Which Countries Are GDPR Countries?

The GDPR (General Data Protection Regulation) is a European regulation implemented in 2018. It is the much more robust replacement to the DPD (Data Protection Directive) and considered the “gold standard” for data privacy laws in the world. It’s 99 articles and 173 recitals add up to 7 Principles of The GDPR which have informed every privacy law since it’s inception.

The GDPR changed the world with respect to how companies use data. As people become more aware of the value and importance of personal data, so does the demand of individuals to respect their privacy and usage of their data.
Since WWII, Europe has led the world with laws and regulations enforcing personal privacy. The GDPR is by far the most far-reaching.

Below is a list of countries protected by the GDPR and a brief breakdown of how they fit together.

3 Categories Of GDPR Countries

Of the countries protected by the GDPR, there are 3 categories. Countries in the EU, the United Kingdom and members of the European Economic Area (EEA). The United Kingdom left the EU in 2020 and is also no longer a member of the EEA. The EEA is an economic arrangement in Europe which allows cooperating countries to trade smoothly based on agreed upon rules.  Below is a list of GDPR country categories.

1. EU Member States – 27 participating countries
2. United Kingdom – Post Brexit
3. The European Economic Area (EEA) – EU + 3 participating countries

Brexit: Will the UK still enforce the GDPR?

Yes. An exiting member state of the EU is bound by treaty to do so. The UK version is nearly the same with the same latitudes afforded other members states.

It should also be noted that as this is article is being written, the UK is proposing an overhaul to their version of the GDPR. Data privacy regulations, in a data centric world, prove very challenging for companies – especially multi-nationals. To say the least, this is something to watch.

Noteworthy Non-GDPR Countries

1. Switzerland. While neither a member of the EU nor the EEA, it does participate in the EEA single market and it’s privacy laws are considered adequate. Most noteworthy about Switzerland is that it is not a GDPR country though it is often assumed to be.
2. Ukraine. Ukraine is not currently a member state of the EU. Due to their 2022 situation with Russia, Ukraine has asked to join. Depending on the outcome of their request, their citizens will enjoy the protections of the GDPR.

Need a list of GDPR countries? Here it is:

GDPR Countries List 2023

1. 1. Austria
   2. Belgium
   3. Bulgaria
   4. Croatia
   5. Cyprus
   6. Czech Republic
   7. Denmark
   8. Estonia
   9. Finland
   10. France
   11. Germany
   12. Greece
   13. Hungary
   14. Ireland
   15. Italy
   16. Latvia
   17. Lithuania
   18. Luxembourg
   19. Malta
   20. Netherlands
   21. Poland
   22. Portugal
   23. Romania
   24. Slovakia
   25. Slovenia
   26. Spain
   27. Sweden
   28. United Kingdom – Formerly EU, Pre-Brexit
   29. Iceland – Member of EEA
   30. Lichtenstein – Member of EEA
   31. Norway – Member of EEA

Extra Territorial Scope

At present, 31 countries are protected by the GDPR and maybe you don’t have a business presence in any of them. So why does this law apply to your company? To put it simply, obtaining data about individuals or moving data across international borders is done easily and the EEA wishes to protect the privacy rights of those living within their member countries. These sorts of laws are a hard trend internationally and while informed heavily by the GDPR, all have their own nuances. It is important to understand your obligations and plan very well and early for compliance. The GDPR went into effect in 2018 and was just the beginning.