Privacy Map

Asia. National jurisdiction.

China CN

Primary authority: Cyberspace Administration of China (CAC)
Part I

Domestic law

Comprehensive data protection3

  • PI Compliance Audit MeasuresAdministrative Measures for Personal Information Protection Compliance Audits (个人信息保护合规审计管理办法)In force
    In force from     Implements the PIPL requirement for regular compliance audits. Handlers of PI of over 10 million people must self-audit at least every two years, and regulators can order audits after serious incidents.
    Synopsis

    Implements the PIPL requirement for regular compliance audits. Handlers of PI of over 10 million people must self-audit at least every two years, and regulators can order audits after serious incidents.

    Key themes
    • compliance audit
    • audit frequency
    • regulator-ordered audits
    • PI protection officer
    Unique features

    Mandatory periodic privacy audits are unusual among peer laws; regulator-ordered audits use external auditors at the handler's cost.

    SaaS relevance

    Large consumer SaaS platforms in China must budget for biennial privacy audits.

    DPO
    Conditional
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    Issue date given as February 2025 (exact day not confirmed). DPO needed above 1m individuals. [Link: official Chinese (CAC); CLT translation]

    Full record for PI Compliance Audit Measures
  • NDSMRRegulations on Network Data Security Management (网络数据安全管理条例) (State Council Decree No. 790)In force
    In force from     State Council regulation that operationalises the CSL, DSL and PIPL for 'network data'. It details notice and consent, individual-rights handling, important-data identification and risk assessment, platform duties and cross-border routes.
    Synopsis

    State Council regulation that operationalises the CSL, DSL and PIPL for 'network data'. It details notice and consent, individual-rights handling, important-data identification and risk assessment, platform duties and cross-border routes.

    Key themes
    • important data
    • risk assessments
    • PI rights requests
    • platform obligations
    • cross-border exemptions
    • security lead for >10m individuals
    • record keeping
    Unique features

    Extends extraterritorial reach to offshore processing of important data; handlers processing PI of over 10 million people need a dedicated security lead and body.

    SaaS relevance

    Sets the day-to-day compliance mechanics (rights requests, sharing contracts, logs) for SaaS processing Chinese users' data, including offshore providers.

    Extraterritorial
    Yes
    Breach notification
    Activate emergency plan; notify affected parties and authorities promptly
    DPO
    Conditional
    Cross-border transfers
    Security assessment / standard contract / certification or listed necessity exceptions
    Maximum penalty
    Up to RMB 10m under referenced laws; RMB 100k–1m for certain violations, individuals RMB 10k–100k
    Key dates
    • Adopted
    • In force
    • Published 2024-09-30
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    text_url and text_url_en are standard gov.cn / China Law Translate locations; exact path not opened.

    Full record for NDSMR
  • PIPLPersonal Information Protection Law of the People's Republic of China (个人信息保护法)In force
    In force from     China's general personal information law, setting legal bases, notice and separate-consent rules, individual rights and duties for 'personal information handlers'. It also governs outbound transfers and gives the CAC a coordinating enforcement role alongside sector regulators.
    Synopsis

    China's general personal information law, setting legal bases, notice and separate-consent rules, individual rights and duties for 'personal information handlers'. It also governs outbound transfers and gives the CAC a coordinating enforcement role alongside sector regulators.

    Key themes
    • legal bases
    • separate consent
    • sensitive PI
    • individual rights
    • PI protection officer
    • PIPIA
    • cross-border transfers
    • local representative
    • compliance audits
    Unique features

    Consent-centred with 'separate consent' for sensitive data, sharing and export; no legitimate-interests basis. Offshore handlers caught must appoint a representative in China, and large platforms carry gatekeeper-style duties.

    SaaS relevance

    Applies to foreign SaaS providers offering products or services to individuals in China or analysing their behaviour, and any export of China-collected PI needs one of the CAC transfer routes.

    Extraterritorial
    Yes
    Breach notification
    Notify regulator and individuals promptly (individual notice may be skipped if harm effectively mitigated); CAC incident-reporting measures add hour-based deadlines from 2025-11-01
    DPO
    Conditional
    Cross-border transfers
    CAC security assessment / standard contract filing / certification, subject to 2024 thresholds and exemptions
    Maximum penalty
    RMB 50m or 5% of prior-year revenue, plus business suspension and personal fines for responsible managers
    Key dates
    • Adopted
    • In force
    • Adopted by NPC Standing Committee 2021-08-20; implementing rules since include NDSMR (2025-01-01), compliance audit measures (2025-05-01), certification measures (2026-01-01)
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Sources consulted
    Verification

    High confidence.

    DPO threshold (1m individuals) set by NDSMR/audit measures; DLA notes an inconsistency between 1m and 10m in its summary. Revenue base for 5% fine (China vs global) is unsettled.

    Full record for PIPL

Breach notification1

  • Cyber Incident Reporting MeasuresAdministrative Measures for Reporting National Cybersecurity Incidents (国家网络安全事件报告管理办法)In force
    In force from     Sets a four-level classification of cybersecurity incidents and hour-based deadlines for reporting them to regulators. Applies to network operators, including incidents involving personal information leaks.
    Synopsis

    Sets a four-level classification of cybersecurity incidents and hour-based deadlines for reporting them to regulators. Applies to network operators, including incidents involving personal information leaks.

    Key themes
    • incident classification
    • reporting deadlines
    • network operators
    • PI leaks
    Unique features

    The shortest reporting deadline is four hours from awareness for the most serious incidents.

    SaaS relevance

    SaaS network operators in China need incident runbooks able to meet hour-level reporting deadlines.

    Breach notification
    Tiered; as short as 4 hours for particularly significant incidents
    Key dates
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Official title and adoption date from memory of CAC naming; only effective date and tiering verified via DLA Piper. [Link: official Chinese (CAC, published 2025-09-15); CLT translation]

    Full record for Cyber Incident Reporting Measures
    Partly verifiedMedium confidence. Official title and adoption date from memory of CAC naming; only effective date and tiering verified via DLA Piper. [Link: official Chinese (CAC, published 2025-09-15); CLT translation]

Children's privacy1

  • Minors Online Protection RegulationsRegulations on the Protection of Minors Online (未成年人网络保护条例) (State Council Decree No. 766)In force
    In force from     State Council regulation protecting under-18s online, covering content, internet addiction, and handling of minors' personal information. PI handlers must audit minors' data handling annually and respond to breaches affecting minors.
    Synopsis

    State Council regulation protecting under-18s online, covering content, internet addiction, and handling of minors' personal information. PI handlers must audit minors' data handling annually and respond to breaches affecting minors.

    Key themes
    • minors
    • guardian consent
    • annual audit
    • anti-addiction
    • content controls
    • breach response
    Unique features

    Annual compliance audit specifically for minors' PI, and minors' mode requirements for large platforms.

    SaaS relevance

    Consumer or edtech SaaS in China with minor users must run annual minors-data audits.

    Breach notification
    Activate response plan; notify affected minors/guardians or publish if individual notice impossible
    Key dates
    • Adopted
    • In force
    • Published 2023-10-24
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    [Link: official Chinese (State Council Gazette, Decree 766); CLT translation]

    Full record for Minors Online Protection Regulations

AI / automated decisions2

  • AI Content Labelling MeasuresMeasures for Labelling Artificial Intelligence-Generated and Synthetic Content (人工智能生成合成内容标识办法)In force
    In force from     Requires providers of AI generation services to add visible labels and metadata (implicit) labels to AI-generated text, images, audio, video and virtual scenes. App stores must check labelling, and users must declare AI content they publish.
    Synopsis

    Requires providers of AI generation services to add visible labels and metadata (implicit) labels to AI-generated text, images, audio, video and virtual scenes. App stores must check labelling, and users must declare AI content they publish.

    Key themes
    • explicit labels
    • implicit metadata labels
    • platform verification
    • user declarations
    • mandatory national standard
    Unique features

    Pairs the measures with a mandatory national labelling standard effective the same day, covering both visible markers and file metadata.

    SaaS relevance

    SaaS that lets users generate or export AI content for the Chinese market must embed labels and metadata.

    Extraterritorial
    Limited
    Key dates
    • Adopted
    • In force
    Text
    Authority
    CAC with MIIT, MPS and NRTA
    Verification

    High confidence.

    Companion standard commonly cited as GB 45438-2025; number not confirmed in sources read. [Link: official Chinese (CAC notice with Measures); CLT translation]

    Full record for AI Content Labelling Measures
  • GenAI MeasuresInterim Measures for the Management of Generative Artificial Intelligence Services (生成式人工智能服务管理暂行办法)In force
    In force from     Regulates generative AI services offered to the public in China, covering training-data legality, content controls, user agreements and labelling. Services with public-opinion attributes need security assessments and algorithm filing.
    Synopsis

    Regulates generative AI services offered to the public in China, covering training-data legality, content controls, user agreements and labelling. Services with public-opinion attributes need security assessments and algorithm filing.

    Key themes
    • generative AI
    • training data
    • content moderation
    • algorithm filing
    • security assessment
    • user agreements
    Unique features

    Applies to any public-facing GenAI service accessible in China regardless of provider location; non-compliant foreign services may be blocked.

    SaaS relevance

    SaaS embedding generative AI features for users in China must meet filing, content and labelling duties.

    Extraterritorial
    Yes
    Maximum penalty
    Service suspension; penalties under CSL/DSL/PIPL
    Key dates
    • Adopted
    • In force
    Text
    Authority
    CAC with NDRC, MOE, MOST, MIIT, MPS, NRTA
    Sources consulted
    Verification

    High confidence.

    URL paths for text not opened directly.

    Full record for GenAI Measures

Cybersecurity2

  • CSL Amendment 2025Decision on Amending the Cybersecurity Law of the People's Republic of China (2025)In force
    In force from     First revision of the Cybersecurity Law, which tightens and tiers penalties by severity of harm and allows fines without a prior refusal to rectify. It aligns PI and data liability with the PIPL and DSL, adds a statutory clause on AI governance and expands action against overseas actors harming Chinese cybersecurity.
    Synopsis

    First revision of the Cybersecurity Law, which tightens and tiers penalties by severity of harm and allows fines without a prior refusal to rectify. It aligns PI and data liability with the PIPL and DSL, adds a statutory clause on AI governance and expands action against overseas actors harming Chinese cybersecurity.

    Key themes
    • tiered penalties
    • AI governance
    • extraterritorial enforcement
    • certified network equipment
    • alignment with PIPL/DSL
    Unique features

    First statutory-level AI provision in Chinese law; overseas entities can face fines and asset freezes for conduct harming China's cybersecurity.

    SaaS relevance

    Raises fine exposure for SaaS network operators for MLPS and incident-handling failures even on first violation.

    Extraterritorial
    Yes
    Breach notification
    Incident-handling failures now separately penalised
    Cross-border transfers
    Refers to PIPL/DSL
    Maximum penalty
    RMB 2m–10m for entity where consequences extremely grave; RMB 200k–1m for responsible individuals
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    [Link: official Chinese (NPCSC decision reposted on CAC); CSET translation of the amended CSL]

    Full record for CSL Amendment 2025
  • CSLCybersecurity Law of the People's Republic of China (网络安全法)In force
    In force from     China's first comprehensive cyber law, requiring network operators to follow the Multi-Level Protection Scheme, protect user information and support real-name registration. Operators of critical information infrastructure must store personal information and important data in China and pass a security assessment before exporting it.
    Synopsis

    China's first comprehensive cyber law, requiring network operators to follow the Multi-Level Protection Scheme, protect user information and support real-name registration. Operators of critical information infrastructure must store personal information and important data in China and pass a security assessment before exporting it.

    Key themes
    • MLPS
    • network operator duties
    • CII
    • data localisation
    • real-name registration
    • incident response
    • PI protection
    Unique features

    Introduced CII localisation and the MLPS grading regime that underpins later data laws.

    SaaS relevance

    Any SaaS operating networks or services in China is a 'network operator' and must meet MLPS, logging and incident-reporting duties.

