Fragmented data transfer rules threaten privacy and hinder trade, UN expert warns

Brian Nougrères called on the private sector to apply “privacy by design” across all systems and processes, making the protection of personal information part of how those systems are developed and operated.

A growing patchwork of rules governing the movement of personal data across borders is exposing people to privacy risks and creating barriers to legitimate trade, a UN expert said today, warning that existing arrangements lack coherence, accessibility and effectiveness in protecting human rights.

Ana Brian Nougrères, the UN Special Rapporteur on the right to privacy, called on governments to strengthen national data protection laws and work towards a legally binding international agreement that would provide a more consistent framework for international data transfers.

Her report to the General Assembly examines the safeguards used to transfer personal information between countries and finds that their effectiveness depends on strong domestic protections, capable supervisory authorities, political commitment and people's understanding of their rights.

Existing transfer safeguards cannot protect privacy on their own

The report assesses adequacy mechanisms, standard contractual clauses, binding corporate rules, multilateral privacy mechanisms and complementary instruments, examining how effectively these arrangements uphold human rights when personal data moves across national borders.

"None of the instruments analysed is sufficient on their own to guarantee the right to privacy in cross-border flows of personal data," Brian Nougrères said, explaining that these tools depend on the legal and institutional conditions in which they operate.

She urged States to adopt or update national data protection legislation in line with international human rights standards, give data protection authorities greater capacity to monitor compliance with transfer instruments and promote digital literacy so that people can better understand and exercise their rights.

The recommendations connect the protection of personal information to the ability of authorities to supervise its transfer, recognising that rules and contractual safeguards require effective oversight to deliver meaningful protection.

Businesses need to build privacy into systems and decisions

Brian Nougrères called on the private sector to apply "privacy by design" across all systems and processes, making the protection of personal information part of how those systems are developed and operated. Businesses should also adopt clear policies governing international data transfers and conduct rigorous assessments of their potential impact, placing privacy considerations at the centre of decisions about sending personal information abroad.

The report calls for dialogue between regional systems and the development of practical guidance and cost-effective tools, giving developing countries and small and medium-sized enterprises greater support in implementing international data transfer mechanisms. Brian Nougrères described this support as key to integrating personal data protection into digital trade agreements and free trade agreement negotiations, connecting privacy safeguards with the rules that govern international commerce.

A binding international agreement would support a coherent framework

The Special Rapporteur urged States, supported by the international community, to begin negotiations on a legally binding international instrument governing international data transfers, taking forward efforts to address the fragmented regulatory landscape.

Her recommendations set out a path towards a coherent global framework with robust privacy safeguards, supported by stronger national laws, effective supervision, responsible business practices and greater public awareness.

The report builds on her earlier findings on the international collection of personal data, presented to the Human Rights Council at its 61st session in March 2026, extending that work through an examination of the mechanisms used to protect information transferred across borders.