Third Country
A country outside the EEA — Chapter V GDPR
TL;DR
A third-country transfer (Art. 44 GDPR) is permitted only under specific conditions: an adequacy decision (Art. 45), appropriate safeguards (Art. 46, e.g. SCCs), or derogations (Art. 49).
What is a third country?
Countries with an adequacy decision (as at 04/2026):
- Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, Canada (commercial), New Zealand, Switzerland, Uruguay, United Kingdom, South Korea (limited), Japan
- USA: only under the DPF (Data Privacy Framework) — risk increased by the Trump EO of 01/2025
Practical example
You use a cloud provider with servers in India. India is a third country without an adequacy decision. Required: SCCs 2021/914 + TIA + additional measures (encryption).
Frequently asked questions
Is the UK still a third country?
Yes, since Brexit. But the adequacy decision was extended to 27 June 2025. As at 04/2026: still valid.
Is encryption sufficient?
It helps, but it does not replace SCCs. European Data Protection Board (EDPB) Recommendations 01/2020.
What about Switzerland?
Special status: not in the EEA, but covered by an adequacy decision. The Swiss CH-DSG is harmonised with the GDPR.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.