AngolaLaw on the Protection of Personal Data, cross border transfer
Lei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Notify the Agência de Protecção de Dados before transferring personal data to a country that ensures a level of protection at least equal to this law's, and expect the APD to assess adequacy by the nature, purpose and duration of the processing, the destination country and the legal, professional and security rules in force there.
- Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the APD's authorisation on one of the law's listed grounds, such as the data subject's unequivocal, express and written consent, an applicable international treaty, humanitarian aid, contractual necessity, an important public interest or legal claim, the data subject's vital interests, a publicly accessible source, or the recipient's contractual guarantee of adequate protection on APD-set terms.
- Rely on uniform, binding internal privacy and data protection rules to satisfy the adequate protection requirement for a transfer between companies of the same corporate group.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 33 and 34 make a transfer to a country with adequate protection subject to notification to the Agência de Protecção de Dados, and a transfer elsewhere subject to its authorization on stated grounds. They require no log or record of transfers and name no audit.
- Kind
- None
- As of
What this law does
Article 33 subjects the international transfer of personal data to a country that ensures a level of protection at least equal to this law's to notification to the APD, which decides whether a state provides that level by weighing the nature of the data, the purpose and duration of the processing, the destination country, and the legal, professional and security rules in force there.
Article 34 conditions transfer of personal data to a country that does not ensure an adequate level of protection on the APD's authorisation, granted only where the data subject has given unequivocal, express and written consent, an international treaty or agreement to which Angola is party applies, the transfer answers a humanitarian aid request, the transfer is necessary for a contract with or for the benefit of the data subject, the transfer serves an important public interest or a legal claim, the transfer protects the data subject's vital interests where they cannot consent, the data originates from a publicly accessible source, or the recipient contractually guarantees the transferred data an adequate level of protection on terms the APD sets.
Article 34 also lets a group of companies satisfy the adequate protection requirement for transfers between them through binding uniform internal rules on privacy and data protection.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .