Data Transfers from Monaco in 2026
Most Monaco businesses send data abroad through US cloud tools. Here's how international data transfers work under Law 1.565 and the APDP.
Your Data Already Leaves Monaco Every Day
If your business uses Microsoft 365, Google Workspace, Stripe, HubSpot, Mailchimp, or almost any mainstream cloud tool, your customer and employee data is already being processed outside Monaco — usually in the United States or across the EU. For most Monegasque companies this is invisible, automatic, and completely normal. It is also a regulated activity.
Under Monaco's Law n° 1.565 of 3 December 2024 on personal data protection, transferring personal data outside the Principality is treated as a distinct obligation, supervised by the APDP (Autorité Protectrice des Données Personnelles), the authority that replaced the CCIN in 2025. This is one of the areas where Monegasque practice is evolving quickly in 2026 — and where copy-pasting an EU approach can leave you exposed.
What Counts as an International Transfer
A transfer happens whenever personal data is sent to, stored on, or made accessible from outside Monaco. In day-to-day operations, that includes far more than people expect:
- Cloud email and file storage hosted on US or EU infrastructure
- CRM and marketing platforms that store your contact lists abroad
- Payment processors that handle cardholder and identity data
- Website analytics, hosting, and form tools running on overseas servers
- AI tools that send prompts, documents, or customer data to models hosted elsewhere
The key point: you do not have to "export" data deliberately. Simply using a US-based SaaS product is, in legal terms, an international transfer — and you remain responsible for it as the data controller.
Monaco Is Not the EU — So GDPR Mechanisms Don't Automatically Apply
This is where many Monaco businesses get it wrong. Monaco is not an EU member state, and the GDPR does not apply by default in the Principality. That means the familiar EU transfer tools — Standard Contractual Clauses (SCCs), the EU–US Data Privacy Framework — are not automatically valid as a basis for transfers from Monaco.
Law 1.565 is built to high European standards and is structurally similar to the GDPR, but it sits under Monegasque jurisdiction. In recent decisions through 2025 and 2026, the APDP has shown a clear preference for transfer arrangements tailored to Monaco's own legal framework rather than relying purely on EU instruments. In practice, the authority has approved transfers to the US where the contractual safeguards were adapted to Monegasque law instead of leaning on EU SCCs alone.
The takeaway for business owners: an EU-style privacy posture is a starting point, not a finished solution. If your provider's only transfer mechanism is "we use EU SCCs," that may not be enough to satisfy the APDP.
The EU Adequacy Decision That Could Change Everything
There is a bigger development worth watching. Monaco has ratified the Council of Europe's Convention 108+ and has formally renewed its request for an EU adequacy decision. If the European Commission grants it, data could flow freely between Monaco and the EU without additional contractual mechanisms — a significant simplification for any business operating across the French and Italian borders.
As of mid-2026 this decision has not been issued, and there is no confirmed timeline. So the practical advice is: plan for today's rules, but build your systems so they can take advantage of adequacy if and when it arrives. A flexible, well-documented digital strategy is far easier to adjust than a tangle of one-off contracts.
What This Means for Your Website and Tools
Your public-facing digital presence is usually where transfers are most visible — and most often overlooked. A few practical checks:
- Map where your data lives. List every tool that touches personal data and note where each provider hosts and processes it.
- Update your privacy policy. It should name the categories of recipients and the fact that data may be processed outside Monaco — accurately, not with boilerplate.
- Review your processor contracts. If a vendor processes data on your behalf, you likely need an agreement covering international transfers under Monegasque rules.
- Be deliberate with AI. Feeding customer data into AI tools is still a transfer and still personal data. Choose tools and configurations that match your obligations.
Building these considerations into your web design and data protection compliance from the start is far cheaper than retrofitting them after an APDP query.
A Practical Approach for Monaco Businesses
You do not need to abandon US cloud tools — most Monaco businesses cannot operate without them. The goal is to use them knowingly and defensibly:
- Inventory every cross-border data flow, including AI and analytics.
- Document the legal basis and safeguard for each transfer.
- Prefer providers that can offer Monaco- or EU-region hosting and contractual terms adaptable to Monegasque law.
- Keep evidence. Under Law 1.565, being able to demonstrate compliance matters as much as achieving it.
- Verify with a professional. Transfer rules sit at the intersection of law, contracts, and technology — for binding guidance, engage a qualified Monegasque adviser.
We can help you audit your digital tools and tighten the technical side of compliance, but formal legal questions should always go to a licensed professional.
Get Your Cross-Border Data in Order
International data transfers are no longer a niche concern for large institutions — they affect almost every Monaco business with a website and a CRM. The rules are tightening and the EU adequacy question is live, so getting your house in order now is the smart move.
If you want a clear-eyed review of where your data goes and how your digital setup handles it, get in touch.
