Draft for review. This resource has not yet been reviewed by counsel or approved by the Next Gen Global Collab. It is a reference, not legal advice.
Consent · version 2026-10-v2
Consent: why it matters and how it works
The Jesus IndexA global measure of Jesus-following · jfindx.org
For organisations running the Jesus Index with young people aged 13–30. No young person answers the Index unless someone responsible has said yes first. This resource explains why, how consent works on the platform, what the rules look like in 200 countries, and gives you the materials to do it well.
This is a reference, not legal advice. See the disclaimer at the end.
0 · Why consent?
Why we ask you to confirm consent
You're inviting young people to answer questions about faith. In most countries, answers about religious belief are protected as sensitive information, and anyone under 18 is protected as a child. That usually means:
- a parent or guardian says yes before a minor takes part, and the young person agrees too
- taking part is free and voluntary, with no pressure and no reward
- answers stay private, so no one can trace them back to a person
The Index never asks for names, emails or consent forms. That's deliberate: consent is gathered by you, locally, where you know the young people and the law. The platform can't check it for you, so we ask you to confirm it, for your organisation and again for each survey you send.
No consent, no participation. Until you confirm, your survey link can't record answers.
Rules differ by country. See the country reference before you send, and check your own law, denomination and safeguarding policy.
This text appears with every consent request on the platform · version 2026-10-v1
1 · At a glance
| Who takes part | Young people aged 13–30. Anyone who picks “12 or younger” or “31 or older” is stopped at the first question and nothing is kept. A survey consented for 18+ only also stops anyone who picks 13–17. |
| How long it takes | About 8 minutes for the full survey, or about 5 for the J12-only version. Everyone answers the questions for their own path; there is no optional extra section. |
| What's collected | Answers, age group, gender (optional), country (chosen from a list), language, and when they answered. No free-text answers and no city. Never names, emails, phone numbers, birthdays or IP addresses. |
| Who sees what | You see grouped results only, never one person's answers. Groups smaller than 10 show a count but no score. |
| How long answers are kept | Full answers for 60 days, for quality checks. After that the exact time and the individual survey link are removed. The cleaned answers are kept for up to 5 years, then only grouped totals remain. |
| Who holds consent records | You do. Keep them yourself and never send them to the Index. |
2 · How consent works on the Index
Consent is confirmed twice. A survey link records nothing until both are in place.
| Level | When | Who confirms | What they confirm |
|---|---|---|---|
| 1. Your organisation | Once, and again whenever the statement changes | An organisation admin | The organisation statement (5.1) |
| 2. Each survey you send | Before every link or QR code goes out | An organisation admin | The survey statement (5.2): the countries it runs in, the age groups invited, how parental consent was gathered, any ethics approval and any local legal advice |
- No consent, no participation. A link without both confirmations shows young people a polite “This survey isn't open yet” screen and records nothing. Test links still work, and record only to test data.
- You can't send what isn't consented. A new survey link shows its URL and QR code only after its consent step.
- Visible to the Index administrators. A consent register shows every organisation and every survey: consented or not, for what, by whom and when, with the full history. It holds staff names and dates only, never anything about a young person.
3 · What makes research with under-18s different
Research with young people under 18 adds six layers of care. The details differ by country, so there's no single standard.
| Layer | What it asks of us |
|---|---|
| Ethical review | Often a review board or equivalent before the study starts. For a church-run, non-academic survey this is usually best practice rather than law, but it becomes required where a university, public funding or publication is involved. |
| Parental or guardian consent | Active and verifiable, not assumed. Often it must be in place before the young person even sees the survey. |
| The young person's own agreement | Plain language a 13-year-old understands: what it is, and that it's voluntary. |
| Data protection | Stricter rules for children's data, and in some countries limits on sending it abroad. |
| Recruitment | Going through churches and youth organisations that already hold consent structures, not social-media ads aimed at minors. |
| Safeguarding | A plan for sensitive answers, support for anyone distressed, and knowing local reporting duties. |
One practical consequence: there's no compliant way to recruit 13-year-olds directly through social media at scale. Consent has to come through people and organisations who already know the young person.
That's how the Index works. The survey reaches young people only through churches and ministries that know them, and those organisations gather consent locally. It never reaches young people through open social-media recruitment. That's why both levels of consent are required, and why a survey can't run without them.
4 · Your responsibilities
Confirming consent means you have done the following:
- Checked what your context requires: your country's law (section 6), your denomination's policy and your own safeguarding policy. Where any of them requires a parent's or guardian's consent for 13–17-year-olds, you have it before they take part.
- Shared links only with the age groups you confirmed, and never with anyone under 13.
- Made taking part voluntary. No one is rewarded for taking part or penalised for not taking part. Anyone can stop at any time, and the personal questions about faith and gender offer “Prefer not to say”.
- Given people privacy while they answer. Let them use their own phone, or a space where no one can see their screen. Leaders don't look over shoulders or ask anyone what they answered.
- Kept your own records. Store consent forms and attendance lists securely, in line with your safeguarding policy. Never upload them to the Index or link them to survey answers.
- Prepared for disclosures. If a young person raises something that concerns you, follow your safeguarding policy as you would anywhere else. The survey itself is anonymous and can't be used to follow anyone up.
5 · The statements you confirm
5.1 Your organisation · version 2026-10-v1
- We have obtained the consent our context requires before anyone takes this survey — including a parent's or guardian's consent for 13-to-17-year-olds wherever our law, denomination or safeguarding policy requires it.
- We will only share our survey links with people aged 13 or over.
- We will keep any consent records ourselves. We will not send them to the Index, and the Index will never ask for them.
- We understand that the Index stores answers anonymously and shows us grouped results only, never an individual's answers.
5.2 Each survey you send · version 2026-10-v2
- This survey will run in [countries] and invites [age groups].
- For anyone under 18, we have the parent's or guardian's consent our context requires, gathered by [method], before they take part.
- The young people will be told that taking part is voluntary and anonymous, and that they can stop at any time.
- We have read “Why consent?” and the country reference for these countries, and have taken local advice where it is required.
☐ I've read “Why consent?” and confirm the above for this survey.
If either statement changes, its version number changes and the platform asks you to confirm again. An existing survey keeps collecting for 14 days after a change, then pauses until it's reconfirmed.
6 · Country reference
The table covers 200 countries and territories — every UN member state, plus a few places ministries commonly work. Requiring a parent's or guardian's consent for every 13–17-year-old meets or exceeds the minimum age in every country in the table except Thailand (under 20), where a parent's consent may also be needed for some young adults.
179 rows are a first pass. Rows marked 2026-10-v2 are a first-pass desk reference prepared for counsel review (Oct 2026). Where a statute, age or rule could not be confirmed the row says "to confirm" or "assume", and the age defaults to 18. Verify before relying on any v2 row.
Truly anonymous data falls outside nearly every law below. The rules apply in full if answers can identify someone, for example through a small town combined with age band and gender. That's why the Index removes those details after 60 days.
Showing 200 of 200. Printing includes every country.
| Country | Main law (regulator) | Parent/guardian consent needed under | Faith answers sensitive? | Ethics review for a church-run survey | Storing data abroad (US/EU) | Level of care |
|---|---|---|---|---|---|---|
| Afghanistanfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: apostasy punishable by death; Christians in hiding |
| Albaniafirst pass · to verify | Law on Personal Data Protection (GDPR-aligned, 2024; to confirm) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Algeriafirst pass · to verify | Law 18-07 on personal data (amended 2025; to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: Ordinance 06-03 criminalises inciting a Muslim to convert |
| Andorrafirst pass · to verify | Qualified Law 29/2021 on personal data (GDPR-aligned) | 18 (assume; to confirm) | Yes, special category | Best practice | EU adequate | StandardStandard |
| Angolafirst pass · to verify | Law 22/11 on Personal Data Protection | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Antigua and Barbudafirst pass · to verify | Data Protection Act 2013 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Argentina | Law 25.326 (AAIP); reform pending | 18 (assume) | Yes; no one can be compelled to give it | Best practice | EU adequate; US needs consent or model clauses | StandardStandard |
| Armeniafirst pass · to verify | Law on Protection of Personal Data (2015) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Australiafirst pass · to verify | Privacy Act 1988, amended 2024 (OAIC); Children's Online Privacy Code in development | No fixed age; the OAIC generally assumes capacity from 15 | Yes, sensitive information | Best practice | Allowed; the sender stays accountable (APP 8) | StandardStandard |
| Austriafirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Azerbaijanfirst pass · to verify | Law on Personal Data (2010) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: religious literature and activity restricted to registered groups |
| Bahrainfirst pass · to verify | Law 30/2018 (PDPL) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims is prohibited; expatriate congregations only |
| Bangladesh | Personal Data Protection Ordinance 2025 / Act 2026 (status to confirm) | 18 | Yes, explicit consent | Best practice | Some data must stay in-country | High risk — local advice strongly recommendedHigh |
| Barbadosfirst pass · to verify | Data Protection Act 2019 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Belarusfirst pass · to verify | Law 99-Z on Personal Data Protection (2021) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: religious activity tightly regulated; surveillance risk |
| Belgiumfirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Belizefirst pass · to verify | Data Protection Act 2021 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Beninfirst pass · to verify | Digital Code 2018 (APDP) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Bhutanfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytism is restricted |
| Boliviafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Bosnia and Herzegovinafirst pass · to verify | Law on Protection of Personal Data (to confirm current version) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Botswanafirst pass · to verify | Data Protection Act 2024 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Brazil | LGPD + ECA Digital, 2026 (ANPD) | 12 under LGPD; parental authorisation advised for all under-18s | Yes, highlighted consent | Not required for anonymous opinion surveys (CNS Res. 510/2016) unless academic | Contract clauses, consent or adequacy | StandardStandard |
| Bruneifirst pass · to verify | Personal Data Protection Order 2025 (to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: the Syariah Penal Code criminalises propagating other religions to Muslims |
| Bulgariafirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Burkina Fasofirst pass · to verify | Law 001-2021 (CIL) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: jihadist violence; churches targeted in the north and east |
| Burundifirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Cabo Verdefirst pass · to verify | Law 133/V/2001 (as amended) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Cambodiafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Cameroonfirst pass · to verify | Law 2024-017 on personal data (to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: insecurity in the Anglophone and Far North regions |
| Canada | PIPEDA (often doesn't cover non-commercial charities); Quebec Law 25 | 14 in Quebec; no fixed federal age | Yes in Quebec: express consent | Best practice (TCPS 2 binds funded institutions) | Quebec: privacy impact assessment first | StandardStandard |
| Central African Republicfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: armed conflict |
| Chadfirst pass · to verify | Law 007/PR/2015 on personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: insecurity in several regions |
| Chilefirst pass · to verify | Law 21.719 (new data protection law, in force Dec 2026; replaces Law 19.628) | 14 under Law 21.719 | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| China | PIPL 2021 (CAC) | 14 | Yes, separate consent | n/a: state approval governs | CAC assessment or contract, plus separate consent | Blocked until local legal advice is recordedDo not run without PRC legal advice |
| Colombiafirst pass · to verify | Law 1581 of 2012 (SIC) | 18; minors' data only in their best interest, with a representative | Yes, sensitive data | Best practice | Adequate country or SIC declaration | StandardStandard |
| Comorosfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising and conversion from Islam are penalised |
| Costa Ricafirst pass · to verify | Law 8968 (PRODHAB) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Côte d'Ivoirefirst pass · to verify | Law 2013-450 (ARTCI) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | ARTCI authorisation for transfers | Extra careCare: first pass, confirm locally |
| Croatiafirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Cubafirst pass · to verify | Law 149/2022 on Personal Data Protection | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: religious activity monitored; registration required |
| Cyprusfirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Czechiafirst pass · to verify | GDPR + national data protection law | 15 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Denmarkfirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Djiboutifirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims discouraged; existing communities only |
| Dominicafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Dominican Republicfirst pass · to verify | Law 172-13 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| DR Congo | Digital Code 2023; interim regulator ARPTIC | 18 (assume) | Yes | Best practice | Equivalent protection; authorisation regime not yet applied | Extra careModerate |
| Ecuadorfirst pass · to verify | Organic Law on Personal Data Protection 2021 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Egypt | Law 151/2020 + Executive Regulations, Nov 2025 (PDPC) | 15 (written); 15–17 depends on circumstances | Yes; licence needed; all children's data sensitive | Best practice | Licence + adequacy + consent | High risk — local advice strongly recommendedHigh: existing church communities only |
| El Salvadorfirst pass · to verify | Personal Data Protection Law (2024; to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Equatorial Guineafirst pass · to verify | Law 1/2016 on personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Eritreafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: unregistered churches banned; detention of Christians |
| Estoniafirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Eswatinifirst pass · to verify | Data Protection Act 2022 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Ethiopia | Proclamation 1321/2024 (Ethiopian Communications Authority) | 16 | Yes, written consent | Best practice | **Data must be stored in Ethiopia;** sensitive data needs approval to leave | High risk — local advice strongly recommendedHigh: conflicts with US/EU hosting |
| Fijifirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Finlandfirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| France | GDPR + Loi Informatique et Libertés (CNIL) | 15, parent and child jointly | Yes, special category | Best practice | As Germany | StandardStandard |
| Gabonfirst pass · to verify | Law 001/2011 on personal data (amended 2023) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Georgiafirst pass · to verify | Law on Personal Data Protection (2023) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Germany | GDPR + BDSG; churches may use their own regime (KDG, DSG-EKD) | 16 (GDPR default; to confirm) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard; check which church regime applies |
| Ghanafirst pass · to verify | Data Protection Act 2012 (DPC) | 18 (assume; to confirm) | Yes, special personal data | Best practice | No general limit identified (to confirm) | Extra careCare: register with the DPC |
| Greecefirst pass · to verify | GDPR + national data protection law | 15 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Grenadafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Guatemalafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Guineafirst pass · to verify | Law L/2016/037 on cybersecurity and personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Guinea-Bissaufirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Guyanafirst pass · to verify | Data Protection Act 2023 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Haitifirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: gang violence and instability |
| Hondurasfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Hong Kongfirst pass · to verify | Personal Data (Privacy) Ordinance (PCPD) | 18 (assume) | No separate category | Best practice | No general limit identified (to confirm) | Extra careCare: national security legislation; confirm locally |
| Hungaryfirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Icelandfirst pass · to verify | GDPR (via the EEA Agreement) + national law | 13 (national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| India | DPDP Act 2023; core duties from 13 May 2027 | 18 | No separate category | Best practice | Allowed unless the country is restricted | Extra careCare: anti-conversion laws in some states |
| Indonesia | PDP Law 27/2022; agency not yet operating | 18 | Religion not listed; children's data is sensitive | Best practice | Adequacy, safeguards or consent | Extra careCare: local advice on religious propagation |
| Iranfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: apostasy and evangelism prosecuted; physical-safety risk |
| Iraqfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: conversion from Islam not recognised; security risk |
| Irelandfirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Israelfirst pass · to verify | Protection of Privacy Law (Amendment 13, in force 2025) | 18 (assume; to confirm) | Yes, especially sensitive information | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: the Penal Law restricts religious persuasion of minors; parental consent essential |
| Italyfirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Jamaicafirst pass · to verify | Data Protection Act 2020 (Information Commissioner) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Japanfirst pass · to verify | Act on the Protection of Personal Information (PPC) | No fixed age; PPC guidance points to about 12–15 | Yes, special care-required | Best practice | Consent, or a recipient with equivalent protection | StandardStandard |
| Jordanfirst pass · to verify | Personal Data Protection Law No. 24 of 2023 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims is restricted; existing church communities only |
| Kazakhstanfirst pass · to verify | Law on Personal Data and its Protection (data localisation) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | Data must be stored in Kazakhstan | High risk — local advice strongly recommendedHigh: missionary work needs registration; minors' religious participation needs parental consent |
| Kenyafirst pass · to verify | Data Protection Act 2019 (ODPC, actively enforcing) | 18 | Yes, sensitive personal data | Best practice; a NACOSTI research licence may apply | Safeguards or consent; some data must be kept in Kenya | Extra careCare: register with the ODPC if required |
| Kiribatifirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Kosovofirst pass · to verify | Law 06/L-082 on Personal Data Protection (GDPR-aligned) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Kuwaitfirst pass · to verify | Data Privacy Protection Regulation (CITRA, 2021) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims is prohibited; expatriate congregations only |
| Kyrgyzstanfirst pass · to verify | Law on Personal Information | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: religion law tightened in 2025; registration required |
| Laosfirst pass · to verify | Law on Electronic Data Protection (2017) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: religious activity tightly controlled |
| Latviafirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Lebanonfirst pass · to verify | Law 81/2018 on Electronic Transactions and Personal Data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Lesothofirst pass · to verify | Data Protection Act 2011 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Liberiafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Libyafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: conflict; proselytising criminalised |
| Liechtensteinfirst pass · to verify | GDPR (via the EEA Agreement) + national law | 16 (national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Lithuaniafirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Luxembourgfirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Macaufirst pass · to verify | Law 8/2005 on Personal Data Protection | 18 (assume; to confirm) | Yes, sensitive data | Best practice | Authorisation for some transfers | Extra careCare: first pass, confirm locally |
| Madagascarfirst pass · to verify | Law 2014-038 on personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Malawifirst pass · to verify | Data Protection Act 2024 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Malaysiafirst pass · to verify | PDPA 2010, amended 2024 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | Allowed with comparable protection (2024 amendment) | High risk — local advice strongly recommendedHigh: state laws restrict propagating other religions to Muslims |
| Maldivesfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: citizens must be Muslim; other religious practice by citizens is barred |
| Malifirst pass · to verify | Law 2013-015 on personal data | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: jihadist violence and instability |
| Maltafirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Marshall Islandsfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Mauritaniafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: apostasy is a capital offence |
| Mauritiusfirst pass · to verify | Data Protection Act 2017 (GDPR-aligned) | 16 | Yes, special category | Best practice | No general limit identified (to confirm) | StandardStandard |
| Mexico | LFPDPPP 2025 (SABG) | 18 | Yes, express consent | Best practice | Generally consent; hosting providers often exempt (to confirm) | StandardStandard |
| Micronesiafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Moldovafirst pass · to verify | Law 133/2011 on personal data (reform in progress; to confirm) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Monacofirst pass · to verify | Law 1.565 of 2024 on personal data (GDPR-aligned; to confirm) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | StandardStandard |
| Mongoliafirst pass · to verify | Law on Personal Data Protection (2021) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Montenegrofirst pass · to verify | Law on Personal Data Protection (to confirm current version) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Moroccofirst pass · to verify | Law 09-08 (CNDP) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | CNDP authorisation for most transfers | High risk — local advice strongly recommendedHigh: the Penal Code criminalises shaking a Muslim's faith |
| Mozambiquefirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Myanmarfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: civil war; surveillance and attacks on churches |
| Namibiafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Naurufirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Nepalfirst pass · to verify | Individual Privacy Act 2018 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: the Criminal Code criminalises proselytism |
| Netherlandsfirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| New Zealandfirst pass · to verify | Privacy Act 2020 (Privacy Commissioner) | No fixed age; take extra care under 16 | No separate category | Best practice | Comparable safeguards (IPP 12) | StandardStandard |
| Nicaraguafirst pass · to verify | Law 787 on Personal Data Protection | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: churches and clergy targeted by the government |
| Nigerfirst pass · to verify | Law 2017-28 on personal data | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: jihadist violence and instability |
| Nigeria | NDPA 2023 + GAID 2025 (NDPC) | 18, with age verification | Yes | Best practice | Adequacy, an approved instrument, or informed consent | Extra careStandard+ |
| North Koreafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: Christian practice is severely persecuted |
| North Macedoniafirst pass · to verify | Law on Personal Data Protection 2020 (GDPR-aligned) | 14 (to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | StandardStandard |
| Norwayfirst pass · to verify | GDPR (via the EEA Agreement) + national law | 13 (national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Omanfirst pass · to verify | Royal Decree 6/2022 (PDPL) | 18 (assume; to confirm) | Yes, permit needed for some processing | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims is prohibited; expatriate congregations only |
| Pakistan | No comprehensive law in force; PECA 2016 | 18 | Not under current law | National Bioethics Committee if foreign-funded or multi-province | No general limit | Blocked until local legal advice is recordedVery high: blasphemy laws; physical-safety risk |
| Palaufirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Palestinefirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: no comprehensive law; security and social risk |
| Panamafirst pass · to verify | Law 81 of 2019 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Papua New Guineafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Paraguayfirst pass · to verify | Personal data protection law (2025; to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | StandardStandard |
| Perufirst pass · to verify | Law 29733 + 2024 Regulation (ANPDP) | 14 | Yes, sensitive data | Best practice | No general limit identified (to confirm) | StandardStandard |
| Philippinesfirst pass · to verify | Data Privacy Act 2012 (NPC) | 18 | Yes, sensitive personal information | Best practice | Allowed; the controller stays accountable | StandardStandard |
| Polandfirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Portugalfirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Puerto Ricofirst pass · to verify | US federal law (COPPA) + Puerto Rico law | 13 (COPPA) | No federal category | Best practice | No general limit | StandardStandard |
| Qatarfirst pass · to verify | Law 13/2016 on Personal Data Privacy | 18 (assume; to confirm) | Yes, special nature data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: proselytising Muslims is prohibited; expatriate congregations only |
| Republic of the Congofirst pass · to verify | Law 29-2019 on personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Romaniafirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Russiafirst pass · to verify | Federal Law 152-FZ on Personal Data | 18 (assume; to confirm) | Yes, special category | Best practice | Russian citizens' data must first be stored in Russia; transfer notifications | High risk — local advice strongly recommendedHigh: missionary activity restricted (2016 amendments); data must be stored in Russia |
| Rwandafirst pass · to verify | Law 058/2021 on personal data | 18 (assume; to confirm) | Yes, sensitive data | Best practice | Authorisation from NCSA; storage in Rwanda unless authorised | Extra careCare: data localisation unless authorised |
| Saint Kitts and Nevisfirst pass · to verify | Data Protection Act 2018 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Saint Luciafirst pass · to verify | Data Protection Act 2011 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Saint Vincent and the Grenadinesfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Samoafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| San Marinofirst pass · to verify | Law 171/2018 (GDPR-aligned) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | StandardStandard |
| São Tomé and Príncipefirst pass · to verify | Law 03/2016 on personal data | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Saudi Arabia | PDPL (SDAIA), actively enforced | 18 (assume) | Yes | Best practice | Adequacy or safeguards | Blocked until local legal advice is recordedVery high: proselytising is banned |
| Senegalfirst pass · to verify | Law 2008-12 (CDP) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | CDP authorisation for transfers | Extra careCare: first pass, confirm locally |
| Serbiafirst pass · to verify | Law on Personal Data Protection 2018 (GDPR-aligned) | 15 for online services (to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | StandardStandard |
| Seychellesfirst pass · to verify | Data Protection Act 2023 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Sierra Leonefirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Singaporefirst pass · to verify | Personal Data Protection Act 2012 (PDPC) | 13 (PDPC guidance) | Not a listed category | Best practice | Comparable protection required | StandardStandard |
| Slovakiafirst pass · to verify | GDPR + national data protection law | 16 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Sloveniafirst pass · to verify | GDPR + national data protection law | 15 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Solomon Islandsfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Somaliafirst pass · to verify | Data Protection Act 2023 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: converts from Islam face lethal danger; conflict |
| South Africa | POPIA (Information Regulator) | 18 | Yes, special personal information | Best practice (NHREC binds health research) | Adequate-protection test; may need Regulator authorisation for children's data | Extra careStandard+ |
| South Koreafirst pass · to verify | Personal Information Protection Act (PIPC) | 14 | Yes, sensitive information | Best practice | Consent, certification or adequacy | StandardStandard |
| South Sudanfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: armed conflict and fragile security |
| Spainfirst pass · to verify | GDPR + national data protection law | 14 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Sri Lankafirst pass · to verify | Personal Data Protection Act 2022 (phased in) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Sudanfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: armed conflict; severe risk to Christians |
| Surinamefirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Swedenfirst pass · to verify | GDPR + national data protection law | 13 (GDPR Art. 8 national age for online services) | Yes, special category | Best practice | US via the EU–US Data Privacy Framework or contract clauses | StandardStandard |
| Switzerlandfirst pass · to verify | Revised Federal Act on Data Protection (FADP, 2023) | No fixed age: the child's capacity of judgement (often taken as about 16) | Yes, sensitive data | Best practice | US via the Swiss–US Data Privacy Framework or contract clauses | StandardStandard |
| Syriafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: conflict and fragile security |
| Taiwanfirst pass · to verify | Personal Data Protection Act (PDPC being established) | 18 (age of majority) | Not a listed category (to confirm) | Best practice | No general limit identified (to confirm) | StandardStandard |
| Tajikistanfirst pass · to verify | Law on Personal Data Protection (2018) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: minors are barred from religious activity outside the family |
| Tanzania | PDPA 2022 (PDPC, actively enforcing) | 18, prior written consent | Yes; children's data is sensitive | Best practice; a COSTECH research permit may apply | PDPC permit before transfer | Extra careModerate–high |
| Thailandfirst pass · to verify | Personal Data Protection Act 2019 (PDPC) | Under 20 (Thai age of majority), with exceptions; to confirm | Yes, sensitive data | Best practice | Adequate protection or safeguards | Extra careCare: parental consent may be needed for 18–19-year-olds |
| The Bahamasfirst pass · to verify | Data Protection Act 2003 | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | StandardStandard |
| The Gambiafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Timor-Lestefirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Togofirst pass · to verify | Law 2019-014 on personal data | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Tongafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Trinidad and Tobagofirst pass · to verify | Data Protection Act 2011 (partly in force) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Tunisiafirst pass · to verify | Organic Law 2004-63 (INPDP) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | High risk — local advice strongly recommendedHigh: social and legal pressure on converts; existing communities only |
| Türkiyefirst pass · to verify | KVKK, Law 6698 (KVKK Authority); transfer rules amended 2024 | 18 | Yes, special category | Best practice | Adequacy, standard contract notified to the Authority, or explicit consent | Extra careCare: confirm locally; social pressure on converts |
| Turkmenistanfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: religious activity tightly controlled; surveillance |
| Tuvalufirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Ugandafirst pass · to verify | Data Protection and Privacy Act 2019 (PDPO) | 18, with parental consent | Yes, special personal data | Best practice; UNCST registration for research | Adequate protection in the receiving country | Extra careCare: first pass, confirm locally |
| Ukrainefirst pass · to verify | Law of Ukraine on Personal Data Protection (2010) | 18 (assume; to confirm) | Yes, special category | Best practice | No general limit identified (to confirm) | Extra careCare: martial law; confirm safety for gatherings and data |
| United Arab Emiratesfirst pass · to verify | Federal Decree-Law 45/2021 (PDPL) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | Adequacy or safeguards | High risk — local advice strongly recommendedHigh: proselytising Muslims is a criminal offence; registered churches serve expatriates |
| United Kingdom | UK GDPR + DPA 2018, amended 2025 (ICO) | 13 for online services | Yes, special category | Best practice | EU adequate; US via the UK–US data bridge | StandardStandard |
| United States | COPPA (FTC); state privacy laws vary | 13 (COPPA) | No federal category; some states yes | Best practice. An IRB is required only for federally funded research | No general limit | StandardStandard |
| Uruguayfirst pass · to verify | Law 18.331 (URCDP); EU adequate | 18 (assume; to confirm) | Yes, sensitive data | Best practice | Adequate country or safeguards | StandardStandard |
| Uzbekistanfirst pass · to verify | Law ZRU-547 on Personal Data (2019; data localisation) | 18 (assume; to confirm) | Yes, special category | Best practice | Citizens' data must be stored in Uzbekistan | High risk — local advice strongly recommendedHigh: proselytism is banned |
| Vanuatufirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Vatican Cityfirst pass · to verify | Vatican data protection norms (to confirm) | 18 (assume; to confirm) | Yes (to confirm) | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Venezuelafirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Extra careCare: instability; confirm locally |
| Vietnam | Law 91/2025 on Personal Data + Decree 356 (in force 1 Jan 2026) | 18; parent and child both consent (to confirm) | Yes | Best practice | Transfer impact assessment filed with the Ministry of Public Security | High risk — local advice strongly recommendedHigh: registered churches only |
| Yemenfirst pass · to verify | No comprehensive data protection law identified (to confirm) | 18 (assume; to confirm) | No specific rule identified | Best practice | No general limit identified (to confirm) | Blocked until local legal advice is recordedVery high: conflict; apostasy punishable |
| Zambiafirst pass · to verify | Data Protection Act 2021 | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
| Zimbabwefirst pass · to verify | Cyber and Data Protection Act 2021 (POTRAZ) | 18 (assume; to confirm) | Yes, sensitive data | Best practice | No general limit identified (to confirm) | Extra careCare: first pass, confirm locally |
“Best practice” means we found no legal requirement for a non-academic, church-run survey. It becomes required if a university, public research funding or academic publication is involved.
6.1 Countries that need local advice before launch
In these 55 countries the risk is to the young people themselves, not only a compliance question. Don't open a survey there without local legal advice and a named local partner. In the 19 marked “blocked”, the platform won't accept a survey consent until a local-advice reference is recorded.
