Can a company share my data with third parties without consent?

How the answer differs across 9 jurisdictions

The Short Answer

No, a company cannot share your personal information with third parties without your valid, informed consent under Canadian federal privacy law.

Valid consent
Required for sharing
Clear purpose
Must be explained
Federal law
Applies to private sector
PIPEDA
S.C. 2000, c. 5
AustraliaFull article
The Short Answer

Yes, it is likely a breach of the Privacy Act 1988 (Cth) if a company uses your personal information for a purpose different from the one they disclosed at collection, unless an exception applies.

APP 6.1
Key privacy principle
30 days
Response time for complaints
$2.5M
Max penalty for serious breaches
13 APPs
Australian Privacy Principles
The Short Answer

Under Irish law, a company transferring your personal data outside the EU must ensure an adequate level of protection, using approved safeguards like Standard Contractual Clauses or binding corporate rules.

GDPR applies
Legal basis
Section 38
Data Protection Act 2018
EU adequacy
Transfer condition
72 hours
Breach notification
SingaporeFull article
The Short Answer

Under Singapore law, a company must obtain your consent and ensure comparable protection before transferring your personal data overseas.

s. 26
Relevant section
Consent require
Key requirement
10 years
Max penalty term
S$1M
Max fine
European UnionFull article
The Short Answer

No, it is generally illegal for a company in the EU to transfer your personal data to the US without adequate safeguards, such as an adequacy decision, appropriate safeguards (e.g., SCCs), or a valid derogation.

GDPR Art. 44
Legal basis
Schrems II
Key ruling
72h breach
Notification deadline
€20M or 4%
Max fine
The Short Answer

Yes, a company can transfer your data outside India, but only if certain conditions under the Digital Personal Data Protection Act, 2023 are met — including adequacy determination or valid contracts.

100+ countries
Eligible for adequacy
Section 16
Data transfer provision
2023
Act enacted
Consent require
For sensitive data
South KoreaFull article
The Short Answer

In South Korea, a company generally cannot share your personal data with a third party without your prior, explicit consent — unless an exception under the Personal Information Protection Act applies.

14 days
Breach notification deadline
₩30M
Max fine for violation
5 years
Max imprisonment
Article 17
Third-party provision rule
The Short Answer

No, it is not lawful for a UK company to transfer your personal data outside the UK without appropriate safeguards, unless an exception applies.

UK GDPR
Governing law
s. 209
DPA 2018 section
48 hours
Breach reporting deadline
£17.5M
Max fine (UK GDPR)
The Short Answer

Yes, consent is generally required to provide personal information to third parties in Japan, unless an exception under the Act on the Protection of Personal Information applies.

Article 23
APPI consent rule
Opt-in
Consent standard
3 years
Record retention
JPY 1M
Max fine

Read Full Articles

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: June 2026.