In cross-jurisdiction privacy matters, what is expected of platforms?

• A. They may ignore local laws and only follow their home country's privacy policy
• B. They must only follow international privacy standards
• C. They must comply with the local laws of that jurisdiction
• D. They are exempt from privacy laws in foreign markets

Answer: (C)

When data is processed in or about people in a given country, the local privacy rules of that country apply to that processing. Platforms must follow the jurisdictional laws where the data is handled, even if their headquarters are in a different country. This means they need to comply with local requirements on consent, data minimization, purpose limitation, breach notification, user rights, and other protections established by that jurisdiction’s regime.

Relying solely on international standards isn’t enough because those standards may be aspirational or non-binding in a given place; local laws have enforceable obligations and penalties for noncompliance. Conversely, platforms aren’t exempt from privacy laws simply because they operate in foreign markets, and they can’t ignore local regulations in favor of their home policy.

In short, cross-jurisdiction privacy expectation is to comply with the local laws of the jurisdiction where the data is processed or where the users reside.