Privacy Map

Europe. National jurisdiction.

United Kingdom GB

EU adequacy decisionPrimary authority: Information Commissioner's Office (ICO)
Part I

Domestic law

Comprehensive data protection4

  • UK GDPRUnited Kingdom General Data Protection Regulation (UK GDPR) – retained Regulation (EU) 2016/679 as amendedIn force
    In force from     The UK's core data protection regulation, a domesticated copy of the EU GDPR that sets principles, lawful bases, data subject rights, controller and processor duties and international transfer rules. Since February 2026 it carries the Data (Use and Access) Act 2025 reforms, including recognised legitimate interests, a relaxed automated decision-making regime and a new 'data protection test' for transfers.
    Synopsis

    The UK's core data protection regulation, a domesticated copy of the EU GDPR that sets principles, lawful bases, data subject rights, controller and processor duties and international transfer rules. Since February 2026 it carries the Data (Use and Access) Act 2025 reforms, including recognised legitimate interests, a relaxed automated decision-making regime and a new 'data protection test' for transfers.

    Key themes
    • lawful bases
    • recognised legitimate interests
    • data subject rights
    • automated decision-making
    • DPIA
    • DPO
    • breach notification
    • international transfers
    • UK representative
    Unique features

    Post-DUAA it diverges from the EU GDPR: a list of recognised legitimate interests needing no balancing test, Articles 22A–22D allowing most solely automated decisions with safeguards (stricter for special category data), a 'not materially lower' standard for transfer adequacy, and clarified scientific research and further-processing rules. Fines are capped in sterling (£17.5m).

    SaaS relevance

    Applies to SaaS providers established in the UK and, via Art 3(2), to overseas providers offering services to or monitoring people in the UK, who must also appoint a UK representative unless exempt; processors carry direct Art 28/32 duties.

    Extraterritorial
    Yes
    Breach notification
    ICO within 72h; individuals without undue delay if high risk
    DPO
    Conditional
    Cross-border transfers
    UK adequacy regulations; IDTA / UK Addendum to EU SCCs; BCRs; derogations; DUAA 'data protection test'
    Maximum penalty
    £17.5m or 4% of worldwide annual turnover (higher)
    Key dates
    • Adopted
    • In force
    • EU GDPR applied in UK 2018-05-25; became UK GDPR on 2021-01-01 via EU (Withdrawal) Act 2018 and DPPEC (EU Exit) Regs 2019; substantially amended by Data (Use and Access) Act 2025 (main Part 5 changes commenced 2026-02-05; complaints duty 2026-06-19)
    Text
    Authority
    Information Commissioner's Office (ICO)
    Sources consulted
    Verification

    High confidence.

    EU adequacy (GDPR and LED decisions of 28 June 2021) renewed by the Commission on 19 December 2025; the renewed decisions run until 27 December 2031 subject to review. Retained EU law is now termed 'assimilated law' under the Retained EU Law (Revocation and Reform) Act 2023.

    Full record for UK GDPR
  • DPA 2018Data Protection Act 2018In force
    In force from     Supplements the UK GDPR with exemptions, conditions for special category and criminal offence data, and the ICO's powers, and separately regulates law enforcement (Part 3) and intelligence services (Part 4) processing. It also contains the criminal offences and the statutory basis for ICO codes of practice.
    Synopsis

    Supplements the UK GDPR with exemptions, conditions for special category and criminal offence data, and the ICO's powers, and separately regulates law enforcement (Part 3) and intelligence services (Part 4) processing. It also contains the criminal offences and the statutory basis for ICO codes of practice.

    Key themes
    • UK GDPR derogations
    • Schedule 1 conditions
    • exemptions
    • age of digital consent
    • law enforcement processing
    • intelligence services
    • ICO enforcement
    • codes of practice
    • complaints handling
    Unique features

    Sets the UK age of digital consent at 13; requires an 'appropriate policy document' for many Schedule 1 processing conditions; criminal offences for re-identifying de-identified data and unlawful obtaining; since June 2026 controllers must run a data subject complaints procedure (s.164A) and acknowledge complaints within 30 days.

    SaaS relevance

    Any SaaS provider within UK GDPR scope relies on DPA 2018 Schedule 1 to process health, biometric or criminal-offence data and must operate the new complaints process.

    Extraterritorial
    Yes
    Breach notification
    ICO within 72h (via UK GDPR Art 33); Part 3 competent authorities likewise
    DPO
    Conditional
    Cross-border transfers
    Via UK GDPR Chapter V; s.17A–17C adequacy regulations power
    Maximum penalty
    £17.5m or 4% worldwide turnover (higher maximum); unlimited fines for criminal offences
    Key dates
    • Adopted
    • In force
    • Royal Assent 2018-05-23; main provisions in force 2018-05-25; amended for Brexit 2021-01-01; amended by DUAA 2025 (national security/LPP changes Sept–Nov 2025; main Part 5 changes 2026-02-05; s.164A complaints procedure 2026-06-19)
    Text
    Authority
    Information Commissioner's Office (ICO)
    Sources consulted
    Verification

    High confidence.

    Information Commission is to replace the Information Commissioner under DUAA Part 6; one secondary source reports abolition/transfer applicable from 2026-09-30, not confirmed against a commencement SI.

    Full record for DPA 2018
Historic & pending (2)
  • DPA 1998Data Protection Act 1998Repealed/superseded
    In force from     The Act implemented the EU Data Protection Directive 95/46/EC in the UK and replaced the Data Protection Act 1984. It applied to personal data held on computers and in relevant paper filing systems and set out eight data protection principles in Schedule 1. It gave individuals rights including subject access, and created offences such as unlawfully obtaining or disclosing personal data. It was repealed on 25 May 2018 by the Data Protection Act 2018, except s. 62 and parts of Schedule 15.
    Synopsis

    The Act implemented the EU Data Protection Directive 95/46/EC in the UK and replaced the Data Protection Act 1984. It applied to personal data held on computers and in relevant paper filing systems and set out eight data protection principles in Schedule 1. It gave individuals rights including subject access, and created offences such as unlawfully obtaining or disclosing personal data. It was repealed on 25 May 2018 by the Data Protection Act 2018, except s. 62 and parts of Schedule 15.

    Key themes
    • eight data protection principles
    • subject access
    • notification to the Commissioner
    • transfers outside the EEA
    • offences
    Unique features

    Covered manual records in structured filing systems as well as computer data; eighth principle restricted transfers outside the European Economic Area.

    SaaS relevance

    Historical only; replaced by the UK GDPR and the Data Protection Act 2018.

    Breach notification
    None
    DPO
    No
    Key dates
    • Adopted
    • In force
    • Ended
    • Royal Assent 16 July 1998; most provisions commenced 1 March 2000 (S.I. 2000/183); repealed 25 May 2018 by the Data Protection Act 2018 (S.I. 2018/625), save for a few provisions
    Text
    Authority
    Information Commissioner (Data Protection Commissioner until 2001)
    Sources consulted
    Verification

    High confidence.

    Section 56 was excluded from the 2000 commencement order (it depended on the Police Act 1997). Repeal was not total: s. 62 and Schedule 15 paras 13, 15, 16, 18 and 19 survived. The Commissioner's title change to Information Commissioner (2001) comes from a National Archives catalogue summary.

    Full record for DPA 1998
  • DPA 1984Data Protection Act 1984Repealed/superseded
    In force from     The UK's first general data protection statute. It regulated the use of automatically processed information relating to individuals and the provision of services in respect of such information. It set up the office of the Data Protection Registrar and a register of data users and computer bureaux. The Act was repealed on 1 March 2000 when the Data Protection Act 1998 came into force.
    Synopsis

    The UK's first general data protection statute. It regulated the use of automatically processed information relating to individuals and the provision of services in respect of such information. It set up the office of the Data Protection Registrar and a register of data users and computer bureaux. The Act was repealed on 1 March 2000 when the Data Protection Act 1998 came into force.

    Key themes
    • automatically processed personal data
    • registration of data users
    • Data Protection Registrar
    • data subject rights
    Unique features

    Limited to automatically processed (computer) data; data users had to register with the Registrar.

    SaaS relevance

    Historical only; replaced by the Data Protection Act 1998 (itself replaced by the UK GDPR and Data Protection Act 2018).

    Breach notification
    None
    DPO
    No
    Key dates
    • Adopted
    • In force
    • Ended
    • Royal Assent 12 July 1984; under s.42 no registration applications until a day appointed by order, which S.I. 1985/1055 set as 11 November 1985; sections 5 and 15 did not apply until six months after that day, and certain Registrar powers were restricted for two years after it (to November 1987); repealed 1 March 2000 by the Data Protection Act 1998
    Text
    Authority
    Data Protection Registrar
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. date_in_force is the day appointed under s.42(1) by S.I. 1985/1055 (11 November 1985, per the editorial note on legislation.gov.uk), when registration began. The six-month and two-year periods in s.42 run from that day (about May 1986 and November 1987; National Archives says full effect came in November 1987). The text of S.I. 1985/1055 itself was not readable, so the date rests on the legislation.gov.uk note. The chapter date 12 July 1984 is treated as Royal Assent.

    Full record for DPA 1984
    Partly verifiedMedium confidence. date_in_force is the day appointed under s.42(1) by S.I. 1985/1055 (11 November 1985, per the editorial note on legislation.gov.uk), when registration began. The six-month and two-year periods in s.42 run from that day (about May 1986 and November 1987; National Archives says full effect came in November 1987). The text of S.I. 1985/1055 itself was not readable, so the date rests on the legislation.gov.uk note. The chapter date 12 July 1984 is treated as Royal Assent.

ePrivacy / marketing1

  • PECRPrivacy and Electronic Communications (EC Directive) Regulations 2003In force
    In force from     The UK's ePrivacy rules covering electronic direct marketing (email, SMS, calls), cookies and similar storage/access technologies, and the security and confidentiality of public electronic communications services. Since February 2026 the ICO can fine PECR breaches at UK GDPR levels.
    Synopsis

    The UK's ePrivacy rules covering electronic direct marketing (email, SMS, calls), cookies and similar storage/access technologies, and the security and confidentiality of public electronic communications services. Since February 2026 the ICO can fine PECR breaches at UK GDPR levels.

    Key themes
    • cookies and similar technologies
    • consent
    • electronic marketing
    • soft opt-in
    • calling line ID
    • traffic and location data
    • service provider breach notification
    Unique features

    DUAA 2025 added consent exemptions for analytics/statistical cookies, website appearance and functionality, and emergency location, extended the soft opt-in to charities, and lifted the old £500,000 cap to £17.5m/4% turnover.

    SaaS relevance

    Any SaaS website or app that sets cookies or SDK trackers on UK users' devices, or sends marketing emails/SMS to UK recipients, is caught regardless of where the provider is based.

    Extraterritorial
    Limited
    Breach notification
    Service providers: ICO within 72h (aligned with UK GDPR from 2025-08-20)
    DPO
    No
    Cross-border transfers
    None specific
    Maximum penalty
    £17.5m or 4% worldwide turnover (post-DUAA)
    Key dates
    • Adopted
    • In force
    • Amended 2011 (cookie consent), 2018, 2021 (Brexit); DUAA 2025 s.111 aligned breach notification 2025-08-20; DUAA ss.112–116 (cookie exemptions, soft opt-in for charities, PECR fines raised to UK GDPR level) commenced 2026-02-05
    Text
    Authority
    Information Commissioner's Office (ICO)
    Sources consulted
    Verification

    High confidence.

    ICO states all DUAA provisions affecting PECR are now in force.

    Full record for PECR

Children's privacy2

  • AADC / Children's CodeAge Appropriate Design Code (Children's Code) – statutory code of practice under s.123 Data Protection Act 2018In force
    In force from     Sets 15 standards that online services likely to be accessed by under-18s must meet when processing children's data, such as high-privacy defaults, minimised data collection, no nudge techniques and geolocation off by default. Courts and the ICO must take it into account when applying UK GDPR and PECR.
    Synopsis

    Sets 15 standards that online services likely to be accessed by under-18s must meet when processing children's data, such as high-privacy defaults, minimised data collection, no nudge techniques and geolocation off by default. Courts and the ICO must take it into account when applying UK GDPR and PECR.

    Key themes
    • best interests of the child
    • high privacy by default
    • age assurance
    • profiling off by default
    • DPIA
    • parental controls
    • nudge techniques
    Unique features

    Applies to services 'likely to be accessed' by children, not only child-directed ones, and covers all under-18s; it became a global template (e.g. California AADC).

    SaaS relevance

    Relevant to consumer-facing or education SaaS likely to be used by under-18s in the UK; B2B tools are usually out of scope unless children are end users.

    Extraterritorial
    Yes
    Breach notification
    See UK GDPR
    Cross-border transfers
    See UK GDPR
    Maximum penalty
    Enforced via UK GDPR: £17.5m or 4% turnover
    Key dates
    • Adopted
    • In force
    • In force 2020-09-02 with 12-month transition; conformance expected from 2021-09-02; DUAA 2025 adds a statutory 'children's higher protection matters' duty for information society services
    Text
    Authority
    Information Commissioner's Office (ICO)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Dates from ICO publication history; not individually re-verified this session.

    Full record for AADC / Children's Code
    Partly verifiedMedium confidence. Dates from ICO publication history; not individually re-verified this session.
  • OSAOnline Safety Act 2023Partially in force
    In force from     Imposes duties of care on user-to-user and search services with UK links to assess and mitigate illegal content risks and, where children are likely to access the service, to protect them from harmful content, including through highly effective age assurance. Ofcom enforces through codes of practice, information notices and fines.
    Synopsis

    Imposes duties of care on user-to-user and search services with UK links to assess and mitigate illegal content risks and, where children are likely to access the service, to protect them from harmful content, including through highly effective age assurance. Ofcom enforces through codes of practice, information notices and fines.

    Key themes
    • children's risk assessment
    • age assurance
    • illegal content
    • transparency reporting
    • categorised services
    • Ofcom codes
    Unique features

    Turnover-based fines and potential business disruption (blocking) orders, and personal liability for senior managers in some cases; age assurance duties interact directly with UK GDPR data minimisation and the Children's Code.

    SaaS relevance

    Caught if the SaaS lets users share content with other users or provides search and has a significant number of UK users or targets the UK; pure B2B tools without user-to-user functionality are largely out of scope.

    Extraterritorial
    Yes
    Breach notification
    None (not a data breach law)
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    £18m or 10% of qualifying worldwide revenue (higher)
    Key dates
    • Adopted
    • In force
    • Royal Assent 2023-10-26; illegal content duties from 2025-03-17; child safety duties and highly effective age assurance from 2025-07-25; categorised service duties and register phased later; amended by DUAA s.124 (2025-09-30)
    Text
    Authority
    Ofcom
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Phased Ofcom implementation dates taken from general knowledge of Ofcom's roadmap and not re-verified this session.

    Full record for OSA
    Partly verifiedMedium confidence. Phased Ofcom implementation dates taken from general knowledge of Ofcom's roadmap and not re-verified this session.

Cybersecurity2

  • NIS RegulationsNetwork and Information Systems Regulations 2018In force
    In force from     Implements the NIS Directive in the UK, requiring operators of essential services and relevant digital service providers to manage network and information security risks and report significant incidents. The ICO regulates cloud computing services, online marketplaces and search engines.
    Synopsis

    Implements the NIS Directive in the UK, requiring operators of essential services and relevant digital service providers to manage network and information security risks and report significant incidents. The ICO regulates cloud computing services, online marketplaces and search engines.

    Key themes
    • security measures
    • incident reporting
    • operators of essential services
    • relevant digital service providers
    • cloud
    Unique features

    UK kept the original NIS model after Brexit rather than adopting NIS2; small and micro enterprises are exempt from the RDSP regime.

    SaaS relevance

    Medium and large cloud computing service providers (including many SaaS platforms) offering services in the UK are RDSPs and must register with the ICO and report incidents.

    Extraterritorial
    Yes
    Breach notification
    Incidents with substantial impact: competent authority within 72h
    DPO
    No
    Cross-border transfers
    Non-UK RDSPs must nominate a UK representative
    Maximum penalty
    £17m
    Key dates
    • Adopted
    • In force
    • Amended 2020 and 2021 (Brexit); to be substantially amended/replaced by the Cyber Security and Resilience Bill
    Text
    Authority
    Sector competent authorities; ICO for relevant digital service providers (online marketplaces, search engines, cloud computing services)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. No verification notes recorded.

    Full record for NIS Regulations
    Partly verifiedMedium confidence. No verification notes recorded.
Historic & pending (1)
  • CS&R BillCyber Security and Resilience BillBill/proposed
    Government bill to update the NIS Regulations 2018 by bringing managed service providers and data centres into scope, empowering designation of critical suppliers, tightening incident reporting and increasing regulators' powers. Has passed the Commons and is at Lords Report stage.
    Synopsis

    Government bill to update the NIS Regulations 2018 by bringing managed service providers and data centres into scope, empowering designation of critical suppliers, tightening incident reporting and increasing regulators' powers. Has passed the Commons and is at Lords Report stage.

    Key themes
    • managed service providers
    • data centres
    • critical suppliers
    • incident reporting
    • regulator powers
    • ransomware
    Unique features

    Proposes a 24-hour initial incident notification with fuller report within 72 hours and turnover-based penalties, moving the UK closer to NIS2.

    SaaS relevance

    Managed IT service providers and larger SaaS/cloud businesses serving UK customers are likely to become regulated entities or critical suppliers.

    Extraterritorial
    Yes
    Breach notification
    Proposed: initial notification 24h, full report 72h
    DPO
    No
    Maximum penalty
    Proposed turnover-based fines (figures subject to final text)
    Key dates
    • Introduced in Commons November 2025; Commons second reading January 2026; passed Commons; House of Lords Report stage as of 15 October 2026; no Royal Assent
    Text
    Authority
    Sector regulators; ICO (digital services); DSIT
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Proposed reporting times and penalty levels are from the bill as introduced and may change at Lords stages.

    Full record for CS&R Bill
    Partly verifiedMedium confidence. Proposed reporting times and penalty levels are from the bill as introduced and may change at Lords stages.

Data localisation / cross-border2

  • UK–US Data BridgeData Protection (Adequacy) (United States of America) Regulations 2023 – UK Extension to the EU–US Data Privacy Framework ('UK–US Data Bridge')In force
    In force from     UK adequacy regulations allowing personal data to flow to US organisations certified to the UK Extension of the EU–US Data Privacy Framework without further safeguards. It depends on the US Executive Order 14086 redress mechanism being extended to the UK.
    Synopsis

    UK adequacy regulations allowing personal data to flow to US organisations certified to the UK Extension of the EU–US Data Privacy Framework without further safeguards. It depends on the US Executive Order 14086 redress mechanism being extended to the UK.

    Key themes
    • adequacy
    • DPF certification
    • US redress
    • onward transfers
    Unique features

    Excludes some data (e.g. journalistic data) and requires explicit flagging of special category data by exporters such as genetic, biometric and criminal data.

    SaaS relevance

    A UK SaaS provider can use US vendors certified to the UK Extension without an IDTA; US SaaS providers can self-certify to receive UK data.

    Cross-border transfers
    Partial adequacy for certified US organisations
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Information Commissioner's Office (ICO); DSIT
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Status depends on continued operation of the EU–US DPF and PCLOB/EO 14086 safeguards; monitor US developments.

    Full record for UK–US Data Bridge
    Partly verifiedMedium confidence. Status depends on continued operation of the EU–US DPF and PCLOB/EO 14086 safeguards; monitor US developments.
  • IDTA / UK AddendumInternational Data Transfer Agreement (IDTA) and International Data Transfer Addendum to the EU Standard Contractual ClausesIn force
    In force from     The UK's standard contractual safeguards for restricted transfers under UK GDPR Art 46: a standalone IDTA, or an Addendum that adapts the EU 2021 SCCs for UK transfers. They are used with a transfer risk assessment.
    Synopsis

    The UK's standard contractual safeguards for restricted transfers under UK GDPR Art 46: a standalone IDTA, or an Addendum that adapts the EU 2021 SCCs for UK transfers. They are used with a transfer risk assessment.

    Key themes
    • restricted transfers
    • standard clauses
    • transfer risk assessment
    • processor-to-subprocessor
    Unique features

    The Addendum lets one EU SCC set cover both EU and UK transfers; the ICO's TRA tool is more flexible than the EDPB's approach.

    SaaS relevance

    A SaaS provider sending UK personal data to a non-adequate country (including US sub-processors not on the Data Bridge) normally signs the IDTA or Addendum with customers and sub-processors.

    Cross-border transfers
    Art 46 appropriate safeguard
    Maximum penalty
    Breach enforced via UK GDPR
    Key dates
    • Adopted
    • In force
    • Laid before Parliament 2022-02-02; in force 2022-03-21; old EU SCCs usable for new contracts until 2022-09-21 and for existing contracts until 2024-03-21; remain valid after DUAA transfer reforms (2026-02-05)
    Text
    Authority
    Information Commissioner's Office (ICO)
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Dates from ICO guidance known prior; ICO has signalled possible updates to transfer tools following DUAA.

    Full record for IDTA / UK Addendum
    Partly verifiedMedium confidence. Dates from ICO guidance known prior; ICO has signalled possible updates to transfer tools following DUAA.

Data access / sharing1

  • DUAAData (Use and Access) Act 2025Partially in force
    In force from     A wide-ranging Act that amends UK GDPR, DPA 2018 and PECR, creates frameworks for sector 'smart data' schemes and trusted digital verification services, and restructures the ICO into a corporate Information Commission. Commencement is phased; the core data protection changes have applied since 5 February 2026.
    Synopsis

    A wide-ranging Act that amends UK GDPR, DPA 2018 and PECR, creates frameworks for sector 'smart data' schemes and trusted digital verification services, and restructures the ICO into a corporate Information Commission. Commencement is phased; the core data protection changes have applied since 5 February 2026.

    Key themes
    • smart data schemes
    • digital verification services
    • recognised legitimate interests
    • automated decision-making
    • cookies
    • international transfers
    • complaints
    • Information Commission
    • research
    Unique features

    Introduces a statutory trust framework for digital identity services, regulations-led smart data schemes beyond open banking, and the UK's own adequacy test ('not materially lower'), while keeping the UK broadly aligned enough to have EU adequacy renewed in December 2025.

    SaaS relevance

    SaaS providers to UK users benefit from looser cookie, legitimate interest and ADM rules but must implement a complaints procedure and face PECR fines at GDPR level; identity/verification and data-portability vendors may fall within the DVS and smart data regimes.

    Extraterritorial
    Yes
    Breach notification
    See UK GDPR / PECR
    DPO
    Conditional
    Cross-border transfers
    Amends UK GDPR Chapter V – new 'data protection test' for adequacy and safeguards
    Maximum penalty
    Applies UK GDPR levels; PECR now £17.5m or 4%
    Key dates
    • Adopted
    • In force
    • Royal Assent 2025-06-19; Commencement No.1 2025-08-20 (Part 1 smart data framework, PECR s.111, ICO duties); No.3 2025-09-05 & 2025-11-17 (LPP, national security); No.2 2025-09-30 (OSA amendment); No.4 2025-12-01 (most of Part 2 digital verification services, except ss.45–48); No.6 (SI 2026/82) 2026-02-05 (main data protection and PECR reforms) and 2026-06-19 (s.103 complaints); Part 6 Information Commission – later commencement
    Text
    Authority
    Information Commissioner's Office (ICO); Department for Science, Innovation and Technology (smart data, DVS)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact commencement of Part 6 (Information Commission) unconfirmed: one tracker reports transfer of functions from 2026-09-30; ICO site title already reads 'Information Commission's Office'. DVS ss.45–48 and some smart data regulations may still be pending.

    Full record for DUAA
    Partly verifiedMedium confidence. Exact commencement of Part 6 (Information Commission) unconfirmed: one tracker reports transfer of functions from 2026-09-30; ICO site title already reads 'Information Commission's Office'. DVS ss.45–48 and some smart data regulations may still be pending.

Surveillance / law enforcement access2

  • IPAInvestigatory Powers Act 2016 (as amended by the Investigatory Powers (Amendment) Act 2024)In force
    In force from     Provides the legal framework for UK interception, equipment interference, communications data acquisition and bulk powers, plus technical capability, national security and data retention notices to telecommunications operators. The 2024 amendments added notification notices requiring some operators to tell the Home Office in advance of technical changes that would affect lawful access.
    Synopsis

    Provides the legal framework for UK interception, equipment interference, communications data acquisition and bulk powers, plus technical capability, national security and data retention notices to telecommunications operators. The 2024 amendments added notification notices requiring some operators to tell the Home Office in advance of technical changes that would affect lawful access.

    Key themes
    • lawful interception
    • communications data
    • data retention notices
    • technical capability notices
    • equipment interference
    • bulk datasets
    • double-lock warrants
    Unique features

    Broad definition of 'telecommunications operator' captures many online and cloud services; technical capability notices can be served on overseas operators, as illustrated by the reported 2025 notice to Apple over Advanced Data Protection.

    SaaS relevance

    SaaS providers offering communications or storage services to UK users can be treated as telecommunications operators and receive retention, capability or notification notices, which affects encryption design and transparency commitments.

    Extraterritorial
    Yes
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Notices can apply to overseas operators; UK–US CLOUD Act data access agreement operates alongside
    Maximum penalty
    Civil enforcement of notices; criminal offences for unlawful interception or disclosure of notices
    Key dates
    • Adopted
    • In force
    • Royal Assent 2016-11-29; phased commencement 2016–2018; Investigatory Powers (Amendment) Act 2024 (2024 c. 9) Royal Assent April 2024, phased commencement 2024–2025 (notification notices, bulk personal datasets, ICR changes)
    Text
    Authority
    Investigatory Powers Commissioner's Office (IPCO); Investigatory Powers Tribunal
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Exact 2024 Act commencement dates not re-verified.

    Full record for IPA
    Partly verifiedMedium confidence. Exact 2024 Act commencement dates not re-verified.
Historic & pending (1)
  • DRIPAData Retention and Investigatory Powers Act 2014Repealed/superseded
    In force from     DRIPA was passed after the Court of Justice of the EU declared the Data Retention Directive 2006/24/EC invalid. It dealt with the retention of communications data, amended the grounds for interception warrants and certain notices under Part 1 of the Regulation of Investigatory Powers Act 2000, addressed the extra-territorial application of that Part and the meaning of 'telecommunications service', and required a review of investigatory powers. Its operative sections ceased to have effect on 31 December 2016, and the Investigatory Powers Act 2016 took over the subject.
    Synopsis

    DRIPA was passed after the Court of Justice of the EU declared the Data Retention Directive 2006/24/EC invalid. It dealt with the retention of communications data, amended the grounds for interception warrants and certain notices under Part 1 of the Regulation of Investigatory Powers Act 2000, addressed the extra-territorial application of that Part and the meaning of 'telecommunications service', and required a review of investigatory powers. Its operative sections ceased to have effect on 31 December 2016, and the Investigatory Powers Act 2016 took over the subject.

    Key themes
    • communications data retention
    • interception warrants
    • extra-territorial reach
    • sunset clause
    Unique features

    Contained a sunset clause that ended its operative provisions on 31 December 2016.

    SaaS relevance

    Historical only; replaced by the Investigatory Powers Act 2016.

    Breach notification
    None
    DPO
    No
    Key dates
    • Adopted
    • In force
    • Ended
    • Royal Assent and commencement 17 July 2014 (s. 8(1)); sections 1 to 7 repealed 31 December 2016 by their own sunset clause (s. 8(3)); s. 8 omitted 27 June 2018 by the Investigatory Powers Act 2016
    Text
    Sources consulted
    Verification

    High confidence.

    Section 8(1) provides that the Act comes into force on the day on which it is passed (Royal Assent, 17 July 2014); section 1(6) alone awaited a commencement order. The 31 December 2016 sunset is in the Act's own text.

    Full record for DRIPA
Part II

Applied while a member of the EU

EU law applied here from 1973 until , the end of the post-exit transition period.

Comprehensive data protection4

  • EUDPRRegulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agenciesIn force
    In force from     Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
    Synopsis

    Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.

    Key themes
    • EU institutions
    • EDPS
    • DPO
    • processors
    • transfers
    • administrative fines
    Unique features

    The EDPS can fine EU institutions directly. The EDPS investigated the European Commission's use of Microsoft 365 under this law.

    SaaS relevance

    Applies when a SaaS provider is a processor for an EU institution or agency: Art 29 processor terms and transfer rules apply.

    Extraterritorial
    No
    Breach notification
    EDPS 72h; individuals if high risk
    DPO
    Yes
    Cross-border transfers
    Adequacy/SCCs/derogations
    Maximum penalty
    €50,000 per infringement / €500,000 per year (fines on EU bodies)
    Key dates
    • Adopted
    • In force
    • Applies from 2018-12-11 (operational personal data rules for Eurojust/EPPO etc. phased)
    Text
    Authority
    European Data Protection Supervisor (EDPS)
    Sources consulted
    Verification

    High confidence.

    Full record for EUDPR
  • GDPRRegulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)In force
    In force from     The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
    Synopsis

    The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.

    Key themes
    • principles
    • lawful bases
    • consent
    • data subject rights
    • accountability
    • DPIA
    • DPO
    • processor contracts (Art 28)
    • breach notification
    • cross-border transfers
    • one-stop-shop
    Unique features

    Global benchmark with broad extraterritorial reach (Art 3(2)), turnover-based fines and the one-stop-shop enforcement model.

    SaaS relevance

    Applies to any SaaS provider established in the EU or offering services to, or monitoring, people in the EU, whether as controller or as processor under Art 28.

    Extraterritorial
    Yes
    Breach notification
    Authority within 72h; individuals without undue delay if high risk
    DPO
    Conditional
    Cross-border transfers
    Adequacy/SCCs/BCRs/derogations
    Maximum penalty
    €20m or 4% worldwide annual turnover
    Key dates
    • Adopted
    • In force
    • Applies from 2018-05-25. Supplemented by the GDPR Procedural Regulation (EU) 2025/2518 (applies 2027-04-02). Targeted amendments are proposed in the Digital Omnibus COM(2025) 837 (pending as of Oct 2026). Incorporated into the EEA from 2018-07-20.
    Text
    Authority
    European Data Protection Board (EDPB) / national supervisory authorities
    Sources consulted
    Verification

    High confidence.

    The Digital Omnibus may change the definition of personal data, breach notification (high-risk only, 96h, single entry point) and AI-related legitimate interest. It was not adopted as of Oct 2026; see the separate row.

    Full record for GDPR
Historic & pending (2)
  • Regulation 45/2001 (EU institutions)Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodiesRepealed/superseded
    In force from     Regulation 45/2001 applied data protection rules, modelled on Directive 95/46/EC, to the Community institutions and bodies, and set up the European Data Protection Supervisor as an independent supervisory authority for them. Regulation (EU) 2018/1725 repealed it with effect from 11 December 2018 and references to it were then read as references to the new Regulation.
    Synopsis

    Regulation 45/2001 applied data protection rules, modelled on Directive 95/46/EC, to the Community institutions and bodies, and set up the European Data Protection Supervisor as an independent supervisory authority for them. Regulation (EU) 2018/1725 repealed it with effect from 11 December 2018 and references to it were then read as references to the new Regulation.

    Key themes
    • EU institutions
    • EDPS
    • supervision
    • data subject rights
    Unique features

    Created the European Data Protection Supervisor. Binding in its entirety and directly applicable.

    SaaS relevance

    Historical only; replaced by Regulation (EU) 2018/1725 (EUDPR).

    Breach notification
    None
    Cross-border transfers
    Rules on transfers to third countries
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 18 December 2000; published 12 January 2001; in force on the twentieth day after publication (1 February 2001); repealed with effect from 11 December 2018 by Regulation (EU) 2018/1725
    Text
    Authority
    European Data Protection Supervisor
    Sources consulted
    Verification

    High confidence.

    In force date is the 20th day after the 12 January 2001 publication (Article 51). Repeal date from Article 99 of Regulation 2018/1725. The DPO field is left empty because it was not checked in the text.

    Full record for Regulation 45/2001 (EU institutions)
  • Data Protection DirectiveDirective 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such dataRepealed/superseded
    In force from     The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
    Synopsis

    The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.

    Key themes
    • lawful grounds
    • sensitive data
    • data subject rights
    • DPA notification
    • adequacy
    Unique features

    It created the adequacy concept and the Article 29 Working Party. It was the basis for the Safe Harbor decision that was annulled in Schrems I.

    SaaS relevance

    Historical; its adequacy decisions stayed in force under GDPR Art 45(9) until amended or repealed.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Adequacy; SCCs; BCRs
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • Ended
    • Transposition deadline 1998-10-24; repealed by GDPR with effect from 2018-05-25
    Text
    Authority
    Article 29 Working Party (replaced by EDPB) / national DPAs
    Sources consulted
    Verification

    High confidence.

    Full record for Data Protection Directive

ePrivacy / marketing2

  • ePrivacy DirectiveDirective 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive)In force
    In force from     Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
    Synopsis

    Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).

    Key themes
    • cookies
    • device access
    • confidentiality of communications
    • traffic and location data
    • direct marketing
    • spam
    Unique features

    Art 5(3) applies to any information stored on terminal equipment, personal or not, which is why the EU has cookie banners. Each member state enforces it differently.

    SaaS relevance

    Any SaaS website or app that sets non-essential cookies or SDKs on EU users' devices, or sends marketing emails, must comply.

    Extraterritorial
    Limited
    Breach notification
    Telecoms providers: authority within 24h under Reg 611/2013
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • Amended by Directive 2006/24/EC (Data Retention, annulled 2014) and Directive 2009/136/EC (cookie consent; transposition 2011-05-25). The proposed ePrivacy Regulation COM(2017) 10 was abandoned: the Commission announced withdrawal in its 2025 work programme (2025-02-11). The Digital Omnibus proposes amending Art 5(3) cookie rules (pending).
    Text
    Authority
    National telecoms regulators and/or data protection authorities (varies by member state)
    Sources consulted
    Verification

    High confidence.

    I did not confirm the Official Journal publication of the formal withdrawal of the ePrivacy Regulation. The Council's Oct 2026 Omnibus draft keeps cookie rules in Art 5(3) with six consent exemptions.

    Full record for ePrivacy Directive
Historic & pending (1)
  • Telecoms Privacy Directive 97/66Directive 97/66/EC concerning the processing of personal data and the protection of privacy in the telecommunications sectorRepealed/superseded
    In force from     Directive 97/66/EC harmonised national rules on privacy and data protection in the telecommunications sector. It was a sector-specific complement to Directive 95/46/EC and dealt with matters such as the confidentiality of communications, traffic and billing data, itemised billing, calling-line identification, automatic call forwarding, subscriber directories and unsolicited calls. Directive 2002/58/EC repealed it with effect from 31 October 2003, and references to it were then read as references to the 2002 Directive.
    Synopsis

    Directive 97/66/EC harmonised national rules on privacy and data protection in the telecommunications sector. It was a sector-specific complement to Directive 95/46/EC and dealt with matters such as the confidentiality of communications, traffic and billing data, itemised billing, calling-line identification, automatic call forwarding, subscriber directories and unsolicited calls. Directive 2002/58/EC repealed it with effect from 31 October 2003, and references to it were then read as references to the 2002 Directive.

    Key themes
    • confidentiality of communications
    • traffic and billing data
    • telecoms subscribers
    • directories
    • unsolicited calls
    Unique features

    The first EU instrument on telecoms privacy. It was written for traditional telecommunications networks, which is why it was replaced by a technology-neutral successor.

    SaaS relevance

    Historical only; replaced by Directive 2002/58/EC (ePrivacy Directive).

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 15 December 1997; published in the Official Journal 30 January 1998; Member States had to apply national laws by 24 October 1998; repealed with effect from 31 October 2003 by Directive 2002/58/EC
    Text
    Authority
    National data protection authorities (no EU-level regulator)
    Sources consulted
    Verification

    High confidence.

    The Directive text contains no entry-into-force article of its own, so date_in_force is set to the 24 October 1998 deadline for national implementation (Article 15). Repeal date taken from Articles 17(1) and 19 of Directive 2002/58/EC (transposition deadline 'before 31 October 2003'). Penalties were left to Member States.

    Full record for Telecoms Privacy Directive 97/66

Cybersecurity1

Historic & pending (1)
  • NIS Directive (NIS1)NIS Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systemsRepealed/superseded
    In force from     Directive (EU) 2016/1148 was the first EU-wide cybersecurity law. It required Member States to adopt a national network and information security strategy, set up national authorities and computer security incident response teams, and impose security and incident notification duties on operators of essential services and on digital service providers. Directive (EU) 2022/2555 (NIS2) repealed it with effect from 18 October 2024.
    Synopsis

    Directive (EU) 2016/1148 was the first EU-wide cybersecurity law. It required Member States to adopt a national network and information security strategy, set up national authorities and computer security incident response teams, and impose security and incident notification duties on operators of essential services and on digital service providers. Directive (EU) 2022/2555 (NIS2) repealed it with effect from 18 October 2024.

    Key themes
    • network and information security
    • operators of essential services
    • digital service providers
    • incident notification
    Unique features

    Left Member States to identify operators of essential services; NIS2 replaced this with size-based scope.

    SaaS relevance

    Historical only; replaced by NIS2 (Directive (EU) 2022/2555).

    Breach notification
    Incident notification to the competent authority or CSIRT (Member State rules)
    DPO
    No
    Cross-border transfers
    Cooperation Group and CSIRTs network
    Maximum penalty
    Set by Member States ('effective, proportionate and dissuasive')
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 6 July 2016; published 19 July 2016; in force 8 August 2016; Member States to apply by 9 May 2018; repealed with effect from 18 October 2024 by Directive (EU) 2022/2555 (NIS2)
    Text
    Authority
    National competent authorities and CSIRTs; Cooperation Group
    Sources consulted
    Verification

    High confidence.

    In force date is the 20th day after the 19 July 2016 publication (Article 26). Repeal date from Article 44 of NIS2. Scope, breach and penalty fields are summarised from the Directive's structure and were not read in full.

    Full record for NIS Directive (NIS1)

Data localisation / cross-border6

  • Free Flow of Non-Personal Data RegulationRegulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European UnionIn force
    In force from     Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
    Synopsis

    Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.

    Key themes
    • anti-localisation
    • regulatory data access
    • porting
    • cloud codes of conduct
    Unique features

    It is the counterpart to the GDPR's free movement principle for non-personal data, and produced the SWIPO codes on switching.

    SaaS relevance

    Lets SaaS providers store non-personal data anywhere in the EU, free of national localisation rules.

    Extraterritorial
    No
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Prohibits intra-EU localisation of non-personal data
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Applies from 2019-05-28. Digital Omnibus proposes merging into the Data Act (pending).
    Text
    Authority
    Member state single points of contact; European Commission
    Sources consulted
    Verification

    High confidence.

    Full record for Free Flow of Non-Personal Data Regulation
Historic & pending (5)
  • EU–US Privacy ShieldCommission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU–U.S. Privacy ShieldRepealed/superseded
    In force from     Implementing Decision 2016/1250 found, under Directive 95/46/EC, that the EU–U.S. Privacy Shield ensured an adequate level of protection for personal data transferred from the EU to certified organisations in the United States. It replaced the Safe Harbour decision that the Court of Justice had invalidated in 2015. The Court of Justice struck the Decision down on 16 July 2020 in Schrems II (C-311/18), because of inadequate protection against US government surveillance. Standard contractual clauses stayed available.
    Synopsis

    Implementing Decision 2016/1250 found, under Directive 95/46/EC, that the EU–U.S. Privacy Shield ensured an adequate level of protection for personal data transferred from the EU to certified organisations in the United States. It replaced the Safe Harbour decision that the Court of Justice had invalidated in 2015. The Court of Justice struck the Decision down on 16 July 2020 in Schrems II (C-311/18), because of inadequate protection against US government surveillance. Standard contractual clauses stayed available.

    Key themes
    • adequacy
    • transfers to the US
    • self-certification
    • government access
    • ombudsperson
    Unique features

    Wikipedia mentions an Ombudsperson mechanism for surveillance concerns; its terms were not checked in the Decision text.

    SaaS relevance

    Historical only; invalidated in 2020. Replaced in practice by standard contractual clauses and, from 2023, the EU–US Data Privacy Framework.

    Extraterritorial
    Applied to US organisations that self-certified
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Allowed transfers to certified US organisations
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 12 July 2016; published 1 August 2016; declared invalid by the Court of Justice on 16 July 2020 (Schrems II, Case C-311/18)
    Text
    Authority
    European Commission; US Department of Commerce and Federal Trade Commission administered the US side
    Sources consulted
    Verification

    High confidence.

    End date confirmed from the judgment: Schrems II (C-311/18), Grand Chamber, 16 July 2020, operative part point 5: Implementing Decision (EU) 2016/1250 'is invalid'. In force date is the adoption date (12 July 2016) as given by Wikipedia; the Decision text read gives only adoption and publication (1 August 2016). Wikipedia mention of an Ombudsperson was not checked against the Decision.

    Full record for EU–US Privacy Shield
  • EU SCCs 2010 (C2P)Commission Decision 2010/87/EU on standard contractual clauses for the transfer of personal data to processors established in third countriesRepealed/superseded
    In force from     Decision 2010/87/EU set standard contractual clauses for transfers from an EU controller to a processor in a third country under Directive 95/46/EC, replacing Decision 2002/16/EC from 15 May 2010. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
    Synopsis

    Decision 2010/87/EU set standard contractual clauses for transfers from an EU controller to a processor in a third country under Directive 95/46/EC, replacing Decision 2002/16/EC from 15 May 2010. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.

    Key themes
    • standard contractual clauses
    • controller-to-processor transfers
    Unique features

    Replaced the 2002 processor clauses from 15 May 2010.

    SaaS relevance

    Historical only; replaced by the 2021 standard contractual clauses (Decision (EU) 2021/914).

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Contractual safeguard for transfers to processors outside the EU
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 5 February 2010; applied from 15 May 2010; repealed with effect from 27 September 2021 by Decision (EU) 2021/914; contracts signed before that date remained valid until 27 December 2022
    Text
    Authority
    European Commission; national data protection authorities
    Sources consulted
    Verification

    High confidence.

    Dates from Article 6 of the Decision and Article 4 of Decision 2021/914. The clause annex was not read.

    Full record for EU SCCs 2010 (C2P)
  • EU SCCs 2002 (C2P)Commission Decision 2002/16/EC on standard contractual clauses for the transfer of personal data to processors established in third countriesRepealed/superseded
    In force from     Decision 2002/16/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a processor in a third country. Decision 2010/87/EU repealed it with effect from 15 May 2010. Contracts concluded under it before that date remained in force and effect for as long as the transfers and processing stayed unchanged.
    Synopsis

    Decision 2002/16/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a processor in a third country. Decision 2010/87/EU repealed it with effect from 15 May 2010. Contracts concluded under it before that date remained in force and effect for as long as the transfers and processing stayed unchanged.

    Key themes
    • standard contractual clauses
    • controller-to-processor transfers
    • transfers to third countries
    Unique features

    The first EU model clauses for processors outside the EU.

    SaaS relevance

    Historical only; replaced by Decision 2010/87/EU, itself replaced in 2021.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Contractual safeguard for transfers to processors outside the EU
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 27 December 2001; applied from 3 April 2002; repealed with effect from 15 May 2010 by Decision 2010/87/EU; contracts made before that date stayed valid while the processing remained unchanged
    Text
    Authority
    European Commission; national data protection authorities
    Sources consulted
    Verification

    High confidence.

    Application date from Article 6 of the Decision; repeal from Article 7(1) of Decision 2010/87/EU.

    Full record for EU SCCs 2002 (C2P)
  • EU SCCs 2001 (C2C)Commission Decision 2001/497/EC on standard contractual clauses for the transfer of personal data to third countries (controller to controller)Repealed/superseded
    In force from     Decision 2001/497/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a controller in a third country. Decision 2004/915/EC added an alternative second set of clauses from 1 April 2005. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.
    Synopsis

    Decision 2001/497/EC recognised standard contractual clauses as giving adequate safeguards under Article 26(2) of Directive 95/46/EC for transfers of personal data from an EU controller to a controller in a third country. Decision 2004/915/EC added an alternative second set of clauses from 1 April 2005. Decision (EU) 2021/914 repealed it with effect from 27 September 2021. Contracts concluded before that date were deemed to give appropriate safeguards until 27 December 2022, if the processing stayed unchanged.

    Key themes
    • standard contractual clauses
    • controller-to-controller transfers
    • transfers to third countries
    Unique features

    The first set of EU standard contractual clauses. Decision 2004/915/EC let exporters choose between two sets of clauses.

    SaaS relevance

    Historical only; replaced by the 2021 standard contractual clauses (Decision (EU) 2021/914).

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Contractual safeguard for transfers outside the EU
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 15 June 2001; applied from 3 September 2001; amended by Decision 2004/915/EC (alternative set of clauses, applied from 1 April 2005); repealed with effect from 27 September 2021 by Decision (EU) 2021/914; contracts signed before that date remained valid until 27 December 2022
    Text
    Authority
    European Commission; national data protection authorities
    Sources consulted
    Verification

    High confidence.

    Date of application from Article 6 of the Decision; repeal and transitional dates from Article 4 of Decision 2021/914.

    Full record for EU SCCs 2001 (C2C)
  • EU–US Safe HarbourCommission Decision 2000/520/EC on the adequacy of the Safe Harbour privacy principlesRepealed/superseded
    In force from     Decision 2000/520/EC found, under Article 25 of Directive 95/46/EC, that US organisations adhering to the Safe Harbour privacy principles and the related frequently asked questions issued by the US Department of Commerce provided adequate protection. US companies self-certified to the Department of Commerce, and EU personal data could then be transferred to them without further safeguards. The Court of Justice declared the Decision invalid on 6 October 2015 in Schrems (C-362/14).
    Synopsis

    Decision 2000/520/EC found, under Article 25 of Directive 95/46/EC, that US organisations adhering to the Safe Harbour privacy principles and the related frequently asked questions issued by the US Department of Commerce provided adequate protection. US companies self-certified to the Department of Commerce, and EU personal data could then be transferred to them without further safeguards. The Court of Justice declared the Decision invalid on 6 October 2015 in Schrems (C-362/14).

    Key themes
    • adequacy
    • transfers to the US
    • self-certification
    • seven privacy principles
    Unique features

    A self-certification scheme, not a US statute. Only organisations under the jurisdiction of the Federal Trade Commission or the Department of Transportation could join.

    SaaS relevance

    Historical only; invalidated in 2015 and replaced by the EU–US Privacy Shield, then by the EU–US Data Privacy Framework.

    Extraterritorial
    Applied to US organisations that self-certified
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Allowed transfers to self-certified US organisations
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 26 July 2000; published 25 August 2000; Member States to comply within 90 days of notification; the Commission's 2013 Communication dates the 'establishment of Safe Harbour' to 2000; declared invalid by the Court of Justice on 6 October 2015 (Schrems, Case C-362/14)
    Text
    Authority
    European Commission; US Department of Commerce and Federal Trade Commission administered the US side
    Sources consulted
    Verification

    High confidence.

    date_in_force is the year only. No official source read gives the exact start: Article 5 gives Member States 90 days from notification (notification date not found), and COM(2013) 847 refers only to 'the establishment of Safe Harbour in 2000'. The Commission staff working documents of 2002 and 2004 could not be retrieved from publications.europa.eu. End date confirmed from the judgment: Schrems (C-362/14), Grand Chamber, 6 October 2015, operative part: 'Decision 2000/520 is invalid'.

    Full record for EU–US Safe Harbour

Surveillance / law enforcement access4

  • EU PNR DirectivePNR Directive (EU) 2016/681 on the use of passenger name record data for the prevention, detection, investigation and prosecution of terrorist offences and serious crimeIn force
    In force from     Directive (EU) 2016/681 requires air carriers to transfer passenger name record data to a Passenger Information Unit set up or designated in each Member State, for use against terrorist offences and serious crime. Member States keep the data in the unit for five years after transfer, and the Directive requires certain data elements to be masked out after six months.
    Synopsis

    Directive (EU) 2016/681 requires air carriers to transfer passenger name record data to a Passenger Information Unit set up or designated in each Member State, for use against terrorist offences and serious crime. Member States keep the data in the unit for five years after transfer, and the Directive requires certain data elements to be masked out after six months.

    Key themes
    • passenger name records
    • air carriers
    • terrorism and serious crime
    • retention and depersonalisation
    Unique features

    Passenger Information Units process the data; a data protection officer is appointed in each unit.

    SaaS relevance

    Mainly affects air carriers and the travel-sector software that handles booking data.

    Breach notification
    None
    DPO
    Yes (each Passenger Information Unit has a data protection officer)
    Cross-border transfers
    Rules for transfers to third countries
    Maximum penalty
    Set by Member States
    Key dates
    • Adopted
    • In force
    • Adopted 27 April 2016; published 4 May 2016; in force 24 May 2016; Member States to apply by 25 May 2018
    Text
    Authority
    National Passenger Information Units; national supervisory authorities
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.

    Full record for EU PNR Directive
    Partly verifiedMedium confidence. Dates from the Directive text (Articles 18 and 22). Directive 2016/681 remains in force as far as this research could confirm; the Court of Justice ruled on it in Case C-817/19 (2022), which was not checked here. The flight scope was not checked in the text, so it is not stated; the SaaS comment is an assessment.
  • LEDDirective (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law enforcement purposes (Law Enforcement Directive)In force
    In force from     The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
    Synopsis

    The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.

    Key themes
    • law enforcement
    • logging
    • categories of data subjects
    • DPIA
    • DPO
    • transfers to third-country authorities
    Unique features

    It requires processing operations to be logged and allows rights to be restricted to protect investigations.

    SaaS relevance

    Applies to SaaS providers only indirectly, as processors for police or justice customers, which must meet the LED's contractual and security requirements.

    Extraterritorial
    No
    Breach notification
    Authority 72h; individuals if high risk (with exceptions)
    DPO
    Yes
    Cross-border transfers
    Adequacy/appropriate safeguards/derogations (Ch V)
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • Transposition deadline 2018-05-06
    Text
    Authority
    National supervisory authorities
    Sources consulted
    Verification

    High confidence.

    Full record for LED
Historic & pending (2)
  • Framework Decision 2008/977/JHACouncil Framework Decision 2008/977/JHA on the protection of personal data in police and judicial cooperation in criminal mattersRepealed/superseded
    In force from     Framework Decision 2008/977/JHA set data protection rules for personal data that Member States exchanged with each other in police and judicial cooperation in criminal matters. It dealt with matters such as purpose limitation, logging and documentation of transmissions, retention time limits and onward transfers. It did not cover purely domestic processing. Directive (EU) 2016/680, the Law Enforcement Directive, repealed it with effect from 6 May 2018.
    Synopsis

    Framework Decision 2008/977/JHA set data protection rules for personal data that Member States exchanged with each other in police and judicial cooperation in criminal matters. It dealt with matters such as purpose limitation, logging and documentation of transmissions, retention time limits and onward transfers. It did not cover purely domestic processing. Directive (EU) 2016/680, the Law Enforcement Directive, repealed it with effect from 6 May 2018.

    Key themes
    • police and judicial cooperation
    • cross-border exchange
    • retention limits
    • onward transfer
    Unique features

    Applied only to data transmitted or made available between Member States, not to national police processing.

    SaaS relevance

    Historical only; replaced by the Law Enforcement Directive (EU) 2016/680.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Rules for onward transfer to third states and bodies
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 27 November 2008; published 30 December 2008; in force 19 January 2009; repealed with effect from 6 May 2018 by Directive (EU) 2016/680
    Text
    Authority
    National data protection authorities (no EU-level regulator)
    Sources consulted
    Verification

    High confidence.

    In force date is the 20th day after publication on 30 December 2008 (Article 30). Repeal date from Article 59(1) of Directive 2016/680. Scope description is taken from the title and the articles read, not from a full reading.

    Full record for Framework Decision 2008/977/JHA
  • Data Retention DirectiveData Retention Directive 2006/24/ECRepealed/superseded
    In force from     Directive 2006/24/EC required Member States to oblige providers of publicly available electronic communications services and public networks to retain traffic and location data, but not the content of communications, for between six months and two years, so that it could be available for the investigation of serious crime. On 8 April 2014 the Court of Justice declared the Directive invalid in Digital Rights Ireland, finding that the blanket retention it imposed was disproportionate in light of Articles 7 and 8 of the Charter of Fundamental Rights. National laws made under it were left to be assessed separately.
    Synopsis

    Directive 2006/24/EC required Member States to oblige providers of publicly available electronic communications services and public networks to retain traffic and location data, but not the content of communications, for between six months and two years, so that it could be available for the investigation of serious crime. On 8 April 2014 the Court of Justice declared the Directive invalid in Digital Rights Ireland, finding that the blanket retention it imposed was disproportionate in light of Articles 7 and 8 of the Charter of Fundamental Rights. National laws made under it were left to be assessed separately.

    Key themes
    • communications data retention
    • traffic and location data
    • serious crime
    • proportionality
    • Charter Articles 7 and 8
    Unique features

    The first EU law ever to be struck down in full for breach of the Charter's privacy and data protection rights. It derogated from Articles 5, 6 and 9 of Directive 2002/58/EC.

    SaaS relevance

    Historical only; invalidated by the Court of Justice in 2014. Later case law still limits national retention laws for telecoms providers.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Retention period of not less than six months and not more than two years
    Key dates
    • Adopted
    • In force
    • Ended
    • Adopted 15 March 2006; published 13 April 2006; in force 3 May 2006; Member States to apply by 15 September 2007; declared invalid by the Court of Justice on 8 April 2014 (Digital Rights Ireland, Joined Cases C-293/12 and C-594/12)
    Text
    Authority
    National authorities (no EU-level regulator)
    Sources consulted
    Verification

    High confidence.

    End date confirmed from the judgment: Digital Rights Ireland, Joined Cases C-293/12 and C-594/12, Grand Chamber, 8 April 2014, which answers that Directive 2006/24 is invalid. In force date is the 20th day after publication on 13 April 2006 (Article 16), which agrees with Wikipedia (3 May 2006). The judgment does not appear to limit the effects in time; I did not find any such limitation in the passages searched, so the end date is the judgment date.

    Full record for Data Retention Directive

Human rights / constitutional2

  • CFR Arts 7–8Charter of Fundamental Rights of the European Union, Articles 7 and 8In force
    In force from     Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.
    Synopsis

    Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.

    Key themes
    • right to privacy
    • right to data protection
    • independent supervision
    • access
    • rectification
    Unique features

    It makes data protection a fundamental right distinct from privacy. It is the basis for CJEU judgments striking down EU acts and transfer decisions, such as Digital Rights Ireland, Schrems I and Schrems II.

    SaaS relevance

    It is the yardstick against which EU transfer mechanisms (DPF, SCCs) and GDPR interpretation are tested, so it directly affects SaaS transfer risk.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Indirect: basis for 'essential equivalence' test
    Maximum penalty
    None directly
    Key dates
    • Adopted
    • In force
    • Proclaimed in Nice on 2000-12-07; legally binding with the same value as the Treaties from 2009-12-01 (Treaty of Lisbon, Art 6(1) TEU)
    Text
    Authority
    Court of Justice of the European Union; independent supervisory authorities (Art 8(3))
    Sources consulted
    Verification

    High confidence.

    Full record for CFR Arts 7–8
  • TFEU Art 16Treaty on the Functioning of the European Union, Article 16In force
    In force from     Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.
    Synopsis

    Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.

    Key themes
    • legal basis
    • right to data protection
    • independent supervision
    Unique features

    It is the legal basis for the GDPR, the LED and the EUDPR. The earlier Directive 95/46 relied on internal-market powers instead.

    SaaS relevance

    Gives no direct obligations; it is the legal basis for the GDPR family.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Signed as part of the Lisbon Treaty on 2007-12-13; in force 2009-12-01
    Text
    Authority
    Independent supervisory authorities
    Sources consulted
    Verification

    High confidence.

    Declaration 21 annexed to the Lisbon Treaty provides for specific rules for police and judicial cooperation; Art 39 TEU covers CFSP.

    Full record for TFEU Art 16
Part III

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 20 instruments from 4 bodies.

Commonwealth of Nations

  • Commonwealth Model LawCommonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy BillIn force
    In force from     A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
    Synopsis

    A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.

    Key themes
    • model legislation
    • consent
    • breach handling
    • cross-border transfers
    • harmonisation
    Unique features

    Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.

    SaaS relevance

    Background only; influences national laws in smaller Commonwealth jurisdictions.

    Breach notification
    Model provisions on breach investigation
    Cross-border transfers
    Model grounds for cross-border transfer
    Maximum penalty
    None (model)
    Key dates
    • Adopted
    • In force
    • 2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022
    Text
    Authority
    Commonwealth Secretariat (Rule of Law)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

    Full record for Commonwealth Model Law
    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

Council of Europe

  • Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal DataIn force
    In force from     The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
    Synopsis

    The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.

    Key themes
    • data quality
    • sensitive data
    • security
    • access and rectification
    • transborder flows
    • mutual assistance
    Unique features

    It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.

    SaaS relevance

    It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.

    Breach notification
    None (added by 108+)
    DPO
    No
    Cross-border transfers
    Free flow between parties; restrictions to non-parties permitted
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)
    Text
    Authority
    Consultative Committee of Convention 108 (T-PD)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate; the treaty office page did not render for me.

    Full record for Convention 108
  • Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)Enacted – not yet in force
    Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
    Synopsis

    Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.

    Key themes
    • lawful basis
    • accountability
    • breach notification
    • automated decisions
    • privacy by design
    • transborder flows
    • follow-up mechanism
    Unique features

    It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.

    SaaS relevance

    Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.

    Breach notification
    Supervisory authority without delay for serious breaches (Art 7(2))
    DPO
    No
    Cross-border transfers
    Free flow between parties; appropriate safeguards for non-parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
    Text
    Authority
    Convention Committee (T-PD); national supervisory authorities
    Sources consulted
    Verification

    High confidence.

    Not in force as of Oct 2026 (34 of 38 required ratifications). The text_url document ID was not re-checked this session.

    Full record for Convention 108+
  • CoE AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of LawSigned – not ratified
    The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
    Synopsis

    The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.

    Key themes
    • AI lifecycle
    • human rights impact assessment
    • transparency
    • accountability
    • privacy
    • remedies
    • risk management
    Unique features

    It is open to non-European signatories, including the US, UK, Canada and Japan. It is principle-based and leaves parties to choose implementation measures, unlike the prescriptive EU AI Act.

    SaaS relevance

    It has no direct obligations yet; for EU-market SaaS it will be implemented mainly through the AI Act.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted 2024-05-17; opened in Vilnius on 2024-09-05. Enters into force on the first day of the month after 3 months from the 5th ratification (at least 3 of them CoE member states). The EU ratified on 2026-05-15. The threshold had not been reached as of Sept 2026.
    Text
    Authority
    Conference of the Parties (once in force)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.

    Full record for CoE AI Convention
    Partly verifiedMedium confidence. The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
  • Protocol 181Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flowsIn force
    In force from     Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
    Synopsis

    Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.

    Key themes
    • independent supervisory authority
    • adequacy
    • transborder data flows
    Unique features

    It brought the adequacy and independent-DPA concepts of Directive 95/46 into the Council of Europe framework.

    SaaS relevance

    It shapes the transfer rules of non-EU parties that a SaaS provider may need to meet.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Adequacy or ad hoc/approved safeguards for non-parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 181; opened 2001-11-08; in force 2004-07-01; to be absorbed by Convention 108+
    Text
    Authority
    National supervisory authorities; T-PD
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I could not fetch the treaty office status page; the dates come from established references.

    Full record for Protocol 181
    Partly verifiedMedium confidence. I could not fetch the treaty office status page; the dates come from established references.
  • Budapest ConventionConvention on Cybercrime (Budapest Convention)In force
    In force from     The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
    Synopsis

    The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.

    Key themes
    • cybercrime offences
    • data preservation
    • production orders
    • interception
    • mutual legal assistance
    • 24/7 network
    Unique features

    It has over 75 parties worldwide and is the model for many national cybercrime laws. Article 15 requires procedural powers to be subject to human rights conditions and safeguards.

    SaaS relevance

    National laws based on it allow domestic production and preservation orders for subscriber and traffic data held by SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    MLA and 24/7 points of contact
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • ETS No. 185; opened 2001-11-23; in force 2004-07-01; First Additional Protocol (ETS 189, xenophobia) 2003; Second Additional Protocol CETS 224 (2022) not yet in force
    Text
    Authority
    Cybercrime Convention Committee (T-CY)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The party count is approximate.

    Full record for Budapest Convention
    Partly verifiedMedium confidence. The party count is approximate.
  • Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidenceSigned – not ratified
    Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
    Synopsis

    Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.

    Key themes
    • direct cooperation with providers
    • subscriber information
    • domain registration data
    • emergency disclosure
    • data protection safeguards (Art 14)
    Unique features

    It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.

    SaaS relevance

    Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.

    Extraterritorial
    Yes
    Breach notification
    Art 14 requires notifying the transferring party of security incidents involving transferred data
    DPO
    No
    Cross-border transfers
    Art 14 safeguards govern transfers between parties
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
    Text
    Authority
    Cybercrime Convention Committee (T-CY)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.

    Full record for Budapest 2nd Additional Protocol
    Partly verifiedMedium confidence. I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
  • ECHR Art 8Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8In force
    In force from     Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
    Synopsis

    Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.

    Key themes
    • private life
    • correspondence
    • surveillance
    • legality
    • necessity and proportionality
    • positive obligations
    Unique features

    It has a large body of case law on surveillance and data retention (e.g. S. and Marper, Big Brother Watch, Centrum för Rättvisa). Article 8 has been read to include data protection, and it informs the interpretation of the EU Charter (Art 52(3)).

    SaaS relevance

    It binds states only, but it drives national law on employee monitoring, surveillance and data retention that affects SaaS providers.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    Just satisfaction awarded against states
    Key dates
    • Adopted
    • In force
    • ETS No. 005; signed in Rome on 1950-11-04; in force 1953-09-03
    Text
    Authority
    European Court of Human Rights
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1950ECHR.pdf). Russia ceased to be a party on 2022-09-16.

    Full record for ECHR Art 8
  • Rec 509 (1968)Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological DevelopmentsIn force
    In force from     In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
    Synopsis

    In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.

    Key themes
    • technology and privacy
    • surveillance devices
    • computers
    • adequacy of ECHR Art 8
    Unique features

    It was the first pan-European political recognition that computerisation threatened privacy. It is non-binding and historical.

    SaaS relevance

    Historical background only; no obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).

    Full record for Rec 509 (1968)
    Partly verifiedMedium confidence. I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
  • Res (74) 29Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public SectorRepealed/superseded
    In force from     The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
    Synopsis

    The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.

    Key themes
    • public sector
    • transparency
    • lawfulness
    • accuracy
    • security
    • access
    Unique features

    Extended the 1973 principles to government processing.

    SaaS relevance

    Historical only; no current obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Superseded by Convention 108. I did not re-check the document URL this session.

    Full record for Res (74) 29
    Partly verifiedMedium confidence. Superseded by Convention 108. I did not re-check the document URL this session.
  • Res (73) 22Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private SectorRepealed/superseded
    In force from     A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
    Synopsis

    A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.

    Key themes
    • private sector
    • data quality
    • purpose
    • retention
    • security
    • access
    Unique features

    Early soft-law forerunner of Convention 108, focused on the private sector.

    SaaS relevance

    Historical only; no current obligations.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.

    Full record for Res (73) 22
    Partly verifiedMedium confidence. Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.

Organisation for Economic Co-operation and Development (OECD)

  • OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force
    In force from     Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
    Synopsis

    Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

    Key themes
    • trustworthy AI
    • human rights
    • privacy
    • transparency
    • explainability
    • robustness
    • accountability
    Unique features

    It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

    SaaS relevance

    Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
    Text
    Authority
    OECD Working Party on AI Governance / OECD.AI
    Sources consulted
    Verification

    High confidence.

    Full record for OECD AI Principles
  • OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force
    In force from     The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
    Synopsis

    The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

    Key themes
    • government access
    • national security
    • law enforcement
    • legal basis
    • oversight
    • redress
    • transparency
    Unique features

    It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

    SaaS relevance

    Useful reference for transfer impact assessments and for policies on responding to government data demands.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Supports trusted data flows between adherents
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Trusted Government Access Declaration
  • OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force
    In force from     Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
    Synopsis

    Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

    Key themes
    • accountability
    • privacy management programmes
    • breach notification
    • enforcement cooperation
    • interoperability
    • transborder flows
    Unique features

    It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

    SaaS relevance

    It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

    Breach notification
    Recommended: authority and affected individuals for significant breaches
    DPO
    No
    Cross-border transfers
    Restrictions should be proportionate to risk
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
    Text
    Authority
    OECD Working Party on Data Governance and Privacy
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Privacy Guidelines 2013
  • OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded
    In force from     A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
    Synopsis

    A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

    Key themes
    • eight fair information principles
    • accountability
    • transborder flows
    Unique features

    These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

    SaaS relevance

    Historical baseline; its principles are reflected in most national laws a SaaS provider meets.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow encouraged; restrictions only where proportionate
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Ended
    • Revised 2013-07-11 (see separate row)
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

    Full record for OECD Guidelines 1980

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.