Privacy Map

North America. Part of Canada.

Ontario CA-ON

Primary authority: Information and Privacy Commissioner of Ontario (IPC)
Part I

Domestic law

Health data1

  • PHIPAPersonal Health Information Protection Act, 2004 (SO 2004, c. 3, Sch. A)In force
    In force from     Governs collection, use and disclosure of personal health information by health information custodians and their agents in Ontario, and sets rules for electronic service providers and health information network providers.
    Synopsis

    Governs collection, use and disclosure of personal health information by health information custodians and their agents in Ontario, and sets rules for electronic service providers and health information network providers.

    Key themes
    • personal health information
    • custodians
    • agents/information managers
    • consent
    • breach notification
    • electronic health records
    Unique features

    Declared substantially similar to PIPEDA for health information; IPC can impose administrative monetary penalties and offence fines are among the highest in Canada; specific duties for health information network providers.

    SaaS relevance

    Health SaaS vendors acting as agents, electronic service providers or information managers for custodians in this province must meet the Act's security, contract and breach obligations.

    Extraterritorial
    No
    Breach notification
    Individuals at first reasonable opportunity; IPC for prescribed categories; annual breach statistics to IPC
    DPO
    Yes
    Maximum penalty
    Offences up to CAD 200,000 (individuals) / CAD 1m (organisations); AMPs available
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Information and Privacy Commissioner of Ontario (IPC)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Penalty and AMP details from general knowledge; IPC page fetched did not state them.

    Full record for PHIPA
    Partly verifiedMedium confidence. Penalty and AMP details from general knowledge; IPC page fetched did not state them.

Cybersecurity1

  • Bill 194 / EDSTAStrengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (SO 2024, c. 24; Bill 194)Partially in force
    In force from     Enacts the Enhancing Digital Security and Trust Act for public sector entities (cyber programmes and incident reporting, AI accountability, children's digital information in schools and children's aid societies) and amends FIPPA to require PIAs, safeguards and breach reporting.
    Synopsis

    Enacts the Enhancing Digital Security and Trust Act for public sector entities (cyber programmes and incident reporting, AI accountability, children's digital information in schools and children's aid societies) and amends FIPPA to require PIAs, safeguards and breach reporting.

    Key themes
    • public-sector cybersecurity
    • AI accountability
    • children's data
    • PIAs
    • breach notification (RROSH)
    Unique features

    First Ontario statute regulating public-sector AI use by regulation; FIPPA gains a real-risk-of-significant-harm breach reporting duty and IPC review powers over information practices.

    SaaS relevance

    SaaS/AI vendors to Ontario ministries, school boards and children's aid societies will see technical standards, AI disclosure and breach-reporting obligations flowed down by contract.

    Extraterritorial
    No
    Breach notification
    FIPPA: IPC and individuals where real risk of significant harm (once proclaimed)
    Key dates
    • Adopted
    • In force
    • Royal Assent Nov 2024; Schedule 1 (Enhancing Digital Security and Trust Act) and most FIPPA amendments in Schedule 2 (ss.1-14) commence on proclamation
    Text
    Authority
    Ministry of Public and Business Service Delivery; Information and Privacy Commissioner of Ontario
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact Royal Assent date (believed 2024-11-25) and proclamation status of Schedule 1 / Sch 2 ss.1-14 not verified.

    Full record for Bill 194 / EDSTA
    Partly verifiedMedium confidence. Exact Royal Assent date (believed 2024-11-25) and proclamation status of Schedule 1 / Sch 2 ss.1-14 not verified.
Part II

Also applies here

Inherited from Canada.

Comprehensive data protection3

  • PIPEDAPersonal Information Protection and Electronic Documents Act (PIPEDA)In force
    In force from     Federal private-sector privacy law built around ten fair information principles (accountability, consent, limiting collection, etc.). It covers personal information handled in the course of commercial activity across Canada, plus employee data of federally regulated businesses, except where a provincial law has been declared substantially similar.
    Synopsis

    Federal private-sector privacy law built around ten fair information principles (accountability, consent, limiting collection, etc.). It covers personal information handled in the course of commercial activity across Canada, plus employee data of federally regulated businesses, except where a provincial law has been declared substantially similar.

    Key themes
    • fair information principles
    • meaningful consent
    • accountability
    • access and correction
    • safeguards
    • breach reporting
    • OPC complaints and Federal Court
    Unique features

    Principles-based and consent-centric rather than lawful-basis driven; the OPC is an ombudsman without order-making or fining powers, with enforcement via Federal Court applications. Transfers to service providers abroad are treated as a 'use' requiring accountability and transparency, not consent.

    SaaS relevance

    Any SaaS provider collecting Canadians' personal information in commercial activity with a real and substantial connection to Canada is covered, including foreign providers.

