71% of Countries Now Have a Data Protection Law [2026]

71% of the 194 economies tracked by UNCTAD's Global Cyberlaw Tracker had a data protection and privacy law in place as of its most recent update. A separate, broader academic count from Graham Greenleaf's Global Data Privacy Laws 2025 tables puts the figure even higher, at 172 countries with some form of enacted law. Both numbers are correct. They simply answer slightly different versions of the same question, depending on which jurisdictions get counted and how strict the definition of "a law" is.

Below is what each count actually measures, how quickly the number keeps climbing, and why having a law on the books is not the same thing as meeting GDPR-level standards.

What percentage of countries have a data protection law?

71% of the 194 economies UNCTAD's Global Cyberlaw Tracker scores have data protection and privacy legislation in place. Another 9% show a bill still at draft stage, and 15% have no legislation at all, with the remaining 5% showing a status UNCTAD's tracker could not confirm at its last update. UNCTAD builds its tracker from government-sourced legislative records across 194 economies, checked against its own standing checklist for what counts as data protection and privacy legislation.

Figure 1: Legislative status across the 194 economies UNCTAD tracks. Source: UNCTAD Global Cyberlaw Tracker, data protection and privacy legislation worldwide.

Coverage is uneven by region. UNCTAD's own regional breakdown puts Europe highest at 96% of countries with legislation in place, while Africa trails at 50%, the lowest of the four regions it tracks. A business whose customers are concentrated in Africa or parts of Asia-Pacific is more likely to be dealing with a genuine legal gap in at least one market than a business serving only European or North American customers.

How does Greenleaf's count of 172 compare to UNCTAD's 71%?

Greenleaf's tables count 172 countries with an enacted data privacy law of any kind, a higher number than UNCTAD's 71% because the two trackers use different jurisdiction lists and a different bar for what qualifies. Neither number is wrong. They measure different things.

Tracker	Countries covered	Jurisdictions scored	Update cycle
Greenleaf's Global Data Privacy Laws 2025	172 countries	Tracks back to Sweden's 1973 law, includes some territories	Academic tables, roughly every 2 years
UNCTAD Global Cyberlaw Tracker	71% of 194 (about 138)	UN member states plus select economies	Government-sourced, continuously updated

Greenleaf's total runs higher because his tables count any national data privacy law, including narrower sectoral rules and older statutes that predate GDPR-style comprehensive frameworks, and because his jurisdiction list includes some territories UNCTAD does not score on its own. For a full country-by-country breakdown of which 172 jurisdictions are on Greenleaf's list, see our global privacy law tracker by country. Treat 172 as the broadest defensible count of countries with any data privacy law, and UNCTAD's 71% as the more conservative, government-verified share.

Figure 2: On Greenleaf's broader count, 172 of the 195 UN member states have an enacted data privacy law. Source: Graham Greenleaf, Global Data Privacy Laws 2025 (SSRN, 2025); United Nations membership total.

How fast are new countries passing a first data protection law?

New countries have enacted a first data protection law at an average rate of 5.4 per year since 2020, according to Greenleaf's tables, nearly double the 3.3-per-year average across the full 1973-2025 period those tables cover. 12 countries passed a first law across 2023 and 2024 combined.

Figure 3: Post-GDPR milestones in the pace of new enactments. Source: Graham Greenleaf, 172 Countries with Data Privacy Laws, Year by Year 1973-2025 (SSRN, 2025).

GDPR's 2018 effective date is the clearest inflection point in the data. Countries that had been watching the EU's approach from the sidelines began passing their own comprehensive laws once GDPR proved that a strict, well-enforced regime was workable at scale, and once it became clear that failing to match it could cost non-EU companies access to EU user data.

Is the pace of new laws speeding up or slowing down?

The pace has not been steady. Using Greenleaf's own published cumulative counts (1 country in 1973, 89 in 2012, 132 in 2019, 162 in 2023, and 172 in 2025), PrivacyTerms.io calculated the average number of new countries enacting a first law in each period between those milestones. The middle years, 2012 to 2023, show the fastest pace by a wide margin.

Figure 4: PrivacyTerms.io calculation from Greenleaf's published year-by-year cumulative country counts. Source: Graham Greenleaf, 172 Countries with Data Privacy Laws, Year by Year 1973-2025 (SSRN, 2025).

The 2019-2023 period, averaging 7.5 new countries per year, is the fastest stretch in the entire 52-year record, coinciding with GDPR's early enforcement years and a wave of Asia-Pacific and Latin American laws modeled on it. The 2023-2025 average slows to 5.0 per year, still well above the historical baseline, which Greenleaf's own commentary attributes to the remaining uncovered countries being a harder, more scattered group to move than the earlier wave. If your site has customers in more than one of these newly regulated markets, it is worth building a privacy policy against the strictest law your audience touches rather than waiting for every jurisdiction you serve to pass its own rule.

