About 1.03 billion people, 12.6% of the world's population, currently live in a country the European Commission has formally certified as providing GDPR-equivalent data protection, based on the Commission's adequacy decisions in effect as of 2026. That figure only counts formally recognized jurisdictions. Broader, more contested definitions of "GDPR-style" push the total dramatically higher, toward half the world's population, depending on which countries you are willing to count.
Population coverage is not the same question as country coverage. Our companion post on 172 countries with a data privacy law in 2026 counts every jurisdiction with any national privacy statute, narrow or comprehensive. This post asks a stricter question: how many people live somewhere the EU itself considers GDPR-equivalent, and how much higher does that number climb once you count countries that model their own laws on the GDPR without a formal EU blessing.
How many people live under a formal GDPR adequacy decision?
An EU adequacy decision is the European Commission's own determination that a non-EU country's data protection law provides protection "essentially equivalent" to the GDPR, letting personal data flow to that country without extra transfer safeguards. As of 2026, the Commission lists adequacy decisions for the United Kingdom, Japan, South Korea, Brazil, Canada, Switzerland, Israel, New Zealand, Argentina, Uruguay, Andorra, and several smaller European territories, alongside the EU's own 27 member states and its EEA partners Norway and Iceland.
Summing 2024 population estimates for the EU, the EEA, and every adequacy-recognized country outside it gives roughly 1.03 billion people, or 12.6% of the 8.14 billion people on Earth. That is the most defensible, narrowest reading of "GDPR-style": a government-to-government legal finding, not a journalist's or a law firm's characterization.
| Jurisdiction | Adequacy basis | Population (2024) | Share of world |
|---|---|---|---|
| EU (27 member states) | The GDPR itself | 450,228,188 | 5.5% |
| Norway + Iceland | EEA Agreement, applies GDPR directly | 5,958,785 | 0.1% |
| United Kingdom | Adequacy decision, 2021 | 69,281,000 | 0.9% |
| Japan | Adequacy decision, 2019 | 123,975,371 | 1.5% |
| South Korea | Adequacy decision, 2021 | 51,751,065 | 0.6% |
| Brazil | Adequacy decision, 2026 | 211,998,573 | 2.6% |
| Canada, Switzerland, Israel, New Zealand, Argentina, Uruguay, Andorra | Adequacy decisions, 2000-2013 | 114,724,796 | 1.4% |
| Core total | All of the above | 1,027,917,778 | 12.6% |
The narrowest single-country decisions barely move the total. The two that matter most are the EU's own 450.2 million residents and Brazil's 212.0 million, which became the first Latin American economy on the adequacy list when the Commission recognized Brazil's LGPD in January 2026, calling the resulting arrangement one of the biggest areas of free and safe data flows in the world.
Figure 1: Selected milestones in the European Commission's adequacy decision timeline. Source: European Commission, Adequacy Decisions (current list, 2026).
How high does the count go under a broader definition of "GDPR-style"?
Several of the world's most populous countries have enacted comprehensive data protection laws that closely follow the GDPR's structure, consent or legitimate-basis processing, a dedicated regulator, and enumerated data subject rights, without ever receiving a formal EU adequacy decision. Legal commentators routinely describe these laws as their country's own version of the GDPR. Osborne Clarke's client guide to China's Personal Information Protection Law calls it "China's equivalent of the EU's General Data Protection Regulation (GDPR)." Latham & Watkins' comparison of India's Digital Personal Data Protection Act finds it "draws heavily" on the GDPR's framework. Nigeria's Data Protection Act 2023 and Kenya's Data Protection Act 2019 are both described in legal analysis as aligned with GDPR principles, and DataGuidance's side-by-side comparison of Thailand's PDPA against the GDPR documents a law "modeled on the EU's GDPR" with some differences in consent and cross-border transfer rules.
Add the population of India, China, Nigeria, Kenya, and Thailand, none of which has a formal EU adequacy decision, and the total jumps by another 3.22 billion people. Combined with the 1.03 billion core figure, that brings the expanded total to roughly 4.25 billion people, or 52.2% of the world's population.
| Jurisdiction | GDPR-style basis | Population (2024) | Share of world |
|---|---|---|---|
| India | Digital Personal Data Protection Act 2023, described as GDPR-inspired | 1,450,935,791 | 17.8% |
| China | Personal Information Protection Law 2021, widely called "China's GDPR" | 1,408,975,000 | 17.3% |
| Nigeria | Data Protection Act 2023, aligned with GDPR principles | 232,679,478 | 2.9% |
| Thailand | Personal Data Protection Act, modeled on the GDPR | 71,668,011 | 0.9% |
| Kenya | Data Protection Act 2019, modeled closely on the GDPR | 56,432,944 | 0.7% |
| Expanded additional | No formal EU adequacy | 3,220,691,224 | 39.6% |
| Grand total (core + expanded) | 4,248,609,002 | 52.2% |
Treat the expanded figure as an upper bound, not a settled count. China's PIPL contains broad national-security and state-access carve-outs that many privacy scholars argue make it fundamentally different from the GDPR's individual-rights model, even though its structure looks similar on paper. India's DPDPA was still rolling out implementing rules through 2026, with phased compliance timelines for some obligations. The 4.25 billion figure only holds if you accept "structurally similar, self-described as GDPR-like" as your bar; the 1.03 billion figure holds regardless, because it rests on the EU's own legal determination.
Figure 2: The eight largest jurisdictions counted toward either the core or expanded GDPR-style totals, by 2024 population. Source: World Bank, Population, total (2024 estimates).
Figure 3: Where major jurisdictions fall on population size versus formal EU recognition. Source: European Commission adequacy decisions; World Bank population data, 2024.
How does this compare with Gartner's forecast for global privacy law coverage?
Long before this site calculated a country-by-country total, Gartner made the single most-cited prediction in this space. In a press release published on September 14, 2020, Gartner forecast that 65% of the world's population would have its personal data covered under "modern privacy regulations" by 2023, up from just 10% of the world in 2020, an analyst note that has been reproduced by dozens of outlets since, including CPO Magazine and BizTechReports.
Gartner's forecast and this article's calculations answer different questions. Gartner's 65% figure covers any "modern privacy regulation," a category broad enough to include laws that are not GDPR-style at all, such as the United States' sectoral state laws. This article's 12.6% core figure counts only laws the EU has formally certified as GDPR-equivalent, a much narrower bar. Gartner has not published a follow-up report confirming whether its 2023 target was actually reached, so treat the 65% figure as an unaudited forecast rather than a measured outcome.
Figure 4: How the world's population splits across three tiers of GDPR-style law status. Source: PrivacyTerms.io calculation from European Commission adequacy decisions and World Bank population data, 2024-2026.
Both numbers point the same direction. Whether you use Gartner's broad 65% forecast, this article's narrow 12.6% adequacy-only figure, or the 52.2% expanded figure, every credible estimate agrees that privacy regulation resembling the GDPR now touches a substantial and growing share of the world's population, not a small European exception.
How do you decide whether a country's law actually counts as GDPR-style?
Because "GDPR-style" has no single legal definition, this article applies a simple, disclosed test rather than an editorial judgment call for each country.
Figure 5: The two-tier test this article applies before counting a jurisdiction's population toward either total. Source: PrivacyTerms.io methodology, based on European Commission adequacy decisions and named legal commentary.
This test deliberately excludes narrower sectoral frameworks, such as the United States' patchwork of state privacy laws or the EU-US Data Privacy Framework, which grants adequacy only to individually certified companies rather than establishing a nationwide GDPR-equivalent statute. If your business already complies with a GDPR-style consent and disclosure framework for EU users, extending the same privacy policy generator approach to cover Brazilian, UK, or Japanese users usually requires only modest additions, since the underlying legal concepts, lawful basis, data subject rights, and named recipients, are already close to what most GDPR-style laws expect.
