Personal data laws are laws that delineate how private and often public entities are required to treat personal data. If there is one ‘comprehensive’ law for the public sector and another for the private, both are counted together affirmatively; on the other hand, if a country has a law governing personal data held by the private sector but does not govern that held by the public sector, it would not count.

Open data laws require governmental bodies to make public sector data freely available, easy to use, distribute and reuse, subject to limited exceptions such as for national security or to protect privacy. In addition, open data laws generally require the government to proactively and transparently release information. If a law dictates a regime wherein citizens have unrestricted access to government datasets, it would thus not count unless there is a mandate for the government to actively publish data by default, subject to certain exceptions.

Under some data protection laws, individuals have a right (under certain conditions) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects the data subject. Companies, authorities, and other entities cannot make decisions about individuals using only technology with no human intervention in certain circumstances. Hence a bank cannot refuse a data subject a loan based on an algorithm in a computer program. For our purposes, not only do laws which grant citizens a measure of legal protection against fully automated decision making (such as in China) count, but also laws which grant citizens a measure of legal protection against any kind of decisions, which are the result of fully automated processing of personal data. Can take the form of a right to object, complain, be informed, or merely to be safeguarded from such decisions.