Law / 
Central African Republic
Loi n° 24.001 portant protection des données à caractère personnel, flux transfrontalier
Loi n° 24.001 du 25 janvier 2024, Chapitre III, articles 22 à 27 (flux transfrontalier)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Before transferring personal data outside the Central African Republic, confirm the destination offers a similar level of protection, or rely on one of the Act's specific derogations.NIST Privacy FrameworkCT.PO-P2
- Assess the destination's level of protection against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the legal, professional, and security rules it applies, before any transfer.NIST Privacy FrameworkID.DE-P2
- Do not let a recipient in a foreign State transfer the data onward to another State without your agreement as the original controller.NIST Privacy FrameworkCT.PO-P2
- Give the agency prior notice before transferring personal data to a State outside the CEMAC or CEEAC, and rely on the agency's authorization, supported by appropriate contractual clauses, where the destination lacks equivalent protection.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Chapter III bars a transfer of personal data to a foreign State unless the destination ensures a similar level of protection or a listed derogation applies (the person’s unambiguous consent, a contract, a vital interest, a public register and others), forbids onward transfer without the controller’s agreement, and requires prior notice to the agency, or its authorization with contractual clauses, for transfers outside the CEMAC and CEEAC. A notice to the agency and the controller’s duty to check the recipient and assess the necessity of a transfer are acts done at the time of the transfer, and the chapter does not require the controller to keep or produce a record of them. None of these articles requires a person to make, keep or produce a log or record.
- Kind
- None
- As of
What this law does
A controller may transfer personal data to a foreign State only where that State's legislation ensures a level of protection similar to the one this Act assures, assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules the third country applies.
Absent a similarly protective destination, a transfer may still go ahead where the person concerned, informed of the gap, has unambiguously consented, where it is necessary to perform a contract with or for the person or pre-contractual measures at their request, where a law requires it to safeguard an important public interest or a legal claim, where it safeguards the person's vital interest, or where it comes from a public register open to a person with a legitimate interest.
A recipient may not transfer the data onward to another State without the original controller's agreement. For a transfer to a State outside the CEMAC or CEEAC that does not assure an identical level of protection, the agency may still authorize it where the controller offers sufficient guarantees for privacy and fundamental rights, including through appropriate contractual clauses, and that authorization may be renewed on request.
A transfer to another country outside the CEMAC or CEEAC needs a sufficient level of protection there too, the controller must give the agency prior notice before any such transfer, and absent adequate protection the transfer may still proceed on the person's unambiguous consent, a contract's necessity, an important public interest or legal claim, or a public register. The Act states that it takes effect from its date of promulgation.
When LexLint raises it
When your app profile says your app ships a mobile app or processes personal data.
Back to the example · Lint your app
Page updated .