Privacy worldwide

100 countries, sorted by the privacy their laws provide.

Grouped into seven tiers, from constitutional limits on the state down to pervasive surveillance. Not a ranking — a tier is a range, and the order within one carries no meaning. Two tables, two directions — protection from the state, and protection from companies — and a country can rank high on one while low on the other.

How to read this. Every country sits in one of seven tiers by how much privacy its law provides in practice — not by how much surveillance it runs. The table has two kinds of rows. Documented rows trace cell‑by‑cell to a primary instrument — a constitution, a statute, a court ruling, an adequacy decision — and those cells carry a source number. The rest are estimates, placed from a cross‑country internet‑freedom index with no per‑country privacy document behind them; they are shown in grey, without a number, on purpose. Scores were dropped deliberately: tiers are far more defensible than any exact rank. Policies change — verify current details before relying on this. General information, not legal advice.

Checked July 11, 2026

How the tiers work

Seven tiers, strongest to weakest

The tiers describe the level of privacy protection a person effectively has, end to end. The meter shows the tier at a glance — more filled bars mean more protection. The columns carry the mechanism — whether the protection is constitutional or merely statutory, whether retention is mandatory, whether encryption can be compelled.

Comprehensive protections. A data-protection statute plus a constitutional court that has actually struck surveillance powers down — protection that survives a change of government.
Strong protections. Clear statutory rights and an active regulator; any bulk-collection or retention power is limited, contested, or under judicial pressure.
Substantial protections. Solid data-protection law and enforcement, but with a standing retention mandate or an intelligence power that isn’t fully checked.
Moderate protections. Real law on the books, weaker enforcement, and state-access powers that cut against it.
Limited protections. Sweeping retention or bulk powers, or a compelled-assistance regime, outweigh the statutory protections that exist.
Weak protections. Broad state access and thin oversight; the law itself does little to constrain surveillance.
Minimal protections. Pervasive state surveillance, localization or interception mandates, and little or no independent oversight.

The tags under a country

Five, Nine, and Fourteen Eyes

A handful of countries carry a small slate tag — Fourteen Eyes — beneath their name. These name an intelligence-sharing arrangement that grew out of a postwar signals-intelligence pact, in which the member states share the communications their agencies intercept. It is one club in three rings, not three separate ones: each wider ring contains the one inside it.

5Five Eyes
The original core — the United States, the United Kingdom, Canada, Australia, and New Zealand.
9Nine Eyes
The Five, plus Denmark, France, the Netherlands, and Norway.
14Fourteen Eyes
The Nine, plus Germany, Belgium, Italy, Spain, and Sweden.

So the rings nest. Whatever the innermost Five share reaches the Nine and the Fourteen as well — the wider the ring, the more governments see the same intercept. A country’s tag marks the ring it enters at: the smallest circle that already includes it, which is why a partner such as France reads Nine Eyes rather than Five.

That is why the tag belongs on a privacy page. A member can receive what its partners collect, so communications a country’s own courts might forbid it to gather can still reach its agencies through an ally — which is what caps how high an otherwise-strong democracy can sit in the tables below. The fuller version of that argument is at the foot of the page.

Membership is documented through declassified records of the UKUSA arrangement and reporting on leaked intelligence files, rather than any single public statute; it is shown here as background, not as a rated cell. Checked July 11, 2026.

The first table

100 countries, rated against the state

Filter by tier, or sort A–Z. Each marker reads on a single scale — the more filled the shape, the more protection — and works in greyscale. Grey markers are estimates; coloured markers with a number are documented.

Protection from the state100 countries · sort by tier or A–Z

Tier Sort

Country	Protection from the state	Legal basis	Data retention	Message scanning	Encryption	Biometric	Enforcement	EU adequacy	Trend	Basis
ESTEstoniaEurope	Comprehensive protections. Comprehensive	Constitutional¹	Targeted²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Mixed: primary sources and the index. P·I
ISLIcelandEurope	Comprehensive protections. Comprehensive	GDPR (EEA)¹	None	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EEA	→Freest (FOTN)¹²	Estimated from the internet-freedom index. I
DEUGermanyEurope Fourteen Eyes	Comprehensive protections. Comprehensive	Constitutional^1,4,5	None in force^2,4	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Courts active^4,5	Primary-source-driven. P
AUTAustriaEurope	Comprehensive protections. Comprehensive	GDPR · DSG¹	Court-struck²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Primary-source-driven. P
PRTPortugalEurope	Comprehensive protections. Comprehensive	Constitutional¹	Court-struck ’22²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	↑Post-strike	Primary-source-driven. P
SVNSloveniaEurope	Comprehensive protections. Comprehensive	GDPR · ZVOP-2¹	Court-struck²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Estimated from the internet-freedom index. I
FINFinlandEurope	Comprehensive protections. Comprehensive	Constitutional¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Mixed: primary sources and the index. P·I
IRLIrelandEurope	Comprehensive protections. Comprehensive	GDPR¹	Targeted (post-DRI)²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Weak enforcement	EU	→Stable	Primary-source-driven. P
CRICosta RicaAmericas	Comprehensive protections. Comprehensive	Constitutional	Targeted	No scanning regime	No compulsion	Restricted	Agency	—	→Stable	Estimated from the internet-freedom index. I
CHLChileAmericas	Comprehensive protections. Comprehensive	Constitutional	Targeted	No scanning regime	No compulsion	Restricted	New agency	—	↑New GDPR-style law	Mixed: primary sources and the index. P·I
JPNJapanAsia–Pacific	Comprehensive protections. Comprehensive	APPI¹⁴	Targeted	No scanning regime	No compulsion	Restricted	PPC¹⁴	Adequacy³	→Stable	Mixed: primary sources and the index. P·I
URYUruguayAmericas	Comprehensive protections. Comprehensive	Ley 18.331	Targeted	No scanning regime	No compulsion	Restricted	URCDP	Adequacy³	→Stable	Estimated from the internet-freedom index. I
LUXLuxembourgEurope	Comprehensive protections. Comprehensive	GDPR¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	CNPD¹	EU	→Stable	Estimated from the internet-freedom index. I
CHESwitzerlandEurope	Comprehensive protections. Comprehensive	Const · FADP⁶	Mandatory ~6mo⁶	No scanning regime	Decryption (proposed)⁶	Not located	FDPIC⁶	Adequacy³	↓OSCPT revision; Proton exit⁶	Primary-source-driven. P
CZECzechiaEurope	Strong protections. Strong	GDPR¹	Court-struck²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Primary-source-driven. P
NLDNetherlandsEurope Nine Eyes	Strong protections. Strong	GDPR · UAVG¹	Struck ’15²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→9 Eyes	Primary-source-driven. P
NORNorwayEurope Nine Eyes	Strong protections. Strong	GDPR (EEA)¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EEA	→9 Eyes	Mixed: primary sources and the index. P·I
TWNTaiwanAsia–Pacific	Strong protections. Strong	PDPA	Targeted	No scanning regime	No compulsion	Restricted	New PDPC	—	↑New DPA (2025)	Mixed: primary sources and the index. P·I
BELBelgiumEurope Fourteen Eyes	Strong protections. Strong	GDPR¹	Re-legislated	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→14 Eyes	Primary-source-driven. P
ESPSpainEurope Fourteen Eyes	Strong protections. Strong	LOPDGDD¹	Mandatory (contested)	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	AEPD · active¹	EU	→14 Eyes	Primary-source-driven. P
DNKDenmarkEurope Nine Eyes	Strong protections. Strong	GDPR¹	Session logging	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	↓Retention revival	Mixed: primary sources and the index. P·I
NZLNew ZealandAsia–Pacific Five Eyes	Strong protections. Strong	Privacy Act 2020	Targeted	No scanning regime	Assistance regime	Restricted	Commissioner	—	→5 Eyes	Mixed: primary sources and the index. P·I
FRAFranceEurope Nine Eyes	Strong protections. Strong	GDPR¹	Mandatory (nat-sec)	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	CNIL · active¹	EU	↓LQDN II reopened retention²	Primary-source-driven. P
LTULithuaniaEurope	Strong protections. Strong	GDPR¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	VDAI¹	EU	→Stable	Estimated from the internet-freedom index. I
LVALatviaEurope	Strong protections. Strong	GDPR¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	DVI¹	EU	→Stable	Estimated from the internet-freedom index. I
ARGArgentinaAmericas	Strong protections. Strong	Ley 25.326	Targeted	No scanning regime	No compulsion	Restricted	AAIP	Adequacy³	→Stable	Mixed: primary sources and the index. P·I
ITAItalyEurope Fourteen Eyes	Strong protections. Strong	GDPR¹	Up to 72mo	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Garante · active¹	EU	→14 Eyes	Primary-source-driven. P
SWESwedenEurope Fourteen Eyes	Strong protections. Strong	GDPR¹	Mandatory · FRA	Voluntary (CC 1.0)^19,20	Backdoor push ’25	Restricted (GDPR)¹	Independent¹	EU	↓FRA + encryption bill	Primary-source-driven. P
POLPolandEurope	Substantial protections. Substantial	GDPR¹	Mandatory 12mo	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Broad police access	EU	↓Weak oversight	Mixed: primary sources and the index. P·I
CANCanadaAmericas Five Eyes	Substantial protections. Substantial	PIPEDA	Targeted	No scanning regime	Lawful-access bills	Restricted	OPC	Adequacy³	↓Lawful-access bills	Mixed: primary sources and the index. P·I
GRCGreeceEurope	Substantial protections. Substantial	GDPR¹	Mandatory	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Predator scandal	EU	↓Predator affair	Mixed: primary sources and the index. P·I
HRVCroatiaEurope	Substantial protections. Substantial	GDPR¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	AZOP¹	EU	→Stable	Estimated from the internet-freedom index. I
CYPCyprusEurope	Substantial protections. Substantial	GDPR¹	Contested	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Commissioner¹	EU	→Stable	Estimated from the internet-freedom index. I
SVKSlovakiaEurope	Substantial protections. Substantial	GDPR¹	Court-struck²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Estimated from the internet-freedom index. I
BRABrazilAmericas	Substantial protections. Substantial	LGPD¹³	Marco Civil	No scanning regime	No compulsion	LGPD-restricted	ANPD¹³	Adequacy ’26^13,3	↑EU adequacy (2026)¹³	Mixed: primary sources and the index. P·I
MLTMaltaEurope	Substantial protections. Substantial	GDPR¹	Targeted	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	IDPC¹	EU	→Stable	Estimated from the internet-freedom index. I
ROURomaniaEurope	Substantial protections. Substantial	GDPR¹	Repeatedly struck²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Mixed: primary sources and the index. P·I
BGRBulgariaEurope	Substantial protections. Substantial	GDPR¹	Struck ’15²	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Independent¹	EU	→Stable	Estimated from the internet-freedom index. I
ZAFSouth AfricaAfrica	Substantial protections. Substantial	POPIA · Const §14¹⁸	RICA (amaBhungane)¹⁸	No scanning regime	No compulsion	POPIA-restricted	Regulator	—	↑Post-amaBhungane	Primary-source-driven. P
KORSouth KoreaAsia–Pacific	Substantial protections. Substantial	PIPA¹⁵	Mandatory	No scanning regime	Assistance regime	Restricted	PIPC · active¹⁵	Adequacy³	→Content controls	Mixed: primary sources and the index. P·I
HUNHungaryEurope	Substantial protections. Substantial	GDPR¹	Mandatory	Voluntary (CC 1.0)^19,20	No compulsion	Restricted (GDPR)¹	Pegasus operator	EU	↓Illiberal drift	Mixed: primary sources and the index. P·I
GHAGhanaAfrica	Substantial protections. Substantial	DPA 2012	Targeted	No scanning regime	No compulsion	Not located	Commission	—	→Stable	Estimated from the internet-freedom index. I
COLColombiaAmericas	Moderate protections. Moderate	Ley 1581	Targeted	No scanning regime	No compulsion	Not located	SIC	—	→Stable	Estimated from the internet-freedom index. I
MEXMexicoAmericas	Moderate protections. Moderate	LFPDPPP	Mandatory	No scanning regime	No compulsion	Not located	INAI abolished ’25	—	↓INAI dissolution	Mixed: primary sources and the index. P·I
ECUEcuadorAmericas	Moderate protections. Moderate	LOPDP 2021	Targeted	No scanning regime	No compulsion	Not located	Authority	—	↑New law	Estimated from the internet-freedom index. I
ARMArmeniaEurasia	Moderate protections. Moderate	Law 2015	Targeted	No scanning regime	No compulsion	Not located	Agency	—	→Stable	Estimated from the internet-freedom index. I
SRBSerbiaEurope	Moderate protections. Moderate	ZZPL	Mandatory	No scanning regime	No compulsion	Safe City CCTV	Commissioner	—	↓Smart-city CCTV	Estimated from the internet-freedom index. I
MDAMoldovaEurope	Moderate protections. Moderate	Law 133	Targeted	No scanning regime	No compulsion	Not located	Centre	—	↑EU-alignment	Estimated from the internet-freedom index. I
UKRUkraineEurope	Moderate protections. Moderate	PDP law (wartime)	Wartime powers	No scanning regime	No compulsion	Not located	Ombudsman	—	→Wartime	Estimated from the internet-freedom index. I
MNGMongoliaAsia–Pacific	Moderate protections. Moderate	Law 2021	Targeted	No scanning regime	No compulsion	Not located	Authority	—	→Stable	Estimated from the internet-freedom index. I
USAUnited StatesAmericas Five Eyes	Moderate protections. Moderate	No federal statute⁹	Provider-retained	Voluntary (providers)²¹	No general mandate	State patchwork	No federal DPA	DPF³	↓§702 / RISAA; broker buys⁹	Primary-source-driven. P
GEOGeorgiaEurasia	Moderate protections. Moderate	PDP law	Mandatory	No scanning regime	No compulsion	Not located	Foreign-agent law	—	↓↓Foreign-influence law	Mixed: primary sources and the index. P·I
ISRIsraelMiddle East	Moderate protections. Moderate	PPL	Mandatory	No scanning regime	Assistance regime	Deployed	PPA	—	↓Surveillance exports	Mixed: primary sources and the index. P·I
MYSMalaysiaAsia–Pacific	Moderate protections. Moderate	PDPA (2024 amd)	Mandatory	No scanning regime	Assistance regime	Emerging	Commissioner	—	→Content controls	Estimated from the internet-freedom index. I
PHLPhilippinesAsia–Pacific	Moderate protections. Moderate	DPA 2012	Targeted	No scanning regime	No compulsion	Emerging	NPC	—	↓SIM registration	Estimated from the internet-freedom index. I
NAMNamibiaAfrica	Moderate protections. Moderate	Bill pending	Targeted	No scanning regime	No compulsion	Not located	None yet	—	→Stable	Estimated from the internet-freedom index. I
BWABotswanaAfrica	Limited protections. Limited	DPA 2018	Targeted	No scanning regime	No compulsion	Not located	Commission	—	→Stable	Estimated from the internet-freedom index. I
GBRUnited KingdomEurope Five Eyes	Limited protections. Limited	DUAA 2025	12mo ICRs⁷	Scanning power (OSA)²²	TCN power⁷	Live FR	ICO	Adequacy³	↓↓IPA · OSA · Apple order^7,8,12	Primary-source-driven. P
AUSAustraliaAsia–Pacific Five Eyes	Limited protections. Limited	Privacy Act 1988	Mandatory 24mo¹⁰	No scanning regime	Decryption (TOLA)¹⁰	Emerging	OAIC	—	↓TOLA, retention¹⁰	Mixed: primary sources and the index. P·I
TUNTunisiaAfrica	Limited protections. Limited	Law 2004-63	Targeted	No scanning regime	No compulsion	Not located	INPDP	—	→Stable	Estimated from the internet-freedom index. I
SENSenegalAfrica	Limited protections. Limited	Law 2008-12	Targeted	No scanning regime	No compulsion	Not located	CDP	—	→Stable	Estimated from the internet-freedom index. I
KENKenyaAfrica	Limited protections. Limited	DPA 2019	Targeted	No scanning regime	No compulsion	Emerging	ODPC	—	↓Protest shutdown ’24	Estimated from the internet-freedom index. I
NGANigeriaAfrica	Limited protections. Limited	DPA 2023	Targeted	No scanning regime	No compulsion	Emerging	NDPC	—	↑New law	Estimated from the internet-freedom index. I
ZMBZambiaAfrica	Limited protections. Limited	DPA 2021	Targeted	No scanning regime	No compulsion	Not located	Authority	—	→Stable	Estimated from the internet-freedom index. I
IDNIndonesiaAsia–Pacific	Limited protections. Limited	PDP 2022	Localization	No scanning regime	Assistance regime	Emerging	Authority	—	↓Localization	Estimated from the internet-freedom index. I
LKASri LankaAsia–Pacific	Limited protections. Limited	PDPA 2022	Targeted	No scanning regime	No compulsion	Not located	Authority	—	↑New law	Estimated from the internet-freedom index. I
JORJordanMiddle East	Limited protections. Limited	PDP 2023	Mandatory	No scanning regime	Assistance regime	Not located	Authority	—	↑New law	Estimated from the internet-freedom index. I
LBNLebanonMiddle East	Limited protections. Limited	Law 81/2018	Targeted	No scanning regime	No compulsion	Not located	Weak	—	→Stable	Estimated from the internet-freedom index. I
INDIndiaAsia–Pacific	Limited protections. Limited	Puttaswamy · DPDP¹⁶	Localization (emerging)	No scanning regime	Decryption (IT §69)	Aadhaar¹⁶	Non-independent board¹⁶	—	↓DPDP state exemptions	Primary-source-driven. P
MARMoroccoAfrica	Limited protections. Limited	Law 09-08	Mandatory	No scanning regime	Assistance regime	Not located	CNDP	—	↓Pegasus	Estimated from the internet-freedom index. I
SGPSingaporeAsia–Pacific	Weak protections. Weak	PDPA 2012	Mandatory	Broad state access	Assistance regime	National biometric	PDPC	—	→High state access	Mixed: primary sources and the index. P·I
NPLNepalAsia–Pacific	Weak protections. Weak	Privacy Act 2018	Targeted	Broad state access	No compulsion	Not located	Not located	—	→Stable	Estimated from the internet-freedom index. I
PERPeruAmericas	Weak protections. Weak	Ley 29733	Mandatory	Broad state access	No compulsion	Not located	ANPD	—	→Stable	Estimated from the internet-freedom index. I
KWTKuwaitMiddle East	Weak protections. Weak	CITRA regs	Mandatory	Broad state access	Assistance regime	Emerging	CITRA	—	→Broad access	Estimated from the internet-freedom index. I
QATQatarMiddle East	Weak protections. Weak	Law 13/2016	Mandatory	Broad state access	Assistance regime	Biometric CCTV	Authority	—	→Pervasive monitoring	Estimated from the internet-freedom index. I
OMNOmanMiddle East	Weak protections. Weak	PDPL 2022	Mandatory	Broad state access	Assistance regime	Emerging	Authority	—	→Broad exemptions	Estimated from the internet-freedom index. I
KAZKazakhstanEurasia	Weak protections. Weak	Law 2013	SORM model	Broad state access	HTTPS-interception	TargetEYE FR	Authority	—	↓Buildout (incomplete)	Mixed: primary sources and the index. P·I
UGAUgandaAfrica	Weak protections. Weak	DPA 2019	Mandatory	Broad state access	Assistance regime	Huawei CCTV	Authority	—	↓Pegasus / CCTV	Estimated from the internet-freedom index. I
ZWEZimbabweAfrica	Weak protections. Weak	DPA 2021	Mandatory	Broad state access	Assistance regime	FR pilot	Authority	—	→Stable	Estimated from the internet-freedom index. I
THAThailandAsia–Pacific	Weak protections. Weak	PDPA 2019	Mandatory	Broad state access	Assistance regime	Deployed	Committee	—	↓Content control	Estimated from the internet-freedom index. I
KHMCambodiaAsia–Pacific	Weak protections. Weak	Sub-decree (NIG)	NIG gateway	Broad state access	Assistance regime	Deployed	None	—	↓NIG buildout	Estimated from the internet-freedom index. I
AZEAzerbaijanEurasia	Weak protections. Weak	Pervasive monitoring	Mandatory	Broad state access	Assistance regime	Not located	None	—	↓Pegasus	Estimated from the internet-freedom index. I
BHRBahrainMiddle East	Weak protections. Weak	PDPL 2018	Mandatory	Broad state access	Assistance regime	Biometric CCTV	Authority	—	↓Spyware	Estimated from the internet-freedom index. I
IRQIraqMiddle East	Weak protections. Weak	No comprehensive law	Mandatory	Broad state access	Assistance regime	Not located	None	—	→Shutdowns	Estimated from the internet-freedom index. I
PAKPakistanAsia–Pacific	Minimal protections. Minimal	PECA 2016	Web Monitoring System	Broad state access	De facto compelled	Deployed	None	—	↓↓Firewall buildout	Estimated from the internet-freedom index. I
TURTurkeyEurasia	Minimal protections. Minimal	KVKK	Mandatory	Broad state access	Assistance regime	Deployed	KVKK board	—	↓Content control	Mixed: primary sources and the index. P·I
EGYEgyptAfrica	Minimal protections. Minimal	DP Law 2020	Mandatory	Broad state access	Assistance regime	Deployed	Regs pending	—	↓Mass surveillance	Estimated from the internet-freedom index. I
VENVenezuelaAmericas	Minimal protections. Minimal	No independent DPA	Mandatory	Broad state access	Assistance regime	Deployed	None	—	↓↓CANTV monitoring	Estimated from the internet-freedom index. I
AREUAEMiddle East	Minimal protections. Minimal	PDPL 2021 (regs unissued)	Mandatory	Broad state access	De facto compelled	Biometric CCTV	Authority	—	↓Spyware, biometrics	Mixed: primary sources and the index. P·I
SAUSaudi ArabiaMiddle East	Minimal protections. Minimal	PDPL (state-exempt)	Localization	Broad state access	De facto compelled	Biometric CCTV	SDAIA	—	↓State-exempt enforcement	Mixed: primary sources and the index. P·I
UZBUzbekistanEurasia	Minimal protections. Minimal	Law 2019 (localization)	SORM model	Broad state access	De facto compelled	State biometric	Authority	—	↓Buildout (incomplete)	Mixed: primary sources and the index. P·I
VNMVietnamAsia–Pacific	Minimal protections. Minimal	PDPD 2023	Localization	Broad state access	De facto compelled	Deployed	Authority	—	↓Localization, control	Mixed: primary sources and the index. P·I
CUBCubaAmericas	Minimal protections. Minimal	Decree 370	Mandatory	Broad state access	De facto compelled	Not located	State ISP monopoly	—	↓ETECSA monopoly	Estimated from the internet-freedom index. I
BLRBelarusEurope	Minimal protections. Minimal	Nominal	SORM · DPI	Broad state access	De facto compelled	Deployed	None	—	↓↓Near-total in crises	Mixed: primary sources and the index. P·I
RUSRussiaEurasia	Minimal protections. Minimal	Nominal	SORM-3 · Yarovaya¹¹	State interception¹¹	Key disclosure¹¹	FR network	No independent DPA	—	↓↓Sovereign-internet buildout (incomplete)¹¹	Primary-source-driven. P
MMRMyanmarAsia–Pacific	Minimal protections. Minimal	Junta rule	Mandatory	Broad state access	De facto compelled	Junta biometric	None	—	↓↓Junta control (not sealed)¹²	Estimated from the internet-freedom index. I
IRNIranMiddle East	Minimal protections. Minimal	Nominal	Mandatory	Broad state access	De facto compelled	Deployed	None	—	↓↓NIN advanced; full shutdowns¹²	Mixed: primary sources and the index. P·I
TKMTurkmenistanEurasia	Minimal protections. Minimal	Nominal (2017)	Total	Broad state access	De facto compelled	State control	None	—	↓Near-total control¹²	Estimated from the internet-freedom index. I
CHNChinaAsia–Pacific	Minimal protections. Minimal	PIPL (firms)¹⁷	Real-name · comprehensive¹²	State interception¹²	Backdoor / compelled¹²	Skynet · FR¹²	PIPL on firms	—	→Great Firewall operational¹²	Primary-source-driven. P
PRKNorth KoreaAsia–Pacific	Minimal protections. Minimal	No open internet	Total	Broad state access	Intranet only	Total control	None	—	→Kwangmyong only¹²	Estimated from the internet-freedom index. I

No countries in that tier.

Filled. Strong safeguard — a constitutional right, no or targeted retention, no compelled decryption. Half. Present but qualified — contested, weakly enforced, or an assistance regime. Open ring. Absent, mandatory, or compelled — the low-protection end. Dashed. Not located — we couldn’t find it, which isn’t proof it doesn’t exist. Grey (any shape). Estimated from the index, with no per-country document — shown without a source number.

Reading the columns. Legal basis is whether privacy rests on an enforceable constitutional right, ordinary statute, or little at all. Data retention asks whether communications metadata must be kept — less is more protective. Message scanning is whether the law lets or makes providers inspect the content of private messages without individualized suspicion — a filled marker means no such regime, a half marker means voluntary scanning of non-encrypted surfaces, an open ring means a scanning mandate, client-side scanning, or broad state interception; it is distinct from encryption, which follows. Encryption is whether providers can be compelled to weaken or break it. Biometric is the reach of state facial-recognition and biometric-ID systems — a filled marker means little or none, an open ring means pervasive deployment. How those systems — automated plate readers, face recognition, always-on sensors — actually work is on our cameras & sensors page. Enforcement is whether an independent regulator actually acts. EU adequacy is here because it is the one external, independent verdict on a country’s data-protection regime: the European Commission formally judging it essentially equivalent to the GDPR. It is Euro-centric and many countries never sought it, so a dash is not a demerit — only the positive mark carries weight. Five / Nine / Fourteen Eyes intelligence-sharing appears as a tag under the country name, because it caps how high an otherwise-strong democracy can sit. Basis tags each row: P primary-source-driven, P·I mixed, I estimated from the index. A cell shows a number only where the primary instrument could be linked directly; some documented rows are summarised without a per-cell link.Checked July 11, 2026 — verify current details before relying on this. General information, not legal advice.

The other direction

The same countries, rated against companies

The table above asks how well a country’s law restrains the state. This one asks the opposite: how well it restrains companies — whether you can see what a business holds on you, delete it, refuse the sale of it, and whether a regulator will make that stick. They are different questions, and a country can sit at opposite ends of each.

China is the clearest case. It is in the bottom tier against the state — and near the top against companies, because its Personal Information Protection Law is one of the strictest corporate-data regimes anywhere: separate opt-in consent, deletion and portability rights, hard limits on facial recognition, and fines up to 5% of turnover. The pattern repeats — several authoritarian states bind companies tightly while exempting themselves, and the Five / Nine / Fourteen Eyes democracies, capped in the first table by their intelligence powers, are not capped here, so their commercial-privacy strength shows through. The European Union sits at the top of both.

Same discipline as the first table: documented rows trace to the statute or regulator behind them and carry a source number; estimated rows rest on the DLA Piper cross-country tracker — the commercial-privacy analog to the internet-freedom index used above — and are shown in grey without a number. This is a first tranche: the strongest regimes and the marquee reversals are placed; the weaker-protection countries follow in the next pass. General information, not legal advice.

One company-side practice these columns don’t yet capture: surveillance pricing — being charged a different price based on what a company knows about you. There is little law on it anywhere; the nearest hook is the GDPR’s limit on decisions “based solely on automated processing,” including profiling. We take it apart on the financial privacy page.

Comprehensive protections. An omnibus data-protection law binding the private sector, opt-in consent, the full set of individual rights — access, deletion, portability — and an independent regulator that levies real, turnover-scaled fines.
Strong protections. A comprehensive law and an active regulator with most rights intact; penalties are real but lower, the regulator isn’t fully independent, or one axis such as consent or ad-targeting is weaker.
Substantial protections. Solid law and rights on paper, but enforcement is uneven or under-resourced, or a strengthening reform has stalled.
Moderate protections. A law exists — often newer, sectoral, or opt-out — with only partial rights or a young, underpowered regulator.
Limited protections. Coverage is narrow or not yet in force, consent rules are weak, and there is little enforcement against companies.
Weak protections. Minimal statutory obligations on companies; any regulator is nominal.
Minimal protections. No meaningful private-sector data-protection law, or none that is enforced.

Protection from companies100 countries · sort by tier or A–Z

Tier Sort

Country	Protection from companies	Comprehensive law	Consent model	Access & deletion	Sale & targeted ads	Sensitive & children	Breach notice	Enforcement & penalty	EU adequacy	Trend	Basis
ESTEstoniaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
DEUGermanyEurope Fourteen Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
AUTAustriaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
PRTPortugalEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
SVNSloveniaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
FINFinlandEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
IRLIrelandEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPC · backlog	EU	→Stable	Primary-source-driven. P
LUXLuxembourgEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
NLDNetherlandsEurope Nine Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
BELBelgiumEurope Fourteen Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
ESPSpainEurope Fourteen Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
DNKDenmarkEurope Nine Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
FRAFranceEurope Nine Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
LTULithuaniaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
LVALatviaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
ITAItalyEurope Fourteen Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
SWESwedenEurope Fourteen Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
CZECzechiaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
POLPolandEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
GRCGreeceEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
HRVCroatiaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
CYPCyprusEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
SVKSlovakiaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
MLTMaltaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
ROURomaniaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
BGRBulgariaEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
HUNHungaryEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EU	→Stable	Primary-source-driven. P
ISLIcelandEurope	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EEA	→Stable	Primary-source-driven. P
NORNorwayEurope Nine Eyes	Comprehensive protection. Comprehensive	Omnibus (GDPR)¹	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat · Art. 8	72h to DPA	DPA · up to 4% turnover¹	EEA	→Stable	Primary-source-driven. P
CHESwitzerlandEurope	Comprehensive protection. Comprehensive	FADP 2023¹¹	Opt-in	Access · erase · port	Consent required	Special-cat	Mandatory	FDPIC¹¹	Adequacy²	→Stable	Primary-source-driven. P
KORSouth KoreaAsia–Pacific	Comprehensive protection. Comprehensive	PIPA⁷	Opt-in (strict)	Access · erase · port	Consent required	Strict	Mandatory	PIPC · large fines⁷	Adequacy²	→Active enforcer	Primary-source-driven. P
BRABrazilAmericas	Comprehensive protection. Comprehensive	LGPD⁵	Opt-in · lawful basis	Access · erase · port	Consent required	Special-cat	Mandatory	ANPD⁵	Adequacy ’26⁵	↑EU adequacy 2026	Primary-source-driven. P
JPNJapanAsia–Pacific	Strong protection. Strong	APPI⁶	Opt-out for sharing	Access · erase	Opt-out (sharing)	Special-cat	Mandatory (2022)	PPC⁶	Adequacy²	→Stable	Primary-source-driven. P
GBRUnited KingdomEurope Five Eyes	Strong protection. Strong	UK GDPR · DUAA ’25⁸	Opt-in · lawful basis	Access · erase · port	Consent (PECR)	Children’s code	72h to ICO	ICO · up to 4%	Adequacy²	↓DUAA loosening⁸	Primary-source-driven. P
ARGArgentinaAmericas	Strong protection. Strong	Ley 25.326¹⁴	Opt-in	Access · rectify · delete	Limited rules	Special-cat	Emerging	AAIP	Adequacy²	→Reform pending	Mixed: primary sources and the tracker. P·I
URYUruguayAmericas	Strong protection. Strong	Ley 18.331¹⁴	Opt-in	Access · delete	Limited rules	Special-cat	Emerging	URCDP	Adequacy²	→Stable	Mixed: primary sources and the tracker. P·I
NZLNew ZealandAsia–Pacific Five Eyes	Strong protection. Strong	Privacy Act 2020¹⁴	IPPs (consent)	Access · correct	Limited rules	Emerging	Notifiable (2020)	Commissioner	—	→Stable	Mixed: primary sources and the tracker. P·I
TWNTaiwanAsia–Pacific	Strong protection. Strong	PDPA¹⁴	Consent-based	Access · delete	Limited rules	Special-cat	Emerging	New PDPC (2025)	—	↑New DPA 2025	Mixed: primary sources and the tracker. P·I
CHNChinaAsia–Pacific	Strong protection. Strong	PIPL⁴	Opt-in (separate consent)	Access · delete · port	Consent required	Strict (FR limits)	Mandatory	CAC · up to 5% (state-run)⁴	—	→Strict on firms	Primary-source-driven. P
CANCanadaAmericas Five Eyes	Substantial protection. Substantial	PIPEDA¹²	Consent-based	Access · correct	Limited rules	Emerging	Mandatory (PIPEDA)	OPC · weak fines¹²	Adequacy (comm.)²	→Reform stalled (C-27)	Mixed: primary sources and the tracker. P·I
AUSAustraliaAsia–Pacific Five Eyes	Substantial protection. Substantial	Privacy Act 1988¹³	APPs	Access · correct	Limited rules	Children’s code (2024)	Notifiable (NDB)	OAIC	—	↑2024 reforms¹³	Mixed: primary sources and the tracker. P·I
ZAFSouth AfricaAfrica	Substantial protection. Substantial	POPIA¹⁰	Consent-based	Access · delete	Marketing opt-in	Special-cat	Mandatory	Info Regulator¹⁰	—	→Stable	Primary-source-driven. P
USAUnited StatesAmericas Five Eyes	Moderate protection. Moderate	No federal omnibus · state laws³	Opt-out (state)	Access · delete (state)	Opt-out of sale (CCPA)³	COPPA (children)	Breach laws (all states)	FTC · state AGs · CPPA³	DPF²	→State patchwork growing	Primary-source-driven. P
INDIndiaAsia–Pacific	Limited protection. Limited	DPDP 2023 (rules notified Nov 2025)⁹	Consent (from May 2027)	Access · erase (from May 2027)	No opt-out yet	Parental consent	Mandatory (from May 2027)	Non-independent board⁹	—	↑Core duties start May 2027	Primary-source-driven. P
CRICosta RicaAmericas	Substantial protection. Substantial	Ley 8968	Opt-in	Access · rectify	Limited rules	Special-cat	Emerging	PRODHAB	—	→Stable	Estimated from the tracker. I
CHLChileAmericas	Substantial protection. Substantial	Ley 21.719	Opt-in	Access · erase · port	Consent (pending)	Special-cat	Mandatory (’26)	New APDP (’26)	—	↑In force Dec 2026	Estimated from the tracker. I
COLColombiaAmericas	Substantial protection. Substantial	Ley 1581	Opt-in	Access · delete	Registry rules	Special-cat	Mandatory	SIC · active	—	→Active enforcer	Estimated from the tracker. I
ECUEcuadorAmericas	Moderate protection. Moderate	LOPDP 2021	Opt-in	Access · erase	Limited rules	Special-cat	Mandatory	Superintendencia	—	↑Young regulator	Estimated from the tracker. I
MEXMexicoAmericas	Moderate protection. Moderate	LFPDPPP	Opt-out (ARCO)	ARCO rights	Limited rules	Special-cat	Mandatory	Exec ministry (non-indep)	—	↓INAI abolished 2025	Estimated from the tracker. I
PERPeruAmericas	Moderate protection. Moderate	Ley 29733	Opt-in	Access · delete	Limited rules	Special-cat	Emerging	APDP	—	→Stable	Estimated from the tracker. I
VENVenezuelaAmericas	Weak protection. Weak	No comprehensive law	None	Habeas data (const.)	None	None	None	None	—	→Stable	Estimated from the tracker. I
CUBCubaAmericas	Limited protection. Limited	Decree-Law 2022	Consent	Access	None	Some	None	State body	—	→Stable	Estimated from the tracker. I
SRBSerbiaEurope	Substantial protection. Substantial	PDP Law 2018	Opt-in	Access · erase · port	Consent	Special-cat	72h	Commissioner	—	→GDPR-aligned	Estimated from the tracker. I
MDAMoldovaEurope	Moderate protection. Moderate	PDP Law	Opt-in	Access · rectify	Limited rules	Special-cat	Emerging	NCPDP	—	↑GDPR alignment	Estimated from the tracker. I
UKRUkraineEurope	Moderate protection. Moderate	Law 2010 (reform pending)	Consent	Access · rectify	Weak	Special-cat	None	Ombudsman	—	↑GDPR reform	Estimated from the tracker. I
BLRBelarusEurope	Limited protection. Limited	PDP Law 2021	Consent	Access	Weak	Some	None	State (NPDP)	—	→State-aligned	Estimated from the tracker. I
ARMArmeniaEurasia	Moderate protection. Moderate	PDP Law 2015	Opt-in	Access · rectify	Weak	Special-cat	None	Agency	—	→Stable	Estimated from the tracker. I
GEOGeorgiaEurasia	Substantial protection. Substantial	PDP Law 2023	Opt-in	Access · erase · port	Consent	Special-cat	72h	PDP Service	—	↑New 2023 law	Estimated from the tracker. I
TURTurkeyEurasia	Moderate protection. Moderate	KVKK 2016	Opt-in (explicit)	Access · delete	Limited rules	Special-cat	Mandatory	KVKK Board	—	→Localization concerns	Estimated from the tracker. I
AZEAzerbaijanEurasia	Limited protection. Limited	Law 2010	Consent	Access	Weak	Some	None	State	—	→Stable	Estimated from the tracker. I
KAZKazakhstanEurasia	Limited protection. Limited	Law 2013	Consent	Access	Weak	Some	None	State agency	—	→Localization	Estimated from the tracker. I
UZBUzbekistanEurasia	Limited protection. Limited	Law 2019 (localization)	Consent	Access	Weak	Some	None	State	—	→Localization	Estimated from the tracker. I
TKMTurkmenistanEurasia	Minimal protection. Minimal	Nominal (2017)	None	None	None	None	None	None	—	→Stable	Estimated from the tracker. I
RUSRussiaEurasia	Substantial protection. Substantial	152-FZ	Consent (opt-in)	Access · delete	Limited rules	Special-cat	Mandatory (Roskomnadzor)	Roskomnadzor · turnover fines (state-run)	—	↑2024 fine hikes	Estimated from the tracker. I
ISRIsraelMiddle East	Substantial protection. Substantial	PPL	Consent	Access · correct	Limited rules	Special-cat	Mandatory	PPA	Adequacy²	↑2024 amendment	Mixed: primary sources and the tracker. P·I
JORJordanMiddle East	Moderate protection. Moderate	PDP Law 2023	Consent	Access · correct	Limited rules	Special-cat	Mandatory	New (2023)	—	↑New 2023 law	Estimated from the tracker. I
LBNLebanonMiddle East	Limited protection. Limited	Law 81/2018	Consent	Access	Weak	Some	None	Weak	—	→Weak enforcement	Estimated from the tracker. I
MARMoroccoAfrica	Moderate protection. Moderate	Law 09-08	Consent	Access · rectify	Limited rules	Special-cat	Emerging	CNDP	—	→Stable	Estimated from the tracker. I
TUNTunisiaAfrica	Limited protection. Limited	Law 2004 (reform pending)	Consent	Access	Weak	Some	None	INPDP	—	→Reform pending	Estimated from the tracker. I
EGYEgyptAfrica	Limited protection. Limited	DP Law 2020 (regs pending)	Consent	Access	Weak	Some	Mandatory	Authority pending	—	↑Regs pending	Estimated from the tracker. I
AREUAEMiddle East	Moderate protection. Moderate	PDPL 2021 + DIFC/ADGM	Consent	Access · erase · port	Limited rules	Special-cat	Mandatory	UAE Data Office	—	↑In force	Estimated from the tracker. I
SAUSaudi ArabiaMiddle East	Moderate protection. Moderate	PDPL 2023	Consent	Access · delete · port	Limited rules	Special-cat	Mandatory (72h)	SDAIA	—	↑In force 2024	Estimated from the tracker. I
QATQatarMiddle East	Moderate protection. Moderate	PDPPL 2016	Consent	Access · correct	Limited rules	Special-cat	Mandatory	NDPO	—	→First GCC law	Estimated from the tracker. I
BHRBahrainMiddle East	Moderate protection. Moderate	PDPL 2018	Consent	Access · correct	Limited rules	Special-cat	Mandatory	PDP Authority	—	→Stable	Estimated from the tracker. I
OMNOmanMiddle East	Moderate protection. Moderate	PDPL 2022	Consent	Access · correct	Limited rules	Special-cat	Mandatory	MTCIT	—	↑In force 2023	Estimated from the tracker. I
KWTKuwaitMiddle East	Limited protection. Limited	CITRA reg (2021)	Consent	Access	Weak	None	None	CITRA	—	→Sectoral only	Estimated from the tracker. I
IRQIraqMiddle East	Minimal protection. Minimal	No comprehensive law	None	None	None	None	None	None	—	→Stable	Estimated from the tracker. I
IRNIranMiddle East	Minimal protection. Minimal	No comprehensive law	None	None	None	None	None	None	—	→Draft bill	Estimated from the tracker. I
GHAGhanaAfrica	Moderate protection. Moderate	DPA 2012	Consent	Access · correct	Limited rules	Special-cat	Emerging	DP Commission	—	→Stable	Estimated from the tracker. I
KENKenyaAfrica	Substantial protection. Substantial	DPA 2019	Opt-in	Access · erase · port	Consent	Special-cat	72h	ODPC · active	—	↑Active regulator	Estimated from the tracker. I
NGANigeriaAfrica	Substantial protection. Substantial	NDPA 2023	Consent	Access · erase	Limited rules	Special-cat	72h	NDPC	—	↑NDPA 2023	Estimated from the tracker. I
SENSenegalAfrica	Moderate protection. Moderate	Law 2008	Consent	Access · rectify	Weak	Special-cat	None	CDP	—	→Stable	Estimated from the tracker. I
ZMBZambiaAfrica	Limited protection. Limited	DP Act 2021	Consent	Access · correct	Weak	Special-cat	Mandatory	New (2021)	—	↑New 2021 law	Estimated from the tracker. I
ZWEZimbabweAfrica	Limited protection. Limited	Cyber & DP Act 2021	Consent	Access	Weak	Some	Mandatory	POTRAZ	—	→Stable	Estimated from the tracker. I
UGAUgandaAfrica	Moderate protection. Moderate	DPP Act 2019	Consent	Access · correct	Weak	Special-cat	Mandatory	PDPO	—	→Stable	Estimated from the tracker. I
BWABotswanaAfrica	Moderate protection. Moderate	DP Act 2018	Consent	Access · correct	Weak	Special-cat	Emerging	Info & DP Commission	—	↑In force 2021	Estimated from the tracker. I
NAMNamibiaAfrica	Weak protection. Weak	Bill pending	None	None	None	None	None	None	—	↑Bill pending	Estimated from the tracker. I
SGPSingaporeAsia–Pacific	Substantial protection. Substantial	PDPA 2012	Opt-in (consent)	Access · correct · port	Do-Not-Call + consent	Some	Mandatory (2021)	PDPC · active fines	—	→Active enforcer	Estimated from the tracker. I
MYSMalaysiaAsia–Pacific	Substantial protection. Substantial	PDPA 2010 (2024 amd)	Consent	Access · correct	Limited rules	Special-cat	Mandatory (2024)	PDP Commissioner	—	↑2024 amendments	Estimated from the tracker. I
PHLPhilippinesAsia–Pacific	Substantial protection. Substantial	DPA 2012	Consent	Access · erase · port	Consent	Special-cat	72h (NPC)	NPC · active	—	→Active regulator	Estimated from the tracker. I
IDNIndonesiaAsia–Pacific	Moderate protection. Moderate	PDP Law 2022	Consent	Access · erase · port	Limited rules	Special-cat	72h	Agency (forming)	—	↑In force 2024	Estimated from the tracker. I
THAThailandAsia–Pacific	Substantial protection. Substantial	PDPA 2019	Opt-in (consent)	Access · erase · port	Consent	Special-cat	72h	PDPC	—	↑In force 2022	Estimated from the tracker. I
VNMVietnamAsia–Pacific	Substantial protection. Substantial	PDPL 2025	Opt-in (explicit)	Access · delete	Sale banned	Special-cat	Mandatory	MPS · up to 5% (state-run)	—	↑In force Jan 2026	Estimated from the tracker. I
LKASri LankaAsia–Pacific	Moderate protection. Moderate	PDPA 2022	Consent	Access · erase	Limited rules	Special-cat	Mandatory	DPA (new)	—	↑New law	Estimated from the tracker. I
NPLNepalAsia–Pacific	Limited protection. Limited	Privacy Act 2018	Consent	Access	Weak	Some	None	Weak	—	→Limited	Estimated from the tracker. I
KHMCambodiaAsia–Pacific	Weak protection. Weak	Draft law	None	None	None	None	None	None	—	↑Draft law	Estimated from the tracker. I
MNGMongoliaAsia–Pacific	Moderate protection. Moderate	PDP Law 2021	Consent	Access · correct	Limited rules	Special-cat	Mandatory	New (2021)	—	↑New 2021 law	Estimated from the tracker. I
PAKPakistanAsia–Pacific	Weak protection. Weak	Draft bill (pending)	None	None	None	None	None	None	—	→Bill pending	Estimated from the tracker. I
MMRMyanmarAsia–Pacific	Minimal protection. Minimal	No DP law	None	None	None	None	None	None	—	→Junta rule	Estimated from the tracker. I
PRKNorth KoreaAsia–Pacific	Minimal protection. Minimal	No law	None	None	None	None	None	None	—	→No open internet	Estimated from the tracker. I

No countries in that tier.

Filled. Strong protection — a right that binds companies, present and enforceable. Half. Present but qualified — opt-out rather than opt-in, partial, or weakly enforced. Open ring. Absent or adverse — no such right, or a rule that favours the company. Dashed. Not located. Grey (any shape). Estimated from the tracker, with no per-country document — shown without a source number.

Reading the columns. Comprehensive law is whether an omnibus statute covers the private sector, or only a sectoral patchwork does. Consent model is the default: opt-in with a lawful basis is more protective than opt-out. Access & deletion is what you can demand of a company — to see, correct, erase, and port your data. Sale & targeted ads is whether selling data or behavioural profiling needs your consent or an opt-out. Sensitive & children is the extra protection for health, biometric, and children’s data. Breach notice is whether a company must tell you and the regulator when your data leaks. Enforcement & penalty is the part that makes the rest real: an independent regulator and a fine large enough to matter. EU adequacy sits here because it is the external verdict on a country’s commercial regime — though Schrems II shows it also weighs state access, so it is not a pure consumer measure. Basis tags each row: P primary-source-driven, P·I mixed, I estimated from the tracker.Checked July 18, 2026 — verify current details before relying on this. General information, not legal advice.

Sources & notes (companies)

Each number matches a superscript in the table above and points to the primary instrument or regulator behind a documented cell. Cells without a number are estimated from the DLA Piper tracker (source 14) and shown in grey. Checked July 18, 2026.

European Union — General Data Protection Regulation (Regulation (EU) 2016/679) — private-sector duties, the individual rights of access, erasure and portability, 72-hour breach notification, and fines up to 4% of global turnover, enforced by an independent authority. eur-lex.europa.eu
European Commission — Adequacy decisions — the external verdict on a country’s data-protection regime; note that Schrems II turned on state access, so adequacy is not a purely commercial measure. commission.europa.eu
United States — California Consumer Privacy Act / CPRA — rights to know, delete, and opt out of the sale or sharing of personal data, enforced by the California Privacy Protection Agency. There is no comprehensive federal statute: a sectoral patchwork (HIPAA, GLBA, COPPA, FCRA) plus a growing set of state laws. oag.ca.gov
China — Personal Information Protection Law (PIPL), effective 1 November 2021 — separate opt-in consent, data minimisation, deletion and portability rights, strict facial-recognition rules, and fines up to 5% of turnover; enforced by the state Cyberspace Administration, not an independent regulator, and subject to broad state carve-outs. dlapiperdataprotection.com
Brazil / European Commission — LGPD, enforced by the ANPD, and the EU–Brazil mutual adequacy decisions of January 2026. ec.europa.eu
Japan — Act on the Protection of Personal Information (APPI), enforced by the independent Personal Information Protection Commission; the first post-GDPR adequacy country. ppc.go.jp
South Korea — Personal Information Protection Act (PIPA). The Personal Information Protection Commission (independent since 2020) has fined Google and Meta tens of millions of dollars; Korea holds EU adequacy. pipc.go.kr
United Kingdom — UK GDPR as amended by the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025) — it keeps the comprehensive framework and EU adequacy while easing some rules (recognised legitimate interests, automated decisions) and adding children’s-protection duties and a right to complain to controllers; enforced by the ICO. legislation.gov.uk
India — Digital Personal Data Protection Act 2023 — consent-based with parental consent for children, phasing in through May 2027, with broad government exemptions and a non-independent Data Protection Board. dlapiperdataprotection.com The DPDP Rules were notified on November 13, 2025: the Data Protection Board came first, consent-manager registration follows in November 2026, and the core duties on consent, breach notice, children’s data and user rights apply from May 13, 2027. AZB & Partners
South Africa — Protection of Personal Information Act (POPIA), enforced by the Information Regulator; mandatory breach notification and consent-based direct marketing. inforegulator.org.za
Switzerland — Revised Federal Act on Data Protection (in force 1 September 2023), GDPR-aligned, enforced by the FDPIC; Switzerland holds EU adequacy. edoeb.admin.ch
Canada — Personal Information Protection and Electronic Documents Act (PIPEDA), enforced by the Office of the Privacy Commissioner (limited fining power; the Bill C-27 reform lapsed); EU adequacy for commercial data. priv.gc.ca
Australia — Privacy Act 1988 (Australian Privacy Principles) and the Notifiable Data Breaches scheme, enforced by the OAIC; the Privacy and Other Legislation Amendment Act 2024 began a phased strengthening. oaic.gov.au
DLA Piper — Data Protection Laws of the World — the cross-country tracker behind the estimated (Basis “I”) rows and tier placements; the commercial-privacy analog to the internet-freedom index used in the first table. dlapiperdataprotection.com

On method. Tiers, not scores, for the same reason as the first table: the top and bottom hold up, the middle turns on how you weigh paper rights against real enforcement. This is a student project for privacy education; it is not an official index and takes no position on any government.

What the pattern shows

Courts, alliances, and law versus practice

The top tier has a common feature, and it isn’t a privacy law on the books — almost every country has one of those. It’s an independent court willing to strike surveillance powers down. The countries in the strongest tier tend to pair a data-protection statute with a constitutional court that has actually voided a retention mandate or an intelligence power, so the protection holds when a government would rather it didn’t. A statute a legislature can amend is worth less than the same words a court will enforce.

Intelligence-sharing membership caps how high an otherwise-strong democracy can sit. A country can have GDPR-grade law and an active regulator and still run bulk-collection powers or cable interception under a national-security carve-out. Where it does, the table places it a tier below what its commercial protections alone would suggest — which is why several wealthy democracies with excellent consumer-privacy regimes land in the middle rather than the top. The companion table above is where that strength reappears: the UK, the United States, and Australia all sit markedly higher against companies than against their own governments.

