cybersecurity requirements for data processors or controllers and provisions safeguarding the rights of data subjects may engender certainty and trust to promote data-based transactions.

Given the essential role of data regulation in promoting trust in the data economy, this diagnostic builds on a trust framework proposed in the WDR21, which advocates for the adoption of both _safeguards_ and _enablers_ to achieve an efficient environment for data governance (World Bank 2021). The trust framework embeds rule of law and good governance principles, including certainty, transparency and accountability, nondiscrimination, fairness, inclusiveness, and openness. Rule of law that emphasizes certainty, rules, and predictability as well as procedural due process supports the creation of trust in the data economy (Crawford and Schultz 2014; Tamanaha 2004; Waldron 2008).

This diagnostic builds on earlier efforts to document the regulatory environment for digital economy activities across countries. The United Nations Conference on Trade and Development (UNCTAD) developed a database tracking the existence of legislation related to e-transactions, consumer protection, data protection/privacy, and cybercrime in 194 countries. DLA Piper, a global law firm, also launched a data protection law tracker that covers116 jurisdictions (DLA Piper 2020). Ferracane, Lee-Makiyama, and van der Marel (2018) have developed a digital trade restrictiveness index to map and measure policy restrictions to digital trade in 64 countries. Greenleaf (2019) conducted a stocktaking of data privacy laws in 132 countries. However, most of the existing data collection efforts focus only on collecting information about the adoption of certain types of legislation, such as the existence of e-commerce or data protection laws, without providing a more granular level of information about the contents of the legislation. What makes this diagnostic unique is that it goes beyond documenting the presence or absence of legislation. It assesses whether the laws contain specific good practice provisions or regulatory attributes, thereby conveying something about the quality of the regulatory environment. In doing so, it builds on the conceptual framework described above.

# **3. Methodology**

Within the trust framework, the term _safeguards_ stands for norms and legal frameworks that aim to protect the rights of individuals and entities participating in the data economy by addressing misuse of data, or data breaches. Cybersecurity requirements imposed on data processors or controllers are typical safeguards. The term _enablers_ refers to norms and laws that facilitate the use and reuse of data, such as data portability mechanisms, open data legislation, and so on. Although safeguards and enablers include both formal legal frameworks as well as social norms, the diagnostic assesses only formal regulatory environments. While the diagnostic goes beyond identifying the presence or absence of legislation, by examining different attributes of the regulatory framework, it is not possible to assess the implementation or enforcement of the regulatory frameworks.

Moreover, according to the WDR21, a legal framework with enablers and safeguards to build trust in the data economy needs to be multidimensional, covering different types of data, actors, and transactions. Personal data—data directly provided by an individual that involved personally identifiable information— as well as nonpersonal data have different levels of sensitivity, thus requiring tailored safeguards. According to international law, individuals have fundamental rights regarding their personal data, such as the right to object to the data usage, file complaints, and seek redress. Safeguarding nonpersonal data instead requires protection of intellectual property rights. Depending on the “domain” of the data—whether data are generated and/or controlled by the public or private sector—enablers would also vary. Government can directly adopt regulatory or policy reforms to mandate access or use of public data, while in the case of private data, the government’s role is more limited to creating incentives and removing barriers to facilitate 4