European Union. Data localisation / cross-border. Regulation (EU)
Free Flow of Non-Personal Data RegulationRegulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European Union
In force
§1Summary
- Synopsis
Bans member states from imposing data localisation requirements on non-personal data unless justified on public security grounds. It ensures competent authorities can still access data stored elsewhere, and encourages self-regulatory codes on cloud switching and porting.
- Key themes
- Unique features
It is the counterpart to the GDPR's free movement principle for non-personal data, and produced the SWIPO codes on switching.
- SaaS relevance
Lets SaaS providers store non-personal data anywhere in the EU, free of national localisation rules.
§2Obligations
- Extraterritorial
- No
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Prohibits intra-EU localisation of non-personal data
- Maximum penalty
- None
§3Dates
- Key dates
- Adopted
- In force
- Applies from 2019-05-28. Digital Omnibus proposes merging into the Data Act (pending).
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- Member state single points of contact; European Commission
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
High confidence.