BelizeData Protection Act 2021, cross-border transfer of personal data
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdfA cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Before transferring personal data of a person in Belize outside the country, confirm the destination has an adequate level of protection or put an appropriate safeguard in place, such as standard contractual clauses or binding corporate rules.
- This condition does not apply to a transfer made for the purpose of cloud storage.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Binding corporate rules for transfers outside Belize must specify mechanisms for verifying compliance within the group, for reporting and recording changes to the rules, and for making the verification results available to the supervisory authority or the Commissioner. The record is one of changes to the rules and of verification results, not an event log, and section 26 states no interval for the verification. The scope clause in section 3 lies outside sections 23 to 29, so no territorial hook is coded.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act 2021, section 26(1)(j), (k) and (l)
- Trigger
- personal_data_processing
What this law does
Part IV requires a transferor sending personal data outside Belize to ensure either an adequate level of protection, assessed against factors including the destination country's law and international obligations, or an appropriate safeguard, such as a legally binding instrument between public authorities, binding corporate rules, or standard or authorised contractual clauses.
Section 23(2) expressly disapplies both requirements, and the need for the data subject's consent, to a transfer made for the purposes of cloud storage. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .