Data Protection Monitor · Cross-Jurisdiction Domain Hub
Cross-border & adequacy
Jurisdiction Readings (167 markets)
31 Confirmed
67 Probable
69 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Amber | The Malabo Convention does not itself establish a GDPR-style adequacy mechanism. The principal continental instrument bearing on cross-border data flows is the AU Data Policy Framework, which aims to… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Red | Alabama, as a US state, has no adequacy-decision framework, SCC/BCR regime, or data-localisation mandate of its own; cross-border personal-data transfer questions touching Alabama residents are… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Red | As a US state without an omnibus privacy statute, Alaska has no state-level cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | PIPA-covered organizations must additionally comply with PIPEDA for trans-border commercial data flows, since Alberta's substantially-similar status only displaces PIPEDA for intra-provincial… | Profile →Brief |
| Algeria (DZ) | Africa | Amber | Algeria's data-protection law is understood, by regional statutory pattern, to condition cross-border personal-data transfers on prior ANPDP authorisation or an assessment of the destination… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No source located on transfer mechanisms, adequacy decisions received or granted, SCC/BCR uptake, transfer-impact-assessment duties, or data-localisation mandates for Antigua and Barbuda. No EU… | Profile →Brief |
| Argentina (AR) | Americas | Green | Argentina received an EU Commission adequacy decision in 2003 — one of the earliest such findings — which remains in effect. The domestic Act prohibits transfers to jurisdictions lacking adequate… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Red | Arizona has no state-level cross-border data-transfer regime, no adequacy mechanism, and no data-localisation mandate. Cross-border transfer questions arising from AZ-resident data are governed… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Red | In the absence of a comprehensive consumer-privacy statute, Arkansas has no state-level cross-border transfer-mechanism, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Amber | This is the core module for the APAC bloc row. Two voluntary transfer mechanisms operate in parallel: the Global CBPR/PRP certification system (whose membership extends beyond APAC to Canada, Mexico… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Amber | APP 8 and s16C create an accountability-based (not adequacy-list-based) cross-border transfer regime: an APP entity must take reasonable steps to ensure an overseas recipient will not breach the APPs… | Profile →Brief |
| Austria (AT) | Europe | Green | As an EU Member State, Austria applies the GDPR Chapter V transfer regime uniformly: European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, and Article 49… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Red | No transfer-mechanism detail (adequacy, SCCs, BCRs, derogations), adequacy decisions received or granted, transfer-impact-assessment requirement, or data-localisation mandate could be confirmed for… | Profile →Brief |
| Belgium (BE) | Europe | Green | As an EU Member State, Belgium relies on the EU-level GDPR Chapter V transfer regime: European Commission adequacy decisions, SCCs, BCRs, and Article 49 derogations. Adequacy decisions are… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced provisions on transfer mechanisms, adequacy status (received or granted), SCC/BCR uptake, transfer-impact-assessment duties, or data-localisation mandates for Belize were located. Belize… | Profile →Brief |
| Brazil (BR) | Americas | Green | Article 33 provides an exhaustive list of transfer mechanisms (adequacy, standard contractual clauses, BCRs, consent, legal-obligation, contract necessity, and other named grounds). ANPD published… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | PIPA governs BC-internal personal information flows, while PIPEDA continues to apply to interprovincial and international commercial transfers and to federally-regulated works and undertakings even… | Profile →Brief |
| Bulgaria (BG) | Europe | Amber | As an EU Member State, Bulgaria applies the GDPR Chapter V transfer regime directly (adequacy decisions, SCCs, BCRs, derogations); adequacy decisions are issued/received at EU-Commission level rather… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | The draft LPDP proposes cross-border transfer restrictions and an overseas-representative requirement, but no enacted transfer regime, adequacy determination, or localisation mandate currently… | Profile →Brief |
| Cameroon (CM) | Africa | Amber | The draft law contemplates cross-border transfer mechanisms including standard contractual clauses approved by the Data Protection Authority and binding corporate rules adopted by the data importer.… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Amber | Canada's 2002 EU adequacy decision is scoped only to organizations and data governed by PIPEDA (i.e., commercial activity); it does not extend to purely provincially-regulated activity… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Green | PIPEDA takes an organization-to-organization accountability approach to outbound transfers rather than an adequacy-gated model domestically. Canada (via PIPEDA) has held EU adequacy since 2001… | Profile →Brief |
| Chile (CL) | Americas | Amber | Ley 21.719 introduces, for the first time, a structured international-transfer regime with multiple transfer mechanisms (adequacy-style destination assessment, contractual clauses/BCRs… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | PIPL Article 38 offers three cross-border transfer mechanisms — CAC-led security assessment, PI-protection certification, or a CAC-standard-contract (Chinese SCC, effective 1 June 2023) — with… | Profile →Brief |
| Colombia (CO) | Americas | Amber | Colombia treats every non-Colombian jurisdiction as a 'third country' and requires an adequate level of protection for outbound transfers, achievable via SIC adequacy decisions, statutory exceptions… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Red | The Colorado Privacy Act is a US state consumer-privacy statute and contains no international-transfer mechanism, adequacy-decision framework, SCC/BCR regime, transfer-impact-assessment requirement… | Profile →Brief |
| Comoros (KM) | Africa | Red | No EU/UK adequacy decision covering the Union of the Comoros, no SCC/BCR uptake data, and no data-localisation mandate were identified for this JID. Comoros participates in an EU trade relationship… | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No Comorian statutory transfer mechanism (adequacy regime, SCCs, BCRs, localisation rule, or transfer-impact-assessment test) could be identified, consistent with the absence of a national… | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No domestic transfer-mechanism regime (adequacy, SCCs, BCRs, TIA, or localisation mandate) exists in Comorian law. The only cross-border data commitment identified is the treaty-level Article 15 of… | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Red | The CTDPA does not contain a distinct cross-border-transfer regime (no adequacy mechanism, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate) — this is… | Profile →Brief |
| Costa Rica (CR) | Americas | Red | The 2016 reform amended the conditions governing personal-data transfers under Law No. 8968 with the stated aim of generating greater fluidity in the transfer and commercialization of personal data… | Profile →Brief |
| Croatia (HR) | Europe | Green | As an EU Member State, Croatia applies GDPR Chapter V (Articles 44-49) directly and uniformly; there is no separate national adequacy, SCC/BCR or transfer-impact-assessment regime distinct from the… | Profile →Brief |
| Curaçao (CW) | Caribbean | Amber | The Ordinance affirmatively regulates cross-border transfers, restricting transfer of personal data to countries assessed as providing adequate protection. No confirmed adequacy decisions received… | Profile →Brief |
| Cyprus (CY) | Europe | Green | As an EU Member State, Cyprus applies the GDPR Chapter V transfer regime directly: transfers to third countries rely on European Commission adequacy decisions, SCCs, BCRs or Art 49 derogations.… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | As an EU Member State, Czech Republic operates under the GDPR's full cross-border transfer toolkit (adequacy decisions adopted at EU-Commission level, SCCs, BCRs, codes of conduct, certification) and… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Red | The DPDPA, consistent with the general US state-omnibus-privacy pattern, does not contain a GDPR-style cross-border transfer regime. No adequacy-decision mechanism, SCC/BCR framework… | Profile →Brief |
| Denmark (DK) | Europe | Green | As an EU Member State, Denmark's transfer regime is governed by GDPR Chapter V uniformly across the Union: adequacy decisions are adopted at EU (Commission) level rather than bilaterally by Denmark… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Red | As a sub-federal U.S. jurisdiction, the District of Columbia does not independently operate transfer mechanisms, adequacy decisions, SCC/BCR regimes, or data-localisation mandates; these matters, to… | Profile →Brief |
| Dominican Republic (DO) | Americas | Red | Law 172-13 predates the modern SCC/BCR/TIA transfer-mechanism architecture, and no confirmed cross-border transfer regime, adequacy decision (received or granted), or data-localisation mandate… | Profile →Brief |
| Ecuador (EC) | Americas | Amber | EUDPR Chapter V (Arts 46-50) governs transfers by EUIs to third countries/international organisations: a general principle (Art 46), transfers on the basis of GDPR/LED adequacy decisions (Art 47)… | Profile →Brief |
| Egypt (EG) | Africa | Amber | The PDPL prohibits transfer, storage, or sharing of personal data with a foreign state unless the destination affords protection not less than the PDPL and a PDPC license/authorization is obtained.… | Profile →Brief |
| Estonia (EE) | Europe | Green | As an EU/EEA Member State, Estonia relies on the GDPR's Chapter V transfer toolkit (adequacy decisions, SCCs, BCRs, derogations) applied uniformly; adequacy decisions are adopted at EU Commission… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | The EEA operates the full GDPR Chapter V transfer toolkit (adequacy, SCCs, BCRs, Article 49 derogations, TIAs). It currently grants adequacy to 15 third countries/territories (including the US via… | Profile →Brief |
| Finland (FI) | Europe | Amber | As an EU Member State, Finland relies on the GDPR Chapter V mechanisms (adequacy decisions, SCCs, BCRs, derogations) which are adopted at EU level rather than negotiated bilaterally by Finland… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Red | No Florida-specific cross-border data-transfer mechanism, adequacy determination (received or granted), SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate was… | Profile →Brief |
| France (FR) | Europe | Red | France applies the GDPR's uniform EU transfer regime (adequacy decisions, SCCs, BCRs, derogations) as an EU Member State; no FR-specific derogation or localisation mandate beyond the sector-specific… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Red | Georgia has no independent authority over cross-border data transfers; adequacy determinations, SCCs, and BCR frameworks operate exclusively at the US federal level (e.g., the EU-US Data Privacy… | Profile →Brief |
| Germany (DE) | Europe | Green | As an EU Member State, Germany has no independent national adequacy or bilateral-transfer mechanism: adequacy decisions are adopted centrally by the European Commission under GDPR Art 45 and bind… | Profile →Brief |
| Ghana (GH) | Africa | Amber | The Act imposes duties for adequate protection where processing is carried out by processors domiciled outside Ghana, requires specification of transfer destinations when registering processing with… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Amber | Gibraltar benefits from full UK adequacy status (it is listed among the countries/territories the UK deems fully adequate for restricted transfers), and Gibraltar-based organisations may use the UK… | Profile →Brief |
| Greece (GR) | Europe | Green | As an EU Member State, Greece applies the GDPR Chapter V transfer regime directly (adequacy, SCCs, BCRs, derogations, TIA), with no distinct national mechanism identified. Adequacy decisions are set… | Profile →Brief |
| Guernsey (GG) | Europe | Green | Guernsey holds an EU Commission adequacy decision (2003/821/EC under Directive 95/46/EC, carried forward under GDPR Art 45(9), reconfirmed in the Commission's January 2024 first-review report) and a… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Green | Guernsey (including Alderney) holds a long-standing EU Commission adequacy finding, originally made in 2003 under Directive 95/46/EC, which the European Commission's first periodic review (2024)… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Red | As a US sub-national jurisdiction, Hawaii has no independent authority to grant or receive adequacy decisions, mandate SCCs/BCRs, require transfer-impact assessments, or impose data-localisation. Any… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Red | Section 33 of the PDPO — the sole cross-border transfer restriction provision — has never been commenced since the Ordinance's 1995/1996 enactment, so no binding transfer restriction currently… | Profile →Brief |
| Hungary (HU) | Europe | Amber | Chapter V transfer mechanisms apply via GDPR directly; NAIH has approved Binding Corporate Rules as a BCR-lead authority. As adequacy decisions are made centrally by the European Commission for all… | Profile →Brief |
| Iceland (IS) | Europe | Amber | Iceland applies GDPR Chapter V transfer rules directly via EEA Agreement incorporation; it neither issues nor requires separate third-country adequacy decisions relative to the EU/EEA, and its DPA… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Red | Cross-border transfer mechanisms, adequacy determinations, SCC/BCR frameworks, and data-localisation mandates are federal/EU-level constructs; Idaho has no state-specific transfer regime, adequacy… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Red | Illinois has no state-level cross-border transfer regime, adequacy mechanism, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border data flows touching… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | DPDPA departs from the EU adequacy model. Under s.16(1), international transfers are permitted by default; the central government may notify a 'blacklist' of restricted countries rather than a… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Red | As a US state consumer-privacy statute, the ICDPA contains no international-transfer-mechanism framework, adequacy regime, SCC/BCR provisions, transfer-impact-assessment requirement, or… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Red | As a US state consumer-privacy statute, the ICDPA does not create an adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime analogous to GDPR Chapter V; such transfer-restriction… | Profile →Brief |
| Ireland (IE) | Europe | Amber | Ireland relies on the EU's transfer mechanisms (SCCs, BCRs, adequacy decisions, derogations) under GDPR Chapter V. The DPC's TikTok and Meta decisions are the leading Irish precedents on SCC… | Profile →Brief |
| Isle of Man (IM) | Europe | Green | The Isle of Man holds a long-standing EU adequacy finding (Commission Decision 2004/411/EC, originally under Directive 95/46/EC and retained in force under GDPR), reconfirmed in the European… | Profile →Brief |
| Italy (IT) | Europe | Green | As an EU Member State, Italy applies GDPR Chapter V (Arts.44-49) transfer mechanisms directly and uniformly; adequacy decisions are an EU Commission competence exercised at Union level rather than a… | Profile →Brief |
| Ivory Coast (CI) | Africa | Amber | Côte d'Ivoire has not received or granted any EU adequacy decision. As a founding ECOWAS member state, Côte d'Ivoire is presumptively within scope of the ECOWAS Supplementary Act A/SA.1/01/10 on… | Profile →Brief |
| Japan (JP) | Asia-Pacific | Green | Cross-border transfers require either data-subject consent or reliance on an 'established personal information protection system' at the recipient (broadly SCC-equivalent contractual/organisational… | Profile →Brief |
| Jersey (JE) | Europe | Green | Jersey holds one of the longest-standing EU third-country adequacy findings (Commission Decision 2008/393/EC, 8 May 2008, under the 1995 Directive), which remained in force under GDPR Art 97 and was… | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Red | Cross-border transfer mechanisms, adequacy determinations, and data-localisation mandates are federal/international-level constructs (US Department of Commerce, EU adequacy decisions) rather than… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Amber | Kazakhstan operates a data-localisation-centric transfer regime rather than an adequacy/SCC-based model. Data operators must maintain personal-data databases within Kazakhstan, and… | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Red | No cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was located for the KCDPA or any other Kentucky state… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Kenya has no adequacy agreement with any other jurisdiction and has not published approved SCC-equivalent forms; transfers instead rely on ODPC-assessed 'appropriate safeguards' (an 'essentially… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | Available secondary analysis indicates the Lao electronic data protection framework touches on cross-border transfer and encryption rules without imposing broad data-localisation mandates, but the… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Amber | There is no bloc-wide adequacy, SCC, or localisation instrument. What exists is (a) RIPD-origin model contractual clauses adopted nationally (Argentina's AAIP, 2023), and (b) individual-state… | Profile →Brief |
| Latvia (LV) | Europe | Green | As an EU Member State, Latvia's cross-border transfer regime is governed entirely by GDPR Chapter V (Articles 44-49): adequacy decisions are an EU Commission competence (not a Latvia-specific… | Profile →Brief |
| Liechtenstein (LI) | Europe | Green | As an EEA-EFTA state, Liechtenstein benefits from and applies the GDPR's transfer regime (adequacy decisions, SCCs, BCRs, derogations) directly. It is treated as part of the EEA for the purposes of… | Profile →Brief |
| Lithuania (LT) | Europe | Amber | As an EU Member State, Lithuania relies on GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, derogations); adequacy decisions are an EU-level competence and not issued/received bilaterally by… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Red | As a U.S. sub-federal jurisdiction, Louisiana has no adequacy-decision, SCC/BCR, transfer-impact-assessment, or data-localisation regime of its own; cross-border transfer governance for… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | As an EU Member State, Luxembourg's transfer regime runs directly off GDPR Chapter V (Arts 44-49) as EU law; the national act supplies institutional enforcement capacity via CNPD rather than a… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Red | No Maine-specific cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was identified; this is consistent with… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Amber | The PDPA permits cross-border transfers to jurisdictions with adequate data protection laws ('whitelisted' countries), under circumstances of public interest, or with data-subject consent. The 2024… | Profile →Brief |
| Malta (MT) | Europe | Green | As an EU Member State, Malta relies on the EU-level GDPR Chapter V transfer framework (adequacy decisions, SCCs, BCRs, derogations) rather than maintaining an independent national adequacy or SCC… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | RMI has received no adequacy decision from the EU/UK or other regimes and has granted none; no statutory transfer mechanism (SCCs, BCRs, derogations), transfer-impact-assessment duty, or… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Red | MODPA, like other US state comprehensive privacy laws, contains no EU-style cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | Massachusetts has no state-specific cross-border transfer mechanism, adequacy regime, or data-localisation mandate. The operative adequacy mechanism for entities operating in Massachusetts is the… | Profile →Brief |
| Mexico (MX) | Americas | Amber | Mexico's private-sector regime permits international transfers through privacy-notice-embedded transfer clauses binding the foreign recipient to the same purposes, and secondary commentary indicates… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Red | Michigan has no state-level transfer-mechanism, adequacy, SCC/BCR, TIA, or data-localisation regime. Cross-border data-transfer governance operative for Michigan-based entities occurs at the federal… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Red | As a US state consumer-privacy statute, the MCDPA does not include an EU/GDPR-style cross-border transfer regime. No adequacy-determination mechanism (received or granted), standard contractual… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Red | Mississippi has no state-specific cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border data flows… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Red | Missouri, as a US state, has no independent cross-border-transfer regime, no data-localisation mandate, and no state-level role in adequacy determinations. Cross-border transfer mechanisms (e.g., the… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Red | No cross-border transfer mechanism, adequacy-decision framework (received or granted), SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was identified within the… | Profile →Brief |
| Morocco (MA) | Africa | Amber | Law 09-08's principles applicable to trans-border data transfers were found convergent with the GDPR approach, and CNDP has approved an expedited authorisation process for certain transfers. Morocco… | Profile →Brief |
| Mozambique (MZ) | Africa | Amber | Mozambique signed and ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), but there is no evidence of domestic transposing legislation giving it… | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | No adequacy decisions have been received from or granted to other regimes, no SCC/BCR framework is codified, no transfer-impact-assessment obligation exists, and no explicit data-localisation mandate… | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Red | As a US state consumer-privacy statute, the NDPA does not implement a GDPR-style international-transfer regime (no adequacy findings, SCC/BCR frameworks, or transfer impact assessments). Nebraska… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No transfer-mechanism regime (adequacy, SCCs, BCRs, derogations), no adequacy decisions received or granted, no TIA requirement, and no data-localisation mandate were located for Nepal in available… | Profile →Brief |
| Netherlands (NL) | Europe | Green | As an EU Member State, NL's cross-border transfer regime is governed directly by GDPR Chapter V: adequacy decisions issued by the European Commission apply uniformly across the EU including NL (e.g.… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Red | No Nevada-specific cross-border transfer regime, adequacy mechanism, SCC/BCR analogue, transfer-impact-assessment requirement, or data-localisation mandate was identified. As a US state operating… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Amber | PIPEDA relies on an accountability-based transfer mechanism (contractual/other means providing comparable protection) rather than a GDPR-style SCC/BCR/TIA regime. Canada (via PIPEDA-covered… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Red | No cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate specific to New Hampshire's NHDPA was identified. As a… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Red | The NJDPL is a domestic US state consumer-privacy statute and contains no GDPR-style cross-border transfer mechanism regime (no adequacy findings, SCCs, BCRs, or transfer-impact-assessment… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Red | As a sub-federal US jurisdiction with no comprehensive privacy statute, New Mexico has no transfer-mechanism regime, adequacy-decision apparatus, SCC/BCR framework, TIA requirement, or… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Green | IPP12 (introduced by the 2020 Act) governs overseas disclosure of personal information, permitting transfer where the receiving agency is subject to comparable safeguards, via individual… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | Part VIII (Sections 41-43) of the NDPA governs cross-border transfer of personal data, requiring an adequate level of protection at the destination, assessed by the Commission against principles… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Red | North Carolina has no state-level cross-border transfer mechanism, adequacy-determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate. Adequacy… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Red | North Dakota has no state-level cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Any transfer governance… | Profile →Brief |
