Privacy Map

Organisation for Economic Co-operation and Development (OECD). Treaty / framework. Recommendation (OECD Council)

OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)

In force

§1Summary

Synopsis

Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

Key themes
  • accountability
  • privacy management programmes
  • breach notification
  • enforcement cooperation
  • interoperability
  • transborder flows
Unique features

It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

SaaS relevance

It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

§2Obligations

Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None

§3Dates

Key dates
  • Adopted
  • In force
  • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue

§4Text and authority

Text
Authority
OECD Working Party on Data Governance and Privacy

§5Where it applies

Members of the body

Membership-based — check ratification status. Membership of Organisation for Economic Co-operation and Development (OECD) does not mean a state has signed or ratified this instrument.

§6Sources and verification

Sources consulted
Verification

High confidence.