ArmeniaLaw on Protection of Personal Data, cross-border transfer
Law of the Republic of Armenia on Protection of Personal Data, Law No. HO-49-N, Art. 27
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Armenia to a recipient outside Armenia must obtain the data subject's consent, rely on the destination being on the authorized body's published adequacy list or covered by an applicable treaty, or obtain the authorized body's prior written permission for a contract it has approved as providing adequate safeguards.
These lines are LexLint's reading of the law's text. Also read by: Head of the Personal Data Protection Agency of the Ministry of Justice of Armenia (the authorized body): decision No. ATPP-001/24 of establishing the list of states ensuring an adequate level of personal data protection under Article 27(5) of the Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.arlis.am/hy/acts/195045
- Guidance body
- Head of the Personal Data Protection Agency of the Ministry of Justice of Armenia (the authorized body): decision No. ATPP-001/24 of establishing the list of states ensuring an adequate level of personal data protection under Article 27(5) of the Law
- Open questions
- Does Article 27(1), which allows transfer to another country "եթե տվյալների փոխանցումը բխում է անձնական տվյալների մշակման նպատակներից և (կամ) անհրաժեշտ է այդ նպատակների իրագործման համար" ("if the transfer follows from the purposes of processing and/or is necessary for achieving them"), permit a transfer to a state without an adequate level of protection when the authorized body has not given the permission that Article 27(3) requires?
- Which United States organizations does the entry for the United States of America in the authorized body's list of states ensuring an adequate level of protection cover, given that the entry is qualified only by a parenthetical reading organizations and the list states no test for them?
What it makes you log
Logging duty
Article 27 sets the routes for a transfer abroad (consent, necessity for the purposes, an adequate destination, or the authority's permission of a contract) and requires an application to the authorized body before a transfer that needs its permission, which the authority decides within 30 days. The application is a filing and the authority's annual review of the adequacy list is its own duty. The Article requires no log or record to be kept.
- Kind
- None
- As of
What this law does
Art. 27 permits cross-border transfer with the data subject's consent, or where the transfer follows from or is necessary for the purposes of processing. Absent authorized-body permission, transfer to a state providing an adequate level of protection is permitted where adequacy follows an international treaty or the destination is on the authorized body's officially published list, reviewed at least annually.
Transfer to a non-adequate state requires the authorized body's prior written permission, granted only where a contract provides safeguards the body has itself approved as adequate; the processor must apply in writing before transfer, naming the destination country, recipient, data description, purpose, and the contract or draft contract, and the authority must approve or reject within 30 days.
Personal data held by state bodies may be passed to foreign state bodies only within ratified international treaties, and to non-state bodies in line with Art. 27 itself (Art. 27(6)). No standardized model-contract template mechanism exists, and no data localization is compelled.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .