What changed in the data

Vietnam's operative data-protection instrument is now a statute: the Law on Personal Data Protection No. 91/2025/QH15, in force since 1 January 2026, as the Ministry of Public Security confirms. Our entry still pointed to Decree 13/2023/ND-CP, which the law superseded as the primary source of obligations. The year field moves from 2023 to 2026 in the same pass.

Seychelles replaced its 2003 data-protection law with the Data Protection Act 2023 (Act 24 of 2023), as the Seychelles Information Commission confirms. Our entry still showed the 2003 Act, which misstated the position for anyone processing personal data there. The year field moves from 2003 to 2023 in the same pass.

Full re-check of the status fields against their single primary sources. FATF: the latest statements are still those of the June 2026 plenary (19 June); the five jurisdictions tracked here on the grey list — Bulgaria, Kenya, Kuwait, Vietnam and the British Virgin Islands — are unchanged. Apostille: the HCCH status table (last updated 30 June 2026) shows no new contracting party among the 90 beyond those already recorded; Thailand's entry into force on 28 February 2027 remains in the schedule. Sanctions: the UK country-regime list, the EU Council's Russia timeline and OFAC's recent actions since 17 September contain designations, removals and licence changes, but no new programme against a whole jurisdiction; Russia and Belarus remain the only two of the 90 under broad sectoral measures. Nothing in the table changed, so the dataset version stays 2.7. From this pass on, the front page no longer promises a fixed two-week cycle: the date shown is the last completed re-check, and each one is written up here.

Full re-check of the status fields, which is what the review date on the front page covers. FATF: no statement has been published since the 17–19 June 2026 plenary, and the five jurisdictions tracked here that sit on the grey list — Bulgaria, Kenya, Kuwait, Vietnam and the British Virgin Islands — are unchanged. Apostille: the whole HCCH status table was compared against all 90 entries mechanically rather than by eye. Eighty-two match directly, seven are covered by extension of the ratifying state (Hong Kong through China; the British Virgin Islands, Cayman Islands, Jersey, Guernsey, the Isle of Man and Bermuda through the United Kingdom), and Thailand is a contracting party whose Convention does not enter into force until 28 February 2027, so it correctly still reads no. Zero discrepancies. Sanctions: the UK regime index, the EU Council pages for Russia and Belarus, and the OFAC country-programme index were read. Of the 90, only Russia and Belarus are under broad sectoral measures. China and Hong Kong appear in the UK and US country indexes, but as an arms embargo and targeted designations rather than sectoral measures, so both remain marked no — a judgement, made deliberately, not an omission. Corporate tax rates are not part of this pass: each rests on its own ministry source and they are re-checked in rotating batches.

The 1961 Apostille Convention enters into force for Vietnam today. Documents issued in a contracting state and destined for Vietnam — and Vietnamese documents going the other way — take an apostille from the competent authority instead of the consular legalisation chain. Vietnam acceded on 31 December 2025 and the HCCH status table gives 11 September 2026 as the date of entry into force; this change was announced in our diary in advance and applied on the day. Two points worth keeping: the Convention does not apply between Vietnam and a contracting state that objected to its accession, and an apostille certifies the signature and seal, never the content of the document.

A new field has been added across all 90 jurisdictions: their position in the EU list of non-cooperative jurisdictions for tax purposes. It carries four states rather than two — Annex I (listed), Annex II (commitments given and being tracked, which is where substance undertakings sit), not listed, and not applicable for EU member states, since the list covers third countries only. Taken from the Council of the EU's own list in the revision of 17 February 2026 and cross-checked against the Commission's page. The Council revises it twice a year.

Cyprus raised the corporate income tax rate from 12.5% to 15%. This is alignment with the OECD Pillar Two minimum rather than a one-off fiscal grab: the 12.5% headline had become the gap that large groups topped up elsewhere anyway. Voted by the House of Representatives on 22 December 2025, published in the Official Gazette on 31 December 2025, effective for tax years from 1 January 2026. Flagged pending verification in our own notes — four independent professional sources agree on the dates, but the Cyprus finance portal is unreachable and the statute itself has not been read.

Estonia's distribution rate is 22/78, in force since 1 January 2025 — our 20% was two years out of date. Worth knowing what did not happen: a further rise to 24% was passed on 18 June 2025 and then cancelled by government decision on 24 September 2025, together with the planned security tax. So the figure to plan against is 22%, not 24%, and the mechanism is unchanged — tax falls due on distribution, not on profit as it accrues.

Luxembourg's aggregate burden for a company in Luxembourg City is 23.87%, down from 24.94%: corporate income tax 16%, employment-fund surcharge 1.12%, municipal business tax 6.75% at the city's 225% multiplier. The figure is municipality-specific by construction — the municipal component varies by commune, so a company established outside the capital lands on a different total. We have not read the 2026 table of municipal multipliers.

Portugal is not making one cut but running a schedule: 19% for tax periods beginning in 2026, 18% in 2027, 17% from 2028. Our 21% had missed two steps down. Article 87 of the CIRC now carries the sequence explicitly, so the rate a structure faces depends on which year it is planning for — quoting a single number for Portugal is about to be wrong twice.

Ghana has been a party to the New York Convention since 9 April 1968, in force since 8 July 1968 — nearly sixty years. Our "no" was simply wrong. The likely cause is worth naming: Ghana genuinely is not a party to the Apostille Convention, and that status appears to have been carried across to the neighbouring field. The practical consequence of the error was material — it suggested an arbitral award could not be enforced in Ghana when in fact it can.

Seychelles acceded to the New York Convention in its own right on 3 February 2020, in force 3 May 2020, with the two standard reservations: (a) reciprocity — awards made in the territory of another contracting state — and (c) commercial character. Recent enough that an older reference work would have said no, which is presumably where our value came from; it has been wrong for over six years.

The Cayman Islands are covered by the New York Convention through the United Kingdom's territorial extension of 26 November 1980, subject to a reciprocity reservation — awards made in the territory of another contracting state. The mechanism matters and is not a footnote: this is not an accession by Cayman in its own right, so the reservations that apply are the United Kingdom's as extended, not any that Cayman might have chosen. For anyone drafting an arbitration clause with a Cayman vehicle, that distinction changes which awards travel.

Jordan's Personal Data Protection Law No. 24 of 2023 is enacted, not a draft. Our entry still described it as pending, which understated the compliance position for anyone processing Jordanian personal data. The year field moves from "N/A" to 2023 in the same pass.

The British Virgin Islands do have a data-protection statute: the Data Protection Act 2021. Our entry said "None", which is the kind of error that reads as a feature — it suggested a jurisdiction with no data-protection obligations at all, and someone could have chosen a BVI vehicle on that basis. Year corrected to 2021.

Canada's operative law is PIPEDA, in force since 2000. Bill C-27 died when Parliament was prorogued in January 2025 and never became law; the successor, Bill C-36 (45-1), is at second reading and has not received royal assent. Our entry named C-27 as if it were in force and dated the regime to 2023 — both wrong. Year corrected to 2000, the year PIPEDA actually took effect.

The year on Israel's regime was wrong. Amendment 13 to the Protection of Privacy Law 5741-1981 belongs to 2025, not 2023 — it is the amendment that rebuilt enforcement and the powers of the Privacy Protection Authority. The law named in the entry was right; only its date was off.

Japan amended the Act on the Protection of Personal Information: Act No. 56 of 17 July 2026, passed by the House of Councillors on 10 July 2026. One thing to watch before relying on the new text — commencement is set by cabinet order within two years of promulgation, and as of 14 August 2026 that order had not been issued. So the amendment is law but not yet the law you comply with, and the date is on our diary.

Argentina does impose a residency requirement on the board. Article 256 of Ley 19.550 requires that an absolute majority of the directors of a sociedad anónima have their real domicile in Argentina — a stricter rule than the single resident director common elsewhere, because it scales with the size of the board. Our earlier “not required” was wrong. Flagged by cross-checking against the forma. jurisdiction database.

Oman is a party to the 1961 Hague Apostille Convention and has been since 30 January 2012. Our earlier “confirm before relying” flag was simply wrong. Public documents from Oman need an apostille only — no consular legalisation.

Vietnam acceded to the Apostille Convention on 31 December 2025, but accession is not entry into force. The Convention only enters into force for Vietnam on 11 September 2026. Until that date consular legalisation is still required, so we flipped the flag back to “no”.

FATF re-verified against the 17–19 June 2026 plenary. The grey list stands at 22 jurisdictions; of those, only Bulgaria, Kenya, Kuwait, Vietnam and the British Virgin Islands are tracked here, and all five were already flagged correctly. June's additions (Bosnia and Herzegovina, Iraq) and removals (Algeria, Namibia) fall outside this dataset. Black list unchanged: DPRK, Iran, Myanmar.