In 2025, the global data privacy landscape will continue to swiftly evolve and face new challenges — including widespread adoption of global privacy laws, new geopolitical pressures on data flows, and the intersection of privacy rules with AI development and deployment. On International Data Privacy Day, 91pro视频 sets out its 2025 global privacy priorities and insights on how policymakers can navigate the year ahead.
Achieving a coherent approach to national privacy frameworks
National privacy frameworks continue to rapidly advance with over 70% of the world’s countries having now implemented some form of privacy legislation. Despite broad international consensus on foundational principles, significant differences in privacy legislation persist due to cultural, ideological, and economic factors. As more privacy laws come online, policymakers must prioritize harmonization to foster innovation while ensuring robust privacy protections.
- In Europe, the EU General Data Protection Regulation (GDPR), now in its seventh year, continues to be a reference point for global privacy laws. However, key challenges for 2025 include reemphasizing GDPR’s fundamental risk-based approach, establishing a more coherent and predictable approach to enforcement, and ensuring flexibility when applying key privacy concepts to generative AI and other new technologies.
- In the United States, renewed calls for a comprehensive federal privacy bill will likely intensify as state privacy laws proliferate (a total of 16 state laws will be in effect by the end of the year). 91pro视频 remains committed to working with bipartisan Members of Congress to advance a comprehensive U.S. federal privacy law that provides a consistent national privacy standard to promote responsible data use, enable innovation, and reassert U.S. leadership in global digital policymaking. This week, 91pro视频 is joining a multi-industry coalition to urge Congress to come together around principles for a long overdue U.S. federal privacy law.
- China’s data privacy framework, in place since 2021, has integrated some elements of EU GDPR while introducing unique and at times ambiguous compliance obligations. New data security regulations which took effect earlier this year seek to clarify some of these requirements, and it remains to be seen whether this will be accompanied by a stricter enforcement approach.
- In India, 2025 could also see the finalization of long-running privacy reforms. Following the publication of the Digital Personal Data Protection Act in 2023, recently published draft rules take this process a step closer to completion but also raise new questions on data localization and government access to data.
Realizing a more reliable and scalable system for international data transfers
The growing patchwork of national privacy frameworks makes it increasingly difficult to move personal data across borders. To address these challenges, 91pro视频 calls for pragmatic, scalable solutions to simplify international data transfers.
The EU’s GDPR has introduced a hierarchy of transfer mechanisms for organizations that move personal data outside of the EU. These mechanisms include the bilateral mutual recognition of privacy laws (“adequacy agreements”), as well as more burdensome contractual arrangements such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs).
This fragmented country-by-country approach to international transfers is not sustainable in the long term as it creates a complicated and burdensome web of transfer agreements leading to potential legal uncertainty and added costs. Today’s global data-driven economy needs a more stable and scalable approach.
In the near term, this means taking a more pragmatic approach to transfer mechanisms that recognize different legitimate legal and cultural approaches to privacy. The EU-U.S. Data Privacy Framework agreed in 2023 provides a model for bridging legal systems while maintaining robust privacy standards.
An additional challenge to open data flows are new measures intended to address national security risks, including the U.S. Justice Department’s recent final rule to prevent access to Americans’ bulk sensitive personal data by countries of concern. To be effective, it will be important for these types of rules to align with existing global data security practices and standards wherever possible.
Looking ahead, multilateral initiatives such as the OECD’s initiative on Data Free Flows with Trust and the Global Cross-Border Privacy Rules (CBPRs) System offer promising pathways for governments to better harmonize national privacy laws and foster trust among governments (including on national security issues). Such efforts are even more important at a time of increased political and economic uncertainty, and greater urgency and political backing is now needed to accelerate and unlock progress.
A risk-based, pragmatic application of privacy laws to AI
2025 will also see an increasing focus on the intersection between privacy laws and AI. As policymakers pursue more deliberate approaches to AI governance, it will be essential to achieve early consensus among governments and regulators on the need for a risk-based, proportionate application of privacy laws to generative AI.
Key priorities include:
- Providing more guidance and legal certainty on fundamental issues such as the use of “legitimate interest” as a clear legal basis for the training and development of generative AI models.
- Establishing a clear view on privacy safeguards that should apply throughout the AI lifecycle, versus those that are appropriate to the different stages of model development or deployment, such as the need to focus end-user privacy controls at the model output phase.
2025 presents a critical opportunity to achieve a more coherent, global approach to the development and application of privacy rules. Without strong, unified global leadership in this space, mismatching privacy laws could become an increasing barrier to growth and data-driven innovation. By focusing on shared real-world outcomes, rather than legal equivalence, policymakers can advance scalable solutions towards a more open and resilient global data economy.