How we research this
Every country record is produced by running one prompt against live government sources, then reviewed by a person. The prompt is versioned, and each record stores the version used, so any answer on this site can be reproduced.
The rules the research must follow
- 1. Nothing from memory. Every time-sensitive claim is verified during the run.
- 2. A government link for every claim. If the only source is a law firm or a news report, confidence drops and the gap is listed openly.
- 3. Say when a rule bites. Adopted, in force, and actually enforceable are three different dates. We record all three.
- 4. Never state a negative as fact. “No rule found, checked on this date” — not “there is no rule”.
- 5. Publish the gaps. The “What we're not sure about” section is a required part of every record.
The exact prompt
This is the text the Refresh button on a country page runs, with the country name and today's date substituted in.
# Research prompt — build or refresh a country's data governance record
**Prompt ID:** `research_country`
**Version:** 1.0
**Last changed:** 2026-08-18
**Referenced by:** every jurisdiction record's `provenance.research_prompt_ref`
> This is the exact prompt the "Refresh" button runs. Substitute the three placeholders and send it to a research agent with web search and web fetch. Bump the version whenever the text changes, and record the version used in `provenance.research_prompt_version` so any record can be reproduced.
**Placeholders:** `{{COUNTRY}}` · `{{TODAY}}` · `{{EXISTING_RECORD_JSON}}` (empty string on first build)
---
```
Today is {{TODAY}}. Research the CURRENT state of data governance and data storage rules
for {{COUNTRY}} and return a single JSON object conforming to the DGN v0.1 jurisdiction
schema.
If {{EXISTING_RECORD_JSON}} is non-empty, treat it as the previous version of this record.
Your job is then a REFRESH: re-verify every claim in it from scratch, and report what
changed. Do not assume a previous claim is still true because it was true last time —
that is the entire point of the refresh.
=== NON-NEGOTIABLE RULES ===
1. DO NOT ANSWER FROM MEMORY. Every time-sensitive claim must be verified by an actual
search or fetch performed during this run. Your training data is stale by definition
and this domain changes monthly.
2. EVERY CLAIM NEEDS A GOVERNMENT BACKLINK. Each answer and each rule must cite at least
one source hosted on an official government or regulator domain for that country —
the gazette, the statute text, the regulator's own site, or the court's own site.
Law firm summaries and news articles are excellent for FINDING things and unacceptable
as the sole citation for asserting them. If you can only find a professional or media
source, still include it, but set confidence to "dg:conf:medium" or lower and add an
entry to the "unconfirmed" array explaining that the government backlink is missing.
3. QUOTE THE OPERATIVE TEXT where it is short enough. A verbatim sentence from the
regulator beats three paragraphs of paraphrase.
4. SAY WHEN IT BITES, NOT JUST THAT IT EXISTS. Distinguish: adopted / in force /
actually enforceable. Many laws are in force with obligations that do not bite for
years. Record all three dates.
5. NEVER ASSERT A NEGATIVE AS FACT. Write "no rule found, checked {{TODAY}}, confidence
medium", not "there is no rule".
6. FLAG WHAT YOU COULD NOT CONFIRM. The "unconfirmed" array is a required deliverable,
not an afterthought. An honest gap is more valuable than a confident guess.
=== ANSWER THESE EIGHT QUESTIONS ===
Q1 SCOPE — Does it reach a foreign company with no local office? Any size or revenue
threshold? Is a local representative required?
Q2 CAN THE DATA LEAVE? — Rate the country on exactly one of: open / conditional /
sectoral / mirror / closed. Then list every SECTOR that overrides that headline, each
with its own rating. Search specifically for sector rules in: banking, payments,
insurance, securities, health, telecom, government cloud, education, gaming,
mapping/geospatial, and defence. THIS IS THE MOST IMPORTANT AND MOST TIME-CONSUMING
PART — budget most of your effort here. The headline answer is almost never the real
answer.
Q3 HOW TO TRANSFER — What must be in place before data leaves? Is the model a blocklist
(banned only if listed), an allowlist (banned unless approved), case-by-case approval,
or unrestricted? CRITICALLY: is the list actually populated right now? An empty
blocklist is a completely different risk picture from a full one.
Q4 WHO ENFORCES — Name the regulator(s) and link their own sites. Then answer the
question everyone skips: IS IT ACTUALLY OPERATIONAL? Is it staffed? Has it issued
decisions? Rate enforcement as dormant / waking / active / aggressive based on
observable evidence, not on how strict the text reads. If sources disagree about
whether a regulator has been constituted, trust the regulator's own recruitment
notices over secondary commentary.
Q5 RETENTION — Both directions. The FLOOR (minimum periods you must keep: tax, company,
transaction, security logs) and the CEILING (when you must delete). Note how the
country resolves a conflict between them.
Q6 WHEN IT BREAKS — Breach and incident reporting deadlines in hours. Count the clocks:
most countries have two or more overlapping regimes with different deadlines, and
that overlap is the most common operational failure.
Q7 TRAPS — Three to five things that are not in the summary and cost someone their
weekend. Look especially for: children's age thresholds that differ from the global
norm, criminal (not administrative) liability, contractual requirements beyond a
standard processor agreement, in-country personnel requirements, and rules that are
printed in the statute but unenforceable.
Q8 WHAT'S COMING — Anything landing in the next 12 months, with dates. Separately list
DORMANT SWITCHES: powers the government already holds that could change the picture
overnight with no consultation. These matter more than pending legislation.
=== WATCH FOR THESE FOUR STATES ===
Most trackers get these wrong. Use the right status code:
- partially-in-force : some provisions commenced, others not
- abeyance : formally adopted, suspended by the regulator, revivable without notice
- disapplied : printed in the law but unenforceable by superior law (e.g. struck
down by a higher court but never repealed)
- proposed : a bill, with no legal effect — do not present these as binding
A rule that is "on the books but not enforceable" reads as binding to a naive text search.
Catching these is a large part of this record's value.
=== OUTPUT ===
Return ONLY a JSON object matching the DGN v0.1 schema. Required top-level keys:
dgn_version, id, jurisdiction, name, belongs_to_bloc, last_verified, headline, questions,
rules, authorities, unconfirmed, provenance.
Write every "plain" field for a smart person with NO legal or technical background:
short sentences, no acronym without expansion on first use, no Latin, no section numbers
in the plain text (put those in "detail" and in the citation). If a sentence would confuse
a competent 16-year-old, rewrite it.
Set provenance.last_refreshed to {{TODAY}}, provenance.research_prompt_version to the
version of this prompt, and choose refresh_interval_days by volatility:
30 days — a live challenge to a transfer mechanism, or a law commencing in phases
60 days — dormant switches that can flip without consultation
90 days — stable regime, active regulator, no pending change
180 days — stable and quiet
If this was a REFRESH, also return a top-level "diff" key: a short, human-readable list of
what changed since the previous record, what was confirmed unchanged, and what you could
no longer verify. This is displayed in the country page's changelog.
```
---
## Notes for whoever maintains this
- **The prompt is data.** It lives in version control, it is referenced by ID and version from every record, and the exact rendered text can be stored in `provenance.research_prompt_inline` so a refresh is byte-for-byte reproducible.
- **Refreshing is not the same as building.** The refresh path passes the previous record and demands a diff. Without that, refreshes silently drift and nobody notices a rule was quietly dropped.
- **Rule 1 is load-bearing.** In testing this framework on India and Germany, a model answering from memory got the Indian regulator's staffing status wrong, missed a telecom localisation rule notified four weeks earlier, and asserted that Germany still enforced telecoms data retention that courts disapplied in 2023. All three were caught only by forcing live verification.
- **Rule 2 is what makes the site credible.** It is also the rule most likely to be quietly relaxed under time pressure. Enforce it in validation, not just in the prompt.
- **Consider a second agent as an adversarial checker** before publishing: give it the produced record and ask it to refute each claim. On the pilot run this is what caught secondary sources incorrectly reporting an Indian regulator appointment that the regulator's own vacancy notices contradicted.