    Extraterritorial
    Yes
    Breach notification
    OPC and individuals as soon as feasible where real risk of significant harm (RROSH); record all breaches 24 months
    DPO
    Yes
    Cross-border transfers
    No restriction; accountability via contracts and notice to individuals
    Maximum penalty
    CAD 100,000 per offence (breach reporting/record-keeping, obstruction)
    Key dates
    • Adopted
    • In force
    • Phased: federal works 2001; all commercial activity in provinces without substantially similar law from 2004-01-01; Digital Privacy Act 2015 amendments; mandatory breach reporting from 2018-11-01. Bill C-36 (tabled 2026-06-15) would repeal Part 1.
    Text
    Authority
    Office of the Privacy Commissioner of Canada (OPC)
    Sources consulted
    Verification

    High confidence.

    DPO = 'designated individual accountable' under Principle 4.1. EU adequacy (2001 decision) covers PIPEDA commercial organisations only; reaffirmed in Commission's January 2024 review. Bill C-36 pending.

    Full record for PIPEDA
Historic & pending (2)
  • Bill C-36 (PPCDA)Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA) and to make related amendmentsBill/proposed
    Third attempt to modernise federal private-sector privacy law. It would replace Part 1 of PIPEDA with a new Act requiring privacy management programmes, PIAs in some cases, a disposal right, tighter rules for children's data and transparency for automated decision systems, enforced by a new commission with direct penalty powers.
    Synopsis

    Third attempt to modernise federal private-sector privacy law. It would replace Part 1 of PIPEDA with a new Act requiring privacy management programmes, PIAs in some cases, a disposal right, tighter rules for children's data and transparency for automated decision systems, enforced by a new commission with direct penalty powers.

    Key themes
    • privacy management programme
    • disposal right
    • children's data
    • automated decision systems
    • cross-border risk assessment
    • AMPs
    Unique features

    Drops the tribunal model and the AI statute (AIDA) from C-27; merges privacy and online-safety oversight into one commission; requires assessing and mitigating risk before transferring data outside Canada.

    SaaS relevance

    If enacted, SaaS providers serving Canadians would face a GDPR-style compliance programme, transfer risk assessments and turnover-based penalties.

    Extraterritorial
    Yes
    Breach notification
    Proposed: regulator and individuals (carried over RROSH model)
    DPO
    Yes
    Cross-border transfers
    Proposed: assess and mitigate risks before transfer outside Canada
    Maximum penalty
    Proposed: AMPs greater of CAD 10m or 3% gross global revenue; offences greater of CAD 25m or 5%
    Key dates
    • Adopted
    • Tabled at first reading 2026-06-15 by the Minister of Artificial Intelligence and Digital Innovation; coming into force tied to Bill C-34 (Digital Safety Act) and a new regulator
    Text
    Authority
    Proposed Digital Safety and Data Protection Commission of Canada
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Only at first reading (has NOT passed a chamber) - included at caller's request. LEGISinfo URL (45-1/c-36) constructed from parliament/session numbering, not opened.

    Full record for Bill C-36 (PPCDA)
    Partly verifiedMedium confidence. Only at first reading (has NOT passed a chamber) - included at caller's request. LEGISinfo URL (45-1/c-36) constructed from parliament/session numbering, not opened.
  • Bill C-27Bill C-27, Digital Charter Implementation Act, 2022 (CPPA, PIDPTA, AIDA)Repealed/superseded
    Proposed to replace PIPEDA's privacy part with a Consumer Privacy Protection Act, create a privacy tribunal and enact the Artificial Intelligence and Data Act. It lapsed without enactment.
    Synopsis

    Proposed to replace PIPEDA's privacy part with a Consumer Privacy Protection Act, create a privacy tribunal and enact the Artificial Intelligence and Data Act. It lapsed without enactment.

    Key themes
    • CPPA
    • tribunal
    • AI regulation (AIDA)
    • de-identification
    • minors' data
    Unique features

    Would have introduced Canada's first federal AI statute; AIDA was not carried forward into the successor bill.

    SaaS relevance

    No current legal effect; useful only as background to Bill C-36.

    Maximum penalty
    Proposed: greater of CAD 25m or 5% global revenue
    Key dates
    • Adopted
    • Ended
    • Introduced 2022-06-16; died on the order paper when Parliament was prorogued 2025-01-06; replaced in substance by Bill C-36 (2026)
    Text
    Authority
    Would have been OPC + Personal Information and Data Protection Tribunal
    Verification

    High confidence.

    Status uses 'Repealed/superseded' to signal a lapsed bill.

