Common principles for processing of personal data include the need to have a legitimate reason for any processing activity, usually obtained through consent of the data subject. Alternatives to consent address contractual or legal obligations the firm may be subject to as well as the interests of the data subject or the public. The majority of the regulations analyzed feature elaborate frameworks in this regard. An array of legal bases for data collection and processing gives processors more freedom under certain circumstances. Additionally, all the regulations reviewed required that personal data be stored in a manner that allows for the data subject’s exercise of the right to access the information and to request its correction or deletion if

**<mark>Table 9. Adoption of domestic regulation on data governance</mark>**

||**None**|**Partial**|**Full***|**Comments**|
|---|---|---|---|---|
|**Albania**|||●||
|**Armenia**|||●||
|**Bangladesh**|●||||
|**Burkina Faso**|||●||
|**Canada**|||●||
|**Colombia**|||●||
|**France**|||●||
|**Honduras**||●||The Constitution grants right to<br>access and deletion|
|**Indonesia**|||●||
|**Kazakhstan**|||●||
|**Kenya**||●||Access to Information Act grants<br>right to access and deletion|
|**Korea, Rep.**|||●||
|**Kyrgyzstan**|||●||
|**Malaysia**|||●||
|**Mexico**|||●||
|**Moldova**|||●||
|**Pakistan**|●||||
|**Senegal**|||●||
|**Tanzania**|●||||
|**Vietnam**|||●||

(*) Refers to a general framework on privacy and data protection. Despite the lack of a general framework, specific rules may be often found in sectoral regulations, in particular on financial, telecommunications and health sectors necessary. While most of these requirements are included in the general frameworks for data governance, Honduras and Kenya grant these rights through the Constitution, and the Access to Information Act, respectively.

Providing clear rules on cross-border data transfers increases transparency and the ease of compliance. Here too, Vietnam’s legislation stands out as the only one failing to provide such rules. Additionally, where data is required to be stored domestically, such requirement should not prevent processors from transferring a copy of the data abroad. This grants governments greater ease of accessing the data of their citizens during legal disputes, while ensuring global data flows. Although data localization requirements may be present in other regulations, such as those addressing financial or health matters, none of the general data governance frameworks analyzed feature this type of restriction.

**<mark>Table 10:  Domestic regulation on data governance around the world</mark>**

||**Sensitive**<br>**data**<br>Special<br>treatment|**Legal ba**<br>Consent|**ses for data co**<br>Performance<br>of a contract|**llection and**<br>Legal<br>obligation|**processing**<br>Legitimate<br>interests|**Data**<br>**subject’s**<br>**rights**<br>Access/<br>deletion|**Cross-b**<br>**tra**<br>Rules on<br>transfers|**order data**<br>**nsfers**<br>No data<br>localization|
|---|---|---|---|---|---|---|---|---|
|**Albania**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|**●**|
|**Armenia**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Burkina Faso**|**●**|**●**|**●**|**●**||**●**|**●**|**●**|
|**Canada**||**●**|**●**|**●**|**●**|**●**|**●**|**●**|

20