Last updated: 27 September 2026
Short answer: if your product or business touches personal data from people in Europe, the UK, India or most large US states, privacy law already applies to you, and 2026 added more of it. The practical requirements are similar everywhere: collect only what you need, tell people what you collect, secure it, let people see and delete their data, and report breaches quickly. For engineers, the biggest change is that connected products sold in the EU must now let users access the data their devices generate. This is a summary for orientation, not legal advice.
Which privacy laws matter in 2026?
| Law | Where | Status in 2026 | Why engineers should care |
|---|---|---|---|
| GDPR | European Union | In force since 2018 | The global reference point; fines up to €20 million or 4% of worldwide annual turnover |
| UK GDPR, amended by the Data (Use and Access) Act 2025 | United Kingdom | Act passed June 2025; main data protection changes commenced February 2026 | Similar to GDPR with some relaxations, such as "recognised legitimate interests" |
| Digital Personal Data Protection (DPDP) Act 2023 and DPDP Rules 2025 | India | Rules notified November 2025; phased in until May 2027 | India's first comprehensive privacy law; affects anyone processing Indians' personal data |
| State comprehensive privacy laws | United States | 20 states with laws in effect in 2026 | No single federal law; obligations vary by state |
| EU Data Act | European Union | Applicable since 12 September 2025 | Users of connected products can demand access to the data those products generate |
What does GDPR actually require from a product?
Most of the world's privacy laws borrowed GDPR's core ideas, so it is the best one to understand first. For a product team, the parts that matter day to day are:
- Lawful basis. You need a legal reason to process personal data, such as consent, a contract or a legitimate interest.
- Data minimisation. Collect only what you need for a stated purpose. "We might use it later" is not a purpose.
- Privacy by design and by default. Build protection in from the start, and default settings should be the privacy-friendly ones.
- User rights. People can ask to access, correct, delete or export their data, and you must be able to do it.
- Breach notification. Serious breaches must be reported to the regulator within 72 hours of becoming aware of them.
For engineers, "personal data" is broader than names and emails. IP addresses, device identifiers, location traces and usage telemetry linked to a person or device can all count.
What changed in the UK?
The UK kept GDPR after Brexit as "UK GDPR" and has now reformed it. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and its main data protection changes came into force in February 2026. Changes include a new lawful basis of "recognised legitimate interests", clarification that responses to access requests need only a reasonable and proportionate search, and changes to cookie rules.
For most businesses the day-to-day obligations look very similar to before. If you already comply with EU GDPR, you are most of the way there for the UK.
What does India's DPDP Act mean for businesses?
India's Digital Personal Data Protection Act was passed in 2023, and the rules that make it workable were notified in November 2025. Implementation is phased over 18 months: the Data Protection Board was set up immediately, provisions on consent managers follow after 12 months, and most substantive obligations apply from May 2027.
The law is built around consent and notice: tell people clearly what you collect and why, get their consent, let them withdraw it, and protect the data. Companies serving Indian users, including engineering and software firms with Indian customers or staff data, should use the phase-in period to map their data and update notices and consent flows.
How do US privacy laws work without a federal law?
State by state. By 2026, twenty states had comprehensive consumer privacy laws in effect, with Indiana, Kentucky and Rhode Island joining on 1 January 2026. California's law, strengthened by the CPRA, remains the most demanding.
The laws differ in thresholds and details, but most give consumers rights to access, delete, correct and port their data, require opt-in consent for sensitive data, and let people opt out of targeted advertising and the sale of their data. Many only apply above certain thresholds of revenue or number of consumers, so a very small business may fall outside some of them. Check the thresholds for the states where your customers are.
What is the EU Data Act, and why does it matter for hardware?
This is the one engineers building physical products most need to know about. Since 12 September 2025, the EU Data Act lets users of connected products, from smart appliances and phones to industrial machinery and vehicles, demand access to the data their use of the product generates, both personal and non-personal. Users can also ask for that data to be shared with a third party, such as an independent repair or service company.
Two engineering consequences follow:
- Before sale, you must tell users what data the product generates and how they can access it.
- For products placed on the EU market after 12 September 2026, access by design applies: products should be designed so users can access their data directly, where technically feasible.
For machine builders, this changes how telemetry, service data and data-export features are designed, and it needs to be in the product specification rather than bolted on at the end.
What should engineers build into products now?
- A data map. List every piece of data your product or service collects, where it goes and who can see it. You cannot comply with anything without it.
- Minimal collection by default. Turn off optional telemetry unless there is a clear purpose and a lawful basis.
- Export and deletion functions. Build them early. Retrofitting "delete my data" into a mature system is painful.
- Access controls and logging. Know who accessed personal data and when.
- Encryption in transit and at rest, including backups. My 30-minute backup guide covers encrypting backups for a small business.
- Supplier checks. Cloud services, analytics tools and AI services that process your users' data need contracts and data-processing terms. That includes AI tools: before pasting customer data into one, read local vs cloud AI for a small business. The same care applies to engineering records, as I noted in how AI is changing engineering documentation.
- A breach plan. Know who decides, who notifies regulators and customers, and how you meet a 72-hour deadline.
FAQ
Does GDPR apply to a US or Indian company?
It can. GDPR applies to organisations outside the EU when they offer goods or services to people in the EU or monitor their behaviour. Having EU customers is often enough to bring a business within scope.
Is IP address data personal data?
Often, yes. Under GDPR, IP addresses and device identifiers can be personal data when they can be linked to an individual. Treat them as personal data unless you have good reason not to.
Do small businesses have to comply with US state privacy laws?
It depends on the state. Many state laws apply only above thresholds, such as annual revenue or the number of consumers whose data is processed. Check each state where you have customers.
What is the difference between the EU Data Act and GDPR?
GDPR protects personal data. The Data Act is about access to and sharing of data generated by connected products and related services, both personal and non-personal. Where personal data is involved, GDPR still applies alongside the Data Act.
