DSGData Protection Act of 4 October 2018 (Datenschutzgesetz, DSG), LGBl. 2018 Nr. 272In force In force from Implements and supplements the GDPR in Liechtenstein as an EEA state and transposes the Law Enforcement Directive. The Datenschutzstelle supervises compliance.
Synopsis
Implements and supplements the GDPR in Liechtenstein as an EEA state and transposes the Law Enforcement Directive. The Datenschutzstelle supervises compliance.
Key themes
GDPR implementation
national derogations
LED transposition
video surveillance
Unique features
Age of digital consent 16; GDPR applied in Liechtenstein from 20 July 2018 via the EEA Agreement, before the DSG entered force.
SaaS relevance
Applies to SaaS providers in Liechtenstein's financial/fintech sector and those targeting its residents.
Extraterritorial
Yes
Breach notification
Authority 72h; individuals without undue delay if high risk
DPO
Conditional
Cross-border transfers
GDPR Chapter V (EEA)
Maximum penalty
€20m or 4% global turnover (CHF equivalent)
Key dates
Adopted
In force
Amended versions in force 2021-01-01, 2025-02-01, 2026-04-01
Partly verifiedMedium confidence.In-force date 2019-01-01 inferred from earliest consolidated version. EEA state – GDPR applies.
Part II
Also applies here
Inherited from the European Economic Area.
Comprehensive data protection1
GDPR in the EEAEEA Joint Committee Decision No 154/2018 incorporating Regulation (EU) 2016/679 into the EEA AgreementIn force In force from Brings the GDPR into the EEA Agreement so that it applies in the three EEA EFTA states with adaptations. Their DPAs take part in the EDPB, and personal data flows freely between the EU and the EEA EFTA states.
Synopsis
Brings the GDPR into the EEA Agreement so that it applies in the three EEA EFTA states with adaptations. Their DPAs take part in the EDPB, and personal data flows freely between the EU and the EEA EFTA states.
Key themes
EEA
GDPR incorporation
EFTA
EDPB participation
Unique features
The EEA EFTA DPAs participate in the EDPB but have no vote on certain decisions; EFTA Court jurisdiction applies.
SaaS relevance
A SaaS provider serving Norway, Iceland or Liechtenstein is subject to the GDPR in those countries, and transfers within the EEA need no extra safeguards.
Extraterritorial
Yes
Breach notification
As GDPR
DPO
Conditional
Cross-border transfers
Treated as within the EEA
Maximum penalty
As GDPR
Key dates
Adopted
In force
GDPR applies in Iceland, Liechtenstein and Norway from 2018-07-20
Membership-based — check ratification status in the instrument record. 15 instruments from 2 bodies.
Council of Europe
Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal DataIn force In force from The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Synopsis
The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Key themes
data quality
sensitive data
security
access and rectification
transborder flows
mutual assistance
Unique features
It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.
SaaS relevance
It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.
Breach notification
None (added by 108+)
DPO
No
Cross-border transfers
Free flow between parties; restrictions to non-parties permitted
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)
Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)Enacted – not yet in force Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Synopsis
Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Key themes
lawful basis
accountability
breach notification
automated decisions
privacy by design
transborder flows
follow-up mechanism
Unique features
It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.
SaaS relevance
Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.
Breach notification
Supervisory authority without delay for serious breaches (Art 7(2))
DPO
No
Cross-border transfers
Free flow between parties; appropriate safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
CoE AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of LawSigned – not ratified The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Synopsis
The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Key themes
AI lifecycle
human rights impact assessment
transparency
accountability
privacy
remedies
risk management
Unique features
It is open to non-European signatories, including the US, UK, Canada and Japan. It is principle-based and leaves parties to choose implementation measures, unlike the prescriptive EU AI Act.
SaaS relevance
It has no direct obligations yet; for EU-market SaaS it will be implemented mainly through the AI Act.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2024-05-17; opened in Vilnius on 2024-09-05. Enters into force on the first day of the month after 3 months from the 5th ratification (at least 3 of them CoE member states). The EU ratified on 2026-05-15. The threshold had not been reached as of Sept 2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Protocol 181Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flowsIn force In force from Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Synopsis
Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Key themes
independent supervisory authority
adequacy
transborder data flows
Unique features
It brought the adequacy and independent-DPA concepts of Directive 95/46 into the Council of Europe framework.
SaaS relevance
It shapes the transfer rules of non-EU parties that a SaaS provider may need to meet.
Breach notification
None
DPO
No
Cross-border transfers
Adequacy or ad hoc/approved safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 181; opened 2001-11-08; in force 2004-07-01; to be absorbed by Convention 108+
Partly verifiedMedium confidence.I could not fetch the treaty office status page; the dates come from established references.
Budapest ConventionConvention on Cybercrime (Budapest Convention)In force In force from The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Synopsis
The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Key themes
cybercrime offences
data preservation
production orders
interception
mutual legal assistance
24/7 network
Unique features
It has over 75 parties worldwide and is the model for many national cybercrime laws. Article 15 requires procedural powers to be subject to human rights conditions and safeguards.
SaaS relevance
National laws based on it allow domestic production and preservation orders for subscriber and traffic data held by SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
MLA and 24/7 points of contact
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 185; opened 2001-11-23; in force 2004-07-01; First Additional Protocol (ETS 189, xenophobia) 2003; Second Additional Protocol CETS 224 (2022) not yet in force
Partly verifiedMedium confidence.The party count is approximate.
Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidenceSigned – not ratified Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Synopsis
Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Key themes
direct cooperation with providers
subscriber information
domain registration data
emergency disclosure
data protection safeguards (Art 14)
Unique features
It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.
SaaS relevance
Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.
Extraterritorial
Yes
Breach notification
Art 14 requires notifying the transferring party of security incidents involving transferred data
DPO
No
Cross-border transfers
Art 14 safeguards govern transfers between parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
Medium confidence. Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
ECHR Art 8Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8In force In force from Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Synopsis
Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Key themes
private life
correspondence
surveillance
legality
necessity and proportionality
positive obligations
Unique features
It has a large body of case law on surveillance and data retention (e.g. S. and Marper, Big Brother Watch, Centrum för Rättvisa). Article 8 has been read to include data protection, and it informs the interpretation of the EU Charter (Art 52(3)).
SaaS relevance
It binds states only, but it drives national law on employee monitoring, surveillance and data retention that affects SaaS providers.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Just satisfaction awarded against states
Key dates
Adopted
In force
ETS No. 005; signed in Rome on 1950-11-04; in force 1953-09-03
Rec 509 (1968)Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological DevelopmentsIn force In force from In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Synopsis
In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Key themes
technology and privacy
surveillance devices
computers
adequacy of ECHR Art 8
Unique features
It was the first pan-European political recognition that computerisation threatened privacy. It is non-binding and historical.
Medium confidence. Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Res (74) 29Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public SectorRepealed/superseded In force from The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Synopsis
The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Key themes
public sector
transparency
lawfulness
accuracy
security
access
Unique features
Extended the 1973 principles to government processing.
Partly verifiedMedium confidence.Superseded by Convention 108. I did not re-check the document URL this session.
Res (73) 22Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private SectorRepealed/superseded In force from A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Synopsis
A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Key themes
private sector
data quality
purpose
retention
security
access
Unique features
Early soft-law forerunner of Convention 108, focused on the private sector.
Medium confidence. Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
United Nations
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.