Which Countries Have the Best Cloud Privacy Laws in 2020?

Privacy laws vary from country to country. Some places have policies that are aimed at protecting their citizens, while others have laws that look good on the surface but are so broad they allow authorities to access a lot of personal data.

Then, there are countries that simply don’t honor privacy at all.

When it comes to cloud services, it’s a good idea to note which country they’re based in. The countries with the most privacy-friendly laws are the best places to base services such as virtual private networks, backup and storage. In this article, we’re going to look at which countries have the best cloud privacy laws, so you can choose a service wisely.

Countries to Avoid

There are countries that you should just avoid if you value your privacy. For starters, the U.S. is well known for government surveillance and internet service providers spying on their customers. Then there’s China, where VPNs are basically illegal and the internet is mostly blocked by its Great Firewall.

Many other countries have active surveillance and monitoring, too. India has a tool called NETRA that collects and analyzes internet traffic data. Read our best VPN for Russia guide for another example of an online surveillance tool being used, SORM. Our best VPN for France article shows how an illegal database with data on millions of its citizens was made in secret.

Other countries, such as Malaysia, Bangladesh, Qatar and Pakistan, have been found to use the spy software FinFisher, and many of the nations listed in our top five are guilty of some sort of monitoring or surveillance.

Luckily, there are still a few countries that respect privacy and they are a good choice if you want to keep your data secret.

Switzerland

Switzerland is probably the best place to be for privacy. Article 13 of the Swiss constitution guarantees citizens’ their right to privacy and there are strict federal laws in place to protect your data. The Federal Data Protection Act and the Data Protection Ordinance protect personal data and prohibit any processing of it unless authorized by the subjects or law.

Data controllers and processors are required to keep a record of their data processing activities. The consent of the subjects must be obtained when processing sensitive data. Disclosing such data to third parties without permission is a breach of data protection, which could lead to fines.

People and companies are covered by the regulations. You are in control of your data and you can ask a data controller to tell you if your personal data is being collected. With that in mind, if you want to guarantee that your data and files are safe from snooping, choosing a cloud service that is based in Switzerland is a no-brainer.

Tresorit and pCloud are cloud storage companies based in Switzerland and both are good choices with excellent privacy. They have zero-knowledge encryption, too, which means only you can see the files you store with them. Even the company you are using won’t be able to see them. If it’s cloud storage you’re after, read our pCloud review and Tresorit review for more.

Other companies that make use of Switzerland’s privacy laws are VyprVPN and ProtonVPN. VyprVPN is managed by Golden Frog GmbH, which says it is incorporated in Switzerland because the country’s favorable privacy laws reflect its mission as a company. You can read our VyprVPN review and ProtonVPN review for more information about the services.

Norway

Norway is another country that believes in privacy. It has the Norwegian Data Protection Authority, which is an independent public authority set up to protect individual’s privacy. It upholds many acts and regulations for data protection — the main law being the Personal Data Act — to make sure organizations and the like follow them.

Personal data can only be processed under certain conditions. The subject of the data must give consent. It is necessary in the context of a contract with them and for the establishment, exercise or defense of legal claims.

The General Data Protection Regulation was applied in the EU in May 2018. Though Norway is not an EU member state, it is a member of the European Economic Area, and the GDPR has been incorporated into the EEA agreement.

That is why the GDPR became part of Norwegian law by means of a new Personal Data Act in July 2018. The GDPR strengthens laws that are already in place to protect individuals’ rights to their personal data.

You are in control of your personal data, including being able to consent to collection, determine and even delete your information from websites.

The cloud storage service Jottacloud is based in Norway, giving it a high ranking for privacy. The company says your files will be stored safely on servers in Norway or in countries that have equivalent or stronger privacy laws. Check out our Jottacloud review for a better look.

Romania

Romania takes data protection seriously. It has solid legislation, including the Data Protection Law, E-Privacy Law and E-commerce Law. They implement privacy protection for different sectors. They also require prior and express consent from the owner of sensitive data before it can be processed.

Plus, with Romania being part of the EU, the GDPR applies. Two months after the GDPR was enacted, the Romanian legislature adopted Law 190, which provided even more protection against the processing of personal data.

Romania also has the National Supervisory Authority for Personal Data Processing, which guarantees that the fundamental rights to privacy and the protection of personal data are respected. It checks that companies are adhering to data processing laws and can slap a fine on any found violating them.

Despite Romania’s commitment to privacy, we only have one review of a cloud service based there. VPN provider CyberGhost was founded in Bucharest, Romania, in 2011 and is still dedicated to providing people with reliable privacy and security solutions. Read our CyberGhost review for more on the company.

Iceland

The volcanic island in the northern Atlantic Ocean is another country that believes in privacy. It has a strong array of legislation to protect its citizens and, though it isn’t part of the EU, it is, like Norway, part of the EEA. The Icelandic parliament passed Act 80/2018, also known as the Data Protection Act, in July 2018 to implement the GDPR.

The laws state that data must be collected fairly and lawfully for legitimate purposes. Data collectors also need to have the subject’s consent or show that it is necessary for them to collect it to be in compliance with a legal obligation.

In 2010, the International Modern Media Institute changed Icelandic privacy laws to protect freedom of speech and information. The change was created with the involvement of WikiLeaks and gives protection to journalists and whistleblowers, making Iceland a haven for investigative journalism.

Its Data Protection Authority supervises companies’ compliance with the laws on the processing of personal data and also looks to improve deficiencies in data policies.

Iceland keeps people’s privacy top of mind and is is a good choice for those wanting that protection.

Bulgaria

Bulgaria has a solid legal framework of laws and directives to protect privacy, including in its constitution, which provides for the protection of privacy with safeguards against illegal interference.

The Law for Protection of Personal Data protects individuals from having their personal data processed illegally. Data can only be collected for concrete, specific and lawful purposes. Collection is allowed in certain cases, though, such as for the execution of an obligation settled by law, for compliance with a contract or when the subject has given their consent.

The data processor must submit an application for registration before it can start processing personal data. Plus, individuals have the right to access data related to them. Under Article 28a, the person has the right to have the data deleted, corrected or blocked.

There are also rules for the activities of the Commision for Personal Data Protection and its administration. The commission maintains a register of the personal data controllers and the personal data registers kept by them.

Because Bulgaria is part of the EU, it has adapted its data protection laws to implement the GDPR. That means more consent rules, subject rights and fines for companies who do not observe the rules.

VPNArea is based in Bulgaria. Though it falls short of our best VPN providers, it’s a pretty decent VPN that includes a no-logs policy. Look at our VPNArea review for more details on the service.

British Virgin Islands

The British Virgin Islands is a popular place for businesses to base themselves. That is because of its lenient privacy laws, as well as the income tax exemption for companies and individuals.

Though the BVI is a British territory, sharing the same monarch as Great Britain, and its people have full British citizenship, it isn’t a member of the EU. That means companies do not have to comply with the GDPR when it comes to processing citizens’ data. It is not part of the 14 Eyes, either, meaning it is not bound by any intelligence sharing agreements.

It is a self-governing archipelago that strictly enforces client confidentiality. That said, English Common Law is its primary rule of law, so there is no official legislation that regulates data protection. Unlike countries that require ISPs to collect users’ metadata, there are no data retention laws in the BVI.

The only way a company in the BVI would have to produce records would be if the BVI High Court issued an order to do so. Other countries do not have the authority to make a company in the BVI produce such information. Their government would have to submit a request to the BVI High Court for it to make an order under BVI jurisdiction.

Even then, the government would have to explain why it has requested the information. It would need to be relevant as evidence to a crime and justifying its collection is quite an extensive process.

ExpressVPN is based in the BVI and it doesn’t keep logs, so it’s a great choice for those who want anonymity. Read our ExpressVPN review to find out why we rank it the best VPN overall.

The Seychelles

This compilation of 115 beautiful, tropical islands is not just appealing to those looking for paradise. It is also a tax haven, popular with many offshore companies. It’s another place with good privacy laws, too.

Despite the Data Protection Act, which provides individuals with privacy rights regarding the processing of personal data, being enacted in 2003, the Seychelles does not have a law that addresses the collection and use of personal data. That’s because it never went into effect.

The constitution of the Seychelles guarantees the right to privacy and there are sectoral laws that include data protection provisions. Also, because it has its own legal system, companies located in the Seychelles can safely ignore U.S. warrants.

Only a court located in the Seychelles would have jurisdiction over a company there. Given that there are no mandatory data retention laws, there shouldn’t be anything logged anyway, providing the company ensures privacy.

If you shop around, you’ll notice there are companies that take advantage of the extra privacy, and we’ve reviewed a couple of them. Astrill and BoxPN are based in the Seychelles. They both have no-logs policies, too, which makes either one a good choice if privacy is your main objective. Read our Astrill review and BoxPN review for more.

Panama

Panama has extensive legislation regulating offshore jurisdiction. Its constitution, judicial code and criminal code have several articles that guarantee privacy and protection of personal data for its citizens and foreigners.

Article 29 of the constitution provides for protection of private documents and correspondence. It also says private communications may not be intercepted or recorded unless there is a warrant.

Law 6 of the judicial code ensures that personal information is not shared and, under Law 6 of the criminal code, it is an offense for businesses to breach the confidentiality of information they hold.

The Electronic Commerce Law states that storage providers for electronic documents must guarantee the protection of the data and information that is stored on behalf of their clients.

Panama’s privacy laws regulate the release of private information and people have the right to obtain access to public files, registers and data banks that contain information about them. They also have the right to know why the information was collected and can ask for it to be suppressed.

Panama has also signed international covenants to protect the right to privacy. The International Pact for Civil and Political Rights was approved in 1976 and states that judicial proceedings must protect information from being released.

Though there is no general legal framework that regulates data protection, all of the above provides for it. A new data privacy law, Bill No. 665, was recently approved by the National Assembly and is expected to be enacted by the government soon.

NordVPN is based in Panama and doesn’t keep logs, which makes it a strong contender in the VPN market for anyone who values their privacy. Read our NordVPN review to see for yourself.

Final Thoughts

When it comes to online privacy, it’s hard to guarantee 100 percent protection, but you can take steps to make it more difficult for companies or government to get hold of you data.

The countries on our list are the best locations for companies to be based in terms of your privacy. Others aren’t far off, but they don’t quite have enough protection to make the grade. If you have suggestions for countries that value privacy, let us know in the comments. Thank you for reading.