# Standards and Regulatory References — Conflicting Laws Management

## International Frameworks for Conflict Resolution

### OECD Privacy Guidelines (2013)
- Principle of interoperability: privacy frameworks should be developed to work with other frameworks
- Encouraged consistent implementation to reduce cross-border conflicts
- Accountability principle enables flexible approaches to compliance

### APEC Privacy Framework (2015 update)
- Cross-Border Privacy Rules (CBPR) designed to reduce conflicts between APEC economies
- Provides a common baseline that member economies recognise
- Does not eliminate conflicts but reduces them for participating organisations

### Council of Europe Convention 108+ (2018)
- Modernised international standard for data protection
- Designed to be compatible with national laws
- Art. 14: Transborder flows with safeguards to prevent circumvention

## Key Conflict Areas

### Data Localisation Requirements by Jurisdiction

| Jurisdiction | Requirement | Scope | Legal Basis |
|-------------|-------------|-------|-------------|
| China (PIPL) | CIIO data stored in PRC | CIIOs and large processors | Art. 40 |
| India (RBI) | Payment system data in India | Payment system operators | RBI Circular April 2018 |
| Russia (Federal Law 242-FZ) | Russian citizens' data in Russia | All personal data processing | Art. 18(5) |
| Indonesia (GR 71/2019) | Strategic electronic systems in Indonesia | Public sector electronic systems | Art. 20 |
| Vietnam (Decree 13) | Important data assessment required | Cross-border transfers | Art. 25 |
| Saudi Arabia (PDPL) | Certain data categories in Saudi Arabia | As prescribed | PDPL Art. 29 |

### Government Access Conflicts

| Jurisdiction | Government Access Regime | Tension With |
|-------------|------------------------|-------------|
| United States | FISA 702, CLOUD Act | EU GDPR (Schrems II) — EU-US DPF framework |
| China | National Security Law, Cybersecurity Law | EU GDPR SCCs — TIA required |
| India | Information Technology Act Section 69 | EU GDPR — supplementary measures needed |
| Russia | SORM (lawful interception) | EU GDPR — supplementary measures needed |

## Resolution Principles

### Principle 1: Highest Common Denominator
Apply the most protective standard where requirements are compatible but differ in stringency.

### Principle 2: Jurisdictional Specificity
Where requirements are truly incompatible, implement jurisdiction-specific controls and document the conflict resolution.

### Principle 3: Risk-Based Approach
Where no resolution fully satisfies all jurisdictions, adopt the approach that minimises aggregate risk, considering enforcement likelihood, penalty exposure, and data subject impact.

### Principle 4: Transparency
Document all conflicts and resolutions transparently for regulatory inquiry.