Belgian Data Protection Law 2018Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal dataIn force In force from Belgium's framework law adapts the GDPR nationally, transposes the Law Enforcement Directive and contains derogations for journalism, research and the intelligence services. The DPA itself is organised by the separate law of 3 December 2017.
Synopsis
Belgium's framework law adapts the GDPR nationally, transposes the Law Enforcement Directive and contains derogations for journalism, research and the intelligence services. The DPA itself is organised by the separate law of 3 December 2017.
Key themes
national GDPR derogations
age of consent
DPO
employee data
criminal offences
supervisory authority powers
Unique features
Age of digital consent (GDPR Art 8): 13. Criminal offences for certain breaches; public bodies cannot receive administrative fines; specific rules on genetic, biometric and health data requiring an extra list of persons with access.
SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
Extraterritorial
Limited
Breach notification
Authority 72h; individuals without undue delay (GDPR Arts 33-34)
DPO
Conditional
Cross-border transfers
GDPR Chapter V (adequacy/SCCs/BCRs)
Maximum penalty
GDPR Art 83: €20m or 4% global turnover; criminal fines under Title 6; no administrative fines on public authorities
Key dates
Adopted
In force
Supervisory authority created separately by Law of 3 December 2017 establishing the Data Protection Authority
Partly verifiedMedium confidence.ELI numac for the 2018 law not independently fetched.
Historic & pending (1)
Privacy Law 1992Law of 8 December 1992 on the protection of privacy in relation to the processing of personal dataRepealed/superseded In force from Belgium's general data protection law for about 26 years. It was repealed by the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, which entered into force on 5 September 2018, after the GDPR had applied directly from 25 May 2018.
Synopsis
Belgium's general data protection law for about 26 years. It was repealed by the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, which entered into force on 5 September 2018, after the GDPR had applied directly from 25 May 2018.
Key themes
protection of privacy
processing of personal data
Unique features
Remained on the books alongside the GDPR from 25 May to 5 September 2018.
SaaS relevance
Historical only; replaced by the Law of 30 July 2018 (see be-dpa-2018) and the GDPR.
Breach notification
None
DPO
No
Key dates
Adopted
In force
Ended
Law of 8 December 1992, published in the Moniteur belge on 18 March 1993; under article 52 each provision entered into force on a date set by the King and at the latest by a long-stop (first day of the 18th month after publication, i.e. 1 September 1994, later extended to the 24th month by a law of 30 June 1994); five articles (6, 8, 9, 17, 18) were still not in force in mid-1994; heavily amended by the law of 11 December 1998, whose amendments took effect on 1 September 2001; repealed by the Law of 30 July 2018, in force 5 September 2018
Low confidence. Partly verifiedLow confidence.date_in_force is given as 1994 because a June 1994 parliamentary report (seen via search) says that by the 1 September 1994 long-stop all but five articles were in force; the exact commencing decrees were not found, so earlier staged commencement is possible. Publication date 18 March 1993 is from the same search results. The 1 September 2001 date for the 1998 amendments comes from a search-result summary of a coordinated text. text_url is a January 2006 coordinated version hosted by the AFAPDP (association of francophone data protection authorities), not the Moniteur original.
Partly verifiedLow confidence.date_in_force is given as 1994 because a June 1994 parliamentary report (seen via search) says that by the 1 September 1994 long-stop all but five articles were in force; the exact commencing decrees were not found, so earlier staged commencement is possible. Publication date 18 March 1993 is from the same search results. The 1 September 2001 date for the 1998 amendments comes from a search-result summary of a coordinated text. text_url is a January 2006 coordinated version hosted by the AFAPDP (association of francophone data protection authorities), not the Moniteur original.
ePrivacy / marketing1
LCE / WECLaw of 13 June 2005 on electronic communications (Article 10/2 on cookies) and Code of Economic Law Book XII (e-marketing)In force In force from Belgium's Electronic Communications Act requires prior consent for non-essential cookies and similar technologies. Unsolicited electronic marketing is governed by the Code of Economic Law with an opt-in rule and limited soft opt-in.
Synopsis
Belgium's Electronic Communications Act requires prior consent for non-essential cookies and similar technologies. Unsolicited electronic marketing is governed by the Code of Economic Law with an opt-in rule and limited soft opt-in.
Key themes
cookies/terminal equipment consent
direct marketing
soft opt-in
traffic and location data
Unique features
The Belgian DPA has taken the lead on cookie enforcement and has issued detailed cookie guidance; Belgium also hosted the IAB Europe TCF decision.
SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
Extraterritorial
Yes
Breach notification
Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
DPO
No
Cross-border transfers
None
Maximum penalty
Criminal/administrative fines under LCE and CEL; GDPR fines via APD
Key dates
Adopted
In force
Cookie rule formerly Art 129, moved to Art 10/2 in 2022 by the law transposing the EECC; e-mail marketing under Code of Economic Law Art XII.13 and Royal Decree of 4 April 2003
Partly verifiedLow confidence.Article renumbering (129 to 10/2) from memory; verify.
Part II
Also applies here
Inherited from the European Union.
Comprehensive data protection6
EUDPRRegulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agenciesIn force In force from Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
Synopsis
Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
Key themes
EU institutions
EDPS
DPO
processors
transfers
administrative fines
Unique features
The EDPS can fine EU institutions directly. The EDPS investigated the European Commission's use of Microsoft 365 under this law.
SaaS relevance
Applies when a SaaS provider is a processor for an EU institution or agency: Art 29 processor terms and transfer rules apply.
Extraterritorial
No
Breach notification
EDPS 72h; individuals if high risk
DPO
Yes
Cross-border transfers
Adequacy/SCCs/derogations
Maximum penalty
€50,000 per infringement / €500,000 per year (fines on EU bodies)
Key dates
Adopted
In force
Applies from 2018-12-11 (operational personal data rules for Eurojust/EPPO etc. phased)
GDPRRegulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)In force In force from The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
Synopsis
The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
Key themes
principles
lawful bases
consent
data subject rights
accountability
DPIA
DPO
processor contracts (Art 28)
breach notification
cross-border transfers
one-stop-shop
Unique features
Global benchmark with broad extraterritorial reach (Art 3(2)), turnover-based fines and the one-stop-shop enforcement model.
SaaS relevance
Applies to any SaaS provider established in the EU or offering services to, or monitoring, people in the EU, whether as controller or as processor under Art 28.
Extraterritorial
Yes
Breach notification
Authority within 72h; individuals without undue delay if high risk
DPO
Conditional
Cross-border transfers
Adequacy/SCCs/BCRs/derogations
Maximum penalty
€20m or 4% worldwide annual turnover
Key dates
Adopted
In force
Applies from 2018-05-25. Supplemented by the GDPR Procedural Regulation (EU) 2025/2518 (applies 2027-04-02). Targeted amendments are proposed in the Digital Omnibus COM(2025) 837 (pending as of Oct 2026). Incorporated into the EEA from 2018-07-20.
The Digital Omnibus may change the definition of personal data, breach notification (high-risk only, 96h, single entry point) and AI-related legitimate interest. It was not adopted as of Oct 2026; see the separate row.
GDPR Procedural RegulationRegulation (EU) 2025/2518 laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679Enacted – not yet in force In force from Harmonises how supervisory authorities handle cross-border GDPR complaints and investigations. It covers admissibility of complaints, the parties' right to be heard and access to the file, timelines, early resolution, and how lead and concerned authorities cooperate and settle disputes.
Synopsis
Harmonises how supervisory authorities handle cross-border GDPR complaints and investigations. It covers admissibility of complaints, the parties' right to be heard and access to the file, timelines, early resolution, and how lead and concerned authorities cooperate and settle disputes.
Key themes
one-stop-shop
complaint handling
right to be heard
access to file
investigation deadlines
dispute resolution
Unique features
It sets binding procedural deadlines for cross-border investigations and gives companies under investigation harmonised defence rights.
SaaS relevance
Shapes how a SaaS provider with an EU main establishment would be investigated in a cross-border GDPR case from April 2027.
Breach notification
None
Maximum penalty
As GDPR
Key dates
Adopted
In force
Published in OJ 2025-12-12; entered into force 2026-01-01; applies from 2027-04-02
Medium confidence. Partly verifiedMedium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.
Partly verifiedMedium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.
Historic & pending (3)
Digital Omnibus (data)Proposal for a Regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus)Bill/proposed A Commission proposal to simplify EU digital rules. For the GDPR it would clarify that data is not personal for an entity that cannot reasonably identify the person, limit breach notification to high-risk breaches with a 96-hour deadline and a single EU reporting entry point, and recognise legitimate interest for AI development. It would also move cookie consent rules from the ePrivacy Directive into the GDPR, and merge the DGA and Free Flow Regulation into the Data Act.
Synopsis
A Commission proposal to simplify EU digital rules. For the GDPR it would clarify that data is not personal for an entity that cannot reasonably identify the person, limit breach notification to high-risk breaches with a 96-hour deadline and a single EU reporting entry point, and recognise legitimate interest for AI development. It would also move cookie consent rules from the ePrivacy Directive into the GDPR, and merge the DGA and Free Flow Regulation into the Data Act.
Key themes
definition of personal data
pseudonymisation
breach notification 96h
single entry point
cookies
AI legitimate interest
Data Act consolidation
Unique features
It is the first substantive amendment proposal to the GDPR since 2016. The EDPB and EDPS have criticised the change to the definition of personal data.
SaaS relevance
If adopted, it would change SaaS breach-reporting timelines, cookie consent design and the legal basis analysis for training AI on customer data.
Extraterritorial
Yes
Breach notification
Proposed: authority 96h, high-risk breaches only, via single entry point
Key dates
Adopted
Commission proposal COM(2025) 837 of 2025-11-19. Council compromise texts June–Oct 2026 (doc 13886/26 of 2026-10-02); Coreper mandate not confirmed as of 2026-10-12. EP ITRE/LIBE draft report 2026-06-22, no committee vote by mid-Sept 2026. Trilogues not started. The separate AI omnibus was adopted as Regulation (EU) 2026/1744.
Medium confidence. Partly verifiedMedium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.
Partly verifiedMedium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.
Regulation 45/2001 (EU institutions)Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodiesRepealed/superseded In force from Regulation 45/2001 applied data protection rules, modelled on Directive 95/46/EC, to the Community institutions and bodies, and set up the European Data Protection Supervisor as an independent supervisory authority for them. Regulation (EU) 2018/1725 repealed it with effect from 11 December 2018 and references to it were then read as references to the new Regulation.
Synopsis
Regulation 45/2001 applied data protection rules, modelled on Directive 95/46/EC, to the Community institutions and bodies, and set up the European Data Protection Supervisor as an independent supervisory authority for them. Regulation (EU) 2018/1725 repealed it with effect from 11 December 2018 and references to it were then read as references to the new Regulation.
Key themes
EU institutions
EDPS
supervision
data subject rights
Unique features
Created the European Data Protection Supervisor. Binding in its entirety and directly applicable.
SaaS relevance
Historical only; replaced by Regulation (EU) 2018/1725 (EUDPR).
Breach notification
None
Cross-border transfers
Rules on transfers to third countries
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 18 December 2000; published 12 January 2001; in force on the twentieth day after publication (1 February 2001); repealed with effect from 11 December 2018 by Regulation (EU) 2018/1725
In force date is the 20th day after the 12 January 2001 publication (Article 51). Repeal date from Article 99 of Regulation 2018/1725. The DPO field is left empty because it was not checked in the text.
Data Protection DirectiveDirective 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such dataRepealed/superseded In force from The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
Synopsis
The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
Key themes
lawful grounds
sensitive data
data subject rights
DPA notification
adequacy
Unique features
It created the adequacy concept and the Article 29 Working Party. It was the basis for the Safe Harbor decision that was annulled in Schrems I.
SaaS relevance
Historical; its adequacy decisions stayed in force under GDPR Art 45(9) until amended or repealed.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Adequacy; SCCs; BCRs
Maximum penalty
Set by national law
Key dates
Adopted
In force
Ended
Transposition deadline 1998-10-24; repealed by GDPR with effect from 2018-05-25
DSARegulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act)In force In force from Sets layered obligations for intermediary services (mere conduit, caching, hosting, online platforms) on illegal content, notice and action, transparency and user protection. Very large platforms and search engines also have systemic risk duties. It includes privacy-relevant bans on targeted ads to minors and on ads based on sensitive data profiling.
Synopsis
Sets layered obligations for intermediary services (mere conduit, caching, hosting, online platforms) on illegal content, notice and action, transparency and user protection. Very large platforms and search engines also have systemic risk duties. It includes privacy-relevant bans on targeted ads to minors and on ads based on sensitive data profiling.
Key themes
notice and action
transparency reporting
ad transparency
profiling restrictions
minors
dark patterns
systemic risk
Unique features
It bans online platforms from showing ads based on profiling with special-category data, and from profiling-based ads to minors (Arts 26(3), 28(2)). It also bans dark patterns (Art 25).
SaaS relevance
A SaaS product that hosts user content is a 'hosting service' and needs notice-and-action and transparency measures. Platform duties apply if it disseminates user content to the public (micro and small enterprises are exempt from some duties).
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
6% of worldwide annual turnover
Key dates
Adopted
In force
VLOP/VLOSE obligations from four months after designation (first designations 2023-04-25); fully applicable 2024-02-17
TTPARegulation (EU) 2024/900 on the transparency and targeting of political advertisingIn force In force from Requires political ads to be labelled and accompanied by transparency notices, and sets due-diligence duties for political advertising publishers. It strictly limits targeting and ad-delivery techniques that use personal data: these need explicit consent, cannot use special-category profiling, and cannot target people known to be under voting age plus one year.
Synopsis
Requires political ads to be labelled and accompanied by transparency notices, and sets due-diligence duties for political advertising publishers. It strictly limits targeting and ad-delivery techniques that use personal data: these need explicit consent, cannot use special-category profiling, and cannot target people known to be under voting age plus one year.
Key themes
political advertising
transparency notices
targeting restrictions
explicit consent
special category data
ad repository
Unique features
Its targeting ban goes beyond the GDPR and is enforced by DPAs. Several large platforms stopped political advertising in the EU in response.
SaaS relevance
Applies to ad-tech and marketing SaaS used for political campaigns; such platforms must handle consent, transparency notices and repository duties.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
DPAs: GDPR-level fines for targeting breaches; others up to 6% of provider's turnover
Key dates
Adopted
In force
Most provisions apply from 2025-10-10 (some non-discrimination provisions applied earlier); implementing acts on labels (2025-07-09) and the European repository (2026-04-09)
Medium confidence. Partly verifiedMedium confidence.The penalty figure and adoption date come from established references and were not re-checked this session.
Partly verifiedMedium confidence.The penalty figure and adoption date come from established references and were not re-checked this session.
ePrivacy DirectiveDirective 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive)In force In force from Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
Synopsis
Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
Key themes
cookies
device access
confidentiality of communications
traffic and location data
direct marketing
spam
Unique features
Art 5(3) applies to any information stored on terminal equipment, personal or not, which is why the EU has cookie banners. Each member state enforces it differently.
SaaS relevance
Any SaaS website or app that sets non-essential cookies or SDKs on EU users' devices, or sends marketing emails, must comply.
Extraterritorial
Limited
Breach notification
Telecoms providers: authority within 24h under Reg 611/2013
DPO
No
Cross-border transfers
None
Maximum penalty
Set by national law
Key dates
Adopted
In force
Amended by Directive 2006/24/EC (Data Retention, annulled 2014) and Directive 2009/136/EC (cookie consent; transposition 2011-05-25). The proposed ePrivacy Regulation COM(2017) 10 was abandoned: the Commission announced withdrawal in its 2025 work programme (2025-02-11). The Digital Omnibus proposes amending Art 5(3) cookie rules (pending).
I did not confirm the Official Journal publication of the formal withdrawal of the ePrivacy Regulation. The Council's Oct 2026 Omnibus draft keeps cookie rules in Art 5(3) with six consent exemptions.
Telecoms Privacy Directive 97/66Directive 97/66/EC concerning the processing of personal data and the protection of privacy in the telecommunications sectorRepealed/superseded In force from Directive 97/66/EC harmonised national rules on privacy and data protection in the telecommunications sector. It was a sector-specific complement to Directive 95/46/EC and dealt with matters such as the confidentiality of communications, traffic and billing data, itemised billing, calling-line identification, automatic call forwarding, subscriber directories and unsolicited calls. Directive 2002/58/EC repealed it with effect from 31 October 2003, and references to it were then read as references to the 2002 Directive.
Synopsis
Directive 97/66/EC harmonised national rules on privacy and data protection in the telecommunications sector. It was a sector-specific complement to Directive 95/46/EC and dealt with matters such as the confidentiality of communications, traffic and billing data, itemised billing, calling-line identification, automatic call forwarding, subscriber directories and unsolicited calls. Directive 2002/58/EC repealed it with effect from 31 October 2003, and references to it were then read as references to the 2002 Directive.
Key themes
confidentiality of communications
traffic and billing data
telecoms subscribers
directories
unsolicited calls
Unique features
The first EU instrument on telecoms privacy. It was written for traditional telecommunications networks, which is why it was replaced by a technology-neutral successor.
SaaS relevance
Historical only; replaced by Directive 2002/58/EC (ePrivacy Directive).
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 15 December 1997; published in the Official Journal 30 January 1998; Member States had to apply national laws by 24 October 1998; repealed with effect from 31 October 2003 by Directive 2002/58/EC
The Directive text contains no entry-into-force article of its own, so date_in_force is set to the 24 October 1998 deadline for national implementation (Article 15). Repeal date taken from Articles 17(1) and 19 of Directive 2002/58/EC (transposition deadline 'before 31 October 2003'). Penalties were left to Member States.
EHDSRegulation (EU) 2025/327 on the European Health Data SpacePartially in force In force from Gives individuals stronger rights to access and control their electronic health data and makes it portable across the EU through MyHealth@EU. It sets requirements for electronic health record systems, and creates a permit-based framework for secondary use of health data for research, innovation and policy.
Synopsis
Gives individuals stronger rights to access and control their electronic health data and makes it portable across the EU through MyHealth@EU. It sets requirements for electronic health record systems, and creates a permit-based framework for secondary use of health data for research, innovation and policy.
Key themes
patient access
EHR interoperability
EHR system certification
secondary use
data permits
health data access bodies
Unique features
It has a self-certification and CE-like regime for EHR systems, and lets individuals opt out of secondary use.
SaaS relevance
Health-tech SaaS that is an EHR system or a wellness app claiming interoperability faces product requirements. Holders of health data may have to make it available for secondary use.
Extraterritorial
Yes
Breach notification
As GDPR
Cross-border transfers
Restrictions on non-personal electronic health data transfers; GDPR for personal data
Maximum penalty
Set by national law (with ceilings for secondary use breaches)
Key dates
Adopted
In force
Published in OJ 2025-03-05; in force 2025-03-26. Primary use (Ch II–III) from 2027-03-26; EHR system manufacturer obligations 2028-03-26; secondary use (Ch IV) 2029-03-26; further categories up to 2031.
AI ActRegulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)Partially in force In force from A risk-based product-safety style regulation of AI. It bans certain practices, imposes conformity, data governance, logging, transparency and human oversight duties on high-risk systems, sets transparency duties for chatbots and generative content, and adds obligations for general-purpose AI model providers. Deployers also have duties, including fundamental rights impact assessments for some.
Synopsis
A risk-based product-safety style regulation of AI. It bans certain practices, imposes conformity, data governance, logging, transparency and human oversight duties on high-risk systems, sets transparency duties for chatbots and generative content, and adds obligations for general-purpose AI model providers. Deployers also have duties, including fundamental rights impact assessments for some.
Key themes
prohibited practices
high-risk systems
conformity assessment
GPAI
transparency
human oversight
AI literacy
FRIA
Unique features
It is the first comprehensive horizontal AI law. It applies to providers and deployers whatever their location if output is used in the EU, and phases obligations in over 2025–2028.