    Full record for Bill C-27

Sectoral privacy1

  • Privacy ActPrivacy Act (R.S.C. 1985, c. P-21)In force
    In force from     Governs how federal government institutions collect, use, disclose and retain personal information and gives individuals a right to access and correct their records. It applies to the public sector only.
    Synopsis

    Governs how federal government institutions collect, use, disclose and retain personal information and gives individuals a right to access and correct their records. It applies to the public sector only.

    Key themes
    • public sector
    • access rights
    • correction
    • use and disclosure limits
    • personal information banks
    Unique features

    Access rights limited historically to citizens and persons present in Canada; OPC handles complaints but lacks order powers over most issues.

    SaaS relevance

    Relevant mainly when a SaaS vendor contracts with federal institutions, which flow Privacy Act and Treasury Board requirements into contracts.

    Extraterritorial
    No
    Breach notification
    Treasury Board policy requires material breach reporting to OPC and TBS (policy, not statute)
    Cross-border transfers
    Treasury Board policy guidance; no statutory bar
    Key dates
    • Adopted
    • In force
    • Modernisation long proposed; no comprehensive reform enacted as of Oct 2026
    Text
    Authority
    Office of the Privacy Commissioner of Canada (OPC)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Brief row for completeness.

    Full record for Privacy Act
    Partly verifiedMedium confidence. Brief row for completeness.

ePrivacy / marketing1

  • CASLAn Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities (Canada's Anti-Spam Legislation)Partially in force
    In force from     Prohibits sending commercial electronic messages without express or implied consent, requires sender identification and a working unsubscribe mechanism, and restricts installing software or altering transmission data without consent.
    Synopsis

    Prohibits sending commercial electronic messages without express or implied consent, requires sender identification and a working unsubscribe mechanism, and restricts installing software or altering transmission data without consent.

    Key themes
    • commercial electronic messages
    • express/implied consent
    • unsubscribe
    • software installation
    • address harvesting
    Unique features

    Opt-in model stricter than US CAN-SPAM; applies to any message sent to or accessed from a computer system in Canada; directors and officers can be personally liable.

    SaaS relevance

    SaaS marketing emails, in-app messages and transactional-plus-promotional messages to Canadian recipients must meet consent, ID and unsubscribe rules; auto-updating software installs also caught.

    Extraterritorial
    Yes
    Breach notification
    None
    DPO
    No
    Maximum penalty
    AMPs up to CAD 10m per violation (organisations) / CAD 1m (individuals)
    Key dates
    • Adopted
    • In force
    • Software installation rules from 2015-01-15; transitional implied consent ended 2017-07-01; private right of action suspended indefinitely (2017)
    Text
    Authority
    Canadian Radio-television and Telecommunications Commission (CRTC); Competition Bureau; OPC
    Sources consulted
    Verification

    High confidence.

    Private right of action (ss.47-51) never brought into force.

    Full record for CASL

Breach notification1

  • BSSRBreach of Security Safeguards Regulations (SOR/2018-64)In force
    In force from     Regulations under PIPEDA setting the content and manner of breach reports to the OPC and notices to affected individuals. They also require organisations to keep a record of every breach of security safeguards for at least 24 months.
    Synopsis

    Regulations under PIPEDA setting the content and manner of breach reports to the OPC and notices to affected individuals. They also require organisations to keep a record of every breach of security safeguards for at least 24 months.

    Key themes
    • breach reporting
    • real risk of significant harm
    • notification content
    • record-keeping
    • third-party notification
    Unique features

    Threshold is 'real risk of significant harm' (sensitivity plus probability of misuse) rather than a fixed hour deadline; every breach, even below threshold, must be logged and producible to the OPC.

    SaaS relevance

    A SaaS controller suffering an incident involving Canadian personal data must assess RROSH, report and notify, and keep breach records available for OPC inspection.

    Extraterritorial
    Yes
    Breach notification
    OPC + individuals as soon as feasible if RROSH; notify other organisations that can mitigate; 24-month breach log
    Maximum penalty
    CAD 100,000 per knowing contravention (via PIPEDA s.28)
    Key dates
    • Adopted
    • In force
    • Published Canada Gazette II 2018-04-18
    Text
    Authority
    Office of the Privacy Commissioner of Canada (OPC)
    Sources consulted
    Verification

    High confidence.

    Prosecution is via Attorney General/DPP, not OPC.

    Full record for BSSR

Human rights / constitutional1

  • Charter s.8Canadian Charter of Rights and Freedoms, section 8 (unreasonable search or seizure)In force
    In force from     Guarantees everyone the right to be secure against unreasonable search or seizure, protecting a reasonable expectation of privacy against state intrusion. Courts have applied it to subscriber data, IP addresses and digital devices.
    Synopsis

    Guarantees everyone the right to be secure against unreasonable search or seizure, protecting a reasonable expectation of privacy against state intrusion. Courts have applied it to subscriber data, IP addresses and digital devices.

