Ministerial Order No. 2026-548 of 30 September 2026, published in the Journal de Monaco on 16 October 2026, establishes the list of countries, territories and international organisations recognised as providing an adequate level of protection for personal data. This development has important implications for Monaco-based businesses transferring personal data internationally.
Adopted pursuant to Article 97 of Law No. 1.565 of 3 December 2024 on the Protection of Personal Data, the Ministerial Order clarifies the legal framework governing international data transfers from Monaco.
Jurisdictions Recognised as Providing Adequate Protection
The list includes the Member States of the European Union, the United Kingdom, Switzerland, Andorra, Argentina, Brazil, New Zealand and Uruguay.
It also covers Iceland, Liechtenstein, Norway, Guernsey, Jersey, the Isle of Man, the Faroe Islands and the European Patent Organisation.
Canada is also included, although its adequacy recognition specifically applies to private-sector organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) in the course of their commercial activities.
Notably, the United States, Japan, the Republic of Korea and Israel are not included in the final list, although their inclusion had initially been contemplated.
What Are the Implications for Monaco-Based Businesses?
Transfers of personal data to jurisdictions recognised as providing adequate protection may be carried out without specific prior formalities relating to the transfer, provided that all other applicable legal obligations are met.
Transfers to jurisdictions not benefiting from an adequacy recognition remain possible, subject to the mechanisms provided under Law No. 1.565, including:
- Article 98: Appropriate safeguards, such as standard data protection clauses approved by Monaco’s Personal Data Protection Authority (APDP) or binding corporate rules.
- Article 99: Statutory derogations applicable under specific conditions.
- Article 100: Prior authorisation from the APDP based on specific safeguards.
The publication of the APDP’s standard data protection clauses, which could take place by the end of 2026, is expected to provide further guidance on international data transfers.
A Key Compliance Consideration
These developments are particularly relevant for Monaco-based businesses relying on international service providers, cloud services or IT solutions involving cross-border transfers of personal data.
Businesses should therefore review their international data flows and ensure that appropriate legal safeguards are in place.
How Gordon S. Blair Can Assist
Gordon S. Blair advises businesses, investors and executives on the structuring and development of their projects in Monaco, providing legal guidance tailored to their needs and the Principality’s regulatory environment.
Drawing on its expertise in corporate and business law, risk management and regulatory compliance, the firm assists its clients in identifying and anticipating legal and regulatory challenges.
The evolving personal data protection framework highlights the importance of integrating compliance considerations into business operations and projects to mitigate legal risks and support their long-term development.