Côte d'IvoireLaw No. 2013-450 on the Protection of Personal Data, cross-border transfer
Loi n° 2013-450, arts. 7, 26 (cross-border transfer)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdfIn force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Before transferring personal data to a third country, confirm that country affords a level of protection of privacy, freedoms and fundamental rights equivalent to or higher than Côte d'Ivoire's.
- Obtain ARTCI's prior authorization before implementing any processing that transfers personal data to a third country, and its permission again before the actual transfer takes place.
- Expect the Protection Body to monitor a cross-border transfer on a continuing basis in light of its purpose.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 7 subjects a transfer to a third country to the Protection Body's prior authorization, and Article 26 allows it only to a state with an equivalent or higher level of protection, with the Body's permission before the actual transfer and with regular monitoring of the transfer by the Body afterwards. Neither article requires the person responsible to keep a log or a record of the transfers. The Body's monitoring is supervision of the transfer, not a check of a kept record, so no audit expectation is given. The sections cited here carry no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 7 makes the transfer of personal data to a third country subject to ARTCI's prior authorization before implementation. Article 26 conditions that transfer on the destination state affording a level of protection of privacy, freedoms and fundamental rights equivalent to or higher than Côte d'Ivoire's with regard to the processing concerned, and requires the person responsible for the processing to obtain the Protection Body's permission before any actual transfer.
The transfer of personal data to a third country remains subject to the Protection Body's regular monitoring in light of its purpose. No commencement notice for the Act has been located in the Official Gazette.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .