New Zealand NZ

A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.

• model legislation
• consent
• breach handling
• cross-border transfers
• harmonisation

Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.

• Adopted November 2022
• In force November 2022
• 2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022

• Authoritative text thecommonwealth.org

• thecommonwealth.org
• law.ed.ac.uk

Medium confidence.

Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

• trustworthy AI
• human rights
• privacy
• transparency
• explainability
• robustness
• accountability

It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

• Adopted 22 May 2019
• In force 22 May 2019
• OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it

• Authoritative text legalinstruments.oecd.org

• oecd.org
• legalinstruments.oecd.org

High confidence.

The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

• government access
• national security
• law enforcement
• legal basis
• oversight
• redress
• transparency

It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

• Adopted 14 December 2022
• In force 14 December 2022
• OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered

• Authoritative text legalinstruments.oecd.org

• oecd.org
• eurojust.europa.eu

High confidence.

Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

• accountability
• privacy management programmes
• breach notification
• enforcement cooperation
• interoperability
• transborder flows

It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

• Adopted 11 July 2013
• In force 11 July 2013
• OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue

• Authoritative text legalinstruments.oecd.org

• legalinstruments.oecd.org
• oecd.org

High confidence.

A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

• eight fair information principles
• accountability
• transborder flows

These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

• Adopted 23 September 1980
• In force 23 September 1980
• Ended 11 July 2013
• Revised 2013-07-11 (see separate row)

• Authoritative text legalinstruments.oecd.org

• legalinstruments.oecd.org

High confidence.

The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

• certification
• accountability agents
• cross-border enforcement
• processors

It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

• Adopted 2011
• In force 2012
• CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).

• Authoritative text cbprs.org

• cbprs.org
• globalcbpr.org

Medium confidence.

A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

• preventing harm
• notice
• choice
• accountability
• cross-border privacy enforcement
• interoperability

Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

• Adopted 2005
• In force 2005
• Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)

• Authoritative text apec.org

• apec.org

Medium confidence.

The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

• cybercrime offences
• e-evidence
• production orders
• data preservation
• mutual legal assistance
• human rights safeguards

It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

• Adopted 24 December 2024
• Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.

• Authoritative text unodc.org

• en.wikipedia.org
• unodc.org

Medium confidence.

This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

• surveillance
• interception
• AI and privacy
• encryption
• business responsibility
• remedies

The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

• Adopted 18 December 2013
• In force 18 December 2013
• First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17

• Authoritative text documents.un.org

• documents.un.org
• digitallibrary.un.org

Medium confidence.

This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

• right to privacy
• state obligations
• legality
• arbitrariness
• individual communications

It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

• Adopted 16 December 1966
• In force 23 March 1976
• Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.

• Authoritative text ohchr.org

• ohchr.org
• ohchr.org

High confidence.

The party count is approximate and was not re-checked against the UN Treaty Collection.

Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

• right to privacy
• correspondence
• reputation
• protection of the law

Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

• Adopted 10 December 1948
• In force 10 December 1948
• Proclaimed by the UN General Assembly in Paris on 10 December 1948

• Authoritative text un.org

• un.org
• ohchr.org

High confidence.

The CIPP/E project holds a copy (1948UDHR.pdf).

Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

• fair information principles
• sensitive data
• access
• security
• supervisory authority
• transborder flows

Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

• Adopted 14 December 1990
• In force 14 December 1990

• Authoritative text refworld.org

• refworld.org
• digitallibrary.un.org

Medium confidence.