Data privacy is increasingly important. Most countries now have laws and regulations to protect their citizens’ personal information.
In this article, we will provide an overview of the key global data privacy laws in 2023 that game companies need to be aware of.
GDPR (EU)
The General Data Protection Regulation (GDPR) is the most comprehensive data privacy law in the world, applying to all companies that process the personal data of EU citizens.
The GDPR provides individuals with a range of rights, including the right to access their personal data, the right to rectify any inaccuracies, and the right to erasure. Game companies must comply with strict data protection requirements, such as through conducting data protection impact assessments and notifying individuals of data breaches.
CCPA (California, US)
The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), is a data privacy law applying to companies that process the personal information of California residents and meet certain minimum requirements (which could include the number of California users, percentage of revenue derived from selling personal data, etc.).
The CCPA gives individuals the right to know what personal information is being collected, the right to request that their information be deleted, and the right to opt-out of the sale of their information.
Game companies must provide a clear and conspicuous privacy policy describing their data collection and sharing practices.
LGPD (Brazil)
The Lei Geral de Proteção de Dados (LGPD) is Brazil’s data protection law, modeled on the GDPR.
The LGPD applies to all companies processing personal data in Brazil, providing individuals with a range of rights, such as the right to access their personal data and the right to erasure.
Game companies collecting and processing personal data in Brazil must comply with strict data protection requirements. Requirements include conducting data protection impact assessments and appointing a Data Protection Officer.
PIPEDA (Canada)
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal data protection law, applying to all companies that process personal information in Canada.
PIPEDA gives individuals the right to access their personal information, the right to request that their information be corrected, and the right to withdraw their consent for their information to be processed.
Regular assessments of their data protection practices and notifying individuals of data breaches are among the strict requirements game companies must abide by.
APPI (Japan)
The Act on the Protection of Personal Information (APPI) is Japan’s data protection law, applying to all companies that process personal data in Japan.
APPI grants individuals the right to access their personal data and the right to erasure.
Game companies must also obtain individuals’ consent for the collection and processing of their personal data and implement appropriate security measures.
POPIA (South Africa)
The Protection of Personal Information Act (POPIA) is South Africa’s data protection law. It applies to all companies that process personal information in South Africa.
POPIA gives individuals the right to access their personal information, the right to request that their information be corrected, and the right to object to the processing of their information.
Companies must comply with a range of data protection requirements, through processes like appointing an Information Officer or conducting data protection regular assessments.
PECR (UK)
The Privacy and Electronic Communications Regulations (PECR) apply to all companies that send marketing communications by email, text message, or phone call in the UK.
The PECR requires companies to obtain individuals’ consent before sending marketing communications, and individuals have the right to opt-out of receiving such communications. Companies must also provide clear and transparent information about their data collection and processing practices.
Conclusion – what to do now?
Data privacy is an important issue around the world.
Most nations have their own take on privacy laws, so it is important to speak with an attorney or privacy professional in each jurisdiction prior to publishing your game.
Need help getting started with game company privacy compliance? Jump over to my contact page to set up a consultation.
