About

A reference map of privacy and data protection law: 559 instruments across 255 national and sub-national jurisdictions, with status as of 18 October 2026.

Not legal advice

This is a research compilation, not legal advice. Laws change, and summaries leave things out. Confirm the current text through each instrument's authoritative link before relying on anything here.

How it was compiled

Each record was researched against official texts, regulators and reputable secondary trackers, in a single research pass completed on 18 October 2026. Every record carries a confidence level and verification notes. The site shows both, and never hides them.

On each jurisdiction page, Domestic law lists the jurisdiction's own instruments. Also applies here lists instruments it inherits: EU law in EU member states, the GDPR's EEA incorporation in Norway, Iceland and Liechtenstein, and federal law in US states, Canadian provinces, Australian states and UAE and Qatari free zones and emirates. Regional & international frameworks are matched by membership of the body that made them. Membership is not ratification, so check each instrument's record.

The map colours a country by its own and inherited law. States, provinces and free zones are coloured by their own law, so the map shows where they have legislated; federal law still applies there and is listed on their pages.

Grey areas are not covered in this dataset. That does not mean there is no privacy law there.

Confidence levels

High: Checked against official text or the authority within this research pass. (167 instruments)
Medium: Checked against reputable secondary sources (DLA Piper, IAPP, MoFo, law-firm trackers); some details not re-checked. (328 instruments)
Low: Partly unverified — see Verification notes before relying on it. (64 instruments)

Medium and Low records carry a “Partly verified” label. Open it to read the record's verification notes.

Membership lists

Inheritance and framework matching use hand-maintained lists in memberships.json, each with its source:

European Union: european-union.europa.eu/principles-countries-history/eu-cou (checked 2026-10-18)
EEA EFTA States: web.archive.org/web/2026id_/https://www.efta.int/about-efta/ (live site blocks automated requests; checked 2026-10-18)
Council of Europe: web.archive.org/web/20251222031044id_/https://www.coe.int/en (Wayback copy; the live site blocks automated requests; checked 2026-10-18)
Organisation for Economic Co-operation and Development (OECD): web.archive.org/web/2026id_/https://www.oecd.org/en/about/me (Wayback copy; the live site blocks automated requests; checked 2026-10-18)
Asia-Pacific Economic Cooperation (APEC): apec.org/who-we-are/our-members (checked 2026-10-18)
Association of Southeast Asian Nations (ASEAN): web.archive.org/web/2026id_/https://asean.org/ (Wayback copy; the live site blocks automated requests; checked 2026-10-18)
African Union: au.int/en/member_states/countryprofiles2 (checked 2026-10-18)
Economic Community of West African States (ECOWAS): www.ecowas.int/member-states/ (checked 2026-10-18)
Southern African Development Community (SADC): sadc.int/member-states (checked 2026-10-18)
East African Community (EAC): www.eac.int/eac-partner-states (checked 2026-10-18)
Organization of American States (OAS): www.oas.org/en/member_states/default.asp (checked 2026-10-18)
Ibero-American Data Protection Network (RIPD): www.redipd.org/en/the-network/composition (checked 2026-10-18)
Commonwealth of Nations: thecommonwealth.org/our-member-countries (checked 2026-10-18)
Global Cross-Border Privacy Rules Forum: www.globalcbpr.org/about/membership/ (checked 2026-10-18)
United Nations: All UN member states. allExcept lists the dataset's non-member jurisdictions (territories, Taiwan, Kosovo, Hong Kong, Macao); not checked against un.org.
coe-108-parties: NOT SOURCED: the coe.int Treaty Office chart for ETS 108 could not be fetched (HTTP 403 to automated requests). Convention 108, Protocol 181 and Convention 108+ therefore fall back to Council of Europe membership, with the membership caveat.

Download the data

Spreadsheet (xlsx): the human-readable master, with a “Needs verification” sheet.
Instruments (csv)
Instruments and jurisdictions (json)

Licence

Licence to be confirmed.

Boundaries are derived from Natural Earth (public domain) via the world-atlas and us-atlas packages (ISC). Fonts are Inter and EB Garamond (SIL Open Font License).

Privacy

This site sets no cookies, runs no analytics, and makes no requests to third parties: fonts, map shapes and data are all served from this site. If you switch between light and dark themes, that choice is stored in your browser's local storage and never leaves your device. The hosting provider (Cloudflare) processes standard connection data such as IP addresses to deliver and protect the site.

Report an error

If something is wrong or out of date, email hello@privacyposture.com with the page address and, if you can, a link to the authoritative source.