In data protection law, a third country is any state outside the European Union and the European Economic Area.
Which countries are third countries?
The EEA comprises the EU Member States plus Iceland, Liechtenstein and Norway. The GDPR applies to these states, so they are not third countries. All other states, including Switzerland, the United Kingdom and the USA, are third countries.
Adequate level of data protection
The European Commission can decide that a third country ensures an adequate level of protection. Such adequacy decisions exist, for example, for Switzerland, Japan and Canada (for commercial organisations) and for the USA in respect of companies certified under the EU-U.S. Data Privacy Framework. The European Commission publishes the current list.
For all other third countries, appropriate safeguards such as standard contractual clauses or one of the derogations in Art. 49 GDPR are required.
Legal provisions
- Art. 44 GDPR
- General principle for transfers to third countries.
- Art. 45 GDPR
- Transfers on the basis of an adequacy decision.
- Art. 46 GDPR
- Transfers subject to appropriate safeguards.
Related terms.
Standard contractual clauses (SCCs) Standard contractual clauses are model contracts issued by the European Commission that provide appropriate safeguards for transfers of personal data to third countries. Art. 46(2)(c) GDPR Schrems II Schrems II is the CJEU judgment of 16 July 2020 (C-311/18) which declared the EU-US Privacy Shield invalid. CJEU, C-311/18 