# Multi-Jurisdiction Compliance Matrix — Zenith Global Enterprises

## Jurisdiction Inventory

| Jurisdiction | Law | Regulator | Operations | Data Subjects |
|-------------|-----|-----------|-----------|---------------|
| EU/EEA | GDPR | National DPAs | HQ (Germany), offices in 5 EU states | 500,000+ |
| UK | UK GDPR | ICO | London office | 50,000+ |
| Brazil | LGPD | ANPD | São Paulo office | 100,000+ |
| China | PIPL | CAC | Shanghai office | 200,000+ |
| Korea | PIPA | PIPC | Seoul office | 80,000+ |
| India | DPDP Act | DPBI | Mumbai office | 500,000+ |
| Thailand | PDPA | PDPC | Bangkok office | 40,000+ |
| Singapore | PDPA | PDPC | Singapore office | 60,000+ |
| Japan | APPI | PPC | Tokyo office | 120,000+ |
| Australia | Privacy Act | OAIC | Sydney office | 30,000+ |

## Harmonised Controls Summary

| Control | Standard | Driven By | Jurisdictions Satisfied |
|---------|----------|-----------|----------------------|
| Breach notification | 72 hours | EU GDPR, Korea PIPA, India DPDP | All (most stringent) |
| Children's consent | Under 18 | India DPDP | All |
| Consent granularity | Separate per purpose + separate for transfers | China PIPL | All |
| DPO appointment | All jurisdictions with operations | GDPR, LGPD, PDPA | All |
| Impact assessment | All high-risk processing | GDPR, PIPL, Australia (2024) | All |
| Encryption | AES-256 at rest, TLS 1.3 in transit | Cross-jurisdiction best practice | All |
| Retention deletion | Within 5 days of purpose fulfilment | Korea PIPA | All |
| Consent records | 7-year retention | India DPDP (consent manager) | All |

## Gap Summary

| Gap | Jurisdiction | Priority | Remediation |
|-----|-------------|----------|-------------|
| None identified | — | — | All harmonised controls implemented |

## Next Review

| Element | Detail |
|---------|--------|
| Last comprehensive review | January 2026 |
| Next quarterly update | April 2026 |
| Next annual review | January 2027 |
| Review committee | Privacy Steering Committee |