🌐Free Flow of Non-Personal Data

NEW

Also known as: Regulation (EU) 2018/1807

EU regulation removing unjustified data localization restrictions and enabling the free movement of non-personal data within the EU.

DESCRIPTION

Regulation (EU) 2018/1807 establishes a framework for the free flow of non-personal data within the EU. It prohibits unjustified data localization requirements, improving cross-border cloud adoption. The regulation clarifies the distinction between personal and non-personal data and addresses mixed datasets. It promotes data portability and cloud switching via self-regulatory codes of conduct. Public authorities retain access rights for regulatory control. The regulation complements GDPR, which governs personal data. Together, they support a competitive, integrated European data economy.

ALTERNATIVE DEFINITIONS

European Commission

The Regulation on the free flow of non-personal data removes unjustified data localisation restrictions and ensures that non-personal data can be stored and processed anywhere in the EU.

Focuses on removing localization barriers and EU-wide processing freedom.

Source

EUR-Lex

Regulation (EU) 2018/1807 on a framework for the free flow of non-personal data in the European Union.

Formal legal title establishing the regulatory framework.

Source

RELATED TERMS

General Data Protection Regulation (GDPR) Data Portability Cloud Switching Sovereignty Data Residency Interoperability

COMPETING TERMS

Data Localization

RELATIONS

• Broader: Non-Personal Data

KNOWLEDGE AREAS

Data Privacy & Compliance Cloud Data Management Data Security Data Architecture

TARGET AUDIENCE

Chief Information Officer Chief Technology Officer Cloud Architect Data Architect Chief Data Officer

EXTERNAL SOURCES

• Wikipedia - Free flow of non-personal data regulation
• European Commission - Official policy overview
• EUR-Lex - Official regulation text

TOP QUESTIONS

What problem does the Free Flow of Non-Personal Data Regulation solve?

It prevents EU countries from imposing unjustified data localization rules, enabling organizations to store and process non-personal data anywhere in the EU.

Category: Overview

How does the regulation interact with GDPR?

GDPR governs personal data, while this regulation covers non-personal data. Mixed datasets must apply GDPR protections to personal data components.

Category: Compliance

Does the regulation force cloud provider switching?

It encourages cloud switching through codes of conduct and transparent information on data portability, but it doesn’t mandate switching.

Category: Policy

What is considered non-personal data under this regulation?

Data that does not relate to an identified or identifiable person. Aggregate and anonymized datasets are examples, provided anonymization is robust.

Category: Definition

Can public authorities still access non-personal data across borders?

Yes. Public authorities retain access rights for legitimate regulatory purposes, even when data is stored in another member state.

Category: Governance

How should companies handle mixed datasets?

Apply GDPR to personal data elements and this regulation to non-personal parts. Maintain clear data classification and separation where feasible.

Category: Best practices

What are common mistakes with this regulation?

Assuming it covers personal data or abolishes all localization rules. Some sector-specific laws may still impose localization for justified reasons.

Category: Mistakes

What is the business impact of removing localization barriers?

Lower infrastructure costs, better resilience, and improved vendor choice by leveraging cross-border cloud services and data centers.

Category: Value

How can organizations demonstrate compliance?

Document data classification, justify any localization requirements, align with portability codes of conduct, and ensure transparency in cloud contracts.

Category: Implementation