| name | conflicting-laws-mgmt |
| title | Managing Conflicting Privacy Requirements |
| description | Guides managing conflicting privacy requirements across jurisdictions. Covers data localisation vs transfer freedom, consent standards variation, age thresholds, breach timelines, and resolution frameworks for incompatible obligations. Keywords: conflicting laws, data localisation, consent variation, age thresholds, resolution framework. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/conflicting-laws-mgmt |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | cross-jurisdiction |
| practice | data-protection |
| language | en |
Managing Conflicting Privacy Requirements
Overview
Organisations operating across multiple jurisdictions inevitably encounter situations where privacy requirements in different countries conflict, are incompatible, or create compliance tensions. These conflicts arise because privacy laws reflect different legal traditions, cultural values, and policy priorities. A structured resolution framework enables organisations to navigate these conflicts while maintaining defensible compliance positions in all jurisdictions.
Categories of Conflict
Category 1: Data Localisation vs Transfer Freedom
| Conflict | Detail |
|---|
| Localisation requirement | China PIPL Art. 40 requires CIIOs to store personal information within the PRC; India RBI circular requires payment data stored in India |
| Transfer freedom | EU GDPR Art. 44-49 permits transfers with appropriate safeguards; Singapore PDPA Section 26 permits transfers with comparable protection |
| Resolution challenge | An organisation may need to store data locally while also making it available to a global headquarters |
Resolution Framework for Zenith Global Enterprises:
| Scenario | Approach |
|---|
| China CIIO data + EU HQ access | Store primary data in PRC; transfer processed copies via CAC-approved mechanism; maintain PRC as system of record |
| India payment data + Global Treasury | Store payment system data in India (RBI compliance); process copies transferred to Treasury with contractual safeguards |
| Cross-jurisdiction analytics | Implement federated analytics: run queries locally, aggregate results centrally; avoid moving raw personal data |
Category 2: Consent Standards Variation
| Jurisdiction | Consent Standard |
|---|
| EU (GDPR) | Freely given, specific, informed, unambiguous; not required if other lawful basis applies |
| China (PIPL) | Default basis; separate consent (单独同意) for five scenarios |
| Korea (PIPA) | Prescriptive display requirements (font size, colour); separate consent for marketing |
| Brazil (LGPD) | Standalone consent clause separate from contract terms; 10 alternative bases |
|
