172 Countries Have Privacy Laws in 2026: The Global List

172 countries had a national data privacy or data protection law in force as of Graham Greenleaf's Global Data Privacy Laws 2025 tables, published through the SSRN preprint series and Privacy Laws & Business International Report in 2025. That is up from 89 countries a little over a decade earlier, and the growth has not leveled off: 12 of those 172 countries passed their first law in just the two years spanning 2023 and 2024.

How many countries have a privacy law right now?

172 countries have enacted a data privacy law, according to Greenleaf's tables, which track legislation back to Sweden's original 1973 law, the first of its kind anywhere. Since 2020, new countries have adopted a first privacy law at an average rate of 5.4 per year, close to double the 3.3-per-year average across the full 52-year period Greenleaf covers. Coverage now works out to roughly 89% of the 195 UN member states, though the figure is not a precise percentage of UN membership because Greenleaf's count includes some non-member territories and jurisdictions alongside member states.

Figure 1: Cumulative country count by year, since Sweden's 1973 law. Source: Graham Greenleaf, Global Data Privacy Laws 2025 and 172 Countries with Data Privacy Laws, Year by Year 1973-2025 (SSRN, 2025).

A second, independently run tracker gives a lower but directionally consistent number. UNCTAD's Global Cyberlaw Tracker counts 194 economies and found that 71% had data protection and privacy legislation in place at its most recent update, with 9% showing a bill still in draft and 15% showing no legislation at all. The two trackers differ because Greenleaf includes any enacted data privacy law, comprehensive or narrow, while UNCTAD scores each economy against its own e-commerce legislation checklist and updates on a different cycle.

Figure 2: Legislative status across the 194 economies UNCTAD tracks. Source: UNCTAD Global Cyberlaw Tracker, data protection and privacy legislation worldwide.

Why do different trackers report different country counts?

Three organizations publish country counts for privacy legislation, and each uses a different jurisdiction list and a different bar for what counts as a qualifying law, so the totals do not match even though all three are collecting real data in good faith.

Tracker	Countries with a law	Jurisdictions scored	Methodology note
Greenleaf's Global Data Privacy Laws 2025	172	Tracks back to 1973, includes territories	Academic tables, updated roughly every two years
UNCTAD Global Cyberlaw Tracker	137 of 194 (71%)	UN member states plus select economies	Government-sourced, continuously updated
DLA Piper Data Protection Laws of the World	160-plus jurisdictions profiled	Law-firm network coverage	Practitioner guide, updated per jurisdiction as laws change

Greenleaf's total is the highest of the three because his tables count any national data privacy law, including narrower sectoral or older laws that predate GDPR-style comprehensive frameworks, and because his jurisdiction list includes some territories that UNCTAD does not score separately. UNCTAD's 71% figure is the most conservative because its tracker only marks a jurisdiction as covered once government-verified legislation meets its own checklist, and its 194-economy list is not identical to Greenleaf's. Treat 172 as the broadest defensible count of countries with any data privacy law, and 71% as the most conservative confirmed share.

Which regions have the most and least legal coverage?

Coverage is far from even. Europe leads at 96% of countries with data protection legislation in place, according to UNCTAD's regional breakdown, largely because GDPR compliance is mandatory across the EU and most neighboring states have matched it voluntarily to preserve data flows. Africa trails at 50%, the lowest of the four regions UNCTAD tracks, though that share has been rising as more African Union member states adopt laws modeled on the AU's Malabo Convention.

Figure 3: Regional legislative coverage rates. Source: UNCTAD Global Cyberlaw Tracker, data protection and privacy legislation worldwide.

The gap matters for any business operating across borders: a company serving customers in Europe faces near-universal statutory coverage, while the same company serving customers across Africa or parts of Asia-Pacific may be dealing with a genuine patchwork where some countries have no enacted law at all. If your audience spans multiple regions, the safest baseline is still a single privacy policy built to the strictest applicable regime, since a document written to GDPR-level disclosure standards tends to satisfy lighter regimes automatically.

How fast is new privacy legislation being passed?

The pace of new laws has roughly doubled since GDPR took effect. Greenleaf's tables show 12 new countries enacting a first data privacy law in 2023 and 2024 combined, and the rolling average since 2020 sits at 5.4 new countries per year, up from 3.3 per year across the full 1973-2025 period.

Figure 4: Key milestones in privacy law adoption, 1973 to 2025. Source: Graham Greenleaf, Global Data Privacy Laws 2025 and companion year-by-year tables (SSRN, 2025).

Greenleaf's own analysis, published alongside the 2025 tables, notes that 2025 may mark a turning point: for the first time, the pace of countries revising or strengthening an existing law is outstripping the pace of countries passing a first law from scratch. That shift suggests the next phase of global privacy regulation is less about closing legislative gaps and more about tightening enforcement in countries that already have a law on the books.

What does it take for a law to count as GDPR-equivalent?

Not every one of the 172 counted laws matches GDPR's scope. A smaller, harder-edged group of countries have earned an EU adequacy decision, a formal European Commission finding that a country's data protection framework offers protection essentially equivalent to the EU's own, which lets personal data flow to that country without extra contractual safeguards.

Figure 5: How EU adequacy status splits countries that already have a privacy law. Source: European Commission adequacy decisions list, as of 2026.

As of 2026, the European Commission has issued adequacy decisions covering roughly 16 to 17 countries and territories, including Andorra, Argentina, Canada's commercial sector, Israel, Japan, New Zealand, South Korea, Switzerland, the UK, Uruguay, and the United States under the EU-US Data Privacy Framework for certified organizations. Brazil became the newest addition in February 2026 under a mutual adequacy agreement, meaning data can now flow in both directions between the EU and Brazil without extra transfer mechanisms. That leaves the overwhelming majority of the 172 countries with an enacted law outside the adequacy list, meaning any EU business sending them personal data still needs standard contractual clauses or another Article 46 transfer safeguard.

The Bottom Line

The headline number keeps moving in one direction: 172 countries now have some form of national data privacy law, up from 89 just over a decade ago, and the pace of new enactments has accelerated rather than slowed since GDPR took effect in 2018. But the country count on its own overstates how uniform global privacy law actually is. Coverage ranges from 96% of European countries down to 50% of African countries, and only a small adequacy-approved subset of the 172 offers the kind of frictionless EU data flow that many businesses assume comes automatically with "having a privacy law." For a business operating across two or more of these jurisdictions, the practical answer is the same regardless of which tracker's number you cite: build a privacy policy to the strictest regime your users touch, and treat lighter-regulated markets as a floor, not a ceiling.

Frequently Asked Questions

How many countries have a data privacy law in 2026? 172 countries had enacted a national data privacy or data protection law as of Graham Greenleaf's Global Data Privacy Laws 2025 tables, the most cited academic count of privacy legislation worldwide. That covers roughly 89 percent of the 195 UN member states plus non-member jurisdictions Greenleaf tracks.

What percentage of countries worldwide have data protection legislation? 71 percent of the 194 economies tracked by UNCTAD's Global Cyberlaw Tracker had data protection and privacy legislation in place as of its most recent update, with 9 percent showing draft legislation and 15 percent showing no legislation at all. UNCTAD's count differs from Greenleaf's 172 because the two trackers use different jurisdiction lists and cutoff dates.

Which region has the most countries with privacy laws? Europe has the highest coverage rate, with data protection legislation in 96 percent of countries, according to UNCTAD's regional breakdown. The Americas follow at 69 percent, Asia and the Pacific at 57 percent, and Africa at 50 percent, the lowest of the four regions UNCTAD tracks.

How many countries has the EU approved for adequate data protection? The European Commission had issued adequacy decisions covering roughly 16 to 17 countries and territories as of 2026, most recently adding Brazil in February 2026 following a mutual adequacy agreement. An adequacy decision lets personal data flow from the EU to that country without extra transfer safeguards.

Where the Numbers Come From

1. Graham Greenleaf. (2025). "Global Data Privacy Laws 2025: 172 Countries, Twelve New in 2023/24." Privacy Laws & Business International Report, SSRN preprint. 172 countries with an enacted law, 12 new in 2023-24.
2. Graham Greenleaf. (2025). "172 Countries with Data Privacy Laws, Year by Year 1973-2025." SSRN preprint, published March 2025. Year-by-year adoption counts since Sweden's 1973 law; 3.3 new countries per year average since 1973, rising to 5.4 per year since 2020.
3. UNCTAD. "Data Protection and Privacy Legislation Worldwide." Global Cyberlaw Tracker, 194 economies scored, 71% with legislation in place, 9% draft, 15% none.
4. UNCTAD. "Data and Privacy Unprotected in One Third of Countries, Despite Progress." Regional breakdown: 96% Europe, 69% Americas, 57% Asia-Pacific, 50% Africa.
5. European Commission. "Adequacy Decisions." List of countries and territories with an EU adequacy finding, updated on each new decision.
6. European Commission. (2026). "EU-Brazil Data Adequacy Agreement." Mutual adequacy decision between the EU and Brazil, announced February 2026.

Note: All figures verified as of July 2026. Country counts from Greenleaf's tables and UNCTAD's tracker are not directly comparable because each uses a different jurisdiction list and update cycle; both are refreshed periodically and this post's numbers are refreshed at least twice a year to track new editions.