Does this apply to me?

Answer three questions. We'll list the countries whose data rules reach you, why each one applies, and the first thing to do about it.

Where is your company based?

Where do your users live?

What does your product do?

Three things decide whose rules you follow — and they stack.

You don't pick one. You have to satisfy all of them at the same time.

1. Where your users live. This is the big one and it surprises people. Most modern privacy laws apply to you even if you have no office, no staff and no company in that country. If you offer your product to people in India, Brazil or the EU, their law applies to you directly. A US startup with users in twelve countries is subject to twelve sets of rules.
2. Where your company is based. Your home country's rules apply to you no matter where your users are.
3. Where the data physically sits. The country hosting your servers can reach that data — including its government. This is why storage location still matters even when no law forces you to pick one.

On top of those, industry rules follow the activity, not the company. If you process payments in India, India's payments rules apply to you whether or not you're Indian.

These can genuinely conflict. One country can require you to hand data to its authorities while another forbids you from doing so. When two rules on your list disagree, that is the point to get a qualified adviser.

Your list

Hardest first: countries that force data to stay put, then by how much work each one creates.

Pick your company's home country, or the countries your users live in, and the list appears here.

This list is a starting point, not legal advice. Open any country to read the rules behind it — every claim links to the government's own website. Nothing here is stored: the answers live in this page's address, so you can share it with your team.

Browse every country instead