DPDPADelaware Personal Data Privacy Act (6 Del. C. ch. 12D)In force In force from Virginia-style law with low thresholds that also covers most non-profits and treats status as transgender or non-binary as sensitive data.
Synopsis
Virginia-style law with low thresholds that also covers most non-profits and treats status as transgender or non-binary as sensitive data.
Key themes
consumer rights (access, deletion, correction, portability)
opt-out of sale, targeted advertising and profiling
sensitive data consent
data protection assessments
processor contracts
list of third-party categories
Unique features
Low thresholds (35,000 consumers, or 10,000 with 20%+ revenue from sales); non-profits included.
SaaS relevance
Even small SaaS businesses with Delaware users can be caught.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Breach notification1
DE breach lawDelaware data breach notification law (Del. Code tit. 6, § 12B-101 et seq.)In force In force from Requires businesses (and in most cases public bodies) that own or license computerised personal information about Delaware residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay and within 60 days of determining a breach. Covered data: name plus SSN, driver's licence/ID, financial account with codes, passport, online credentials, medical history and DNA profile, health insurance ID, biometric data, taxpayer ID.
Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Delaware residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay and within 60 days of determining a breach. Covered data: name plus SSN, driver's licence/ID, financial account with codes, passport, online credentials, medical history and DNA profile, health insurance ID, biometric data, taxpayer ID.
Key themes
breach notification
personal information definition
regulator notice
consumer reporting agency notice
vendor-to-owner notice
encryption safe harbour
substitute notice
law enforcement delay
Unique features
One year of free credit monitoring is mandatory when SSNs are breached; also imposes a duty to maintain reasonable security.
SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Delaware requires the maintaining entity to notify and cooperate with the owner immediately after determining a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
Extraterritorial
Limited
Breach notification
Individuals without unreasonable delay and within 60 days of determining a breach; AG no later than individuals if >500 residents
DPO
No
Cross-border transfers
None
Maximum penalty
AG enforcement under consumer fraud laws; direct economic damages recoverable
Key dates
Adopted
In force
Overhauled by HS 1 for HB 180 (signed 2017-08-17, eff. 2018-04-14)
FTC Act s5Federal Trade Commission Act, Section 5 (15 U.S.C. § 45) – unfair or deceptive acts or practicesIn force In force from Prohibits unfair or deceptive acts or practices in commerce and is the FTC's main tool for privacy and data security enforcement. The FTC brings cases over misleading privacy statements, inadequate security and harmful data practices, usually resolved by long-term consent orders.
Synopsis
Prohibits unfair or deceptive acts or practices in commerce and is the FTC's main tool for privacy and data security enforcement. The FTC brings cases over misleading privacy statements, inadequate security and harmful data practices, usually resolved by long-term consent orders.
Key themes
deception
unfairness
data security
consent orders
dark patterns
algorithmic disgorgement
DPF enforcement
Unique features
Functions as the de facto US federal privacy regime through case law and consent orders rather than prescriptive rules; the FTC has ordered deletion of models trained on improperly obtained data.
SaaS relevance
Applies to almost any for-profit SaaS business: privacy policies, security claims and DPF self-certifications are enforceable promises.
Extraterritorial
Limited
Breach notification
None (but failure to disclose may be deceptive)
DPO
No
Cross-border transfers
EU-US DPF / UK Extension / Swiss-US DPF self-certification enforced by FTC
Maximum penalty
Civil penalties for violating orders or rules: $53,088 per violation (2025 inflation adjustment)
Key dates
Adopted
In force
Wheeler-Lea Act 1938 added 'unfair or deceptive acts or practices'; AMG Capital (2021) removed s13(b) monetary relief; civil penalties available for order/rule violations (inflation-adjusted annually).
TAKE IT DOWN ActTools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act)In force In force from Makes it a federal crime to knowingly publish non-consensual intimate images, including AI-generated deepfakes, or to threaten to do so. Covered platforms must provide a notice-and-removal process and take down reported content within 48 hours.
Synopsis
Makes it a federal crime to knowingly publish non-consensual intimate images, including AI-generated deepfakes, or to threaten to do so. Covered platforms must provide a notice-and-removal process and take down reported content within 48 hours.
Key themes
non-consensual intimate imagery
deepfakes
notice and removal
48-hour takedown
Unique features
One of the first federal statutes imposing content-removal deadlines on platforms; enforced by the FTC as an unfair/deceptive practice.
SaaS relevance
SaaS that host user-generated content publicly (forums, community, media hosting) are 'covered platforms' and need a removal workflow.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
FTC civil penalties of $53,088 per violation; criminal imprisonment up to 2 years (3 where minors involved)
DPPADriver's Privacy Protection Act of 1994 (18 U.S.C. §§ 2721–2725)In force In force from Limits disclosure and use of personal information from state motor vehicle records to permissible purposes. Resellers and recipients are bound by the same limits.
Synopsis
Limits disclosure and use of personal information from state motor vehicle records to permissible purposes. Resellers and recipients are bound by the same limits.
Key themes
motor vehicle records
permissible uses
resale
marketing consent
Unique features
Binds downstream recipients of DMV data, not just the state agencies.
SaaS relevance
Relevant to SaaS in insurance, automotive, identity verification and data enrichment that ingest DMV-derived data.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Liquidated damages of $2,500 per violation plus punitive damages; criminal fines
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Computer Matching ActComputer Matching and Privacy Protection Act of 1988 (amending 5 U.S.C. § 552a)In force In force from Amends the Privacy Act of 1974 to add protections for people whose records are used in automated matching programmes. Agencies must have written matching agreements (valid for 18 months by default) and Data Integrity Boards, and the subject may contest information before a federal benefit is denied, suspended or terminated.
Synopsis
Amends the Privacy Act of 1974 to add protections for people whose records are used in automated matching programmes. Agencies must have written matching agreements (valid for 18 months by default) and Data Integrity Boards, and the subject may contest information before a federal benefit is denied, suspended or terminated.
Key themes
computer matching
matching agreements
Data Integrity Boards
due process before benefit denial
Unique features
Specific to federal agency data matching.
SaaS relevance
Limited; applies to federal agencies and their contractors.
Breach notification
None
DPO
No
Cross-border transfers
None
Key dates
Adopted
In force
Pub. L. 100-503 signed 18 Oct 1988 (102 Stat. 2507). CRS reports it has been amended 10 times, most recently in 2014.
Enactment and effective-date text read in the Statutes at Large PDF on congress.gov (102 Stat. 2507); the 18-month agreement limit also appears there. In force date: section 10 of Pub. L. 100-503 says the amendments take effect 9 months after enactment (18 Oct 1988), except sections 3(b), 6, 7 and 8, which took effect on enactment; 9 months after is 18 Jul 1989 (calculated). Read in the Statutes at Large PDF on congress.gov.
EPPAEmployee Polygraph Protection Act of 1988 (29 U.S.C. § 2001 et seq.)In force In force from Generally prevents most private employers from requiring or requesting lie detector tests of applicants or employees, or retaliating against those who refuse. Exemptions cover certain security firms and pharmaceutical businesses. It does not cover federal, state or local government employers.
Synopsis
Generally prevents most private employers from requiring or requesting lie detector tests of applicants or employees, or retaliating against those who refuse. Exemptions cover certain security firms and pharmaceutical businesses. It does not cover federal, state or local government employers.
Key themes
employment
polygraph
lie detector tests
retaliation
Unique features
Employment-specific; the DOL page cited in the source describes enforcement but its details were not read.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia stub only. Penalties and DOL enforcement details not confirmed, so max_penalty is empty. In force date: LII note (Pub. L. 100-347 s.11) says the Act becomes effective 6 months after enactment (27 Jun 1988), which is calculated as 27 Dec 1988. The rest of the sentence was truncated in the fetched page; check if exactness matters.
Partly verifiedMedium confidence.Source read: Wikipedia stub only. Penalties and DOL enforcement details not confirmed, so max_penalty is empty. In force date: LII note (Pub. L. 100-347 s.11) says the Act becomes effective 6 months after enactment (27 Jun 1988), which is calculated as 27 Dec 1988. The rest of the sentence was truncated in the fetched page; check if exactness matters.
VPPAVideo Privacy Protection Act of 1988 (18 U.S.C. § 2710)In force In force from Bars video tape service providers from knowingly disclosing personally identifiable information about consumers' video viewing without informed written consent. Courts have applied it to streaming and websites with embedded video.
Synopsis
Bars video tape service providers from knowingly disclosing personally identifiable information about consumers' video viewing without informed written consent. Courts have applied it to streaming and websites with embedded video.
Key themes
video viewing history
consent
tracking pixels
class actions
Unique features
Pre-internet statute now driving pixel litigation against sites that share video viewing data with ad platforms.
SaaS relevance
Video hosting and analytics SaaS and their customers face claims where viewing data plus identifiers flow to third parties.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Liquidated damages of $2,500 per person plus punitive damages
Key dates
Adopted
In force
Amended 2013 to allow electronic consent for sharing.
Medium confidence. Partly verifiedMedium confidence.Circuit split on who is a 'consumer'. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Circuit split on who is a 'consumer'. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Cable Act privacyCable Communications Policy Act of 1984, subscriber privacy provisions (47 U.S.C. § 551)In force In force from Section 631 (47 U.S.C. § 551) protects the privacy of cable subscribers. Operators must give subscribers a written privacy notice when service begins and at least yearly. Operators need prior written or electronic consent to collect personal information over the cable system, unless it is needed to provide service or detect unauthorised reception, and generally need consent to disclose it, with exceptions for service-related business, court orders (with notice to the subscriber) and name-and-address lists with an opt-out. Subscribers may inspect and correct their data, and operators must destroy personal information once it is no longer needed. Government entities need a court order on clear and convincing evidence.
Synopsis
Section 631 (47 U.S.C. § 551) protects the privacy of cable subscribers. Operators must give subscribers a written privacy notice when service begins and at least yearly. Operators need prior written or electronic consent to collect personal information over the cable system, unless it is needed to provide service or detect unauthorised reception, and generally need consent to disclose it, with exceptions for service-related business, court orders (with notice to the subscriber) and name-and-address lists with an opt-out. Subscribers may inspect and correct their data, and operators must destroy personal information once it is no longer needed. Government entities need a court order on clear and convincing evidence.
Key themes
cable subscribers
privacy notice
consent to collect and disclose
subscriber access and correction
data destruction
court orders
Unique features
Includes a private right of action with liquidated damages of the greater of $100 per day of violation or $1,000, plus punitive damages and attorneys' fees.
SaaS relevance
Limited; applies to cable operators.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Actual damages with liquidated damages of the greater of $100 per day of violation or $1,000, plus punitive damages and attorneys' fees (47 U.S.C. § 551(f))
Key dates
Adopted
In force
Pub. L. 98-549 signed 30 Oct 1984; section effective 60 days after 30 Oct 1984, except where otherwise expressly provided. Amended by the Cable Act of 1992 and the Telecommunications Act of 1996.
Synopsis from the text of 47 U.S.C. 551 on LII. In force date: LII note says the section is effective 60 days after 30 Oct 1984; calculated as 29 Dec 1984. Authority listed (FCC) is not stated in the section, which is enforced by civil action in federal court.
Privacy Protection ActPrivacy Protection Act of 1980 (42 U.S.C. § 2000aa)In force In force from Protects journalists and newsrooms from government searches and seizures of work product and documentary materials, generally requiring a subpoena rather than a search warrant.
Synopsis
Protects journalists and newsrooms from government searches and seizures of work product and documentary materials, generally requiring a subpoena rather than a search warrant.
Key themes
press freedom
searches and seizures
work product
documentary materials
Unique features
Protects publishers' materials rather than personal data in general.
SaaS relevance
Minor; may affect law-enforcement requests for journalists' materials held by hosting providers.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only; remedies and effective date not stated there, so left empty. Whether it fits a privacy dataset is an editorial call. In force date: LII Effective Date note (Pub. L. 96-440 s.108) says the title took effect 1 Jan 1981, except that for States and other governmental units besides the United States it took effect one year after enactment (13 Oct 1981). Remedies (2000aa-6) not read, so max_penalty is empty.
Partly verifiedMedium confidence.Source read: Wikipedia only; remedies and effective date not stated there, so left empty. Whether it fits a privacy dataset is an editorial call. In force date: LII Effective Date note (Pub. L. 96-440 s.108) says the title took effect 1 Jan 1981, except that for States and other governmental units besides the United States it took effect one year after enactment (13 Oct 1981). Remedies (2000aa-6) not read, so max_penalty is empty.
Privacy ActPrivacy Act of 1974 (5 U.S.C. § 552a)In force In force from Governs how federal agencies collect, maintain, use and disclose records about individuals held in 'systems of records'. Requires public notice of record systems, limits disclosures without consent, and gives individuals access and amendment rights.
Synopsis
Governs how federal agencies collect, maintain, use and disclose records about individuals held in 'systems of records'. Requires public notice of record systems, limits disclosures without consent, and gives individuals access and amendment rights.
Key themes
government records
system of records notices
access
amendment
disclosure limits
computer matching
Unique features
Applies only to federal agencies; rights originally limited to US citizens and permanent residents, partly extended to EU citizens by the Judicial Redress Act.
SaaS relevance
Caught indirectly when a SaaS provider operates a system of records on behalf of a federal agency under contract (contractor clause, 5 U.S.C. 552a(m)).
Extraterritorial
No
Breach notification
None in statute (OMB M-17-12 governs agency breaches)
DPO
Conditional
Cross-border transfers
None
Maximum penalty
Actual damages (min. $1,000) in civil suits; misdemeanour fines up to $5,000
Key dates
Adopted
In force
Computer Matching and Privacy Protection Act 1988 amendments; Judicial Redress Act 2015 extended certain remedies to citizens of designated countries (incl. EU).
FERPAFamily Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99)In force In force from Protects the privacy of student education records at schools receiving federal education funding. Parents and eligible students have rights to access and seek amendment, and disclosure generally requires consent subject to exceptions.
Synopsis
Protects the privacy of student education records at schools receiving federal education funding. Parents and eligible students have rights to access and seek amendment, and disclosure generally requires consent subject to exceptions.
Key themes
education records
consent
school official exception
directory information
parental rights
Unique features
Enforced through withdrawal of federal funding from institutions; no private right of action.
SaaS relevance
Ed-tech SaaS can receive student records under the 'school official' exception only if under the school's direct control and barred from redisclosure.
Extraterritorial
No
Breach notification
None (no statutory breach duty)
DPO
No
Cross-border transfers
None
Maximum penalty
Loss of federal funding for institutions
Key dates
Adopted
In force
Regulations amended 2008 and 2011 (school official exception for contractors).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
ePrivacy / marketing2
CAN-SPAMControlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (15 U.S.C. §§ 7701–7713)In force In force from Sets rules for commercial email, including honest headers and subject lines, identification as an advertisement, a physical address and a working opt-out honoured within 10 business days. It does not require prior consent.
Synopsis
Sets rules for commercial email, including honest headers and subject lines, identification as an advertisement, a physical address and a working opt-out honoured within 10 business days. It does not require prior consent.
Key themes
commercial email
opt-out
header accuracy
physical address
preemption of state anti-spam laws
Unique features
Opt-out regime, in contrast to the EU/UK opt-in for marketing email; largely preempts state spam laws.
SaaS relevance
Applies to SaaS marketing email and to email-sending platforms that 'initiate' or 'procure' messages for customers.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
TCPATelephone Consumer Protection Act of 1991 (47 U.S.C. § 227)In force In force from Restricts telemarketing calls, autodialled and prerecorded/artificial-voice calls and texts to mobiles, and unsolicited faxes. Requires prior express (written, for marketing) consent and honours Do Not Call lists.
Synopsis
Restricts telemarketing calls, autodialled and prerecorded/artificial-voice calls and texts to mobiles, and unsolicited faxes. Requires prior express (written, for marketing) consent and honours Do Not Call lists.
Key themes
robocalls
text messages
prior express written consent
Do Not Call
AI-generated voices
Unique features
Private right of action with statutory damages per call drives large class actions; FCC confirmed in 2024 that AI-generated voices are 'artificial'.
SaaS relevance
SaaS offering SMS/voice campaigns, or using SMS for marketing, must manage consent capture and opt-outs.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
$500 per call/text, trebled to $1,500 if wilful (private action)
Key dates
Adopted
In force
FCC rules 47 C.F.R. 64.1200; National Do Not Call Registry 2003; FCC 'one-to-one consent' rule vacated by 11th Cir. in January 2025; McLaughlin Chiropractic (US Sup. Ct. 2025) ended binding deference to FCC interpretations.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Breach notification2
HBNRFTC Health Breach Notification Rule (16 C.F.R. Part 318)In force In force from Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. The 2024 update confirms that unauthorised disclosures (e.g. sharing with advertisers) count as breaches.
Synopsis
Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. The 2024 update confirms that unauthorised disclosures (e.g. sharing with advertisers) count as breaches.
Key themes
personal health records
health apps
unauthorised disclosure
FTC notification
Unique features
Treats unauthorised sharing, not just security incidents, as a reportable breach; fills the gap for non-HIPAA health apps.
SaaS relevance
Health and wellness apps and the SaaS platforms behind them that draw data from multiple sources are 'PHR vendors' or service providers to them.
Extraterritorial
Limited
Breach notification
Individuals without unreasonable delay and within 60 days; FTC at same time if 500+ (else annually); media if 500+ in a state
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation
Key dates
Adopted
In force
2021 policy statement; amended rule published 2024-05-30, effective 2024-07-29, clarifying coverage of health apps and adding electronic notice.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
HIPAA Breach Rule / HITECHHIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) under the HITECH ActIn force In force from Requires covered entities to notify affected individuals, HHS and in larger cases the media following a breach of unsecured PHI. Business associates must notify the covered entity. The HITECH Act also made business associates directly liable and increased penalties.
Synopsis
Requires covered entities to notify affected individuals, HHS and in larger cases the media following a breach of unsecured PHI. Business associates must notify the covered entity. The HITECH Act also made business associates directly liable and increased penalties.
Key themes
breach of unsecured PHI
presumption of breach
four-factor risk assessment
HHS reporting
business associate liability
Unique features
Breach is presumed unless a documented risk assessment shows low probability of compromise; breaches of 500+ are published on HHS's public portal.
SaaS relevance
SaaS business associates must notify their covered-entity customers without unreasonable delay and within 60 days of discovery.
Extraterritorial
Limited
Breach notification
Individuals within 60 days; HHS within 60 days if 500+ (annual log if fewer); media if 500+ in a state; BA to CE within 60 days
Cross-border transfers
None
Maximum penalty
As HIPAA (tiered civil penalties)
Key dates
Adopted
In force
HITECH Act enacted 2009-02-17; interim final rule effective 2009-09-23; 'risk of harm' standard replaced by low-probability-of-compromise test in 2013 Omnibus Rule.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Children's privacy2
Amended COPPA RuleChildren's Online Privacy Protection Rule, 16 C.F.R. Part 312 (2025 amendments)In force In force from Updates the COPPA Rule to require separate verifiable parental consent before disclosing children's data to third parties such as advertisers, written information security programs, and a written data retention policy. It also expands the definition of personal information to include biometric identifiers and adds transparency for safe harbor programs.
Synopsis
Updates the COPPA Rule to require separate verifiable parental consent before disclosing children's data to third parties such as advertisers, written information security programs, and a written data retention policy. It also expands the definition of personal information to include biometric identifiers and adds transparency for safe harbor programs.
Key themes
separate consent for third-party disclosure
written security program
retention policy
biometric identifiers
safe harbors
Unique features
Bans indefinite retention of children's data and requires published retention policies; separate consent for targeted advertising disclosures.
SaaS relevance
SaaS vendors serving child-directed apps need a written security program and must support customers' separate consent and deletion workflows.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation
Key dates
Adopted
In force
Final rule published in Federal Register 2025-04-22; effective 2025-06-23; general compliance date 2026-04-22 (safe harbor programs had some later deadlines).
COPPAChildren's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506)In force In force from Requires operators of websites and online services directed to children under 13, or with actual knowledge they collect data from such children, to give notice and obtain verifiable parental consent. Also imposes data security, retention and parental access obligations.
Synopsis
Requires operators of websites and online services directed to children under 13, or with actual knowledge they collect data from such children, to give notice and obtain verifiable parental consent. Also imposes data security, retention and parental access obligations.
Key themes
children under 13
verifiable parental consent
notice
data retention
safe harbor programs
Unique features
Age threshold is 13 (lower than many state laws); approved industry self-regulatory safe harbor programs can certify compliance.
SaaS relevance
Catches ed-tech and consumer SaaS directed at children, and general-audience services that have actual knowledge of under-13 users; school-authorised consent route is narrow.
Extraterritorial
Yes
Breach notification
None (security obligation only)
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation (2025 inflation-adjusted)
Key dates
Adopted
In force
Rule first effective 2000-04-21; amended 2013-07-01; further amended Rule effective 2025-06-23 with compliance by 2026-04-22.
GINAGenetic Information Nondiscrimination Act of 2008 (GINA)In force In force from Prevents health insurers and group health plans from denying coverage or charging higher premiums based on genetic predisposition, and employers from using genetic information in hiring, firing, placement or promotion.
Synopsis
Prevents health insurers and group health plans from denying coverage or charging higher premiums based on genetic predisposition, and employers from using genetic information in hiring, firing, placement or promotion.
Key themes
genetic information
employment discrimination
health insurance
Unique features
Protects genetic data specifically; does not cover life, disability or long-term-care insurance (not verified in source read).
SaaS relevance
Relevant to HR and benefits platforms and wellness programme providers that handle genetic information.
Breach notification
None
DPO
No
Cross-border transfers
None
Key dates
Adopted
In force
Pub. L. 110-233 signed 21 May 2008. EEOC amended its GINA regulations 17 May 2016 on wellness programmes, effective 16 Jul 2016.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only; enforcement mechanisms and separate Title I/II effective dates not stated there. The listed agencies are from general knowledge and not confirmed in the source. Text link opened on LII (42 U.S.C. 2000ff). LII note: Title II (employment) takes effect 18 months after enactment, i.e. about 21 Nov 2009 (calculated); 2008-05-21 is the enactment date and Title I's date was not checked.
Partly verifiedMedium confidence.Source read: Wikipedia only; enforcement mechanisms and separate Title I/II effective dates not stated there. The listed agencies are from general knowledge and not confirmed in the source. Text link opened on LII (42 U.S.C. 2000ff). LII note: Title II (employment) takes effect 18 months after enactment, i.e. about 21 Nov 2009 (calculated); 2008-05-21 is the enactment date and Title I's date was not checked.
HIPAA Security RuleHIPAA Security Rule (45 C.F.R. Part 164 Subpart C)In force In force from Requires covered entities and business associates to protect electronic PHI through administrative, physical and technical safeguards, based on a documented risk analysis. Many specifications are 'addressable', allowing risk-based alternatives.
Synopsis
Requires covered entities and business associates to protect electronic PHI through administrative, physical and technical safeguards, based on a documented risk analysis. Many specifications are 'addressable', allowing risk-based alternatives.
Key themes
risk analysis
administrative safeguards
access controls
audit controls
encryption (addressable)
contingency planning
Unique features
Flexible, risk-based approach; the pending proposal would make encryption and MFA mandatory and require asset inventories and 72-hour restoration capability.
SaaS relevance
Cloud and SaaS business associates holding ePHI must run risk analyses and implement the safeguards themselves, not merely contractually.
Extraterritorial
Limited
Breach notification
See HIPAA Breach Notification Rule
DPO
Yes
Cross-border transfers
None
Maximum penalty
As HIPAA Privacy Rule (tiered; ~$2.1m annual cap per provision)
Key dates
Adopted
In force
Compliance 2005-04-20 (small plans 2006); NPRM to overhaul the rule published 2025-01-06; HHS has moved final action to 'long-term actions' with target July 2027.
HIPAA Privacy RuleHIPAA Privacy Rule (45 C.F.R. Part 160 and Part 164 Subparts A and E)In force In force from Sets national standards for use and disclosure of protected health information by health plans, clearinghouses and most providers (covered entities) and their business associates. Grants individuals rights of access, amendment and an accounting of disclosures.
Synopsis
Sets national standards for use and disclosure of protected health information by health plans, clearinghouses and most providers (covered entities) and their business associates. Grants individuals rights of access, amendment and an accounting of disclosures.
Key themes
protected health information
minimum necessary
business associate agreements
right of access
de-identification
Unique features
Sector- and entity-based rather than data-based: identical health data held outside a covered entity/business associate falls outside HIPAA.
SaaS relevance
SaaS providers that create, receive, maintain or transmit PHI for a covered entity are business associates and must sign BAAs and comply directly.
Extraterritorial
Limited
Breach notification
See HIPAA Breach Notification Rule
DPO
Yes
Cross-border transfers
None (no transfer restriction)
Maximum penalty
Tiered civil penalties per violation with an annual cap per requirement of roughly $2.1m (inflation-adjusted); criminal fines up to $250,000 and 10 years
Key dates
Adopted
In force
HIPAA enacted 1996-08-21; Privacy Rule compliance 2003-04-14 (small plans 2004); HITECH Omnibus Rule compliance 2013-09-23; 2024 reproductive health amendments vacated by a federal court in 2025.
Medium confidence. Partly verifiedMedium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.
Partly verifiedMedium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.
HIPAA (statute)Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191)In force In force from The statute that required HHS to set national standards for electronic health care transactions and identifiers (Title II, Administrative Simplification). HHS issued Privacy, Transactions and Code Sets, Security, Unique Identifiers and Enforcement rules under it.
Synopsis
The statute that required HHS to set national standards for electronic health care transactions and identifiers (Title II, Administrative Simplification). HHS issued Privacy, Transactions and Code Sets, Security, Unique Identifiers and Enforcement rules under it.
Key themes
health information
administrative simplification
covered entities
HHS rules
Unique features
The enabling statute; the operative privacy obligations are in the HHS rules recorded separately.
SaaS relevance
SaaS vendors handling protected health information act as business associates under the rules.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Criminal: up to $250,000 and 10 years for offences with intent to sell or use for commercial advantage (per Wikipedia)
Key dates
Adopted
In force
Pub. L. 104-191 signed 21 Aug 1996. Title II (Administrative Simplification) led to HHS rules: Privacy Rule (effective 14 Apr 2003, see us-hipaa-privacy-rule), Security Rule, Enforcement Rule (effective 16 Mar 2006).
Medium confidence. Partly verifiedMedium confidence.Source read: first 100,000 characters of Wikipedia. The in-force date used here is the signing date; it is not confirmed whether Title II took effect then. Civil tier penalty amounts in the source look outdated, so none are given. In force date: the Act (read in the Statutes at Large PDF on congress.gov) has no general effective-date clause for Title II, subtitle F (Administrative Simplification), so the enactment date is used. Compliance is required 24 months after each HHS standard is adopted (36 months for small health plans), which is why the Privacy Rule applied from 14 Apr 2003. LII (42 U.S.C. 1320d) has no effective-date note for Pub. L. 104-191.
Partly verifiedMedium confidence.Source read: first 100,000 characters of Wikipedia. The in-force date used here is the signing date; it is not confirmed whether Title II took effect then. Civil tier penalty amounts in the source look outdated, so none are given. In force date: the Act (read in the Statutes at Large PDF on congress.gov) has no general effective-date clause for Title II, subtitle F (Administrative Simplification), so the enactment date is used. Compliance is required 24 months after each HHS standard is adopted (36 months for small health plans), which is why the Privacy Rule applied from 14 Apr 2003. LII (42 U.S.C. 1320d) has no effective-date note for Pub. L. 104-191.
Financial data5
FACTAFair and Accurate Credit Transactions Act of 2003 (FACTA; amending the Fair Credit Reporting Act)In force In force from Amends the Fair Credit Reporting Act. Gives consumers a free credit report every 12 months from each nationwide credit bureau, requires identity theft prevention rules (the Red Flags Rule) and limits card numbers on receipts to five digits plus no expiry date.
Synopsis
Amends the Fair Credit Reporting Act. Gives consumers a free credit report every 12 months from each nationwide credit bureau, requires identity theft prevention rules (the Red Flags Rule) and limits card numbers on receipts to five digits plus no expiry date.
Key themes
credit reports
identity theft
Red Flags Rule
receipt truncation
disposal of consumer information
Unique features
Receipt truncation carries statutory damages of $100 to $1,000 per violation (per Wikipedia).
SaaS relevance
Relevant to SaaS used by creditors and financial institutions for identity theft programmes.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Statutory damages $100 to $1,000 per violation for receipt truncation breaches (per Wikipedia)
Key dates
Adopted
In force
Pub. L. 108-159 signed 4 Dec 2003. Red Flags Rule compliance deadline for financial institutions: 1 Nov 2008 (later extended).
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only. Disposal rule details not read. The FCRA itself is recorded as us-fcra. Text link opened on LII (15 U.S.C. 1681, the FCRA).
Partly verifiedMedium confidence.Source read: Wikipedia only. Disposal rule details not read. The FCRA itself is recorded as us-fcra. Text link opened on LII (15 U.S.C. 1681, the FCRA).
GLBAGramm-Leach-Bliley Act, Title V Subtitle A (15 U.S.C. §§ 6801–6809) and Regulation P (12 C.F.R. Part 1016)In force In force from Requires financial institutions to give customers privacy notices and a right to opt out of certain sharing of nonpublic personal information with non-affiliated third parties. Also mandates safeguarding of customer information through agency rules.
Synopsis
Requires financial institutions to give customers privacy notices and a right to opt out of certain sharing of nonpublic personal information with non-affiliated third parties. Also mandates safeguarding of customer information through agency rules.
Key themes
nonpublic personal information
privacy notices
opt-out of third-party sharing
reuse and redisclosure limits
safeguards
Unique features
Opt-out (not opt-in) model; many state comprehensive laws exempt GLBA-covered entities or data, though Connecticut and others are narrowing entity-level exemptions.
SaaS relevance
Fintech SaaS that are 'financial institutions' are covered directly; vendors to them are bound by redisclosure limits and contractual safeguards.
Extraterritorial
Limited
Breach notification
See FTC Safeguards Rule / banking interagency rule
DPO
No
Cross-border transfers
None
Maximum penalty
Depends on regulator; FTC civil penalties for rule violations; criminal penalties for pretexting
Key dates
Adopted
In force
Privacy rules mandatory from 2001-07-01; Regulation P recodified by CFPB 2011; annual notice exception added 2015 (FAST Act).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
RFPARight to Financial Privacy Act of 1978 (12 U.S.C. § 3401 et seq.)In force In force from Gives customers of financial institutions a degree of privacy from federal government searches of their records, generally requiring notice to the customer and a chance to consent or challenge before the government obtains the records. Passed after United States v. Miller (1976) held that bank records belong to the bank.
Synopsis
Gives customers of financial institutions a degree of privacy from federal government searches of their records, generally requiring notice to the customer and a chance to consent or challenge before the government obtains the records. Passed after United States v. Miller (1976) held that bank records belong to the bank.
Key themes
government access to bank records
customer notice
consent
legal process
Unique features
Binds federal government access only, not private-sector use of financial data.
SaaS relevance
Limited; relevant to financial-sector SaaS that holds bank customer records and receives federal requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Statutory damages of $100 per violation (per Wikipedia)
Key dates
Adopted
In force
Pub. L. 95-630, Title XI, signed 10 Nov 1978. Amended 1986 and by the USA PATRIOT Act 2001 and USA FREEDOM Act.
Medium confidence. Partly verifiedMedium confidence.Effective date not stated in the source read, so date_in_force is empty. Authority listed is not a single regulator; the Act is enforced through civil actions. In force date: LII note says the section is effective upon the expiration of 120 days after 10 Nov 1978 (Pub. L. 95-630 s.2101); 120 days after that date is 10 Mar 1979 (calculated).
Partly verifiedMedium confidence.Effective date not stated in the source read, so date_in_force is empty. Authority listed is not a single regulator; the Act is enforced through civil actions. In force date: LII note says the section is effective upon the expiration of 120 days after 10 Nov 1978 (Pub. L. 95-630 s.2101); 120 days after that date is 10 Mar 1979 (calculated).
FCRAFair Credit Reporting Act (15 U.S.C. § 1681 et seq.)In force In force from Regulates consumer reporting agencies, users of consumer reports and furnishers of information. It limits report use to permissible purposes, requires accuracy procedures, adverse action notices and dispute rights.
Synopsis
Regulates consumer reporting agencies, users of consumer reports and furnishers of information. It limits report use to permissible purposes, requires accuracy procedures, adverse action notices and dispute rights.
Key themes
consumer reports
permissible purpose
accuracy
adverse action
disputes
background checks
Unique features
Strong private right of action with statutory damages; can sweep in data brokers and HR-tech that assemble data used for eligibility decisions.
SaaS relevance
HR, tenant-screening and risk-scoring SaaS may become consumer reporting agencies if they supply data used for credit, employment, insurance or housing eligibility.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Wilful violations: actual or statutory damages $100–$1,000 per consumer plus punitive damages; regulator civil penalties
Key dates
Adopted
In force
Major amendments 1996 and FACTA 2003; CFPB withdrew its proposed data-broker FCRA rule in 2025.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Bank Secrecy ActBank Secrecy Act of 1970 (Currency and Foreign Transactions Reporting Act; 31 U.S.C. § 5311 et seq.)In force In force from Requires US financial institutions and some businesses to keep records and file reports on cash transactions over $10,000, international transport of currency, foreign accounts and suspicious activity. It is an anti-money-laundering law that compels collection and reporting of customer financial data to the government.
Synopsis
Requires US financial institutions and some businesses to keep records and file reports on cash transactions over $10,000, international transport of currency, foreign accounts and suspicious activity. It is an anti-money-laundering law that compels collection and reporting of customer financial data to the government.
Key themes
currency transaction reports
suspicious activity reports
record-keeping
anti-money laundering
government access to financial records
Unique features
Reports include account number, name, address and Social Security number; institutions may not tell a customer that a suspicious activity report has been filed; the reports are exempt from FOIA.
SaaS relevance
Relevant to fintech and payment SaaS customers that are financial institutions or money services businesses and must retain and report customer data.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Fines and imprisonment for failing to file reports (amounts not verified)
Key dates
Adopted
In force
Pub. L. 91-508 signed 26 Oct 1970. Amended by the USA PATRIOT Act 2001 and the Anti-Money Laundering Act of 2020.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only. The text does not state in force explicitly but describes the Act as current. Penalty amounts not verified. Text link verified on LII (31 U.S.C. 5311).
Partly verifiedMedium confidence.Source read: Wikipedia only. The text does not state in force explicitly but describes the Act as current. Penalty amounts not verified. Text link verified on LII (31 U.S.C. 5311).
Cybersecurity4
SEC cyber disclosure rulesSEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05; Regulation S-K Item 106)In force In force from Requires SEC registrants to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe cyber risk management, strategy and governance annually.
Synopsis
Requires SEC registrants to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe cyber risk management, strategy and governance annually.
Key themes
material incidents
four business days
board oversight
risk management disclosure
national security delay
Unique features
Trigger is materiality to investors rather than harm to individuals; disclosure can be delayed only on Attorney General national security determination.
SaaS relevance
Applies to listed SaaS companies, and SaaS vendors to listed companies will face incident-information demands from customers.
Extraterritorial
Yes
Breach notification
Form 8-K within 4 business days of materiality determination
DPO
No
Cross-border transfers
None
Maximum penalty
SEC enforcement remedies under securities laws
Key dates
Adopted
In force
8-K incident reporting from 2023-12-18 (smaller reporting companies 2024-06-15); annual 10-K disclosures for fiscal years ending on/after 2023-12-15.
Medium confidence. Partly verifiedMedium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
GLBA Safeguards RuleFTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 C.F.R. Part 314In force In force from Requires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, encryption, MFA and vendor oversight. Since May 2024 they must report qualifying security events to the FTC.
Synopsis
Requires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, encryption, MFA and vendor oversight. Since May 2024 they must report qualifying security events to the FTC.
Key themes
written information security program
qualified individual
MFA
encryption
service provider oversight
FTC notification
Unique features
Prescriptive control list (MFA, encryption, penetration testing) unusual for US federal rules; notification goes to the FTC, not to individuals.
SaaS relevance
Covers fintech, lenders, tax preparers and similar SaaS; service providers must be contractually required to maintain safeguards.
Extraterritorial
Limited
Breach notification
FTC within 30 days of discovery where unencrypted data of 500+ consumers is acquired without authorisation
DPO
Conditional
Cross-border transfers
None
Maximum penalty
FTC civil penalties for rule violations (via order or rule enforcement)
Key dates
Adopted
In force
Major revision 2021 with most requirements effective 2023-06-09; notification amendment adopted 2023-10-27, effective 2024-05-13.
Medium confidence. Partly verifiedMedium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
CFAAComputer Fraud and Abuse Act of 1986 (18 U.S.C. § 1030)In force In force from Criminalises unauthorised access to protected computers and creates a private civil right of action for people harmed. In Van Buren v. United States (2021) the Supreme Court held that 'exceeds authorized access' does not cover someone who uses information they were entitled to access for an improper purpose.
Synopsis
Criminalises unauthorised access to protected computers and creates a private civil right of action for people harmed. In Van Buren v. United States (2021) the Supreme Court held that 'exceeds authorized access' does not cover someone who uses information they were entitled to access for an improper purpose.
Key themes
unauthorised access
protected computers
civil action
hacking
Unique features
Both a criminal statute and a basis for private suits; the scope of 'authorized access' has been narrowed by the courts.
SaaS relevance
Basis for action against hacking and scraping of SaaS systems; informs security-research risk.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Imprisonment from up to 1 year up to 20 years (or life where death results) depending on the offence; civil damages and equitable relief under 18 U.S.C. 1030(g)
Key dates
Adopted
In force
Pub. L. 99-474 signed 16 Oct 1986. Amended 1989, 1994, 1996, 2001 (USA PATRIOT Act), 2002 and 2008 (Identity Theft Enforcement and Restitution Act). Van Buren v. United States decided June 2021.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only. Penalty levels not given in the source so left empty. Effective date not stated. In force date: the Act (Pub. L. 99-474, read in the Statutes at Large at congress.gov) contains no effective-date clause, and LII has no effective-date note for it, so the enactment date of 16 Oct 1986 is used by default. Penalties per 18 U.S.C. 1030(c) on LII range from 1 year to 20 years depending on the offence; civil action under 1030(g) must be filed within 2 years.
Partly verifiedMedium confidence.Source read: Wikipedia only. Penalty levels not given in the source so left empty. Effective date not stated. In force date: the Act (Pub. L. 99-474, read in the Statutes at Large at congress.gov) contains no effective-date clause, and LII has no effective-date note for it, so the enactment date of 16 Oct 1986 is used by default. Penalties per 18 U.S.C. 1030(c) on LII range from 1 year to 20 years depending on the offence; civil action under 1030(g) must be filed within 2 years.
CIRCIACyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)Enacted – not yet in force Will require covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA and to report ransomware payments. Detailed scope and content are set by CISA rulemaking.
Synopsis
Will require covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA and to report ransomware payments. Detailed scope and content are set by CISA rulemaking.
Key themes
critical infrastructure
incident reporting
ransomware payments
data preservation
Unique features
Reports go to a security agency, not a privacy regulator; reports are shielded from use in regulatory enforcement in many cases.
SaaS relevance
SaaS providers to critical infrastructure, or IT/cloud providers meeting sector criteria, may become covered entities once the rule is final.
Breach notification
Proposed: CISA within 72 hours of reasonable belief of covered incident; ransom payments within 24 hours
DPO
No
Cross-border transfers
None
Maximum penalty
Subpoena and civil action to compel reporting; contempt
Key dates
Adopted
NPRM published 2024-04-04; statutory final-rule deadline (Oct 2025) missed; CISA targeted May 2026, then September 2026 for the final rule; reporting duties start only once the final rule takes effect.
Medium confidence. Partly verifiedMedium confidence.Could not confirm whether the final rule was published in Sept/Oct 2026; check the Federal Register.
Partly verifiedMedium confidence.Could not confirm whether the final rule was published in Sept/Oct 2026; check the Federal Register.
Data localisation / cross-border2
DOJ Data Security ProgramPreventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (28 C.F.R. Part 202), implementing Executive Order 14117In force In force from Prohibits or restricts US persons from engaging in data brokerage, vendor, employment and investment transactions that give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions are permitted only with CISA security requirements, due diligence and audits.
Synopsis
Prohibits or restricts US persons from engaging in data brokerage, vendor, employment and investment transactions that give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions are permitted only with CISA security requirements, due diligence and audits.
Key themes
bulk sensitive data
countries of concern
covered persons
restricted transactions
CISA security requirements
audits
reporting
Unique features
Export-control style regime with criminal penalties applied to personal data; volume thresholds per data type (e.g. 100,000 US persons for covered personal identifiers).
SaaS relevance
US SaaS companies with China-linked vendors, employees, investors or customers must screen access to bulk datasets, and onward data brokerage contracts need prohibited-transfer clauses.
Extraterritorial
Limited
Breach notification
Reporting of rejected prohibited transactions within 14 days; annual reports for certain restricted transactions
DPO
Conditional
Cross-border transfers
Prohibited/restricted transfers to China (incl. HK/Macau), Russia, Iran, North Korea, Cuba, Venezuela
Maximum penalty
IEEPA civil penalties (greater of ~$377,700 or twice the transaction value) and criminal penalties up to $1m and 20 years
Key dates
Adopted
In force
EO 14117 signed 2024-02-28; final rule published 2025-01-08; core prohibitions effective 2025-04-08; due diligence, audit and reporting obligations effective 2025-10-06.
Medium confidence. Partly verifiedMedium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.
Partly verifiedMedium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.
PADFAProtecting Americans' Data from Foreign Adversaries Act of 2024 (15 U.S.C. § 9901)In force In force from Makes it unlawful for data brokers to sell, license or otherwise make available sensitive data of US individuals to foreign adversary countries (China, Russia, Iran, North Korea) or entities they control. Violations are treated as violations of an FTC rule.
Synopsis
Makes it unlawful for data brokers to sell, license or otherwise make available sensitive data of US individuals to foreign adversary countries (China, Russia, Iran, North Korea) or entities they control. Violations are treated as violations of an FTC rule.
Key themes
data brokers
foreign adversaries
sensitive data
national security
Unique features
Very broad 'sensitive data' list (including precise geolocation, health, biometrics, private communications); no volume threshold.
SaaS relevance
Caught if a SaaS business provides US individuals' sensitive data to others for consideration where the recipient is a foreign adversary or controlled entity; ordinary service providers are carved out.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Prohibition on transfers to foreign adversary countries/controlled entities
Maximum penalty
FTC civil penalties as for rule violations ($53,088 per violation)
Key dates
Adopted
In force
Enacted as Division I of Pub. L. 118-50; effective 60 days after enactment.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Surveillance / law enforcement access9
EO 14086Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence ActivitiesIn force In force from Requires US signals intelligence to be necessary and proportionate to defined legitimate objectives and sets up a two-tier redress mechanism for people in qualifying states. It underpins the EU-US, UK and Swiss data privacy frameworks.
Synopsis
Requires US signals intelligence to be necessary and proportionate to defined legitimate objectives and sets up a two-tier redress mechanism for people in qualifying states. It underpins the EU-US, UK and Swiss data privacy frameworks.
Key themes
signals intelligence
necessity and proportionality
redress
Data Protection Review Court
qualifying states
Unique features
Introduces EU-style proportionality language into US intelligence practice through executive action, which a future President could revoke.
SaaS relevance
Underpins DPF transfers and transfer impact assessments for EU/UK customer data processed by US SaaS.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Basis for EU-US DPF adequacy and UK/Swiss equivalents
Maximum penalty
None (executive order)
Key dates
Adopted
In force
DOJ regulation creating Data Protection Review Court (28 C.F.R. Part 201) Oct 2022; EU adequacy decision for EU-US DPF 2023-07-10; EU General Court dismissed Latombe challenge 2025-09-03; appeal to CJEU lodged Oct 2025 and pending.
Medium confidence. Partly verifiedMedium confidence.PCLOB independence concerns raised in 2025–26 after member removals; Latombe appeal (C-703/25 P per reports) unresolved as of research.
Partly verifiedMedium confidence.PCLOB independence concerns raised in 2025–26 after member removals; Latombe appeal (C-703/25 P per reports) unresolved as of research.
CLOUD ActClarifying Lawful Overseas Use of Data Act (CLOUD Act)In force In force from Confirms that US providers must produce data within their possession, custody or control in response to US legal process regardless of where it is stored. It also authorises executive agreements letting qualifying foreign governments request data directly from US providers.
Synopsis
Confirms that US providers must produce data within their possession, custody or control in response to US legal process regardless of where it is stored. It also authorises executive agreements letting qualifying foreign governments request data directly from US providers.
Key themes
extraterritorial data access
possession custody or control
comity challenges
executive agreements
Unique features
Lets providers move to quash where disclosure would breach a qualifying foreign government's law; a frequent issue in EU transfer impact assessments.
SaaS relevance
Any US-headquartered SaaS (or one with US control over data) can be compelled to produce customer data stored abroad.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Executive agreements with UK, Australia
Maximum penalty
Contempt sanctions for non-compliance with legal process
Key dates
Adopted
In force
US-UK Data Access Agreement in force 2022-10-03; US-Australia agreement in force 2024-01-31.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
USA FREEDOM ActUSA FREEDOM Act of 2015 (Pub. L. 114-23)In force In force from Reauthorised expiring USA PATRIOT Act provisions and amended section 215 to bar the NSA's bulk collection of telephone metadata, requiring a specific selection term. Call-detail-record production required reasonable grounds of relevance and a reasonable, articulable suspicion linked to terrorism.
Synopsis
Reauthorised expiring USA PATRIOT Act provisions and amended section 215 to bar the NSA's bulk collection of telephone metadata, requiring a specific selection term. Call-detail-record production required reasonable grounds of relevance and a reasonable, articulable suspicion linked to terrorism.
Key themes
bulk collection
specific selection term
call detail records
FISA business records
Unique features
First major post-Snowden curtailment of bulk surveillance. In August 2019 the NSA reportedly suspended the call-detail-records programme and deleted the records.
SaaS relevance
Context for provider responses to FISA business-records orders.
Breach notification
None
DPO
No
Cross-border transfers
None
Key dates
Adopted
In force
Pub. L. 114-23 (129 Stat. 268) signed 2 Jun 2015. Section 215 call-detail-record authority later lapsed (see us-patriot-act-sunset-2020).
