WY breach lawWyoming data breach notification law (Wyo. Stat. §§ 40-12-501 to 40-12-502)In force In force from Requires businesses (and in most cases public bodies) that own or license computerised personal information about Wyoming residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as possible after determining misuse is likely. Covered data: name plus SSN, driver's licence, financial account with codes, government ID, security tokens, online credentials, birth/marriage certificate, medical and health insurance data, biometric data, taxpayer ID.
Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Wyoming residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as possible after determining misuse is likely. Covered data: name plus SSN, driver's licence, financial account with codes, government ID, security tokens, online credentials, birth/marriage certificate, medical and health insurance data, biometric data, taxpayer ID.
Key themes
breach notification
personal information definition
regulator notice
consumer reporting agency notice
vendor-to-owner notice
encryption safe harbour
substitute notice
law enforcement delay
Unique features
Very broad PI definition including shared secrets/security tokens and birth or marriage certificates; no regulator notice.
SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Wyoming requires the maintaining entity to notify the owner as soon as practicable. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
Extraterritorial
Limited
Breach notification
Individuals as soon as possible after determining misuse is likely; no AG notice
DPO
No
Cross-border transfers
None
Maximum penalty
AG may seek damages and other relief; no specific penalty
Key dates
Adopted
In force
SF 35 and SF 36 (2015, eff. 2015-07-01) broadened PI and notice content
FTC Act s5Federal Trade Commission Act, Section 5 (15 U.S.C. § 45) – unfair or deceptive acts or practicesIn force In force from Prohibits unfair or deceptive acts or practices in commerce and is the FTC's main tool for privacy and data security enforcement. The FTC brings cases over misleading privacy statements, inadequate security and harmful data practices, usually resolved by long-term consent orders.
Synopsis
Prohibits unfair or deceptive acts or practices in commerce and is the FTC's main tool for privacy and data security enforcement. The FTC brings cases over misleading privacy statements, inadequate security and harmful data practices, usually resolved by long-term consent orders.
Key themes
deception
unfairness
data security
consent orders
dark patterns
algorithmic disgorgement
DPF enforcement
Unique features
Functions as the de facto US federal privacy regime through case law and consent orders rather than prescriptive rules; the FTC has ordered deletion of models trained on improperly obtained data.
SaaS relevance
Applies to almost any for-profit SaaS business: privacy policies, security claims and DPF self-certifications are enforceable promises.
Extraterritorial
Limited
Breach notification
None (but failure to disclose may be deceptive)
DPO
No
Cross-border transfers
EU-US DPF / UK Extension / Swiss-US DPF self-certification enforced by FTC
Maximum penalty
Civil penalties for violating orders or rules: $53,088 per violation (2025 inflation adjustment)
Key dates
Adopted
In force
Wheeler-Lea Act 1938 added 'unfair or deceptive acts or practices'; AMG Capital (2021) removed s13(b) monetary relief; civil penalties available for order/rule violations (inflation-adjusted annually).
TAKE IT DOWN ActTools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act (TAKE IT DOWN Act)In force In force from Makes it a federal crime to knowingly publish non-consensual intimate images, including AI-generated deepfakes, or to threaten to do so. Covered platforms must provide a notice-and-removal process and take down reported content within 48 hours.
Synopsis
Makes it a federal crime to knowingly publish non-consensual intimate images, including AI-generated deepfakes, or to threaten to do so. Covered platforms must provide a notice-and-removal process and take down reported content within 48 hours.
Key themes
non-consensual intimate imagery
deepfakes
notice and removal
48-hour takedown
Unique features
One of the first federal statutes imposing content-removal deadlines on platforms; enforced by the FTC as an unfair/deceptive practice.
SaaS relevance
SaaS that host user-generated content publicly (forums, community, media hosting) are 'covered platforms' and need a removal workflow.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
FTC civil penalties of $53,088 per violation; criminal imprisonment up to 2 years (3 where minors involved)
DPPADriver's Privacy Protection Act of 1994 (18 U.S.C. §§ 2721–2725)In force In force from Limits disclosure and use of personal information from state motor vehicle records to permissible purposes. Resellers and recipients are bound by the same limits.
Synopsis
Limits disclosure and use of personal information from state motor vehicle records to permissible purposes. Resellers and recipients are bound by the same limits.
Key themes
motor vehicle records
permissible uses
resale
marketing consent
Unique features
Binds downstream recipients of DMV data, not just the state agencies.
SaaS relevance
Relevant to SaaS in insurance, automotive, identity verification and data enrichment that ingest DMV-derived data.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Liquidated damages of $2,500 per violation plus punitive damages; criminal fines
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
VPPAVideo Privacy Protection Act of 1988 (18 U.S.C. § 2710)In force In force from Bars video tape service providers from knowingly disclosing personally identifiable information about consumers' video viewing without informed written consent. Courts have applied it to streaming and websites with embedded video.
Synopsis
Bars video tape service providers from knowingly disclosing personally identifiable information about consumers' video viewing without informed written consent. Courts have applied it to streaming and websites with embedded video.
Key themes
video viewing history
consent
tracking pixels
class actions
Unique features
Pre-internet statute now driving pixel litigation against sites that share video viewing data with ad platforms.
SaaS relevance
Video hosting and analytics SaaS and their customers face claims where viewing data plus identifiers flow to third parties.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Liquidated damages of $2,500 per person plus punitive damages
Key dates
Adopted
In force
Amended 2013 to allow electronic consent for sharing.
Medium confidence. Partly verifiedMedium confidence.Circuit split on who is a 'consumer'. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Circuit split on who is a 'consumer'. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Privacy ActPrivacy Act of 1974 (5 U.S.C. § 552a)In force In force from Governs how federal agencies collect, maintain, use and disclose records about individuals held in 'systems of records'. Requires public notice of record systems, limits disclosures without consent, and gives individuals access and amendment rights.
Synopsis
Governs how federal agencies collect, maintain, use and disclose records about individuals held in 'systems of records'. Requires public notice of record systems, limits disclosures without consent, and gives individuals access and amendment rights.
Key themes
government records
system of records notices
access
amendment
disclosure limits
computer matching
Unique features
Applies only to federal agencies; rights originally limited to US citizens and permanent residents, partly extended to EU citizens by the Judicial Redress Act.
SaaS relevance
Caught indirectly when a SaaS provider operates a system of records on behalf of a federal agency under contract (contractor clause, 5 U.S.C. 552a(m)).
Extraterritorial
No
Breach notification
None in statute (OMB M-17-12 governs agency breaches)
DPO
Conditional
Cross-border transfers
None
Maximum penalty
Actual damages (min. $1,000) in civil suits; misdemeanour fines up to $5,000
Key dates
Adopted
In force
Computer Matching and Privacy Protection Act 1988 amendments; Judicial Redress Act 2015 extended certain remedies to citizens of designated countries (incl. EU).
FERPAFamily Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99)In force In force from Protects the privacy of student education records at schools receiving federal education funding. Parents and eligible students have rights to access and seek amendment, and disclosure generally requires consent subject to exceptions.
Synopsis
Protects the privacy of student education records at schools receiving federal education funding. Parents and eligible students have rights to access and seek amendment, and disclosure generally requires consent subject to exceptions.
Key themes
education records
consent
school official exception
directory information
parental rights
Unique features
Enforced through withdrawal of federal funding from institutions; no private right of action.
SaaS relevance
Ed-tech SaaS can receive student records under the 'school official' exception only if under the school's direct control and barred from redisclosure.
Extraterritorial
No
Breach notification
None (no statutory breach duty)
DPO
No
Cross-border transfers
None
Maximum penalty
Loss of federal funding for institutions
Key dates
Adopted
In force
Regulations amended 2008 and 2011 (school official exception for contractors).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
ePrivacy / marketing2
CAN-SPAMControlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (15 U.S.C. §§ 7701–7713)In force In force from Sets rules for commercial email, including honest headers and subject lines, identification as an advertisement, a physical address and a working opt-out honoured within 10 business days. It does not require prior consent.
Synopsis
Sets rules for commercial email, including honest headers and subject lines, identification as an advertisement, a physical address and a working opt-out honoured within 10 business days. It does not require prior consent.
Key themes
commercial email
opt-out
header accuracy
physical address
preemption of state anti-spam laws
Unique features
Opt-out regime, in contrast to the EU/UK opt-in for marketing email; largely preempts state spam laws.
SaaS relevance
Applies to SaaS marketing email and to email-sending platforms that 'initiate' or 'procure' messages for customers.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
TCPATelephone Consumer Protection Act of 1991 (47 U.S.C. § 227)In force In force from Restricts telemarketing calls, autodialled and prerecorded/artificial-voice calls and texts to mobiles, and unsolicited faxes. Requires prior express (written, for marketing) consent and honours Do Not Call lists.
Synopsis
Restricts telemarketing calls, autodialled and prerecorded/artificial-voice calls and texts to mobiles, and unsolicited faxes. Requires prior express (written, for marketing) consent and honours Do Not Call lists.
Key themes
robocalls
text messages
prior express written consent
Do Not Call
AI-generated voices
Unique features
Private right of action with statutory damages per call drives large class actions; FCC confirmed in 2024 that AI-generated voices are 'artificial'.
SaaS relevance
SaaS offering SMS/voice campaigns, or using SMS for marketing, must manage consent capture and opt-outs.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
$500 per call/text, trebled to $1,500 if wilful (private action)
Key dates
Adopted
In force
FCC rules 47 C.F.R. 64.1200; National Do Not Call Registry 2003; FCC 'one-to-one consent' rule vacated by 11th Cir. in January 2025; McLaughlin Chiropractic (US Sup. Ct. 2025) ended binding deference to FCC interpretations.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Breach notification2
HBNRFTC Health Breach Notification Rule (16 C.F.R. Part 318)In force In force from Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. The 2024 update confirms that unauthorised disclosures (e.g. sharing with advertisers) count as breaches.
Synopsis
Requires vendors of personal health records and related entities not covered by HIPAA to notify individuals, the FTC and sometimes the media after a breach of unsecured identifiable health information. The 2024 update confirms that unauthorised disclosures (e.g. sharing with advertisers) count as breaches.
Key themes
personal health records
health apps
unauthorised disclosure
FTC notification
Unique features
Treats unauthorised sharing, not just security incidents, as a reportable breach; fills the gap for non-HIPAA health apps.
SaaS relevance
Health and wellness apps and the SaaS platforms behind them that draw data from multiple sources are 'PHR vendors' or service providers to them.
Extraterritorial
Limited
Breach notification
Individuals without unreasonable delay and within 60 days; FTC at same time if 500+ (else annually); media if 500+ in a state
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation
Key dates
Adopted
In force
2021 policy statement; amended rule published 2024-05-30, effective 2024-07-29, clarifying coverage of health apps and adding electronic notice.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
HIPAA Breach Rule / HITECHHIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) under the HITECH ActIn force In force from Requires covered entities to notify affected individuals, HHS and in larger cases the media following a breach of unsecured PHI. Business associates must notify the covered entity. The HITECH Act also made business associates directly liable and increased penalties.
Synopsis
Requires covered entities to notify affected individuals, HHS and in larger cases the media following a breach of unsecured PHI. Business associates must notify the covered entity. The HITECH Act also made business associates directly liable and increased penalties.
Key themes
breach of unsecured PHI
presumption of breach
four-factor risk assessment
HHS reporting
business associate liability
Unique features
Breach is presumed unless a documented risk assessment shows low probability of compromise; breaches of 500+ are published on HHS's public portal.
SaaS relevance
SaaS business associates must notify their covered-entity customers without unreasonable delay and within 60 days of discovery.
Extraterritorial
Limited
Breach notification
Individuals within 60 days; HHS within 60 days if 500+ (annual log if fewer); media if 500+ in a state; BA to CE within 60 days
Cross-border transfers
None
Maximum penalty
As HIPAA (tiered civil penalties)
Key dates
Adopted
In force
HITECH Act enacted 2009-02-17; interim final rule effective 2009-09-23; 'risk of harm' standard replaced by low-probability-of-compromise test in 2013 Omnibus Rule.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Children's privacy2
Amended COPPA RuleChildren's Online Privacy Protection Rule, 16 C.F.R. Part 312 (2025 amendments)In force In force from Updates the COPPA Rule to require separate verifiable parental consent before disclosing children's data to third parties such as advertisers, written information security programs, and a written data retention policy. It also expands the definition of personal information to include biometric identifiers and adds transparency for safe harbor programs.
Synopsis
Updates the COPPA Rule to require separate verifiable parental consent before disclosing children's data to third parties such as advertisers, written information security programs, and a written data retention policy. It also expands the definition of personal information to include biometric identifiers and adds transparency for safe harbor programs.
Key themes
separate consent for third-party disclosure
written security program
retention policy
biometric identifiers
safe harbors
Unique features
Bans indefinite retention of children's data and requires published retention policies; separate consent for targeted advertising disclosures.
SaaS relevance
SaaS vendors serving child-directed apps need a written security program and must support customers' separate consent and deletion workflows.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation
Key dates
Adopted
In force
Final rule published in Federal Register 2025-04-22; effective 2025-06-23; general compliance date 2026-04-22 (safe harbor programs had some later deadlines).
COPPAChildren's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506)In force In force from Requires operators of websites and online services directed to children under 13, or with actual knowledge they collect data from such children, to give notice and obtain verifiable parental consent. Also imposes data security, retention and parental access obligations.
Synopsis
Requires operators of websites and online services directed to children under 13, or with actual knowledge they collect data from such children, to give notice and obtain verifiable parental consent. Also imposes data security, retention and parental access obligations.
Key themes
children under 13
verifiable parental consent
notice
data retention
safe harbor programs
Unique features
Age threshold is 13 (lower than many state laws); approved industry self-regulatory safe harbor programs can certify compliance.
SaaS relevance
Catches ed-tech and consumer SaaS directed at children, and general-audience services that have actual knowledge of under-13 users; school-authorised consent route is narrow.
Extraterritorial
Yes
Breach notification
None (security obligation only)
DPO
No
Cross-border transfers
None
Maximum penalty
$53,088 per violation (2025 inflation-adjusted)
Key dates
Adopted
In force
Rule first effective 2000-04-21; amended 2013-07-01; further amended Rule effective 2025-06-23 with compliance by 2026-04-22.
HIPAA Security RuleHIPAA Security Rule (45 C.F.R. Part 164 Subpart C)In force In force from Requires covered entities and business associates to protect electronic PHI through administrative, physical and technical safeguards, based on a documented risk analysis. Many specifications are 'addressable', allowing risk-based alternatives.
Synopsis
Requires covered entities and business associates to protect electronic PHI through administrative, physical and technical safeguards, based on a documented risk analysis. Many specifications are 'addressable', allowing risk-based alternatives.
Key themes
risk analysis
administrative safeguards
access controls
audit controls
encryption (addressable)
contingency planning
Unique features
Flexible, risk-based approach; the pending proposal would make encryption and MFA mandatory and require asset inventories and 72-hour restoration capability.
SaaS relevance
Cloud and SaaS business associates holding ePHI must run risk analyses and implement the safeguards themselves, not merely contractually.
Extraterritorial
Limited
Breach notification
See HIPAA Breach Notification Rule
DPO
Yes
Cross-border transfers
None
Maximum penalty
As HIPAA Privacy Rule (tiered; ~$2.1m annual cap per provision)
Key dates
Adopted
In force
Compliance 2005-04-20 (small plans 2006); NPRM to overhaul the rule published 2025-01-06; HHS has moved final action to 'long-term actions' with target July 2027.
HIPAA Privacy RuleHIPAA Privacy Rule (45 C.F.R. Part 160 and Part 164 Subparts A and E)In force In force from Sets national standards for use and disclosure of protected health information by health plans, clearinghouses and most providers (covered entities) and their business associates. Grants individuals rights of access, amendment and an accounting of disclosures.
Synopsis
Sets national standards for use and disclosure of protected health information by health plans, clearinghouses and most providers (covered entities) and their business associates. Grants individuals rights of access, amendment and an accounting of disclosures.
Key themes
protected health information
minimum necessary
business associate agreements
right of access
de-identification
Unique features
Sector- and entity-based rather than data-based: identical health data held outside a covered entity/business associate falls outside HIPAA.
SaaS relevance
SaaS providers that create, receive, maintain or transmit PHI for a covered entity are business associates and must sign BAAs and comply directly.
Extraterritorial
Limited
Breach notification
See HIPAA Breach Notification Rule
DPO
Yes
Cross-border transfers
None (no transfer restriction)
Maximum penalty
Tiered civil penalties per violation with an annual cap per requirement of roughly $2.1m (inflation-adjusted); criminal fines up to $250,000 and 10 years
Key dates
Adopted
In force
HIPAA enacted 1996-08-21; Privacy Rule compliance 2003-04-14 (small plans 2004); HITECH Omnibus Rule compliance 2013-09-23; 2024 reproductive health amendments vacated by a federal court in 2025.
Medium confidence. Partly verifiedMedium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.
Partly verifiedMedium confidence.dpo_required Yes = mandatory privacy official. A care-coordination Privacy Rule final rule was at OMB in 2026 (per DWT, July 2026); check whether published. Vacatur of the 2024 reproductive health rule is from established knowledge.
Financial data2
GLBAGramm-Leach-Bliley Act, Title V Subtitle A (15 U.S.C. §§ 6801–6809) and Regulation P (12 C.F.R. Part 1016)In force In force from Requires financial institutions to give customers privacy notices and a right to opt out of certain sharing of nonpublic personal information with non-affiliated third parties. Also mandates safeguarding of customer information through agency rules.
Synopsis
Requires financial institutions to give customers privacy notices and a right to opt out of certain sharing of nonpublic personal information with non-affiliated third parties. Also mandates safeguarding of customer information through agency rules.
Key themes
nonpublic personal information
privacy notices
opt-out of third-party sharing
reuse and redisclosure limits
safeguards
Unique features
Opt-out (not opt-in) model; many state comprehensive laws exempt GLBA-covered entities or data, though Connecticut and others are narrowing entity-level exemptions.
SaaS relevance
Fintech SaaS that are 'financial institutions' are covered directly; vendors to them are bound by redisclosure limits and contractual safeguards.
Extraterritorial
Limited
Breach notification
See FTC Safeguards Rule / banking interagency rule
DPO
No
Cross-border transfers
None
Maximum penalty
Depends on regulator; FTC civil penalties for rule violations; criminal penalties for pretexting
Key dates
Adopted
In force
Privacy rules mandatory from 2001-07-01; Regulation P recodified by CFPB 2011; annual notice exception added 2015 (FAST Act).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
FCRAFair Credit Reporting Act (15 U.S.C. § 1681 et seq.)In force In force from Regulates consumer reporting agencies, users of consumer reports and furnishers of information. It limits report use to permissible purposes, requires accuracy procedures, adverse action notices and dispute rights.
Synopsis
Regulates consumer reporting agencies, users of consumer reports and furnishers of information. It limits report use to permissible purposes, requires accuracy procedures, adverse action notices and dispute rights.
Key themes
consumer reports
permissible purpose
accuracy
adverse action
disputes
background checks
Unique features
Strong private right of action with statutory damages; can sweep in data brokers and HR-tech that assemble data used for eligibility decisions.
SaaS relevance
HR, tenant-screening and risk-scoring SaaS may become consumer reporting agencies if they supply data used for credit, employment, insurance or housing eligibility.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Wilful violations: actual or statutory damages $100–$1,000 per consumer plus punitive damages; regulator civil penalties
Key dates
Adopted
In force
Major amendments 1996 and FACTA 2003; CFPB withdrew its proposed data-broker FCRA rule in 2025.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Cybersecurity3
SEC cyber disclosure rulesSEC Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules (Form 8-K Item 1.05; Regulation S-K Item 106)In force In force from Requires SEC registrants to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe cyber risk management, strategy and governance annually.
Synopsis
Requires SEC registrants to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe cyber risk management, strategy and governance annually.
Key themes
material incidents
four business days
board oversight
risk management disclosure
national security delay
Unique features
Trigger is materiality to investors rather than harm to individuals; disclosure can be delayed only on Attorney General national security determination.
SaaS relevance
Applies to listed SaaS companies, and SaaS vendors to listed companies will face incident-information demands from customers.
Extraterritorial
Yes
Breach notification
Form 8-K within 4 business days of materiality determination
DPO
No
Cross-border transfers
None
Maximum penalty
SEC enforcement remedies under securities laws
Key dates
Adopted
In force
8-K incident reporting from 2023-12-18 (smaller reporting companies 2024-06-15); annual 10-K disclosures for fiscal years ending on/after 2023-12-15.
Medium confidence. Partly verifiedMedium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Foreign private issuers have equivalent Form 6-K/20-F duties. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
GLBA Safeguards RuleFTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 C.F.R. Part 314In force In force from Requires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, encryption, MFA and vendor oversight. Since May 2024 they must report qualifying security events to the FTC.
Synopsis
Requires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, encryption, MFA and vendor oversight. Since May 2024 they must report qualifying security events to the FTC.
Key themes
written information security program
qualified individual
MFA
encryption
service provider oversight
FTC notification
Unique features
Prescriptive control list (MFA, encryption, penetration testing) unusual for US federal rules; notification goes to the FTC, not to individuals.
SaaS relevance
Covers fintech, lenders, tax preparers and similar SaaS; service providers must be contractually required to maintain safeguards.
Extraterritorial
Limited
Breach notification
FTC within 30 days of discovery where unencrypted data of 500+ consumers is acquired without authorisation
DPO
Conditional
Cross-border transfers
None
Maximum penalty
FTC civil penalties for rule violations (via order or rule enforcement)
Key dates
Adopted
In force
Major revision 2021 with most requirements effective 2023-06-09; notification amendment adopted 2023-10-27, effective 2024-05-13.
Medium confidence. Partly verifiedMedium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
CIRCIACyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)Enacted – not yet in force Will require covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA and to report ransomware payments. Detailed scope and content are set by CISA rulemaking.
Synopsis
Will require covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA and to report ransomware payments. Detailed scope and content are set by CISA rulemaking.
Key themes
critical infrastructure
incident reporting
ransomware payments
data preservation
Unique features
Reports go to a security agency, not a privacy regulator; reports are shielded from use in regulatory enforcement in many cases.
SaaS relevance
SaaS providers to critical infrastructure, or IT/cloud providers meeting sector criteria, may become covered entities once the rule is final.
Breach notification
Proposed: CISA within 72 hours of reasonable belief of covered incident; ransom payments within 24 hours
DPO
No
Cross-border transfers
None
Maximum penalty
Subpoena and civil action to compel reporting; contempt
Key dates
Adopted
NPRM published 2024-04-04; statutory final-rule deadline (Oct 2025) missed; CISA targeted May 2026, then September 2026 for the final rule; reporting duties start only once the final rule takes effect.
Medium confidence. Partly verifiedMedium confidence.Could not confirm whether the final rule was published in Sept/Oct 2026; check the Federal Register.
Partly verifiedMedium confidence.Could not confirm whether the final rule was published in Sept/Oct 2026; check the Federal Register.
Data localisation / cross-border2
DOJ Data Security ProgramPreventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons (28 C.F.R. Part 202), implementing Executive Order 14117In force In force from Prohibits or restricts US persons from engaging in data brokerage, vendor, employment and investment transactions that give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions are permitted only with CISA security requirements, due diligence and audits.
Synopsis
Prohibits or restricts US persons from engaging in data brokerage, vendor, employment and investment transactions that give countries of concern or covered persons access to bulk US sensitive personal data or government-related data. Restricted transactions are permitted only with CISA security requirements, due diligence and audits.
Key themes
bulk sensitive data
countries of concern
covered persons
restricted transactions
CISA security requirements
audits
reporting
Unique features
Export-control style regime with criminal penalties applied to personal data; volume thresholds per data type (e.g. 100,000 US persons for covered personal identifiers).
SaaS relevance
US SaaS companies with China-linked vendors, employees, investors or customers must screen access to bulk datasets, and onward data brokerage contracts need prohibited-transfer clauses.
