OECD Privacy Guidelines

No changes recorded yet — we are watching, and nothing has been published.

1. 2021-01-07 Report to the Council on implementation of the Recommendation (C(2021)42), which concluded the Recommendation itself does not need revision
2. 2013-07-11 Council revises the Recommendation
3. 1980-09-23 OECD Council adopts the Recommendation

1. 2013-07-11
   OECD Privacy Guidelines (as revised 11 July 2013) RevisionCurrent

   The Council revised the Recommendation, focusing on practical implementation through risk management and on the global dimension of privacy; the core 1980 principles were kept. source

   More

   • New concepts include national privacy strategies, privacy management programmes and data security breach notification.
   • Other revisions strengthened accountability and privacy enforcement in the approach to data flows; a supplementary Explanatory Memorandum was produced.
2. 1980-09-23
   OECD Privacy Guidelines (1980) Major version

   Adopted by the OECD Council as the first internationally agreed set of privacy principles, with an Explanatory Memorandum. source

A recommendation to governments that adhere to it, setting principles for personal data in the public and private sectors.

Scope

Personal data, in the public or private sector, which because of the way it is processed, its nature or its context poses a risk to privacy and individual liberties. source

Eight principles

Collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. source

Data controllers

A data controller should have a privacy management programme and notify authorities, as appropriate, of a significant security breach; where data subjects are likely to be adversely affected, it should notify them too. source

Governments

Members should develop national privacy strategies, adopt privacy laws and establish privacy enforcement authorities with the resources and expertise to act effectively. source

Data flows

A data controller remains accountable for personal data under its control wherever the data is located; members should refrain from restricting transborder flows to a country that substantially observes the Guidelines, or where sufficient safeguards exist. source

Implementation is monitored through reports to the OECD Council, the next of which is scheduled for 2026.

Monitoring

The 2021 report to the Council found that all responding Adherents have privacy legislation and privacy enforcement authorities, and identified further implementation work. source

Guidance

In 2023 the Working Party developed Implementation Guidance on accountability, to be read with the 1980 and 2013 Explanatory Memoranda. source

Next report

The next report to the Council on implementation, dissemination and continued relevance is scheduled for 2026. source

Not legally binding: a political commitment that Adherents will do their best to implement it, put into effect through national privacy laws.

Legal force

OECD Recommendations are not legally binding; they represent a political commitment and an expectation that Adherents will do their best to implement them. source

National laws

The Guidelines have influenced legislation and policy in OECD countries and beyond, and Adherents describe them as the bedrock of their own national frameworks. source

1. Law text OECD/LEGAL/0188 — Recommendation and Guidelines (instrument page)
2. Guidance Report to the Council on implementation of the Recommendation, C(2021)42
3. Guidance About OECD legal instruments

1. GDPR

   Binding EU law with fines and supervisory authorities; the OECD Guidelines are a non-binding recommendation to governments.

2. ISO 29100

   An international standard of privacy terminology and principles for organizations, rather than a recommendation adopted by governments.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to OECD Privacy Guidelines (RSS)