Medium confidence. Partly verifiedMedium confidence.Several of its extended authorities lapsed on 2020-03-15 but the Act's amendments remain in the statute. Wikipedia's infobox gives 2 June 2015 as the signing date. Confirmed in the public law text: Pub. L. 114-23, H.R. 2048, 114th Congress, approved 2 Jun 2015, 129 Stat. 268. The CRS R40138 source was removed from this record. Effective date: the Act's own effective-date provisions were not read, so the enactment date is used.
Partly verifiedMedium confidence.Several of its extended authorities lapsed on 2020-03-15 but the Act's amendments remain in the statute. Wikipedia's infobox gives 2 June 2015 as the signing date. Confirmed in the public law text: Pub. L. 114-23, H.R. 2048, 114th Congress, approved 2 Jun 2015, 129 Stat. 268. The CRS R40138 source was removed from this record. Effective date: the Act's own effective-date provisions were not read, so the enactment date is used.
CALEACommunications Assistance for Law Enforcement Act (CALEA) 1994 (47 U.S.C. §§ 1001-1010)In force In force from Requires telecommunications carriers and equipment manufacturers to build surveillance capability into their facilities so agencies can conduct targeted wiretaps, and to make call detail records available. Extended by the FCC to interconnected VoIP and broadband internet access providers.
Synopsis
Requires telecommunications carriers and equipment manufacturers to build surveillance capability into their facilities so agencies can conduct targeted wiretaps, and to make call detail records available. Extended by the FCC to interconnected VoIP and broadband internet access providers.
Key themes
lawful interception
wiretap capability
carriers
VoIP
call detail records
Unique features
Imposes design requirements on communications infrastructure rather than rules on data handling.
SaaS relevance
May apply to interconnected VoIP and broadband providers; most SaaS products are outside it.
Breach notification
None
DPO
No
Cross-border transfers
None
Key dates
Adopted
In force
Pub. L. 103-414 signed 25 Oct 1994. FCC extended it to interconnected VoIP and broadband access in Sept 2005 (First Report and Order), affirmed May 2006. Compliance deadline of 14 May 2007 for those services.
Medium confidence. Partly verifiedMedium confidence.Source read: Wikipedia only. Which providers are in scope today is not verified. In force date: LII notes say the title took effect on enactment (25 Oct 1994), but sections 103 and 105 (capability and security duties) take effect 4 years after enactment (about 25 Oct 1998; not stated as a date on LII). The earlier 1995-01-01 date came from Wikipedia and is not supported by LII.
Partly verifiedMedium confidence.Source read: Wikipedia only. Which providers are in scope today is not verified. In force date: LII notes say the title took effect on enactment (25 Oct 1994), but sections 103 and 105 (capability and security duties) take effect 4 years after enactment (about 25 Oct 1998; not stated as a date on LII). The earlier 1995-01-01 date came from Wikipedia and is not supported by LII.
Wiretap ActElectronic Communications Privacy Act, Title I – Wiretap Act (18 U.S.C. §§ 2510–2523)In force In force from Prohibits intentional interception of wire, oral and electronic communications in transit unless an exception applies, such as one-party consent or provider exceptions. Sets the procedure for court-ordered interception by law enforcement.
Synopsis
Prohibits intentional interception of wire, oral and electronic communications in transit unless an exception applies, such as one-party consent or provider exceptions. Sets the procedure for court-ordered interception by law enforcement.
Key themes
interception
one-party consent
provider exception
court orders
session replay and pixel litigation
Unique features
Federal standard is one-party consent, but many states require all-party consent; used heavily in class actions over session-replay and tracking pixels.
SaaS relevance
Analytics, chat and session-replay SaaS face wiretap claims where they capture website communications without adequate consent.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Civil: greater of $100/day or $10,000 per plaintiff plus punitive damages; criminal up to 5 years
Key dates
Adopted
In force
Original Title III enacted 1968; expanded to electronic communications by ECPA 1986.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
SCAElectronic Communications Privacy Act, Title II – Stored Communications Act (18 U.S.C. §§ 2701–2713)In force In force from Restricts unauthorised access to stored electronic communications and limits voluntary disclosure of content and records by providers of electronic communication and remote computing services. Sets the legal process (subpoena, 2703(d) order, warrant) required for government access.
Synopsis
Restricts unauthorised access to stored electronic communications and limits voluntary disclosure of content and records by providers of electronic communication and remote computing services. Sets the legal process (subpoena, 2703(d) order, warrant) required for government access.
Key themes
stored communications
voluntary disclosure limits
subpoenas
2703(d) orders
warrants
non-disclosure orders
Unique features
Provider-centric: distinguishes electronic communication services from remote computing services, with different rules for content and non-content data.
SaaS relevance
Cloud/SaaS hosts storing customer communications are typically RCS/ECS providers that cannot voluntarily hand over content to government and must respond to compulsory process.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
CLOUD Act executive agreements
Maximum penalty
Civil: actual damages or minimum $1,000 plus punitive damages; criminal penalties
Key dates
Adopted
In force
Amended by the CLOUD Act 2018 (s2713 extraterritorial reach).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
FISAForeign Intelligence Surveillance Act of 1978 (50 U.S.C. § 1801 et seq.)In force In force from Sets the procedure for physical and electronic surveillance and collection of foreign intelligence in the US and created the Foreign Intelligence Surveillance Court to review applications. Covers electronic surveillance, physical searches, pen registers and trap-and-trace devices, and access to certain business records.
Synopsis
Sets the procedure for physical and electronic surveillance and collection of foreign intelligence in the US and created the Foreign Intelligence Surveillance Court to review applications. Covers electronic surveillance, physical searches, pen registers and trap-and-trace devices, and access to certain business records.
Key themes
foreign intelligence
FISA Court
electronic surveillance
physical searches
pen registers
business records
Unique features
Created the secret FISA Court. Section 702 (Title VII) is recorded as a separate row; the rest of the Act continues.
SaaS relevance
US providers can receive FISA orders for customer data; relevant to EU transfer assessments.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Relevant to EU transfer risk assessments
Key dates
Adopted
In force
Pub. L. 95-511 signed 25 Oct 1978. Amended by the USA PATRIOT Act 2001, Protect America Act 2007 (5 Aug 2007), FISA Amendments Act 2008 (10 Jul 2008, added Title VII), USA FREEDOM Act 2015, FISA Amendments Reauthorization Act 2018 (19 Jan 2018) and RISAA 2024 (20 Apr 2024). Title VII, including section 702, lapsed on 12 Jun 2026 (see us-fisa-702).
Medium confidence. Partly verifiedMedium confidence.Source read: first 100,000 characters of Wikipedia only. The base Act remains in force; only Title VII (702) and the provisions listed under us-patriot-act-sunset-2020 lapsed. Effective date not stated, so date_in_force is empty. In force date: LII Effective Date note says the provisions became effective on the date of enactment, 25 Oct 1978 (with an exception for Attorney General-approved surveillance for 90 days after the first judge designation).
Partly verifiedMedium confidence.Source read: first 100,000 characters of Wikipedia only. The base Act remains in force; only Title VII (702) and the provisions listed under us-patriot-act-sunset-2020 lapsed. Effective date not stated, so date_in_force is empty. In force date: LII Effective Date note says the provisions became effective on the date of enactment, 25 Oct 1978 (with an exception for Attorney General-approved surveillance for 90 days after the first judge designation).
Historic & pending (2)
FISA 702Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. § 1881a)Repealed/superseded In force from Authorised targeted collection of foreign intelligence from non-US persons reasonably believed to be abroad, with compelled assistance from US electronic communication service providers. The authority lapsed on 12 June 2026, but directives issued under existing certifications remain effective until they expire.
Synopsis
Authorised targeted collection of foreign intelligence from non-US persons reasonably believed to be abroad, with compelled assistance from US electronic communication service providers. The authority lapsed on 12 June 2026, but directives issued under existing certifications remain effective until they expire.
Key themes
foreign intelligence
electronic communication service providers
directives
US person queries
sunset
Unique features
Central to Schrems II; the 2024 RISAA expansion of the 'ECSP' definition was controversial for reaching data centre and cloud providers.
SaaS relevance
US cloud/SaaS providers may still receive directives under surviving certifications until they expire, which remains relevant to EU transfer impact assessments.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Relevant to EU transfer risk assessments
Maximum penalty
Contempt for refusing directives
Key dates
Adopted
In force
Ended
Reauthorised by RISAA 2024-04-20 until April 2026; short-term extensions in April 2026 (incl. Pub. L. 119-87); title VII sunset 2026-06-12; FISC-approved one-year certifications (March 2026) continue under transition clause until about March 2027.
Medium confidence. Partly verifiedMedium confidence.Status as of the June 2026 CRS sidebar. Reauthorisation bills (H.R. 8035, S. 3893) were pending; check whether Congress revived 702 after June 2026.
Partly verifiedMedium confidence.Status as of the June 2026 CRS sidebar. Reauthorisation bills (H.R. 8035, S. 3893) were pending; check whether Congress revived 702 after June 2026.
PATRIOT Act s215 etc. (expired)USA PATRIOT Act (2001): section 215 business-records, roving wiretap and lone-wolf FISA authorities (expired 15 March 2020)Repealed/superseded In force from Three FISA amendments that sunset on 15 March 2020 and have not been reauthorised: section 215 business-records orders, 'roving' wiretaps under section 206 and the 'lone wolf' provision. The rest of the USA PATRIOT Act is not covered by this record and remains in force.
Synopsis
Three FISA amendments that sunset on 15 March 2020 and have not been reauthorised: section 215 business-records orders, 'roving' wiretaps under section 206 and the 'lone wolf' provision. The rest of the USA PATRIOT Act is not covered by this record and remains in force.
Key themes
section 215
business records
roving wiretaps
lone wolf
sunset
grandfather clause
Unique features
Section 215's call-detail-record authority lapsed separately because it had no separate sunset. A 2021 DOJ letter says the government may use the grandfather exception for older investigations.
SaaS relevance
Provider exposure to section 215 orders is limited to pre-March 2020 investigations; other FISA and national security process continues.
Breach notification
None
DPO
No
Cross-border transfers
None
Key dates
Adopted
In force
Ended
USA PATRIOT Act, Pub. L. 107-56, signed 26 Oct 2001. Original sunset 31 Dec 2005; extended 2006 and 2011; lapsed 1 Jun 2015; restored by the USA FREEDOM Act 2 Jun 2015; extended to 15 Mar 2020 in Dec 2019. House passed H.R. 6172 on 11 Mar 2020, but no extension was enacted. Grandfather clauses keep the provisions available for investigations begun before the sunset.
Medium confidence. Partly verifiedMedium confidence.Lapse date confirmed in CRS R40138 (Origins and Impact of the FISA Provisions That Expired on March 15, 2020, updated 31 Mar 2021, opened as PDF on congress.gov): the provisions expired on 15 Mar 2020 and have not been reauthorized since, with grandfather clauses for earlier investigations. The report is from March 2021, so later action by Congress is not checked. Wikipedia's table shows 15 Dec 2019, which was the earlier deadline. In force date is the enactment date of Pub. L. 107-56 (26 Oct 2001) from Wikipedia; the three authorities came in separately (s.206 and s.215 in 2001, lone wolf in 2004 under IRTPA).
Partly verifiedMedium confidence.Lapse date confirmed in CRS R40138 (Origins and Impact of the FISA Provisions That Expired on March 15, 2020, updated 31 Mar 2021, opened as PDF on congress.gov): the provisions expired on 15 Mar 2020 and have not been reauthorized since, with grandfather clauses for earlier investigations. The report is from March 2021, so later action by Congress is not checked. Wikipedia's table shows 15 Dec 2019, which was the earlier deadline. In force date is the enactment date of Pub. L. 107-56 (26 Oct 2001) from Wikipedia; the three authorities came in separately (s.206 and s.215 in 2001, lone wolf in 2004 under IRTPA).
Human rights / constitutional1
Fourth AmendmentUnited States Constitution, Fourth AmendmentIn force In force from Protects people against unreasonable searches and seizures by government and generally requires a warrant supported by probable cause. Courts apply a 'reasonable expectation of privacy' test, with the third-party doctrine limiting protection for data held by service providers.
Synopsis
Protects people against unreasonable searches and seizures by government and generally requires a warrant supported by probable cause. Courts apply a 'reasonable expectation of privacy' test, with the third-party doctrine limiting protection for data held by service providers.
Key themes
government searches
warrants
reasonable expectation of privacy
third-party doctrine
location data
Unique features
Binds only government actors, not private companies; there is no general constitutional right to data protection at federal level, unlike Article 8 of the EU Charter.
SaaS relevance
Shapes when US law enforcement needs a warrant versus a subpoena to obtain customer data held by a SaaS provider.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Exclusion of evidence; civil claims against officials (Bivens/42 USC 1983)
Key dates
Adopted
In force
Ratified with the Bill of Rights 1791; Carpenter v. United States (2018) extended warrant requirement to historical cell-site location data.
Membership-based — check ratification status in the instrument record. 13 instruments from 5 bodies.
Organisation for Economic Co-operation and Development (OECD)
OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force In force from Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Synopsis
Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Key themes
trustworthy AI
human rights
privacy
transparency
explainability
robustness
accountability
Unique features
It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.
SaaS relevance
Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force In force from The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Synopsis
The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Key themes
government access
national security
law enforcement
legal basis
oversight
redress
transparency
Unique features
It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.
SaaS relevance
Useful reference for transfer impact assessments and for policies on responding to government data demands.
Breach notification
None
DPO
No
Cross-border transfers
Supports trusted data flows between adherents
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force In force from Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Synopsis
Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Key themes
accountability
privacy management programmes
breach notification
enforcement cooperation
interoperability
transborder flows
Unique features
It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.
SaaS relevance
It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.
Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded In force from A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Synopsis
A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Key themes
eight fair information principles
accountability
transborder flows
Unique features
These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.
SaaS relevance
Historical baseline; its principles are reflected in most national laws a SaaS provider meets.
Breach notification
None
DPO
No
Cross-border transfers
Free flow encouraged; restrictions only where proportionate
Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force In force from An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Synopsis
An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Key themes
certification
interoperability
accountability agents
processors
data flows
Unique features
The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.
SaaS relevance
A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
Medium confidence. Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Asia-Pacific Economic Cooperation (APEC)
APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force In force from Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Synopsis
Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Key themes
certification
accountability agents
cross-border enforcement
processors
Unique features
It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).
SaaS relevance
PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
Medium confidence. Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
APEC Privacy FrameworkAPEC Privacy FrameworkIn force In force from A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Synopsis
A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Key themes
preventing harm
notice
choice
accountability
cross-border privacy enforcement
interoperability
Unique features
Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.
SaaS relevance
It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Accountability-based; CBPR system
Maximum penalty
None
Key dates
Adopted
In force
Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
Partly verifiedMedium confidence.I did not re-check the publication URL this session.
United Nations
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Organization of American States (OAS)
OAS Updated PrinciplesInter-American Juridical Committee Updated Principles on Privacy and Personal Data ProtectionIn force In force from Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
Synopsis
Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
Key themes
principles
consent
sensitive data
accountability
cross-border flows
independent authority
Unique features
The update accounts for the GDPR and Convention 108+ while staying compatible with Inter-American human rights law and the habeas data tradition.
SaaS relevance
Background for Latin American national law; no direct obligations.
Breach notification
Recommended (security principle)
DPO
No
Cross-border transfers
Transfers to jurisdictions with comparable protection or with safeguards
Maximum penalty
None
Key dates
Adopted
In force
Replaces the CJI 2015 Principles (from the 2012 proposal); approved by the Inter-American Juridical Committee in April 2021 (98th regular session); the General Assembly took note in 2021
Low confidence. Partly verifiedLow confidence.The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.
Partly verifiedLow confidence.The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.