Monaco's Adequacy List: US Left Out

The Short Version

Monaco's official list of countries with an adequate level of data protection is now final. Ministerial Order No. 2026-548 of 30 September 2026 was published in the Journal de Monaco on Friday 16 October 2026. The United States is not on it.

That single fact matters more than anything else in the order. A large share of the software Monaco businesses use every day comes from US companies, or relies on US-based support teams and sub-processors: email, office suites, CRMs, analytics, advertising platforms, AI assistants. If personal data from your business ends up in the US, that transfer can no longer rest on an adequacy finding. It needs a different legal basis, and you need to be able to show which one.

We covered the draft version of this list in August in Monaco's Adequate Country List. This post covers what changed in the final text and what to do about it.

What the Final List Contains

The order is issued under Article 97 of Law No. 1.565, Monaco's data protection law. It names the destinations where personal data can go on the strength of an adequacy finding alone:

• All 27 EU member states, plus the United Kingdom
• Other European jurisdictions: Andorra, Iceland, Liechtenstein, Norway, Switzerland, Guernsey, Jersey, the Isle of Man and the Faroe Islands
• Further afield: Argentina, Brazil, Canada, New Zealand and Uruguay
• One international organisation: the European Patent Organisation

Canada comes with a condition. Adequacy rests on its federal private-sector privacy law (PIPEDA), which covers private-sector organisations handling personal data in the course of commercial activities.

The comparison with the draft is the interesting part. According to the APDP, Japan, South Korea, Israel and the United States were removed from the list the government first proposed, and the European Patent Organisation was added.

Why This Is Not the EU List

Many Monaco businesses assume their data protection position mirrors France's. This order shows why that assumption is risky. Monaco is not an EU member state, the GDPR does not apply here by default, and Monaco makes its own adequacy decisions.

The EU recognises the US (through the EU–US Data Privacy Framework), Japan, South Korea and Israel as adequate. Monaco now does not. A tool that is perfectly fine for a company in Nice can therefore need extra paperwork for the same company's sister business in Monaco.

The process has also left open questions. In its notice of 19 October, the APDP said the government told it that the working documents behind the adequacy choices would not be shared with it. It also said the European Patent Organisation was added without its prior opinion, and that it had received interpretation points on Law 1.565 that it still needs to assess. More guidance from the authority could follow, so check apdp.mc regularly.

What Changes for Your Tool Stack

The practical question is no longer "is this tool GDPR-compliant?" It is "where does our customer data physically go, and on what basis?"

For destinations on the list, such as an Irish data centre, a French host or a Swiss provider, the transfer can rest on adequacy. You still need everything else Law 1.565 requires: a contract with the processor, security measures and a record of the processing.

For destinations off the list, which now include the US, you need another basis. Law 1.565 provides for appropriate safeguards and, in limited situations, specific exceptions. In the past the APDP has accepted US transfers where the contractual safeguards were adapted to Monegasque law, rather than simply relying on EU standard contractual clauses. Which mechanism applies to your situation, and whether any formality with the APDP is needed, depends on the transfer itself. This is exactly where a qualified Monaco lawyer or DPO earns their fee. Do not guess.

Two traps are worth knowing about:

• "EU hosting" is not always the whole story. A US provider may store your data in Frankfurt or Dublin but still give US-based staff or sub-processors access for support, security or AI features. Remote access from a country can count as a transfer to that country. Read the provider's sub-processor list, not just the marketing page.
• Your website is part of the stack. Analytics tags, chat widgets, embedded booking tools, fonts and form handlers can all send visitor data abroad. A careful web development setup lets you see and control every one of them.

A Five-Step Response

You do not need to rip out your software. You do need to know where you stand.

1. List every tool that handles personal data. That means customers, prospects, employees and website visitors. Start with your email marketing and CRM platforms, which usually hold the most.
2. Record where each one stores and accesses data. Use the provider's data processing agreement and sub-processor list. Flag anything that touches the US, Japan, South Korea, Israel or any other country not on the list.
3. Check the legal basis for every flagged transfer. Make sure you have safeguards in writing that work under Monegasque law, not just a link to an EU-focused policy.
4. Where alternatives are equal, choose listed destinations. An EU region, or a European provider with a European support chain, takes the question off the table.
5. Write it all down. Under Law 1.565, the burden of proof is on you. A one-page transfer register, kept up to date, is worth far more than good intentions.

If your business is also preparing for the impact-assessment obligations due by the end of 2027, the same inventory feeds directly into that work. Our APDP data protection service can help structure it.

What to Watch Next

The order says the list is meant to be updated, and the APDP has signalled that it is still assessing the government's position. Countries could be added later. The US in particular may come back into the conversation if Monaco develops its own arrangement. Until then, treat the current list as the rule and build your processes so that a change costs an afternoon, not a month.

If you want a clear map of where your website and marketing data actually go, and a digital strategy that holds up when the rules move, get in touch. We will tell you plainly what needs attention. For binding interpretation of Law 1.565, always consult a qualified Monaco legal adviser.