The EU GDPR applies across the European Union, and the UK GDPR sits alongside the Data Protection Act 2018. In California, the CCPA, as amended by the CPRA, gives residents rights over their data and applies to businesses above set thresholds. PIPEDA is Canada's federal private-sector law. Australia's Privacy Act 1988 contains the Australian Privacy Principles, and New Zealand's Privacy Act 2020 sets out its own information privacy principles.
Although details differ, these laws share common themes: tell people what you collect and why, collect only what you need, keep it secure, respond to people's requests about their own data, and take care when sending it to other countries or suppliers. Several require serious breaches to be reported. A small business serving customers abroad can fall under more than one of these laws.
Which laws apply, and how, depends on where your customers are, what data you hold, and the size of the business, so the question belongs with a qualified legal adviser. This overview is general information, not legal advice. We implement technical safeguards these laws commonly call for, such as access controls, encryption, backups, and logging, but we do not give legal advice or guarantee compliance.