Ley de Protección de Datos Personales, comunicación internacional de datos

Article 27 bars personal data that has been processed, or obtained for processing, from being communicated, assigned or transferred to countries that do not provide a level of legal protection comparable to the Law's, unless the Órgano Rector de Protección de Datos Personales gives its prior authorization. Article 27 provides that the level of protection of the destination country is assessed in light of all the circumstances of the transfer and the category of data requested.

Article 28 exempts transfers resulting from treaties or conventions to which Equatorial Guinea is a party, transfers to which the data subject has given unequivocal consent, transfers for international judicial assistance or for medical prevention, diagnosis or care, transfers necessary or legally required for a public interest, money transfers under specific legislation, transfers made from a public register at the request of a person with a legitimate interest, and transfers necessary for a contract in the data subject's interest.