General Data Protection Regulation. Cross-border transfers gated by adequacy or SCCs; supervisory authority in every member state.
Digital Personal Data Protection Act. Notified cross-border restrictions; significant data fiduciary obligations.
Lei Geral de Proteção de Dados. ANPD oversight; international transfer mechanisms required.
Personal Data Protection Law. SDAIA enforcement; localization for sensitive categories.
Nigeria Data Protection Act. Cross-border transfers restricted; data fiduciary obligations.
Protection of Personal Information Act. Information Regulator oversight.
Personal Data Protection Law. Localization for strategic personal data; cross-border conditions.
Federal Data Protection Law plus DIFC/ADGM regimes; transfer assessments required.
Indicative summary; not legal advice. Rhodium 45 engages local counsel in every market and provides regulator-facing audit interfaces as part of platform delivery.
Standard contractual clauses and adequacy decisions are legal constructs. They do not change where compute physically happens. When a European bank, an Indian ministry, a Brazilian insurer or a Nigerian telco runs inference on customer data, the question regulators ask is not “what’s in your DPA?” but “where did the bytes go?”
Rhodium 45 answers that question with a physical address inside the jurisdiction, customer-controlled cryptographic keys, and a federated control plane that cannot be operated from outside. These commitments are durable, growing, and unavailable from offshore hyperscalers.