    Key themes
    • reasonable expectation of privacy
    • warrants
    • state access
    • digital evidence
    Unique features

    Supreme Court has held that IP addresses and basic subscriber information attract a reasonable expectation of privacy, so police generally need judicial authorisation to obtain them from providers.

    SaaS relevance

    Shapes when Canadian law enforcement may lawfully demand customer data from SaaS providers without a warrant.

    Extraterritorial
    No
    Key dates
    • Adopted
    • In force
    • Key cases: Hunter v Southam (1984), R v Spencer (2014, subscriber info), R v Bykovets (2024, IP addresses)
    Text
    Authority
    Courts
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Case citations from general knowledge; not re-verified in this pass.

    Full record for Charter s.8
    Partly verifiedMedium confidence. Case citations from general knowledge; not re-verified in this pass.
Part III

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 14 instruments from 6 bodies.

Commonwealth of Nations

  • Commonwealth Model LawCommonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy BillIn force
    In force from     A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
    Synopsis

    A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.

    Key themes
    • model legislation
    • consent
    • breach handling
    • cross-border transfers
    • harmonisation
    Unique features

    Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.

    SaaS relevance

    Background only; influences national laws in smaller Commonwealth jurisdictions.

    Breach notification
    Model provisions on breach investigation
    Cross-border transfers
    Model grounds for cross-border transfer
    Maximum penalty
    None (model)
    Key dates
    • Adopted
    • In force
    • 2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022
    Text
    Authority
    Commonwealth Secretariat (Rule of Law)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

    Full record for Commonwealth Model Law
    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

Organisation for Economic Co-operation and Development (OECD)

  • OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force
    In force from     Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
    Synopsis

    Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

    Key themes
    • trustworthy AI
    • human rights
    • privacy
    • transparency
    • explainability
    • robustness
    • accountability
    Unique features

    It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

    SaaS relevance

    Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
    Text
    Authority
    OECD Working Party on AI Governance / OECD.AI
    Sources consulted
    Verification

    High confidence.

    Full record for OECD AI Principles
  • OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force
    In force from     The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
    Synopsis

    The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

    Key themes
    • government access
    • national security
    • law enforcement
    • legal basis
    • oversight
    • redress
    • transparency
    Unique features

    It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

    SaaS relevance

    Useful reference for transfer impact assessments and for policies on responding to government data demands.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Supports trusted data flows between adherents
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Trusted Government Access Declaration
  • OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force
    In force from     Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
    Synopsis

    Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

    Key themes
    • accountability
    • privacy management programmes
    • breach notification
    • enforcement cooperation
    • interoperability
    • transborder flows
    Unique features

    It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

    SaaS relevance

    It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

    Breach notification
    Recommended: authority and affected individuals for significant breaches
    DPO
    No
    Cross-border transfers
    Restrictions should be proportionate to risk
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
    Text
    Authority
    OECD Working Party on Data Governance and Privacy
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Privacy Guidelines 2013
  • OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded
    In force from     A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
    Synopsis

    A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

    Key themes
    • eight fair information principles
    • accountability
    • transborder flows
    Unique features

    These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

    SaaS relevance

    Historical baseline; its principles are reflected in most national laws a SaaS provider meets.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow encouraged; restrictions only where proportionate
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Revised 2013-07-11 (see separate row)
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

    Full record for OECD Guidelines 1980

Global Cross-Border Privacy Rules Forum

  • Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force
    In force from     An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
    Synopsis

    An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.

    Key themes
    • certification
    • interoperability
    • accountability agents
    • processors
    • data flows
    Unique features

    The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.

    SaaS relevance

    A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
    Text
    Authority
    Global CBPR Forum; Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

    Full record for Global CBPR / Global PRP
    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

Organization of American States (OAS)

  • OAS Updated PrinciplesInter-American Juridical Committee Updated Principles on Privacy and Personal Data ProtectionIn force
    In force from     Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
    Synopsis

    Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.

    Key themes
    • principles
    • consent
    • sensitive data
    • accountability
    • cross-border flows
    • independent authority
    Unique features

    The update accounts for the GDPR and Convention 108+ while staying compatible with Inter-American human rights law and the habeas data tradition.

    SaaS relevance

    Background for Latin American national law; no direct obligations.

    Breach notification
    Recommended (security principle)
    DPO
    No
    Cross-border transfers
    Transfers to jurisdictions with comparable protection or with safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Replaces the CJI 2015 Principles (from the 2012 proposal); approved by the Inter-American Juridical Committee in April 2021 (98th regular session); the General Assembly took note in 2021
    Text
    Authority
    OAS Inter-American Juridical Committee; Department of International Law
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.

    Full record for OAS Updated Principles
    Partly verifiedLow confidence. The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.