NIST Privacy Framework, Identify-PID.DE-P2

Before transferring personal data collected in The Bahamas to another country, be prepared to show the recipient provides protection equivalent to this Act if the Data Protection Commissioner questions the transfer.

Assess adequacy on all the circumstances before the transfer, weighing the nature of the data, the countries of origin and final destination, the purposes and period of the intended processing, the law in force and international obligations there, any enforceable codes of conduct, and the security measures taken in that country or territory.

As a competent authority transferring personal data to another country or international organisation for a criminal-law purpose, apply the same adequacy-or-safeguards test and document your assessment, under Articles 91 to 95.

Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal, professional, and security rules it applies, before any transfer.

Before disclosing Personal Data to a Controller or Processor abroad, hold a Licence from the Center and satisfy yourself that your work or purpose corresponds, that there is a legitimate interest in the data, and that the legal and technical protection there is not below Egypt's own.

Assess the level of protection in the destination jurisdiction before the transfer, weighing the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the rules of law and security measures in force there.

Assess the level of protection yourself, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime.

Document the assessment of the safeguards or criteria that justify each transfer out of The Gambia.

Assess adequacy on the nature of the personal data, the State or territory of origin and of final destination, the purposes and period of the intended processing, the law and international obligations of the receiving State or territory, any enforceable codes of conduct there, and the security measures applied to the data.

An app transferring the personal data of an individual in Malaysia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Malaysia must self-assess that the recipient's jurisdiction has a substantially similar law or an adequate level of protection before the transfer.

Confirm the recipient country's processor ensures a comparable level of protection for data subjects' rights before transferring personal data outside Seychelles.

Take practical security steps against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, and the reliability of personnel with access, and secure the same guarantees from any data processor you engage.

Choose a subcontractor who gives sufficient guarantees for the protection and security of the data, and ensure the subcontractor complies with this Law.

Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.

Take practical steps to secure personal data against loss, misuse, unauthorised access, alteration or destruction, and obtain a data processor's own security guarantees before letting it process personal data on your behalf.

Process data on a subcontractor's behalf only on the controller's instructions, and use only a subcontractor that offers sufficient guarantees to implement the required security measures.

Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage, and use a processor only where it offers sufficient security and confidentiality guarantees, which does not relieve you of your own duty to see those guarantees are met.

Choose a sub-processor offering sufficient guarantees, bind them by a written act limited to your instructions, and extend the confidentiality duty to anyone who takes part in the sub-processing.

Enter into a written contract before entrusting personal data processing to a processor, and use only a processor registered to carry out personal data processing and able to guarantee technical, personnel and organizational protection measures, under Article 16.

Choose a processor that offers sufficient security and confidentiality guarantees, govern its processing under a written confidentiality contract, and hold it to the same obligations that bind you.

Take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data, its storage, and the personnel with access to it, and require a data processor you engage to give sufficient security guarantees and comply with them.

Engage a data processor only where it gives sufficient guarantees as to the reporting of security breaches to you, under a written contract binding it to obligations equivalent to your own.