Legal framework: GDPR Regulation (EU) 2016/679 (May 2018)
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679
Non-EU countries & International transfers of personal data
- EU data protection rules apply to the European Economic Area (EEA), which includes all EU countries and non-EU countries Iceland, Liechtenstein and Norway.
- Includes research conducted, partially or totally, in a non-EU country, and/or participants or resources which come from a non-EU country
- Material (Data) imported from or exported to a non-EU country must ensure compliance with EU Ethics standards regardless of the country where the research is to be conducted.