Third country

A third country, in the sense of Chapter V GDPR, is any country that is not a Member State of the European Union or of the European Economic Area (the 27 EU Member States plus Iceland, Liechtenstein and Norway, which apply the GDPR through the EEA Agreement). The United Kingdom has been a third country since 1 January 2021; Switzerland, the United States, Canada, Japan, China, India, Australia and every other non-EEA jurisdiction are third countries, whatever the quality of their data protection law.

The consequence is that any disclosure of personal data to a recipient in a third country, or remote access from one, is an international data transfer that requires a Chapter V mechanism: an adequacy decision under Art. 45, appropriate safeguards such as SCCs or BCRs under Art. 46 (with a transfer impact assessment), or a derogation under Art. 49. Third countries recognised as adequate include the UK, Switzerland, Japan, Korea, Canada (commercial organisations), Israel, Argentina, Uruguay, Brazil, New Zealand and, for certified organisations, the US under the Data Privacy Framework; transfers to them require no further safeguards. Adequacy decisions are subject to periodic review and to challenge before the Court of Justice.

For a European clinical trial, third-country recipients typically include a US or Swiss sponsor parent, a global CRO, central laboratories, cloud-hosted EDC and eCOA platforms, safety database providers and non-EU regulators such as the FDA. Each should be mapped in the DPIA with its mechanism, disclosed in the informed consent form and recorded in the RoPA. Note that the UK GDPR and the Swiss FADP treat EU Member States as third countries from their perspective, though both recognise the EU as adequate.