1

Germany*

2

Andorra***

3

Argentina***

4

Austria*

5

Belgium*

6

Bulgaria***

7

Canada***

An adequate level of data protection is guaranteed if the Canadian Federal Act on Personal Information Protection and Electronic Documents of 13 April 2000 or the act of a Canadian province that largely corresponds to this Federal Act applies to the private sphere. The Federal Act applies to personal data that is collected, processed or disclosed in the course of commercial activities, irrespective of whether it relates to organisations such as associations, partnerships, individuals or trade unions or undertakings regulated by federal law such as facilities, works, undertakings or business activities that fall within the legislative authority of the Canadian Parliament. The provinces of Quebec, British Columbia and Alberta have issued an act that largely corresponds to the Federal Act; the provinces of Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia have issued an act that largely corresponds to this act in relation to health data. In all Canadian provinces, the Federal Act applies to all personal data that are collected, processed or disclosed by undertakings regulated by federal law, including data on employees of these undertakings. The Federal Act also applies to personal data transferred to another province or another country in the course of commercial activities.

8

Cyprus***

9

Croatia***

10

Denmark*

11

Spain*

12

Estonia*

13

Finland*

14

France*

15

Gibraltar***

16

Greece*

17

Guernsey***

18

Hungary*

19

Isle of Man***

20

Faroe Islands***

21

Ireland***

22

Island*

23

Israel***

24

Italy*

25

Jersey***

26

Latvia*

27

Liechtenstein*

28

Lithuania*

29

Luxembourg*

30

Malta*

31

Monaco***

32

Norway*

33

New Zealand***

34

Netherlands*

35

Poland*

36

Portugal*

37

Czech Republic*

38

Romania***

39

United Kingdom **

40

Slovakia*

41

Slovenia*

42

Sweden*

43

Uruguay***

44

United States***

For personal data processed by organisations certified under the Principles of the Swiss-US Privacy Framework, an adequate level of protection is deemed to be guaranteed based on the safeguards provided by Executive Order 14086 of 7 October 2022, the Rule on the United States Attorney General's Data Protection Review Court of 7 October 2022 and Intelligence Community Directive 126 (Implementation Procedures for the Signals Intelligence Redress Mechanism under Executive Order 14086) issued by the Office of the Director of National Intelligence on 6 December 2022 and the Designation of Switzerland on 7 June 2024 as a country covered by the two-layer redress mechanism, including access to the Data Protection Review Court.