Which country has the best privacy laws?
On the evidence of how privacy is actually protected online, Estonia comes out on top. A ranking by the Stevens Institute of Technology, built from Freedom House’s 2022 Freedom on the Net report, scored 70 countries out of 40 on the eight measures Freedom House uses for violations of internet users’ rights. Estonia scored 37, the highest of any country, earning full marks on six of the eight measures [1].
Stevens describes Estonia as having strong laws that protect personal information, no intrusive government surveillance system, and no prosecution or attacks on citizens for what they do online [1]. As an EU member, Estonia is also covered by the General Data Protection Regulation (GDPR), the EU law widely treated as the benchmark for data protection.
A good privacy law on paper is only part of the picture. The Freedom House measures look at whether laws protect free expression and are enforced by independent courts, whether people are punished for online activity, whether the state restricts encryption or anonymous communication, how far state surveillance and company data collection intrude on users’ privacy, and how common online intimidation and cyberattacks are [1][3]. That makes it a useful test of which countries protect privacy in practice, not just in law.
The best countries for internet privacy
These were the highest scores in the Stevens ranking, out of 40 (as of the 2022 Freedom on the Net data) [1]:
| Rank | Country | Privacy score (of 40) |
|---|---|---|
| 1 | Estonia | 37 |
| 2 | Iceland | 36 |
| 3 | Costa Rica | 33 |
| 4 | Canada | 32 |
| 5 | Georgia | 28 |
| 6 | Armenia | 26 |
| 7 | Germany | 26 |
| 8 | Japan | 26 |
| 9 | South Africa | 26 |
| 10 | United Kingdom | 25 |
Italy, Serbia, Taiwan, Kenya, Australia, the United States and Argentina all scored 25 as well, and France 24 [1]. Ties were split by how much each country’s score had changed since 2016. The infographic by Stevens maps every country’s score and its overall internet freedom rating, which makes it easy to compare regions at a glance.
There is a big gap after the top four. Estonia, Iceland, Costa Rica and Canada were the only countries to score above 30, and even well-regarded democracies such as Germany, Japan and the UK lost points, mostly on state surveillance and the collection of user data by tech companies [1]. Only 70 countries are covered by Freedom on the Net, so many smaller European countries, including the Nordic countries other than Iceland, are not in the ranking at all [2].
Why the EU’s GDPR is seen as the gold standard
When people ask which countries have the best privacy laws, the usual answer starts with the European Union. The GDPR entered into force on 24 May 2016 and has applied since 25 May 2018 [4]. It covers all 27 EU member states and, through the EEA Agreement, Norway, Iceland and Liechtenstein [4]. Stevens chose 2016 as its comparison year for that reason, describing the GDPR as “a gold standard for data protection laws all over the world” [1].
The GDPR gives people rights over their data, including access, correction and erasure, requires a lawful basis for processing personal data, and sets rules for reporting breaches. Its fines for the most serious breaches can reach 20 million euros or 4% of a company’s worldwide annual turnover, whichever is higher [5].
The EU also judges whether other countries’ laws offer equivalent protection. So far the European Commission has recognised Andorra, Argentina, Brazil, Canada (for commercial organisations), the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, South Korea, Switzerland, the United Kingdom, the United States (for companies in the EU-US Data Privacy Framework) and Uruguay as providing adequate protection [6]. For businesses, that list is a practical guide to the countries with privacy laws the EU considers as strong as its own.
How the United States and UK compare
The United States scored 25 out of 40, level with the UK, Australia and several others, and down 2 points since 2016 [1]. Freedom House noted in 2022 that the US still lacks a comprehensive federal privacy law [2]. Instead it has a patchwork of state laws and laws for particular sectors such as health and children’s data. The US is on the EU adequacy list only for companies that sign up to the Data Privacy Framework [6].
The United Kingdom kept the GDPR in its own law after leaving the EU, alongside the Data Protection Act 2018, and the EU renewed its adequacy decision for the UK in December 2025 [6]. The UK was one of the few countries whose privacy score improved between 2016 and 2022, up 1 point [1].
Countries with the weakest internet privacy
China came last, scoring 0 out of 40, the lowest possible score on every one of the eight measures [1]. Freedom House named China the world’s worst environment for internet freedom for the eighth year in a row in 2022 [2]. Stevens points to laws limiting what people can access, the threat of fines or prison for online activity, close monitoring of what users do and severe limits on anonymous communication [1].
Just above China, Myanmar, Egypt, Vietnam, Saudi Arabia and Iran each scored 4, with Belarus and Russia on 6 [1]. Myanmar, where the military seized power in 2021, had the steepest fall since 2016, losing 9 points, followed by Rwanda (down 7) and the Philippines, Nigeria, Kyrgyzstan, Cambodia and Belarus (down 6 each). The Gambia improved the most, up 7 points [1]. Overall, Freedom House found that global internet freedom fell in 2022 for the 12th year running [2].
How many countries have data protection laws?
Most countries now have some form of data protection law. UNCTAD’s Global Cyberlaw Tracker records 155 of 195 countries with data protection and privacy legislation, five more with draft laws and 33 with none, as of September 2026 [7]. Having a law, though, does not mean it is enforced, or that it limits government surveillance. China, Russia, Saudi Arabia, Egypt and Vietnam, all near the bottom of the Stevens ranking, are recorded as having data protection legislation [7], yet they scored 6 or less out of 40 on protecting users’ privacy and rights online [1].
Questions about countries with the best privacy laws
Which country is best for internet privacy?
Estonia, with 37 out of 40 in the Stevens Institute ranking based on Freedom House’s 2022 data. Iceland (36), Costa Rica (33) and Canada (32) follow [1].
Which countries have the strictest data privacy laws?
The EU and EEA countries under the GDPR have the most demanding general data protection rules, with fines of up to 4% of worldwide turnover [5]. The European Commission also recognises the laws of countries such as Switzerland, the UK, Japan, South Korea, New Zealand, Canada and Brazil as giving adequate protection [6].
Which country has the worst internet privacy?
China, which scored 0 out of 40 on every privacy measure in the Stevens ranking [1].
Does the United States have a federal privacy law?
No. As Freedom House noted in its 2022 report, the US still lacks a comprehensive federal privacy law, and relies on state laws and sector-specific rules [2].
What is the most data secure country?
On user rights and privacy, Estonia scored highest in the Stevens ranking [1]. Stevens also says Estonia ranks third in the world for its commitment to cybersecurity [1].
Sources
- Stevens Institute of Technology, Countries Ranked by Internet Privacy, 3 May 2023 (archived copy). The creator’s page with this infographic.
- Freedom House, Freedom on the Net 2022, Countering an Authoritarian Overhaul of the Internet.
- Freedom House, Freedom on the Net scores.
- European Commission, Legal framework of EU data protection.
- GDPR, Article 83, general conditions for imposing administrative fines.
- European Commission, Adequacy decisions.
- UNCTAD, Global Cyberlaw Tracker, data protection and privacy legislation worldwide, updated 9 September 2026.
Last reviewed 5 November 2026
