Information for staff > Data protection > Data protection guidance > Transferring information to other organisations > Countries in the EEA

Countries in the European Economic Area (EEA) and on the approved list

On this page:

• Purpose
• Legal context
• What is the approved list of countries?

In this section:

• Overview guidance on the issues to consider when transferring personal data to other organisations
• Guidance on the contractual requirements when transferring data to a:
  • Data processor in the EEA
  • Data controller in the EEA
  • Data processor outside the EEA
  • Data controller outside the EEA
• Exemptions to the prohibition of transfers of personal data outside the European Economic Area (EEA)

If you have any comments about this guidance document, we would very much appreciate hearing them. Please contact us with your feedback.

• Feedback form

Purpose

This page explains which countries are part of the European Economic Area and which are on list of countries that the European Commission has approved as having data protection legislation comparable to that in force in the EEA.  It is part of a set of guidance which deals with the transfer of information about identifiable, living individuals to other organisations.

Use this guidance when transferring information overseas to help identify which contract clauses you need to use.

Legal context

The eighth data protection principle set out in the Data Protection Act 1998 states that personal data must not be transferred to countries outside the European Economic Area (EEA) unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data, or unless an exemption applies.

The European Economic Area is comprised of the member states of the European Union plus Norway, Iceland and Liechtenstein. 

• A list of the member states of the European Union

Which countries have been approved?

The European Commission has identified a number of countries outside the EEA that offer the required level of protection for personal data.  These are listed in the approved list. As a result, transfers to these countries can be undertaken by following the same procedures as for transfers to countries within the EEA.  Please note that in a number of cases the recognition has qualifications attached to it; the United States Safe Harbor arrangement is one such example, where personal data may be transferred to certain approved companies in the United States. It is therefore important to confirm that the approval applies in your particular case.

• List of approved countries

Page last updated: Wednesday November 03 2010