Privacy rules by region before you sell company data to AI
The law that applies follows the people in the data, not only where your company is. Pick a region to see its main laws, what counts as no longer personal, which records carry extra rules and what to check first. General information, not legal advice.
| United States | HIPAA, California and other state laws, the FTC, and the records that carry extra rules. |
| Canada | PIPEDA, Quebec Law 25, the provincial acts, and health information laws. |
| United Kingdom | The UK GDPR, the Data Protection Act 2018, the 2025 Act and the ICO anonymisation guidance. |
| European Union | The GDPR, the EDPB on anonymisation and AI models, and the EU AI Act. |
| Australia | The Privacy Act 1988, the Australian Privacy Principles, OAIC guidance and health records laws. |
For how we clean data to these tests, see de-identification.