![2 New National Privacy Laws Passed in 2025 [Global Count]](/_astro/how-many-privacy-laws-passed-in-2025.CB1_pLEb_Z1B3GWG.webp)
Only 2 countries, Vietnam and Bangladesh, enacted a brand new national data protection law in 2025, even as 8 US states saw an existing law take effect for the first time and the global country count reached 172, per Graham Greenleaf's tables and the IAPP's US State Privacy Legislation Tracker. "Passed" and "took effect" answer different questions, and 2025 is a clean example of why the distinction matters.
Below is what actually happened in 2025, country by country and state by state, plus how that year's pace compares to the long-run trend.
How many countries passed a brand new privacy law in 2025?
2 countries enacted a wholly new comprehensive national data protection law during 2025: Vietnam and Bangladesh. Both replaced a patchwork of narrower decrees and sector rules with a single cross-cutting statute, the same pattern GDPR set in 2018.
Figure 1: The bulk of 2025's activity was existing laws reaching their effective date, not brand new enactments. Source: IAPP US State Privacy Legislation Tracker; Vietnam National Assembly; Bangladesh government gazette; India Ministry of Electronics and Information Technology.
Vietnam's National Assembly passed Law No. 91/2025/QH15, the Law on Personal Data Protection, on June 26, 2025, with 433 of 435 participating delegates voting in favor. It replaces Decree 13/2023/ND-CP and takes effect January 1, 2026. Bangladesh's cabinet approved its Personal Data Protection Ordinance on October 9, 2025, and the government issued the gazette notification on November 9, 2025, giving the country its first standalone, cross-sectoral data protection law.
How many US states got a new privacy law in 2025?
0 US states enacted a brand new comprehensive privacy law in 2025. Instead, 8 states saw a law that had already been signed in an earlier legislative session finally reach its effective date, more effective dates landing in 2025 than in any other single year on record for US state privacy law.
Figure 2: US effective dates were spread across three months, while both new national enactments landed in the second half of the year. Source: IAPP US State Privacy Legislation Tracker; Vietnam National Assembly; Bangladesh government gazette; India MeitY.
Five of the 8 states, Delaware, Iowa, Nebraska, New Hampshire, and New Jersey, started enforcement in January alone. Tennessee and Minnesota followed in July, and Maryland closed out the year on October 1. None of these 8 laws were new legislative acts in 2025; each had already cleared its state legislature in 2023 or 2024 and simply reached the date its own text specified.
Did any country update an existing law instead of passing a new one?
Yes. India's Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 on November 13, 2025, operationalizing the Digital Personal Data Protection Act that Parliament had already passed in 2023. The Rules, not a new law, are what actually give the 2023 Act enforceable teeth, including phased compliance deadlines running out to May 2027 for some obligations.
Figure 3: The same word, "passed," gets applied loosely to three different kinds of events; only the first branch is a genuinely new law. Source: PrivacyTerms.io classification of the sources cited throughout this post.
The distinction is not just semantic. A business already compliant with India's 2023 Act had homework to do in November 2025 when the Rules landed, even though no new law was passed that year, in the same way a business already compliant with Delaware's 2023-enacted law had homework to do the moment it took effect on January 1, 2025.
How does 2025's pace compare to the historical trend?
The global count of countries with an enacted data protection law reached 172 in 2025, according to Greenleaf's tables, up from 162 in 2023, a gain of 10 countries in two years. That averages out to 5.0 new countries per year across the 2023-to-2025 window, in line with the 5.4-per-year pace Greenleaf's tables show since 2020 and well above the 3.3-per-year average across the full 1973-2025 period those tables cover.
| Milestone year | Cumulative countries with a law | Source |
|---|---|---|
| 1973 | 1 | Greenleaf, Global Data Privacy Laws tables |
| 2012 | 89 | Greenleaf, Global Data Privacy Laws tables |
| 2019 | 132 | Greenleaf, Global Data Privacy Laws tables |
| 2023 | 162 | Greenleaf, Global Data Privacy Laws tables |
| 2025 | 172 | Greenleaf, Global Data Privacy Laws tables |
Source: Graham Greenleaf, Global Data Privacy Laws 2025: 172 Countries, Twelve New in 2023/24 (SSRN, 2025), and 172 Countries with Data Privacy Laws, Year by Year 1973-2025 (SSRN, 2025).
Figure 4: The 52-year climb to 172 countries, with the steepest years arriving after GDPR took effect in 2018. Source: Graham Greenleaf, 172 Countries with Data Privacy Laws, Year by Year 1973-2025 (SSRN, 2025).
Only 2 brand new enactments in a single calendar year looks small against a 172-country total, but that total counts every country that has ever passed a qualifying law, not how many pass one in any given year. Once a country like Vietnam or Bangladesh joins the list, it rarely needs a second brand new law again soon; most subsequent activity is amendments, implementing rules, and effective dates, exactly the pattern 2025 shows for India and the 8 US states. For a full breakdown of which 172 countries make Greenleaf's list, see our global privacy law tracker by country, and for the broader question of legislative coverage worldwide, see how many countries have a data protection law.
What does this mean for a business updating its policies?
A business tracking "how many privacy laws passed" needs to watch three separate calendars, not one: new enactments (Vietnam, Bangladesh), implementing rules under laws already on the books (India), and effective dates for laws signed in a prior year (the 8 US states). Missing any one of the three can leave a privacy policy out of date even in a year with only 2 headline new laws.
Figure 5: New US effective dates outnumbered new national-level activity more than 2 to 1 in 2025. Source: IAPP US State Privacy Legislation Tracker; Vietnam National Assembly; Bangladesh government gazette; India MeitY.
A privacy policy generator that tracks effective dates and implementing rules, not only brand new enactments, catches all three categories of change without requiring a business to separately monitor an Asian legislature, a South Asian gazette, and eight different US state effective-date calendars by hand.
The Bottom Line
2025 produced only 2 brand new national privacy laws worldwide, Vietnam's and Bangladesh's, but that low headline number undersells how much actually changed for compliance teams during the year. 8 US states reached an effective date, India rewired the enforcement mechanics of a law it had already passed two years earlier, and the global count of countries with any data protection law climbed to 172. A business asking "how many privacy laws passed in 2025" gets a small, accurate answer if it means brand new enactments, and a much larger, equally accurate answer if it means every legal change that could have required an updated privacy policy that year. Both answers are correct; the question is which one a given business actually needs to act on.
Frequently Asked Questions
How many countries passed a brand new privacy law in 2025? 2 countries enacted a wholly new comprehensive national data protection law in 2025: Vietnam, whose National Assembly passed Law No. 91/2025/QH15 on June 26, 2025, and Bangladesh, which gazetted its Personal Data Protection Ordinance 2025 on November 9, 2025, its first cross-sectoral data protection law.
How many US states got a new privacy law in 2025? 0 US states enacted a brand new comprehensive privacy law in 2025, but 8 states saw a previously enacted law reach its effective date for the first time that year: Delaware, Iowa, Nebraska, and New Hampshire on January 1, New Jersey on January 15, Tennessee on July 1, Minnesota on July 31, and Maryland on October 1, per the IAPP's US State Privacy Legislation Tracker.
Did any country update an existing privacy law in 2025 without passing a new one? Yes. India's Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules 2025 on November 13, 2025, operationalizing the Digital Personal Data Protection Act that Parliament had already passed back in 2023, rather than enacting a new law.
How many countries have any data protection law as of 2025? 172 countries have an enacted data protection law of some kind as of 2025, according to Graham Greenleaf's Global Data Privacy Laws tables, up from 162 in 2023, a gain of 10 countries in two years and an average pace of 5.0 new countries per year across that window.
Where the Numbers Come From
- Legal 500. "Legal Update on Law on Personal Data Protection." Confirms Vietnam's National Assembly passed Law No. 91/2025/QH15 on June 26, 2025, replacing Decree 13/2023/ND-CP.
- The Daily Star. "Bangladesh's Personal Data Protection Ordinance 2025: Key Takeaways." Cabinet approval October 9, 2025, gazette notification November 9, 2025, described as the country's first comprehensive data protection law.
- Ministry of Electronics and Information Technology, Government of India. Digital Personal Data Protection Rules, 2025, notified November 13, 2025, operationalizing the Digital Personal Data Protection Act, 2023.
- IAPP. "US State Privacy Legislation Tracker." Confirms Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland effective dates during 2025.
- Graham Greenleaf. (2025). "Global Data Privacy Laws 2025: 172 Countries, Twelve New in 2023/24." SSRN preprint. Cumulative country count of 172 as of 2025, up from 162 in 2023.
- Graham Greenleaf. (2025). "172 Countries with Data Privacy Laws, Year by Year 1973-2025." SSRN preprint. Year-by-year cumulative counts: 1 in 1973, 89 in 2012, 132 in 2019, 162 in 2023, 172 in 2025.
Note: All figures verified as of August 2026. India's Rules carry a phased compliance timeline running into 2027 rather than a single fixed date, and this post's country and state counts are refreshed at least twice a year to track new enactments and effective dates.