| Norway (NO) | Europe | Green | As an EEA state, Norway relies on the same transfer toolkit as EU Member States: EU adequacy decisions (e.g. the EU-US Data Privacy Framework) extend automatically to Norway via the EEA Agreement… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Red | Neither Ohio nor US federal sectoral law maintains a GDPR-style cross-border transfer regime. There are no Ohio-specific adequacy determinations (received or granted), no SCC/BCR analogue, no… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Red | The United States has no GDPR-style cross-border transfer/adequacy framework, and Oklahoma has no state-level data-localisation mandate or transfer-impact-assessment requirement for general… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | PIPEDA contains no separate explicit trans-border data flow rules; instead it relies on transparency and accountability obligations requiring comparable protection when data is transferred abroad for… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Red | No cross-border transfer mechanism, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime was located within the OCPA or associated Oregon DOJ guidance; unlike GDPR, US state… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted cross-border transfer regime, adequacy mechanism, SCC/BCR framework, or transfer-impact-assessment requirement exists. Draft bills across versions (2018, 2020, 2023) propose transfer… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No transfer-mechanism regime, adequacy decision (received or granted), SCC/BCR uptake, transfer-impact-assessment requirement, or data-localisation mandate could be located for Palau. Palau does not… | Profile →Brief |
| Panama (PA) | Americas | Amber | Law 81 permits cross-border processing/transfer of confidential, sensitive, or restricted personal data where compliance with data-protection standards is demonstrated, and Executive Decree 285 adds… | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Red | No PA-specific transfer mechanism, adequacy-recognition process, SCC/BCR uptake requirement, transfer-impact-assessment duty, or data-localisation mandate was identified. Because Pennsylvania has no… | Profile →Brief |
| Peru (PE) | Americas | Amber | Cross-border transfer of personal data ('flujo transfronterizo') is permitted where the recipient country offers an adequate protection level as assessed by ANPD, or where agreements establishing… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | The Act requires data-sharing agreements (domestic or cross-border) to provide adequate safeguards and be subject to NPC review; no formal EU-style adequacy decision covering the Philippines was… | Profile →Brief |
| Poland (PL) | Europe | Amber | As an EU Member State, Poland relies on the GDPR's harmonised cross-border transfer mechanisms (adequacy decisions issued by the European Commission, SCCs, BCRs, and Article 49 derogations); Poland's… | Profile →Brief |
| Portugal (PT) | Europe | Amber | As an EU Member State, Portugal's transfer regime operates within the GDPR Chapter V framework (adequacy decisions, SCCs, BCRs, derogations) administered at EU level; the CNPD applies these… | Profile →Brief |
| Qatar (QA) | Middle East | Amber | The QFC Regulations require transfers out of the QFC to rely on an adequate jurisdiction (per a DPO-maintained and publishable list), QFC Standard Contractual Clauses, Binding Corporate Rules… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | Quebec uses a case-by-case Transfer Impact Assessment model (Section 17) rather than a published adequacy-list mechanism. No formal adequacy decisions received-from or granted-to other regimes were… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Red | RIDTPPA, consistent with the general pattern of US state comprehensive privacy statutes, does not establish an adequacy-decision regime, cross-border transfer mechanism (SCCs/BCRs)… | Profile →Brief |
| Romania (RO) | Europe | Green | As an EU Member State, Romania does not operate an independent adequacy regime; cross-border transfer mechanisms (adequacy decisions, SCCs, BCRs, derogations) are governed exclusively at EU level… | Profile →Brief |
| Russia (RU) | Europe | Red | Russia operates one of the strictest data-localisation regimes among comprehensively-regulated jurisdictions: since September 2015, personal data of Russian citizens must first be recorded/stored on… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | The law dedicates provisions to transfer or sharing of personal data outside Rwanda (Article 54), data hosting (Article 55), and a distinctive 'Data Embassy' mechanism (Article 56), alongside a… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Amber | The PDPL's original restrictive, prohibition-first stance on cross-border transfers was substantially liberalized in the 2023 amendments and the September 2023 Cross-Border Data Transfer Regulation… | Profile →Brief |
| Senegal (SN) | Africa | Amber | Article 49 of the Law establishes a country-level adequacy-style test for international transfers. Senegal has also ratified the Council of Europe Convention 108. CDP sector guidance on… | Profile →Brief |
| Serbia (RS) | Europe | Amber | LPDP international-transfer provisions are described as mirroring the GDPR transfer regime (adequacy, safeguards, derogations). Serbia does not hold an EU Commission adequacy decision, reflecting its… | Profile →Brief |
| Seychelles (SC) | Africa | Amber | The Act specifies rules for cross-border transfer of personal data and empowers the Information Commission to make regulations on the circumstances and restrictions of such transfers; the detailed… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Green | <cite index="31-3,31-4">Section 26 of the PDPA limits the ability of an organization to transfer personal data outside Singapore; section 26(1) provides that an organization must not transfer any… | Profile →Brief |
| Slovakia (SK) | Europe | Amber | As an EU Member State, Slovakia relies on the GDPR Chapter V transfer regime: adequacy decisions issued by the European Commission apply uniformly across the EU/EEA (Slovakia does not issue… | Profile →Brief |
| Slovenia (SI) | Europe | Green | GDPR Chapter V transfer mechanisms apply directly in Slovenia. Slovenia (as an EU Member State) is covered by the UK's transitional EU-adequacy regulations, and the Slovenian SA has engaged with the… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | POPIA restricts cross-border transfers unless the destination country has a similar level of protection (or another statutory ground applies), increasing compliance burden on offshoring; both… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Red | South Carolina has enacted no state-level cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Red | South Dakota has no state-specific cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Any cross-border transfer… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Amber | The European Commission adopted an adequacy decision for South Korea (Commission Implementing Decision (EU) 2022/254), concluding that PIPA offers protection essentially equivalent to the GDPR… | Profile →Brief |
| Spain (ES) | Europe | Green | As an EU Member State, Spain applies the GDPR Chapter V transfer regime uniformly: transfers rely on European Commission adequacy decisions, Commission Implementing Decision (EU) 2021/914 SCCs, BCRs… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Amber | The PDPA restricts cross-border transfers unless the destination benefits from an adequacy-type decision or the controller puts in place appropriate safeguards (including a legally binding… | Profile →Brief |
| Sweden (SE) | Europe | Amber | GDPR Chapter V transfer rules apply directly in Sweden; IMY enforcement (Klarna) has penalised failure to inform data subjects about third-country transfers and safeguards, and the Apoteket/Apohem… | Profile →Brief |
| Switzerland (CH) | Europe | Green | Switzerland offers multiple cross-border transfer mechanisms mirroring the GDPR: adequacy (its own FDPIC-maintained country list plus reliance on the general adequacy concept), Standard Contractual… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Amber | The PDPA does not provide a GDPR-style menu of transfer mechanisms (adequacy, SCCs, BCRs). Instead, a competent authority holds discretion to restrict or prohibit international transfers of personal… | Profile →Brief |
| Tanzania (TZ) | Africa | Amber | The PDPA is confirmed to contain requirements associated with international data transfers, but the specific transfer mechanisms (adequacy-style tests, SCC/BCR equivalents, derogations), any adequacy… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Red | TIPA, consistent with the US state comprehensive-privacy-law model, contains no EU-style cross-border transfer regime: there are no adequacy decisions (received or granted), no SCC/BCR mechanisms, no… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Red | TDPSA does not establish a GDPR-style cross-border transfer, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime. As with other US state comprehensive privacy laws… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Amber | <cite index="1-19">Section 28 of the PDPA stipulates the need for sending or transferring data to a destination country or international organization with adequate data protection standards.</cite>… | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | Part IV (unproclaimed) would impose a comparable-safeguards test on outbound disclosures, but this is not in force. No adequacy decision has been received from or granted to any other regime, and no… | Profile →Brief |
| Tunisia (TN) | Africa | Amber | Tunisia is one of a small group of non-European states that acceded to the Council of Europe Convention 108 (1981), and Tunisia has been identified among the non-European Convention 108 parties in… | Profile →Brief |
| Turkey (TR) | Europe | Amber | Turkey substantially overhauled its cross-border transfer regime via the March 2024 Law 7499 amendments to LPPD Article 9 and the implementing By-Law on Procedures and Principles for the Transfer of… | Profile →Brief |
| Uganda (UG) | Africa | Amber | The 2021 Regulations introduced additional provisions on data transfers beyond the base Act, and the PDPO has taken active enforcement steps against at least one major cross-border transferor… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | Ukraine operates a Convention-108-anchored transfer regime: EEA states and other Convention 108 signatories are deemed adequate for outbound transfers, and the Cabinet of Ministers may (but has not)… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Amber | Cross-border transfer detail is best documented at the DIFC and ADGM free-zone level: both provide GDPR-style mechanisms (adequacy, SCCs, BCRs, derogations) with no data-localisation mandate, and the… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Green | UK GDPR transfer rules (recast as Article 44A-46 by the DUAA) preserve a three-tier structure of adequacy regulations, appropriate safeguards (SCCs/IDTA/BCRs) and Article 49 derogations. The EU… | Profile →Brief |
| United States (US) | Americas | Amber | The US is the recipient of an EU adequacy-style instrument — the EU-US Data Privacy Framework (DPF) adequacy decision, adopted by the European Commission on 10 July 2023 — which permits data to flow… | Profile →Brief |
| United States — California (US-CA) | Americas | Red | Unlike GDPR-style omnibus regimes, the CCPA/CPRA does not establish an adequacy framework, government-to-government adequacy decisions, mandated SCC/BCR transfer mechanisms, or a data-localisation… | Profile →Brief |
| United States — New York (US-NY) | Americas | Red | New York state law contains no adequacy-decision mechanism, no SCC/BCR concept, and no transfer-impact-assessment requirement — these are EU/GDPR-derived constructs with no US state-law analogue. No… | Profile →Brief |
| Uruguay (UY) | Americas | Green | Uruguay is the only Latin American jurisdiction to hold an EU adequacy decision (Commission Implementing Decision 2012/484/EU, under the former Directive 95/46/EC framework, still in effect).… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Red | As a U.S. state consumer-privacy statute, the UCPA contains no GDPR-style cross-border transfer regime: no adequacy mechanism (received or granted), no SCC/BCR framework, no… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Amber | The Act is reported to <cite index="1-6">provide requirements for cross-border transfers</cite>, but the specific transfer-mechanism menu (adequacy-style finding, contractual clauses, consent… | Profile →Brief |
| Venezuela (VE) | Americas | Red | Venezuela has no adequacy regime, no SCC/BCR framework, no transfer-impact-assessment requirement, and no data-localisation statute. Venezuela has not received an EU adequacy decision and has no… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Red | No Vermont-specific cross-border transfer regime (adequacy, SCCs, BCRs, TIA, or data-localisation mandate) was identified. This is a legitimate structural gap consistent with the US's sectoral… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Amber | Cross-border transfers are permitted only under enumerated conditions (consent, intra-organisational transfer, transfer to a processor, transfer requested by a competent state agency -- PDPL… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Red | As a US state consumer-privacy statute, the VCDPA has no GDPR-style cross-border transfer or adequacy framework. The only transfer-relevant control is the mandatory controller-processor data… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Red | Washington has no state-level adequacy, SCC, BCR, transfer-impact-assessment, or data-localisation regime. The only WA-specific control affecting data transfers is MHMDA's consent/authorization… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Red | As a US state, West Virginia has no legal mechanism equivalent to GDPR adequacy decisions, SCCs, BCRs, or transfer-impact assessments, and has neither received nor granted adequacy status. No… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Amber | Wisconsin has no state-specific cross-border transfer regime. At the federal level, the EU-U.S. Data Privacy Framework (adequacy decision issued 17 July 2023) provides a voluntary self-certification… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Amber | Wyoming imposes no state-level cross-border transfer restrictions or data-localisation mandates. At the federal level, the EU-U.S. Data Privacy Framework provides an adequacy-linked… | Profile →Brief |
| Zambia (ZM) | Africa | Red | No T1/T2 primary or secondary text confirming Zambia's cross-border transfer mechanisms (adequacy, SCC/BCR equivalents, derogations), any adequacy decisions received or granted… | Profile →Brief |