The Bottom Line
No matter how you slice it, GDPR-style privacy regulation no longer describes a European exception. At minimum, 1.03 billion people, 12.6% of the world, live somewhere the EU itself has certified as providing GDPR-equivalent protection, and that list has grown every few years since 2000, most recently adding Brazil in January 2026. Once you count countries whose own laws are widely described as their nation's version of the GDPR, even without formal EU recognition, the total climbs past 4 billion people, more than half the planet. Gartner's independently-derived 65% forecast for 2023, made back in 2020, points toward the same broad conclusion from a completely different angle. For any site with users outside its home country, the practical question is no longer whether a GDPR-style law applies somewhere in its audience, it almost certainly does, but whether its privacy policy already covers the disclosures those laws expect: you can generate a GDPR-ready privacy policy that addresses consent, data subject rights, and international transfers in one pass.
Frequently Asked Questions
How many people live under a GDPR-style privacy law in 2026? About 1.03 billion people, 12.6% of the world's population, live in a country the European Commission has formally recognized as providing GDPR-equivalent data protection, based on the Commission's adequacy decisions in effect as of 2026. A broader, more contested definition that also counts India, China, Nigeria, Kenya, and Thailand pushes the total toward 4.25 billion, or 52.2% of the world.
What did Gartner predict about global privacy law coverage? In a September 2020 press release, Gartner predicted that 65% of the world's population would have its personal data covered under modern privacy regulations by 2023, up from just 10% in 2020. Gartner has not published a follow-up audit confirming whether the 65% figure was reached, and the forecast used a broader category of modern privacy regulation than the stricter GDPR-equivalence definition used elsewhere in this article.
Which countries have a formal EU adequacy decision confirming GDPR-equivalent protection? As of 2026, the European Commission lists 14 countries and territories with a formal adequacy decision outside the EU/EEA, including the United Kingdom, Japan, South Korea, Brazil, Canada, Switzerland, Israel, New Zealand, Argentina, Uruguay, and Andorra, plus a narrower decision for the United States limited to companies certified under the EU-US Data Privacy Framework.
Why do population estimates for GDPR-style law coverage vary so much? Because GDPR-style is not a legally defined term. Counting only the European Commission's own adequacy decisions produces 1.03 billion people, 12.6% of the world. Counting countries whose comprehensive privacy law is widely described in legal commentary as the country's own GDPR, including Nigeria, Kenya, Thailand, India, and China, without formal EU recognition, adds 3.22 billion more people and pushes the total to roughly 4.25 billion, or 52.2% of the world's population.
Where the Numbers Come From
- World Bank. "Population, total" (indicator SP.POP.TOTL). 2024 estimates for the world, the EU, and every country cited in this article, last updated 13 July 2026.
- European Commission. "Adequacy decisions." Current list of countries and territories with a formal EU adequacy finding, including Brazil's addition in January 2026.
- Gartner. (2020). "Gartner Predicts 65% of World's Population Will Have Its Personal Data Covered Under Modern Privacy Regulations by 2023." Press release, 14 September 2020.
- CPO Magazine. "Gartner Projects Major Jump in Data Privacy Regulations, From 10% of the World Covered in 2020 to 65% in 2023." Corroborating report on Gartner's forecast.
- Latham & Watkins. "India's Digital Personal Data Protection Act 2023 vs. the GDPR: A Comparison."
- Osborne Clarke. "PRC Personal Information Protection Law ('China's GDPR') in a Nutshell."
- Mondaq. "Nigeria's Data Protection Landscape: Key Developments and What to Expect in 2026 and Beyond."
- DataGuidance. "GDPR v. Thailand's Personal Data Protection Act." Comparative analysis, May 2022.
- Office of the Data Protection Commissioner, Kenya. Official regulator for Kenya's Data Protection Act 2019.
Note: All figures verified as of August 2026. Population figures use World Bank 2024 estimates against a 2024 world total of 8,140,897,523; the adequacy decision list and India's DPDPA implementation status are both subject to change and will be refreshed at this post's next scheduled update.
