Which country is not GDPR compliant?

There is no official list of “GDPR non-compliant countries.” GDPR compliance concerns how organisations process personal data; countries are assessed separately for the protection they provide to transferred data. The European Commission publishes adequacy decisions for international data transfers. An adequacy decision allows transfers within its scope without an additional Article 46 transfer safeguard.

As of September 2026, countries including Türkiye, India and China do not have EU adequacy decisions. Organisations there can still comply with GDPR, and transfers may be lawful using appropriate safeguards, such as standard contractual clauses with the necessary assessments and supplementary measures. Organisations outside the EU can also fall directly under GDPR when they target people in the EU with goods or services or monitor their behaviour there.