Law / 
Central African Republic
Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier
Loi n° 24.001 du 25 janvier 2024 Chapitre II (motifs de licéité, données librement accessibles) et Chapitre III (flux transfrontalier), articles 11 à 27
In force since .
A personal data rule binding public and private bodies.
- Obligation class
- Consent, Transfer, Biometric
- Audit expectation
- none
What it requires
- Before relying on data a person has made freely accessible as your lawful basis for collecting it, confirm your use fits the context in which the person made it accessible; freely accessible data supports the legitimate-interest basis but is not an exemption from the Act's other duties.NIST AI RMFMEASURE 2.10
- Before transferring personal data you collected in the Central African Republic, or personal data about a person there, to another country, confirm the destination offers a similar level of protection or rely on one of the Act's specific derogations.no control in the NIST AI RMF
- Give the data protection agency prior notice before transferring personal data to a State outside the CEMAC or CEEAC, and rely on the agency's authorization, supported by appropriate contractual guarantees, where the destination lacks equivalent protection.no control in the NIST AI RMF
- Get the data subject's explicit consent, or rely on one of the Act's other listed derogations, before collecting or processing a sensitive category of data such as biometric, genetic, health, political, religious, or criminal-record data, whatever the source.NIST AI RMFMAP 1.6
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- ETSI EN 304 223
- 5.1.4-3Where oversight is a risk control, the technical measures behind it are built, verified and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Articles 11 to 27 set the lawful bases for processing (including data the person made freely accessible), the rules for transfers abroad and to CEMAC or CEEAC States, and interconnection. The one step toward the data protection agency is a prior notice of a transfer to a State outside CEMAC or CEEAC (article 25), which is a notification and not a log. The articles name no log, audit, auditor, retention period or access right for a record. The articles state no territorial hook.
- Kind
- None
- As of
What this law does
Loi n° 24.001 reaches personal data wherever a controller finds it, including data a person has made publicly accessible online. A data subject who has made their own personal data freely accessible supports a controller's reliance on the legitimate-interest lawful basis for processing it, provided the use fits the context in which the person made the data accessible, but the Act does not state that publicly accessible data falls outside its scope or its other duties.
A controller may transfer personal data, wherever it was collected, to a foreign State only where that State's own legislation ensures a level of protection similar to the one this Act assures, or under one of the Act's listed derogations, the data subject's informed and unambiguous consent, a contract's necessity, an important public interest or legal claim, a vital interest, or a public register.
A transfer to a State outside the CEMAC or CEEAC needs the controller to give the data protection agency prior notice before the transfer, and absent an equivalent level of protection there the agency may still authorize it where the controller offers sufficient contractual guarantees.
Sensitive categories of personal data, including biometric, genetic, health, political, religious, and criminal-record data, may be processed only on the data subject's explicit consent or one of the Act's other listed derogations, whatever the source from which a controller obtained them. The Act states that it takes effect from its date of promulgation.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .