India's data protection rules were notified twelve days ago, and they are one of four regimes a single system may have to sit inside at once. This is an engineering read of what those regimes cost to build against rather than legal advice. Where residency and erasure pull against each other on the same design decision, and why "apply the strictest standard everywhere" is advice that cannot be turned into an architecture.
26 November 2025·8 min read·regulation
Before any of this: I am not a lawyer, none of what follows is legal advice, and I have left every penalty and enforcement figure out of it, because I did not verify them and this is a subject where being casually wrong is worse than saying nothing. What I can describe is what these regimes cost to build against, which is an engineering question, and which is the part that reaches a technical team long after the interpretation was settled somewhere else.
The framing that causes the damage is that these are four dialects of one idea, differing mainly in severity, so a system built for the toughest one is safe everywhere. That framing survives because it is true of the parts people notice first. All four want notice. All four want some account of purpose. All four have something to say about children, and about breaches, and about what a company may do with data it collected for one reason and would like to use for another.
It stops being true at the layer where systems get built. The European regulation starts from the position that processing personal data is prohibited unless you can name a lawful basis, and attaches individual rights that follow the person rather than the record. The Chinese regime starts from the position that data leaving the country is the event that matters, and organizes much of its machinery around that crossing. Those are not two severities. They are different questions, and a design that answers one well can be structurally worse at the other.
The EU asks what your basis is, before anything happens. The General Data Protection Regulation, applicable since 25 May 2018, is a rights instrument. Processing needs a lawful basis identified in advance, and consent is only one of six, which is the thing most often gotten wrong in the direction of asking for consent you do not need and cannot rely on. Then come rights that attach to the person: access, rectification, erasure, portability, objection. The architectural consequence is that a record has to be findable by data subject rather than only by application key, which is a design property, not a policy.
The US has no baseline, and that is the structural fact. There is no general federal privacy statute. What exists is sectoral law for particular kinds of data, the Federal Trade Commission acting on unfair or deceptive practices, and a growing set of state statutes. California is the anchor: the CCPA was signed on 28 June 2018 and took effect on 1 January 2020, and the CPRA that voters approved in November 2020 amended it and created a dedicated state agency. Other states followed with their own definitions and their own thresholds, and the count changes every legislative session.
India built the machinery around consent, and turned it on this month. The Digital Personal Data Protection Act received assent on 11 August 2023 and then waited two years for the rules that make it operable. Those rules were notified on 14 November 2025, twelve days before I am writing this, with obligations phased in over the following year and a half rather than landing at once. The framework is consent-centric, with notice requirements, a defined fiduciary role, its own grievance machinery and a board to run it. Anyone claiming settled operational experience of it is claiming something impossible.
China makes the border the load-bearing constraint. The Personal Information Protection Law took effect on 1 November 2021, and its distinctive feature is not the domestic obligations, which will look familiar. It is that moving personal information out of the country is a regulated act with named routes through it: a regulator-run security assessment, a state-form standard contract, or certification, with separate consent from the individual for the transfer itself. Sitting underneath, localization obligations from the cybersecurity regime require certain operators and categories of data to stay inside the country entirely.
"Apply the strictest standard everywhere" is appealing because it converts a four-way problem into a one-way problem, and for a certain class of requirement it genuinely works. Retention is the clean case: keep everything for the shortest period any regime allows and you are inside all of them, at the cost of data you might have wanted. Notice is similar. These are requirements that live on one axis, where more is monotonically safer.
Most of them do not live on one axis. Take the simplest instance. One regime wants a category of data to remain physically inside its borders. Another gives an individual a right to erasure and expects you to honor it wherever the data is. The first pushes you toward a copy that never leaves and is operated by people constrained in what they may do with it. The second requires you to reach that copy and remove a row on request. Neither is stricter. They pull in different directions on the same design decision.
Here is the compressed version, and it is the sentence I would want a leader to take away. Strictness is only a coherent idea within one axis, and these regimes do not share axes, so "the strictest" is not a thing that exists to be selected.
Where data lives is a schema decision before it is a deployment decision. Everyone frames residency as "which region do we deploy in", which is the easy half. The hard half is whether your data model can even express the question. If the region a record belongs to is derivable from the record, you have options. If it is implied by which cluster the row happens to be in, you have a migration every time the answer changes, and you will discover this the first time a customer moves or an acquisition arrives with the same user in two places.
Logs, analytics and error reports are a second copy in a different jurisdiction. This is the one I would go and check first in any system I had not looked at before. The primary datastore is usually where the residency conversation happened. Meanwhile the observability stack, the error aggregator, the product analytics and the support tooling each hold a partial copy, frequently in a region chosen by whoever set up the vendor account, frequently containing identifiers and sometimes free text. A stack trace with a user's email in it is personal data in an American SaaS product, and it got there through a mechanism nobody designed.
In a database, deletion is easy. You have a row, you have a key, the row goes away. Everything that makes deletion hard is outside the database, and all of it is machinery you added on purpose. The read replica that has not caught up. The cache with no invalidation path for this key. The search index built nightly from a snapshot. The event log the architecture depends on being append-only. The warehouse, which denormalized the person into eleven aggregate tables. And the backups, which exist precisely so that deleted things can come back.
Backups are the honest impasse and deserve naming rather than waving at. A backup you can surgically edit is not much of a backup, since the property you paid for was a faithful frozen copy. So the practical arrangement is that deletion propagates through live systems immediately and through backups by expiry, and the promise you can keep is bounded by the retention window rather than by the delete endpoint. That is defensible. It is a problem only when nobody wrote it down and the window turns out to be seven years.
The EU to US transfer position is in force and contested. The Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, extended to the wider European Economic Area from July 2024, and transfers on that basis are lawful today. Two predecessor arrangements were struck down by the Court of Justice. The framework depends on a US redress mechanism created by executive order, and the independence of that mechanism has been publicly questioned since early 2025 after changes to its membership. I am not going to predict the outcome. I would design so that the answer is survivable either way.
India is twelve days into having operable rules. The rules under the Indian act were notified on 14 November 2025 with phased commencement, which means the substantive obligations arrive over the coming year and a half rather than now. There is no enforcement history, no body of regulator guidance and no settled practice, so anybody offering you a confident interpretation is offering you a reading. Build the mechanisms the framework obviously needs, which are consent capture with versioning, notice, grievance handling and breach reporting, and leave the interpretive detail loosely coupled.
The US patchwork has no stable count and will not have one. I am deliberately not giving a number of states with comprehensive statutes, because it changes every legislative session and any figure I wrote would be wrong by the time this is read. That is not a gap in the piece; it is the property that matters. A system whose correctness depends on an enumeration of jurisdictions needs that enumeration to be configuration with an owner and a review date, not a constant somebody typed into a validation function.
Engineering is never handed a law. It is handed an interpretation of a law, arrived at by counsel, filtered through a program manager, and delivered as a requirement in a ticket. The interpretation embeds a risk appetite that was chosen by somebody who is not in the room, and two competent lawyers reading the same provision will land in different places, one of them conservative because that is what the role rewards and one of them aggressive because the business asked for room. Both are defensible. They produce different systems.
The single most useful thing an engineering leader can do here costs nothing and is almost never done: insist that the interpretation is a written, dated, versioned artifact with a named owner, and that the code points at it. Not the law, the reading of it. What we concluded, who concluded it, when, and what changes would make us revisit. It turns a moving target into a fixed one that moves visibly, and it means the next change is a diff rather than an argument about what was agreed in a meeting nobody minuted.
The wish underneath "why can there not be one standard" is a wish for every other country to adopt somebody else's values, and it is worth noticing whose. These regimes differ because the societies behind them disagree, in good faith, about the relationship between a person, a company and a state. Europe's rights framing comes out of a specific history of what states do with registries. The American sectoral approach reflects a real preference for constraining government more than commerce. Harmonization means somebody's view loses, and whoever asks for it assumes it will not be theirs.
Where I will not give ground is on the pretense. The system that claims to be globally compliant, with no statement of which regime it was built for and no description of how it behaves against the others, has not solved the problem. It has left it undocumented, and undocumented is the state in which it gets discovered by somebody outside the company.
What stays with me is the timing. Every one of these decisions is cheap on the day the schema is drawn and enormous eighteen months later, and none of them looks like a legal question when it arrives. It looks like a column, a region name, a cache expiry, an error reporter's default configuration. The law shows up years afterward and asks what you did, and the answer was written by somebody who was solving a different problem on a Tuesday and had never heard of any of this.