juhan6910-pfrsa

Blog By: Kenneth Juhan

Date: August 12, 2026

Kenny Juhan will explain Privacy regulations in the following blog.

Privacy Regulations for SecurityX: GDPR, CCPA, LGPD, and COPPA

Privacy regulations can seem intimidating because different jurisdictions use different laws and terminology.

For SecurityX, the goal is not necessarily to memorize every legal requirement. A better approach is knowing what each major regulation is associated with and why it matters to cybersecurity.

GDPR

The General Data Protection Regulation (GDPR) is associated with the European Union and European Economic Area and establishes requirements for processing personal information.

Important themes include:

• Lawful processing
• Transparency
• Data subject rights
• Data minimization
• Security
• Breach responsibilities

A useful memory rule is:

GDPR = European personal-data protection

Its reach can also affect organizations outside Europe when they process covered individuals’ information.

CCPA

The California Consumer Privacy Act (CCPA) provides privacy rights involving certain California consumers and businesses.

It addresses areas such as disclosure of data practices and consumer rights involving personal information.

Think:

CCPA = California consumer privacy

Organizations operating nationally may therefore need to consider state-level privacy requirements in addition to federal or international obligations.

LGPD

Brazil’s Lei Geral de Proteção de Dados (LGPD) establishes privacy requirements for processing personal data.

The easiest exam association is:

LGPD = Brazil

Like GDPR, it addresses the handling and protection of personal information and rights associated with individuals.

COPPA

The Children’s Online Privacy Protection Act (COPPA) in the United States focuses on online collection of personal information from children under 13.

Think:

COPPA = Children’s online privacy

If a SecurityX scenario describes an online service directed toward young children and asks about privacy requirements, COPPA should immediately stand out.

Privacy Is More Than Encryption

Security professionals sometimes approach every privacy problem as a data-security problem.

Encryption is important, but privacy regulations also address questions such as:

• Why is the information collected?
• Is collection permitted?
• How long is it retained?
• Can individuals request access or deletion?
• Can the information be transferred elsewhere?
• Who can process it?

An organization can strongly encrypt information and still handle it in a way that creates privacy problems.

Why This Matters for SecurityX

A simple memory guide is:

GDPR = Europe

CCPA = California

LGPD = Brazil

COPPA = U.S. children’s online privacy

But memorizing locations is only the starting point.

SecurityX expects candidates to understand that organizations may operate under several overlapping requirements.

A cloud service could have customers in multiple jurisdictions, creating privacy considerations involving where data is collected, stored, processed, and transferred.

When answering exam questions, pay attention to who the data belongs to, where the individuals are located, what kind of information is being processed, and which jurisdiction applies.

Privacy is part of enterprise security because protecting information requires understanding not only how to secure it, but also the rules governing how the organization is allowed to use it.