SaaS relevance
SaaS that embeds AI features carries provider or deployer duties: transparency for chatbots and generated content, AI literacy, and full high-risk compliance if used in Annex III areas such as HR or credit.
Extraterritorial
Yes
Breach notification
Serious incident reporting for high-risk systems to market surveillance authorities (Art 73)
DPO
No
Cross-border transfers
None
Maximum penalty
€35m or 7% worldwide turnover (prohibited practices)
Key dates
Adopted
In force
Prohibitions and AI literacy 2025-02-02; GPAI and governance 2025-08-02; general application and Art 50 transparency 2026-08-02. Amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (in force 2026-07-27): Annex III high-risk obligations postponed to 2027-12-02; Annex I (product) high-risk to 2028-08-02; new prohibition on non-consensual intimate imagery/CSAM generation and a 2026-12-02 grace date for Art 50(2) for generative systems already on the market.
NIS2Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)In force In force from Requires essential and important entities in listed sectors, including cloud computing, data centres, managed service providers and digital providers, to take cybersecurity risk-management measures and report significant incidents. It makes management bodies accountable and sets supervision and fines.
Synopsis
Requires essential and important entities in listed sectors, including cloud computing, data centres, managed service providers and digital providers, to take cybersecurity risk-management measures and report significant incidents. It makes management bodies accountable and sets supervision and fines.
Key themes
risk management
incident reporting
supply chain security
management liability
registration
supervision
Unique features
Size-cap rule (medium and large entities in scope), with some digital infrastructure entities caught whatever their size. Management bodies can be held personally liable.
SaaS relevance
Medium or large SaaS, cloud and managed service providers fall in scope as 'ICT service management' or 'digital infrastructure' entities, and NIS2 duties also flow down to SaaS suppliers through customers' supply chain requirements.
Extraterritorial
Limited
Breach notification
CSIRT/authority: early warning 24h; incident notification 72h; final report 1 month
DPO
No
Cross-border transfers
None
Maximum penalty
Essential: €10m or 2% turnover; Important: €7m or 1.4%
Key dates
Adopted
In force
Transposition deadline 2024-10-17; applies from 2024-10-18 (many member states transposed late); Implementing Regulation (EU) 2024/2690 covers digital providers. A further targeted amendment was proposed in the 2025–26 digital simplification package.
DORARegulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)In force In force from Harmonises ICT risk management, incident reporting, resilience testing and ICT third-party risk management for EU financial entities. It also creates a direct oversight regime for critical ICT third-party service providers.
Synopsis
Harmonises ICT risk management, incident reporting, resilience testing and ICT third-party risk management for EU financial entities. It also creates a direct oversight regime for critical ICT third-party service providers.
Key themes
ICT risk management
major incident reporting
resilience testing (TLPT)
third-party risk
register of information
contractual clauses (Art 30)
Unique features
Lead overseers can directly supervise critical ICT providers. Art 30 specifies mandatory contract terms for ICT services.
SaaS relevance
A SaaS provider serving EU financial entities must accept DORA contract clauses, audit rights, exit plans and incident cooperation, and may be designated as critical.
Extraterritorial
Yes
Breach notification
Financial entities: initial report within 4h of classification / 24h of awareness; intermediate 72h; final 1 month
DPO
No
Cross-border transfers
Critical providers must have EU subsidiary
Maximum penalty
Set by national law for financial entities; periodic penalties up to 1% daily worldwide turnover for critical ICT providers
Key dates
Adopted
In force
Applies from 2025-01-17; first critical ICT third-party providers designated in 2025
Partly verifiedMedium confidence.The incident reporting timelines come from the RTS/ITS and I did not re-verify them this session.
CRARegulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)Partially in force In force from Sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Requirements include secure-by-design, vulnerability handling, security updates over a support period, an SBOM and CE marking. Manufacturers must report actively exploited vulnerabilities and severe incidents.
Synopsis
Sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Requirements include secure-by-design, vulnerability handling, security updates over a support period, an SBOM and CE marking. Manufacturers must report actively exploited vulnerabilities and severe incidents.
Key themes
secure by design
vulnerability handling
SBOM
security updates
CE marking
incident reporting
Unique features
It extends CE-marking to software. Pure SaaS is generally excluded unless it is a 'remote data processing solution' that a product needs to function.
SaaS relevance
Applies where SaaS is the remote data processing back-end for a product with digital elements, or where the provider also ships downloadable or on-prem software or apps.
Extraterritorial
Yes
Breach notification
ENISA/CSIRT: early warning 24h; notification 72h; final report 14 days (vulns) / 1 month (incidents)
DPO
No
Cross-border transfers
None
Maximum penalty
€15m or 2.5% worldwide turnover
Key dates
Adopted
In force
Conformity assessment body provisions 2026-06-11; manufacturer reporting of actively exploited vulnerabilities and severe incidents 2026-09-11; full application 2027-12-11
NIS Directive (NIS1)NIS Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systemsRepealed/superseded In force from Directive (EU) 2016/1148 was the first EU-wide cybersecurity law. It required Member States to adopt a national network and information security strategy, set up national authorities and computer security incident response teams, and impose security and incident notification duties on operators of essential services and on digital service providers. Directive (EU) 2022/2555 (NIS2) repealed it with effect from 18 October 2024.
Synopsis
Directive (EU) 2016/1148 was the first EU-wide cybersecurity law. It required Member States to adopt a national network and information security strategy, set up national authorities and computer security incident response teams, and impose security and incident notification duties on operators of essential services and on digital service providers. Directive (EU) 2022/2555 (NIS2) repealed it with effect from 18 October 2024.
Key themes
network and information security
operators of essential services
digital service providers
incident notification
Unique features
Left Member States to identify operators of essential services; NIS2 replaced this with size-based scope.
SaaS relevance
Historical only; replaced by NIS2 (Directive (EU) 2022/2555).
Breach notification
Incident notification to the competent authority or CSIRT (Member State rules)
DPO
No
Cross-border transfers
Cooperation Group and CSIRTs network
Maximum penalty
Set by Member States ('effective, proportionate and dissuasive')
Key dates
Adopted
In force
Ended
Adopted 6 July 2016; published 19 July 2016; in force 8 August 2016; Member States to apply by 9 May 2018; repealed with effect from 18 October 2024 by Directive (EU) 2022/2555 (NIS2)
In force date is the 20th day after the 19 July 2016 publication (Article 26). Repeal date from Article 44 of NIS2. Scope, breach and penalty fields are summarised from the Directive's structure and were not read in full.
EU–US DPFCommission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy FrameworkIn force In force from Finds that US organisations self-certified to the Data Privacy Framework provide adequate protection, so personal data can flow to them from the EU without further transfer tools. It relies on US Executive Order 14086, which limits signals intelligence and created a redress mechanism including the Data Protection Review Court.
