conflicting-laws-mgmt

Managing Conflicting Privacy Requirements

Overview

Organisations operating across multiple jurisdictions inevitably encounter situations where privacy requirements in different countries conflict, are incompatible, or create compliance tensions. These conflicts arise because privacy laws reflect different legal traditions, cultural values, and policy priorities. A structured resolution framework enables organisations to navigate these conflicts while maintaining defensible compliance positions in all jurisdictions.

Categories of Conflict

Category 1: Data Localisation vs Transfer Freedom

Resolution Framework for Zenith Global Enterprises:

Category 2: Consent Standards Variation

Conflict examples:

• GDPR allows legitimate interest without consent; PIPL requires consent as default with no legitimate interest basis
• LGPD separates consent from contract clauses; some jurisdictions permit integrated consent
• Korea prescribes font size and display; other jurisdictions are principle-based

Resolution: Apply the most restrictive consent standard globally (separate, explicit, purpose-specific consent with clear display) as the harmonised baseline. Where a jurisdiction permits processing without consent (e.g., GDPR legitimate interest), document the jurisdiction-specific basis but maintain the consent infrastructure as a fallback.

Category 3: Age Thresholds for Children

Conflict: Different age thresholds create operational complexity for global platforms.

Resolution: Apply the highest global threshold (18, from India DPDP) as the harmonised standard for all markets. This ensures compliance everywhere at the cost of stricter treatment in jurisdictions with lower thresholds. Where the highest threshold creates significant business impact, implement jurisdiction-specific age logic in the consent management platform.

Category 4: Breach Notification Timelines

Conflict: The 72-hour clock (EU/Korea/India) conflicts with the 30-day assessment window (Singapore/Australia).

Resolution: Implement a two-track notification process:

1. Global fast track: Begin assessment immediately upon awareness; prepare notification within 72 hours for jurisdictions requiring it
2. Assessment track: Continue assessment for up to 30 days for jurisdictions permitting it, but issue preliminary notification at 72 hours to the fast-track jurisdictions
3. Content: Preliminary 72-hour notification may be updated as assessment continues

Category 5: Legitimate Interest Availability

Conflict: An organisation relying on legitimate interest in the EU cannot use the same basis in China, India, or Singapore.

Resolution: For processing activities that rely on legitimate interest in some jurisdictions, maintain consent collection infrastructure as a parallel mechanism. In jurisdictions without legitimate interest, obtain consent or identify an applicable alternative basis. Document both bases in the processing register with jurisdiction-specific applicability.

Category 6: DPO Independence vs Organisational Structure

Resolution: Appoint regional DPOs with local employment protections consistent with national law, reporting to a global Chief Privacy Officer. Each regional DPO holds the statutory DPO role for their jurisdiction while the global CPO provides strategic coordination.

Resolution Framework

Decision Tree for Conflicting Requirements

START: Identify the conflict
  |
  ├── Can a single harmonised standard satisfy all jurisdictions?
  |     |
  |     ├── YES → Apply the most stringent standard globally
  |     |
  |     └── NO → Are the requirements truly incompatible?
  |           |
  |           ├── YES → Implement jurisdiction-specific controls
  |           |     |
  |           |     └── Document: (a) the conflict, (b) the resolution,
  |           |         (c) the risk accepted in each jurisdiction
  |           |
  |           └── NO (tension but not incompatible) → Apply layered approach:
  |                 global baseline + jurisdiction-specific supplements
  |
  └── Record the resolution in the conflict register

Conflict Register Template

Governance