Privacy & no-KYC

Which countries have no mandatory data retention?

Short answer

Panama, Seychelles, Belize, Costa Rica, Curaçao, Moldova and Georgia impose no general data-retention obligation on hosting providers. Switzerland's obligations are narrow and telecoms-focused. Romania struck its retention law down twice on constitutional grounds, and the EU's original Data Retention Directive was invalidated by the Court of Justice in 2014.

Retention law usually targets telecommunications operators rather than hosting providers, so the practical question is how broadly a given country defines "operator". In several EU states the definition has been read widely enough to capture hosts.

Because obligations change, we treat this as a live question rather than a settled one. If a jurisdiction we operate in introduces a retention mandate, we will say so on the location page and in the warrant canary rather than quietly complying.

See also: Warrant canary · Data retention