Since the introduction of the European Union's (EU's) General Data Protection Regulation (GDPR), which has an expansive reach, U.S. businesses have faced comprehensive and unprecedented data protection and privacy considerations. When the GDPR became law, there were no such laws (federal or state) in the United States, and U.S. businesses questioned the GDPR's applicability. Since then, U.S. states have taken it upon themselves to bring a wave of new data protection legislation, forcing U.S. businesses to consider the topic yet again—and this time it's in their backyard.

Over the past five years, 12 new comprehensive U.S. state privacy laws have passed. And more are in the pipeline. Consider, for example, the influx of bills introduced recently—in 2018, only two bills on this topic were introduced, compared with the 59 introduced in 2023.

This wave is not limited to the United States; in recent years, at least 10 countries have enacted new laws or amended their current laws to take a more comprehensive approach. And the wave is likely to gain momentum: The IAPP 2023 global legislative predictions report expects parliaments around the world to continue introducing new legislation or building on existing legislation, and according to the United Nations Conference on Trade and Development, an additional 9 percent of countries have draft legislation on the table. Gone are the days when businesses (especially in this interconnected world) can ignore comprehensive data protection and privacy laws without placing a certain level of risk upon themselves.