Skip to content

Appendix1.md

Latest commit

 

History

History
60 lines (52 loc) · 20.8 KB

Appendix1.md

File metadata and controls

60 lines (52 loc) · 20.8 KB
Raw

Appendix 1 – Countries where GDPR or ‘essentially equivalent’ legislation has been implemented

Under the GDPR, the EU can recognize that other countries or territories are ‘adequate’, meaning that they provide an ‘essentially equivalent’ level of data protection to that which exists within the EU under the GDPR.1

The EU’s recognition of adequacy2 means that the data protection laws in place in the third country are similar in principle and in practice to those of the EU. It is therefore a useful proxy for assessing which countries have legislation similar to the GDPR.

The table below lists all countries that have implemented the GDPR, as well as some of those which have an EU adequacy decision in place.3

Country GDPR or GDPR-type legislation?[^4] Source
Austria Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Argentina Yes, there is an Agrentina-EU Adequacy Decision in place, meaning that the EU recognizes that Argentina provides an essentially equivalent level of data protection to what which exists within the EU. Personal Data Protection Law
Belgium Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Bulgaria Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Canada Yes, there is a Canada-EU Adequacy Decision in place, meaning that the EU recognizes that Canada provides an essentially equivalent level of data protection to what which exists within the EU. Personal Information Protection and Electronic Documents Act
Croatia Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Cyprus Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Czech Republic Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Denmark Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Estonia Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Finland Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
France Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Germany Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Greece Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Hungary Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Ireland Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Israel Yes, there is an Israel-EU Adequacy Decision in place, meaning that the EU recognizes that Israel provides an essentially equivalent level of data protection to what which exists within the EU. Privacy Protection Regulations
Italy Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Japan Yes, there is a Japan-EU Adequacy Decision in place, meaning that the EU recognizes that Japan provides an essentially equivalent level of data protection to what which exists within the EU. Act on the Protection of Personal Information
Latvia Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Lithuania Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Luxembourg Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Malta Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
New Zealand Yes, there is a New Zealand-EU Adequacy Decision in place, meaning that the EU recognizes that New Zealand provides an essentially equivalent level of data protection to what which exists within the EU. The Privacy Act 2020
Poland Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Portugal Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Romania Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Slovakia Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Slovenia Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
South Korea Yes, there is a South Korea-EU Adequacy Decision in place, meaning that the EU recognizes that South Korea provides an essentially equivalent level of data protection to what which exists within the EU. Personal Information Protection Act
Spain Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Sweden Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
Switzerland Yes, there is a Swizterland-EU Adequacy Decision in place, meaning that the EU recognizes that Switzerland provides an essentially equivalent level of data protection to what which exists within the EU. The Swiss Data Protection Act
The Netherlands Yes The GDPR is an EU Regulation. Regulations are directly applicable in all EU Member States.
United Kingdom Yes, there is a UK-EU Adequacy Decision in place, meaning that the EU recognizes that the UK provides an essentially equivalent level of data protection to what which exists within the EU. The UK Data Protection Act 2018
United States Yes, there is a US-EU Adequacy Decision in place, meaning that the EU recognizes that the UK provides an essentially equivalent level of data protection to what which exists within the EU. See the EU Commission’s statement here. The U.S does not have a federal piece of legislation on data protection. Instead, this is legislated at state-level. See here for a summary of U.S state legislation on privacy.

Footnotes

  1. https://ico.org.uk/for-organisations/data-protection-and-the-eu/data-protection-and-the-eu-in-detail/adequacy/ ↩

  2. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ↩

  3. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en ↩