--- title: "Cross-border & adequacy — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/cross-border-and-adequacy/ source_html: /domains/cross-border-and-adequacy/index.html description: "Cross-jurisdiction comparison of Cross-border & adequacy across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 9399d08b13bbf832d9779076ded38135f1b73a13052dbfae3021e7ffab284879 generator: "fe-fleet/md-twin@1.0" --- # Cross-border & adequacy — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 31 Confirmed 67 Probable 69 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Amber The Malabo Convention does not itself establish a GDPR-style adequacy mechanism. The principal continental instrument bearing on cross-border data flows is the AU Data Policy Framework, which aims to… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Red Alabama, as a US state, has no adequacy-decision framework, SCC/BCR regime, or data-localisation mandate of its own; cross-border personal-data transfer questions touching Alabama residents are… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red As a US state without an omnibus privacy statute, Alaska has no state-level cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber PIPA-covered organizations must additionally comply with PIPEDA for trans-border commercial data flows, since Alberta's substantially-similar status only displaces PIPEDA for intra-provincial… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Amber Algeria's data-protection law is understood, by regional statutory pattern, to condition cross-border personal-data transfers on prior ANPDP authorisation or an assessment of the destination… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No source located on transfer mechanisms, adequacy decisions received or granted, SCC/BCR uptake, transfer-impact-assessment duties, or data-localisation mandates for Antigua and Barbuda. No EU… [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Green Argentina received an EU Commission adequacy decision in 2003 — one of the earliest such findings — which remains in effect. The domestic Act prohibits transfers to jurisdictions lacking adequate… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Red Arizona has no state-level cross-border data-transfer regime, no adequacy mechanism, and no data-localisation mandate. Cross-border transfer questions arising from AZ-resident data are governed… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Red In the absence of a comprehensive consumer-privacy statute, Arkansas has no state-level cross-border transfer-mechanism, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Amber This is the core module for the APAC bloc row. Two voluntary transfer mechanisms operate in parallel: the Global CBPR/PRP certification system (whose membership extends beyond APAC to Canada, Mexico… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Amber APP 8 and s16C create an accountability-based (not adequacy-list-based) cross-border transfer regime: an APP entity must take reasonable steps to ensure an overseas recipient will not breach the APPs… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Green As an EU Member State, Austria applies the GDPR Chapter V transfer regime uniformly: European Commission adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, and Article 49… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Red No transfer-mechanism detail (adequacy, SCCs, BCRs, derogations), adequacy decisions received or granted, transfer-impact-assessment requirement, or data-localisation mandate could be confirmed for… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Green As an EU Member State, Belgium relies on the EU-level GDPR Chapter V transfer regime: European Commission adequacy decisions, SCCs, BCRs, and Article 49 derogations. Adequacy decisions are… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced provisions on transfer mechanisms, adequacy status (received or granted), SCC/BCR uptake, transfer-impact-assessment duties, or data-localisation mandates for Belize were located. Belize… [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Green Article 33 provides an exhaustive list of transfer mechanisms (adequacy, standard contractual clauses, BCRs, consent, legal-obligation, contract necessity, and other named grounds). ANPD published… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA governs BC-internal personal information flows, while PIPEDA continues to apply to interprovincial and international commercial transfers and to federally-regulated works and undertakings even… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Amber As an EU Member State, Bulgaria applies the GDPR Chapter V transfer regime directly (adequacy decisions, SCCs, BCRs, derogations); adequacy decisions are issued/received at EU-Commission level rather… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red The draft LPDP proposes cross-border transfer restrictions and an overseas-representative requirement, but no enacted transfer regime, adequacy determination, or localisation mandate currently… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Amber The draft law contemplates cross-border transfer mechanisms including standard contractual clauses approved by the Data Protection Authority and binding corporate rules adopted by the data importer.… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Amber Canada's 2002 EU adequacy decision is scoped only to organizations and data governed by PIPEDA (i.e., commercial activity); it does not extend to purely provincially-regulated activity… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Green PIPEDA takes an organization-to-organization accountability approach to outbound transfers rather than an adequacy-gated model domestically. Canada (via PIPEDA) has held EU adequacy since 2001… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Ley 21.719 introduces, for the first time, a structured international-transfer regime with multiple transfer mechanisms (adequacy-style destination assessment, contractual clauses/BCRs… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber PIPL Article 38 offers three cross-border transfer mechanisms — CAC-led security assessment, PI-protection certification, or a CAC-standard-contract (Chinese SCC, effective 1 June 2023) — with… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Colombia treats every non-Colombian jurisdiction as a 'third country' and requires an adequate level of protection for outbound transfers, achievable via SIC adequacy decisions, statutory exceptions… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Red The Colorado Privacy Act is a US state consumer-privacy statute and contains no international-transfer mechanism, adequacy-decision framework, SCC/BCR regime, transfer-impact-assessment requirement… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No EU/UK adequacy decision covering the Union of the Comoros, no SCC/BCR uptake data, and no data-localisation mandate were identified for this JID. Comoros participates in an EU trade relationship… [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No Comorian statutory transfer mechanism (adequacy regime, SCCs, BCRs, localisation rule, or transfer-impact-assessment test) could be identified, consistent with the absence of a national… [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No domestic transfer-mechanism regime (adequacy, SCCs, BCRs, TIA, or localisation mandate) exists in Comorian law. The only cross-border data commitment identified is the treaty-level Article 15 of… [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Red The CTDPA does not contain a distinct cross-border-transfer regime (no adequacy mechanism, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate) — this is… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Red The 2016 reform amended the conditions governing personal-data transfers under Law No. 8968 with the stated aim of generating greater fluidity in the transfer and commercialization of personal data… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Green As an EU Member State, Croatia applies GDPR Chapter V (Articles 44-49) directly and uniformly; there is no separate national adequacy, SCC/BCR or transfer-impact-assessment regime distinct from the… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Amber The Ordinance affirmatively regulates cross-border transfers, restricting transfer of personal data to countries assessed as providing adequate protection. No confirmed adequacy decisions received… [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Green As an EU Member State, Cyprus applies the GDPR Chapter V transfer regime directly: transfers to third countries rely on European Commission adequacy decisions, SCCs, BCRs or Art 49 derogations.… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green As an EU Member State, Czech Republic operates under the GDPR's full cross-border transfer toolkit (adequacy decisions adopted at EU-Commission level, SCCs, BCRs, codes of conduct, certification) and… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Red The DPDPA, consistent with the general US state-omnibus-privacy pattern, does not contain a GDPR-style cross-border transfer regime. No adequacy-decision mechanism, SCC/BCR framework… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Green As an EU Member State, Denmark's transfer regime is governed by GDPR Chapter V uniformly across the Union: adequacy decisions are adopted at EU (Commission) level rather than bilaterally by Denmark… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Red As a sub-federal U.S. jurisdiction, the District of Columbia does not independently operate transfer mechanisms, adequacy decisions, SCC/BCR regimes, or data-localisation mandates; these matters, to… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Red Law 172-13 predates the modern SCC/BCR/TIA transfer-mechanism architecture, and no confirmed cross-border transfer regime, adequacy decision (received or granted), or data-localisation mandate… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Amber EUDPR Chapter V (Arts 46-50) governs transfers by EUIs to third countries/international organisations: a general principle (Art 46), transfers on the basis of GDPR/LED adequacy decisions (Art 47)… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber The PDPL prohibits transfer, storage, or sharing of personal data with a foreign state unless the destination affords protection not less than the PDPL and a PDPC license/authorization is obtained.… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Green As an EU/EEA Member State, Estonia relies on the GDPR's Chapter V transfer toolkit (adequacy decisions, SCCs, BCRs, derogations) applied uniformly; adequacy decisions are adopted at EU Commission… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber The EEA operates the full GDPR Chapter V transfer toolkit (adequacy, SCCs, BCRs, Article 49 derogations, TIAs). It currently grants adequacy to 15 third countries/territories (including the US via… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Amber As an EU Member State, Finland relies on the GDPR Chapter V mechanisms (adequacy decisions, SCCs, BCRs, derogations) which are adopted at EU level rather than negotiated bilaterally by Finland… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Red No Florida-specific cross-border data-transfer mechanism, adequacy determination (received or granted), SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate was… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Red France applies the GDPR's uniform EU transfer regime (adequacy decisions, SCCs, BCRs, derogations) as an EU Member State; no FR-specific derogation or localisation mandate beyond the sector-specific… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Red Georgia has no independent authority over cross-border data transfers; adequacy determinations, SCCs, and BCR frameworks operate exclusively at the US federal level (e.g., the EU-US Data Privacy… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Green As an EU Member State, Germany has no independent national adequacy or bilateral-transfer mechanism: adequacy decisions are adopted centrally by the European Commission under GDPR Art 45 and bind… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The Act imposes duties for adequate protection where processing is carried out by processors domiciled outside Ghana, requires specification of transfer destinations when registering processing with… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Amber Gibraltar benefits from full UK adequacy status (it is listed among the countries/territories the UK deems fully adequate for restricted transfers), and Gibraltar-based organisations may use the UK… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Green As an EU Member State, Greece applies the GDPR Chapter V transfer regime directly (adequacy, SCCs, BCRs, derogations, TIA), with no distinct national mechanism identified. Adequacy decisions are set… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Green Guernsey holds an EU Commission adequacy decision (2003/821/EC under Directive 95/46/EC, carried forward under GDPR Art 45(9), reconfirmed in the Commission's January 2024 first-review report) and a… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Green Guernsey (including Alderney) holds a long-standing EU Commission adequacy finding, originally made in 2003 under Directive 95/46/EC, which the European Commission's first periodic review (2024)… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Red As a US sub-national jurisdiction, Hawaii has no independent authority to grant or receive adequacy decisions, mandate SCCs/BCRs, require transfer-impact assessments, or impose data-localisation. Any… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Red Section 33 of the PDPO — the sole cross-border transfer restriction provision — has never been commenced since the Ordinance's 1995/1996 enactment, so no binding transfer restriction currently… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber Chapter V transfer mechanisms apply via GDPR directly; NAIH has approved Binding Corporate Rules as a BCR-lead authority. As adequacy decisions are made centrally by the European Commission for all… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber Iceland applies GDPR Chapter V transfer rules directly via EEA Agreement incorporation; it neither issues nor requires separate third-country adequacy decisions relative to the EU/EEA, and its DPA… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Red Cross-border transfer mechanisms, adequacy determinations, SCC/BCR frameworks, and data-localisation mandates are federal/EU-level constructs; Idaho has no state-specific transfer regime, adequacy… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Red Illinois has no state-level cross-border transfer regime, adequacy mechanism, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border data flows touching… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber DPDPA departs from the EU adequacy model. Under s.16(1), international transfers are permitted by default; the central government may notify a 'blacklist' of restricted countries rather than a… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Red As a US state consumer-privacy statute, the ICDPA contains no international-transfer-mechanism framework, adequacy regime, SCC/BCR provisions, transfer-impact-assessment requirement, or… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Red As a US state consumer-privacy statute, the ICDPA does not create an adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime analogous to GDPR Chapter V; such transfer-restriction… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber Ireland relies on the EU's transfer mechanisms (SCCs, BCRs, adequacy decisions, derogations) under GDPR Chapter V. The DPC's TikTok and Meta decisions are the leading Irish precedents on SCC… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Green The Isle of Man holds a long-standing EU adequacy finding (Commission Decision 2004/411/EC, originally under Directive 95/46/EC and retained in force under GDPR), reconfirmed in the European… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Green As an EU Member State, Italy applies GDPR Chapter V (Arts.44-49) transfer mechanisms directly and uniformly; adequacy decisions are an EU Commission competence exercised at Union level rather than a… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Amber Côte d'Ivoire has not received or granted any EU adequacy decision. As a founding ECOWAS member state, Côte d'Ivoire is presumptively within scope of the ECOWAS Supplementary Act A/SA.1/01/10 on… [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Green Cross-border transfers require either data-subject consent or reliance on an 'established personal information protection system' at the recipient (broadly SCC-equivalent contractual/organisational… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Green Jersey holds one of the longest-standing EU third-country adequacy findings (Commission Decision 2008/393/EC, 8 May 2008, under the 1995 Directive), which remained in force under GDPR Art 97 and was… [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Red Cross-border transfer mechanisms, adequacy determinations, and data-localisation mandates are federal/international-level constructs (US Department of Commerce, EU adequacy decisions) rather than… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Amber Kazakhstan operates a data-localisation-centric transfer regime rather than an adequacy/SCC-based model. Data operators must maintain personal-data databases within Kazakhstan, and… [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Red No cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was located for the KCDPA or any other Kentucky state… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber Kenya has no adequacy agreement with any other jurisdiction and has not published approved SCC-equivalent forms; transfers instead rely on ODPC-assessed 'appropriate safeguards' (an 'essentially… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red Available secondary analysis indicates the Lao electronic data protection framework touches on cross-border transfer and encryption rules without imposing broad data-localisation mandates, but the… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber There is no bloc-wide adequacy, SCC, or localisation instrument. What exists is (a) RIPD-origin model contractual clauses adopted nationally (Argentina's AAIP, 2023), and (b) individual-state… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Green As an EU Member State, Latvia's cross-border transfer regime is governed entirely by GDPR Chapter V (Articles 44-49): adequacy decisions are an EU Commission competence (not a Latvia-specific… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Green As an EEA-EFTA state, Liechtenstein benefits from and applies the GDPR's transfer regime (adequacy decisions, SCCs, BCRs, derogations) directly. It is treated as part of the EEA for the purposes of… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Amber As an EU Member State, Lithuania relies on GDPR Chapter V transfer mechanisms (adequacy, SCCs, BCRs, derogations); adequacy decisions are an EU-level competence and not issued/received bilaterally by… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Red As a U.S. sub-federal jurisdiction, Louisiana has no adequacy-decision, SCC/BCR, transfer-impact-assessment, or data-localisation regime of its own; cross-border transfer governance for… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber As an EU Member State, Luxembourg's transfer regime runs directly off GDPR Chapter V (Arts 44-49) as EU law; the national act supplies institutional enforcement capacity via CNPD rather than a… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Red No Maine-specific cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was identified; this is consistent with… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Amber The PDPA permits cross-border transfers to jurisdictions with adequate data protection laws ('whitelisted' countries), under circumstances of public interest, or with data-subject consent. The 2024… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Green As an EU Member State, Malta relies on the EU-level GDPR Chapter V transfer framework (adequacy decisions, SCCs, BCRs, derogations) rather than maintaining an independent national adequacy or SCC… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red RMI has received no adequacy decision from the EU/UK or other regimes and has granted none; no statutory transfer mechanism (SCCs, BCRs, derogations), transfer-impact-assessment duty, or… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Red MODPA, like other US state comprehensive privacy laws, contains no EU-style cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Amber Massachusetts has no state-specific cross-border transfer mechanism, adequacy regime, or data-localisation mandate. The operative adequacy mechanism for entities operating in Massachusetts is the… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Amber Mexico's private-sector regime permits international transfers through privacy-notice-embedded transfer clauses binding the foreign recipient to the same purposes, and secondary commentary indicates… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Red Michigan has no state-level transfer-mechanism, adequacy, SCC/BCR, TIA, or data-localisation regime. Cross-border data-transfer governance operative for Michigan-based entities occurs at the federal… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Red As a US state consumer-privacy statute, the MCDPA does not include an EU/GDPR-style cross-border transfer regime. No adequacy-determination mechanism (received or granted), standard contractual… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Red Mississippi has no state-specific cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border data flows… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Red Missouri, as a US state, has no independent cross-border-transfer regime, no data-localisation mandate, and no state-level role in adequacy determinations. Cross-border transfer mechanisms (e.g., the… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Red No cross-border transfer mechanism, adequacy-decision framework (received or granted), SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate was identified within the… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Amber Law 09-08's principles applicable to trans-border data transfers were found convergent with the GDPR approach, and CNDP has approved an expedited authorisation process for certain transfers. Morocco… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Amber Mozambique signed and ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), but there is no evidence of domestic transposing legislation giving it… [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red No adequacy decisions have been received from or granted to other regimes, no SCC/BCR framework is codified, no transfer-impact-assessment obligation exists, and no explicit data-localisation mandate… [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Red As a US state consumer-privacy statute, the NDPA does not implement a GDPR-style international-transfer regime (no adequacy findings, SCC/BCR frameworks, or transfer impact assessments). Nebraska… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No transfer-mechanism regime (adequacy, SCCs, BCRs, derogations), no adequacy decisions received or granted, no TIA requirement, and no data-localisation mandate were located for Nepal in available… [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green As an EU Member State, NL's cross-border transfer regime is governed directly by GDPR Chapter V: adequacy decisions issued by the European Commission apply uniformly across the EU including NL (e.g.… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Red No Nevada-specific cross-border transfer regime, adequacy mechanism, SCC/BCR analogue, transfer-impact-assessment requirement, or data-localisation mandate was identified. As a US state operating… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Amber PIPEDA relies on an accountability-based transfer mechanism (contractual/other means providing comparable protection) rather than a GDPR-style SCC/BCR/TIA regime. Canada (via PIPEDA-covered… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Red No cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate specific to New Hampshire's NHDPA was identified. As a… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Red The NJDPL is a domestic US state consumer-privacy statute and contains no GDPR-style cross-border transfer mechanism regime (no adequacy findings, SCCs, BCRs, or transfer-impact-assessment… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Red As a sub-federal US jurisdiction with no comprehensive privacy statute, New Mexico has no transfer-mechanism regime, adequacy-decision apparatus, SCC/BCR framework, TIA requirement, or… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Green IPP12 (introduced by the 2020 Act) governs overseas disclosure of personal information, permitting transfer where the receiving agency is subject to comparable safeguards, via individual… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Amber Part VIII (Sections 41-43) of the NDPA governs cross-border transfer of personal data, requiring an adequate level of protection at the destination, assessed by the Commission against principles… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Red North Carolina has no state-level cross-border transfer mechanism, adequacy-determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate. Adequacy… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Red North Dakota has no state-level cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Any transfer governance… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Green As an EEA state, Norway relies on the same transfer toolkit as EU Member States: EU adequacy decisions (e.g. the EU-US Data Privacy Framework) extend automatically to Norway via the EEA Agreement… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Red Neither Ohio nor US federal sectoral law maintains a GDPR-style cross-border transfer regime. There are no Ohio-specific adequacy determinations (received or granted), no SCC/BCR analogue, no… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Red The United States has no GDPR-style cross-border transfer/adequacy framework, and Oklahoma has no state-level data-localisation mandate or transfer-impact-assessment requirement for general… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber PIPEDA contains no separate explicit trans-border data flow rules; instead it relies on transparency and accountability obligations requiring comparable protection when data is transferred abroad for… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Red No cross-border transfer mechanism, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime was located within the OCPA or associated Oregon DOJ guidance; unlike GDPR, US state… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No enacted cross-border transfer regime, adequacy mechanism, SCC/BCR framework, or transfer-impact-assessment requirement exists. Draft bills across versions (2018, 2020, 2023) propose transfer… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No transfer-mechanism regime, adequacy decision (received or granted), SCC/BCR uptake, transfer-impact-assessment requirement, or data-localisation mandate could be located for Palau. Palau does not… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Amber Law 81 permits cross-border processing/transfer of confidential, sensitive, or restricted personal data where compliance with data-protection standards is demonstrated, and Executive Decree 285 adds… [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Red No PA-specific transfer mechanism, adequacy-recognition process, SCC/BCR uptake requirement, transfer-impact-assessment duty, or data-localisation mandate was identified. Because Pennsylvania has no… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Amber Cross-border transfer of personal data ('flujo transfronterizo') is permitted where the recipient country offers an adequate protection level as assessed by ANPD, or where agreements establishing… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber The Act requires data-sharing agreements (domestic or cross-border) to provide adequate safeguards and be subject to NPC review; no formal EU-style adequacy decision covering the Philippines was… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Amber As an EU Member State, Poland relies on the GDPR's harmonised cross-border transfer mechanisms (adequacy decisions issued by the European Commission, SCCs, BCRs, and Article 49 derogations); Poland's… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Amber As an EU Member State, Portugal's transfer regime operates within the GDPR Chapter V framework (adequacy decisions, SCCs, BCRs, derogations) administered at EU level; the CNPD applies these… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Amber The QFC Regulations require transfers out of the QFC to rely on an adequate jurisdiction (per a DPO-maintained and publishable list), QFC Standard Contractual Clauses, Binding Corporate Rules… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Amber Quebec uses a case-by-case Transfer Impact Assessment model (Section 17) rather than a published adequacy-list mechanism. No formal adequacy decisions received-from or granted-to other regimes were… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Red RIDTPPA, consistent with the general pattern of US state comprehensive privacy statutes, does not establish an adequacy-decision regime, cross-border transfer mechanism (SCCs/BCRs)… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Green As an EU Member State, Romania does not operate an independent adequacy regime; cross-border transfer mechanisms (adequacy decisions, SCCs, BCRs, derogations) are governed exclusively at EU level… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Red Russia operates one of the strictest data-localisation regimes among comprehensively-regulated jurisdictions: since September 2015, personal data of Russian citizens must first be recorded/stored on… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Amber The law dedicates provisions to transfer or sharing of personal data outside Rwanda (Article 54), data hosting (Article 55), and a distinctive 'Data Embassy' mechanism (Article 56), alongside a… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Amber The PDPL's original restrictive, prohibition-first stance on cross-border transfers was substantially liberalized in the 2023 amendments and the September 2023 Cross-Border Data Transfer Regulation… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Amber Article 49 of the Law establishes a country-level adequacy-style test for international transfers. Senegal has also ratified the Council of Europe Convention 108. CDP sector guidance on… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Amber LPDP international-transfer provisions are described as mirroring the GDPR transfer regime (adequacy, safeguards, derogations). Serbia does not hold an EU Commission adequacy decision, reflecting its… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Amber The Act specifies rules for cross-border transfer of personal data and empowers the Information Commission to make regulations on the circumstances and restrictions of such transfers; the detailed… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Green Section 26 of the PDPA limits the ability of an organization to transfer personal data outside Singapore; section 26(1) provides that an organization must not transfer any… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Amber As an EU Member State, Slovakia relies on the GDPR Chapter V transfer regime: adequacy decisions issued by the European Commission apply uniformly across the EU/EEA (Slovakia does not issue… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Green GDPR Chapter V transfer mechanisms apply directly in Slovenia. Slovenia (as an EU Member State) is covered by the UK's transitional EU-adequacy regulations, and the Slovenian SA has engaged with the… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber POPIA restricts cross-border transfers unless the destination country has a similar level of protection (or another statutory ground applies), increasing compliance burden on offshoring; both… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Red South Carolina has enacted no state-level cross-border transfer mechanism, adequacy determination, SCC/BCR regime, transfer-impact-assessment requirement, or data-localisation mandate. Cross-border… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Red South Dakota has no state-specific cross-border transfer mechanism, adequacy regime, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate. Any cross-border transfer… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Amber The European Commission adopted an adequacy decision for South Korea (Commission Implementing Decision (EU) 2022/254), concluding that PIPA offers protection essentially equivalent to the GDPR… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Green As an EU Member State, Spain applies the GDPR Chapter V transfer regime uniformly: transfers rely on European Commission adequacy decisions, Commission Implementing Decision (EU) 2021/914 SCCs, BCRs… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Amber The PDPA restricts cross-border transfers unless the destination benefits from an adequacy-type decision or the controller puts in place appropriate safeguards (including a legally binding… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber GDPR Chapter V transfer rules apply directly in Sweden; IMY enforcement (Klarna) has penalised failure to inform data subjects about third-country transfers and safeguards, and the Apoteket/Apohem… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Green Switzerland offers multiple cross-border transfer mechanisms mirroring the GDPR: adequacy (its own FDPIC-maintained country list plus reliance on the general adequacy concept), Standard Contractual… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Amber The PDPA does not provide a GDPR-style menu of transfer mechanisms (adequacy, SCCs, BCRs). Instead, a competent authority holds discretion to restrict or prohibit international transfers of personal… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Amber The PDPA is confirmed to contain requirements associated with international data transfers, but the specific transfer mechanisms (adequacy-style tests, SCC/BCR equivalents, derogations), any adequacy… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Red TIPA, consistent with the US state comprehensive-privacy-law model, contains no EU-style cross-border transfer regime: there are no adequacy decisions (received or granted), no SCC/BCR mechanisms, no… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Red TDPSA does not establish a GDPR-style cross-border transfer, adequacy, SCC/BCR, transfer-impact-assessment, or data-localisation regime. As with other US state comprehensive privacy laws… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Amber Section 28 of the PDPA stipulates the need for sending or transferring data to a destination country or international organization with adequate data protection standards.… [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red Part IV (unproclaimed) would impose a comparable-safeguards test on outbound disclosures, but this is not in force. No adequacy decision has been received from or granted to any other regime, and no… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Amber Tunisia is one of a small group of non-European states that acceded to the Council of Europe Convention 108 (1981), and Tunisia has been identified among the non-European Convention 108 parties in… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Amber Turkey substantially overhauled its cross-border transfer regime via the March 2024 Law 7499 amendments to LPPD Article 9 and the implementing By-Law on Procedures and Principles for the Transfer of… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber The 2021 Regulations introduced additional provisions on data transfers beyond the base Act, and the PDPO has taken active enforcement steps against at least one major cross-border transferor… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber Ukraine operates a Convention-108-anchored transfer regime: EEA states and other Convention 108 signatories are deemed adequate for outbound transfers, and the Cabinet of Ministers may (but has not)… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Amber Cross-border transfer detail is best documented at the DIFC and ADGM free-zone level: both provide GDPR-style mechanisms (adequacy, SCCs, BCRs, derogations) with no data-localisation mandate, and the… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Green UK GDPR transfer rules (recast as Article 44A-46 by the DUAA) preserve a three-tier structure of adequacy regulations, appropriate safeguards (SCCs/IDTA/BCRs) and Article 49 derogations. The EU… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber The US is the recipient of an EU adequacy-style instrument — the EU-US Data Privacy Framework (DPF) adequacy decision, adopted by the European Commission on 10 July 2023 — which permits data to flow… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Red Unlike GDPR-style omnibus regimes, the CCPA/CPRA does not establish an adequacy framework, government-to-government adequacy decisions, mandated SCC/BCR transfer mechanisms, or a data-localisation… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Red New York state law contains no adequacy-decision mechanism, no SCC/BCR concept, and no transfer-impact-assessment requirement — these are EU/GDPR-derived constructs with no US state-law analogue. No… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Green Uruguay is the only Latin American jurisdiction to hold an EU adequacy decision (Commission Implementing Decision 2012/484/EU, under the former Directive 95/46/EC framework, still in effect).… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Red As a U.S. state consumer-privacy statute, the UCPA contains no GDPR-style cross-border transfer regime: no adequacy mechanism (received or granted), no SCC/BCR framework, no… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Amber The Act is reported to provide requirements for cross-border transfers, but the specific transfer-mechanism menu (adequacy-style finding, contractual clauses, consent… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red Venezuela has no adequacy regime, no SCC/BCR framework, no transfer-impact-assessment requirement, and no data-localisation statute. Venezuela has not received an EU adequacy decision and has no… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Red No Vermont-specific cross-border transfer regime (adequacy, SCCs, BCRs, TIA, or data-localisation mandate) was identified. This is a legitimate structural gap consistent with the US's sectoral… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Amber Cross-border transfers are permitted only under enumerated conditions (consent, intra-organisational transfer, transfer to a processor, transfer requested by a competent state agency -- PDPL… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Red As a US state consumer-privacy statute, the VCDPA has no GDPR-style cross-border transfer or adequacy framework. The only transfer-relevant control is the mandatory controller-processor data… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Red Washington has no state-level adequacy, SCC, BCR, transfer-impact-assessment, or data-localisation regime. The only WA-specific control affecting data transfers is MHMDA's consent/authorization… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Red As a US state, West Virginia has no legal mechanism equivalent to GDPR adequacy decisions, SCCs, BCRs, or transfer-impact assessments, and has neither received nor granted adequacy status. No… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Amber Wisconsin has no state-specific cross-border transfer regime. At the federal level, the EU-U.S. Data Privacy Framework (adequacy decision issued 17 July 2023) provides a voluntary self-certification… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Amber Wyoming imposes no state-level cross-border transfer restrictions or data-localisation mandates. At the federal level, the EU-U.S. Data Privacy Framework provides an adequacy-linked… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Red No T1/T2 primary or secondary text confirming Zambia's cross-border transfer mechanisms (adequacy, SCC/BCR equivalents, derogations), any adequacy decisions received or granted… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)