Data Flows & Digital Trade Governance

1866 · 160 years ago

The transatlantic telegraph cable created the first durable cross-border data link

A permanent cable between Ireland and Newfoundland cut transatlantic communication from roughly ten days by ship to minutes, establishing the undersea-cable infrastructure model that still carries the great majority of international data traffic today.

1980 · 46 years ago

The OECD issued the first international guidelines on data flows

The Guidelines on the Protection of Privacy and Transborder Flows of Personal Data sought to prevent privacy rules from becoming unjustified barriers to trade, shaping data protection law across member states for decades.

1995 · 31 years ago

The European Union restricted data transfers to countries without adequate protection

Directive 95/46/EC introduced the concept of adequacy, barring transfers of personal data to third countries unless their laws provided a comparable standard of protection, a model later inherited by the GDPR.

1998 · 28 years ago

WTO members agreed a moratorium on customs duties for electronic transmissions

The Declaration on Global Electronic Commerce committed members not to impose customs duties on data sent across borders electronically, a standstill renewed at every ministerial conference until it lapsed in 2026.

2011 · 15 years ago

APEC economies launched the Cross-Border Privacy Rules system

Asia-Pacific Economic Cooperation members created a voluntary certification scheme allowing companies to demonstrate compliance with common privacy standards across participating economies, the forerunner of today's Global CBPR Forum.

2013 · 13 years ago

Edward Snowden's disclosures exposed the scale of US digital surveillance

Leaked documents revealing mass collection of communications by US intelligence agencies undermined trust in transatlantic data transfers and gave momentum to data localisation and sovereignty arguments worldwide.

2015 · 11 years ago

Russia required personal data on citizens to be stored domestically

Amendments to Russia's data protection law obliged operators collecting personal data on Russian citizens to use databases located within the country, becoming one of the earliest strict data localisation regimes and a model since echoed elsewhere.

2017 · 9 years ago

China introduced security assessments for cross-border data transfers

The Cybersecurity Law required operators of critical information infrastructure to store certain data domestically and pass a security assessment before sending it abroad, establishing the foundation of China's data sovereignty regime.

2018 · 8 years ago

The European Union brought the General Data Protection Regulation into force

The regulation set conditions for transferring personal data outside the European Economic Area, including adequacy decisions and standard contractual clauses, and became the reference model copied or adapted by dozens of countries worldwide.

2020 · 6 years ago

The Court of Justice of the EU struck down the EU-US Privacy Shield

The ruling found that US surveillance law failed to offer EU citizens adequate redress, invalidating the second transatlantic transfer mechanism after Safe Harbour and forcing companies onto standard contractual clauses with supplementary safeguards.

March 2026 · 5 months ago

The WTO let the e-commerce moratorium lapse after members failed to agree at MC14

Ministers meeting in Yaoundé, Cameroon failed to extend the 1998 moratorium on customs duties for electronic transmissions, which lapsed on 30 March 2026 after members could not agree a text.

• A 66-member coalition pledged to keep transmissions duty-free

January 2026 · 7 months ago

China opened a third route for cross-border data certification

Measures jointly issued by the Cyberspace Administration of China and the market regulator took effect on 1 January 2026, adding certification alongside security assessment and standard contracts as compliance pathways for transferring personal information abroad.

• The Cyberspace Administration of Shanghai published cases of illegal transfers

2026 · this year

Amazon Web Services committed 5.3 billion US dollars to a Saudi cloud region

AWS confirmed plans to open a dedicated cloud infrastructure region in Saudi Arabia during 2026, part of a wider build-out by hyperscale providers responding to data residency and localisation requirements across the Gulf.

2026 · this year

South Korea's Personal Information Protection Commission ordered a wallet operator to delete data transferred to Alipay

The regulator found that a domestic digital wallet provider had sent the personal data of around 40 million users to the Chinese payments firm Alipay without adequate legal grounds, and ordered deletion of the data and associated algorithms.

November 2025 · 9 months ago

India finalised rules allowing data transfers to any country by default

The Digital Personal Data Protection Rules confirmed that cross-border transfers are permitted unless a destination is placed on a government negative list; by mid-2026 no such list had been published, leaving the regime largely open.

September 2025 · 11 months ago

The EU General Court upheld the EU-US Data Privacy Framework against a legal challenge

Judges dismissed a challenge seeking annulment of the European Commission's adequacy decision for transatlantic transfers, though an appeal to the Court of Justice followed, leaving open a third framework collapse after Safe Harbour and Privacy Shield.

September 2025 · 11 months ago

Nigeria brought a tiered adequacy test for data transfers into force

The Data Protection Commission's General Application and Implementation Directive set out approved transfer instruments, including standard contractual clauses, for businesses moving personal data out of the country under the 2023 Data Protection Act.

• Kenya issued its own cross-border transfer regulation

June 2025 · last year

The Global Cross-Border Privacy Rules Forum brought its interoperable certification system into live operation

The Global CBPR and Privacy Recognition for Processors systems began certifying companies against a shared set of transfer standards across member economies, with around 100 companies covering more than 2,000 entities certified at launch.

• Nigeria joined as the forum's first African associate

June 2025 · last year

Vietnam enacted its first standalone data protection law

The Personal Data Protection Law, passed in June 2025, tightened obligations on cross-border transfer impact assessments and barred processing based on loosely defined legitimate interest, extending rules first set out in an earlier decree.

February 2025 · last year

The African Union adopted eight annexes to the AfCFTA Digital Trade Protocol

The annexes covered cross-border data transfers, digital identity, payments and cybersecurity, giving substance to a protocol signed in 2024 that still awaits the 22 ratifications needed to enter into force continent-wide.