The modern body of statute governing how personal data is collected, processed and protected, recognized as its own regulatory field since the General Data Protection Regulation. Belongs here: the GDPR itself, the California Consumer Privacy Act, the UK Data Protection Act 2018, India's Digital Personal Data Protection Act of 2023, Canada's Personal Information Protection and Electronic Documents Act, China's Personal Information Protection Law, and the Electronic Communications Privacy Act as an earlier communications-specific privacy statute. Does not belong here: a sector statute whose privacy provisions are secondary to a different regulatory purpose, such as health records regulation, grouped under health, safety, employment and consumer protection instead.