A field report from compliance country

By 2030, there will be more data protection laws than there are work days in the year.

Part one — the scale

The number is bigger than you think.

For most of the post-GDPR era, "data protection law" in corporate conversation has meant a small, manageable handful of statutes: GDPR, CCPA, perhaps Brazil's LGPD if you run anything in São Paulo. That mental model has not aged well.

Two hundred and thirty-three separate statutes, regulations, treaties and amendments, spread across 179 jurisdictions. Roughly 6.6 billion people live under at least one of them. The growth in the last six years alone is 35%.

The geographical coverage is, as of 2026, effectively total. 162 sovereign countries have enacted comprehensive data protection laws — every populated continent at majority coverage, with the gap between best (Europe, at 100%) and worst (the Middle East, at 67%) now just 33 percentage points. Africa alone went from three laws in 2010 to 42 today — a fourteen-fold increase in sixteen years.

The United States is a category of its own. There is no federal comprehensive privacy law — only sectoral ones (HIPAA, COPPA, GLBA) covering specific data types. But 20 of its 50 states have written their own version, and three more are drafting. The map below shows the world first, then the US state by state.

Part one (continued) — the cost

The polite-letter era is over.

For roughly the first decade of European data protection enforcement, fines were modest. That changed with GDPR's enforcement provisions: up to €20 million or 4% of global annual turnover, whichever is higher. Regulators have since shown an appetite for the higher number.

US enforcement, which had been quieter, is no longer quieter. In 2024, the State of Texas alone secured a $1.4 billion settlement against a single technology company over biometric data collection. One state. One case.

Brief detour — how we got here

It started in 1970, with a fear of mainframes.

On 30 September 1970, the German federal state of Hesse — population six million, capital Wiesbaden — became the first jurisdiction anywhere in the world to pass a comprehensive data protection law. The Hessisches Datenschutzgesetz was not a response to the internet, or to corporate surveillance, or to anything most readers of this article would recognise as a modern privacy concern. It was a response to mainframes.

In the late 1960s, West German public administration was being computerised at speed. IBM System/360s and their European competitors were arriving in state offices, replacing paper registries and rooms full of filing cabinets. For the first time in history, a government department could combine information about a citizen — tax records, address, employment, military service, criminal record — at industrial speed and across previously separate registries. Citizens noticed. Constitutional lawyers noticed faster.

The Hesse law was a direct answer: it regulated automated processing of personal data by public bodies, set rules for when registries could be combined, and — quietly, decades before the rest of the world caught up — established the Hessischer Datenschutzbeauftragter, the world's first independent data protection authority. The phrase "personal data" did not yet exist in any other legal system. Thirteen years later, in 1983, the German Federal Constitutional Court would name the underlying principle informationelle Selbstbestimmung — informational self-determination — and the template for everything that followed was set.

Other countries followed slowly. Sweden in 1973 — the first national law. France, Denmark, Norway later that decade. The Council of Europe's Convention 108 in 1981. By 2015, there were 91 such laws worldwide — a number a working compliance team could plausibly keep in its head. Then, on 25 May 2018, the GDPR went live, and the curve stopped being a curve.

Part two — where this is going

The line is [not] bending.

Since 2020, the world has been adding 15 to 18 new comprehensive data protection laws per year, and several major amendments per year on top. Nothing about the current trajectory suggests a slowdown — quite the opposite. The AI regulation wave, led by the EU AI Act and the Council of Europe's 2024 AI treaty, adds an entirely new category of instruments on top of the privacy stack.

The trajectory, projected

Cumulative comprehensive data protection statutes and amendments in force worldwide, with projection to 2030 at the post-GDPR pace.

At current pace, the world reaches roughly 310 distinct laws by 2030. That projection is conservative: it extrapolates the base rate without accounting for the AI wave, the second generation of US state laws, or the dozen or so jurisdictions currently drafting bills.

The more interesting question is not the count but the texture. Three trends matter more than the total number: extraterritorial scope (your customers' jurisdiction matters more than yours), enforcement convergence (regulators sharing case files), and AI overlay (every privacy law now has an AI provision, written or pending).

Part two (a small interlude)

The slightly less serious extrapolation.

With apologies to the data, the future also contains scenarios that are statistically improbable but emotionally accurate. Compiled with input from one tired compliance officer.

Epilogue — what to be ready for

You cannot memorise 310 regulations. You can prepare for them.

The good news is that most data protection laws rhyme. They share roughly the same core: lawful basis, data subject rights, breach notification, cross-border transfer mechanisms, accountability. The bad news is that the rhymes are imperfect, and the differences are exactly where the fines live.

The practical question for the next four years is not which laws apply to your organisation — increasingly, the answer is most of them — but whether your operating model can answer the same compliance question 179 different ways without collapsing. Six capabilities matter more than the others.

The question is no longer whether your organisation needs a data protection strategy. It is whether the one you have can handle 310 overlapping regulations across 179 jurisdictions on six continents — while a 20-state American patchwork keeps growing, AI rules keep tightening, and enforcement records keep breaking.

It started in 1970, in one German state, about mainframe databases. It is now the largest body of cross-border regulation humanity has ever attempted to maintain. It is also still accelerating.