Republic of the CongoLaw No. 29-2019, cross-border transfer of personal data
Loi n° 29-2019, articles 23 à 25 (transfert transfrontalier de données à caractère personnel)
In force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a country outside the Republic of the Congo unless it offers a sufficient level of protection for the privacy and fundamental rights and freedoms of the persons the data concerns, and inform the national commission of the transfer in advance.
- Rely on the article 24 derogation only for a one-off, non-massive transfer, and only where the data subject has expressly consented, or the transfer is necessary to protect that person's life, safeguard the public interest, allow the establishment, exercise or defence of a legal claim, or perform a contract between you and the data subject.
- Where the destination country does not offer a sufficient level of protection and no article 24 derogation applies, obtain the national commission's authorization for the transfer by showing sufficient guarantees for privacy, fundamental rights and freedoms, and the exercise of the corresponding rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 23 to 25 allow a transfer to a third country only if it ensures adequate protection, allow limited exceptions, and let the commission authorize a transfer on sufficient safeguards. Article 23 has the controller inform the commission in advance of any transfer, which is a notification and not a record the controller keeps; the Law names no log, register or retention period for transfers.
- Kind
- None
- As of
What this law does
Article 23 bars a cross-border transfer of personal data unless the third country offers a sufficient level of protection for the privacy and fundamental rights and freedoms of the persons the transferred data does or may concern, measured against the security measures applied, the characteristics of the processing (including its purposes and duration), and the nature, origin and destination of the data, and requires the controller to inform the national commission of any such transfer in advance.
Article 24 lets a controller transfer personal data to a third country that does not meet the article 23 condition where the transfer is a one-off, non-massive transfer and the data subject has expressly consented to it, or the transfer is necessary to protect that person's life, safeguard the public interest, allow the establishment, exercise or defence of a legal claim, or perform a contract between the controller and the data subject.
Article 25 lets the national commission authorize a transfer or a set of transfers to a third country that does not offer a sufficient level of protection where the controller offers sufficient guarantees for the privacy, fundamental rights and freedoms of the data subjects and the exercise of their corresponding rights, on a duly reasoned request from the controller.
Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on . The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, , and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .