IP Act (Qld)Information Privacy Act 2009 (Qld)In force In force from Governs personal information handling by Queensland government agencies. The 2023 amendments replaced the old principles with Queensland Privacy Principles modelled on the APPs and added mandatory data breach notification.
Synopsis
Governs personal information handling by Queensland government agencies. The 2023 amendments replaced the old principles with Queensland Privacy Principles modelled on the APPs and added mandatory data breach notification.
Key themes
QPPs
MNDB
bound contracted service providers
overseas disclosure
OIC complaints
Unique features
Agencies must bind contracted service providers to the QPPs.
SaaS relevance
Relevant where SaaS acts as a contracted service provider to state agencies, which typically flow down these obligations by contract or statute.
Breach notification
Agencies notify OIC and individuals of eligible data breaches
Key dates
Adopted
In force
Information Privacy and Other Legislation Amendment Act 2023: Queensland Privacy Principles and MNDB scheme from 2025-07-01; local government MNDB from 2026-07-01
Medium confidence. Partly verifiedMedium confidence.2025-07-01 and 2026-07-01 commencement dates from general knowledge; OIC pages confirming dates could not be loaded. [Link: Queensland Legislation current in-force version]
Partly verifiedMedium confidence.2025-07-01 and 2026-07-01 commencement dates from general knowledge; OIC pages confirming dates could not be loaded. [Link: Queensland Legislation current in-force version]
Privacy ActPrivacy Act 1988 (Cth)In force In force from Australia's federal privacy law, built on 13 Australian Privacy Principles for Commonwealth agencies and private organisations with turnover above A$3 million (plus some smaller businesses). The OAIC enforces through investigations, determinations, infringement notices and civil penalty proceedings.
Synopsis
Australia's federal privacy law, built on 13 Australian Privacy Principles for Commonwealth agencies and private organisations with turnover above A$3 million (plus some smaller businesses). The OAIC enforces through investigations, determinations, infringement notices and civil penalty proceedings.
Key themes
APPs
small business exemption
overseas disclosure (APP 8)
direct marketing
credit reporting
NDB
civil penalties
Unique features
Small business (<A$3m turnover) exemption and employee records exemption; organisations remain accountable for overseas recipients under APP 8.
SaaS relevance
Applies to SaaS with an 'Australian link', including foreign companies carrying on business in Australia and collecting or holding data there.
Extraterritorial
Yes
Breach notification
See NDB scheme: assess within 30 days; notify OAIC and individuals as soon as practicable
DPO
No
Cross-border transfers
APP 8 accountability, consent or substantially similar law
Maximum penalty
Greater of A$50m, 3x benefit, or 30% of adjusted turnover (serious interference); tier of A$3.3m for non-serious
Key dates
Adopted
In force
Private sector from 2001; APPs from 2014-03-12; NDB scheme 2018-02-22; penalty increase 2022-12-13; POLA Act 2024 (assent Dec 2024) – ADM privacy-policy transparency from 2026-12-10
POLA Act 2024Privacy and Other Legislation Amendment Act 2024 (Cth)Partially in force In force from Tranche 1 of Australia's Privacy Act reform. It adds tiered civil penalties and infringement notices, a statutory tort for serious invasions of privacy, a Children's Online Privacy Code, ADM transparency, an overseas-transfer whitelist mechanism, eligible data breach declarations and new doxxing crimes.
Synopsis
Tranche 1 of Australia's Privacy Act reform. It adds tiered civil penalties and infringement notices, a statutory tort for serious invasions of privacy, a Children's Online Privacy Code, ADM transparency, an overseas-transfer whitelist mechanism, eligible data breach declarations and new doxxing crimes.
Key themes
statutory tort
children's code
ADM transparency
penalty tiers
infringement notices
whitelist for overseas transfers
security (APP 11) clarification
doxxing
Unique features
Creates a privately actionable tort for intentional or reckless serious invasions of privacy, independent of APP coverage.
SaaS relevance
SaaS using personal data in substantially automated decisions must disclose this in privacy policies from December 2026; consumer platforms likely accessed by children will be under the new code.
Extraterritorial
Yes
Maximum penalty
A$50m/3x benefit/30% turnover; infringement notices for administrative breaches
Key dates
Adopted
In force
Most of Sch 1 from 2024-12-11; statutory tort (Sch 2) from 2025-06-10; Children's Online Privacy Code to be registered by 2026-12-10; ADM transparency in privacy policies from 2026-12-10; doxxing offences (Sch 3) on assent
Medium confidence. Partly verifiedMedium confidence.Royal assent 2024-12-10 and general commencement 2024-12-11 from general knowledge; legislation.gov.au commencement table could not be read. Tort start 2025-06-10 confirmed.
Partly verifiedMedium confidence.Royal assent 2024-12-10 and general commencement 2024-12-11 from general knowledge; legislation.gov.au commencement table could not be read. Tort start 2025-06-10 confirmed.
ePrivacy / marketing2
DNCR ActDo Not Call Register Act 2006 (Cth)In force In force from Prohibits unsolicited telemarketing calls and marketing faxes to numbers on the national Do Not Call Register without consent.
Synopsis
Prohibits unsolicited telemarketing calls and marketing faxes to numbers on the national Do Not Call Register without consent.
Key themes
telemarketing
do not call register
consent
SaaS relevance
Relevant to SaaS with outbound telesales to Australian numbers.
Low confidence. Partly verifiedLow confidence.Not explicitly covered by sources read; dates from general knowledge. [Link: Federal Register of Legislation, latest compilation]
Partly verifiedLow confidence.Not explicitly covered by sources read; dates from general knowledge. [Link: Federal Register of Legislation, latest compilation]
Spam ActSpam Act 2003 (Cth)In force In force from Requires consent, sender identification and a working unsubscribe facility for commercial electronic messages with an Australian link.
Synopsis
Requires consent, sender identification and a working unsubscribe facility for commercial electronic messages with an Australian link.
Key themes
consent
identify
unsubscribe within 5 business days
address harvesting
Unique features
ACMA actively enforces with large infringement notices.
SaaS relevance
Applies to SaaS marketing emails/SMS to Australian recipients, including transactional messages with marketing content.
Extraterritorial
Yes
Maximum penalty
Up to A$3.3m per day for repeat offenders (corporations)
NDB SchemeNotifiable Data Breaches Scheme (Privacy Act 1988 Part IIIC, inserted by Privacy Amendment (Notifiable Data Breaches) Act 2017)In force In force from Requires APP entities to assess suspected breaches within 30 days and notify the OAIC and affected individuals of eligible breaches likely to cause serious harm.
Synopsis
Requires APP entities to assess suspected breaches within 30 days and notify the OAIC and affected individuals of eligible breaches likely to cause serious harm.
Key themes
eligible data breach
serious harm
30-day assessment
notification statement
remedial action exception
Unique features
No fixed hour deadline; notification 'as soon as practicable' after an eligible breach is confirmed.
SaaS relevance
SaaS holding data covered by the Privacy Act must notify; in shared-custody cases one entity may notify for all.
Extraterritorial
Yes
Breach notification
Assess within 30 days; OAIC and individuals as soon as practicable
Key dates
Adopted
In force
POLA Act 2024 adds ministerial eligible data breach declarations
Social Media Minimum Age ActOnline Safety Amendment (Social Media Minimum Age) Act 2024 (Cth)In force In force from Requires age-restricted social media platforms to take reasonable steps to stop under-16s having accounts. Part 4A of the Online Safety Act adds strict privacy limits on data collected for age assurance, enforced by the OAIC.
Synopsis
Requires age-restricted social media platforms to take reasonable steps to stop under-16s having accounts. Part 4A of the Online Safety Act adds strict privacy limits on data collected for age assurance, enforced by the OAIC.
Key themes
age assurance
under-16 ban
purpose limitation
destruction of age data
no mandatory government ID
Unique features
Information collected for age assurance must be used only for that purpose (unless consented) and destroyed afterwards; platforms cannot insist on government ID alone.
SaaS relevance
Platforms with social features and Australian users, and age-assurance vendors, carry these duties.
Extraterritorial
Yes
Maximum penalty
A$49.5m (corporations)
Key dates
Adopted
In force
Royal assent 2024-12-10; age restriction obligation from 2025-12-10
Children's Online Privacy CodeChildren's Online Privacy Code (to be made under Privacy Act 1988 s 26GC)Bill/proposed An OAIC-developed APP code applying to social media, relevant electronic and designated internet services likely to be accessed by children. Breach of the code will be an interference with privacy.
Synopsis
An OAIC-developed APP code applying to social media, relevant electronic and designated internet services likely to be accessed by children. Breach of the code will be an interference with privacy.
Key themes
children
online services
best interests
APP code
Unique features
Scope keyed to Online Safety Act service categories and 'likely to be accessed by children'.
SaaS relevance
Consumer-facing SaaS/apps likely to have under-18 users will need to comply once registered.
Extraterritorial
Yes
Key dates
Exposure draft 2026-03-31; consultation closed 2026-06-05; must be registered by 2026-12-10
Formally in development by the regulator with a statutory registration deadline, hence included. [Link: OAIC code page; code not yet on Federal Register (exposure draft stage)]
CDRConsumer Data Right (Competition and Consumer Act 2010 Part IVD, inserted by Treasury Laws Amendment (Consumer Data Right) Act 2019)In force In force from Gives consumers the right to direct data holders in designated sectors to share their data with accredited recipients via standardised APIs. Thirteen Privacy Safeguards apply alongside the Privacy Act.
Synopsis
Gives consumers the right to direct data holders in designated sectors to share their data with accredited recipients via standardised APIs. Thirteen Privacy Safeguards apply alongside the Privacy Act.
Key themes
data portability
accreditation
privacy safeguards
consent
data standards
designated sectors
Unique features
Sectoral open-data regime with accreditation and its own privacy safeguards stricter than the APPs.
SaaS relevance
Fintech/energy SaaS wishing to receive CDR data need accreditation or to operate under an accredited provider.
Key dates
Adopted
In force
Banking live July 2020; energy Nov 2022; telecoms designated 2022; non-bank lending from 2026
Partly verifiedMedium confidence.[Link: Competition and Consumer Act 2010 compilation; CDR is Part IVD]
Human rights / constitutional1
Privacy TortStatutory Tort for Serious Invasions of Privacy (Schedule 2, Privacy Act 1988)In force In force from Lets individuals sue for intrusion upon seclusion or misuse of information where there was a reasonable expectation of privacy, the invasion was serious and intentional or reckless, and public interest does not outweigh it.
Synopsis
Lets individuals sue for intrusion upon seclusion or misuse of information where there was a reasonable expectation of privacy, the invasion was serious and intentional or reckless, and public interest does not outweigh it.
Key themes
private right of action
intrusion
misuse of information
public interest balancing
damages
Unique features
Applies regardless of the small business exemption; journalists and some agencies exempt.
SaaS relevance
Creates litigation risk for SaaS whose deliberate or reckless data misuse seriously invades someone's privacy.
Maximum penalty
Damages (non-economic damages capped, aligned with defamation cap); injunctions
Medium confidence. Partly verifiedMedium confidence.Damages cap detail from general knowledge. [Link: Privacy and Other Legislation Amendment Act 2024 (No. 128), Sch 2 inserts Sch 2 tort into Privacy Act; no regulator (courts)]
Partly verifiedMedium confidence.Damages cap detail from general knowledge. [Link: Privacy and Other Legislation Amendment Act 2024 (No. 128), Sch 2 inserts Sch 2 tort into Privacy Act; no regulator (courts)]
Part III
Regional & international frameworks
Membership-based — check ratification status in the instrument record. 13 instruments from 5 bodies.
Commonwealth of Nations
Commonwealth Model LawCommonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy BillIn force In force from A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
Synopsis
A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
Key themes
model legislation
consent
breach handling
cross-border transfers
harmonisation
Unique features
Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.
SaaS relevance
Background only; influences national laws in smaller Commonwealth jurisdictions.
Breach notification
Model provisions on breach investigation
Cross-border transfers
Model grounds for cross-border transfer
Maximum penalty
None (model)
Key dates
Adopted
In force
2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022
Partly verifiedMedium confidence.The text_url is the announcement page; I did not find a direct link to the model law text.
Organisation for Economic Co-operation and Development (OECD)
OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force In force from Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Synopsis
Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Key themes
trustworthy AI
human rights
privacy
transparency
explainability
robustness
accountability
Unique features
It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.
SaaS relevance
Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force In force from The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Synopsis
The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Key themes
government access
national security
law enforcement
legal basis
oversight
redress
transparency
Unique features
It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.
SaaS relevance
Useful reference for transfer impact assessments and for policies on responding to government data demands.
Breach notification
None
DPO
No
Cross-border transfers
Supports trusted data flows between adherents
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force In force from Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Synopsis
Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Key themes
accountability
privacy management programmes
breach notification
enforcement cooperation
interoperability
transborder flows
Unique features
It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.
SaaS relevance
It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.
Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded In force from A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Synopsis
A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Key themes
eight fair information principles
accountability
transborder flows
Unique features
These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.
SaaS relevance
Historical baseline; its principles are reflected in most national laws a SaaS provider meets.
Breach notification
None
DPO
No
Cross-border transfers
Free flow encouraged; restrictions only where proportionate
Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force In force from An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Synopsis
An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Key themes
certification
interoperability
accountability agents
processors
data flows
Unique features
The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.
SaaS relevance
A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
Medium confidence. Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Asia-Pacific Economic Cooperation (APEC)
APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force In force from Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Synopsis
Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Key themes
certification
accountability agents
cross-border enforcement
processors
Unique features
It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).
SaaS relevance
PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
Medium confidence. Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
APEC Privacy FrameworkAPEC Privacy FrameworkIn force In force from A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Synopsis
A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Key themes
preventing harm
notice
choice
accountability
cross-border privacy enforcement
interoperability
Unique features
Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.
SaaS relevance
It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Accountability-based; CBPR system
Maximum penalty
None
Key dates
Adopted
In force
Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
Partly verifiedMedium confidence.I did not re-check the publication URL this session.
United Nations
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.