Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, cross border transfer
Lei n.º 133/V/2001 de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 35-36 (transferência internacional de dados)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Confirm that a destination country ensures an adequate level of data protection before transferring personal data there, and expect the CNPD to decide adequacy by the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, and the legal, professional and security rules in force there.NIST Privacy FrameworkCT.PO-P2
- Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the CNPD's permission based on the data subject's unambiguous consent or one of the law's other listed grounds, such as contractual necessity, an important public interest or legal claim, the data subject's vital interests, or a public register open to consultation.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkGV.PO-P5
- Present sufficient guarantees for the protection of privacy and fundamental rights and freedoms, in particular appropriate contractual clauses, to obtain the CNPD's authorization for a transfer or set of transfers to a country without an adequate level of protection.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 35 and 36 allow a transfer abroad only to a country with an adequate level of protection, decided by the CNPD, or under the CNPD's permission for the listed derogations and for sufficient guarantees such as contractual clauses. They require no log or record of transfers. The cited articles state no territorial hook.
- Kind
- None
- As of
What this law does
Article 35 permits transfer of personal data undergoing or intended for processing only in compliance with this law and other applicable data protection legislation and, for a transfer abroad, to a country that ensures an adequate level of protection, which Article 35(2) assesses in light of all the circumstances of the transfer, and leaves it for the CNPD to decide whether a foreign State ensures that adequate level.
Article 36 lets the CNPD permit a transfer to a country that does not ensure an adequate level of protection where the data subject has unambiguously consented, or where the transfer is necessary for a contract between the data subject and the controller or for pre-contractual steps at the data subject's request, for a contract in the data subject's interest between the controller and a third party, for an important public interest or a legal claim, or to protect the data subject's vital interests, or is made from a public register open to consultation by the general public or a person who can show a legitimate interest.
Article 36 also lets the CNPD authorize a transfer or set of transfers to a country without an adequate level of protection where the controller presents sufficient guarantees for the protection of privacy and fundamental rights and freedoms, in particular through appropriate contractual clauses. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .