Vietnam VN

The DMF is a voluntary guide for businesses on data governance across the data lifecycle. The MCCs are voluntary template contract terms for controller-to-controller and controller-to-processor transfers between ASEAN member states, setting baseline protections.

• model contractual clauses
• cross-border flows
• data governance
• processor terms

They are designed as a regional baseline. A joint EU–ASEAN guide maps the MCCs against the EU SCCs.

• Adopted 22 January 2021
• In force 22 January 2021
• Framework on Digital Data Governance 2018; DMF and MCCs endorsed by the 1st ASEAN Digital Ministers' Meeting on 2021-01-22; joint EU–ASEAN guide on MCCs/SCCs in 2023

• Authoritative text asean.org

• pdpc.gov.sg
• asean.org

High confidence.

The 2018 DDG Framework date and the 2023 EU–ASEAN guide come from memory.

A statement of intent by ASEAN members to cooperate on personal data protection. It sets out principles: consent, notification and purpose; accuracy; security; access and correction; transfers to other countries; retention; and accountability. It creates no legal obligations.

• principles
• consent
• transfers
• accountability
• regional cooperation

Expressly non-binding and leaves room for domestic law; it is the basis of ASEAN cross-border data instruments.

• Adopted 25 November 2016
• In force 25 November 2016
• Adopted at the 16th ASEAN Telecommunications and IT Ministers Meeting (TELMIN), November 2016

• Authoritative text asean.org

• pdpc.gov.sg

Medium confidence.

Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

• certification
• accountability agents
• cross-border enforcement
• processors

It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

• Adopted 2011
• In force 2012
• CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).

• Authoritative text cbprs.org

• cbprs.org
• globalcbpr.org

Medium confidence.

A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

• preventing harm
• notice
• choice
• accountability
• cross-border privacy enforcement
• interoperability

Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

• Adopted 2005
• In force 2005
• Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)

• Authoritative text apec.org

• apec.org

Medium confidence.

The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

• cybercrime offences
• e-evidence
• production orders
• data preservation
• mutual legal assistance
• human rights safeguards

It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

• Adopted 24 December 2024
• Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.

• Authoritative text unodc.org

• en.wikipedia.org
• unodc.org

Medium confidence.

This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

• surveillance
• interception
• AI and privacy
• encryption
• business responsibility
• remedies

The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

• Adopted 18 December 2013
• In force 18 December 2013
• First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17

• Authoritative text documents.un.org

• documents.un.org
• digitallibrary.un.org

Medium confidence.

This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

• right to privacy
• state obligations
• legality
• arbitrariness
• individual communications

It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

• Adopted 16 December 1966
• In force 23 March 1976
• Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.

• Authoritative text ohchr.org

• ohchr.org
• ohchr.org

High confidence.

The party count is approximate and was not re-checked against the UN Treaty Collection.

Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

• right to privacy
• correspondence
• reputation
• protection of the law

Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

• Adopted 10 December 1948
• In force 10 December 1948
• Proclaimed by the UN General Assembly in Paris on 10 December 1948

• Authoritative text un.org

• un.org
• ohchr.org

High confidence.

The CIPP/E project holds a copy (1948UDHR.pdf).

Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

• fair information principles
• sensitive data
• access
• security
• supervisory authority
• transborder flows

Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

• Adopted 14 December 1990
• In force 14 December 1990

• Authoritative text refworld.org

• refworld.org
• digitallibrary.un.org

Medium confidence.