PDPLPersonal Data Processing Law (Fizisko personu datu apstrādes likums)In force In force from Latvia's PDPL supplements the GDPR, defines the Data State Inspectorate's status and sets national derogations for journalism, research and official publications.
Synopsis
Latvia's PDPL supplements the GDPR, defines the Data State Inspectorate's status and sets national derogations for journalism, research and official publications.
Key themes
national GDPR derogations
age of consent
DPO
employee data
criminal offences
supervisory authority powers
Unique features
Age of digital consent (GDPR Art 8): 13. DVI must consider warnings before fines for minor breaches; specific rules on processing by public bodies and for academic/artistic expression.
SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
Extraterritorial
Limited
Breach notification
Authority 72h; individuals without undue delay (GDPR Arts 33-34)
Partly verifiedMedium confidence. No verification notes recorded.
ePrivacy / marketing1
ISS LawLaw on Information Society Services (Informācijas sabiedrības pakalpojumu likums)In force In force from Latvia's Information Society Services Law requires consent for storing information on users' devices and opt-in for unsolicited electronic commercial communications.
Synopsis
Latvia's Information Society Services Law requires consent for storing information on users' devices and opt-in for unsolicited electronic commercial communications.
Key themes
cookies/terminal equipment consent
direct marketing
soft opt-in
traffic and location data
Unique features
The ePrivacy cookie rule sits in the e-commerce law rather than the electronic communications law.
SaaS relevance
Any SaaS website, app or product that sets non-essential cookies/SDKs or sends marketing emails/SMS to users in this country needs prior consent (subject to exemptions) under this law, regardless of where the provider is based.
Extraterritorial
Yes
Breach notification
Telecom providers: authority notification under Reg 611/2013; otherwise GDPR
DPO
No
Cross-border transfers
None
Maximum penalty
Administrative fines; GDPR fines
Key dates
Adopted
In force
Art 7.1 cookie consent; Art 9 commercial communications
Partly verifiedLow confidence.Not verified this session.
Part II
Also applies here
Inherited from the European Union.
Comprehensive data protection5
EUDPRRegulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agenciesIn force In force from Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
Synopsis
Applies GDPR-equivalent rules to EU institutions, bodies, offices and agencies, under EDPS supervision. Chapter IX covers operational personal data in police and judicial cooperation bodies.
Key themes
EU institutions
EDPS
DPO
processors
transfers
administrative fines
Unique features
The EDPS can fine EU institutions directly. The EDPS investigated the European Commission's use of Microsoft 365 under this law.
SaaS relevance
Applies when a SaaS provider is a processor for an EU institution or agency: Art 29 processor terms and transfer rules apply.
Extraterritorial
No
Breach notification
EDPS 72h; individuals if high risk
DPO
Yes
Cross-border transfers
Adequacy/SCCs/derogations
Maximum penalty
€50,000 per infringement / €500,000 per year (fines on EU bodies)
Key dates
Adopted
In force
Applies from 2018-12-11 (operational personal data rules for Eurojust/EPPO etc. phased)
GDPRRegulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)In force In force from The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
Synopsis
The EU's comprehensive data protection law. It sets principles, lawful bases, transparency and data subject rights, controller and processor duties (records, DPIAs, security, breach notification, DPOs) and rules on international transfers. Independent national authorities enforce it, with consistency handled by the EDPB through the one-stop-shop.
Key themes
principles
lawful bases
consent
data subject rights
accountability
DPIA
DPO
processor contracts (Art 28)
breach notification
cross-border transfers
one-stop-shop
Unique features
Global benchmark with broad extraterritorial reach (Art 3(2)), turnover-based fines and the one-stop-shop enforcement model.
SaaS relevance
Applies to any SaaS provider established in the EU or offering services to, or monitoring, people in the EU, whether as controller or as processor under Art 28.
Extraterritorial
Yes
Breach notification
Authority within 72h; individuals without undue delay if high risk
DPO
Conditional
Cross-border transfers
Adequacy/SCCs/BCRs/derogations
Maximum penalty
€20m or 4% worldwide annual turnover
Key dates
Adopted
In force
Applies from 2018-05-25. Supplemented by the GDPR Procedural Regulation (EU) 2025/2518 (applies 2027-04-02). Targeted amendments are proposed in the Digital Omnibus COM(2025) 837 (pending as of Oct 2026). Incorporated into the EEA from 2018-07-20.
The Digital Omnibus may change the definition of personal data, breach notification (high-risk only, 96h, single entry point) and AI-related legitimate interest. It was not adopted as of Oct 2026; see the separate row.
GDPR Procedural RegulationRegulation (EU) 2025/2518 laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679Enacted – not yet in force In force from Harmonises how supervisory authorities handle cross-border GDPR complaints and investigations. It covers admissibility of complaints, the parties' right to be heard and access to the file, timelines, early resolution, and how lead and concerned authorities cooperate and settle disputes.
Synopsis
Harmonises how supervisory authorities handle cross-border GDPR complaints and investigations. It covers admissibility of complaints, the parties' right to be heard and access to the file, timelines, early resolution, and how lead and concerned authorities cooperate and settle disputes.
Key themes
one-stop-shop
complaint handling
right to be heard
access to file
investigation deadlines
dispute resolution
Unique features
It sets binding procedural deadlines for cross-border investigations and gives companies under investigation harmonised defence rights.
SaaS relevance
Shapes how a SaaS provider with an EU main establishment would be investigated in a cross-border GDPR case from April 2027.
Breach notification
None
Maximum penalty
As GDPR
Key dates
Adopted
In force
Published in OJ 2025-12-12; entered into force 2026-01-01; applies from 2027-04-02
Medium confidence. Partly verifiedMedium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.
Partly verifiedMedium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.
Historic & pending (2)
Digital Omnibus (data)Proposal for a Regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus)Bill/proposed A Commission proposal to simplify EU digital rules. For the GDPR it would clarify that data is not personal for an entity that cannot reasonably identify the person, limit breach notification to high-risk breaches with a 96-hour deadline and a single EU reporting entry point, and recognise legitimate interest for AI development. It would also move cookie consent rules from the ePrivacy Directive into the GDPR, and merge the DGA and Free Flow Regulation into the Data Act.
Synopsis
A Commission proposal to simplify EU digital rules. For the GDPR it would clarify that data is not personal for an entity that cannot reasonably identify the person, limit breach notification to high-risk breaches with a 96-hour deadline and a single EU reporting entry point, and recognise legitimate interest for AI development. It would also move cookie consent rules from the ePrivacy Directive into the GDPR, and merge the DGA and Free Flow Regulation into the Data Act.
Key themes
definition of personal data
pseudonymisation
breach notification 96h
single entry point
cookies
AI legitimate interest
Data Act consolidation
Unique features
It is the first substantive amendment proposal to the GDPR since 2016. The EDPB and EDPS have criticised the change to the definition of personal data.
SaaS relevance
If adopted, it would change SaaS breach-reporting timelines, cookie consent design and the legal basis analysis for training AI on customer data.
Extraterritorial
Yes
Breach notification
Proposed: authority 96h, high-risk breaches only, via single entry point
Key dates
Adopted
Commission proposal COM(2025) 837 of 2025-11-19. Council compromise texts June–Oct 2026 (doc 13886/26 of 2026-10-02); Coreper mandate not confirmed as of 2026-10-12. EP ITRE/LIBE draft report 2026-06-22, no committee vote by mid-Sept 2026. Trilogues not started. The separate AI omnibus was adopted as Regulation (EU) 2026/1744.
Medium confidence. Partly verifiedMedium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.
Partly verifiedMedium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.
Data Protection DirectiveDirective 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such dataRepealed/superseded In force from The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
Synopsis
The first harmonised EU data protection regime. Member states had to transpose rules on lawful processing grounds, sensitive data, data subject rights, notification to DPAs and adequacy-based transfer restrictions. Differences in how states transposed it led to the GDPR.
Key themes
lawful grounds
sensitive data
data subject rights
DPA notification
adequacy
Unique features
It created the adequacy concept and the Article 29 Working Party. It was the basis for the Safe Harbor decision that was annulled in Schrems I.
SaaS relevance
Historical; its adequacy decisions stayed in force under GDPR Art 45(9) until amended or repealed.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Adequacy; SCCs; BCRs
Maximum penalty
Set by national law
Key dates
Adopted
In force
Transposition deadline 1998-10-24; repealed by GDPR with effect from 2018-05-25
DSARegulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act)In force In force from Sets layered obligations for intermediary services (mere conduit, caching, hosting, online platforms) on illegal content, notice and action, transparency and user protection. Very large platforms and search engines also have systemic risk duties. It includes privacy-relevant bans on targeted ads to minors and on ads based on sensitive data profiling.
Synopsis
Sets layered obligations for intermediary services (mere conduit, caching, hosting, online platforms) on illegal content, notice and action, transparency and user protection. Very large platforms and search engines also have systemic risk duties. It includes privacy-relevant bans on targeted ads to minors and on ads based on sensitive data profiling.
Key themes
notice and action
transparency reporting
ad transparency
profiling restrictions
minors
dark patterns
systemic risk
Unique features
It bans online platforms from showing ads based on profiling with special-category data, and from profiling-based ads to minors (Arts 26(3), 28(2)). It also bans dark patterns (Art 25).
SaaS relevance
A SaaS product that hosts user content is a 'hosting service' and needs notice-and-action and transparency measures. Platform duties apply if it disseminates user content to the public (micro and small enterprises are exempt from some duties).
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
6% of worldwide annual turnover
Key dates
Adopted
In force
VLOP/VLOSE obligations from four months after designation (first designations 2023-04-25); fully applicable 2024-02-17
TTPARegulation (EU) 2024/900 on the transparency and targeting of political advertisingIn force In force from Requires political ads to be labelled and accompanied by transparency notices, and sets due-diligence duties for political advertising publishers. It strictly limits targeting and ad-delivery techniques that use personal data: these need explicit consent, cannot use special-category profiling, and cannot target people known to be under voting age plus one year.
Synopsis
Requires political ads to be labelled and accompanied by transparency notices, and sets due-diligence duties for political advertising publishers. It strictly limits targeting and ad-delivery techniques that use personal data: these need explicit consent, cannot use special-category profiling, and cannot target people known to be under voting age plus one year.
Key themes
political advertising
transparency notices
targeting restrictions
explicit consent
special category data
ad repository
Unique features
Its targeting ban goes beyond the GDPR and is enforced by DPAs. Several large platforms stopped political advertising in the EU in response.
SaaS relevance
Applies to ad-tech and marketing SaaS used for political campaigns; such platforms must handle consent, transparency notices and repository duties.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
DPAs: GDPR-level fines for targeting breaches; others up to 6% of provider's turnover
Key dates
Adopted
In force
Most provisions apply from 2025-10-10 (some non-discrimination provisions applied earlier); implementing acts on labels (2025-07-09) and the European repository (2026-04-09)
Medium confidence. Partly verifiedMedium confidence.The penalty figure and adoption date come from established references and were not re-checked this session.
Partly verifiedMedium confidence.The penalty figure and adoption date come from established references and were not re-checked this session.
ePrivacy DirectiveDirective 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive)In force In force from Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
Synopsis
Sector-specific privacy rules for electronic communications. It covers confidentiality of communications, the consent requirement for storing or accessing information on users' devices (cookies and similar technologies, Art 5(3)), traffic and location data, and opt-in consent for unsolicited electronic marketing (Art 13).
Key themes
cookies
device access
confidentiality of communications
traffic and location data
direct marketing
spam
Unique features
Art 5(3) applies to any information stored on terminal equipment, personal or not, which is why the EU has cookie banners. Each member state enforces it differently.
SaaS relevance
Any SaaS website or app that sets non-essential cookies or SDKs on EU users' devices, or sends marketing emails, must comply.
Extraterritorial
Limited
Breach notification
Telecoms providers: authority within 24h under Reg 611/2013
DPO
No
Cross-border transfers
None
Maximum penalty
Set by national law
Key dates
Adopted
In force
Amended by Directive 2006/24/EC (Data Retention, annulled 2014) and Directive 2009/136/EC (cookie consent; transposition 2011-05-25). The proposed ePrivacy Regulation COM(2017) 10 was abandoned: the Commission announced withdrawal in its 2025 work programme (2025-02-11). The Digital Omnibus proposes amending Art 5(3) cookie rules (pending).
I did not confirm the Official Journal publication of the formal withdrawal of the ePrivacy Regulation. The Council's Oct 2026 Omnibus draft keeps cookie rules in Art 5(3) with six consent exemptions.
EHDSRegulation (EU) 2025/327 on the European Health Data SpacePartially in force In force from Gives individuals stronger rights to access and control their electronic health data and makes it portable across the EU through MyHealth@EU. It sets requirements for electronic health record systems, and creates a permit-based framework for secondary use of health data for research, innovation and policy.
Synopsis
Gives individuals stronger rights to access and control their electronic health data and makes it portable across the EU through MyHealth@EU. It sets requirements for electronic health record systems, and creates a permit-based framework for secondary use of health data for research, innovation and policy.
Key themes
patient access
EHR interoperability
EHR system certification
secondary use
data permits
health data access bodies
Unique features
It has a self-certification and CE-like regime for EHR systems, and lets individuals opt out of secondary use.
SaaS relevance
Health-tech SaaS that is an EHR system or a wellness app claiming interoperability faces product requirements. Holders of health data may have to make it available for secondary use.
Extraterritorial
Yes
Breach notification
As GDPR
Cross-border transfers
Restrictions on non-personal electronic health data transfers; GDPR for personal data
Maximum penalty
Set by national law (with ceilings for secondary use breaches)
Key dates
Adopted
In force
Published in OJ 2025-03-05; in force 2025-03-26. Primary use (Ch II–III) from 2027-03-26; EHR system manufacturer obligations 2028-03-26; secondary use (Ch IV) 2029-03-26; further categories up to 2031.
AI ActRegulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)Partially in force In force from A risk-based product-safety style regulation of AI. It bans certain practices, imposes conformity, data governance, logging, transparency and human oversight duties on high-risk systems, sets transparency duties for chatbots and generative content, and adds obligations for general-purpose AI model providers. Deployers also have duties, including fundamental rights impact assessments for some.
Synopsis
A risk-based product-safety style regulation of AI. It bans certain practices, imposes conformity, data governance, logging, transparency and human oversight duties on high-risk systems, sets transparency duties for chatbots and generative content, and adds obligations for general-purpose AI model providers. Deployers also have duties, including fundamental rights impact assessments for some.
Key themes
prohibited practices
high-risk systems
conformity assessment
GPAI
transparency
human oversight
AI literacy
FRIA
Unique features
It is the first comprehensive horizontal AI law. It applies to providers and deployers whatever their location if output is used in the EU, and phases obligations in over 2025–2028.
SaaS relevance
SaaS that embeds AI features carries provider or deployer duties: transparency for chatbots and generated content, AI literacy, and full high-risk compliance if used in Annex III areas such as HR or credit.
Extraterritorial
Yes
Breach notification
Serious incident reporting for high-risk systems to market surveillance authorities (Art 73)
DPO
No
Cross-border transfers
None
Maximum penalty
€35m or 7% worldwide turnover (prohibited practices)
Key dates
Adopted
In force
Prohibitions and AI literacy 2025-02-02; GPAI and governance 2025-08-02; general application and Art 50 transparency 2026-08-02. Amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (in force 2026-07-27): Annex III high-risk obligations postponed to 2027-12-02; Annex I (product) high-risk to 2028-08-02; new prohibition on non-consensual intimate imagery/CSAM generation and a 2026-12-02 grace date for Art 50(2) for generative systems already on the market.
NIS2Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)In force In force from Requires essential and important entities in listed sectors, including cloud computing, data centres, managed service providers and digital providers, to take cybersecurity risk-management measures and report significant incidents. It makes management bodies accountable and sets supervision and fines.
Synopsis
Requires essential and important entities in listed sectors, including cloud computing, data centres, managed service providers and digital providers, to take cybersecurity risk-management measures and report significant incidents. It makes management bodies accountable and sets supervision and fines.
Key themes
risk management
incident reporting
supply chain security
management liability
registration
supervision
Unique features
Size-cap rule (medium and large entities in scope), with some digital infrastructure entities caught whatever their size. Management bodies can be held personally liable.
SaaS relevance
Medium or large SaaS, cloud and managed service providers fall in scope as 'ICT service management' or 'digital infrastructure' entities, and NIS2 duties also flow down to SaaS suppliers through customers' supply chain requirements.
Extraterritorial
Limited
Breach notification
CSIRT/authority: early warning 24h; incident notification 72h; final report 1 month
DPO
No
Cross-border transfers
None
Maximum penalty
Essential: €10m or 2% turnover; Important: €7m or 1.4%
Key dates
Adopted
In force
Transposition deadline 2024-10-17; applies from 2024-10-18 (many member states transposed late); Implementing Regulation (EU) 2024/2690 covers digital providers. A further targeted amendment was proposed in the 2025–26 digital simplification package.
DORARegulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)In force In force from Harmonises ICT risk management, incident reporting, resilience testing and ICT third-party risk management for EU financial entities. It also creates a direct oversight regime for critical ICT third-party service providers.
Synopsis
Harmonises ICT risk management, incident reporting, resilience testing and ICT third-party risk management for EU financial entities. It also creates a direct oversight regime for critical ICT third-party service providers.
Key themes
ICT risk management
major incident reporting
resilience testing (TLPT)
third-party risk
register of information
contractual clauses (Art 30)
Unique features
Lead overseers can directly supervise critical ICT providers. Art 30 specifies mandatory contract terms for ICT services.
SaaS relevance
A SaaS provider serving EU financial entities must accept DORA contract clauses, audit rights, exit plans and incident cooperation, and may be designated as critical.
Extraterritorial
Yes
Breach notification
Financial entities: initial report within 4h of classification / 24h of awareness; intermediate 72h; final 1 month
DPO
No
Cross-border transfers
Critical providers must have EU subsidiary
Maximum penalty
Set by national law for financial entities; periodic penalties up to 1% daily worldwide turnover for critical ICT providers
Key dates
Adopted
In force
Applies from 2025-01-17; first critical ICT third-party providers designated in 2025
Partly verifiedMedium confidence.The incident reporting timelines come from the RTS/ITS and I did not re-verify them this session.
CRARegulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)Partially in force In force from Sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Requirements include secure-by-design, vulnerability handling, security updates over a support period, an SBOM and CE marking. Manufacturers must report actively exploited vulnerabilities and severe incidents.
Synopsis
Sets mandatory cybersecurity requirements for hardware and software products with digital elements placed on the EU market. Requirements include secure-by-design, vulnerability handling, security updates over a support period, an SBOM and CE marking. Manufacturers must report actively exploited vulnerabilities and severe incidents.
Key themes
secure by design
vulnerability handling
SBOM
security updates
CE marking
incident reporting
Unique features
It extends CE-marking to software. Pure SaaS is generally excluded unless it is a 'remote data processing solution' that a product needs to function.
SaaS relevance
Applies where SaaS is the remote data processing back-end for a product with digital elements, or where the provider also ships downloadable or on-prem software or apps.
Extraterritorial
Yes
Breach notification
ENISA/CSIRT: early warning 24h; notification 72h; final report 14 days (vulns) / 1 month (incidents)
DPO
No
Cross-border transfers
None
Maximum penalty
€15m or 2.5% worldwide turnover
Key dates
Adopted
In force
Conformity assessment body provisions 2026-06-11; manufacturer reporting of actively exploited vulnerabilities and severe incidents 2026-09-11; full application 2027-12-11
EU–US DPFCommission Implementing Decision (EU) 2023/1795 on the adequate level of protection of personal data under the EU-US Data Privacy FrameworkIn force In force from Finds that US organisations self-certified to the Data Privacy Framework provide adequate protection, so personal data can flow to them from the EU without further transfer tools. It relies on US Executive Order 14086, which limits signals intelligence and created a redress mechanism including the Data Protection Review Court.
Synopsis
Finds that US organisations self-certified to the Data Privacy Framework provide adequate protection, so personal data can flow to them from the EU without further transfer tools. It relies on US Executive Order 14086, which limits signals intelligence and created a redress mechanism including the Data Protection Review Court.
Key themes
adequacy
self-certification
EO 14086
Data Protection Review Court
PCLOB
redress
Unique features
This is the third EU–US arrangement, after Safe Harbor and Privacy Shield, both struck down. It was upheld at first instance in Latombe, and a CJEU appeal plus a possible Schrems III challenge are pending.
SaaS relevance
A US SaaS provider (or sub-processor) that self-certifies can receive EU data without SCCs; non-certified providers still need SCCs and a TIA.
Breach notification
None
DPO
No
Cross-border transfers
Adequacy for DPF-certified US organisations
Maximum penalty
FTC/DoT enforcement under US law
Key dates
Adopted
In force
First periodic review in 2024. General Court dismissed the annulment action in Latombe v Commission (T-553/23) on 2025-09-03; appeal C-703/25 P lodged 2025-10-31 and pending at the CJEU as of Oct 2026.
EU SCCs 2021Commission Implementing Decision (EU) 2021/914 on standard contractual clauses for the transfer of personal data to third countriesIn force In force from Adopts modular standard contractual clauses (controller-to-controller, controller-to-processor, processor-to-processor, processor-to-controller) as an appropriate safeguard under GDPR Art 46. They require parties to assess third-country laws and practices (a transfer impact assessment) in line with Schrems II.
Synopsis
Adopts modular standard contractual clauses (controller-to-controller, controller-to-processor, processor-to-processor, processor-to-controller) as an appropriate safeguard under GDPR Art 46. They require parties to assess third-country laws and practices (a transfer impact assessment) in line with Schrems II.
Key themes
SCCs
modules
transfer impact assessment
government access
docking clause
onward transfers
Unique features
The modular design covers processor-to-processor chains, and they include an Art 28-compliant processor contract. A Schrems II-style warranty on local laws is built in.
SaaS relevance
The default transfer tool when SaaS providers or sub-processors outside the EU and outside adequate countries process EU personal data.
Breach notification
Importer must notify exporter (and authority where relevant) of breaches
Cross-border transfers
SCCs (Art 46(2)(c) GDPR)
Maximum penalty
As GDPR
Key dates
Adopted
In force
Old SCCs could not be used for new contracts after 2021-09-27 and had to be replaced by 2022-12-27. The Commission has been preparing additional SCCs for importers already subject to the GDPR under Art 3(2) (not adopted as of last check).
Free Flow of Non-Personal Data RegulationRegulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European UnionIn force In force from Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
Synopsis
Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
Key themes
anti-localisation
regulatory data access
porting
cloud codes of conduct
Unique features
It is the counterpart to the GDPR's free movement principle for non-personal data, and produced the SWIPO codes on switching.
SaaS relevance
Lets SaaS providers store non-personal data anywhere in the EU, free of national localisation rules.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
Prohibits intra-EU localisation of non-personal data
Maximum penalty
None
Key dates
Adopted
In force
Applies from 2019-05-28. Digital Omnibus proposes merging into the Data Act (pending).
DMARegulation (EU) 2022/1925 on contestable and fair markets in the digital sector (Digital Markets Act)In force In force from Imposes conduct obligations on designated gatekeepers' core platform services. It bans combining or cross-using personal data across services without GDPR-valid consent, requires data portability and business-user data access, and requires disclosure of consumer profiling techniques for independent audit.
Synopsis
Imposes conduct obligations on designated gatekeepers' core platform services. It bans combining or cross-using personal data across services without GDPR-valid consent, requires data portability and business-user data access, and requires disclosure of consumer profiling techniques for independent audit.
Key themes
gatekeepers
data combination consent
portability
business user data access
interoperability
profiling audit
Unique features
Art 5(2) imposes a consent requirement for data combination that goes beyond GDPR legitimate interest. Fines are up to 10% of turnover, 20% for repeat infringement.
SaaS relevance
It mainly gives business users rights; a SaaS provider gains data access and portability rights against gatekeeper platforms rather than having obligations, unless designated.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
10% worldwide turnover (20% repeat)
Key dates
Adopted
In force
Applies from 2023-05-02; first gatekeepers designated 2023-09-06; compliance from 2024-03-07
DGARegulation (EU) 2022/868 on European data governance (Data Governance Act)In force In force from Creates a framework for re-using certain protected public-sector data. It sets up a notification and neutrality regime for data intermediation services, and a voluntary registration regime for data altruism organisations.
Synopsis
Creates a framework for re-using certain protected public-sector data. It sets up a notification and neutrality regime for data intermediation services, and a voluntary registration regime for data altruism organisations.
Key themes
public sector data re-use
data intermediation services
data altruism
neutrality
international transfers of non-personal data
Unique features
It regulates 'data intermediaries' as a new kind of neutral market actor, and restricts transfers of protected non-personal data to third countries.
SaaS relevance
Applies if a SaaS platform's main purpose is to intermediate data-sharing between holders and users (notification and structural separation required).
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Restrictions on transfers of protected non-personal public-sector data
Maximum penalty
Set by national law
Key dates
Adopted
In force
Applies from 2023-09-24. The Digital Omnibus proposes folding DGA provisions into the Data Act (pending).
Data ActRegulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)Partially in force In force from Gives users of connected products and related services the right to access and share the data those products generate. It sets fair terms for B2B data sharing, allows public bodies to access data in exceptional need, and requires cloud and other data processing services to enable switching and interoperability. It also restricts unlawful third-country government access to non-personal data.
Synopsis
Gives users of connected products and related services the right to access and share the data those products generate. It sets fair terms for B2B data sharing, allows public bodies to access data in exceptional need, and requires cloud and other data processing services to enable switching and interoperability. It also restricts unlawful third-country government access to non-personal data.
Key themes
IoT data access
B2B data sharing
unfair contract terms
cloud switching
interoperability
government access safeguards
Unique features
It imposes binding switching and egress-fee duties on all 'data processing service' providers (IaaS, PaaS, SaaS) and protects non-personal data from foreign government access.
SaaS relevance
SaaS providers count as 'data processing services' and must support customer switching: contract terms, a maximum two-month notice period, data export, reduced and then no switching charges, and transparency on jurisdiction.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Safeguards against unlawful third-country governmental access to non-personal data (Art 32)
Maximum penalty
Set by national law; GDPR-level fines where personal data rules infringed
Key dates
Adopted
In force
Applies generally from 2025-09-12. Product design duties (Art 3(1)) for connected products placed on the market from 2026-09-12. Cloud switching charges abolished from 2027-01-12. Unfair-terms rules extend to certain pre-existing contracts from 2027-09-12. Amendments proposed in the Digital Omnibus (pending).
Status is 'Partially in force' because several provisions are phased. The Digital Omnibus may change trade-secret and switching rules; Council discussions in Oct 2026 focused on this.
LEDDirective (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law enforcement purposes (Law Enforcement Directive)In force In force from The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
Synopsis
The data protection rules for police, prosecutors and other competent authorities processing personal data to prevent, investigate, detect or prosecute crime or execute penalties. It mirrors GDPR principles with adjustments, such as distinguishing categories of data subjects, logging, and restricted transparency rights.
Key themes
law enforcement
logging
categories of data subjects
DPIA
DPO
transfers to third-country authorities
Unique features
It requires processing operations to be logged and allows rights to be restricted to protect investigations.
SaaS relevance
Applies to SaaS providers only indirectly, as processors for police or justice customers, which must meet the LED's contractual and security requirements.
Extraterritorial
No
Breach notification
Authority 72h; individuals if high risk (with exceptions)
CFR Arts 7–8Charter of Fundamental Rights of the European Union, Articles 7 and 8In force In force from Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.
Synopsis
Article 7 protects respect for private and family life, home and communications. Article 8 sets out a separate right to the protection of personal data: fair processing for specified purposes on the basis of consent or another legitimate basis, rights of access and rectification, and control by an independent authority.
Key themes
right to privacy
right to data protection
independent supervision
access
rectification
Unique features
It makes data protection a fundamental right distinct from privacy. It is the basis for CJEU judgments striking down EU acts and transfer decisions, such as Digital Rights Ireland, Schrems I and Schrems II.
SaaS relevance
It is the yardstick against which EU transfer mechanisms (DPF, SCCs) and GDPR interpretation are tested, so it directly affects SaaS transfer risk.
Breach notification
None
DPO
No
Cross-border transfers
Indirect: basis for 'essential equivalence' test
Maximum penalty
None directly
Key dates
Adopted
In force
Proclaimed in Nice on 2000-12-07; legally binding with the same value as the Treaties from 2009-12-01 (Treaty of Lisbon, Art 6(1) TEU)
TFEU Art 16Treaty on the Functioning of the European Union, Article 16In force In force from Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.
Synopsis
Restates everyone's right to the protection of their personal data. It gives the Parliament and Council a specific legal basis to adopt data protection rules for EU institutions and for member states acting within EU law, with compliance controlled by independent authorities.
Key themes
legal basis
right to data protection
independent supervision
Unique features
It is the legal basis for the GDPR, the LED and the EUDPR. The earlier Directive 95/46 relied on internal-market powers instead.
SaaS relevance
Gives no direct obligations; it is the legal basis for the GDPR family.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Signed as part of the Lisbon Treaty on 2007-12-13; in force 2009-12-01
Membership-based — check ratification status in the instrument record. 19 instruments from 3 bodies.
Council of Europe
Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal DataIn force In force from The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Synopsis
The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.
Key themes
data quality
sensitive data
security
access and rectification
transborder flows
mutual assistance
Unique features
It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.
SaaS relevance
It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.
Breach notification
None (added by 108+)
DPO
No
Cross-border transfers
Free flow between parties; restrictions to non-parties permitted
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)
Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)Enacted – not yet in force Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Synopsis
Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
Key themes
lawful basis
accountability
breach notification
automated decisions
privacy by design
transborder flows
follow-up mechanism
Unique features
It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.
SaaS relevance
Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.
Breach notification
Supervisory authority without delay for serious breaches (Art 7(2))
DPO
No
Cross-border transfers
Free flow between parties; appropriate safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
CoE AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of LawSigned – not ratified The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Synopsis
The first binding international treaty on AI. Parties must make sure activities across the AI lifecycle are consistent with human rights, democracy and the rule of law, including through transparency, accountability, non-discrimination, privacy and personal data protection, risk and impact management, and remedies. It applies mainly to public authorities; for the private sector, each party chooses how to address risks.
Key themes
AI lifecycle
human rights impact assessment
transparency
accountability
privacy
remedies
risk management
Unique features
It is open to non-European signatories, including the US, UK, Canada and Japan. It is principle-based and leaves parties to choose implementation measures, unlike the prescriptive EU AI Act.
SaaS relevance
It has no direct obligations yet; for EU-market SaaS it will be implemented mainly through the AI Act.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2024-05-17; opened in Vilnius on 2024-09-05. Enters into force on the first day of the month after 3 months from the 5th ratification (at least 3 of them CoE member states). The EU ratified on 2026-05-15. The threshold had not been reached as of Sept 2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Partly verifiedMedium confidence.The ratification count was not available from the treaty office page. A Sept 2026 secondary source says it is not yet in force. The text_url document ID was not re-checked.
Protocol 181Additional Protocol to Convention 108 regarding supervisory authorities and transborder data flowsIn force In force from Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Synopsis
Requires parties to set up independent supervisory authorities with powers of investigation and intervention. It also restricts transfers to non-parties unless the recipient ensures an adequate level of protection or safeguards such as contractual clauses are in place.
Key themes
independent supervisory authority
adequacy
transborder data flows
Unique features
It brought the adequacy and independent-DPA concepts of Directive 95/46 into the Council of Europe framework.
SaaS relevance
It shapes the transfer rules of non-EU parties that a SaaS provider may need to meet.
Breach notification
None
DPO
No
Cross-border transfers
Adequacy or ad hoc/approved safeguards for non-parties
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 181; opened 2001-11-08; in force 2004-07-01; to be absorbed by Convention 108+
Partly verifiedMedium confidence.I could not fetch the treaty office status page; the dates come from established references.
Budapest ConventionConvention on Cybercrime (Budapest Convention)In force In force from The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Synopsis
The main multilateral cybercrime treaty, open to non-European states. It harmonises offences such as illegal access and data interference, requires procedural powers (expedited preservation, production orders, search and seizure, interception), and sets up mutual legal assistance. Brazil and many other non-European states have acceded.
Key themes
cybercrime offences
data preservation
production orders
interception
mutual legal assistance
24/7 network
Unique features
It has over 75 parties worldwide and is the model for many national cybercrime laws. Article 15 requires procedural powers to be subject to human rights conditions and safeguards.
SaaS relevance
National laws based on it allow domestic production and preservation orders for subscriber and traffic data held by SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
MLA and 24/7 points of contact
Maximum penalty
Set by national law
Key dates
Adopted
In force
ETS No. 185; opened 2001-11-23; in force 2004-07-01; First Additional Protocol (ETS 189, xenophobia) 2003; Second Additional Protocol CETS 224 (2022) not yet in force
Partly verifiedMedium confidence.The party count is approximate.
Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidenceSigned – not ratified Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Synopsis
Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
Key themes
direct cooperation with providers
subscriber information
domain registration data
emergency disclosure
data protection safeguards (Art 14)
Unique features
It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.
SaaS relevance
Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.
Extraterritorial
Yes
Breach notification
Art 14 requires notifying the transferring party of security incidents involving transferred data
DPO
No
Cross-border transfers
Art 14 safeguards govern transfers between parties
Maximum penalty
Set by national law
Key dates
Adopted
Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
Medium confidence. Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
Partly verifiedMedium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
ECHR Art 8Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights), Article 8In force In force from Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Synopsis
Article 8 protects respect for private and family life, home and correspondence. A state may interfere only where the interference is in accordance with the law, pursues a listed legitimate aim and is necessary in a democratic society. The Strasbourg Court enforces it through binding judgments against the 46 member states.
Key themes
private life
correspondence
surveillance
legality
necessity and proportionality
positive obligations
Unique features
It has a large body of case law on surveillance and data retention (e.g. S. and Marper, Big Brother Watch, Centrum för Rättvisa). Article 8 has been read to include data protection, and it informs the interpretation of the EU Charter (Art 52(3)).
SaaS relevance
It binds states only, but it drives national law on employee monitoring, surveillance and data retention that affects SaaS providers.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Just satisfaction awarded against states
Key dates
Adopted
In force
ETS No. 005; signed in Rome on 1950-11-04; in force 1953-09-03
Rec 509 (1968)Parliamentary Assembly Recommendation 509 (1968) on Human Rights and Modern Scientific and Technological DevelopmentsIn force In force from In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Synopsis
In this recommendation the Parliamentary Assembly asked the Committee of Ministers to look at whether the ECHR and national laws adequately protected privacy against modern technology such as eavesdropping devices and computers. It started the Council of Europe work that led to Resolutions (73)22 and (74)29 and then Convention 108.
Key themes
technology and privacy
surveillance devices
computers
adequacy of ECHR Art 8
Unique features
It was the first pan-European political recognition that computerisation threatened privacy. It is non-binding and historical.
Medium confidence. Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Partly verifiedMedium confidence.I did not re-check the exact adoption date (31 January 1968) or the PACE file URL this session. The CIPP/E project holds a copy (1968REC509.pdf).
Res (74) 29Resolution (74) 29 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Public SectorRepealed/superseded In force from The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Synopsis
The public-sector companion to Res (73) 22. It set principles for government electronic data banks, including that the public should be told about them, that collection should be lawful and fair, that data should be accurate, and that access should be limited. These principles fed directly into Convention 108.
Key themes
public sector
transparency
lawfulness
accuracy
security
access
Unique features
Extended the 1973 principles to government processing.
Partly verifiedMedium confidence.Superseded by Convention 108. I did not re-check the document URL this session.
Res (73) 22Resolution (73) 22 on the Protection of the Privacy of Individuals vis-à-vis Electronic Data Banks in the Private SectorRepealed/superseded In force from A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Synopsis
A Committee of Ministers resolution setting out principles for private-sector electronic data banks, including accurate and relevant information, purpose limitation, a ban on obtaining data by fraud, retention limits, security, and a person's right to know what is held about them. Member states were invited to adopt laws based on these principles.
Key themes
private sector
data quality
purpose
retention
security
access
Unique features
Early soft-law forerunner of Convention 108, focused on the private sector.
Medium confidence. Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
Partly verifiedMedium confidence.Effectively superseded by Convention 108 (1981). I did not re-check the rm.coe.int document URL this session.
Organisation for Economic Co-operation and Development (OECD)
OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force In force from Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Synopsis
Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Key themes
trustworthy AI
human rights
privacy
transparency
explainability
robustness
accountability
Unique features
It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.
SaaS relevance
Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force In force from The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Synopsis
The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Key themes
government access
national security
law enforcement
legal basis
oversight
redress
transparency
Unique features
It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.
SaaS relevance
Useful reference for transfer impact assessments and for policies on responding to government data demands.
Breach notification
None
DPO
No
Cross-border transfers
Supports trusted data flows between adherents
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force In force from Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Synopsis
Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Key themes
accountability
privacy management programmes
breach notification
enforcement cooperation
interoperability
transborder flows
Unique features
It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.
SaaS relevance
It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.
Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded In force from A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Synopsis
A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Key themes
eight fair information principles
accountability
transborder flows
Unique features
These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.
SaaS relevance
Historical baseline; its principles are reflected in most national laws a SaaS provider meets.
Breach notification
None
DPO
No
Cross-border transfers
Free flow encouraged; restrictions only where proportionate
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.