Data in the EU

Inside and outside the EEA

The European Economic Area (EEA) is the EU plus Norway, Liechtenstein and Iceland. Countries outside it are called third countries in the GDPR.

You may only transfer personal data to a third country with an adequate level of protection. Otherwise it is only allowed with appropriate safeguards, such as a model contract from the European Commission or binding corporate rules, or in a few legal exceptions.

For a number of countries the European Commission has determined that the protection is comparable to the GDPR, an adequacy decision. Then no extra safeguards are needed.

And the United States?

Since 10 July 2023 the Data Privacy Framework has applied to the US. If an American organisation takes part in it, you may transfer personal data to it without extra measures. If it does not take part, you need a transfer instrument, such as a model contract, and extra measures where necessary.

Taking part does not mean that every product of a company is covered. The AP recommends checking yourself, for specific software, whether that product falls under the Data Privacy Framework.

What we check

In the Netherlands check, a tool gets a yes if the vendor itself says that your data is stored in the EU or the EEA. If it is not clearly stated, it is unknown. That is not a no.