The number of countries with comprehensive data privacy laws has reached 127, covering 85% of the world's population. However, enforcement capacity varies enormously between jurisdictions.
The EU's GDPR remains the gold standard, with €4.2 billion in fines issued since 2018. The US still lacks a federal privacy law, relying instead on a patchwork of state regulations led by California's CCPA.
India's Digital Personal Data Protection Act, which took effect in January 2026, covers 1.4 billion people and includes provisions specifically addressing AI systems' use of personal data.
The enforcement gap is the critical issue. Many countries have passed privacy laws but lack the institutional capacity to enforce them. Only 23 countries have privacy enforcement agencies with budgets exceeding $10 million.