Burkina FasoPersonal Data Protection Law, cross-border transfer of personal data
Loi n°001-2021/AN, arts. 31, 42-44 (transfert de données hors du Burkina Faso)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Licensing
- Audit expectation
- none
What it requires
- Before transferring personal data to a foreign country or an international organization, confirm that it assures a level of protection adequate to the protection Burkina Faso itself assures for privacy, fundamental freedoms and rights.NIST Privacy FrameworkCT.PO-P2
- Before any transfer of personal data outside Burkina Faso, obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party letting data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkPR.DS-P5
- Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal and professional rules and security measures in force there, or rely on an international convention or CIL-approved ad hoc or standardized safeguards.NIST Privacy FrameworkCT.PO-P2
- Absent an adequate level of protection at the destination, transfer personal data abroad only under a listed exception, such as the data subject's specific informed consent, contractual necessity, a vital interest, a bilateral or multilateral agreement, or the CIL's express authorization of adequate contractual clauses or internal rules.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 42 allows a transfer only to a country with an adequate level of protection and, before any transfer, requires the CIL's authorization, a confidentiality clause and a reversibility clause with the contracting party, and security measures that include a procedure of tests, analysis and evaluation of the measures taken. Article 44 lists the exceptions. The cited articles name no log or record and no inspection of one; the testing procedure checks security measures, not a record. The transfer trigger concerns where the data go, and the cited articles carry no scope clause.
- Kind
- None
- As of
What this law does
Article 31 requires the CIL's prior authorization before any transfer of personal data to a foreign country.
Article 42 bars a controller from transferring personal data to a foreign country or an international organization unless that country or organization assures a level of protection adequate to the protection Burkina Faso itself assures for privacy and fundamental rights and freedoms, and requires the controller, before any external transfer, to obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party to let data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.
Article 43 assesses the adequacy of a destination's protection against the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, the general and sectoral legal rules in force there, and the professional rules and security measures observed, and lets that adequacy also rest on an international convention Burkina Faso has joined or on ad hoc or standardized safeguards the CIL has approved, which the CIL can withdraw if exceptional circumstances in the destination country raise a risk of unauthorized access by local authorities.
Article 44 lets a transfer to a country without an adequate level of protection proceed only under a listed exception, including the data subject's specific, free, informed and unambiguous consent given after being told of the risks, contractual necessity, a vital interest, an exceptional-circumstances decree taken after the CIL's concurring opinion, an overriding legitimate interest the law provides for, a one-off and non-massive transfer necessary for an important public interest or a legal claim, a one-off transfer from a public register open to consultation, judicial mutual assistance, a bilateral or multilateral agreement Burkina Faso has joined, or the CIL's express and reasoned authorization of a contract carrying adequate contractual clauses or internal rules.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .