![172 Countries Now Have a Privacy Policy Law [2026 Study]](/_astro/privacy-policy-laws-by-country-2026.zNFTCbK3_Z1vtKvJ.webp)
172 countries and self-governing jurisdictions now have a comprehensive data protection law that obligates businesses to give people notice about how their personal data is collected and used, according to David Banisar's Data Protection Update and Map, 2026 edition, published January 26, 2026. That notice obligation is what a public privacy policy exists to satisfy. Adoption has more than doubled since 2011, but growth slowed sharply in 2025, and a handful of large economies, most notably the United States, still have no single national law.
How many countries require a privacy policy by law?
172 countries and territories had adopted a comprehensive data protection law as of Banisar's January 2026 count, covering 146 of 193 UN member states directly by statute. Not every one of those laws uses the exact phrase "privacy policy," but nearly all of them share a core transparency requirement: tell the people whose data you collect what you are doing with it, usually in a public, written notice. That requirement is why a privacy policy has become the default way businesses in these countries satisfy the law.
Figure 1: 172 countries and self-governing jurisdictions now have a comprehensive data protection law. Source: David Banisar, Data Protection Update and Map, 2026 edition (January 26, 2026).
A generic privacy policy written for one market rarely covers what a law in a different country actually requires, which is why a privacy policy generator built to track current requirements matters more as this list of countries keeps growing.
What share of UN member states have a privacy law?
Counting UN member states alone rather than every territory, Banisar puts direct statutory coverage at 146 of 193, or 76%, with 5 more member states regulating data protection by executive decree instead of a statute. Add those 5 in and Banisar's own reported figure for UN member state coverage rises to 79%, meaning roughly 1 in 5 UN member states still has no data protection framework of either kind.
Figure 2: Share of UN member states with a data protection law or decree, January 2026. Source: David Banisar, Data Protection Update and Map, 2026 edition.
Coverage by population is even higher than coverage by country count, because several of the largest population countries, including the EU bloc, Brazil, and India, are among the 146 with a statute already in force.
How has global privacy law adoption changed since 2011?
Adoption has climbed steadily for 15 years. Graham Greenleaf's Global Tables of Data Privacy Laws, published through the UNSW Law Research Series, counted 76 countries with a data privacy law in 2011, rising to 109 by 2015 and 162 by 2023. Banisar's tracker picks up the same trend line and puts the January 2026 count at 172.
Figure 3: Countries and territories with a comprehensive data protection law, 2011 to 2026. Source: Graham Greenleaf, Global Tables of Data Privacy Laws (UNSW Law Research Series), and David Banisar, Data Protection Update and Map, 2026 edition.
Growth has not been constant year to year. Banisar counted 11 new adopting countries in 2021, the fastest single year on record, before the pace slowed to just 5 new countries in 2025.
Figure 4: New countries adopting a first comprehensive privacy law each year, 2021 to 2025. Source: David Banisar, Data Protection Update and Map, 2026 edition.
Brunei, Gambia, Bangladesh, Djibouti, and Vietnam were the 5 countries that adopted a first comprehensive law in 2025, the slowest year since Banisar's tracker began recording annual counts in 2015.
How does adoption vary within Europe and Africa?
Adoption is not just a country-by-country count. Two regional treaties also measure how far privacy law has spread within a bloc, and neither has finished the job. The Council of Europe's Convention 108+ needs ratification by 38 countries to enter into force; only 33 had ratified as of the 2026 update, with Greece and Monaco the most recent additions. Within the African Union, the Malabo Convention had been signed by 21 member states but ratified by only 16, short of universal adoption across the bloc's 55 members.
Figure 5: Two regional privacy treaties are both still short of full ratification. Source: David Banisar, Data Protection Update and Map, 2026 edition.
Both treaties show the same pattern seen at the global level: individual countries pass their own national laws faster than blocs can agree on a shared regional standard.
Website-level adoption tells a related but separate story from country- level law; see our data on how many websites actually publish a privacy policy for how legal requirement and real-world compliance diverge even within countries that already have a law on the books.
Which countries still have no privacy policy law?
About 20 countries have no comprehensive data protection framework at all, per Banisar's 2026 tracker, including Iran, Iraq, Sudan, Eritrea, and North Korea. That count is separate from the United States, which is not on Banisar's no-law list because it has sectoral federal statutes and a growing patchwork of state privacy laws, but which still has no single comprehensive national law of the kind most of the other 172 countries have adopted. Roughly 20 more countries, including Pakistan, Cambodia, and Guatemala, have draft legislation pending.
A country having no national law does not mean a business operating there is exempt from every other country's rules; a company serving customers in the EU, California, or any of the other 172 covered jurisdictions still has to meet those laws' requirements regardless of where it is based.
How does the country count compare across trackers?
| Tracker / snapshot | Countries counted | As of | Source |
|---|---|---|---|
| Greenleaf's Global Tables | 76 | 2011 | UNSW Law Research Series |
| Greenleaf's Global Tables | 162 | 2023 | UNSW Law Research Series |
| Banisar's Data Protection Update and Map | 167 | Jan 2025 | International Data Protection Day update |
| IAPP Global Privacy Law and DPA Directory | 144 | Jan 2025 | IAPP Research and Insights |
| Banisar's Data Protection Update and Map | 172 | Jan 2026 | Data Protection Update and Map, 2026 |
Source: as cited per row above; full citations in Where the Numbers Come From.
The 23-country gap between the IAPP's count and Banisar's count for the same month, January 2025, comes down to definitions rather than a disagreement over facts: the two projects draw the line for "comprehensive" differently, and both are transparent about their methodology.
The Bottom Line
172 countries and self-governing jurisdictions now require the kind of transparency that a privacy policy exists to provide, up from 76 just 15 years ago, and the trend line has not reversed even as the annual pace of new adoptions slowed in 2025. A business collecting personal data online is far more likely today to be operating in a country with a privacy law than not, and that is true even before counting the United States, whose state-level patchwork covers most of its population without a single federal statute. The practical implication is the same for a site owner in any of the 172 countries or the roughly 20 still without a law: a current, jurisdiction-aware privacy policy is the default way to meet a notice obligation that keeps expanding, not shrinking.
Frequently Asked Questions
How many countries have a privacy policy law? 172 countries and self-governing jurisdictions have adopted a comprehensive data protection law as of January 2026, according to David Banisar's Data Protection Update and Map, which tracks national privacy legislation worldwide.
What percentage of the world lives under a privacy law? About 85% of the global population now lives in a country with a comprehensive data protection law in force, per Banisar's January 2026 update, up from roughly 83% one year earlier.
Which major countries have no comprehensive privacy law? The United States has no single federal privacy law and relies on a state-by-state patchwork instead, and Banisar counts about 20 countries with no comprehensive data protection framework at all, including Iran, Iraq, Sudan, Eritrea, and North Korea.
Why do different trackers report different country counts? Definitions vary. The IAPP's Global Privacy Law and DPA Directory counted 144 countries with a law in effect in January 2025, while Banisar's tracker counted 167 for the same month, a 23-country gap that comes down to how each project defines a comprehensive law.
Where the Numbers Come From
- David Banisar. (2026). "Data Protection Update and Map, 2026 Edition." Published January 26, 2026. 172 countries and jurisdictions, 146 of 193 UN member states, 79% coverage including executive-decree jurisdictions, 85% of world population, and the 2021-2025 new-adopter counts used throughout this post.
- David Banisar. (2025). "International Data Protection Day 2025 Global Update and Map." Published January 28, 2025. 167-country count and 83% population figure used for the year-over-year comparison.
- IAPP Research and Insights. (2025). "Data protection and privacy laws now in effect in 144 countries." Published January 28, 2025. Alternate tracker count used for the methodology comparison.
- Graham Greenleaf. (2023). "Global Data Privacy Laws 2023: 162 National Laws and 20 Bills." UNSW Law Research Series. Historical country counts for 2011 through 2023 used in the adoption trend chart.
Note: All figures verified as of January 2026, the date of the most recent Banisar update cited above. Global privacy law adoption counts are refreshed at least twice a year as new countries pass legislation and trackers publish updated editions.
