Privacy Map

Europe. National jurisdiction.

Switzerland CH

EU adequacy decisionPrimary authority: Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
Part I

Domestic law

Comprehensive data protection3

  • FADP / nDSGFederal Act on Data Protection of 25 September 2020 (revised FADP; Datenschutzgesetz, nDSG / LPD)In force
    In force from     Switzerland's federal data protection law for private persons and federal bodies, modernised to align closely with the GDPR and Convention 108+. It introduces privacy by design, records of processing, DPIAs, breach notification and expanded information duties, enforced by the FDPIC and criminal courts.
    Synopsis

    Switzerland's federal data protection law for private persons and federal bodies, modernised to align closely with the GDPR and Convention 108+. It introduces privacy by design, records of processing, DPIAs, breach notification and expanded information duties, enforced by the FDPIC and criminal courts.

    Key themes
    • information duty
    • privacy by design and default
    • DPIA
    • records of processing
    • breach notification
    • profiling
    • Swiss representative
    • cross-border disclosure
    Unique features

    Sanctions are criminal fines on responsible individuals (not administrative fines on companies); protects only natural persons; 'high-risk profiling' concept; foreign controllers need a Swiss representative only if processing is regular, extensive and high-risk.

    SaaS relevance

    Applies to any SaaS provider whose processing has effects in Switzerland, regardless of location; controllers must name the countries data are disclosed to in privacy notices.

    Extraterritorial
    Yes
    Breach notification
    FDPIC as soon as possible where high risk; individuals where needed for their protection
    DPO
    No
    Cross-border transfers
    Federal Council adequacy list (Annex 1 DPO); SCCs (Swiss-adapted EU SCCs) ; BCRs; Swiss–US DPF
    Maximum penalty
    CHF 250,000 criminal fine on responsible individuals (CHF 50,000 on the business in limited cases)
    Key dates
    • Adopted
    • In force
    • Revised Act in force 2023-09-01 with no transition period, replacing the 1992 FADP
    Text
    Authority
    Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
    Sources consulted
    Verification

    High confidence.

    EU adequacy Decision 2000/518/EC, confirmed in the Commission's January 2024 review. Cantonal data protection acts (26 cantons) govern cantonal and communal public bodies, are separate from the FADP and are not listed individually here.

    Full record for FADP / nDSG
  • DPO / DSVOrdinance on Data Protection of 31 August 2022 (Datenschutzverordnung, DSV / OPDo)In force
    In force from     Implements the FADP with detailed rules on data security, breach notification content, records of processing exemptions, logging, and the list of countries with adequate protection (Annex 1).
    Synopsis

    Implements the FADP with detailed rules on data security, breach notification content, records of processing exemptions, logging, and the list of countries with adequate protection (Annex 1).

    Key themes
    • data security
    • logging
    • breach notification content
    • adequacy list
    • records exemption
    Unique features

    Exempts businesses under 250 employees from records of processing unless processing is high-risk; Annex 1 is Switzerland's own adequacy list.

    SaaS relevance

    Sets the practical security and documentation requirements a SaaS provider must meet under the FADP.

    Extraterritorial
    Yes
    Breach notification
    Specifies notification content
    DPO
    No
    Cross-border transfers
    Annex 1 adequacy list
    Maximum penalty
    See FADP
    Key dates
    • Adopted
    • In force
    • Annex 1 amended effective 2024-09-15 to add the United States (certified DPF organisations)
    Text
    Authority
    Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
    Sources consulted
    Verification

    High confidence.

    Full record for DPO / DSV
Historic & pending (1)
  • FADP 1992Federal Act of 19 June 1992 on Data Protection (FADP, SR 235.1)Repealed/superseded
    In force from     Switzerland's first federal data protection act. It stayed in force for thirty years, with amendments, until the completely revised FADP of 25 September 2020 replaced it on 1 September 2023.
    Synopsis

    Switzerland's first federal data protection act. It stayed in force for thirty years, with amendments, until the completely revised FADP of 25 September 2020 replaced it on 1 September 2023.

    SaaS relevance

    Historical only; replaced by the revised Federal Act on Data Protection (ch-fadp).

    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 1992-06-19; in force 1993-07-01; completely revised by the Act of 2020-09-25, which entered into force on 2023-09-01
    Text
    No authoritative text located.
    Authority
    Federal Data Protection and Information Commissioner (FDPIC / EDÖB)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Adoption and entry-into-force dates are from Wikipedia. The Federal Office of Justice page (cited in a search result) states the first FADP dates from 19 June 1992 and that the revised FADP entered into force on 1 September 2023; its page could not be fetched directly, and Fedlex could not be read (needs JavaScript). The original ordinance (VDSG) and the content of the 1992 text were not reviewed. date_repealed is the date the revised Act took over.

    Full record for FADP 1992
    Partly verifiedMedium confidence. Adoption and entry-into-force dates are from Wikipedia. The Federal Office of Justice page (cited in a search result) states the first FADP dates from 19 June 1992 and that the revised FADP entered into force on 1 September 2023; its page could not be fetched directly, and Fedlex could not be read (needs JavaScript). The original ordinance (VDSG) and the content of the 1992 text were not reviewed. date_repealed is the date the revised Act took over.

Data localisation / cross-border1

  • Swiss–US DPFSwiss–US Data Privacy Framework (adequacy recognition via amendment of Annex 1 of the Data Protection Ordinance)In force
    In force from     The Federal Council recognised that US organisations certified under the Swiss–US DPF provide adequate protection, enabling transfers without additional safeguards. It mirrors the EU–US DPF and relies on Executive Order 14086 redress.
    Synopsis

    The Federal Council recognised that US organisations certified under the Swiss–US DPF provide adequate protection, enabling transfers without additional safeguards. It mirrors the EU–US DPF and relies on Executive Order 14086 redress.

    Key themes
    • adequacy
    • US certification
    • redress
    Unique features

    Switzerland's first partial adequacy finding for the US since the Privacy Shield was invalidated.

    SaaS relevance

    Swiss customers can transfer data to US SaaS providers certified to the Swiss–US DPF without SCCs.

    Cross-border transfers
    Partial adequacy for certified US organisations
    Key dates
    • Adopted
    • In force
    Text
    Authority
    FDPIC; US Department of Commerce (certification)
    Verification

    High confidence.

    Full record for Swiss–US DPF
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 19 instruments from 3 bodies.

Council of Europe

  • Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal DataIn force
    In force from     The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
    Synopsis

    The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.

    Key themes
    • data quality
    • sensitive data
    • security
    • access and rectification
    • transborder flows
    • mutual assistance
    Unique features

    It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.

    SaaS relevance

    It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.

    Breach notification
    None (added by 108+)
    DPO
    No
    Cross-border transfers
    Free flow between parties; restrictions to non-parties permitted
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)
    Text
    Authority
    Consultative Committee of Convention 108 (T-PD)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate; the treaty office page did not render for me.

    Full record for Convention 108
  • Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)Enacted – not yet in force
    Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
    Synopsis

    Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.

    Key themes
    • lawful basis
    • accountability
    • breach notification
    • automated decisions
    • privacy by design
    • transborder flows
    • follow-up mechanism
    Unique features

    It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.

    SaaS relevance

    Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.

    Breach notification
    Supervisory authority without delay for serious breaches (Art 7(2))
    DPO
    No
    Cross-border transfers
    Free flow between parties; appropriate safeguards for non-parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
    Text
    Authority
    Convention Committee (T-PD); national supervisory authorities
    Sources consulted
    Verification

    High confidence.

    Not in force as of Oct 2026 (34 of 38 required ratifications). The text_url document ID was not re-checked this session.

    Full record for Convention 108+
  • CoE AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of LawSigned – not ratified
    The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
    Synopsis

    The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.

    Key themes
    • AI lifecycle
    • human rights impact assessment
    • transparency
    • accountability
    • privacy
    • remedies
    • risk management
    Unique features

    It is open to non-European signatories, including the US, UK, Canada and Japan. It is principle-based and leaves parties to choose implementation measures, unlike the prescriptive EU AI Act.

    SaaS relevance

    It has no direct obligations yet; for EU-market SaaS it will be implemented mainly through the AI Act.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted 2024-05-17; opened in Vilnius on 2024-09-05. Enters into force on the first day of the month after 3 months from the 5th ratification (at least 3 of them CoE member states). The EU ratified on 2026-05-15. The threshold had not been reached as of Sept 2026.
    Text
    Authority
    Conference of the Parties (once in force)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.

    Full record for CoE AI Convention
    Partly verifiedMedium confidence. The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
  • Protocol 181Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flowsIn force
    In force from     Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
    Synopsis

    Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.

    Key themes
    • independent supervisory authority
    • adequacy
    • transborder data flows
    Unique features

    It brought the adequacy and independent-DPA concepts of Directive 95/46 into the Council of Europe framework.

    SaaS relevance

    It shapes the transfer rules of non-EU parties that a SaaS provider may need to meet.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Adequacy or ad hoc/approved safeguards for non-parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 181; opened 2001-11-08; in force 2004-07-01; to be absorbed by Convention 108+
    Text
    Authority
    National supervisory authorities; T-PD
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I could not fetch the treaty office status page; the dates come from established references.

    Full record for Protocol 181
    Partly verifiedMedium confidence. I could not fetch the treaty office status page; the dates come from established references.
  • Budapest ConventionConvention on Cybercrime (Budapest Convention)In force
    In force from     The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
    Synopsis

    The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.

    Key themes
    • cybercrime offences
    • data preservation
    • production orders
    • interception
    • mutual legal assistance
    • 24/7 network
    Unique features

    It has over 75 parties worldwide and is the model for many national cybercrime laws. Article 15 requires procedural powers to be subject to human rights conditions and safeguards.

    SaaS relevance

    National laws based on it allow domestic production and preservation orders for subscriber and traffic data held by SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    MLA and 24/7 points of contact
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 185; opened 2001-11-23; in force 2004-07-01; First Additional Protocol (ETS 189, xenophobia) 2003; Second Additional Protocol CETS 224 (2022) not yet in force
    Text
    Authority
    Cybercrime Convention Committee (T-CY)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The party count is approximate.

    Full record for Budapest Convention
    Partly verifiedMedium confidence. The party count is approximate.
  • Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidenceSigned – not ratified
    Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
    Synopsis

    Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.

    Key themes
    • direct cooperation with providers
    • subscriber information
    • domain registration data
    • emergency disclosure
    • data protection safeguards (Art 14)
    Unique features

    It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.

    SaaS relevance

    Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.

    Extraterritorial
    Yes
    Breach notification
    Art 14 requires notifying the transferring party of security incidents involving transferred data
    DPO
    No
    Cross-border transfers
    Art 14 safeguards govern transfers between parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
    Text
    Authority
    Cybercrime Convention Committee (T-CY)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.

    Full record for Budapest 2nd Additional Protocol
    Partly verifiedMedium confidence. I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
  • ECHR Art 8Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8In force
    In force from     Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
    Synopsis

    Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.

    Key themes
    • private life
    • correspondence
    • surveillance
    • legality
    • necessity and proportionality
    • positive obligations
    Unique features

    It has a large body of case law on surveillance and data retention (e.g. S. and Marper, Big Brother Watch, Centrum för Rättvisa). Article 8 has been read to include data protection, and it informs the interpretation of the EU Charter (Art 52(3)).

    SaaS relevance

    It binds states only, but it drives national law on employee monitoring, surveillance and data retention that affects SaaS providers.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Just satisfaction awarded against states
    Key dates
    • Adopted
    • In force
    • ETS No. 005; signed in Rome on 1950-11-04; in force 1953-09-03
    Text
    Authority
    European Court of Human Rights
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1950ECHR.pdf). Russia ceased to be a party on 2022-09-16.

    Full record for ECHR Art 8
  • Rec 509 (1968)Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological DevelopmentsIn force
    In force from     In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
    Synopsis

    In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.

    Key themes
    • technology and privacy
    • surveillance devices
    • computers
    • adequacy of ECHR Art 8
    Unique features

    It was the first pan-European political recognition that computerisation threatened privacy. It is non-binding and historical.

    SaaS relevance

    Historical background only; no obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).

    Full record for Rec 509 (1968)
    Partly verifiedMedium confidence. I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
  • Res (74) 29Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public SectorRepealed/superseded
    In force from     The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
    Synopsis

    The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.

    Key themes
    • public sector
    • transparency
    • lawfulness
    • accuracy
    • security
    • access
    Unique features

    Extended the 1973 principles to government processing.

    SaaS relevance

    Historical only; no current obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Superseded by Convention 108. I did not re-check the document URL this session.

    Full record for Res (74) 29
    Partly verifiedMedium confidence. Superseded by Convention 108. I did not re-check the document URL this session.
  • Res (73) 22Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private SectorRepealed/superseded
    In force from     A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
    Synopsis

    A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.

    Key themes
    • private sector
    • data quality
    • purpose
    • retention
    • security
    • access
    Unique features

    Early soft-law forerunner of Convention 108, focused on the private sector.

    SaaS relevance

    Historical only; no current obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.

    Full record for Res (73) 22
    Partly verifiedMedium confidence. Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.

Organisation for Economic Co-operation and Development (OECD)

  • OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force
    In force from     Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
    Synopsis

    Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

    Key themes
    • trustworthy AI
    • human rights
    • privacy
    • transparency
    • explainability
    • robustness
    • accountability
    Unique features

    It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

    SaaS relevance

    Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
    Text
    Authority
    OECD Working Party on AI Governance / OECD.AI
    Sources consulted
    Verification

    High confidence.

    Full record for OECD AI Principles
  • OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force
    In force from     The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
    Synopsis

    The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

    Key themes
    • government access
    • national security
    • law enforcement
    • legal basis
    • oversight
    • redress
    • transparency
    Unique features

    It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

    SaaS relevance

    Useful reference for transfer impact assessments and for policies on responding to government data demands.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Supports trusted data flows between adherents
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Trusted Government Access Declaration
  • OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force
    In force from     Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
    Synopsis

    Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

    Key themes
    • accountability
    • privacy management programmes
    • breach notification
    • enforcement cooperation
    • interoperability
    • transborder flows
    Unique features

    It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

    SaaS relevance

    It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

    Breach notification
    Recommended: authority and affected individuals for significant breaches
    DPO
    No
    Cross-border transfers
    Restrictions should be proportionate to risk
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
    Text
    Authority
    OECD Working Party on Data Governance and Privacy
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Privacy Guidelines 2013
  • OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded
    In force from     A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
    Synopsis

    A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

    Key themes
    • eight fair information principles
    • accountability
    • transborder flows
    Unique features

    These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

    SaaS relevance

    Historical baseline; its principles are reflected in most national laws a SaaS provider meets.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow encouraged; restrictions only where proportionate
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Revised 2013-07-11 (see separate row)
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

    Full record for OECD Guidelines 1980

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.