European Economic Area (EEA)

The area comprising the 27 EU member states plus Iceland, Liechtenstein, and Norway, within which GDPR applies uniformly. The EEA extends the EU's single market to include these three non-EU countries, and they've adopted GDPR as part of EEA law. For privacy purposes, data can flow freely within the EEA without additional safeguards—transfers between EEA countries are treated as internal transfers. The EEA distinction matters because Switzerland (while geographically in the region) isn't an EEA member, so transfers to Switzerland are international transfers requiring appropriate mechanisms (though Switzerland has an adequacy decision). When privacy discussions reference 'EU,' they often mean 'EEA' since GDPR applies to the entire economic area. The UK was part of the EEA until Brexit but now requires transfer mechanisms (though it has adequacy decisions). Understanding EEA membership helps clarify which jurisdictions require transfer safeguards.