GLARS Deep Dive

Contents

• Introduction
  • Apolitical Principles
• Terminology
• GLARS Core Components
• Embargo and Sanctions Components
• Scoring Guide
• Scoring Methodology
• Risk Levels
• Perspective Score
• Transfer Risk Assessment
• Vector Notation
• Implementation Guidance
• Use Cases
• Evolution Roadmap
• Security Considerations
• References

Introduction

Data sovereignty assessments currently lack a standardized approach for quantifying jurisdictional risk. The Geo-Legal Access Risk Score (GLARS) addresses this gap by providing an objective, reproducible methodology for evaluating legal risks associated with data location and movement across international boundaries.

GLARS draws inspiration from established scoring systems such as CVSS (Common Vulnerability Scoring System), adapting proven quantification approaches to the domain of legal jurisdiction assessment. The goal is to transform subjective risk assessments into objective, comparable scores that enable data-driven decision-making.

Apolitical Principles

GLARS is designed to function as a strictly apolitical assessment framework. Its core principles include:

1. Evidence-Based Assessment: All evaluations rely solely on verifiable, publicly available information about legal frameworks, technical requirements, and enforcement mechanisms. The framework avoids subjective judgments or geopolitical interpretations.
2. Objective Criteria: The same evaluation criteria are applied consistently across all jurisdictions, regardless of political systems, alliances, or economic relationships. The methodology assesses the presence or absence of specific legal powers and mechanisms, not the governments that enact them.
3. Transparency: The assessment methodology is fully transparent, allowing users to understand exactly how scores are derived and which legal frameworks contribute to each evaluation.
4. Focus on Legal Facts: GLARS concentrates exclusively on the legal capabilities that exist within each jurisdiction, not on speculation about how those capabilities might be used. It measures what powers are legally available, not how they might be employed.

The framework encompasses three primary risk domains:

1. Legal access frameworks
2. Embargo restrictions
3. Sanctions regimes

Terminology

GLARS Core Components

GLARS evaluates risk across five primary legal dimensions:

Judicial Oversight (JO)

Evaluates the strength and independence of judicial review processes governing government access to data.

Example: In Germany, government agencies must obtain approval from an independent court before accessing stored communications data, with specific constraints on the target and scope. The court operates independently of the investigating agencies, creating strong judicial oversight (low JO score). In contrast, in some countries, intelligence agencies can access data with only internal executive branch approval or through secret courts with limited independence (high JO score).

Scoring: 0-100, where higher scores indicate weaker oversight and higher risk.

Agency Powers (AP)

Assesses the breadth and depth of legal authorities granted to government agencies for data access.

Example: The US FISA Section 702 authorizes intelligence agencies to collect foreign intelligence by targeting non-US persons reasonably believed to be abroad, with compelled assistance from US providers. Its statutory authority lapsed in June 2026, but collection continues under certifications the Foreign Intelligence Surveillance Court approved in March 2026. The CLOUD Act explicitly allows agencies to compel US-based providers to disclose data regardless of storage location. These broad powers result in a higher AP score compared to jurisdictions where agencies are limited to targeted collection with narrower scope.

Scoring: 0-100, where higher scores indicate broader powers and higher risk.

Technical Requirements (TR)

Measures mandated technical capabilities that providers must implement to facilitate government access.

Example: The UK's Technical Capability Notices under the Investigatory Powers Act can compel providers to modify systems to enable interception and data collection. In 2025 a notice reportedly required Apple to provide access to encrypted iCloud data; Apple withdrew Advanced Data Protection for UK users and is challenging a revised notice at the Investigatory Powers Tribunal. Australia's Assistance and Access Act allows authorities to require companies to create technical capabilities for accessing encrypted communications. These requirements create a high TR score compared to jurisdictions that don't mandate specific technical implementations for surveillance.

Scoring: 0-100, where higher scores indicate more extensive requirements and higher risk.

Extraterritoriality (EX)

Evaluates the degree to which a jurisdiction's legal frameworks assert authority beyond their borders.

Example: The US CLOUD Act explicitly claims authority over data held by US companies regardless of where the data is stored physically. Similarly, China's Data Security Law applies to data processing activities outside China that could harm China's national security. These expansive extraterritorial claims lead to higher EX scores compared to countries whose laws apply only to data within their territorial boundaries. Some laws push back: Article 32 of the EU Data Act, applicable since September 2025, requires cloud providers to take measures against third-country government access to non-personal data that would conflict with EU or member-state law.

Scoring: 0-100, where higher scores indicate greater extraterritorial reach and higher risk.

Transparency (TP)

Analyses the visibility into government data access activities, including public reporting and notification.

Example: The US Office of the Director of National Intelligence publishes an Annual Statistical Transparency Report on its use of FISA and National Security Letters (the thirteenth, covering 2025, appeared in April 2026), and the UK Investigatory Powers Commissioner publishes annual reports on warrants and notices. Conversely, some countries' intelligence agencies can issue access demands with indefinite gag orders, preventing service providers from disclosing even the existence of requests. Jurisdictions with extensive gag order provisions and minimal public reporting receive higher TP scores (higher risk).

Scoring: 0-100, where higher scores indicate lower transparency and higher risk.

Embargo and Sanctions Components

In addition to core legal components, GLARS incorporates two trade restriction factors:

Embargo Impact (EI)

Measures the severity of trade restrictions that prohibit or limit commercial activities with specific countries.

Example: The comprehensive US embargo against Cuba prohibits most transactions involving Cuban entities, including providing cloud services or data processing capabilities to Cuban companies. Similarly, EU embargoes against Russia restrict the export of certain technology and IT services. Organisations found violating these embargoes can face severe penalties, including substantial fines and criminal prosecution, resulting in high EI scores for these jurisdictions.

Scoring: 0-100, where higher scores indicate more severe embargo impacts and higher risk.

Sanction Severity (SS)

Evaluates targeted financial and economic restrictions affecting specific entities, individuals, or sectors.

Example: US sanctions against entities on the Specially Designated Nationals (SDN) list prohibit US persons from providing any services, including cloud computing or data storage, to listed entities. US secondary sanctions can also apply to non-US persons who engage with sanctioned entities. For instance, a European cloud provider working with sanctioned Russian financial institutions could face US secondary sanctions, requiring extensive screening procedures and creating high SS scores for jurisdictions with many sanctioned entities.

Scoring: 0-100, where higher scores indicate more severe sanctions and higher risk.

Scoring Guide

Assessors use their own judgement, but each score should be checkable against a shared measuring stick. For every component, the bands below describe what a jurisdiction at that level looks like in terms of the component’s factors. The questions are an optional aid: answer No, Partly or Yes (scored 0, 50 and 100, where “Yes” always means more risk), skip anything you cannot judge, and average the answers for a suggested score.

Judicial Oversight (JO)

Why it matters: Independent judges are the main check between an agency's request and your data. The weaker that check, the easier it is for access to happen without scrutiny.

Scoring rules (guide v1.2):

• Approval by a prosecutor counts as approval within the executive, unless the prosecutor is shown to be independent of government and the access can be challenged in court.
• Executive approval of national-security access stays in 41–60 where criminal access needs a judge and some independent check exists. It moves to 61–80 where high-volume access, such as communications data for all agencies or bulk collection, also has no independent check.

Questions:

1. Agencies can obtain stored data without prior approval from an independent judge or judicial commissioner.
2. The body that approves access sits inside, or answers to, the executive.
3. Approvals can cover broad categories or whole programmes rather than named targets.
4. Providers or affected people have no meaningful way to challenge access in court.

Agency Powers (AP)

Why it matters: This is how much agencies are legally allowed to collect and from whom. The broader the powers, the more of your data falls within scope.

Scoring rules (guide v1.2):

• A score of 61 or more needs a documented bulk or programme-level power, set out in law or officially acknowledged. Unconfirmed reports can move a score only within its band.
• Foreign-intelligence interception of communications crossing the border, such as cable or signals intelligence, counts as bulk collection in every country alike.

Questions:

1. Agencies can collect in bulk, not only data about specific targets.
2. Agencies can compel service providers to hand over data or give technical assistance.
3. The grounds for access are broad (such as national security or economic well-being) rather than limited to serious crime.
4. Foreign nationals' data has fewer protections than citizens' data.

Technical Requirements (TR)

Why it matters: Mandated capabilities change the system itself. Once a provider must build access in or weaken encryption, the data is exposed whoever is asking.

Scoring rules (guide v1.2):

• A standing duty to keep standard lawful-interception interfaces for executing warrants sits in 41–60. 61–80 is for orders to build new or bespoke capabilities, real-time or direct agency access to networks (including agency equipment in operators' networks), and duties to give notice of security changes.

Questions:

1. Providers can be required to build or maintain interception or access capabilities.
2. Providers can be required to remove or weaken encryption, or help decrypt data.
3. Providers must retain data such as metadata or logs for set periods for government use.
4. Authorities can require changes to products or infrastructure, or advance notice of changes.

Extraterritoriality (EX)

Why it matters: Some laws follow the company rather than the data, so storing data in another country does not take it out of reach.

Scoring rules (guide v1.2):

• A country that reaches data abroad only through mutual legal assistance or similar treaties scores 21–40, not 0–20.
• A power set out in law to obtain data held abroad without the other country’s cooperation counts, whether it compels a provider or allows police or intelligence services remote access to computers or accounts abroad: 41–60 with judicial approval, 61–80 without.
• The extraterritorial scope of data-protection law (such as GDPR Article 3(2)) is not a government access power. It can raise EX by at most 5 points within its band.

Questions:

1. The law claims access to data stored outside the country.
2. It applies to providers because of where they are headquartered or incorporated.
3. It reaches foreign subsidiaries or affiliates through corporate control.
4. It applies based on the nationality or location of the people the data is about.

Transparency (TP)

Why it matters: Secrecy hides how often powers are used and stops you from knowing your data was accessed, which makes every other risk harder to manage.

Scoring rules (guide v1.2):

• A disclosure offence or gag rule on its own is a 61–80 factor. 81–100 also needs the absence of any official statistics, oversight reporting or notification.

Questions:

1. The government publishes no meaningful statistics on data-access requests.
2. Providers can be prevented from disclosing requests, including indefinitely.
3. Affected people are rarely or never notified after access.
4. Reports by independent oversight bodies are unpublished or heavily redacted.

Embargo Impact (EI)

Why it matters: An embargo can make providing or using a service unlawful outright, however well the data itself is protected.

Questions:

1. A country-wide embargo restricts trade involving this jurisdiction.
2. The restrictions cover technology, IT or data services specifically.
3. Several major governments impose restrictions.
4. Few licences or exceptions are available.
5. Blocking statutes create conflicting legal obligations.

Sanction Severity (SS)

Why it matters: Targeted sanctions can prohibit dealing with specific organisations or people, and some penalties reach companies outside the sanctioning country.

Questions:

1. Providers, partners or sectors you would rely on are, or are likely to be, on sanctions lists.
2. Secondary sanctions can penalise foreign companies for dealing with listed parties.
3. Penalties for violations are severe, such as large fines or criminal liability.
4. Screening and due-diligence obligations are heavy.
5. Few exemptions exist for essential or humanitarian services.

Scoring Methodology

The GLARS framework uses a multi-layered approach to calculate risk scores.

Base Score Calculation

BaseScore = (JO × 0.2) + (AP × 0.25) + (TR × 0.15) + (EX × 0.25) + (TP × 0.15)

The base score evaluates the fundamental legal risk dimensions, with Agency Powers and Extraterritoriality weighted more heavily due to their significant impact.

Enhanced Score with Trade Restrictions

GLARSScore = max(BaseScore, EmbargoImpact, SanctionSeverity)

The final GLARS score takes the highest risk value from legal frameworks, embargoes, or sanctions, as each dimension independently can create prohibitive risks.

Because the final score is the highest of the three, a High embargo or sanction score always produces a High GLARS result. No separate rule is needed.

Risk Levels

GLARS scores are calibrated to three risk levels, each with specific implications for data handling:

Low Risk (0-40)

Strong legal protections with limited risk exposure

Recommended controls: Standard security measures and routine compliance monitoring.

Medium Risk (41-65)

Moderate access powers requiring enhanced controls

Recommended controls: Enhanced encryption, data minimization, jurisdictional isolation, and regular compliance reviews.

High Risk (66-100)

Extensive access powers requiring significant mitigation

Recommended controls: Data localization in lower-risk jurisdictions, entity separation, zero-knowledge architectures, or avoidance of jurisdiction entirely.

Perspective Score

The GLARS score describes a jurisdiction and is the same for everyone, so assessments can be compared. Where the question is asked from also matters: a UK organisation storing data in the US faces intelligence sharing and direct-access agreements that a German organisation does not, and counter-sanctions that bind one asker mean nothing to another. Like the Environmental score in CVSS, the Perspective score adjusts the Base score for the asker without changing it.

M        = clamp(product of the factors that apply, 0.8, 1.3)
GLARS-P  = min(100, max(Base × M, EI × rEI, SS × rSS))

Measured and judged inputs. The governance gap uses the World Bank Worldwide Governance Indicators (2026 release, 2025 data; governance scores 0–100), licensed CC BY 4.0. Which agreements and adequacy findings exist are facts from official texts. The size of each multiplier is a GLARS default rather than a published measure, so every weight can be changed in the calculator, and changed weights travel with the shared link.

Example. A UK asker with the Base score of 83 for data held in the US: Five Eyes ×1.10, CLOUD Act agreement ×1.05, UK adequacy for certified US organisations ×0.95 and a governance gap of ×1.05 give M = 1.15, so the Perspective score is 95. A German asker for the same data gets 83: EU adequacy and a governance gap apply, but not Five Eyes or the CLOUD Act agreement.

This is a first step towards the Jurisdiction Interaction Model: it covers the relationship between the asker and one jurisdiction, not yet how several jurisdictions holding the same data combine.

Transfer Risk Assessment

A key extension of the GLARS framework is the ability to evaluate risk between jurisdictions.

Transfer Risk Formula

TransferRisk = (EmbargoDiff + SanctionDiff + LegalDiff + CompetingJurisdictionsRisk) × DataClassMultiplier

Component Calculations

Vector Notation

GLARS uses a vector string format to enable precise communication of risk assessments.

Format

GLARS:1.0/B:JO:57/AP:80/TR:68/EX:85/TP:58/EI:70/SS:55/T:HEF:1.1/TV:1.05/LS:0.95/E:IRM:1.1/DSF:1.2/OE:1.05

Components

Implementation Guidance

Use Cases

Evolution Roadmap

Temporal Intelligence Factors

• Legislative VelocityRate of change in legal frameworks
• Enforcement Trend VectorDirectional changes in enforcement
• Legal StabilityScheduled expiries, pending court challenges and use of emergency legislation

Industry Context Multipliers

• Healthcare1.2-1.5×
• Financial1.3-1.6×
• Critical Infrastructure1.4-1.7×
• Telecommunications1.3-1.5×

Enforcement History Factors

• FEFForeign Entity Focus
• ETEExtraterritorial Enforcement
• MPAMax Penalty Application
• IAInvestigative Aggressiveness
• ASRAppeal Success Rate

Data Sensitivity Factors

• Critical2.0-2.5×
• Sensitive1.5-2.0×
• Confidential1.2-1.5×
• Restricted1.0-1.2×
• Public0.8-1.0×

Jurisdiction Interaction Model

• Cooperative EnforcementAmplifyingWhen jurisdictions have mutual legal assistance treaties
• Legal ConflictMitigatingWhen jurisdictions have directly conflicting legal requirements
• Blocking StatutesMitigatingLaws designed to block extraterritorial reach
• Corporate StructureAmplifyingParent-subsidiary relationships creating exposures

Security Considerations

References

North America

1. USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act), Pub. L. No. 107-56, 115 Stat. 272 (2001). Available at: https://www.congress.gov/bill/107th-congress/house-bill/3162
2. Foreign Intelligence Surveillance Act of 1978 (FISA), 50 U.S.C. §§ 1801-1885c. Available at: https://www.govinfo.gov/content/pkg/STATUTE-92/pdf/STATUTE-92-Pg1783.pdf
3. Clarifying Lawful Overseas Use of Data Act (US CLOUD Act), H.R. 4943, 115th Congress (2018). Available at: https://www.congress.gov/bill/115th-congress/house-bill/4943
4. Executive Order 12333—United States Intelligence Activities, 46 FR 59941 (December 4, 1981). Available at: https://www.archives.gov/federal-register/codification/executive-order/12333.html
5. Reforming Intelligence and Securing America Act (RISAA), Pub. L. No. 118-49 (2024), reauthorising FISA Section 702 until April 2026. Available at: https://www.congress.gov/bill/118th-congress/house-bill/7888
6. FISA Amendments Act of 2008, Pub. L. No. 110-261, 122 Stat. 2436. Available at: https://www.congress.gov/bill/110th-congress/house-bill/6304
7. Canada. (2019). "An Act respecting national security matters (Bill C-59)." S.C. 2019, c. 13. Available at: https://laws-lois.justice.gc.ca/eng/annualstatutes/2019_13/
8. Mexico. (2017). "Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados." Available at: http://www.diputados.gob.mx/LeyesBiblio/pdf/LGPDPPSO.pdf

