Data room providers by country
Privacy law, transfer rules, currency and deal practice differ by market. Choose a country for a local shortlist.
The software is global; the rules around it are local
Most data room providers sell the same product everywhere. What changes from one country to the next is the frame around it: which privacy law governs the personal data in the room, what counts as a transfer when a bidder logs in from abroad, which regulators can keep a deal open for months, and how tax lands on an invoice priced in US dollars.
Each guide below covers those points for one market, with a deal timeline, the data protection duties that matter in a transaction, the routes for cross-border access, common mistakes and a cost calculator in the local currency. The shortlists differ by country, and every figure is indicative, so confirm prices and legal positions with the provider and your advisers.
United States
Sector laws plus state privacy acts such as the CCPA
- Sales tax
- Varies by state
- Watch for
- HSR filing and waiting period
United Kingdom
UK GDPR and the Data Protection Act 2018
- VAT
- 20%
- Watch for
- Takeover Code timetable or NSI Act notification
Canada
PIPEDA, plus Quebec Law 25 and the Alberta and BC PIPAs
- GST/HST
- 5%
- Watch for
- Competition Act notification or Investment Canada Act review
Australia
Privacy Act 1988 and the Australian Privacy Principles
- GST
- 10%
- Watch for
- ACCC notification and FIRB approval
Germany
GDPR and the BDSG
- VAT (USt)
- 19%
- Watch for
- Notarial deed for GmbH share transfers
France
GDPR and the Loi Informatique et Libertés
- TVA
- 20%
- Watch for
- CSE consultation before a binding sale decision
Netherlands
GDPR and the UAVG (Dutch GDPR Implementation Act)
- BTW
- 21%
- Watch for
- Works council advice before transferring control
Singapore
Personal Data Protection Act 2012 (PDPA)
- GST
- 9%
- Watch for
- MAS approval for control of regulated institutions
United Arab Emirates
Federal PDPL onshore; separate DIFC and ADGM data protection laws
- VAT
- 5%
- Watch for
- Identifying the regime: mainland, DIFC or ADGM
India
Digital Personal Data Protection Act 2023 and the DPDP Rules 2025
- GST (IGST)
- 18%
- Watch for
- SEBI rules on sharing price-sensitive information
Ireland
GDPR and the Data Protection Act 2018
- VAT
- 23%
- Watch for
- Third-country transaction screening by the enterprise department
Spain
GDPR and the LOPDGDD (Organic Law 3/2018)
- IVA
- 21%
- Watch for
- Prior FDI authorisation and a public deed for SL shares
Italy
GDPR and the Italian Privacy Code (Legislative Decree 196/2003)
- IVA
- 22%
- Watch for
- Golden power notification to the Presidency of the Council of Ministers
Sweden
GDPR and the Swedish Data Protection Act (2018:218)
- Moms
- 25%
- Watch for
- ISP foreign direct investment screening
Poland
GDPR and the Personal Data Protection Act of 10 May 2018
- VAT
- 23%
- Watch for
- UOKiK merger clearance before closing
South Korea
Personal Information Protection Act (PIPA)
- VAT
- 10%
- Watch for
- KFTC merger filing and core technology approvals
Key facts by country
A quick comparison of the local frame around a deal room. Rates are indicative; tax is the standard national rate before any reverse charge.
| Country | Currency | 1 USD ≈ | Tax | Data protection | Supervisor | Cross-border access |
|---|---|---|---|---|---|---|
| United States | USD (US dollar) | 1 USD | Sales tax, varies | Sector laws plus state privacy acts such as the CCPA | FTC and state attorneys general; CPPA in California | No general federal transfer rule; a DOJ rule limits bulk sensitive data to countries of concern |
| United Kingdom | GBP (pound sterling) | 0.76 GBP | VAT 20% | UK GDPR and the Data Protection Act 2018 | Information Commissioner's Office (ICO) | UK adequacy regulations, IDTA or UK Addendum |
| Canada | CAD (Canadian dollar) | 1.43 CAD | GST/HST 5% | PIPEDA, plus Quebec Law 25 and the Alberta and BC PIPAs | Office of the Privacy Commissioner and provincial commissioners | Contractual safeguards; Quebec requires an assessment first |
| Australia | AUD (Australian dollar) | 1.44 AUD | GST 10% | Privacy Act 1988 and the Australian Privacy Principles | Office of the Australian Information Commissioner (OAIC) | APP 8 reasonable steps, usually by contract |
| Germany | EUR (euro) | 0.89 EUR | VAT (USt) 19% | GDPR and the BDSG | State data protection authorities and the BfDI | EU adequacy decision, SCCs or another Chapter V safeguard |
| France | EUR (euro) | 0.89 EUR | TVA 20% | GDPR and the Loi Informatique et Libertés | CNIL | EU adequacy decision, SCCs or another Chapter V safeguard |
| Netherlands | EUR (euro) | 0.89 EUR | BTW 21% | GDPR and the UAVG (Dutch GDPR Implementation Act) | Autoriteit Persoonsgegevens | EU adequacy decision, SCCs or another Chapter V safeguard |
| Singapore | SGD (Singapore dollar) | 1.28 SGD | GST 9% | Personal Data Protection Act 2012 (PDPA) | Personal Data Protection Commission (PDPC) | Comparable protection, usually by contract or binding corporate rules |
| United Arab Emirates | AED (UAE dirham) | 3.6725 AED | VAT 5% | Federal PDPL onshore; separate DIFC and ADGM data protection laws | UAE Data Office; DIFC and ADGM data protection offices | Depends on the regime: onshore PDPL, DIFC or ADGM rules |
| India | INR (Indian rupee) | 97 INR | GST (IGST) 18% | Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 | Data Protection Board of India | Allowed unless the destination is restricted; sector localisation rules still apply |
| Ireland | EUR (euro) | 0.89 EUR | VAT 23% | GDPR and the Data Protection Act 2018 | Data Protection Commission (DPC) | EU adequacy decision, SCCs or another Chapter V safeguard |
| Spain | EUR (euro) | 0.89 EUR | IVA 21% | GDPR and the LOPDGDD (Organic Law 3/2018) | Agencia Española de Protección de Datos (AEPD) | EU adequacy decision, SCCs or another Chapter V safeguard |
| Italy | EUR (euro) | 0.89 EUR | IVA 22% | GDPR and the Italian Privacy Code (Legislative Decree 196/2003) | Garante per la protezione dei dati personali | EU adequacy decision, SCCs or another Chapter V safeguard |
| Sweden | SEK (Swedish krona) | 9.6 SEK | Moms 25% | GDPR and the Swedish Data Protection Act (2018:218) | Integritetsskyddsmyndigheten (IMY) | EU adequacy decision, SCCs or another Chapter V safeguard |
| Poland | PLN (Polish zloty) | 3.8 PLN | VAT 23% | GDPR and the Personal Data Protection Act of 10 May 2018 | President of the Personal Data Protection Office (UODO) | EU adequacy decision, SCCs or another Chapter V safeguard |
| South Korea | KRW (South Korean won) | 1400 KRW | VAT 10% | Personal Information Protection Act (PIPA) | Personal Information Protection Commission (PIPC) | Separate consent or another PIPA Article 28-8 ground |
Exchange rates: Rounded, fixed for illustration and not a live rate. Check the current rate with your bank. Legal summaries are simplified; take advice on your deal.
What the 16 markets have in common
Access is the trigger
In most markets covered here, a bidder opening a file from abroad counts as a transfer or overseas disclosure. Map viewers by location before personal data goes in.
Reviews keep rooms open
Merger control, foreign investment screening and sector approvals can add months after signing. Budget the room to closing, not to the end of diligence.
Minimise, then release
Aggregated schedules in early rounds and named records only for the final bidder is the safest pattern under every regime we cover.
Local steps shape timing
Works councils in France, Germany and the Netherlands, notaries in Germany and the Netherlands, schemes in Australia and India: each changes when the room opens and closes.
USD prices, local tax
Most vendors price in dollars. Exchange rate movement and VAT, GST or sales tax decide the real cost, and business buyers often self-account for tax.
The archive is evidence
Purchase agreements in many markets tie disclosure to what sat in the room. Export the index, Q&A log and audit trail at signing.
Questions about country guides
Does a data room have to be hosted in the country of the deal?
In the 16 markets covered here, general privacy law does not require local hosting for a deal room. What it does require is a valid basis for letting viewers in other countries see personal data. Sector rules, such as for health or payment data, and some public-sector contracts can add residency requirements, so check those separately.
Does a bidder viewing files from abroad count as a transfer?
Under the GDPR, UK GDPR, Australian, Canadian and Singapore rules, remote access by an overseas recipient is generally treated as a transfer or disclosure, even if the server stays in the home country. Plan the transfer mechanism around where the viewers are, not where the files are stored.
Why are prices on this site in US dollars?
Most data room providers publish or quote in USD, so we show USD list prices and on-request labels from our research. Each country guide includes a calculator that converts an indicative USD estimate at a fixed, rounded rate. Confirm the currency, price and tax treatment with the provider.
Is VAT or GST charged on a foreign data room subscription?
Often the business buyer accounts for it through the reverse charge and recovers it if fully taxable, as in the EU, UK, India and the UAE. In Australia, Singapore and Canada the supplier may charge it depending on registration. The US has no federal VAT, and state sales tax treatment of SaaS varies. Confirm with your adviser.
Is the shortlist different in each country?
Yes. Each guide lists four or five rooms chosen for that market, based on our editorial ratings and local fit, such as headquarters, deployment options or common deal types. Ratings are editorial and explained in our methodology.