One reading needs care, and it’s the reason scores were dropped. A repressive law on the books is not the same as a sealed network in operation. Several states with sweeping surveillance statutes still run comparatively open networks in practice — filtering incomplete, VPN use widespread, no permanent isolation actually achieved — while a smaller set operate the control they legislate. The tiers reflect what a person can actually do, so a legally repressive but operationally leaky regime can sit above a fully operational one. The Trend column carries the direction of travel, which is often where the real story is.

And the honest limit: about a fifth of the rows are documented cell-by-cell; the rest are estimates, and roughly a quarter of all countries fall outside the index this leans on entirely. The Basis tag and the grey markers are there so you can see exactly which is which — the same discipline as our campus transparency table, where an unanswered question is marked, not guessed.

The campus transparency table → Who sees your data → Protect yourself →

Sources & notes

Each number matches a superscript in the table and points to the primary instrument behind a documented cell. Cells without a number are either a finding of absence or an estimate from the index in source 12 — there’s no single document to link. The estimated rows (Basis I) rest chiefly on that index plus EU-adequacy status and public data-protection-law trackers; they carry no per-country primary source, and roughly a quarter of the list sits outside the index’s 72 countries on the thinnest basis of all. Checked July 11, 2026.

European Union — General Data Protection Regulation (Regulation (EU) 2016/679) — the statutory data-protection framework, and the requirement of an independent supervisory authority, binding in every member state. eur-lex.europa.eu
Court of Justice of the EU — Digital Rights Ireland (2014) struck the blanket Data Retention Directive; La Quadrature du Net (2020) held that general, indiscriminate retention is unlawful save under narrow conditions — the case-law behind the “court-struck” retention cells across the EU. curia.europa.eu (PDF)
European Commission — Adequacy decisions — the official list of non-EU jurisdictions recognised as providing adequate data protection (Japan, South Korea, Argentina, Uruguay, Canada (commercial), the UK, and others). commission.europa.eu
Germany · Federal Constitutional Court — Judgment of 1 October 2024 (Press Release 83/2024): storage powers under §18(1) no.2 and contact-person surveillance under §45(1) no.4 of the BKA Act held incompatible with the right to informational self-determination, effective until 31 July 2025. bundesverfassungsgericht.de
Germany · Federal Constitutional Court — Order of 8 October 2024: strategic cyber-surveillance of international telecommunications by the Federal Intelligence Service (BND) held unconstitutional in part. bundesverfassungsgericht.de
Switzerland — Federal Constitution Art. 13 and the Federal Act on Data Protection (2023). The 2025 revision of the OSCPT/VÜPF surveillance ordinance would add mandatory identification, six-month retention, and — under Art. 50a — a duty to remove provider-applied encryption; Proton has said it would relocate infrastructure in response. swissinfo.ch
United Kingdom — Investigatory Powers Act 2016 — bulk powers, 12-month Internet Connection Record retention, and secret Technical Capability Notices (the mechanism behind the Apple encryption demand). legislation.gov.uk
United Kingdom — Online Safety Act 2023 — “highly effective age assurance” duties, in force from 25 July 2025. legislation.gov.uk
United States · Congress — Congressional Research Service R48592 on FISA Section 702 and the 2024 RISAA: reauthorised 20 April 2024, broadened the “electronic communication service provider” definition, set to sunset 20 April 2026; short-term extensions carried it to 12 June 2026, when it lapsed, though collection under the March 2026 court approval can run for about a year (CRS LSB11444). The US has no comprehensive federal privacy statute. congress.gov
Australia — Telecommunications (Assistance and Access) Act 2018 (decryption-assistance regime) and the mandatory metadata-retention scheme under the Telecommunications (Interception and Access) Act. legislation.gov.au
Russia · documentation — Human Rights Watch, Disrupted, Throttled, and Blocked (2025) — documents SORM, the 2019 “sovereign internet” law and Yarovaya retention, and that filtering/isolation remain incomplete in practice (the basis for the operational-vs-legal reading). hrw.org
Freedom House — Freedom on the Net 2025 — the cross-country internet-freedom index behind the estimated (Basis “I”) rows and the tier placements; it also documents China and Myanmar as the worst environments and the UK’s 2025 demands to Apple. It assesses 72 countries, so the roughly 28 outside it rest on the thinnest basis of all. freedomhouse.org
Brazil / European Commission — Brazil’s LGPD and the EU–Brazil mutual adequacy decisions of 26–27 January 2026 (European Commission Implementing Decision (EU) 2026/179; ANPD Resolution No. 32/2026). ec.europa.eu
Japan — Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, amended 2020), enforced by the independent Personal Information Protection Commission; Japan was the first country to receive an EU adequacy decision after the GDPR. ppc.go.jp
South Korea — Personal Information Protection Act (PIPA, 2011). The 2020 amendment made the Personal Information Protection Commission an independent regulator, which has fined Google and Meta tens of millions of dollars; privacy is a constitutional right and Korea holds EU adequacy. pipc.go.kr
India · Supreme Court — K. S. Puttaswamy v. Union of India (2017) held privacy to be a fundamental right under Article 21; the Digital Personal Data Protection Act 2023 grants broad state exemptions and a non-independent board, and the Aadhaar programme is a mass biometric-identity system. globalfreedomofexpression.columbia.edu
China — Personal Information Protection Law (PIPL), effective 1 November 2021 — a comprehensive statute that binds companies (including rules on facial-recognition use) but does not constrain state surveillance. dlapiperdataprotection.com
South Africa · Constitutional Court — amaBhungane v Minister of Justice [2021] ZACC 3 (4 February 2021) held RICA’s bulk interception unlawful and the Act unconstitutional in five respects; POPIA (Act 4 of 2013) and Constitution §14 protect privacy. saflii.org
European Union — Regulation (EU) 2021/1232, the temporary ePrivacy derogation permitting voluntary provider scanning of non-encrypted communications for known CSAM. Lapsed 3 April 2026; reinstated 9 July 2026 to run until 3 April 2028; it does not reach end-to-end-encrypted messages. eur-lex.europa.eu
European Parliament — Press release on the 9 July 2026 second-reading vote (“Combating child sexual abuse: support for a more limited ePrivacy derogation”): the motion to reject the Council position drew 314 votes to 276, short of the 361-vote absolute majority needed to block it, so the derogation stands. The permanent Child Sexual Abuse Regulation, COM(2022) 209, remains in trilogue. europarl.europa.eu
United States — 18 U.S.C. § 2258A. Providers are not required to search for CSAM but may scan voluntarily (hash-matching on non-encrypted surfaces such as Gmail, Messenger, and cloud storage) and must report anything found to NCMEC’s CyberTipline. law.cornell.edu
United Kingdom — Online Safety Act 2023, s.121 (the former cl.122 “spy clause”): Ofcom may issue a Technology Notice requiring a provider to use “accredited technology” to scan for CSEA or terrorism content, including on end-to-end-encrypted services. The power is not yet exercised — the government has said it will not be used until “technically feasible,” and no technologies had been accredited as of mid-2026. ofcom.org.uk

On method. Tiers replace the exact scores from the underlying research, because a five-tier range is far more defensible than a precise 1-to-100 ordering — the top and bottom hold up, the middle is sensitive to how you weigh state surveillance against commercial protection. This is a student project for privacy education; it is not an official index, and it takes no position on any government.

Get involved

It’s free, open to everyone at Pitt, and joining takes about a minute.

No dues, no experience needed. Come to a meeting, or leave your name and we’ll tell you when the next one is.

Join the club See upcoming meetings →

Issues

Rankings

Surveillance

Protect yourself