OECD Privacy Guidelines

Why does it matter?

The Guidelines are the common ancestor of the privacy rules most organizations now meet. The OECD says Adherents repeatedly refer to them as the bedrock of their national frameworks and that they are widely recognized as forming the basis of other data protection frameworks, so the eight principles reappear, in local wording, in the laws a privacy team maps its controls to. Written in concise, technology-neutral language, they have been revised once in more than four decades, and the 2013 revision turned the accountability principle into a concrete obligation on data controllers: a privacy management program that can be demonstrated on request.

Key benefits include:

• One set of principles behind many laws

The eight Basic Principles of National Application (paragraphs 7 to 14) give a privacy program a structure that reads across jurisdictions, because the laws of the Adherents build on them.

• A defined privacy management program

Paragraph 15 lists what a data controller's program must do, from giving effect to the Guidelines for all personal data under its control to being updated through monitoring and periodic assessment.

• Risk-based safeguards

The 2013 revision grounded implementation in risk management: safeguards are to be based on privacy risk assessment, and restrictions on transborder flows proportionate to the risks presented (paragraphs 15 and 18).

• Breach notification expectation

Paragraph 15(c) asks data controllers to notify privacy enforcement authorities of a significant security breach affecting personal data and to notify data subjects where the breach is likely to adversely affect them.

• Free flow with accountability

Part Four keeps personal data moving across borders while holding the controller accountable for it regardless of where the data is located (paragraph 16).

How does it work?

The instrument has two layers. The Recommendation itself asks member countries to demonstrate leadership on privacy and the free flow of information, to implement the Guidelines through processes that include all relevant stakeholders and to disseminate the Recommendation across the public and private sectors; it invites non-members to adhere and instructs the responsible committee, now the Digital Policy Committee, to monitor implementation and report to the Council. The Guidelines in the Annex form an integral part of the Recommendation and are organized in six Parts.

Part One defines data controller, personal data (any information relating to an identified or identifiable individual, the data subject), laws protecting privacy, privacy enforcement authority and transborder flows of personal data (paragraph 1), sets the risk-based scope (paragraph 2), says the principles are complementary and should be read as a whole (paragraph 3), requires exceptions to be as few as possible and made known to the public (paragraph 4) and treats the Guidelines as minimum standards that may be supplemented (paragraph 6). Part Two states the eight principles, and Part Three turns accountability into the privacy management program, demonstration and breach-notice duties of paragraph 15.

Parts Four to Six address governments. Part Four says a member country should refrain from restricting transborder flows where the other country substantially observes the Guidelines or sufficient safeguards exist, including effective enforcement and appropriate measures by the data controller (paragraph 17), and that any restriction should be proportionate to the risks (paragraph 18). Part Five lists nine national implementation measures, from national privacy strategies and laws to privacy enforcement authorities with the governance, resources and expertise to act, self-regulation, remedies, sanctions and no unfair discrimination (paragraph 19). Part Six covers cross-border enforcement cooperation, interoperable frameworks, comparable metrics and publishing observance (paragraphs 20 to 23).

Key Elements

• Collection Limitation Principle (paragraph 7)

Limits on collection; data obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

• Data Quality Principle (paragraph 8)

Personal data relevant to the purposes of use and, to the extent necessary, accurate, complete and kept up to date.

• Purpose Specification Principle (paragraph 9)

Purposes specified no later than at the time of collection; later use limited to those purposes or compatible ones specified on each change of purpose.

• Use Limitation Principle (paragraph 10)

No disclosure or use for other purposes except with the consent of the data subject or by the authority of law.

• Security Safeguards Principle (paragraph 11)

Reasonable security safeguards against loss, unauthorized access, destruction, use, modification or disclosure.

• Openness Principle (paragraph 12)

A general policy of openness about developments, practices and policies; means to establish the existence and nature of personal data, the main purposes of use and the identity and usual residence of the data controller.

• Individual Participation Principle (paragraph 13)

Rights to obtain confirmation that a controller holds data, to have the data communicated within a reasonable time, at a charge that is not excessive, in a reasonable manner and intelligible form, to be given reasons for a denial and challenge it, and to challenge the data and have them erased, rectified, completed or amended.

• Accountability Principle (paragraph 14) and Part Three

A data controller is accountable for complying with measures that give effect to the principles; paragraph 15 specifies the privacy management program, its demonstration to a privacy enforcement authority and breach notification.

What does it cover?

The Guidelines apply to personal data, whether in the public or private sectors, which because of the manner in which they are processed, or because of their nature or the context in which they are used, pose a risk to privacy and individual liberties (paragraph 2). They are addressed to the Adherents, the 38 OECD member countries and any non-member invited to adhere, and through those governments to every data controller, a party competent under national law to decide the contents and use of personal data (paragraph 1). They are minimum standards that national law may supplement (paragraph 6); enforceable obligations come from the laws protecting privacy and the privacy enforcement authorities that Part Five asks Adherents to establish.

What are its objectives?

The Council adopted the Recommendation to promote and protect the fundamental values of privacy, individual liberties and the global free flow of personal data. The Guidelines are written so that Adherents will:

Give effect to the eight Basic Principles of National Application in laws protecting privacy (Part Two, paragraph 19(b)).

Have data controllers implement accountability through a privacy management program, demonstrate it on request and notify significant breaches (Part Three, paragraph 15).

Avoid unjustified obstacles to transborder flows of personal data while keeping restrictions proportionate to the risks (Part Four, paragraphs 17 and 18).

Develop national privacy strategies, establish privacy enforcement authorities, provide remedies and sanctions and support self-regulation (Part Five, paragraph 19).

Cooperate across borders on enforcement, promote interoperable privacy frameworks, develop comparable metrics and publish their observance (Part Six, paragraphs 20 to 23).

Keep exceptions, including those for national sovereignty, national security and public policy, as few as possible and public (paragraph 4).

Framework in Context

The 1980 text came with an Explanatory Memorandum, the 2013 revision with a supplementary one, and in 2023 the OECD's Working Party on Data Governance and Privacy added Implementation Guidance on accountability; the three are meant to be read together. The 2021 report to the Council found that all responding Adherents had privacy legislation and privacy enforcement authorities and concluded that the Recommendation did not need revision. Because the Adherents' laws and other data protection frameworks build on the Guidelines, privacy teams use the eight principles as the common layer beneath the national and regional instruments listed below, and the paragraph 15 program as the structure their accountability evidence follows.

Common Framework Mappings

Organizations map the OECD Privacy Guidelines to the national, regional and technical privacy instruments their program must satisfy, so that one set of principles, one privacy management program and one body of evidence serve several regimes.

Mapped frameworks include:

APEC CBPR System

APEC PF

Convention 108+

GDPR

ISO 27001:2022

ISO 27701

ISO 29100

NIST Privacy Framework v1.0