APDP • Deliberation No. 2026-07 of 20 May 2026 giving an opinion on the draft Ministerial Order establishing the list of countries, territories and international organisations offering an adequate level of protection

Deliberation No. 2026-07 of 20 May 2026 of the Data Protection Authority, setting out its opinion on the draft Ministerial Order establishing the list of countries, territories and international organisations offering an adequate level of protection, was issued following a referral from the Minister of State dated 19 February 2026, received on 24 February 2026.

The said Ministerial Order implements Article 97 of Law No. 1.565 of 3 December 2024 on the protection of personal data, which provides that "The list of countries, territories and international organisations offering an adequate level of protection referred to in the first paragraph shall be adopted by Ministerial Order, following the opinion of the data protection authority. It shall be regularly updated and published in the Journal de Monaco and on the data protection authority’s website.”

The transfer of personal data to a country, territory or international organisation which, within the meaning of Article 97 of Law No. 1.565, ensures an adequate level of protection, may take place without any specific additional safeguards.

The APDP calls on the Government to remove at least Japan, South Korea, Brazil, the United States and Israel from the proposed Monegasque list, and to pay particular attention to the situation in Canada.

It puts forward the following reasons:

• The proposed Monegasque list refers to legislation deemed adequate, in particular due to specific measures relating to data originating from the EU, or to partial adequacy decisions granted by the EU "without it being clear what this implies for the Principality."
• Japan, South Korea and Brazil have benefited from an initial adequacy decision since the entry into force of the GDPR (Regulation (EU) 2016/679).
• Discussions are underway within the EU regarding the possible review of the Association Agreement with Israel.
• The adoption of a bilateral agreement with the United States "similar to that of the European Union with that country, following the example of Switzerland which has adopted this solution" is essential "if the Principality wishes to ensure that its data controllers and data subjects benefit from protection in relation to the United States."

According to the APDP, "no in-depth work appears to have been carried out" and it regrets that "no analysis to justify the choices made by the Government" has been provided to it "to inform its opinion", contrary to what had been promised in a letter dated 16 July 2025.

It deplores the fact that the proposed Monegasque list is ‘merely a copy-and-paste of the list of countries with an adequate level of protection as defined by the European Commission’, with the exception of the European Patent Office (EPO), which is not included in that list. The European Union’s adequacy decisions can be viewed here.

However, the APDP points out that:

• the Monegasque list cannot be based solely “on the criterion that a third country has been granted an adequacy decision by the European Union”, “whose safeguards and protection mechanisms do not apply to the Principality, its data subjects, its data controllers” or to the APDP.
• pursuant to Article 97 of Law No. 1.565, “the Principality must "verify" the effectiveness of the protection offered by a country in order to grant it adequacy”. Foreign legislation must benefit “data subjects whose data is collected in the Principality”.

* * *