    Extraterritorial
    Limited
    Breach notification
    Remedy and inform users; report to competent authorities
    DPO
    No
    Cross-border transfers
    CII localisation + security assessment
    Maximum penalty
    As amended from 2026: up to RMB 10m for extremely grave consequences
    Key dates
    • Adopted
    • In force
    • First amendment adopted 2025-10-28, in force 2026-01-01 (see cn-csl-amendment-2025)
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Sources consulted
    Verification

    High confidence.

    Full record for CSL

Data localisation / cross-border5

  • PI Export Certification MeasuresMeasures for Certification of Outbound Transfer of Personal Information (个人信息出境认证办法)In force
    In force from     Jointly issued CAC/SAMR rules that complete the certification route for exporting personal information as an alternative to the standard contract. Exporters need separate consent and a PI impact assessment, then undergo technical verification and on-site review by an accredited body.
    Synopsis

    Jointly issued CAC/SAMR rules that complete the certification route for exporting personal information as an alternative to the standard contract. Exporters need separate consent and a PI impact assessment, then undergo technical verification and on-site review by an accredited body.

    Key themes
    • certification
    • PIPIA
    • separate consent
    • accredited certification bodies
    • 3-year validity
    Unique features

    Certificate valid three years with ongoing supervision; anti-splitting rule prevents dividing volumes to avoid security assessment.

    SaaS relevance

    Lets SaaS groups certify a transfer arrangement once instead of filing contracts per transfer, within the SCC-tier volume band.

    Cross-border transfers
    Alternative to SCC for non-CII handlers exporting 100k–1m PI or <10k sensitive PI per year
    Maximum penalty
    Per PIPL
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC) and State Administration for Market Regulation (SAMR)
    Verification

    High confidence.

    [Link: official Chinese (CAC); no verified free English translation found]

    Full record for PI Export Certification Measures
  • Cross-Border Data Flow ProvisionsProvisions on Promoting and Regulating Cross-Border Data Flows (促进和规范数据跨境流动规定)In force
    In force from     CAC rules that relaxed China's data export regime by exempting common scenarios and resetting volume thresholds. They decide whether an exporter needs a security assessment, a standard contract/certification, or nothing.
    Synopsis

    CAC rules that relaxed China's data export regime by exempting common scenarios and resetting volume thresholds. They decide whether an exporter needs a security assessment, a standard contract/certification, or nothing.

    Key themes
    • export exemptions
    • volume thresholds
    • contract necessity
    • HR transfers
    • FTZ negative lists
    • security assessment validity
    Unique features

    Exempts transfers needed to perform contracts with the individual and cross-border HR, and exempts non-sensitive PI of under 100,000 people per year; pilot FTZs may publish negative lists.

    SaaS relevance

    Determines which export route a SaaS provider serving Chinese users must use; many B2C contract-necessity flows are now exempt.

    Cross-border transfers
    <100k non-sensitive PI/yr exempt; 100k–1m non-sensitive or <10k sensitive: SCC filing or certification; >1m non-sensitive, >10k sensitive, important data or CII: security assessment
    Maximum penalty
    Per PIPL/DSL
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    Took effect on promulgation; volume counted from 1 January of the current year.

    Full record for Cross-Border Data Flow Provisions
  • China SCC MeasuresMeasures on the Standard Contract for Outbound Transfer of Personal Information (个人信息出境标准合同办法)In force
    In force from     Introduces China's mandatory template contract for exporting personal information and requires the signed contract plus a PI impact assessment to be filed with the provincial CAC. It is the most-used export route for mid-volume exporters.
    Synopsis

    Introduces China's mandatory template contract for exporting personal information and requires the signed contract plus a PI impact assessment to be filed with the provincial CAC. It is the most-used export route for mid-volume exporters.

    Key themes
    • standard contract
    • PIPIA
    • filing
    • provincial CAC
    • overseas recipient obligations
    Unique features

    Template cannot be negotiated beyond additions that do not conflict; filing within 10 working days of contract effect.

    SaaS relevance

    Most mid-sized SaaS exporters from China use this route for intra-group or vendor transfers.

    Cross-border transfers
    Template contract + filing
    Maximum penalty
    Per PIPL
    Key dates
    • Adopted
    • In force
    • Grace period to 2023-12-01; eligibility thresholds reset by 2024 Provisions
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    text_url_en path not opened directly.

    Full record for China SCC Measures
  • Security Assessment MeasuresMeasures for the Security Assessment of Outbound Data Transfers (数据出境安全评估办法)In force
    In force from     Sets the procedure for the CAC-run security assessment required for the highest-risk data exports. The exporter self-assesses, files through the provincial CAC and must obtain approval before transferring.
    Synopsis

    Sets the procedure for the CAC-run security assessment required for the highest-risk data exports. The exporter self-assesses, files through the provincial CAC and must obtain approval before transferring.

    Key themes
    • security assessment
    • self-assessment
    • important data
    • CII
    • approval validity
    Unique features

    Pre-approval licensing model for data exports, unlike notification-based regimes elsewhere.

    SaaS relevance

    A SaaS provider exporting large-volume or sensitive PI from China (or any important data) needs CAC approval first.

    Cross-border transfers
    CAC approval required above thresholds
    Maximum penalty
    Per PIPL/DSL
    Key dates
    • Adopted
    • In force
    • Thresholds and validity (now 3 years, extendable) modified by 2024 Cross-Border Data Flow Provisions
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Sources consulted
    Verification

    High confidence.

    Original 2-year validity extended to 3 years by 2024 Provisions.

    Full record for Security Assessment Measures
  • DSLData Security Law of the People's Republic of China (数据安全法)In force
    In force from     Framework law for all data (personal and non-personal) that creates a tiered classification system with 'important data' and 'national core data' at the top. It imposes security management duties, risk assessments and export controls on important data, and bars handing China-stored data to foreign courts or police without approval.
    Synopsis

    Framework law for all data (personal and non-personal) that creates a tiered classification system with 'important data' and 'national core data' at the top. It imposes security management duties, risk assessments and export controls on important data, and bars handing China-stored data to foreign courts or police without approval.

    Key themes
    • data classification
    • important data
    • core data
    • data security management
    • risk assessment
    • foreign judicial requests
    • export control
    Unique features

    Covers non-personal data and links data governance to national security. Prohibits responding to foreign judicial or law-enforcement data requests without Chinese government approval.

    SaaS relevance

    SaaS platforms holding industry datasets in China may hold 'important data', triggering assessments, a security lead and export restrictions.

    Extraterritorial
    Limited
    Breach notification
    Report data security incidents to authorities and inform users
    DPO
    Conditional
    Cross-border transfers
    Important data export needs CAC security assessment; foreign judicial/enforcement requests need approval
    Maximum penalty
    Up to RMB 10m for breaches of core data rules or unlawful export with serious consequences; business suspension/licence revocation
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Cyberspace Administration of China (CAC)
    Verification

    High confidence.

    Responsible-person fines are separate. Sectoral important-data catalogues are still being issued.

    Full record for DSL

Data access / sharing1

  • National Network ID MeasuresMeasures for the Administration of National Network Identity Authentication Public Services (国家网络身份认证公共服务管理办法)In force
    In force from     Creates a state-run network identity service issuing an 'internet number' and certificate that lets users verify identity to online services without handing over full ID details. Use is voluntary, with guardian involvement for minors.
    Synopsis

    Creates a state-run network identity service issuing an 'internet number' and certificate that lets users verify identity to online services without handing over full ID details. Use is voluntary, with guardian involvement for minors.

    Key themes
    • digital identity
    • real-name verification
    • data minimisation
    • voluntary use
    • minors
    Unique features

    Centralised state digital ID for online real-name verification; platforms receive a token rather than ID data.

    SaaS relevance

    SaaS required to do real-name verification in China may accept the national network ID instead of collecting ID numbers.

    Key dates
    • Adopted
    • In force
    Text
    Authority
    Ministry of Public Security and CAC (with other ministries)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Category approximated (no identity category in schema). Privacy groups have raised surveillance concerns. [Link: official Chinese (CAC/MPS joint release); CLT translation of final measures]

    Full record for National Network ID Measures
    Partly verifiedMedium confidence. Category approximated (no identity category in schema). Privacy groups have raised surveillance concerns. [Link: official Chinese (CAC/MPS joint release); CLT translation of final measures]
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 7 instruments from 2 bodies.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.