Extraterritorial
Limited
Breach notification
Reporting of rejected prohibited transactions within 14 days; annual reports for certain restricted transactions
DPO
Conditional
Cross-border transfers
Prohibited/restricted transfers to China (incl. HK/Macau), Russia, Iran, North Korea, Cuba, Venezuela
Maximum penalty
IEEPA civil penalties (greater of ~$377,700 or twice the transaction value) and criminal penalties up to $1m and 20 years
Key dates
Adopted
In force
EO 14117 signed 2024-02-28; final rule published 2025-01-08; core prohibitions effective 2025-04-08; due diligence, audit and reporting obligations effective 2025-10-06.
Medium confidence. Partly verifiedMedium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.
Partly verifiedMedium confidence.dpo_required Conditional: restricted-transaction compliance programmes need a designated officer. IEEPA civil penalty figure is inflation-adjusted; verify the current amount.
PADFAProtecting Americans' Data from Foreign Adversaries Act of 2024 (15 U.S.C. § 9901)In force In force from Makes it unlawful for data brokers to sell, license or otherwise make available sensitive data of US individuals to foreign adversary countries (China, Russia, Iran, North Korea) or entities they control. Violations are treated as violations of an FTC rule.
Synopsis
Makes it unlawful for data brokers to sell, license or otherwise make available sensitive data of US individuals to foreign adversary countries (China, Russia, Iran, North Korea) or entities they control. Violations are treated as violations of an FTC rule.
Key themes
data brokers
foreign adversaries
sensitive data
national security
Unique features
Very broad 'sensitive data' list (including precise geolocation, health, biometrics, private communications); no volume threshold.
SaaS relevance
Caught if a SaaS business provides US individuals' sensitive data to others for consideration where the recipient is a foreign adversary or controlled entity; ordinary service providers are carved out.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Prohibition on transfers to foreign adversary countries/controlled entities
Maximum penalty
FTC civil penalties as for rule violations ($53,088 per violation)
Key dates
Adopted
In force
Enacted as Division I of Pub. L. 118-50; effective 60 days after enactment.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Surveillance / law enforcement access5
EO 14086Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence ActivitiesIn force In force from Requires US signals intelligence to be necessary and proportionate to defined legitimate objectives and sets up a two-tier redress mechanism for people in qualifying states. It underpins the EU-US, UK and Swiss data privacy frameworks.
Synopsis
Requires US signals intelligence to be necessary and proportionate to defined legitimate objectives and sets up a two-tier redress mechanism for people in qualifying states. It underpins the EU-US, UK and Swiss data privacy frameworks.
Key themes
signals intelligence
necessity and proportionality
redress
Data Protection Review Court
qualifying states
Unique features
Introduces EU-style proportionality language into US intelligence practice through executive action, which a future President could revoke.
SaaS relevance
Underpins DPF transfers and transfer impact assessments for EU/UK customer data processed by US SaaS.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Basis for EU-US DPF adequacy and UK/Swiss equivalents
Maximum penalty
None (executive order)
Key dates
Adopted
In force
DOJ regulation creating Data Protection Review Court (28 C.F.R. Part 201) Oct 2022; EU adequacy decision for EU-US DPF 2023-07-10; EU General Court dismissed Latombe challenge 2025-09-03; appeal to CJEU lodged Oct 2025 and pending.
Medium confidence. Partly verifiedMedium confidence.PCLOB independence concerns raised in 2025–26 after member removals; Latombe appeal (C-703/25 P per reports) unresolved as of research.
Partly verifiedMedium confidence.PCLOB independence concerns raised in 2025–26 after member removals; Latombe appeal (C-703/25 P per reports) unresolved as of research.
CLOUD ActClarifying Lawful Overseas Use of Data Act (CLOUD Act)In force In force from Confirms that US providers must produce data within their possession, custody or control in response to US legal process regardless of where it is stored. It also authorises executive agreements letting qualifying foreign governments request data directly from US providers.
Synopsis
Confirms that US providers must produce data within their possession, custody or control in response to US legal process regardless of where it is stored. It also authorises executive agreements letting qualifying foreign governments request data directly from US providers.
Key themes
extraterritorial data access
possession custody or control
comity challenges
executive agreements
Unique features
Lets providers move to quash where disclosure would breach a qualifying foreign government's law; a frequent issue in EU transfer impact assessments.
SaaS relevance
Any US-headquartered SaaS (or one with US control over data) can be compelled to produce customer data stored abroad.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Executive agreements with UK, Australia
Maximum penalty
Contempt sanctions for non-compliance with legal process
Key dates
Adopted
In force
US-UK Data Access Agreement in force 2022-10-03; US-Australia agreement in force 2024-01-31.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Wiretap ActElectronic Communications Privacy Act, Title I – Wiretap Act (18 U.S.C. §§ 2510–2523)In force In force from Prohibits intentional interception of wire, oral and electronic communications in transit unless an exception applies, such as one-party consent or provider exceptions. Sets the procedure for court-ordered interception by law enforcement.
Synopsis
Prohibits intentional interception of wire, oral and electronic communications in transit unless an exception applies, such as one-party consent or provider exceptions. Sets the procedure for court-ordered interception by law enforcement.
Key themes
interception
one-party consent
provider exception
court orders
session replay and pixel litigation
Unique features
Federal standard is one-party consent, but many states require all-party consent; used heavily in class actions over session-replay and tracking pixels.
SaaS relevance
Analytics, chat and session-replay SaaS face wiretap claims where they capture website communications without adequate consent.
Extraterritorial
No
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Civil: greater of $100/day or $10,000 per plaintiff plus punitive damages; criminal up to 5 years
Key dates
Adopted
In force
Original Title III enacted 1968; expanded to electronic communications by ECPA 1986.
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
SCAElectronic Communications Privacy Act, Title II – Stored Communications Act (18 U.S.C. §§ 2701–2713)In force In force from Restricts unauthorised access to stored electronic communications and limits voluntary disclosure of content and records by providers of electronic communication and remote computing services. Sets the legal process (subpoena, 2703(d) order, warrant) required for government access.
Synopsis
Restricts unauthorised access to stored electronic communications and limits voluntary disclosure of content and records by providers of electronic communication and remote computing services. Sets the legal process (subpoena, 2703(d) order, warrant) required for government access.
Key themes
stored communications
voluntary disclosure limits
subpoenas
2703(d) orders
warrants
non-disclosure orders
Unique features
Provider-centric: distinguishes electronic communication services from remote computing services, with different rules for content and non-content data.
SaaS relevance
Cloud/SaaS hosts storing customer communications are typically RCS/ECS providers that cannot voluntarily hand over content to government and must respond to compulsory process.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
CLOUD Act executive agreements
Maximum penalty
Civil: actual damages or minimum $1,000 plus punitive damages; criminal penalties
Key dates
Adopted
In force
Amended by the CLOUD Act 2018 (s2713 extraterritorial reach).
Medium confidence. Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Partly verifiedMedium confidence.Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
Historic & pending (1)
FISA 702Foreign Intelligence Surveillance Act, Section 702 (50 U.S.C. § 1881a)Repealed/superseded In force from Authorised targeted collection of foreign intelligence from non-US persons reasonably believed to be abroad, with compelled assistance from US electronic communication service providers. The authority lapsed on 12 June 2026, but directives issued under existing certifications remain effective until they expire.
Synopsis
Authorised targeted collection of foreign intelligence from non-US persons reasonably believed to be abroad, with compelled assistance from US electronic communication service providers. The authority lapsed on 12 June 2026, but directives issued under existing certifications remain effective until they expire.
Key themes
foreign intelligence
electronic communication service providers
directives
US person queries
sunset
Unique features
Central to Schrems II; the 2024 RISAA expansion of the 'ECSP' definition was controversial for reaching data centre and cloud providers.
SaaS relevance
US cloud/SaaS providers may still receive directives under surviving certifications until they expire, which remains relevant to EU transfer impact assessments.
Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
Relevant to EU transfer risk assessments
Maximum penalty
Contempt for refusing directives
Key dates
Adopted
In force
Reauthorised by RISAA 2024-04-20 until April 2026; short-term extensions in April 2026 (incl. Pub. L. 119-87); title VII sunset 2026-06-12; FISC-approved one-year certifications (March 2026) continue under transition clause until about March 2027.
Medium confidence. Partly verifiedMedium confidence.Status as of the June 2026 CRS sidebar. Reauthorisation bills (H.R. 8035, S. 3893) were pending; check whether Congress revived 702 after June 2026.
Partly verifiedMedium confidence.Status as of the June 2026 CRS sidebar. Reauthorisation bills (H.R. 8035, S. 3893) were pending; check whether Congress revived 702 after June 2026.
Human rights / constitutional1
Fourth AmendmentUnited States Constitution, Fourth AmendmentIn force In force from Protects people against unreasonable searches and seizures by government and generally requires a warrant supported by probable cause. Courts apply a 'reasonable expectation of privacy' test, with the third-party doctrine limiting protection for data held by service providers.
Synopsis
Protects people against unreasonable searches and seizures by government and generally requires a warrant supported by probable cause. Courts apply a 'reasonable expectation of privacy' test, with the third-party doctrine limiting protection for data held by service providers.
Key themes
government searches
warrants
reasonable expectation of privacy
third-party doctrine
location data
Unique features
Binds only government actors, not private companies; there is no general constitutional right to data protection at federal level, unlike Article 8 of the EU Charter.
SaaS relevance
Shapes when US law enforcement needs a warrant versus a subpoena to obtain customer data held by a SaaS provider.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Exclusion of evidence; civil claims against officials (Bivens/42 USC 1983)
Key dates
Adopted
In force
Ratified with the Bill of Rights 1791; Carpenter v. United States (2018) extended warrant requirement to historical cell-site location data.
Membership-based — check ratification status in the instrument record. 13 instruments from 5 bodies.
Organisation for Economic Co-operation and Development (OECD)
OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force In force from Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Synopsis
Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
Key themes
trustworthy AI
human rights
privacy
transparency
explainability
robustness
accountability
Unique features
It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.
SaaS relevance
Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force In force from The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Synopsis
The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
Key themes
government access
national security
law enforcement
legal basis
oversight
redress
transparency
Unique features
It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.
SaaS relevance
Useful reference for transfer impact assessments and for policies on responding to government data demands.
Breach notification
None
DPO
No
Cross-border transfers
Supports trusted data flows between adherents
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force In force from Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Synopsis
Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
Key themes
accountability
privacy management programmes
breach notification
enforcement cooperation
interoperability
transborder flows
Unique features
It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.
SaaS relevance
It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.
Breach notification
Recommended: authority and affected individuals for significant breaches
DPO
No
Cross-border transfers
Restrictions should be proportionate to risk
Maximum penalty
None
Key dates
Adopted
In force
OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded In force from A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Synopsis
A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
Key themes
eight fair information principles
accountability
transborder flows
Unique features
These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.
SaaS relevance
Historical baseline; its principles are reflected in most national laws a SaaS provider meets.
Breach notification
None
DPO
No
Cross-border transfers
Free flow encouraged; restrictions only where proportionate
Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force In force from An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Synopsis
An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
Key themes
certification
interoperability
accountability agents
processors
data flows
Unique features
The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.
SaaS relevance
A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
Medium confidence. Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Partly verifiedMedium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
Asia-Pacific Economic Cooperation (APEC)
APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force In force from Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Synopsis
Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
Key themes
certification
accountability agents
cross-border enforcement
processors
Unique features
It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).
SaaS relevance
PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Certification-based transfer mechanism
Maximum penalty
Decertification; enforcement under local law
Key dates
Adopted
In force
CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
Medium confidence. Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
Partly verifiedMedium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
APEC Privacy FrameworkAPEC Privacy FrameworkIn force In force from A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Synopsis
A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
Key themes
preventing harm
notice
choice
accountability
cross-border privacy enforcement
interoperability
Unique features
Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.
SaaS relevance
It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.
Breach notification
None
DPO
No
Cross-border transfers
Accountability-based; CBPR system
Maximum penalty
None
Key dates
Adopted
In force
Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
Partly verifiedMedium confidence.I did not re-check the publication URL this session.
United Nations
UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Synopsis
The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
Key themes
cybercrime offences
e-evidence
production orders
data preservation
mutual legal assistance
human rights safeguards
Unique features
It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.
SaaS relevance
Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.
Extraterritorial
Limited
Breach notification
None
DPO
No
Cross-border transfers
Cooperation channels for electronic evidence
Maximum penalty
Set by national law
Key dates
Adopted
Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
Medium confidence. Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Partly verifiedMedium confidence.The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force In force from This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Synopsis
This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
Key themes
surveillance
interception
AI and privacy
encryption
business responsibility
remedies
Unique features
The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.
SaaS relevance
These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
Medium confidence. Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
Partly verifiedMedium confidence.Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force In force from This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Synopsis
This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
Key themes
right to privacy
state obligations
legality
arbitrariness
individual communications
Unique features
It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.
SaaS relevance
It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None (treaty-body views; no fines)
Key dates
Adopted
In force
Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
UDHR Art 12Universal Declaration of Human Rights, Article 12In force In force from Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Synopsis
Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
Key themes
right to privacy
correspondence
reputation
protection of the law
Unique features
Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.
SaaS relevance
Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
None
Key dates
Adopted
In force
Proclaimed by the UN General Assembly in Paris on 10 December 1948
UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force In force from Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Synopsis
Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
Key themes
fair information principles
sensitive data
access
security
supervisory authority
transborder flows
Unique features
Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.
SaaS relevance
Gives no direct obligations; it is historical background to UN-system data protection policies.
Medium confidence. Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Partly verifiedMedium confidence.I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.
Organization of American States (OAS)
OAS Updated PrinciplesInter-American Juridical Committee Updated Principles on Privacy and Personal Data ProtectionIn force In force from Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
Synopsis
Thirteen non-binding principles to guide OAS member states in adopting or updating data protection laws. They cover legitimate purpose and fairness, transparency and consent, relevance, limited retention, confidentiality, security, accuracy, access and correction, sensitive data, accountability, cross-border flows and independent authorities.
Key themes
principles
consent
sensitive data
accountability
cross-border flows
independent authority
Unique features
The update accounts for the GDPR and Convention 108+ while staying compatible with Inter-American human rights law and the habeas data tradition.
SaaS relevance
Background for Latin American national law; no direct obligations.
Breach notification
Recommended (security principle)
DPO
No
Cross-border transfers
Transfers to jurisdictions with comparable protection or with safeguards
Maximum penalty
None
Key dates
Adopted
In force
Replaces the CJI 2015 Principles (from the 2012 proposal); approved by the Inter-American Juridical Committee in April 2021 (98th regular session); the General Assembly took note in 2021
Low confidence. Partly verifiedLow confidence.The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.
Partly verifiedLow confidence.The April 2021 CJI approval is confirmed indirectly (a SIC Colombia article from 2021 says 'approved last April'). The resolution number, the GA action and the publication URL were not verified.