DjiboutiDigital Code, Book I: cross-border transfer of personal data
Code Numérique, Livre Premier, Arts. 99 à 102 (transferts vers un pays tiers)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a country or international organization outside Djibouti unless it offers an adequate level of protection or another authorized safeguard applies.
- Apply the same adequacy or safeguard requirement to an onward transfer from the destination country or organisation to a further one, not only to the first transfer out.
- Where you rely on an Article 102 exception instead, use one the article lists, and where that is the data subject's consent, obtain it expressly for the specific transfer.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 99 to 102 allow a transfer to a third country or international organization only where the Commission finds adequate protection or one of the listed conditions applies (among them the data subject's express consent to the transfer), and let the Commission withdraw a country from its list, refuse a declared transfer or order a transfer to stop. None of the four articles requires a record of a transfer to be made or kept or names a check of one. Article 103, which provides for the Commission's regular control of transfers, is not cited by this row. No scope clause is cited, so the row names no territorial hook.
- Kind
- None
- As of
What this law does
Article 99 bars a controller or processor from transferring personal data to a country or international organisation outside Djibouti unless that country or organisation ensures a level of protection equivalent and sufficient to Book I's own, and applies the same requirement to an onward transfer from the destination country or organisation to a further one.
Article 100 sets the factors the Commission weighs to determine whether that level of protection is equivalent and sufficient, including the rule of law, the respect for fundamental freedoms and rights, and the legislation, general and sectoral, in force in the destination country or organisation.
Article 101 lets the Commission withdraw a country or organisation from its adequacy list, refuse a declared transfer, or order an existing transfer to that destination to stop, once it finds the destination no longer ensures a sufficient level of protection.
Article 102 lets a controller or processor transfer personal data to a non-adequate third country outside the African Union, or to a non-adequate international organisation, only on the conditions it lists, including the data subject's express consent to the specific transfer, contractual necessity between the controller and the data subject or a third party, and a legally compelling public-interest ground.
The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .