Privacy Map

Asia. National jurisdiction.

India IN

Primary authority: Data Protection Board of India
Part I

Domestic law

Comprehensive data protection2

  • DPDP ActDigital Personal Data Protection Act, 2023 (Act No. 22 of 2023)Partially in force
    In force from     India's first horizontal data protection statute, covering digital personal data (and offline data later digitised). It relies chiefly on notice-and-consent plus a short list of 'legitimate uses', gives data principals rights to access, correction, erasure, grievance redress and nomination, and places security and breach-reporting duties on data fiduciaries. A digital-first Data Protection Board adjudicates complaints and imposes fixed-ceiling penalties.
    Synopsis

    India's first horizontal data protection statute, covering digital personal data (and offline data later digitised). It relies chiefly on notice-and-consent plus a short list of 'legitimate uses', gives data principals rights to access, correction, erasure, grievance redress and nomination, and places security and breach-reporting duties on data fiduciaries. A digital-first Data Protection Board adjudicates complaints and imposes fixed-ceiling penalties.

    Key themes
    • consent
    • legitimate uses
    • notice
    • data principal rights
    • children's data (verifiable parental consent under 18)
    • significant data fiduciaries
    • breach notification
    • consent managers
    • cross-border transfers
    • Data Protection Board
    Unique features

    No 'legitimate interests' basis; consent or enumerated legitimate uses only. Children are anyone under 18, with a ban on tracking, behavioural monitoring and targeted ads at children. Cross-border transfers are permitted by default except to countries the government blacklists, and data principals carry statutory duties that can attract small fines.

    SaaS relevance

    Applies to any SaaS provider processing digital personal data in India, or abroad where linked to offering goods/services to people in India; B2B SaaS acting on a customer's behalf is a 'data processor' bound contractually by the fiduciary, while the fiduciary remains liable.

    Extraterritorial
    Yes
    Breach notification
    Board and each affected data principal without delay; detailed report to Board within 72h (per DPDP Rules)
    DPO
    Conditional
    Cross-border transfers
    Permitted except to countries restricted by Central Government notification (negative list); sectoral localisation laws prevail; SDFs may be required to keep designated data in India
    Maximum penalty
    INR 250 crore per instance (security safeguards failure); INR 200 crore for breach-notification and children's obligations
    Key dates
    • Adopted
    • In force
    • Presidential assent 2023-08-11. Commenced by G.S.R. 843(E) published 2025-11-13: definitions, Chapter V (Data Protection Board) and rule-making powers from 2025-11-13; s6(9) consent-manager registration and s27(1)(d) from 2026-11-13; core obligations, rights, penalties (ss33-34) and s44(2) IT Act amendments from 2027-05-13.
    Text
    Authority
    Data Protection Board of India
    Sources consulted
    Verification

    High confidence.

    DPO mandatory only for Significant Data Fiduciaries (must be India-based); others must publish a contact person. Government may raise Schedule penalties up to 2x by notification (s42). Exact Board website not confirmed.

    Full record for DPDP Act
  • DPDP RulesDigital Personal Data Protection Rules, 2025Partially in force
    In force from     Implementing rules for the DPDP Act that set out notice content, consent-manager registration, security safeguards, breach reporting mechanics, verifiable parental consent, retention/erasure periods, Significant Data Fiduciary duties and Board procedures. They switch on in three phases over 18 months from notification.
    Synopsis

    Implementing rules for the DPDP Act that set out notice content, consent-manager registration, security safeguards, breach reporting mechanics, verifiable parental consent, retention/erasure periods, Significant Data Fiduciary duties and Board procedures. They switch on in three phases over 18 months from notification.

    Key themes
    • notice
    • consent managers
    • reasonable security safeguards
    • breach notification
    • verifiable parental consent
    • data retention/erasure
    • SDF annual DPIA and audit
    • cross-border restrictions
    • Board procedure
    Unique features

    Large e-commerce (20m+ users), social media (20m+) and online gaming (5m+) platforms must erase data three years after the user's last interaction, with 48 hours' prior warning; logs must be kept at least one year. SDFs face annual DPIA and audit and possible localisation of government-specified data categories.

    SaaS relevance

    Sets the concrete security, logging, breach-reporting and retention controls Indian customers will flow down to SaaS processors from 13 May 2027.

    Extraterritorial
    Yes
    Breach notification
    Board and data principals without delay; detailed report to Board within 72h
    DPO
    Conditional
    Cross-border transfers
    Transfers allowed subject to any requirements the Central Government specifies by order; SDF localisation for designated data
    Maximum penalty
    As per DPDP Act Schedule (up to INR 250 crore)
    Key dates
    • Adopted
    • In force
    • Published in Gazette 2025-11-13. Rules 1, 2 and 17-21 (Board constitution and functioning) from 2025-11-13; Rule 4 (consent manager registration) from 2026-11-13; Rules 3, 5-16, 22 and 23 (notice, security, breach, retention, children, SDF, transfers, etc.) from 2027-05-13.
    Text
    Authority
    Data Protection Board of India
    Sources consulted
    Verification

    High confidence.

    Notified as G.S.R. 846(E)/companion to G.S.R. 843(E) (commencement notification); rule numbers per secondary sources. Specific egazette document URL not captured.

    Full record for DPDP Rules

Sectoral privacy3

  • IT Rules 2021Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021In force
    In force from     Due-diligence code for intermediaries conditioning the IT Act s79 safe harbour: published terms, grievance officers, takedown on lawful orders and, for significant social media intermediaries, India-resident compliance officers and originator traceability for messaging. 2026 amendments require labelling and provenance metadata for AI-generated content and much faster removal.
    Synopsis

    Due-diligence code for intermediaries conditioning the IT Act s79 safe harbour: published terms, grievance officers, takedown on lawful orders and, for significant social media intermediaries, India-resident compliance officers and originator traceability for messaging. 2026 amendments require labelling and provenance metadata for AI-generated content and much faster removal.

    Key themes
    • intermediary liability
    • safe harbour
    • grievance redress
    • content takedown
    • traceability
    • synthetic media labelling
    • deepfakes
    Unique features

    Mandatory permanent metadata/provenance identifiers on AI-generated content and 2-3 hour takedown windows; SSMIs must obtain and verify user declarations about synthetic content.

    SaaS relevance

    Any SaaS hosting or transmitting user content for Indian users is an intermediary and must meet due diligence (grievance officer, 7-day grievance resolution, takedowns) to retain safe harbour; AI content tools must label outputs.

    Extraterritorial
    Yes
    Breach notification
    None (cyber incidents via CERT-In)
    DPO
    Conditional
    Cross-border transfers
    None
    Maximum penalty
    Loss of s79 safe harbour; liability under IT Act and other laws
    Key dates
    • Adopted
    • In force
    • Amended 2022, 2023; Amendment Rules 2025 (notified Oct 2025, effective 2025-11-01) tightened takedown-notice authorisation; Amendment Rules 2026 (notified 2026-02-10, effective 2026-02-20) added synthetically generated information (SGI) labelling and cut takedown timelines (3h for court/government orders, 2h for non-consensual intimate/deepfake sexual content).
    Text
    Authority
    Ministry of Electronics and Information Technology (MeitY)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. 'DPO required' reflects grievance officer duty for all intermediaries and Chief Compliance Officer/nodal/resident grievance officer for SSMIs. Original 2021 notification date from general knowledge.

    Full record for IT Rules 2021
    Partly verifiedMedium confidence. 'DPO required' reflects grievance officer duty for all intermediaries and Chief Compliance Officer/nodal/resident grievance officer for SSMIs. Original 2021 notification date from general knowledge.
  • SPDI RulesInformation Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011In force
    In force from     Requires body corporates collecting sensitive personal data (passwords, financial, health, biometric data, etc.) to publish a privacy policy, obtain written consent, appoint a grievance officer and follow reasonable security practices such as ISO/IEC 27001. Restricts onward disclosure and limits overseas transfers to recipients offering equivalent protection.
    Synopsis

    Requires body corporates collecting sensitive personal data (passwords, financial, health, biometric data, etc.) to publish a privacy policy, obtain written consent, appoint a grievance officer and follow reasonable security practices such as ISO/IEC 27001. Restricts onward disclosure and limits overseas transfers to recipients offering equivalent protection.

    Key themes
    • privacy policy
    • consent for SPDI
    • grievance officer
    • reasonable security practices
    • ISO 27001
    • transfers
    Unique features

    Only covers a closed list of 'sensitive' categories; compliance with ISO 27001 or an approved code is deemed reasonable security.

    SaaS relevance

    Governs SaaS handling of Indian SPDI until DPDP's main phase on 13 May 2027.

    Extraterritorial
    Limited
    Breach notification
    None (see CERT-In Directions)
    DPO
    No
    Cross-border transfers
    Transfer of SPDI only where recipient ensures the same level of protection and transfer is necessary for a lawful contract or consented
    Maximum penalty
    Compensation under IT Act s43A (uncapped)
    Key dates
    • Adopted
    • In force
    • Made under IT Act s43A/s87(2)(ob). Expected to lapse when DPDP Act s44(2) omits s43A and s87(2)(ob) on 2027-05-13.
    Text
    Authority
    MeitY / adjudicating officers under IT Act
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. DLA Piper confirms the 2011 'Privacy Rules' continue until 13 May 2027. Lapse is inferred from omission of parent provisions; no express repeal notification seen. Grievance officer is required (not a DPO).

    Full record for SPDI Rules
    Partly verifiedMedium confidence. DLA Piper confirms the 2011 'Privacy Rules' continue until 13 May 2027. Lapse is inferred from omission of parent provisions; no express repeal notification seen. Grievance officer is required (not a DPO).
  • IT Act s43A/72AInformation Technology Act, 2000 - sections 43A and 72AIn force
    In force from     Section 43A makes a body corporate handling sensitive personal data liable to pay compensation if negligent security causes wrongful loss or gain. Section 72A criminalises disclosure of personal information obtained under a lawful contract, without consent and with intent to cause wrongful loss or gain.
    Synopsis

    Section 43A makes a body corporate handling sensitive personal data liable to pay compensation if negligent security causes wrongful loss or gain. Section 72A criminalises disclosure of personal information obtained under a lawful contract, without consent and with intent to cause wrongful loss or gain.

    Key themes
    • reasonable security practices
    • compensation
    • unlawful disclosure
    • criminal liability
    Unique features

    Interim, negligence-based privacy regime limited to 'sensitive personal data or information'; s72A survives the DPDP Act while s43A is repealed when DPDP's core provisions start.

    SaaS relevance

    Until 13 May 2027 any SaaS body corporate handling SPDI of Indian users must maintain reasonable security practices (e.g. ISO 27001) to avoid s43A compensation claims; s72A criminal exposure for unauthorised disclosure continues.

    Extraterritorial
    Limited
    Breach notification
    None under these sections (see CERT-In Directions)
    DPO
    No
    Cross-border transfers
    See SPDI Rules 2011
    Maximum penalty
    s43A: uncapped compensation; s72A: up to 3 years' imprisonment and/or fine up to INR 5 lakh
    Key dates
    • Adopted
    • In force
    • Sections 43A and 72A inserted by IT (Amendment) Act 2008 (in force 2009-10-27). DPDP Act s44(2) omits s43A (and rule-making clause s87(2)(ob)) with effect from 2027-05-13.
    Text
    Authority
    Adjudicating officers under IT Act / courts; MeitY
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Original IT Act dates and s72A penalty from general knowledge, not re-verified this session; s43A omission confirmed from DPDP Act s44(2) text. IT Act s1(2) extends to offences outside India involving Indian computer systems (s75).

    Full record for IT Act s43A/72A
    Partly verifiedMedium confidence. Original IT Act dates and s72A penalty from general knowledge, not re-verified this session; s43A omission confirmed from DPDP Act s44(2) text. IT Act s1(2) extends to offences outside India involving Indian computer systems (s75).

Cybersecurity1

  • CERT-In Directions 2022CERT-In Directions under section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidentsIn force
    In force from     Binding directions requiring service providers, intermediaries, data centres, body corporates and government bodies to report specified cyber incidents to CERT-In within six hours of noticing them. They also mandate NTP clock sync, a CERT-In point of contact, 180-day log retention in India, and five-year retention of subscriber records by cloud, VPS, data-centre and VPN providers.
    Synopsis

    Binding directions requiring service providers, intermediaries, data centres, body corporates and government bodies to report specified cyber incidents to CERT-In within six hours of noticing them. They also mandate NTP clock sync, a CERT-In point of contact, 180-day log retention in India, and five-year retention of subscriber records by cloud, VPS, data-centre and VPN providers.

    Key themes
    • incident reporting
    • 6-hour deadline
    • log retention
    • time synchronisation
    • subscriber KYC
    • cloud/VPN providers
    Unique features

    Among the world's shortest incident-reporting windows (6 hours) and covers a broad incident list beyond personal data breaches.

    SaaS relevance

    Applies to SaaS and cloud providers serving Indian users regardless of incorporation; logs must be kept within Indian jurisdiction (CERT-In FAQs allow foreign providers to store abroad if produced on demand) and cloud providers must keep validated customer records for 5 years.

    Extraterritorial
    Yes
    Breach notification
    CERT-In within 6 hours of noticing listed cyber incidents
    DPO
    No
    Cross-border transfers
    Logs to be maintained in Indian jurisdiction for 180 days
    Maximum penalty
    IT Act s70B(7): up to 1 year imprisonment and/or fine up to INR 1 lakh
    Key dates
    • Adopted
    • In force
    • Issued 2022-04-28; effective 60 days later; 2022-06-27 extension for MSMEs and for subscriber-validation by data centres, VPS, cloud and VPN providers (to 2022-09-25).
    Text
    Authority
    Indian Computer Emergency Response Team (CERT-In)
    Sources consulted
    Verification

    High confidence.

    s70B(7) penalty amount and FAQ position on foreign log storage from general knowledge, not re-verified this session.

    Full record for CERT-In Directions 2022

Data localisation / cross-border1

  • RBI data localisationRBI Directive on Storage of Payment System Data (RBI/2017-18/153, DPSS.CO.OD No.2785/06.08.005/2017-2018)In force
    In force from     Requires all payment system providers authorised in India to store the entire data relating to payment systems they operate only in systems located in India. Data on the foreign leg of a cross-border transaction may also be held abroad.
    Synopsis

    Requires all payment system providers authorised in India to store the entire data relating to payment systems they operate only in systems located in India. Data on the foreign leg of a cross-border transaction may also be held abroad.

    Key themes
    • payment data
    • localisation
    • end-to-end transaction data
    • system audit
    Unique features

    Strict full-copy localisation of payment data rather than a mirror requirement.

    SaaS relevance

    Caught where the SaaS is or supports an authorised payment system operator (payment aggregators, gateways, PPIs) handling Indian payment data.

    Extraterritorial
    Limited
    Breach notification
    None in this circular
    DPO
    No
    Cross-border transfers
    Strict localisation: payment system data stored only in India (foreign leg may also be stored abroad)
    Maximum penalty
    Sanctions under Payment and Settlement Systems Act 2007
    Key dates
    • Adopted
    • In force
    • Issued 2018-04-06; compliance deadline 2018-10-15; board-approved CERT-In empanelled system audit report due 2018-12-31; clarified by RBI FAQs (2019).
    Text
    Authority
    Reserve Bank of India (RBI)
    Sources consulted
    Verification

    High confidence.

    2019 FAQs allow processing abroad if data is brought back to India within 24 hours (from general knowledge, not re-verified).

    Full record for RBI data localisation

Surveillance / law enforcement access1

  • Telecom Act 2023Telecommunications Act, 2023 (Act No. 44 of 2023)Partially in force
    In force from     Consolidated telecom licensing statute that also empowers the government to intercept or suspend messages on public-safety grounds, requires biometric-based user verification by telecom providers, and provides protections against unsolicited commercial communications.
    Synopsis

    Consolidated telecom licensing statute that also empowers the government to intercept or suspend messages on public-safety grounds, requires biometric-based user verification by telecom providers, and provides protections against unsolicited commercial communications.

    Key themes
    • interception
    • suspension of services
    • user verification
    • unsolicited commercial communications
    • telecom licensing
    Unique features

    Broad definitions of 'telecommunication' raised concern about application to OTT services; government has indicated OTT is not covered.

    SaaS relevance

    Relevant mainly to SaaS offering telecom-like messaging/CPaaS services or receiving interception/suspension orders.

    DPO
    No
    Key dates
    • Adopted
    • In force
    • Commenced in tranches by notification from 2024-06-26; replaces Indian Telegraph Act 1885 and Wireless Telegraphy Act 1933.
    Text
    Authority
    Department of Telecommunications (DoT)
    Sources consulted
    Verification

    Low confidence.

    Partly verifiedLow confidence. Could not fetch the Act text or commencement notifications this session; assent and first commencement dates from general knowledge. Verify before relying.

    Full record for Telecom Act 2023
    Partly verifiedLow confidence. Could not fetch the Act text or commencement notifications this session; assent and first commencement dates from general knowledge. Verify before relying.

Human rights / constitutional1

  • PuttaswamyJustice K.S. Puttaswamy (Retd.) v Union of India - right to privacy judgment (Constitution of India, Article 21)In force
    In force from     A unanimous nine-judge bench of the Supreme Court held that privacy is a fundamental right intrinsic to life and personal liberty under Article 21 and protected across Part III of the Constitution. State intrusions must satisfy legality, legitimate aim and proportionality.
    Synopsis

    A unanimous nine-judge bench of the Supreme Court held that privacy is a fundamental right intrinsic to life and personal liberty under Article 21 and protected across Part III of the Constitution. State intrusions must satisfy legality, legitimate aim and proportionality.

    Key themes
    • fundamental right to privacy
    • informational privacy
    • proportionality
    • Article 21
    Unique features

    Constitutional foundation that prompted the DPDP Act; enforceable directly against the State.

    SaaS relevance

    Shapes interpretation of Indian privacy statutes and government data demands; not directly binding on private SaaS contracts.

    Extraterritorial
    No
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Nine-judge bench ruling 2017-08-24; Aadhaar validity judgment (five-judge) 2018-09-26.
    Text
    Authority
    Supreme Court of India
    Sources consulted
    Verification

    High confidence.

    Official judgment URL not captured; citation (2017) 10 SCC 1.

    Full record for Puttaswamy
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 6 instruments from 2 bodies.

Commonwealth of Nations

  • Commonwealth Model LawCommonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy BillIn force
    In force from     A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
    Synopsis

    A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.

    Key themes
    • model legislation
    • consent
    • breach handling
    • cross-border transfers
    • harmonisation
    Unique features

    Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.

    SaaS relevance

    Background only; influences national laws in smaller Commonwealth jurisdictions.

    Breach notification
    Model provisions on breach investigation
    Cross-border transfers
    Model grounds for cross-border transfer
    Maximum penalty
    None (model)
    Key dates
    • Adopted
    • In force
    • 2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022
    Text
    Authority
    Commonwealth Secretariat (Rule of Law)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

    Full record for Commonwealth Model Law
    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.