguards.

There is no single worldwide law, however. National and regional rules coexist with international instruments of varying legal force. A general explanation can therefore help identify the common architecture of these regimes, but it cannot replace consulting the applicable law and authority in a particular case.

What personal data are, and what it means to process them

Personal data are information relating to an identified or identifiable natural person. A name may identify someone directly; a license plate number, IP address, or combination of details may do so indirectly. Context matters: several pieces of data put together can identify a person even when none does so on its own.

Processing covers much more than selling data or analyzing it with algorithms. Collecting, organizing, consulting, disclosing, storing, and erasing it are also processing operations. These definitions appear, in their own terms, in rules such as the European Union’s General Data Protection Regulation (GDPR) and in national legislation.

The individual to whom information relates is often called the data subject. The person or organization that determines why and how processing will take place in its essential respects is the controller. The party that processes data on the controller’s behalf and under its instructions is the processor.

Consider a retailer that collects its customers’ addresses and contracts with a cloud-hosting service. The retailer does not stop being the controller by outsourcing its infrastructure; the provider may act as a processor. Each party’s actual function—not merely the label in the contract—determines its role.

Key idea: Data protection law is not concerned only with breaches. It governs the entire data lifecycle, from collection to deletion.

Privacy, data protection, and security are not the same thing

The three concepts are related, but they serve distinct functions.

Privacy is the broader sphere of personal autonomy and private life. Data protection turns part of that concern into rules for information connected to people: principles, legal bases, rights, and responsibilities. Information security comprises measures intended to prevent unauthorized access, loss, or alteration.

A database may be encrypted and well protected from intruders, yet have been created for an illegitimate purpose or with excessive information. Conversely, there may be a permitted purpose alongside inadequate security. In the first case, lawfulness or proportionality fails; in the second, safeguards fail. Security is indispensable, but it is not enough to meet all legal requirements.

The same is true of pseudonymization. Replacing names with codes reduces risks, but does not necessarily make records anonymous. If it remains reasonably possible to link them back to a person, they are still personal data.

Principles that govern processing

Although legal wording varies, many systems share a recognizable set of principles. The OECD Privacy Guidelines provide a comparative framework; the GDPR and various national laws turn several of those principles into enforceable obligations within their respective scopes.

In general, processing should:

• have a recognized legal basis and be carried out fairly and transparently;
• serve specified purposes, without incompatible further use;
• collect data that are adequate and not excessive for those purposes;
• seek to ensure that information is accurate and kept up to date where appropriate;
• retain it only for the period justified;
• apply security measures appropriate to the risk; and
• allow the controller to demonstrate how it meets its duties.

These principles help assess particular decisions. If a public body collects data to administer a registry and later seeks to reuse them for another purpose, the fact that it already holds them is not enough. It must ask whether the new purpose is legally authorized, compatible with the original one, and subject to the necessary safeguards.

Consent is one legal basis, not the only one

A common mistake is to reduce data protection to checking or unchecking a box. Consent may be a legal basis, but many laws recognize others: performing a contract, complying with a legal obligation, protecting vital interests, or carrying out tasks in the public interest, among other possibilities.

Nor does every acceptance amount to valid consent. The freedom to decide, the information received, and a real ability to refuse may matter under the applicable regime. Fatigue from endless notices shows why more clicks do not necessarily mean more autonomy. Data minimization, understandable transparency, accountability by the decision-maker, and effective avenues for complaint also matter.

Key idea: Asking “was there consent?” does not by itself settle lawfulness. First identify which legal bases the applicable rules permit and what conditions they impose.

What rights the individual may have

Laws commonly provide mechanisms that let people learn about and challenge what happens to their information. The exact content, exceptions, and time limits differ across jurisdictions, but rights may include:

• receiving information about processing;
• accessing data and obtaining a copy;
• correcting inaccurate information;
• requesting erasure or deletion in specified circumstances;
• objecting to certain uses or asking for processing to be restricted;
• receiving data in a portable format under particular conditions; and
• challenging or requesting review of certain automated decisions.

These rights do not exist in the same form in every country, and they are not absolute. A request for erasure, for example, may be limited where a law requires records to be retained. The distinction between control and ownership remains important when considering a person’s relationship to personal data.

What controllers and processors must do

Data protection law usually places on the controller the duty to justify processing and organize compliance. This may require clear notices, documentation of decisions, responses to requests, oversight of providers, security measures, and incident response. The intensity of each duty depends on risk, scale, the type of data, and the applicable law.

A processor is not free of responsibility. It must act within the lawful instructions it receives and comply with the duties assigned by the relevant regime. In turn, a controller cannot transfer all of its accountability through a contract. Designing that relationship well helps ensure that responsibility follows effective decision-making.

The sector may also change the legal framework. Mexico, for example, has a federal law for private parties and a general law for obligated subjects. The distinction illustrates a broader point: before assuming which duties or remedies exist, determine whether the data are held by a business, a civil-society organization, or a public entity.

Authorities, complaints, and legitimate limits

Depending on the country, specialized authorities, courts, or other administrative bodies may be involved. Their powers and independence should be checked against current legislation and official sources.

Data protection does not operate in a vacuum. It can come into tension with freedom of expression, access to public information, research, security, innovation, or contract performance. Resolving those tensions requires clear rules, defined exceptions, and proportional, reviewable decisions—not an automatic assertion that one interest always prevails.

From a liberal perspective, the valuable purpose of this field is to constrain arbitrary uses of information by both businesses and public authorities without preventing legitimate uses. To do so, obligations should be predictable and proportionate to the risk. An opaque or excessively rigid regime can raise barriers to entry and favor those able to absorb high compliance costs. A weak regime, by contrast, leaves people exposed to organizations with far greater information and decision-making power.

Key idea: Protecting autonomy requires limits on informational power, but also general, reviewable rules that do not turn every use of data into a prohibition.

How to identify the applicable data protection law

The country where a server is located rarely resolves the question by itself. As an initial map—not as legal advice—it helps to ask five questions:

1. Who processes the data? Identify the organization that decides the purpose, its providers, and whether it belongs to the public or private sector.
2. Where does it operate? Review its place of establishment and relevant activities, not only the technical location of its infrastructure.
3. Whom does it affect? The residence or location of the individuals may trigger certain rules; citizenship alone is not always the criterion.
4. What activity does it carry out? The sector, type of data, purpose, and practices such as offering goods or monitoring behavior may alter the analysis.
5. Which date matters? Check the law’s version currently in force and its transitional provisions.

The date deserves particular attention. In Chile, for example, Law No. 19,628 remains in force as of October 22, 2026, while the comprehensive reform in Law No. 21,719 takes effect later, on December 1, 2026. Reading a future law without checking its effective date can lead one to present rights, duties, or institutions that are not yet in force as if they were current.

The final step is to consult the consolidated text of the law, the competent official authority, and—if the matter may have significant consequences—legal advice in the relevant jurisdiction. The shared architecture makes it possible to ask better questions; the enforceable answer always depends on the law in force and the facts.