Personal Data Protection in Monaco: New Rules on International Data Transfers

Accueil - Publications - Personal Data Protection in Monaco: New Rules on International Data Transfers

Ministerial Order No. 2026-548 of 30 September 2026, published in the Journal de Monaco on 16 October 2026, establishes the list of countries, territories and international organisations recognised as providing an adequate level of protection for personal data. This development has important implications for Monaco-based businesses transferring personal data internationally.

Adopted pursuant to Article 97 of Law No. 1.565 of 3 December 2024 on the Protection of Personal Data, the Ministerial Order clarifies the legal framework governing international data transfers from Monaco.

Jurisdictions Recognised as Providing Adequate Protection

The list includes the Member States of the European Union, the United Kingdom, Switzerland, Andorra, Argentina, Brazil, New Zealand and Uruguay.

It also covers Iceland, Liechtenstein, Norway, Guernsey, Jersey, the Isle of Man, the Faroe Islands and the European Patent Organisation.

Canada is also included, although its adequacy recognition specifically applies to private-sector organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) in the course of their commercial activities.

Notably, the United States, Japan, the Republic of Korea and Israel are not included in the final list, although their inclusion had initially been contemplated.

What Are the Implications for Monaco-Based Businesses?

Transfers of personal data to jurisdictions recognised as providing adequate protection may be carried out without specific prior formalities relating to the transfer, provided that all other applicable legal obligations are met.

Transfers to jurisdictions not benefiting from an adequacy recognition remain possible, subject to the mechanisms provided under Law No. 1.565, including:

  • Article 98: Appropriate safeguards, such as standard data protection clauses approved by Monaco’s Personal Data Protection Authority (APDP) or binding corporate rules.
  • Article 99: Statutory derogations applicable under specific conditions.
  • Article 100: Prior authorisation from the APDP based on specific safeguards.

The publication of the APDP’s standard data protection clauses, which could take place by the end of 2026, is expected to provide further guidance on international data transfers.

A Key Compliance Consideration

These developments are particularly relevant for Monaco-based businesses relying on international service providers, cloud services or IT solutions involving cross-border transfers of personal data.

Businesses should therefore review their international data flows and ensure that appropriate legal safeguards are in place.

How Gordon S. Blair Can Assist

Gordon S. Blair advises businesses, investors and executives on the structuring and development of their projects in Monaco, providing legal guidance tailored to their needs and the Principality’s regulatory environment.

Drawing on its expertise in corporate and business law, risk management and regulatory compliance, the firm assists its clients in identifying and anticipating legal and regulatory challenges.

The evolving personal data protection framework highlights the importance of integrating compliance considerations into business operations and projects to mitigate legal risks and support their long-term development.

Our last news

Gordon S. Blair featured in the Global Law Experts & Global Advisory Experts Handbook 2026

Gordon S. Blair and its Managing Partner, Xavier de Sarrau, are featured in the 2026 edition of the Global Law Experts & Global Advisory Experts Handbook, published in September 2026, in the Monaco – Wealth Management Law section.   An international reference guide Published by Global Law Experts and Global Advisory Experts, the Handbook presents law and advisory firms around the world each year, organised by jurisdiction and practice area. It is aimed at business leaders and decision-makers seeking international advice.   More than a century advising on international wealth Founded in Monaco in 1920, Gordon S. Blair advises private individuals, entrepreneurial families, family offices, financial institutions and international groups on the structuring, protection and management of their private and corporate interests. Led by Xavier de Sarrau, a multidisciplinary team of around 50 legal and tax professionals advises on wealth management, international tax and estate planning, family governance, real estate, corporate law, M&A and cross-border projects.   Key expertise highlighted in the profile The profile published in the Handbook highlights several of the firm's areas of work: Relocation to Monaco: support at every stage of the process, from residency and international tax to wealth structuring, business establishment and regulatory matters. Wealth preservation and succession: trusts, foundations, family offices, holding structures and governance frameworks designed across generations and jurisdictions. High-value assets: yachts, aircraft, real estate and art collections, from acquisition to transmission, integrating legal, tax and regulatory advice.  
See more

Monaco strengthens the right to a bank account

Legal update – 16 October 2026 Published in the Journal de Monaco on 16 October 2026, Law No. 1.597 of 9 October 2026 strengthens the statutory right to a bank account introduced in 2020. The reform sets clearer deadlines for banks and facilitates access to the designation procedure where a bank refuses an application or fails to respond. Clearer processing deadlines The reform first sets a precise timetable for the bank receiving the application. Banks must request the necessary documents in writing within 30 working days of receiving a formally submitted application. Once all necessary documents have been received, the bank has 30 working days to open the account, subject to compliance with statutory due diligence requirements. A bank's silence constitutes an implied refusal One of the main advances of the law is the introduction of an implied refusal. Failure to respond within 30 working days of receiving the application, or following receipt of requested missing documents, constitutes an implied refusal. Eligible applicants may then refer the matter directly to the Budget and Treasury Department, without waiting for a refusal certificate. The Department must designate a bank within 10 working days of receiving the required documentation. Wider access to the right The law also removes two practical obstacles. First, eligible applicants may invoke their right to an account as soon as they receive notice terminating their existing account, without waiting for its actual closure. Second, holding a joint account does not prevent an eligible individual from opening an individual account. Remedies and sanctions The effectiveness of the regime is supported by judicial review and sanctions. A designated bank's refusal, or failure to open an account within the prescribed deadlines, may be challenged before the President of the Court of First Instance under the procedure applicable en la forme des référés. In addition, certain failures to issue a refusal certificate or to notify an applicant of a rejection may attract an administrative fine of up to €10,000. Best practice for applicants In practice, the reform highlights the importance of evidence. Applicants should formally submit their request by registered post, electronic registered delivery or hand delivery against a receipt, and retain evidence of the documents supplied. The right to an account remains subject to anti-money laundering and counter-terrorist financing requirements. Entry into force and transitional provisions The law took effect on 17 October 2026. Transitional provisions notably reserve the new application-processing rules and related sanctions for applications submitted after that date.
See more

Monaco: Draft Law no. 1131 introduces a new framework for crypto-asset services

Draft Law no. 1131 regulating the activities of crypto-asset service providers would introduce a new legal framework in the Principality. According to its explanatory memorandum, the proposed legislation notably reflects Monaco’s commitments under its Monetary Agreement with the European Union, including the adoption of measures equivalent to the European Markets in Crypto-Assets Regulation — MiCA. It also takes into account the recommendations of the Financial Action Task Force — FATF.   A deliberately limited opening The approach adopted by the Princely Government is based on strategic considerations relating to the international environment. It provides for a limited opening of the permitted services, notably to reduce the Principality’s exposure to the risks associated with certain crypto-asset activities. The selected services would therefore constitute a natural extension of financial activities already carried out in Monaco. Against this background, the draft law is largely aligned with amended Law no. 1.338 of 7 September 2007 on financial activities, while adapting certain provisions to the specific features of crypto-asset services, particularly in relation to operating requirements.   A framework limited to three services The draft law would authorise only three crypto-asset services: receiving and transmitting orders in crypto-assets on behalf of clients; • providing crypto-asset portfolio management services; • providing advice on crypto-assets. Other services falling within the scope of the proposed framework would be prohibited in the Principality. These would notably include: custody and administration of crypto-assets on behalf of clients; • operating a crypto-asset trading platform; • exchanging crypto-assets for funds; • exchanging crypto-assets for other crypto-assets; • executing orders on behalf of clients; • placing crypto-assets; • providing crypto-asset transfer services on behalf of clients. The issuance of crypto-assets within the Principality would also be prohibited. The draft law nevertheless provides for certain exclusions from its scope, notably for certain intragroup services, certain unique and non-fungible crypto-assets and crypto-assets already governed by other legal regimes.   Prior authorisation from the CCAF Providing any or all of the three permitted services would require prior authorisation from the Commission de Contrôle des Activités Financières — CCAF. Authorisation could be granted to: Monaco public limited companies meeting the conditions set out in the legislation; • credit institutions headquartered in a foreign State, operating through a branch in Monaco and already authorised by the CCAF under Law no. 1.338. Within their respective areas of competence, the CCAF would seek the opinion of the Autorité Monégasque de Sécurité Financière and the Agence Monégasque de Sécurité Numérique. It would issue its decision within six months of receiving a complete application. Authorisation would notably be subject to requirements concerning: financial guarantees, own funds and prudential safeguards; • the competence and good repute of directors and shareholders; • AML/CFT and asset-freezing obligations; • business continuity and operational resilience; • information systems security.   Client protection and conduct requirements Authorised providers would be subject to prudential and conduct-of-business rules, together with obligations relating to conflicts of interest, record-keeping and information systems security. Client mandates would have to be governed by written agreements. Providers would not be permitted to accept deposits of funds or crypto-assets from their clients. They would also be required to obtain information concerning each client’s knowledge and experience to assess whether the proposed service or crypto-asset is appropriate. Commercial approaches would also be regulated, particularly where made by unauthorised persons or entities. Restrictions would additionally apply to certain unsolicited approaches by authorised providers.   Supervision, penalties and market abuse The CCAF would be the competent authority responsible for supervising the implementation of the framework. Its powers would include: determining applications for authorisation; • monitoring compliance with professional obligations; • conducting inspections and investigations; • cooperating with foreign authorities; • implementing the measures and penalties provided for by the legislation. The draft law also provides for criminal penalties, notably where services are provided without authorisation or prohibited activities are carried out. A specific regime would additionally address market abuse involving crypto-assets, including the unlawful use or disclosure of inside information and market manipulation. Finally, the draft legislation would amend several Monaco laws relating to digital matters, financial activities and AML/CFT. Article 60 would notably repeal amended Law no. 1.491 of 23 June 2020 on token offerings and Title II of Law no. 1.528 of 7 July 2022.   A targeted approach Draft Law no. 1131 therefore adopts a targeted approach: only three crypto-asset services could be provided in the Principality, as an extension of existing financial activities and subject to prior CCAF authorisation. All other services falling within the proposed framework would be prohibited, together with any issuance of crypto-assets within Monaco. As the draft law remains subject to examination by the National Council, its provisions may evolve during the legislative process.
See more