The capacity to move data across borders on the nation's terms: the adequacy arrangements, certification mechanisms and digital-trade rules that keep the intangible economy flowing.
The Capability Development Index tracks the events that move a capability — operational use, technical breakthroughs, procurement decisions and the industrial base behind them — and places each on the record with the date it happened.
Recent developments cover the current period. Historical developments are the inflection points that produced Data Flows & Digital Trade Governance as it stands today.
A permanent cable between Ireland and Newfoundland cut transatlantic communication from roughly ten days by ship to minutes, establishing the undersea-cable infrastructure model that still carries the great majority of international data traffic today.
The Guidelines on the Protection of Privacy and Transborder Flows of Personal Data sought to prevent privacy rules from becoming unjustified barriers to trade, shaping data protection law across member states for decades.
Directive 95/46/EC introduced the concept of adequacy, barring transfers of personal data to third countries unless their laws provided a comparable standard of protection, a model later inherited by the GDPR.
The Declaration on Global Electronic Commerce committed members not to impose customs duties on data sent across borders electronically, a standstill renewed at every ministerial conference until it lapsed in 2026.
Asia-Pacific Economic Cooperation members created a voluntary certification scheme allowing companies to demonstrate compliance with common privacy standards across participating economies, the forerunner of today's Global CBPR Forum.
Leaked documents revealing mass collection of communications by US intelligence agencies undermined trust in transatlantic data transfers and gave momentum to data localisation and sovereignty arguments worldwide.
Amendments to Russia's data protection law obliged operators collecting personal data on Russian citizens to use databases located within the country, becoming one of the earliest strict data localisation regimes and a model since echoed elsewhere.
The Cybersecurity Law required operators of critical information infrastructure to store certain data domestically and pass a security assessment before sending it abroad, establishing the foundation of China's data sovereignty regime.
The regulation set conditions for transferring personal data outside the European Economic Area, including adequacy decisions and standard contractual clauses, and became the reference model copied or adapted by dozens of countries worldwide.
The ruling found that US surveillance law failed to offer EU citizens adequate redress, invalidating the second transatlantic transfer mechanism after Safe Harbour and forcing companies onto standard contractual clauses with supplementary safeguards.
Ministers meeting in Yaoundé, Cameroon failed to extend the 1998 moratorium on customs duties for electronic transmissions, which lapsed on 30 March 2026 after members could not agree a text.
Measures jointly issued by the Cyberspace Administration of China and the market regulator took effect on 1 January 2026, adding certification alongside security assessment and standard contracts as compliance pathways for transferring personal information abroad.
AWS confirmed plans to open a dedicated cloud infrastructure region in Saudi Arabia during 2026, part of a wider build-out by hyperscale providers responding to data residency and localisation requirements across the Gulf.
The regulator found that a domestic digital wallet provider had sent the personal data of around 40 million users to the Chinese payments firm Alipay without adequate legal grounds, and ordered deletion of the data and associated algorithms.
The Digital Personal Data Protection Rules confirmed that cross-border transfers are permitted unless a destination is placed on a government negative list; by mid-2026 no such list had been published, leaving the regime largely open.
Judges dismissed a challenge seeking annulment of the European Commission's adequacy decision for transatlantic transfers, though an appeal to the Court of Justice followed, leaving open a third framework collapse after Safe Harbour and Privacy Shield.
The Data Protection Commission's General Application and Implementation Directive set out approved transfer instruments, including standard contractual clauses, for businesses moving personal data out of the country under the 2023 Data Protection Act.
The Global CBPR and Privacy Recognition for Processors systems began certifying companies against a shared set of transfer standards across member economies, with around 100 companies covering more than 2,000 entities certified at launch.
The Personal Data Protection Law, passed in June 2025, tightened obligations on cross-border transfer impact assessments and barred processing based on loosely defined legitimate interest, extending rules first set out in an earlier decree.
The annexes covered cross-border data transfers, digital identity, payments and cybersecurity, giving substance to a protocol signed in 2024 that still awaits the 22 ratifications needed to enter into force continent-wide.