A third country is a country which the EU does not deem ‘adequate’ in terms of its laws surrounding data protection.  By nature of the fact that the list of adequate countries is expected to change regularly, by default so will the list of third countries.

Any personal data which is being transferred to a third country must be protected by additional safeguards.