Europe

9. Investigatory Powers Act 2016 (UK). Available at: https://www.legislation.gov.uk/ukpga/2016/25/contents
10. Investigatory Powers Act 2016 (UK), section 253: Technical capability notices. Available at: https://www.legislation.gov.uk/ukpga/2016/25/section/253
11. Investigatory Powers (Amendment) Act 2024 (UK). Available at: https://www.legislation.gov.uk/ukpga/2024/9/contents
12. European Union. (2016). "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)." Official Journal of the European Union, L119, 1-88. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
13. European Union. (2023). "Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act)", Article 32. Available at: https://eur-lex.europa.eu/eli/reg/2023/2854/oj
14. European Union. (2018). "Directive (EU) 2018/1972 establishing the European Electronic Communications Code." Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018L1972
15. European Union. (1996). "Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases." Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31996L0009
16. Germany. (2017). "Bundesdatenschutzgesetz (BDSG)", enacted by the Datenschutz-Anpassungs- und Umsetzungsgesetz EU (DSAnpUG-EU), in force May 2018. Available at: https://www.gesetze-im-internet.de/bdsg_2018/
17. France. (2018). "Loi n° 2018-493 du 20 juin 2018 relative à la protection des données personnelles." Available at: https://www.legifrance.gouv.fr/loda/id/JORFTEXT000037085952/
18. Russia. (2014). "Federal Law No. 242-FZ on Amendments to Certain Legislative Acts of the Russian Federation Regarding Clarifying the Procedure for Personal Data Processing in Information and Telecommunications Networks." Available at: http://publication.pravo.gov.ru/Document/View/0001201407220002

Asia-Pacific

19. Information Technology Act, 2000 (India), Section 69. Available at: https://www.meity.gov.in/content/information-technology-act-2000
20. Ministry of Home Affairs, Government of India. "NATGRID: National Intelligence Grid." (The previously cited MHA document is no longer online.)
21. Telecommunications Act, 2023 (India), section 20, and the Telecommunications (Procedures and Safeguards for Lawful Interception of Messages) Rules, 2024. Available at: https://dot.gov.in/acts-rules
22. Digital Personal Data Protection Act, 2023 (India) and Digital Personal Data Protection Rules, 2025. Available at: https://www.meity.gov.in/data-protection-framework
23. Reserve Bank of India. (2018). "Storage of Payment System Data." RBI/2017-18/153. Available at: https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11244
24. China. (2017). "Cybersecurity Law of the People's Republic of China." Available at: http://www.cac.gov.cn/2016-11/07/c_1119867116.htm
25. China. (2021). "Data Security Law of the People's Republic of China." Available at: http://www.npc.gov.cn/npc/c30834/202106/7c9af12f51334a73b56d7938f99a788a.shtml
26. China. (2021). "Personal Information Protection Law of the People's Republic of China." Available at: http://www.npc.gov.cn/npc/c30834/202108/a8c4e3672c74491a80b53a172bb753fe.shtml
27. Japan. (2003). "Act on the Protection of Personal Information (Act No. 57 of 2003)." Available at: https://www.ppc.go.jp/files/pdf/Act_on_the_Protection_of_Personal_Information.pdf
28. Australia. (2018). "Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018." Available at: https://www.legislation.gov.au/Details/C2018A00148
29. Singapore. (2012). "Personal Data Protection Act 2012." Available at: https://sso.agc.gov.sg/Act/PDPA2012
30. New Zealand. (2020). "Privacy Act 2020." Available at: https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html
31. South Korea. (2011). "Personal Information Protection Act." Available at: https://www.law.go.kr/LSW/eng/engLsSc.do?menuId=2§ion=lawNm&query=personal+information&x=0&y=0#liBgcolor0

Middle East and Africa

32. Israel. (2017). "Protection of Privacy Law 5741-1981 (as amended)." Available at: https://www.gov.il/he/departments/legalInfo/legislation_privacy
33. United Arab Emirates. (2019). "Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields." Available at: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
34. South Africa. (2013). "Protection of Personal Information Act 4 of 2013." Available at: https://www.gov.za/documents/protection-personal-information-act

International Agreements and Organizations

35. Cox, J. (2018). "The Five Eyes: The Intelligence Alliance of the Anglosphere." UK Defense Journal. Available at: https://ukdefencejournal.org.uk/the-five-eyes-the-intelligence-alliance-of-the-anglosphere/
36. Office of the Director of National Intelligence. (2026). "Annual Statistical Transparency Report Regarding National Security Authorities, Calendar Year 2025." Available at: https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2026/4150-pr-05-26
37. United Kingdom and United States. (2019). "Agreement on Access to Electronic Data for the Purpose of Countering Serious Crime" (UK-US Data Access Agreement), in force October 2022. Available at: https://www.gov.uk/government/publications/ukusa-agreement-on-access-to-electronic-data-for-the-purpose-of-countering-serious-crime-cs-usa-no62019
38. United Nations. (2015). "The right to privacy in the digital age." Human Rights Council Resolution 28/16. Available at: https://documents-dds-ny.un.org/doc/UNDOC/GEN/G15/068/78/PDF/G1506878.pdf
39. Council of Europe. (1981). "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data." European Treaty Series No. 108. Available at: https://rm.coe.int/1680078b37