Does having a law mean it meets GDPR standards?

No. Not every one of the 172 counted laws matches GDPR's comprehensive scope. Greenleaf's tables include narrower sectoral laws and older statutes alongside full, cross-sector frameworks, so "has a data protection law" and "has a GDPR-equivalent law" are two different questions with two different answers.

Figure 5: The two tests a country's law has to pass to move from "has a law" to "EU-adequate." Source: European Commission adequacy decisions list, as of 2026.

A formal EU adequacy decision is the strictest public test of equivalence, and only about 16 to 17 countries and territories hold one as of 2026, including the UK, Japan, South Korea, and, as of February 2026, Brazil under a new mutual adequacy agreement. That leaves the overwhelming majority of the 172 countries with an enacted law outside the adequacy list, meaning any business sending them personal data from the EU still needs standard contractual clauses or another transfer safeguard, even though the destination country technically "has a law."

The Bottom Line

Any honest answer to "how many countries have a data protection law" has two numbers, not one: 71% of the 194 economies UNCTAD tracks have legislation confirmed in place, and 172 countries make Greenleaf's broader academic count. Neither figure is more correct than the other; they simply draw the line for "counts as a law" in different places. What both agree on is the direction: the pace of new enactments since 2020 is nearly double the 52-year historical average, and the gap between "has any law" and "has a GDPR-equivalent law" remains wide, since only a small adequacy-approved subset of either count offers frictionless EU data flow. For a business serving customers across more than one of these markets, the practical answer is the same regardless of which tracker's number you cite: build to the strictest regime your users touch, and treat every newly regulated market as a floor, not a ceiling.

Frequently Asked Questions

How many countries have a data protection law in 2026? 71% of the 194 economies tracked by UNCTAD's Global Cyberlaw Tracker have a data protection and privacy law in place, per its most recent update. A separate, broader academic count from Graham Greenleaf's Global Data Privacy Laws 2025 tables puts the figure at 172 countries, roughly 89% of the 195 UN member states, because Greenleaf counts any enacted law, not only the ones UNCTAD's checklist confirms.

What percentage of countries have no data protection legislation at all? 15% of the 194 economies UNCTAD tracks have no data protection legislation in place, and a further 9% have a bill still in draft. The remaining 5% show a status UNCTAD could not confirm at its last update.

How fast are new countries passing a first data protection law? 5.4 new countries per year have enacted a first data protection law since 2020, according to Greenleaf's year-by-year tables, up from a 3.3-per-year average across the full 1973-2025 period his tables cover. 12 countries enacted a first law across 2023 and 2024 combined.

Does having a data protection law mean it meets GDPR standards? No. Greenleaf's 172-country count includes narrower sectoral and older laws alongside comprehensive, GDPR-style frameworks. Only about 16 to 17 countries and territories hold a formal European Commission adequacy decision, the stricter test for whether a country's protections are considered essentially equivalent to the EU's own.

Where the Numbers Come From

1. Graham Greenleaf. (2025). "Global Data Privacy Laws 2025: 172 Countries, Twelve New in 2023/24." Privacy Laws & Business International Report, SSRN preprint. 172 countries with an enacted law, 12 new in 2023-24.
2. Graham Greenleaf. (2025). "172 Countries with Data Privacy Laws, Year by Year 1973-2025." SSRN preprint, published March 2025. Year-by-year adoption counts since Sweden's 1973 law; 3.3 new countries per year average since 1973, rising to 5.4 per year since 2020.
3. UNCTAD. "Data Protection and Privacy Legislation Worldwide." Global Cyberlaw Tracker, 194 economies scored, 71% with legislation in place, 9% draft, 15% none.
4. UNCTAD. "Data and Privacy Unprotected in One Third of Countries, Despite Progress." Regional breakdown: 96% Europe, 50% Africa, the highest and lowest of the four regions tracked.
5. European Commission. "Adequacy Decisions." List of countries and territories with an EU adequacy finding, updated on each new decision.
6. European Commission. (2026). "EU-Brazil Data Adequacy Agreement." Mutual adequacy decision between the EU and Brazil, announced February 2026.

Note: All figures verified as of August 2026. Country counts from Greenleaf's tables and UNCTAD's tracker are not directly comparable because each uses a different jurisdiction list and update cycle; both are refreshed periodically and this post's numbers are refreshed at least twice a year to track new editions.