| Country | Main concern | On the platform |
|---|---|---|
| China | Surveys connected to an overseas organisation need a licensed local institution and project approval. Online religious content needs a permit. | Survey consent is blocked until a local-advice reference is recorded |
| Saudi Arabia | Non-Muslims are banned from proselytising, and conversion from Islam is prohibited | Blocked until a local-advice reference is recorded. Expatriate congregations only, if at all |
| Pakistan | Blasphemy laws, and documented violence against Christians | Blocked until a local-advice reference is recorded. Free text strongly discouraged |
| Egypt | Contempt-of-religion law is actively enforced; sensitive data needs a licence | Warning on the consent step; existing church communities only |
| Vietnam | Religious activity is state-registered, and online religious activity is under new rules | Warning on the consent step; registered churches only |
| Ethiopia | Personal data must be stored in Ethiopia | Warning on the consent step; allowed only because answers are anonymous |
| Bangladesh | Some data must stay in-country; the new law's status is still settling | Warning on the consent step |
| Afghanistan | Apostasy punishable by death; Christians in hiding | Blocked until a local-advice reference is recorded |
| Algeria | Ordinance 06-03 criminalises inciting a Muslim to convert | Blocked until a local-advice reference is recorded |
| Brunei | The Syariah Penal Code criminalises propagating other religions to Muslims | Blocked until a local-advice reference is recorded |
| Eritrea | Unregistered churches banned; detention of Christians | Blocked until a local-advice reference is recorded |
| Iran | Apostasy and evangelism prosecuted; physical-safety risk | Blocked until a local-advice reference is recorded |
| Libya | Conflict; proselytising criminalised | Blocked until a local-advice reference is recorded |
| Maldives | Citizens must be Muslim; other religious practice by citizens is barred | Blocked until a local-advice reference is recorded |
| Mauritania | Apostasy is a capital offence | Blocked until a local-advice reference is recorded |
| Myanmar | Civil war; surveillance and attacks on churches | Blocked until a local-advice reference is recorded |
| North Korea | Christian practice is severely persecuted | Blocked until a local-advice reference is recorded |
| Somalia | Converts from Islam face lethal danger; conflict | Blocked until a local-advice reference is recorded |
| Sudan | Armed conflict; severe risk to Christians | Blocked until a local-advice reference is recorded |
| Syria | Conflict and fragile security | Blocked until a local-advice reference is recorded |
| Tajikistan | Minors are barred from religious activity outside the family | Blocked until a local-advice reference is recorded |
| Turkmenistan | Religious activity tightly controlled; surveillance | Blocked until a local-advice reference is recorded |
| Yemen | Conflict; apostasy punishable | Blocked until a local-advice reference is recorded |
| Azerbaijan | Religious literature and activity restricted to registered groups | Warning on the consent step |
| Bahrain | Proselytising Muslims is prohibited; expatriate congregations only | Warning on the consent step |
| Belarus | Religious activity tightly regulated; surveillance risk | Warning on the consent step |
| Bhutan | Proselytism is restricted | Warning on the consent step |
| Burkina Faso | Jihadist violence; churches targeted in the north and east | Warning on the consent step |
| Central African Republic | Armed conflict | Warning on the consent step |
| Chad | Insecurity in several regions | Warning on the consent step |
| Comoros | Proselytising and conversion from Islam are penalised | Warning on the consent step |
| Cuba | Religious activity monitored; registration required | Warning on the consent step |
| Djibouti | Proselytising Muslims discouraged; existing communities only | Warning on the consent step |
| Haiti | Gang violence and instability | Warning on the consent step |
| Iraq | Conversion from Islam not recognised; security risk | Warning on the consent step |
| Israel | The Penal Law restricts religious persuasion of minors; parental consent essential | Warning on the consent step |
| Jordan | Proselytising Muslims is restricted; existing church communities only | Warning on the consent step |
| Kazakhstan | Missionary work needs registration; minors' religious participation needs parental consent | Warning on the consent step |
| Kuwait | Proselytising Muslims is prohibited; expatriate congregations only | Warning on the consent step |
| Kyrgyzstan | Religion law tightened in 2025; registration required | Warning on the consent step |
| Laos | Religious activity tightly controlled | Warning on the consent step |
| Malaysia | State laws restrict propagating other religions to Muslims | Warning on the consent step |
| Mali | Jihadist violence and instability | Warning on the consent step |
| Morocco | The Penal Code criminalises shaking a Muslim's faith | Warning on the consent step |
| Nepal | The Criminal Code criminalises proselytism | Warning on the consent step |
| Nicaragua | Churches and clergy targeted by the government | Warning on the consent step |
| Niger | Jihadist violence and instability | Warning on the consent step |
| Oman | Proselytising Muslims is prohibited; expatriate congregations only | Warning on the consent step |
| Palestine | No comprehensive law; security and social risk | Warning on the consent step |
| Qatar | Proselytising Muslims is prohibited; expatriate congregations only | Warning on the consent step |
| Russia | Missionary activity restricted (2016 amendments); data must be stored in Russia | Warning on the consent step |
| South Sudan | Armed conflict and fragile security | Warning on the consent step |
| Tunisia | Social and legal pressure on converts; existing communities only | Warning on the consent step |
| United Arab Emirates | Proselytising Muslims is a criminal offence; registered churches serve expatriates | Warning on the consent step |
| Uzbekistan | Proselytism is banned | Warning on the consent step |
The Jesus IndexA global measure of Jesus-following · jfindx.org
7 · Information for young people
You can hand this out, project it, or read it aloud.
What is this?
It's a short survey about faith: what you believe, how you live it out, and what helps or gets in the way. [Organisation name] is one of many churches and ministries around the world using it to understand how they can serve young people better.
Do I have to do it?
No. It's your choice. You can stop at any time, just by closing the page, and some questions let you choose “Prefer not to say”. Nothing happens if you don't take part.
Is it anonymous?
Yes. We never ask for your name, email, phone number or birthday. Nobody at [Organisation name], including your leaders, can see your answers. They only see results grouped across many people.
What happens to my answers?
They're stored securely. After 60 days, anything that could help point to you is removed, such as the exact time you answered. The rest is kept for up to 5 years to improve the survey, then only group totals are kept. If you stop part-way, the answers you've already given are kept the same way, anonymously.
What if a question is hard?
Some questions are personal. Answer as honestly as you can. If you'd rather not go on, you can stop. If anything brings up something you'd like to talk about, [named leader / safeguarding contact] is available.
Questions?
Ask [named leader], or read the full privacy notice at jfindx.org/privacy.
The Jesus IndexA global measure of Jesus-following · jfindx.org
8 · Information and consent form for parents and guardians
For 13–17-year-olds wherever your law, denomination or safeguarding policy requires a parent's or guardian's consent. Print it on your own letterhead. Keep signed forms yourself. Do not send them to the Index.
Dear parent or guardian,
On [date] at [event / group], [Organisation name] will invite young people to take part in the Jesus Index. It's a short anonymous survey, about 8 minutes on their own phone, used by churches and ministries around the world to understand young people's faith and what helps it grow.
What your child will be asked: questions about what they believe, how they practise their faith, how they relate to others, and what has shaped them. A few questions ask about their age group, gender (optional) and country. No question asks for anything that identifies them, and no question asks them to type their own words.
What is not collected: their name, email, phone number, date of birth, photo or IP address. Answers can't be traced back to your child, and [Organisation name] sees grouped results only.
How long answers are kept: full answers for 60 days. After that, details that could point to a person are removed, and the cleaned answers are kept for up to 5 years for research. After that, only grouped totals remain.
Taking part is voluntary. Your child can stop at any time, and saying no has no consequences. The personal questions about faith and gender offer “Prefer not to say”.
Questions? Contact [name, role, phone/email]. The full privacy notice is at jfindx.org/privacy.
Consent (return to [Organisation name]; kept by us, never shared with the Index)
Young person's first name: ______________________ Group: ______________________
☐ I agree to my child taking part in the Jesus Index survey.
☐ I do not agree to my child taking part.
Parent/guardian name: ______________________
Signature: ______________________ Date: ____________
The Jesus IndexA global measure of Jesus-following · jfindx.org
9 · Script to read before the survey
About 60 seconds. Read it, or say it in your own words, before sharing the link or QR code.
“We're going to give you the chance to take a short survey. It takes about 8 minutes, and it's about faith: what you believe and how you live it out. It's anonymous. There are no names, and none of us will ever see your answers. We only see results grouped across lots of people.
It's completely your choice. You can stop at any time, and that's fine. Some questions let you choose “Prefer not to say”. It's for ages 13 to 30, so if you're 12 or younger, please don't take it.
Find a spot where no one can see your screen. If anything in it brings something up for you, come and find [name] afterwards.
Thank you. Your honest answers help us, and churches around the world, serve young people better.”
10 · Checklist for the day
- ☐ Your organisation's consent is confirmed on the platform (Survey settings → Consent).
- ☐ This survey's consent is confirmed: countries, age groups, parental-consent method, and local advice where required.
- ☐ Parent/guardian forms collected where required, and stored by you.
- ☐ Link or QR code tested with a test link first.
- ☐ A named leader is available for anyone who wants to talk afterwards.
- ☐ Young people can answer privately.
- ☐ The script has been read.
11 · Disclaimer and contact
This is a reference, not legal advice. It summarises our understanding of each country's rules as of October 2026, mostly from law-firm summaries and official sources. Laws change, and individual country laws, regional laws, denominational rules and safeguarding policies may differ from or go beyond what is listed here. Items marked “to confirm” or “assume” were not verified against the law itself. Each organisation remains responsible for meeting the law and policies that apply to it. If in doubt, take local legal advice before you send a survey.
Questions about consent, the Index or your data: ulrich@nxtmove.global. Full privacy notice: jfindx.org/privacy · Terms for organisations: jfindx.org/terms
Sources
- “Addressing the Under-18 Research Gap” (internal scoping paper)
- DLA Piper, Data Protection Laws of the World (most countries)
- FTC, COPPA FAQ
- 45 CFR 46 (Common Rule)
- OPC, PIPEDA in brief
- Quebec Act P-39.1
- TCPS 2 (2022)
- ICO, special category data
- GDPR Art. 9
- GDPR Recital 26
- CNIL, consent for under-15s
- AZB & Partners, India's DPDP framework
- Bird & Bird, South Africa
- UUBO, Nigeria: personal data of a minor
- PIPL (official translation)
- China: foreign-related investigation measures
- DFDL, Indonesia PP 17/2025
- VietNamNet, religious activity rules
- CONEP Ofício-Circular 17/2022 (Brazil)
- Bird & Bird, Brazil
- Garrigues, Mexico's 2025 LFPDPPP
- Al Tamimi, Egypt's Executive Regulations
- National Bioethics Committee, Pakistan
- USCIRF 2026, Pakistan
- The Business Standard, Bangladesh ordinances
- Securiti, Bangladesh 2026 Act
- Ethiopia Proclamation 1321/2024 (full text)
- Bowmans, parental consent in East Africa
Resource version 2026-10-v2 · country reference 2026-10-v2