GabonLaw No. 025/2023, interconnection and cross-border transfer of personal data
Loi n°025/2023, articles 168 à 174 (interconnexion et transfert transfrontalier de données)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Licensing
- Audit expectation
- none
What it requires
- Obtain the APDPVP's prior authorization before transferring personal data to another State; consult the list of States the Authority has found to offer a sufficient level of protection.NIST Privacy FrameworkCT.PO-P2
- Absent that authorization, transfer only where the data subject has expressly consented to the specific transfer and it is necessary to safeguard their life or the public interest, to establish, exercise or defend a legal claim, to consult a public register, or to perform or negotiate a contract with or for the data subject's benefit, or where the APDPVP or a decree has found the processing otherwise offers a sufficient level of protection, such as through contractual clauses or binding internal rules.NIST Privacy FrameworkCT.PO-P2
- Expect the APDPVP to suspend or cancel a transfer, on a receipt served to that effect, once it finds the destination State does not offer a sufficient level of protection, and expect the suspension to lift once it finds that level established.
- Obtain the APDPVP's authorization before interconnecting your data systems with those of another public-service body pursuing a different public interest, or with another private party's systems pursuing a different main purpose.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 168 to 174 require the APDPVP's prior authorization for a transfer to another State and for an interconnection, and set the exceptions, the list of States with a sufficient level of protection and the suspension of a transfer. They state no log, register or audit duty for a controller. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 171 conditions any transfer of personal data to another State on the APDPVP's prior authorization, which the Authority grants only once it is satisfied the destination State assures a sufficient level of protection, judged by that State's rules, its security measures, and the processing's own purpose, duration, nature, origin and destination; the APDPVP publishes the list of States it has found to offer a sufficient level of protection.
Article 173 lets a controller transfer to a State that does not meet article 171's standard only where the data subject has expressly consented to that specific transfer and it is necessary to safeguard the person's life or the public interest, to establish, exercise or defend a legal claim, to consult a public register, or to perform or negotiate a contract with or for the person's benefit, or otherwise by a decision of the APDPVP or a decree finding the processing offers a sufficient level of protection through means such as contractual clauses or binding internal rules.
Article 174 has the APDPVP issue a receipt barring a transfer once it finds the destination State's protection insufficient, informing officials and the public without delay, and enjoining a controller to suspend or cancel a transfer a pending declaration reveals; it lifts the suspension once it finds the State's protection now sufficient.
Articles 168 to 170 separately condition on the APDPVP's authorization any interconnection of information systems belonging to different public-service bodies pursuing different public interests, or to different private parties pursuing different main purposes, and record every interconnection request and authorization in the public register of processing activities.
When LexLint raises it
When your app profile says your app distributes a software product or processes personal data.
Back to the example · Lint your app
Page updated .