NIST Privacy Framework, Identify-PID.DE-P2

Before transferring personal data collected in The Bahamas to another country, be prepared to show the recipient provides protection equivalent to this Act if the Data Protection Commissioner questions the transfer.

Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the countries of origin and final destination, the purposes and period of the intended processing, the law in force and international obligations there, any enforceable codes of conduct, and the security measures taken in that country or territory.

As a competent authority transferring personal data to another country or international organisation for a criminal-law purpose, apply the same adequacy-or-safeguards test and document your assessment, under Articles 91 to 95.

Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal, professional, and security rules it applies, before any transfer.

Before disclosing Personal Data to a Controller or Processor abroad, hold a Licence from the Center and satisfy yourself that your work or purpose corresponds, that there is a legitimate interest in the data, and that the legal and technical protection there is not below Egypt's own.

Assess the level of protection in the destination jurisdiction before the transfer, weighing the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the rules of law and security measures in force there.

The data exporter and the data importer warrant that they have no reason to believe that the laws and practices of the third country of destination prevent the importer from fulfilling its obligations under the Clauses, having taken due account of the circumstances of the transfer, the laws and practices of the destination and any supplementary safeguards (Clause 14(a) and (b)).

Assess the level of protection yourself, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime.

Document the assessment of the safeguards or criteria that justify each transfer out of The Gambia.

Assess adequacy on the nature of the personal data, the State or territory of origin and of final destination, the purposes and period of the intended processing, the law and international obligations of the receiving State or territory, any enforceable codes of conduct there, and the security measures applied to the data.

An app transferring the personal data of an individual in Malaysia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Malaysia must self-assess that the recipient's jurisdiction has a substantially similar law or an adequate level of protection before the transfer.

Take practical security steps against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, and the reliability of personnel with access, and secure the same guarantees from any data processor you engage.

Implement technical and organizational measures adequate to the risks and the nature of the data to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and choose a processor offering sufficient guarantees about those measures.

Choose a subcontractor who gives sufficient guarantees for the protection and security of the data, and ensure the subcontractor complies with this Law.

Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.

Take practical steps to secure personal data against loss, misuse, unauthorised access, alteration or destruction, and obtain a data processor's own security guarantees before letting it process personal data on your behalf.

Process data on a subcontractor's behalf only on the controller's instructions, and use only a subcontractor that offers sufficient guarantees to implement the required security measures.

Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage, and use a processor only where it offers sufficient security and confidentiality guarantees, which does not relieve you of your own duty to see those guarantees are met.

Choose a sub-processor offering sufficient guarantees, bind them by a written act limited to your instructions, and extend the confidentiality duty to anyone who takes part in the sub-processing.

Choose a processor that offers sufficient security and confidentiality guarantees, govern its processing under a written confidentiality contract, and hold it to the same obligations that bind you.

Take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data, its storage, and the personnel with access to it, and require a data processor you engage to give sufficient security guarantees and comply with them.

Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.

Where a records-destruction vendor is contracted to destroy personal information, satisfy this duty by exercising due diligence: reviewing an independent audit of the vendor's operations or compliance, obtaining reliable information about the vendor or requiring the vendor be certified by a recognized trade association, or reviewing and evaluating the vendor's information security policies and procedures.

Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.

The Department says your third-party service provider policies should include due diligence guidelines before you use a provider with access to your information systems or nonpublic information, strongly recommends that you consider the threats AI poses to those providers, and says you should require providers to give timely notice of any cybersecurity event that directly impacts your information systems or the nonpublic information they hold, and should consider additional representations and warranties where providers use AI.

Address in those policies, to the extent applicable: the identification and risk assessment of third-party service providers; the minimum cybersecurity practices they must meet to do business with you; the due diligence you use to evaluate the adequacy of their cybersecurity practices; and periodic assessment of them based on the risk they present and the continued adequacy of their practices.

Engage a data processor only where it gives sufficient guarantees as to the reporting of security breaches to you, under a written contract binding it to obligations equivalent to your own.