Data transfers out of Monaco: what the list of adequate countries changes

Since its publication in the Journal de Monaco on 16 October 2026, a ministerial order has set the list of countries to which personal data may flow freely from the Principality. For a business, the consequences show up less in the text than in its everyday tools: email, file storage, CRM, video conferencing, generative AI, IT support. Each of them moves data. The list now says which of those flows are free; for the others, the law requires a safeguard, a derogation or an authorisation from the APDP.

Below you will find what the list contains, what the APDP has required in its latest authorisations, a four-question decision tree and, tool by tool, the question to put to your provider.

What the list published on 16 October says

Article 97 of Law n°1.565 of 3 December 2024 sets the principle: data may be transferred outside the Principality without any prior formality to a country that offers an adequate level of protection. EU Member States are deemed adequate by the law itself. For every other country, the Principality must have established that level of protection, by ministerial order issued after an opinion from the APDP.

That is the purpose of Ministerial Order n°2026-548 of 30 September 2026. It lists:

• the 27 EU Member States;
• the following other European countries and territories: the United Kingdom, Switzerland, Norway, Iceland, Liechtenstein, Andorra, the Faroe Islands, Guernsey, Jersey and the Isle of Man;
• five more distant countries: Argentina, Brazil, New Zealand, Uruguay and Canada, the latter only for private-sector organisations subject to its federal personal information law, in the course of commercial activities;
• one international organisation: the European Patent Organisation.

What is missing matters just as much. According to the APDP, the United States, Japan, South Korea and Israel were removed from the list initially envisaged. In its opinion of 20 May 2026, the authority had noted that the draft almost copied the European Union’s list, whereas European safeguards do not apply to Monaco: it is for the Principality itself to establish a country’s level of protection.

What a transfer to the United States is worth under EU law is therefore not what it is worth under Monegasque law. A data flow from Monaco to the United States falls under the rules for countries outside the list, whatever the position of the same flow leaving Paris or Milan.

Two further points complete the picture. The list is updated regularly: a country may be added or removed. And, according to the APDP, an update has no effect on transfers already carried out.

A transfer is not only about hosting

In its guidance on transfers, the APDP defines a transfer as any flow of data to a country, territory or international organisation outside the Principality, whether a physical transfer or remote access, within a group or to a third party. It gives two examples: data hosted by a parent company in France, and access to data by an IT provider in India for maintenance purposes.

The first is free, France being in the European Union. The second is not. The most common case: data hosted in Europe, but a support team or sub-processor able to access it from a country that is not on the list. Two recent APDP decisions illustrate this:

• In its decision n°2025-024 of 10 December 2025, concerning a bank in the Principality using Microsoft 365, the possibility that the vendor’s sub-processors, some of them in the United States, might access data in exceptional cases was analysed as a transfer to a country without adequate protection. The APDP authorised it subject to conditions.
• In its decision n°2026-022 of 7 October 2026, access by a shared services centre in India, a subsidiary of the same group, to operate and maintain infrastructure hosting personal data was likewise authorised subject to conditions. A flow within a group is not exempt.

The common thread: the right question for a provider is not only “where is our data stored?” but also “from which countries can it be accessed, by whom, and in what circumstances?”

European standard clauses are not enough in Monaco

When the destination country is not on the list, Article 98 of the law provides five appropriate safeguards that allow a transfer without prior formality:

• an enforceable commitment in the Principality;
• standard protection clauses approved in advance by the APDP;
• binding corporate rules approved by the APDP, or by the data protection authority of an adequate country;
• an approved certification mechanism;
• adherence to a code of conduct approved and published by the APDP.

For certification and codes of conduct, the APDP specifies that they must come with a binding commitment from the recipient, sent to the authority.

The most widely used safeguard in Europe, the standard contractual clauses adopted by the European Commission, is not on that list. In a decision of 22 January 2025, the APDP stated that these clauses cannot be confused with those of Article 98: they count as specific clauses under Article 100, which makes the transfer subject to its prior authorisation. The authority acknowledges that they reflect the highest standards, but the rights they grant are only available within European territory: where rights are exercised, the supervisory authority, the law governing remedies, breach notification. A person in Monaco therefore does not fully benefit from them. The same decision points to a practical route: EU law allows supplementary clauses to be added to the standard clauses, provided they do not contradict them.

That leaves Monegasque standard clauses. The decision of 7 October 2026 cited above still refers to the absence of Monegasque standard protection clauses approved by the APDP and made available. In December 2025 the authority announced supplementary clauses to the European clauses for 2026. Before committing, it is worth checking on its website whether they have been published.

Without an Article 98 safeguard, two routes remain:

• The derogations in Article 99, designed for specific situations: the person’s explicit consent, after being informed of the lack of adequate protection and of the risks; performance of a contract with them, or of a contract concluded in their interest with a third party, such as a travel agency passing its clients’ details to a hotel abroad, an example given by the APDP; legal claims; vital interests; public interest; consultation of a public register. A final, residual case covers transfers that are not repetitive, concern a limited number of people, are necessary for compelling legitimate interests and come with safeguards; the APDP and the people concerned must then be informed. These derogations sit poorly with a tool the whole team uses every day.
• Authorisation under Article 100, on the basis of specific contractual clauses or other safeguards, requested by the controller or the processor. The APDP rules within two months, renewable once; if no decision is made by then, authorisation is deemed refused. For a new tool, that timeline should be planned from the moment the provider is chosen.

If you apply for authorisation: what the APDP has required

The three decisions cited give a precise idea of what the authority expects from specific clauses, especially when they are modelled on the European standard clauses. Before filing, each point deserves a check:

• The rights of people in Monaco can actually be exercised, with jurisdiction for the Monegasque courts and Monegasque law prevailing in the event of conflicting interpretation.
• The supervisory authority is indeed the APDP: the paragraph of the European clauses that allows an EU authority to be chosen must be deleted or amended, otherwise the safeguards provided for Monaco no longer apply.
• Prior information of the people concerned is written into the transparency clause; without it, the right to obtain a copy of the clauses is ineffective.
• The options in the European clauses are settled: these are clauses for a specific transfer, not a template covering several scenarios.
• The wording: do not present your own clauses as “standard clauses” within the meaning of Article 98, which only the APDP can approve.
• A French version of the clauses is available to anyone who asks for it.
• The appendices are complete, and security requirements are consistent across all annexed documents.

Decision tree: four questions per tool

For each tool that handles personal data, four questions are enough to know where it stands.

• 1. Does the data leave Monaco, including through remote access? Hosting, backups, support, maintenance, sub-processors: if everything stays in Monaco, there is no transfer. Otherwise, go to question 2.
• 2. Is every destination or access country on the list in Order n°2026-548? If so, the transfer is free; the contract, the register and information to individuals remain. If even one country is missing, go to question 3 for that flow.
• 3. Is an Article 98 safeguard in place? An enforceable commitment in the Principality, standard clauses approved by the APDP, approved binding corporate rules, an approved certification or code of conduct with a commitment from the recipient. European standard contractual clauses alone do not answer this question. If yes, no formality; if not, go to question 4.
• 4. Does an Article 99 derogation cover exactly this flow? If so, document it, and for the residual case, inform the APDP and the individuals. If not, two options: apply for APDP authorisation under Article 100, or configure the tool (hosting and access in listed countries) so that the question no longer arises.

Tool by tool: the question to ask, the safeguard to expect

Read the grid below section by section, alongside your inventory of tools. It does not prejudge the position of any particular provider: their answers to the questions determine it.

Email and online office suite

• Data involved: emails, calendars, documents, address books, often the core of the client relationship.
• Question for the provider: “In which countries is our data hosted, backups included, and from which countries can your teams and your sub-processors access it? Please send us their list, with their country.”
• Expected safeguard: hosting and access limited to listed countries, committed in the contract. If the provider cannot commit to this, the authorisation route opens, as in the December 2025 decision, with clauses that guarantee the rights of people in Monaco.

File storage and sharing

• Data involved: identity documents, contracts, statements, complete client files.
• Question for the provider: “Is the hosting region guaranteed by contract, including for backup copies and replication? Do your sub-processors (antivirus, indexing, support) access the files, and from where?”
• Expected safeguard: a contractual location in a listed country, backups included, and a processing agreement that complies with Article 26 of the law.

CRM

• Data involved: the history of each relationship, projects, preferences, sometimes due diligence records.
• Question for the provider: “Where are the data and backups hosted, who administers the platform and from which country, and can our data be used for anything other than our own purposes, in particular to train models?”
• Expected safeguard: hosting and administration in a listed country, or in Monaco, provided administration and support are there too.

Video conferencing

• Data involved: participants’ identities, audio and video streams, and above all recordings, transcripts and automatic summaries.
• Question for the provider: “Through which countries are the streams routed, and where are recordings and transcripts stored? Do the transcription or summary features call on a service located in another country?”
• Expected safeguard: streams routed and recordings stored in listed countries, or recording and transcription turned off for meetings about clients.

Generative AI

• Data involved: everything staff paste into a prompt or attach as a document.
• Question for the provider: “In which country does the model run, are prompts and documents retained and where, and can they be used for training?”
• Expected safeguard: a model running in a listed country or in your own environment, with no retention of prompts and no training, both written into the contract. Failing that, a simple internal rule: no personal data, whether about clients, employees or third parties, in prompts.

IT support, managed services and business software

• Data involved: potentially all of it, since support accesses the systems themselves.
• Question for the provider: “From which countries do your teams work? Is access permanent or occasional, on request, and is it logged?”
• Expected safeguard: interventions from listed countries; otherwise, occasional, logged access covered by an APDP authorisation, as in the October 2026 decision.

What to update in your documents

• The register of processing activities (Article 27): for each transfer outside the Principality, the destination country and the safeguards chosen.
• Processing agreements (Article 26): in writing, they benefit from specifying hosting and access countries and the list of sub-processors.
• Information to individuals (Article 11): the notice mentions the transfer and the measures taken under Articles 97 to 100.
• Responses to access requests (Article 12): anyone may ask whether a transfer exists and which safeguards cover it. It is better to have the answer ready.

The stakes are real: Article 54 of the law provides, for an unlawful transfer, an administrative fine of up to 10 million euros or 4% of worldwide annual turnover, and the APDP may order data flows to be suspended. For cases that fall under Articles 99 or 100, your legal adviser’s opinion remains the right reflex. We cover the whole law in our guide to law n°1.565, and the choice of a client relationship tool in our article on sovereign CRM in Monaco.

A map to keep up to date

The 16 October list makes the geography of data, and of access, a criterion for choosing tools alongside features and price. It will be updated, and providers change sub-processors: a map that is kept current can be reviewed in a few hours at each change; it is the first one that takes the most work.

It is an exercise our experts can carry out with you, tool by tool. For the client relationship, it is also the question answered by Minervia CRM, hosted in a data centre in Monaco.