Sharing Information Safely in the Age of Privacy Laws

Privacy laws are no longer just a concern for large corporations. The EU's GDPR, the US state privacy laws like CCPA, and similar regulations around the world apply to organizations of every size. If you handle even a single customer's name, email, or phone number, these laws apply to you.

This guide summarizes the key requirements of major privacy laws and offers practical methods for sharing personal data safely in everyday business operations.

Overview of Major Privacy Laws

EU General Data Protection Regulation (GDPR)

In effect since 2018, the GDPR is one of the strongest privacy laws in the world. It applies to any organization processing the personal data of EU residents, regardless of where the organization is based. Fines can reach up to 4% of global annual revenue.

US State Laws (CCPA/CPRA and Others)

The United States lacks a unified federal privacy law, but states like California (CCPA/CPRA), Virginia (VCDPA), and Colorado (CPA) have enacted their own comprehensive regulations.

Other Notable Laws

South Korea's PIPA, Japan's APPI, Brazil's LGPD, and India's DPDP Act are examples of similar privacy frameworks adopted worldwide.

What Counts as Personal Data

The following items are classified as personal data under most privacy laws.

Category	Examples
Identification info	Name, national ID number, passport number
Contact info	Email address, phone number, physical address
Online identifiers	IP address, cookies, device ID
Financial info	Card numbers, bank account details, transactions
Health info	Medical records, health insurance data
Location info	GPS data, travel patterns

Obligations When Sharing Personal Data

1. Data Minimization

Collect and share only the minimum information necessary. Do not request or transmit data that is not strictly required for the task at hand.

2. Encrypted Transmission

Personal data must be transmitted through encrypted channels. Unencrypted email or standard messaging apps may not meet legal standards.

3. Retention Limits

Personal data should be retained only for the period necessary to fulfill its purpose. Once the purpose is complete, data must be deleted without delay.

4. Consent

Collecting personal data or providing it to third parties generally requires the data subject's consent, with certain legal exceptions.

5. Access Restrictions

Limit who can access personal data to the minimum number of people required for the business purpose.

Major Privacy Law Comparison

Feature	EU GDPR	US CCPA/CPRA	South Korea PIPA
Scope	Any org processing EU resident data	Businesses targeting CA residents	All data processors in Korea
Consent	Consent or legitimate interest	Opt-out focused	Required (statutory exceptions)
Maximum fines	4% of revenue or EUR 20M	Up to $7,500 per violation	Up to 3% of revenue
Data retention	Delete when purpose fulfilled	Delete within reasonable period	Delete when purpose fulfilled
Data subject rights	Access, rectify, delete, port, object	Access, delete, opt out	Access, rectify, delete, port
DPO required	Under certain conditions	Not required	Over certain thresholds

Using LOCK.PUB for Privacy-Compliant Sharing

LOCK.PUB's features align with the core principles of privacy law.

Password Protection = Access Control

Only individuals who know the password can access the information, satisfying the access restriction principle.

Expiration Time = Retention Compliance

Setting an expiration on shared links ensures that access is automatically revoked after the purpose is fulfilled, without requiring a separate deletion process.

Separate Channel Delivery = Enhanced Security

Sending the link and password through different channels means that compromise of one channel alone does not expose the data.

Access Analytics = Audit Trail

Analytics track who accessed the information and when, enabling audit readiness.

Practical Compliance Tips for Small Businesses and Individuals

When Sharing Customer Information

• Do not send personal data directly through email or messaging apps; use password-protected memos
• Include only the necessary data; exclude anything not strictly required
• Set expiration times for automatic access revocation

When Providing Data to External Vendors

• Execute a Data Processing Agreement (DPA)
• Deliver data via password-protected links with expiration
• Maintain access records

When Sharing Personal Data Within a Team

• Do not store personal data in shared spreadsheets
• Share only with those who need it via password-protected memos
• Set expiration to ensure access is cut off after the task is complete

Penalties for Violations

Privacy law violations can lead to severe consequences beyond financial penalties.

• EU: Fines up to 4% of global revenue or EUR 20 million, whichever is greater
• US California: Up to $7,500 per intentional violation
• South Korea: Fines up to 3% of revenue, imprisonment up to 5 years

Get Started Now

Compliance with privacy laws is not optional. Review your current data sharing practices and switch to secure methods with password protection and automatic expiration.

Create a privacy-compliant secret memo on LOCK.PUB today.

Create a Secret Memo