Synopsis
Finds that US organisations self-certified to the Data Privacy Framework provide adequate protection, so personal data can flow to them from the EU without further transfer tools. It relies on US Executive Order 14086, which limits signals intelligence and created a redress mechanism including the Data Protection Review Court.
Key themes
adequacy
self-certification
EO 14086
Data Protection Review Court
PCLOB
redress
Unique features
This is the third EU–US arrangement, after Safe Harbor and Privacy Shield, both struck down. It was upheld at first instance in Latombe, and a CJEU appeal plus a possible Schrems III challenge are pending.
SaaS relevance
A US SaaS provider (or sub-processor) that self-certifies can receive EU data without SCCs; non-certified providers still need SCCs and a TIA.
Breach notification
None
DPO
No
Cross-border transfers
Adequacy for DPF-certified US organisations
Maximum penalty
FTC/DoT enforcement under US law
Key dates
Adopted
In force
First periodic review in 2024. General Court dismissed the annulment action in Latombe v Commission (T-553/23) on 2025-09-03; appeal C-703/25 P lodged 2025-10-31 and pending at the CJEU as of Oct 2026.
EU SCCs 2021Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countriesIn force In force from Adopts modular standard contractual clauses (controller-to-controller, controller-to-processor, processor-to-processor, processor-to-controller) as an appropriate safeguard under GDPR Art 46. They require parties to assess third-country laws and practices (a transfer impact assessment) in line with Schrems II.
Synopsis
Adopts modular standard contractual clauses (controller-to-controller, controller-to-processor, processor-to-processor, processor-to-controller) as an appropriate safeguard under GDPR Art 46. They require parties to assess third-country laws and practices (a transfer impact assessment) in line with Schrems II.
Key themes
SCCs
modules
transfer impact assessment
government access
docking clause
onward transfers
Unique features
The modular design covers processor-to-processor chains, and they include an Art 28-compliant processor contract. A Schrems II-style warranty on local laws is built in.
SaaS relevance
The default transfer tool when SaaS providers or sub-processors outside the EU and outside adequate countries process EU personal data.
Breach notification
Importer must notify exporter (and authority where relevant) of breaches
Cross-border transfers
SCCs (Art 46(2)(c) GDPR)
Maximum penalty
As GDPR
Key dates
Adopted
In force
Old SCCs could not be used for new contracts after 2021-09-27 and had to be replaced by 2022-12-27. The Commission has been preparing additional SCCs for importers already subject to the GDPR under Art 3(2) (not adopted as of last check).
Free Flow of Non-Personal Data RegulationRegulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European UnionIn force In force from Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
Synopsis
Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
Key themes
anti-localisation
regulatory data access
porting
cloud codes of conduct
Unique features
It is the counterpart to the GDPR's free movement principle for non-personal data, and produced the SWIPO codes on switching.
SaaS relevance
Lets SaaS providers store non-personal data anywhere in the EU, free of national localisation rules.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
Prohibits intra-EU localisation of non-personal data
Maximum penalty
None
Key dates
Adopted
In force
Applies from 2019-05-28. Digital Omnibus proposes merging into the Data Act (pending).
EU–US Privacy ShieldCommission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU–U.S. Privacy ShieldRepealed/superseded In force from Implementing Decision 2016/1250 found, under Directive 95/46/EC, that the EU–U.S. Privacy Shield ensured an adequate level of protection for personal data transferred from the EU to certified organisations in the United States. It replaced the Safe Harbour decision that the Court of Justice had invalidated in 2015. The Court of Justice struck the Decision down on 16 July 2020 in Schrems II (C-311/18), because of inadequate protection against US government surveillance. Standard contractual clauses stayed available.
Synopsis
Implementing Decision 2016/1250 found, under Directive 95/46/EC, that the EU–U.S. Privacy Shield ensured an adequate level of protection for personal data transferred from the EU to certified organisations in the United States. It replaced the Safe Harbour decision that the Court of Justice had invalidated in 2015. The Court of Justice struck the Decision down on 16 July 2020 in Schrems II (C-311/18), because of inadequate protection against US government surveillance. Standard contractual clauses stayed available.
Key themes
adequacy
transfers to the US
self-certification
government access
ombudsperson
Unique features
Wikipedia mentions an Ombudsperson mechanism for surveillance concerns; its terms were not checked in the Decision text.
SaaS relevance
Historical only; invalidated in 2020. Replaced in practice by standard contractual clauses and, from 2023, the EU–US Data Privacy Framework.
Extraterritorial
Applied to US organisations that self-certified
Breach notification
None
DPO
No
Cross-border transfers
Allowed transfers to certified US organisations
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 12 July 2016; published 1 August 2016; declared invalid by the Court of Justice on 16 July 2020 (Schrems II, Case C-311/18)
End date confirmed from the judgment: Schrems II (C-311/18), Grand Chamber, 16 July 2020, operative part point 5: Implementing Decision (EU) 2016/1250 'is invalid'. In force date is the adoption date (12 July 2016) as given by Wikipedia; the Decision text read gives only adoption and publication (1 August 2016). Wikipedia mention of an Ombudsperson was not checked against the Decision.
EU SCCs 2010 (C2P)Commission Decision 2010/87/EU on standard contractual clauses for the transfer of personal data to processors established in third countriesRepealed/superseded In force from Decision 2010/87/EU set standard contractual clauses for transfers from an EU controller to a processor in a third country under Directive 95/46/EC, replacing Decision 2002/16/EC from 15 May 2010. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
Synopsis
Decision 2010/87/EU set standard contractual clauses for transfers from an EU controller to a processor in a third country under Directive 95/46/EC, replacing Decision 2002/16/EC from 15 May 2010. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
Key themes
standard contractual clauses
controller-to-processor transfers
Unique features
Replaced the 2002 processor clauses from 15 May 2010.
SaaS relevance
Historical only; replaced by the 2021 standard contractual clauses (Decision (EU) 2021/914).
Breach notification
None
DPO
No
Cross-border transfers
Contractual safeguard for transfers to processors outside the EU
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 5 February 2010; applied from 15 May 2010; repealed with effect from 27 September 2021 by Decision (EU) 2021/914; contracts signed before that date remained valid until 27 December 2022
EU SCCs 2002 (C2P)Commission Decision 2002/16/EC on standard contractual clauses for the transfer of personal data to processors established in third countriesRepealed/superseded In force from Decision 2002/16/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a processor in a third country. Decision 2010/87/EU repealed it with effect from 15 May 2010. Contracts concluded under it before that date remained in force and effect for as long as the transfers and processing stayed unchanged.
Synopsis
Decision 2002/16/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a processor in a third country. Decision 2010/87/EU repealed it with effect from 15 May 2010. Contracts concluded under it before that date remained in force and effect for as long as the transfers and processing stayed unchanged.
Key themes
standard contractual clauses
controller-to-processor transfers
transfers to third countries
Unique features
The first EU model clauses for processors outside the EU.
SaaS relevance
Historical only; replaced by Decision 2010/87/EU, itself replaced in 2021.
Breach notification
None
DPO
No
Cross-border transfers
Contractual safeguard for transfers to processors outside the EU
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 27 December 2001; applied from 3 April 2002; repealed with effect from 15 May 2010 by Decision 2010/87/EU; contracts made before that date stayed valid while the processing remained unchanged
EU SCCs 2001 (C2C)Commission Decision 2001/497/EC on standard contractual clauses for the transfer of personal data to third countries (controller to controller)Repealed/superseded In force from Decision 2001/497/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a controller in a third country. Decision 2004/915/EC added an alternative second set of clauses from 1 April 2005. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
Synopsis
Decision 2001/497/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a controller in a third country. Decision 2004/915/EC added an alternative second set of clauses from 1 April 2005. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
Key themes
standard contractual clauses
controller-to-controller transfers
transfers to third countries
Unique features
The first set of EU standard contractual clauses. Decision 2004/915/EC let exporters choose between two sets of clauses.
SaaS relevance
Historical only; replaced by the 2021 standard contractual clauses (Decision (EU) 2021/914).
Breach notification
None
DPO
No
Cross-border transfers
Contractual safeguard for transfers outside the EU
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 15 June 2001; applied from 3 September 2001; amended by Decision 2004/915/EC (alternative set of clauses, applied from 1 April 2005); repealed with effect from 27 September 2021 by Decision (EU) 2021/914; contracts signed before that date remained valid until 27 December 2022
EU–US Safe HarbourCommission Decision 2000/520/EC on the adequacy of the Safe Harbour privacy principlesRepealed/superseded In force from Decision 2000/520/EC found, under Article 25 of Directive 95/46/EC, that US organisations adhering to the Safe Harbour privacy principles and the related frequently asked questions issued by the US Department of Commerce provided adequate protection. US companies self-certified to the Department of Commerce, and EU personal data could then be transferred to them without further safeguards. The Court of Justice declared the Decision invalid on 6 October 2015 in Schrems (C-362/14).
Synopsis
Decision 2000/520/EC found, under Article 25 of Directive 95/46/EC, that US organisations adhering to the Safe Harbour privacy principles and the related frequently asked questions issued by the US Department of Commerce provided adequate protection. US companies self-certified to the Department of Commerce, and EU personal data could then be transferred to them without further safeguards. The Court of Justice declared the Decision invalid on 6 October 2015 in Schrems (C-362/14).
Key themes
adequacy
transfers to the US
self-certification
seven privacy principles
Unique features
A self-certification scheme, not a US statute. Only organisations under the jurisdiction of the Federal Trade Commission or the Department of Transportation could join.
SaaS relevance
Historical only; invalidated in 2015 and replaced by the EU–US Privacy Shield, then by the EU–US Data Privacy Framework.
Extraterritorial
Applied to US organisations that self-certified
Breach notification
None
DPO
No
Cross-border transfers
Allowed transfers to self-certified US organisations
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 26 July 2000; published 25 August 2000; Member States to comply within 90 days of notification; the Commission's 2013 Communication dates the 'establishment of Safe Harbour' to 2000; declared invalid by the Court of Justice on 6 October 2015 (Schrems, Case C-362/14)
date_in_force is the year only. No official source read gives the exact start: Article 5 gives Member States 90 days from notification (notification date not found), and COM(2013) 847 refers only to 'the establishment of Safe Harbour in 2000'. The Commission staff working documents of 2002 and 2004 could not be retrieved from publications.europa.eu. End date confirmed from the judgment: Schrems (C-362/14), Grand Chamber, 6 October 2015, operative part: 'Decision 2000/520 is invalid'.
DMARegulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act)In force In force from Imposes conduct obligations on designated gatekeepers' core platform services. It bans combining or cross-using personal data across services without GDPR-valid consent, requires data portability and business-user data access, and requires disclosure of consumer profiling techniques for independent audit.
Synopsis
Imposes conduct obligations on designated gatekeepers' core platform services. It bans combining or cross-using personal data across services without GDPR-valid consent, requires data portability and business-user data access, and requires disclosure of consumer profiling techniques for independent audit.
Key themes
gatekeepers
data combination consent
portability
business user data access
interoperability
profiling audit
Unique features
Art 5(2) imposes a consent requirement for data combination that goes beyond GDPR legitimate interest. Fines are up to 10% of turnover, 20% for repeat infringement.
SaaS relevance
It mainly gives business users rights; a SaaS provider gains data access and portability rights against gatekeeper platforms rather than having obligations, unless designated.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
10% worldwide turnover (20% repeat)
Key dates
Adopted
In force
Applies from 2023-05-02; first gatekeepers designated 2023-09-06; compliance from 2024-03-07
DGARegulation (EU) 2022/868 on European data governance (Data Governance Act)In force In force from Creates a framework for re-using certain protected public-sector data. It sets up a notification and neutrality regime for data intermediation services, and a voluntary registration regime for data altruism organisations.
Synopsis
Creates a framework for re-using certain protected public-sector data. It sets up a notification and neutrality regime for data intermediation services, and a voluntary registration regime for data altruism organisations.
Key themes
public sector data re-use
data intermediation services
data altruism
neutrality
international transfers of non-personal data
Unique features
It regulates 'data intermediaries' as a new kind of neutral market actor, and restricts transfers of protected non-personal data to third countries.
SaaS relevance
Applies if a SaaS platform's main purpose is to intermediate data-sharing between holders and users (notification and structural separation required).
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Restrictions on transfers of protected non-personal public-sector data
Maximum penalty
Set by national law
Key dates
Adopted
In force
Applies from 2023-09-24. The Digital Omnibus proposes folding DGA provisions into the Data Act (pending).
Data ActRegulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)Partially in force In force from Gives users of connected products and related services the right to access and share the data those products generate. It sets fair terms for B2B data sharing, allows public bodies to access data in exceptional need, and requires cloud and other data processing services to enable switching and interoperability. It also restricts unlawful third-country government access to non-personal data.
Synopsis
Gives users of connected products and related services the right to access and share the data those products generate. It sets fair terms for B2B data sharing, allows public bodies to access data in exceptional need, and requires cloud and other data processing services to enable switching and interoperability. It also restricts unlawful third-country government access to non-personal data.
Key themes
IoT data access
B2B data sharing
unfair contract terms
cloud switching
interoperability
government access safeguards
Unique features
It imposes binding switching and egress-fee duties on all 'data processing service' providers (IaaS, PaaS, SaaS) and protects non-personal data from foreign government access.
SaaS relevance
SaaS providers count as 'data processing services' and must support customer switching: contract terms, a maximum two-month notice period, data export, reduced and then no switching charges, and transparency on jurisdiction.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Safeguards against unlawful third-country governmental access to non-personal data (Art 32)
Maximum penalty
Set by national law; GDPR-level fines where personal data rules infringed
Key dates
Adopted
In force
Applies generally from 2025-09-12. Product design duties (Art 3(1)) for connected products placed on the market from 2026-09-12. Cloud switching charges abolished from 2027-01-12. Unfair-terms rules extend to certain pre-existing contracts from 2027-09-12. Amendments proposed in the Digital Omnibus (pending).
Status is 'Partially in force' because several provisions are phased. The Digital Omnibus may change trade-secret and switching rules; Council discussions in Oct 2026 focused on this.
EU PNR DirectivePNR Directive (EU) 2016/681 on the use of passenger name record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crimeIn force In force from Directive (EU) 2016/681 requires air carriers to transfer passenger name record data to a Passenger Information Unit set up or designated in each Member State, for use against terrorist offences and serious crime. Member States keep the data in the unit for five years after transfer, and the Directive requires certain data elements to be masked out after six months.
Synopsis
Directive (EU) 2016/681 requires air carriers to transfer passenger name record data to a Passenger Information Unit set up or designated in each Member State, for use against terrorist offences and serious crime. Member States keep the data in the unit for five years after transfer, and the Directive requires certain data elements to be masked out after six months.
Key themes
passenger name records
air carriers
terrorism and serious crime
retention and depersonalisation
Unique features
Passenger Information Units process the data; a data protection officer is appointed in each unit.
SaaS relevance
Mainly affects air carriers and the travel-sector software that handles booking data.
Breach notification
None
DPO
Yes (each Passenger Information Unit has a data protection officer)
Cross-border transfers
Rules for transfers to third countries
Maximum penalty
Set by Member States
Key dates
Adopted
In force
Adopted 27 April 2016; published 4 May 2016; in force 24 May 2016; Member States to apply by 25 May 2018
Medium confidence. Partly verifiedMedium confidence.Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.
Partly verifiedMedium confidence.Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.
LEDDirective (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law enforcement purposes (Law Enforcement Directive)In force In force from The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
Synopsis
The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
Key themes
law enforcement
logging
categories of data subjects
DPIA
DPO
transfers to third-country authorities
Unique features
It requires processing operations to be logged and allows rights to be restricted to protect investigations.
SaaS relevance
Applies to SaaS providers only indirectly, as processors for police or justice customers, which must meet the LED's contractual and security requirements.
Extraterritorial
No
Breach notification
Authority 72h; individuals if high risk (with exceptions)
Framework Decision 2008/977/JHACouncil Framework Decision 2008/977/JHA on the protection of personal data in police and judicial cooperation in criminal mattersRepealed/superseded In force from Framework Decision 2008/977/JHA set data protection rules for personal data that Member States exchanged with each other in police and judicial cooperation in criminal matters. It dealt with matters such as purpose limitation, logging and documentation of transmissions, retention time limits and onward transfers. It did not cover purely domestic processing. Directive (EU) 2016/680, the Law Enforcement Directive, repealed it with effect from 6 May 2018.
Synopsis
Framework Decision 2008/977/JHA set data protection rules for personal data that Member States exchanged with each other in police and judicial cooperation in criminal matters. It dealt with matters such as purpose limitation, logging and documentation of transmissions, retention time limits and onward transfers. It did not cover purely domestic processing. Directive (EU) 2016/680, the Law Enforcement Directive, repealed it with effect from 6 May 2018.
Key themes
police and judicial cooperation
cross-border exchange
retention limits
onward transfer
Unique features
Applied only to data transmitted or made available between Member States, not to national police processing.
SaaS relevance
Historical only; replaced by the Law Enforcement Directive (EU) 2016/680.
Breach notification
None
DPO
No
Cross-border transfers
Rules for onward transfer to third states and bodies
Maximum penalty
None
Key dates
Adopted
In force
Ended
Adopted 27 November 2008; published 30 December 2008; in force 19 January 2009; repealed with effect from 6 May 2018 by Directive (EU) 2016/680
In force date is the 20th day after publication on 30 December 2008 (Article 30). Repeal date from Article 59(1) of Directive 2016/680. Scope description is taken from the title and the articles read, not from a full reading.
Data Retention DirectiveData Retention Directive 2006/24/ECRepealed/superseded In force from Directive 2006/24/EC required Member States to oblige providers of publicly available electronic communications services and public networks to retain traffic and location data, but not the content of communications, for between six months and two years, so that it could be available for the investigation of serious crime. On 8 April 2014 the Court of Justice declared the Directive invalid in Digital Rights Ireland, finding that the blanket retention it imposed was disproportionate in light of Articles 7 and 8 of the Charter of Fundamental Rights. National laws made under it were left to be assessed separately.
Synopsis
Directive 2006/24/EC required Member States to oblige providers of publicly available electronic communications services and public networks to retain traffic and location data, but not the content of communications, for between six months and two years, so that it could be available for the investigation of serious crime. On 8 April 2014 the Court of Justice declared the Directive invalid in Digital Rights Ireland, finding that the blanket retention it imposed was disproportionate in light of Articles 7 and 8 of the Charter of Fundamental Rights. National laws made under it were left to be assessed separately.
Key themes
communications data retention
traffic and location data
serious crime
proportionality
Charter Articles 7 and 8
Unique features
The first EU law ever to be struck down in full for breach of the Charter's privacy and data protection rights. It derogated from Articles 5, 6 and 9 of Directive 2002/58/EC.
SaaS relevance
Historical only; invalidated by the Court of Justice in 2014. Later case law still limits national retention laws for telecoms providers.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Retention period of not less than six months and not more than two years
Key dates
Adopted
In force
Ended
Adopted 15 March 2006; published 13 April 2006; in force 3 May 2006; Member States to apply by 15 September 2007; declared invalid by the Court of Justice on 8 April 2014 (Digital Rights Ireland, Joined Cases C-293/12 and C-594/12)
End date confirmed from the judgment: Digital Rights Ireland, Joined Cases C-293/12 and C-594/12, Grand Chamber, 8 April 2014, which answers that Directive 2006/24 is invalid. In force date is the 20th day after publication on 13 April 2006 (Article 16), which agrees with Wikipedia (3 May 2006). The judgment does not appear to limit the effects in time; I did not find any such limitation in the passages searched, so the end date is the judgment date.
CFR Arts 7–8Charter of Fundamental Rights of the European Union, Articles 7 and 8In force In force from Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.
Synopsis
Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.
Key themes
right to privacy
right to data protection
independent supervision
access
rectification
Unique features
It makes data protection a fundamental right distinct from privacy. It is the basis for CJEU judgments striking down EU acts and transfer decisions, such as Digital Rights Ireland, Schrems I and Schrems II.
SaaS relevance
It is the yardstick against which EU transfer mechanisms (DPF, SCCs) and GDPR interpretation are tested, so it directly affects SaaS transfer risk.
Breach notification
None
DPO
No
Cross-border transfers
Indirect: basis for 'essential equivalence' test
Maximum penalty
None directly
Key dates
Adopted
In force
Proclaimed in Nice on 2000-12-07; legally binding with the same value as the Treaties from 2009-12-01 (Treaty of Lisbon, Art 6(1) TEU)
TFEU Art 16Treaty on the Functioning of the European Union, Article 16In force In force from Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.
Synopsis
Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.
Key themes
legal basis
right to data protection
independent supervision
Unique features
It is the legal basis for the GDPR, the LED and the EUDPR. The earlier Directive 95/46 relied on internal-market powers instead.
SaaS relevance
Gives no direct obligations; it is the legal basis for the GDPR family.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Signed as part of the Lisbon Treaty on 2007-12-13; in force 2009-12-01
Membership-based — check ratification status in the instrument record. 19 instruments from 3 bodies.
Council of Europe
Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal DataIn force In force from The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Synopsis
The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Key themes
data quality
sensitive data
security
access and rectification
transborder flows
mutual assistance
Unique features
It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.
SaaS relevance
It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.
Breach notification
None (added by 108+)
DPO
No
Cross-border transfers
Free flow between parties; restrictions to non-parties permitted
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)
Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)Enacted – not yet in force Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Synopsis
Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Key themes
lawful basis
accountability
breach notification
automated decisions
privacy by design
transborder flows
follow-up mechanism
Unique features
It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.
SaaS relevance
Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.
Breach notification
Supervisory authority without delay for serious breaches (Art 7(2))
DPO
No
Cross-border transfers
Free flow between parties; appropriate safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
CoE AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of LawSigned – not ratified The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Synopsis
The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Key themes
AI lifecycle
human rights impact assessment
transparency
accountability
privacy
remedies
risk management
Unique features
It is open to non-European signatories, including the US, UK, Canada and Japan. It is principle-based and leaves parties to choose implementation measures, unlike the prescriptive EU AI Act.
SaaS relevance
It has no direct obligations yet; for EU-market SaaS it will be implemented mainly through the AI Act.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2024-05-17; opened in Vilnius on 2024-09-05. Enters into force on the first day of the month after 3 months from the 5th ratification (at least 3 of them CoE member states). The EU ratified on 2026-05-15. The threshold had not been reached as of Sept 2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Protocol 181Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flowsIn force In force from Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Synopsis
Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Key themes
independent supervisory authority
adequacy
transborder data flows
Unique features
It brought the adequacy and independent-DPA concepts of Directive 95/46 into the Council of Europe framework.
SaaS relevance
It shapes the transfer rules of non-EU parties that a SaaS provider may need to meet.
Breach notification
None
DPO
No
Cross-border transfers
Adequacy or ad hoc/approved safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 181; opened 2001-11-08; in force 2004-07-01; to be absorbed by Convention 108+
Partly verifiedMedium confidence.I could not fetch the treaty office status page; the dates come from established references.
Budapest ConventionConvention on Cybercrime (Budapest Convention)In force In force from The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Synopsis
The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Key themes
cybercrime offences
data preservation
production orders
interception
mutual legal assistance
24/7 network
Unique features
It has over 75 parties worldwide and is the model for many national cybercrime laws. Article 15 requires procedural powers to be subject to human rights conditions and safeguards.
SaaS relevance
National laws based on it allow domestic production and preservation orders for subscriber and traffic data held by SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
MLA and 24/7 points of contact
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 185; opened 2001-11-23; in force 2004-07-01; First Additional Protocol (ETS 189, xenophobia) 2003; Second Additional Protocol CETS 224 (2022) not yet in force
Partly verifiedMedium confidence.The party count is approximate.
Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidenceSigned – not ratified Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Synopsis
Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Key themes
direct cooperation with providers
subscriber information
domain registration data
emergency disclosure
data protection safeguards (Art 14)
Unique features
It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.
SaaS relevance
Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.
Extraterritorial
Yes
Breach notification
Art 14 requires notifying the transferring party of security incidents involving transferred data
DPO
No
Cross-border transfers
Art 14 safeguards govern transfers between parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
Medium confidence. Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
ECHR Art 8Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8In force In force from Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Synopsis
Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Key themes
private life
correspondence
surveillance
legality
necessity and proportionality
positive obligations
Unique features
It has a large body of case law on surveillance and data retention (e.g. S. and Marper, Big Brother Watch, Centrum för Rättvisa). Article 8 has been read to include data protection, and it informs the interpretation of the EU Charter (Art 52(3)).
SaaS relevance
It binds states only, but it drives national law on employee monitoring, surveillance and data retention that affects SaaS providers.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Just satisfaction awarded against states
Key dates
Adopted
In force
ETS No. 005; signed in Rome on 1950-11-04; in force 1953-09-03
Rec 509 (1968)Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological DevelopmentsIn force In force from In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Synopsis
In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Key themes
technology and privacy
surveillance devices
computers
adequacy of ECHR Art 8
Unique features
It was the first pan-European political recognition that computerisation threatened privacy. It is non-binding and historical.
Medium confidence. Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Res (74) 29Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public SectorRepealed/superseded In force from The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Synopsis
The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Key themes
public sector
transparency
lawfulness
accuracy
security
access
Unique features
Extended the 1973 principles to government processing.
Partly verifiedMedium confidence.Superseded by Convention 108. I did not re-check the document URL this session.
Res (73) 22Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private SectorRepealed/superseded In force from A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Synopsis
A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Key themes
private sector
data quality
purpose
retention
security
access
Unique features
Early soft-law forerunner of Convention 108, focused on the private sector.
Medium confidence. Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
Organisation for Economic Co-operation and Development (OECD)
OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force In force from Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Synopsis
Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Key themes
trustworthy AI
human rights
privacy
transparency
explainability
robustness
accountability
Unique features
It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.
SaaS relevance
Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force In force from The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Synopsis
The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Key themes
government access
national security
law enforcement
legal basis
oversight
redress
transparency
Unique features
It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.
SaaS relevance
Useful reference for transfer impact assessments and for policies on responding to government data demands.
Breach notification
None
DPO
No
Cross-border transfers
Supports trusted data flows between adherents
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force In force from Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Synopsis
Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Key themes
accountability
privacy management programmes
breach notification
enforcement cooperation
interoperability
transborder flows
Unique features
It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.
SaaS relevance
It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.
Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded In force from A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Synopsis
A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Key themes
eight fair information principles
accountability
transborder flows
Unique features
These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.
SaaS relevance
Historical baseline; its principles are reflected in most national laws a SaaS provider meets.
Breach notification
None
DPO
No
Cross-border transfers
Free flow encouraged; restrictions only where proportionate
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.