Cross-border data: the decisions behind a Monaco architecture

A Monaco firm rarely decides to “transfer data abroad”. It decides to use a mail service, a document platform, a CRM, a backup provider or an AI assistant. Each of those choices sends personal data to a place and puts it under someone’s control. Law No. 1.565 treats each such flow as a transfer with its own conditions. The architecture follows from how the firm answers, flow by flow.

This note reads the texts in force by mid-October 2025: Law No. 1.565 of 3 December 2024, published on 13 December 2024, and Sovereign Ordinance No. 11.327, published on 18 July 2025.

Start from the map, not the vendor list

Article 27 of the law requires a written record of processing. Where data leaves the Principality, the record names the destination country or international organisation and, where relevant, the safeguards relied on. Article 96 extends the transfer rules to onward transfers: a provider in one country that passes data to a sub-processor in another creates a second flow the controller must account for.

The practical consequence is a map, not a list of vendors. For each system the map shows where data is stored, where it is processed, from where support staff can reach it, and which sub-processors sit behind the provider. A contract that names a European region answers only the first of those questions.

Three kinds of destination

The law sorts destinations into three groups.

EU member states. Under article 97, they are deemed to offer an adequate level of protection. No further tool is needed for the transfer itself.

Countries found adequate by Monaco. Outside the EU, article 97 allows a transfer where the Principality has found the destination adequate. The finding takes the form of a list adopted by ministerial order after an APDP opinion, published in the Journal de Monaco and on the APDP’s website. We found no such order published by mid-October 2025. The APDP’s list page, as archived on 28 March 2025, offered a list document for download. That document was drawn up under the repealed Law No. 1.165. Which destinations it covered at a given date, and its standing under the new law, are points to confirm with the APDP or counsel before relying on it. Article 67 of the ordinance sets the criteria for future findings. The ordinance adopts no list itself. An EU adequacy decision is one criterion among several, so Monaco’s list need not match Brussels’. The same article states that an update to the list does not affect transfers already made.

Everywhere else. Article 98 allows transfers backed by appropriate safeguards: an enforceable international commitment, standard protection clauses approved by the APDP, binding corporate rules, an approved certification, or an approved code of conduct. Article 99 sets out narrow derogations, such as explicit informed consent or necessity for a contract with the person concerned. Article 100 allows a transfer on APDP authorisation. The authority has two months to decide, renewable once, and an unanswered request is deemed refused.

For a firm planning a new system, the third group carries the cost. A service hosted in a country without a Monaco adequacy finding needs an article 98 safeguard or a derogation that fits the specific flow. Consent and contract derogations suit a single client instruction. They do not suit a platform that holds every client’s file.

An EU data boundary is not Monaco’s boundary

Large providers now sell regional commitments. Microsoft’s EU Data Boundary documentation, last updated on 26 February 2025, defines the boundary as the EU and EFTA states, with datacentres that include Switzerland and Norway. For a Monaco sender, the EU states are deemed adequate. Switzerland, Norway and the other EFTA states are not EU members: their position turns on Monaco’s list, checked at the date of the flow. The same documentation also describes continuing transfers outside the boundary for certain services and cases.

The decision is to read the exceptions, not the region. Which data can still leave the boundary: support data, security telemetry, sub-processor traffic? Does the firm’s record describe those flows? The answer changes from service to service, and the controller carries it.

Data coming the other way

Monaco’s law governs data leaving Monaco. Data arriving from the EU follows EU rules. The European Commission’s list of adequacy decisions contains no decision for Monaco. An EU bank, law firm or trustee sending client data to a Monaco office therefore needs a GDPR transfer tool. The usual one is the set of standard contractual clauses adopted on 4 June 2021, with four modules for controller and processor combinations. Under Clause 14, both parties warrant that they have no reason to believe the laws and practices at the destination, including rules on disclosure to public authorities, prevent the importer from meeting its obligations.

A Monaco firm should expect to sign those clauses as the importer and to answer questions about its own providers. If the Monaco office stores the file with a US-controlled service, the EU sender’s assessment now covers that onward transfer too. A short, accurate description of the firm’s systems, maintained in advance, can make those exchanges easier.

Control matters as much as location

Location is not the only test. The US Department of Justice white paper on the CLOUD Act, published in April 2019, states that providers subject to US jurisdiction must disclose data within their possession, custody or control, regardless of where it is stored. It adds that the Act did not expand US jurisdiction over companies. Whether a US parent controls a subsidiary’s data is a fact-dependent question.

Article 101 of Law No. 1.565 takes the opposite position for Monaco: a foreign court or administrative decision requiring a transfer can be recognised or enforced only under an international agreement in force between the requesting state and Monaco. When the two rules meet, the conflict lands on the provider and on the controller that chose it.

This is where on-premises or Monaco-hosted systems earn their place. Keeping the most sensitive stores on hardware the firm controls, operated by people it employs or contracts locally, removes processors and transfers from the map. It does not remove the controller’s other duties, and it does not require an air gap. A connected system can keep its data at home. An isolated one still needs updates, backups and people.

One decision record per flow

A short record for each significant flow makes the choices visible:

• the categories of data and of people concerned;
• where the data is stored and processed, and from where it can be reached;
• the provider, its sub-processors and the law each one answers to;
• the destination group under Law No. 1.565 and the safeguard relied on;
• the incoming EU flows the system receives, and the clauses signed;
• the exit route if the safeguard fails or the list changes.

A family office might end with client files and its private AI index on its own servers, email with an EU-hosted provider under a processor contract, and a US scheduling tool limited to names and meeting times, with a documented safeguard. The record gives the firm and its advisers a basis to assess each choice.

Limits of this note

This is not legal advice. It reflects texts issued on or before 14 October 2025. We found no ministerial adequacy order published by that date. Any later order, APDP position or change to EU and US law is outside its scope. Firms with regulated activities should confirm each flow with Monegasque counsel. To discuss an architecture, write to contact@desgarde.com.